Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of the 'su' binary preceded by command-line strings that are highly indicative of known Linux privilege escalation exploits, specifically those targeting vulnerabilities like PwnKit (CVE-2021-4034). The rule monitors for common exploit payloads or status messages (e.g., 'prctl PR_SET_DUMPABLE', 'fork userns mapper') associated with successful exploitation attempts that manipulate environment variables or process attributes to elevate privileges to root, while filtering out legitimate container-related processes.
Detects KATARU IoT malware embedded exploit code for CVE-2026-31431 (Copy Fail) Linux privilege escalation, identified by shared exploit-chain strings and syscall sequences used to spawn su as root
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects web requests to 'wp-admin/theme-install.php' containing suspicious query parameters that indicate an attempt to force an unauthenticated theme installation via a Cross-Site Request Forgery (CSRF) exploit (Click2Shell). The rule identifies requests with malicious payloads in the 'theme' parameter, specifically looking for indicators that attempt to bypass CSRF protections when originating from an external site or a non-admin session context.
Detects web requests to 'wp-admin/theme-install.php' containing suspicious query parameters that indicate an attempt to force an unauthenticated theme installation via a Cross-Site Request Forgery (CSRF) exploit (Click2Shell). The rule identifies requests with malicious payloads in the 'theme' parameter, specifically looking for indicators that attempt to bypass CSRF protections when originating from an external site or a non-admin session context.
This rule detects when common web server service accounts (e.g., www-data, apache) spawn Unix shell processes (sh, bash, dash) to execute system enumeration commands like 'id' or 'whoami'. This activity is often a sign of post-exploitation behavior following successful web application exploitation, where an attacker attempts to determine their context and privileges on the compromised host.
This rule detects when common web server service accounts (e.g., www-data, apache) spawn Unix shell processes (sh, bash, dash) to execute system enumeration commands like 'id' or 'whoami'. This activity is often a sign of post-exploitation behavior following successful web application exploitation, where an attacker attempts to determine their context and privileges on the compromised host.
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
This rule identifies Linux devices with kernel versions that are vulnerable to CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. It parses the OSBuild field to extract kernel major, minor, and patch version numbers and compares them against known unpatched releases.
Detects unauthorized modifications, creations, or renames of Pluggable Authentication Module (PAM) configuration files or core shared libraries (such as pam_rootok.so or pam_permit.so) by non-root users. Attackers often modify these files to bypass authentication mechanisms and achieve privilege escalation. The rule excludes common package management tools to minimize false positives.
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
Page 83 of 347