Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,389 copies51 likes26,190 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule detects a high volume of SCTP traffic targeted at internal systems, characterized by mass endpoint creation. This behavior is indicative of an exploit attempt against the 'sctp_diag' kernel component (CVE-2026-74469), which can lead to an out-of-bounds (OOB) write condition, potentially resulting in system instability or denial of service.
This rule detects a high volume of SCTP traffic targeted at internal systems, characterized by mass endpoint creation. This behavior is indicative of an exploit attempt against the 'sctp_diag' kernel component (CVE-2026-74469), which can lead to an out-of-bounds (OOB) write condition, potentially resulting in system instability or denial of service.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects potential local privilege escalation (LPE) to root via an unshare invocation, tracking the process lineage from an unprivileged unshare execution to the subsequent spawning of a root-privileged shell within a short time window. This pattern is characteristic of various Linux kernel vulnerability exploits such as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, where the unshare system call is abused to enter new user namespaces to bypass security restrictions.
Detects potential local privilege escalation (LPE) to root via an unshare invocation, tracking the process lineage from an unprivileged unshare execution to the subsequent spawning of a root-privileged shell within a short time window. This pattern is characteristic of various Linux kernel vulnerability exploits such as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, where the unshare system call is abused to enter new user namespaces to bypass security restrictions.
Page 382 of 756