Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
232 detections
Filters
Last updated
All Time
Detection languages
92
81
28
10
8
Contributors
42
40
36
26
17
Categories
110
82
65
31
22
Platforms
87
83
18
17
11
Products / Services
32
28
25
23
21
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
6
5
5
3
3
IDS Classtypes
2
IDS Protocols
2
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
This rule monitors Android device process events for the execution of 'adb' commands aimed at modifying sensitive system configurations. It specifically tracks attempts to enable accessibility services, toggle wireless debugging, or establish unauthorized ADB pairings. The rule identifies potential malicious intent by aggregating multiple suspicious configuration changes on the same device within a short time window.
Detects instances where a process has been elevated on a Windows system, as indicated by specific log messages containing 'Process is elevated' within the command line or image file name fields.
Detects local privilege escalation attempts targeting Acronis backup plugins for cPanel, WHM, and Plesk. The rule monitors for instances where backup-related processes or binaries located within control panel paths are executed with root privileges when the parent process was not originated by root, a behavior indicative of exploiting insecure file permissions.
Detects a sequence of events where a process within a container namespace attempts to interact with the host filesystem (e.g., /proc/1/root, nsenter) followed shortly by an unexpected gain of root privileges or execution of setuid(0) that is not associated with legitimate su or sudo usage.
Detects unauthorized or suspicious modifications to the SyncRootManager registry keys. This rule is designed to identify potential exploitation attempts, such as the ShieldCrash zero-day, which abuse the Windows CFAPI sync-root mechanisms to achieve privilege escalation or bypass security features. Legitimate synchronization software is explicitly excluded from this detection.
This rule monitors Android device process events for the execution of 'adb' commands aimed at modifying sensitive system configurations. It specifically tracks attempts to enable accessibility services, toggle wireless debugging, or establish unauthorized ADB pairings. The rule identifies potential malicious intent by aggregating multiple suspicious configuration changes on the same device within a short time window.
This rule monitors Android device process events for the execution of 'adb' commands aimed at modifying sensitive system configurations. It specifically tracks attempts to enable accessibility services, toggle wireless debugging, or establish unauthorized ADB pairings. The rule identifies potential malicious intent by aggregating multiple suspicious configuration changes on the same device within a short time window.
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
Detects unauthorized or suspicious modifications to the SyncRootManager registry keys. This rule is designed to identify potential exploitation attempts, such as the ShieldCrash zero-day, which abuse the Windows CFAPI sync-root mechanisms to achieve privilege escalation or bypass security features. Legitimate synchronization software is explicitly excluded from this detection.
Detects the loading or execution of pkexec.so, which is indicative of exploitation attempts targeting CVE-2021-4034 (PwnKit). This vulnerability allows for local privilege escalation on Linux systems, including within compromised containers.
Detects the loading or execution of pkexec.so, which is indicative of exploitation attempts targeting CVE-2021-4034 (PwnKit). This vulnerability allows for local privilege escalation on Linux systems, including within compromised containers.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
This rule monitors Android device process events for the execution of 'adb' commands aimed at modifying sensitive system configurations. It specifically tracks attempts to enable accessibility services, toggle wireless debugging, or establish unauthorized ADB pairings. The rule identifies potential malicious intent by aggregating multiple suspicious configuration changes on the same device within a short time window.
This rule monitors Android device process events for the execution of 'adb' commands aimed at modifying sensitive system configurations. It specifically tracks attempts to enable accessibility services, toggle wireless debugging, or establish unauthorized ADB pairings. The rule identifies potential malicious intent by aggregating multiple suspicious configuration changes on the same device within a short time window.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects a sequence of events where a process within a container namespace attempts to interact with the host filesystem (e.g., /proc/1/root, nsenter) followed shortly by an unexpected gain of root privileges or execution of setuid(0) that is not associated with legitimate su or sudo usage.
Page 2 of 12