Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
180 detections
Filters
Last updated
All Time
Detection languages
91
29
14
14
11
Contributors
66
42
28
6
6
Categories
125
119
42
35
32
Platforms
120
95
36
27
8
Products / Services
85
38
27
21
18
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
3
3
2
2
IDS Classtypes
3
1
IDS Protocols
2
2
Detects a sequence of events where a process within a container namespace attempts to interact with the host filesystem (e.g., /proc/1/root, nsenter) followed shortly by an unexpected gain of root privileges or execution of setuid(0) that is not associated with legitimate su or sudo usage.
Detects a sequence of events where a process within a container namespace attempts to interact with the host filesystem (e.g., /proc/1/root, nsenter) followed shortly by an unexpected gain of root privileges or execution of setuid(0) that is not associated with legitimate su or sudo usage.
Detects a sequence of events where a process within a container namespace attempts to interact with the host filesystem (e.g., /proc/1/root, nsenter) followed shortly by an unexpected gain of root privileges or execution of setuid(0) that is not associated with legitimate su or sudo usage.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects unauthorized attempts to manipulate cgroup files (e.g., cgroup.procs) within Kubernetes pods using kubectl exec/attach sessions. This technique is often associated with SPIRE attestation spoofing or container escape attempts where an attacker attempts to influence process management or isolation constraints from within the container via the Kubernetes API.
Detects unauthorized programmatic invocation of ADB pair or connect commands by an Android application. This activity is indicative of the RatHat malware family attempting to abuse Accessibility Services and Wireless Debugging to self-pair with the local ADB daemon, thereby bypassing the Android application sandbox.
Detects unauthorized programmatic invocation of ADB pair or connect commands by an Android application. This activity is indicative of the RatHat malware family attempting to abuse Accessibility Services and Wireless Debugging to self-pair with the local ADB daemon, thereby bypassing the Android application sandbox.
This rule detects processes or file operations attempting to interact with the Docker daemon socket ('/var/run/docker.sock') by non-standard or unauthorized binaries. Accessing the Docker socket from a container can allow an attacker to escape to the host, manipulate other containers, or perform privileged actions on the Docker daemon.
This rule monitors process command lines for identifiers related to virtual machine communication interfaces such as 'VMCI', 'AF_VSOCK', 'svm_cid', or 'vm:2'. It specifically targets both the ESET Remote Administrator (ERA) Agent and any other processes utilizing these communication mechanisms, which can be indicators of inter-process communication across virtual machine boundaries or potential hypervisor-related activity.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
This rule monitors process command lines for identifiers related to virtual machine communication interfaces such as 'VMCI', 'AF_VSOCK', 'svm_cid', or 'vm:2'. It specifically targets both the ESET Remote Administrator (ERA) Agent and any other processes utilizing these communication mechanisms, which can be indicators of inter-process communication across virtual machine boundaries or potential hypervisor-related activity.
This rule monitors process command lines for identifiers related to virtual machine communication interfaces such as 'VMCI', 'AF_VSOCK', 'svm_cid', or 'vm:2'. It specifically targets both the ESET Remote Administrator (ERA) Agent and any other processes utilizing these communication mechanisms, which can be indicators of inter-process communication across virtual machine boundaries or potential hypervisor-related activity.
Page 3 of 9