Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
4
3
2
2
Contributors
11
Categories
20,632
11,971
5,918
5,199
4,875
Platforms
8
2
1
Products / Services
5
5
2
2
1
MITRE Techniques
3
3
2
2
2
CVEs
5
2
2
1
Detects SSFileCopySender/SSFileCopyReceiver helpers running as uid=0 reading or writing sensitive system paths during Screen Sharing sessions using legacy VNC auth or lacking a preceding valid local logon — abuse of the root file-copy primitive underlying CVE-2026-65400.
Detects a privileged/elevated AI-agent tool invocation whose arguments are sourced from sandbox runtime output within 30 seconds of a PBKDF2/AES decrypt event, with no provenance tag distinguishing that output from trusted state — the generic post-decryption privileged-action sequence behind Cryptographic Context Injection attacks.
Detects a SYSTEM-privileged cmd.exe/powershell.exe process spawned in close temporal/process proximity to Microsoft Defender's scanning process (MsMpEng.exe), consistent with successful exploitation of the ShieldBreak zero-day (CVE-2026-50656) TOCTOU bypass. Excludes known legitimate SYSTEM shell spawns from scheduled tasks, SCCM/Intune, and PsExec-style tooling.
Detects sudoers.d writes attributed to screensharingd/helper followed within minutes by passwordless (sudo -n) execution for a previously-unprivileged account, optionally correlated with a dropped callback script.
Detects the compiled ShieldBreak C++ proof-of-concept exploit binary via embedded source/resource path strings and PE header, indicating local possession or execution of the CVE-2026-50656 Defender bypass PoC.
Detects C2Looper injecting shellcode into the legitimate winspool.drv module via a remote thread, excluding legitimate print subsystem processes.
Detects C2Looper injecting shellcode into the legitimate winspool.drv module via a remote thread, excluding legitimate print subsystem processes.
Detects registration of an unrecognized cloud sync provider combined with placeholder file creation within a short window, consistent with ShieldBreak's TOCTOU race staging technique. Excludes signed installs/re-registrations of known legitimate cloud sync clients (OneDrive, Dropbox, Google Drive, Box).
Detects creation and locking of a CLFS log file matching the ShieldBreak-specific naming/path pattern, used to synchronize the exploit's TOCTOU race window against Microsoft Defender. Excludes legitimate CLFS consumers (MSMQ, TxR/TxF) and Windows servicing operations.
Detects the ShieldBreak Defender-scan TOCTOU exploit locking an alternate data stream on the protected system DLL phoneinfo.dll immediately prior to an arbitrary write — the core privilege-escalation primitive of CVE-2026-50656. Excludes legitimate Windows Update/servicing operations.
Detects the DriverKiller BYOVD loader and its embedded vulnerable TG Soft VirIT Agent driver (CVE-2017-17472) by requiring the leftover PDB path artifact together with a known SHA-256 hash match, rather than either indicator alone, to avoid matching legitimate VirIT Agent installations or unrelated files containing only a subset of the indicators