Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects two distinct malicious activities related to Gitea installations: 1) Container escape attempts involving 'act-runner' processes configured with dangerous flags like --pid=host, --cap-add=ALL, or usage of nsenter, and 2) Potential administrative impersonation attempts against a Gitea instance via injection of the X-WEBAUTH-USER: admin HTTP header.
Detects attempts to escape a Docker container to the host filesystem by exploiting directory traversal vulnerabilities within the 'docker cp' command. It identifies suspicious CLI arguments indicating path traversal, the presence of known PoC artifacts, and file write events initiated by the Docker daemon outside of expected container directory paths.
This rule detects potential local privilege escalation attempts targeting the AnyDesk service. An attacker can exploit the insecure permissions of the 'adprinterpipe' named pipe created by the AnyDesk service to impersonate a client and execute arbitrary commands with NT AUTHORITY\SYSTEM privileges. The rule monitors for suspicious process creation, COM registration changes, anomalous pipe connections, and suspicious DLL loads stemming from AnyDesk processes.
Detects execution of the 'docker cp' command containing directory traversal sequences ('../', '..") in the command line arguments. This pattern is indicative of attempts to exploit path traversal vulnerabilities to read or write files outside the intended container scope, potentially leading to container escape.
This rule detects the execution of container runners (act-runner/gitea-act-runner) with insecure container isolation flags, such as mounting the host root filesystem, disabling security profiles (seccomp/apparmor), or running with host namespaces and excessive capabilities. These configurations indicate potential container escape attempts or misconfigurations that allow significant host-level access.
Detects instances where ImageMagick (magick.exe or convert.exe) spawns Ghostscript (gswin64c.exe, gswin64.exe, or gs.exe) from a directory other than the standard Ghostscript installation path. This behavior is indicative of a search order hijack where an attacker places a malicious binary in a location searched before the legitimate Ghostscript installation.
Detects the execution of the 'unshare' utility on Linux systems using command-line arguments that indicate the creation of new namespaces, particularly targeting user and network namespace isolation. Adversaries often use 'unshare' to bypass security controls or to facilitate container escapes by isolating processes from the host's environment.
This rule detects the use of specific Linux utilities often associated with local privilege escalation or container escape techniques. It monitors for commands involving 'unshare' with flags that allow user or network namespace manipulation, network traffic control ('tc') commands specifically interacting with 'pedit' or 'qdisc' which can be abused for kernel-level manipulation, 'ip netns' commands to manage network namespaces, and execution of known exploit-related filenames like 'pedit_cow_demo' or 'packet_edit_meme'.
Detects non-root users utilizing the 'tc' or 'ip' utilities to interact with kernel traffic control structures (qdisc/filter/action) specifically involving 'pedit' actions. This activity is a documented prerequisite for exploiting CVE-2026-46331, a vulnerability enabling page cache poisoning and local privilege escalation.
Detects the KuinaExtractor UAC bypass technique, which exploits the auto-elevated 'SilentCleanup' scheduled task. The rule identifies suspicious activity via two patterns: the execution of 'cleanmgr.exe' from an unexpected parent process (bypassing normal task scheduler invocation) or the explicit execution of 'schtasks.exe' to trigger the 'SilentCleanup' task.
Detects persistence from the postcss-minify-selector-parser npm typosquat Windows RAT (JFrog, Jun 2026). The Python/Nuitka implant (launched as chost.exe, a renamed python.exe running loader.py) writes an HKCU Run value named 'csshost'. Fires on a CurrentVersion\Run write where the value name is csshost OR the writing process is chost.exe.
Detects the creation of user namespaces combined with network namespace flags using 'unshare' or 'ip netns' by non-root users. This activity is a necessary precursor for exploiting the CVE-2026-46331 vulnerability (pedit COW) to gain CAP_NET_ADMIN capabilities and subsequently corrupt the Linux page cache.
Detects unauthorized writes to the /proc/sys/vm/drop_caches interface by non-root users or processes that are not standard system maintenance tools. This activity is a known post-exploitation technique used by exploits like the 'pedit' COW exploit to clear cached setuid binary pages in memory for evasion or cleanup.
Detects suspicious execution of kernel-related networking commands ('unshare', 'ip', 'modprobe', 'insmod') by non-root users that are associated with the setup or exploitation phases of the 'DirtyClone' Linux kernel privilege escalation exploit. The rule specifically looks for IPsec tunnel/policy manipulation or the loading of ESP/RxRPC kernel modules by unprivileged accounts.
Detects potential cross-process memory injection activity by monitoring for a non-debugger process that performs both NtAllocateVirtualMemory and WriteProcessMemory operations against a sensitive GUI target process within a short 5-minute correlation window.
Detects the loading of 'mscoree.dll' or 'msvcp140.dll' from the 'C:\ProgramData\' directory by processes masquerading as '.NET Runtime Optimization Service' or originating from a highly suspicious, obfuscated folder path. This behavior is indicative of malware attempting to evade detection through DLL side-loading or process masquerading, as legitimate .NET Runtime Optimization Service processes should not load these DLLs from this location or from such unusual paths.
Modular remote access trojan associated with long-term espionage intrusions
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Modular remote access trojan associated with long-term espionage intrusions
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Photo-themed ZIP phishing campaign dropping a Node.js implant
Page 54 of 401