Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
The following analytic detects kernel-level events where a setuid binary launches a shell or interpreter with a NULL argument vector, which occurs when a privilege escalation exploit gains root and executes a process via execve() without constructing a legitimate argument array.
Linux su Login Shell Invocation
Cortex XDR
Detects the invocation of the 'su' command with a login-shell style argument (e.g., 'su -'), which is used to switch user contexts and potentially elevate privileges.
Detects the creation or modification of files within the "sudoers.d" directory on Linux systems.
Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions.
Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.
Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions.
Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.
This rule detects potential attempts to exploit kernel vulnerabilities related to the Stream Control Transmission Protocol (SCTP) within a containerized environment, followed by suspicious file creation activity in sensitive system directories (e.g., /root/). It correlates logs showing SCTP socket configuration activity with subsequent filesystem modifications within a short 5-minute window.
This rule detects suspicious process execution chains where common web application servers (gunicorn, uwsgi, celery) spawn command-line utilities (bash, sh, curl, wget, python3) containing strings indicative of Python object inspection or class pollution. This pattern is commonly associated with attempts to exploit server-side vulnerabilities for remote code execution or post-exploitation activities.
This rule detects suspicious process execution chains where common web application servers (gunicorn, uwsgi, celery) spawn command-line utilities (bash, sh, curl, wget, python3) containing strings indicative of Python object inspection or class pollution. This pattern is commonly associated with attempts to exploit server-side vulnerabilities for remote code execution or post-exploitation activities.
Detects execution of a Bun binary from a temporary, download-staging or node_modules path
rather than a standard installation location. The keyv/cacheable stage-1 loader downloads a
platform-matched standalone Bun runtime from the oven-sh GitHub release URL and uses it to
execute the second stage, specifically to bypass the host Node version and any Node-level
monitoring. Staging directories follow a 'bun-dl-*' naming pattern.
rather than a standard installation location. The keyv/cacheable stage-1 loader downloads a
platform-matched standalone Bun runtime from the oven-sh GitHub release URL and uses it to
execute the second stage, specifically to bypass the host Node version and any Node-level
monitoring. Staging directories follow a 'bun-dl-*' naming pattern.
This rule detects activities indicative of Android APK repackaging and the manual injection of the Frida-gadget library to bypass security controls like SSL pinning. It monitors for the use of APK patching tools followed by ADB installation commands, the installation of specific patched APK names, the presence of the Frida-gadget shared library file, and system-level signature mismatch errors from the PackageManager.
Detects the execution of common shell utilities, interpreters, or configuration commands initiated by QEMU or KVM processes. This often indicates the use of virtualized environments to execute payloads, bypass security controls, or hide artifacts within a host system, especially when correlated with process crashes related to hypervisor components.
Detects the execution of common shell utilities, interpreters, or configuration commands initiated by QEMU or KVM processes. This often indicates the use of virtualized environments to execute payloads, bypass security controls, or hide artifacts within a host system, especially when correlated with process crashes related to hypervisor components.
This rule detects potential attempts to exploit kernel vulnerabilities related to the Stream Control Transmission Protocol (SCTP) within a containerized environment, followed by suspicious file creation activity in sensitive system directories (e.g., /root/). It correlates logs showing SCTP socket configuration activity with subsequent filesystem modifications within a short 5-minute window.
This rule detects the execution of 'pkexec' or 'sudo' by a low-privilege web server process (e.g., Apache, Nginx, PHP-FPM) that results in a process running with root privileges. This pattern is indicative of privilege escalation attempts targeting local vulnerabilities, such as CVE-2021-4034 (PwnKit) or CVE-2021-3156 (Baron Samedit), where a compromised web application account attempts to elevate to root.
Detects the creation of a file named 'license.tmp' within the '/var/tmp/' directory. This location and filename pattern is often associated with the staging or execution of temporary files, potential persistence mechanisms, or obfuscated payloads commonly found in Linux-based malware or adversary activity.
Detects the creation of a file named 'license.tmp' within the '/var/tmp/' directory. This location and filename pattern is often associated with the staging or execution of temporary files, potential persistence mechanisms, or obfuscated payloads commonly found in Linux-based malware or adversary activity.
Detects command-line execution or application configuration referencing the disabling of TLS certificate verification, specifically using 'OpenSSL::SSL::VERIFY_NONE' or 'http.verify_mode'. This pattern is often indicative of malicious activity attempting to bypass secure communication validation, such as in supply chain attacks involving compromised dependencies or backdoors.
Detects unauthorized modifications to the /etc/init.d/workplace initialization script on SonicWall SMA appliances, specifically looking for additions of commands that launch the KNUCKLEBALL Python-based loader (deploy_new.py). This behavior indicates an adversary attempting to establish boot-time persistence.
This rule detects activities indicative of Android APK repackaging and the manual injection of the Frida-gadget library to bypass security controls like SSL pinning. It monitors for the use of APK patching tools followed by ADB installation commands, the installation of specific patched APK names, the presence of the Frida-gadget shared library file, and system-level signature mismatch errors from the PackageManager.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Detects post-exploitation persistence and anti-forensic activity associated with the RufRoot/CVE-2026-59726 vulnerability. The rule identifies the creation of unauthorized .js files within application directories, the modification of 'index.js' followed by a SIGKILL to process ID 1 to force a container restart, and attempts to clear bash command history to hide malicious footprints.
Detects a non-root local process gaining a root shell or executing a SUID-root binary shortly after AF_RXRPC (rxrpc) network socket activity on the same device, consistent with exploitation of the DirtyDecrypt RxGK decrypt-before-authentication flaw to corrupt page-cache pages of SUID-root binaries and gain root.
Detects an unprivileged local user invoking keyctl to add a key of type rxrpc_s to a keyring they control, enabling userspace reproduction of the kernel's RxGK token encryption key derivation as part of CVE-2026-31635 (DirtyDecrypt) exploitation.
Page 23 of 51