Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,144 detections
Filters
Last updated
All Time
Detection languages
3,228
1,086
498
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,979
2,473
1,063
1,026
910
Platforms
39,802
7,144
6,519
3,861
3,601
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,231
1,319
1,319
876
873
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the creation of specific file names used by CL-STA-1132 for EarthWorm and ReverseSocks5 tunneling tools in /tmp/ and /var/tmp/ directories on Linux systems. This activity has been observed in CVE-2026-0300 exploitation.
Detects write operations or modifications to 'uid_map', 'gid_map', or 'setgroups' files within the /proc directory.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
Detects the addition of RxRPC tokens to the process keyring using the `add_key` system call or `keyctl` command.
The RxRPC variant of the Dirty Frag (CVE-2026-43500) vulnerability leverages malicious RxRPC v1 tokens to perform an offline brute-force attack and achieve local privilege escalation via a page-cache write.
Monitoring for unexpected RxRPC key additions helps identify potential exploitation of this vulnerability.
The RxRPC variant of the Dirty Frag (CVE-2026-43500) vulnerability leverages malicious RxRPC v1 tokens to perform an offline brute-force attack and achieve local privilege escalation via a page-cache write.
Monitoring for unexpected RxRPC key additions helps identify potential exploitation of this vulnerability.
Detects a process modifying multiple privileged namespace mapping files (uid_map, gid_map, setgroups) under /proc. This behavior is used by the Dirty Frag xfrm-ESP exploit variant to gain CAP_NET_ADMIN privileges prior to exploiting the Linux kernel page-cache write vulnerability.
Detects attempts to bind an AF_ALG socket to the pcbc(fcrypt) cryptographic cipher. The Dirty Frag (CVE-2026-43500) RxRPC exploit variant leverages this highly unusual cryptographic combination to perform offline key brute-forcing in user-space to predict decrypted file offsets. This rule covers eBPF telemetry arguments, standard command-line logging (to catch potential kernel `modprobe` triggers), and auditd SOCKADDR hex-encoded structures.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
Detects suspicious command execution originating from cPanel daemons. This rule identifies instances where cPanel processes (cpsrvd, cpsrvd-ssl, cpaneld, whostmgrd) or their immediate children execute common shell interpreters or specific commands indicative of potential compromise, such as writing to /etc/passwd, modifying authorized_keys, or using base64/perl/python/bash for interactive shells.
Detects suspicious npm activity indicative of the PhantomRaven Wave 5 supply chain attack. This includes node.js processes executing scripts from temporary directories during npm install, node.js processes accessing credential files (.gitconfig, .npmrc, .aws/credentials, .ssh) during npm lifecycle events, and the installation of known malicious npm package names associated with PhantomRaven.
Detects truncated 'whostmgrsession' cookies missing the comma delimiter, which is a necessary step for attackers to inject cleartext CRLF payloads into cPanel session files and bypass authentication. This rule specifically looks for the 'whostmgrsession' cookie in web or proxy logs where the cookie value matches a regex pattern indicating the absence of the expected comma delimiter, a characteristic of the CVE-2026-41940 exploitation.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
Detects the generation of pre-authentication session cookies via intentionally failed login attempts to the `login_only` endpoint. This detects the initial staging phase of the CVE-2026-41940 exploit chain.
This rule detects the execution of the `unshare` utility with parameters to create a new user namespace (`-U` or `--user`). This activity is a known precursor for the Dirty Frag Linux kernel Local Privilege Escalation (LPE) exploit, where an unprivileged user can gain elevated privileges. The rule specifically targets Linux process execution events.
Nginx or Crash Log Deletion
Cortex XDR
Detects command-line activity indicating the deletion of crash core dump files or Nginx logs. This behavior was observed by CL-STA-1132 as a defense evasion technique to cover tracks after exploiting CVE-2026-0300.
This rule detects the execution of the `unshare` utility with parameters to create a new user namespace (`-U` or `--user`). This activity is a known precursor for the Dirty Frag Linux kernel Local Privilege Escalation (LPE) exploit, where an unprivileged user can gain elevated privileges. The rule specifically targets Linux process execution events.
This rule detects suspicious child processes spawned by the BeyondTrust Remote Support client (bomgar-scc), which could indicate post-exploitation activity following a compromise via vulnerabilities like CVE-2026-1731. It looks for high-risk command line patterns and suspicious child processes commonly used for reconnaissance and payload execution.
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail). While this is a mitigation step, monitoring for it ensures compliance and tracks remediation efforts.
Detects the creation of specific file names used by CL-STA-1132 for EarthWorm and ReverseSocks5 tunneling tools in /tmp/ and /var/tmp/ directories. These file names are highly specific to the CL-STA-1132 campaign.
Detects the Node.js process making external DNS requests to api64.ipify.org, a behavior used by the PhantomRaven payload to discover the host's public IP address.
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail). This rule monitors for dynamic unloading of the module using 'rmmod' or persistent configuration changes via 'modprobe.d' to disable the module. While this is a mitigation step, monitoring for it ensures compliance and tracks remediation efforts.
Detects Python command lines referencing a specific cryptographic string ('authencesn(hmac(sha256),cbc(aes))') known to be used in the exploitation of the 'Copy Fail' vulnerability (CVE-2026-31431). This string is highly specific and its presence in a Python command line is indicative of an attempt to exploit this particular CVE.
Detects Node.js processes querying public IP-address and geolocation lookup services. This automated reconnaissance behavior is the standard "where am I" primitive used by an enormous range of Node-based malware and supply chain campaigns including PhantomRaven (npm), Shai-Hulud, the Bitwarden CLI compromise, Ultralytics-style attacks, and countless commodity Node-based stealers and droppers. Legitimate Node applications rarely query public IP services from developer endpoints — when they do, it is most often during malicious package install lifecycle hooks or within fileless droppers fetched from attacker-controlled C2 servers.
Page 274 of 341