Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule detects a high volume of SCTP traffic targeted at internal systems, characterized by mass endpoint creation. This behavior is indicative of an exploit attempt against the 'sctp_diag' kernel component (CVE-2026-74469), which can lead to an out-of-bounds (OOB) write condition, potentially resulting in system instability or denial of service.
This rule detects a high volume of SCTP traffic targeted at internal systems, characterized by mass endpoint creation. This behavior is indicative of an exploit attempt against the 'sctp_diag' kernel component (CVE-2026-74469), which can lead to an out-of-bounds (OOB) write condition, potentially resulting in system instability or denial of service.
This rule detects a high volume of SCTP traffic targeted at internal systems, characterized by mass endpoint creation. This behavior is indicative of an exploit attempt against the 'sctp_diag' kernel component (CVE-2026-74469), which can lead to an out-of-bounds (OOB) write condition, potentially resulting in system instability or denial of service.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Page 75 of 340