Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,184 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
This rule detects a high volume of SCTP traffic targeted at internal systems, characterized by mass endpoint creation. This behavior is indicative of an exploit attempt against the 'sctp_diag' kernel component (CVE-2026-74469), which can lead to an out-of-bounds (OOB) write condition, potentially resulting in system instability or denial of service.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
This rule detects the execution of specific suspicious filenames (dirtyah6, tunderflow, pppoeject, diagspill) when they are launched from common staging or temporary directories such as /tmp, /home, or /root, while excluding known build environments, package management directories, and common development workspaces.
Page 328 of 756