Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,144 detections
Filters
Last updated
All Time
Detection languages
3,228
1,086
498
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,979
2,473
1,063
1,026
910
Platforms
39,802
7,144
6,519
3,861
3,601
Products / Services
1,325
1,070
970
655
490
MITRE Techniques
2,231
1,319
1,319
876
873
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects the execution of a Python proof-of-concept script named 'exp.py' followed by the execution of the 'su' binary on the same Linux host within a 5-minute window. This correlation is indicative of an attempt to exploit the 'Copy Fail' vulnerability (CVE-2026-31431), which leverages AF_ALG sockets to perform an in-memory page cache overwrite of the 'su' setuid binary to gain a root shell.
This rule detects the execution of Python processes on Linux systems that include a specific cryptographic template string in their command line. This string, "authencesn(hmac(sha256),cbc(aes))", is indicative of a Proof-of-Concept (PoC) exploit related to CVE-2026-31431, also known as 'Copy Fail'. The detection targets Python binaries (python, python3, or versioned python3.x) and aims to identify attempts to leverage this vulnerability for suspicious cryptographic operations.
Identifies potential network tunneling, proxying, and reverse shell activities by correlating process creation with outbound public network connections. This rule looks for known tunneling and proxy tool filenames and specific command-line arguments indicative of such activities, then correlates these process events with successful or attempted outbound network connections to public IP addresses.
Detects process executions containing SSH tunneling or port forwarding parameters correlated with outbound network connections to external public IPs. This may indicate protocol tunneling for evasion or data exfiltration.
This rule detects attempts to mitigate the CVE-2026-31431 vulnerability by either unloading the 'algif_aead' kernel module using 'rmmod' or by configuring 'modprobe' to blackhole the 'algif_aead' module. This activity indicates a system administrator or automated tool is applying a known mitigation for a kernel vulnerability.
Detects Python processes potentially exploiting CVE-2026-31431 ("Copy Fail") by looking for command-line arguments referencing the 'authencesn' cryptography template or known Proof of Concept script names. This exploits a vulnerability in the AF_ALG socket type and splice() to escalate privileges.
Detects the creation of AF_ALG (kernel crypto API) sockets from Python processes or processes explicitly referencing the 'authencesn' cryptographic template. This behavior is heavily associated with the "Copy Fail" (CVE-2026-31431) local privilege escalation exploit, which uses a Python script to chain AF_ALG and splice() to overwrite page cache pages.
This rule detects the execution of Python interpreters on Linux systems where the command line contains a specific AF_ALG cryptography template. This template is associated with a known vulnerability (CVE-2026-31431) and is considered highly suspicious due to its rarity in legitimate command lines. The detection targets the 'authencesn(hmac(sha256),cbc(aes))' string within the Python command line arguments.
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
This rule detects commands executed on Linux systems to mitigate the 'Copy Fail' vulnerability (CVE-2026-31431) related to the 'algif_aead' kernel module. It specifically looks for the dynamic unloading of the module using 'rmmod algif_aead' or the configuration of 'modprobe' to prevent the module from loading by setting 'install algif_aead /bin/false' in a modprobe configuration file.
Detects commands used to disable or unload the 'algif_aead' kernel module. This activity is the recommended emergency mitigation for the "Copy Fail" vulnerability (CVE-2026-31431). Monitoring this ensures visibility into mitigation deployment across infrastructure and helps identify unauthorized tampering with kernel cryptographic capabilities.
Detects when AI-integrated IDEs or coding agents spawn sensitive child processes such as command shells (cmd, powershell, pwsh) or web transfer tools (curl, wget). This behavior could indicate malicious activity if an attacker compromises the AI tool or if the tool itself is misused to execute arbitrary commands or exfiltrate data.
This rule detects the execution of a process on a Linux system where the command line contains a specific URL associated with the 'Copy Fail Exploit Download' (CVE-2026-31431). This indicates an attempt to download or execute a known exploit.
Detects Python processes creating AF_ALG sockets with the 'authencesn' crypto template, which could indicate exploitation of CVE-2026-31431. This rule specifically looks for Python interpreter executions on Linux systems where the command line contains both 'socket.socket(38' (representing AF_ALG family) and 'authencesn'.
This rule detects the execution of processes with filenames starting with 'claude' on server devices. It specifically targets server endpoints by filtering device information to include only 'Server' device types and then joins this with process execution events. This could indicate the presence or execution of AI-related tools or unauthorized software on critical infrastructure.
Detects commands used to flush system kernel caches via drop_caches. In the context of the CVE-2026-31431 (CopyFail) vulnerability, flushing caches is the primary method to recover the 'su' binary after it has been corrupted by the public Proof-of-Concept exploit.
Detects discovery commands checking for the presence of the vulnerable 'algif_aead' kernel module. Checking if this module is loaded is a prerequisite step for both defenders mitigating the threat and attackers profiling targets for CVE-2026-31431 (CopyFail).
Detects the download of the public proof-of-concept exploit script for CVE-2026-31431 (CopyFail) from the known payload domain 'copy.fail'. Attackers or testers may use utilities like curl or wget to retrieve the payload directly to a vulnerable system.
Detects anomalous file modification or deletion events targeting the SSH known_hosts file. This activity can be indicative of VECT ransomware, which zeroes out this file across compromised Linux and ESXi systems to suppress host-key warnings, enabling silent lateral movement via SCP and SSH.
Detects alerts generated by page-cache integrity checking tools (e.g., pagecache_diff.py) indicating a divergence between a file's in-memory page cache and its on-disk representation. This is a primary post-exploitation indicator for the Copy Fail vulnerability (CVE-2026-31431), which corrupts the page cache without modifying the physical file to bypass traditional File Integrity Monitoring (FIM).
Detects the creation of the 'vector_notice.sh' script in the '/etc/profile.d/' directory. The VECT ransomware (Linux and ESXi variants) drops this shell script to display a ransom note to users upon shell login.
Page 276 of 341