Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,389 copies51 likes26,189 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
Page 381 of 756