Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects registry key creation under the Windows SyncRootManager path (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager) initiated by a process that is not a known legitimate cloud sync client. This technique is associated with CVE-2026-41091 (RedSun) for privilege escalation via Cloud Files sync root provider registration.
Identifies file, registry, network, and process indicators associated with the @mastra/* npm supply chain compromise. This rule detects the presence of specific malicious files, registry modifications for persistence, outbound network connections to known command and control (C2) infrastructure, and the execution of malicious scripts related to the attack.
This rule detects cross-process memory allocation, memory writing, and thread creation activities targeting critical Windows processes like svchost.exe or explorer.exe. Such actions are commonly utilized by attackers for code injection (e.g., Payouts King tradecraft) to execute arbitrary code within the context of trusted processes, enabling evasion or persistence.
Detects the SharkLoader malware (StrikeShark campaign) establishing persistence by writing references to 'SystemSettings.exe' located within specific AppData working directories (e.g., 'xwreg', 'xgdf') into Windows Registry Run keys.
This rule monitors for suspicious activity linked to files or processes within the Windows temporary directory. It identifies three distinct malicious patterns: (1) sensitive privilege usage (e.g., SeDebugPrivilege) by processes running from temp; (2) presence of known malicious file names associated with a specific campaign (vile_*.ico, vile_*.lnk, etc.); and (3) PowerShell execution of a specific decryptor shortcut file from the temp directory.
Detects suspicious activity involving the combination of user or network namespace creation using 'unshare' or 'ip' and subsequent manipulation of kernel networking queues using 'tc' (Traffic Control). This behavioral pattern is frequently observed in Linux kernel exploits designed to achieve local privilege escalation by creating namespaces and using the 'tc' subsystem to trigger vulnerabilities. The rule further refines matches by flagging commands or parent processes residing in directories associated with staging or temporary storage, such as /tmp or /dev/shm.
Detects a potential privilege escalation attempt where an unprivileged user executes a SUID-capable binary (su, sudo, passwd), followed immediately by the creation of a root-owned shell process. This pattern is indicative of exploitation of local privilege escalation vulnerabilities, such as page cache poisoning (e.g., CVE-2026-46331).
This rule detects potentially malicious activity involving the 'nvdaHelperRemote.dll' library and suspicious parent-child process relationships. It identifies instances where a process named 'COU_ITR' spawns suspicious children (cmd, powershell, rundll32), or where 'nvdaHelperRemote.dll' is loaded from non-standard or user-writable directories (such as AppData, Temp, Downloads, or Desktop), which is indicative of DLL hijacking or side-loading techniques.
Detects the suspicious combination of 'aa-exec' (commonly associated with AppArmor or specific container runtime wrappers) being followed by the execution of 'unshare' with flags used to manipulate kernel namespaces (user, network). This pattern is often indicative of container breakouts or privilege escalation attempts where an adversary leverages namespace isolation to gain higher privileges on the host.
Detects suspicious sequences of AWS CloudTrail API calls originating from non-console or non-service-account sources (CLI, curl, etc.). The rule flags scenarios where reconnaissance via 'GetCallerIdentity' is immediately followed by sensitive IAM modifications (CreateUser, CreateAccessKey) or privilege escalation attempts (AssumeRole), which may indicate the use of exfiltrated credentials.
Detects the execution of the 'unshare' utility by non-root users with flags designed to create new user or network namespaces. This behavior is often associated with container escape attempts, privilege escalation, or efforts to bypass local security controls by creating isolated environments.
Detects evidence of the DirtyClone (CVE-2026-43503) Linux kernel privilege escalation exploit. The rule identifies a multi-stage attack chain, including the compilation of the exploit binary, creation of unprivileged user and network namespaces required for the exploit, and the use of the 'ip' utility to configure XFRM states/policies for page cache corruption.
Detects in-memory privilege escalation patterns associated with the 'DirtyClone' (CVE-2026-43503) vulnerability. The rule monitors for a sequence of events where an unprivileged process utilizes 'unshare' to create user and network namespaces in conjunction with IPsec XFRM tunnel configurations, immediately followed by the execution of 'su' or 'sudo', resulting in unauthorized root access without disk-based modification of binary files.
Detects potential persistence attempts via cron job manipulation by unprivileged service accounts (such as www-data) or patterns indicative of the 'lambsys' threat, including usage of known writable temporary directories, non-interactive crontab installations, and aggressive execution schedules.
This rule detects a multi-stage attack chain where a WinRAR or UnRAR process, spawned by an email client (Outlook or Thunderbird), extracts files directly into the Windows startup directory. It then correlates this with the execution of common scripting or command-line tools (such as mshta, wscript, powershell, or cmd) from that same startup location within 30 seconds of the extraction event.
Detects the BQTLock malware's User Account Control (UAC) bypass technique. This technique involves modifying the registry key HKCU\Software\Classes\mscfile\shell\open\command to hijack the EventViewer COM object. Subsequently, eventvwr.exe is launched, which auto-elevates and executes BQT.exe, bypassing UAC.
Detects the creation of a Windows kernel-mode driver service where the driver binary is located in a suspicious, non-standard directory like Temp, Public, or AppData. This is a common persistence technique for malware, including EDR killers that use vulnerable drivers.
This rule detects command line activity associated with the exploitation of a Linux kernel vulnerability involving packet editing (often referred to as the 'pedit' or 'act_pedit' vulnerability). It monitors for the execution of exploit-specific binaries, kernel module loading of 'act_pedit', use of 'unshare' for namespace abuse, and configuration of 'tc' (traffic control) filters related to the exploit.
This rule detects activities associated with the DirtyClone (CVE-2026-43503) privilege escalation vulnerability on Linux systems. It monitors for the execution of exploit binaries from world-writable directories, the modification of critical process memory mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) by non-root users, the use of unshare to create user namespaces as a precondition, and the anomalous spawning of shells by the SUID binary /usr/bin/su.
Detects execution of AWS CLI subcommands used for credential or identity enumeration (e.g., sts get-caller-identity, iam get-user) when spawned from Amazon Q-related or development environment processes (Node.js/VS Code). This behavior is indicative of potential malicious activity involving a compromised MCP server configuration file (CVE-2026-12957).
Detects execution of the CVE-2026-46331 exploit chain, which utilizes unprivileged user namespace creation to escalate privileges followed by malicious Linux traffic control (tc) pedit actions to achieve kernel-level page cache corruption.
Page 73 of 401