Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,456
11,839
5,876
5,155
4,865
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects the 'prl_disp_service' process spawning 'tar' with the '--use-compress-program' flag set to an unconventional binary. This behavior is associated with the exploitation of ParaShells (CVE-2026-90894), where an attacker leverages the compression program hook in 'tar' to execute arbitrary commands with root privileges.
Detects the 'prl_disp_service' process spawning 'tar' with the '--use-compress-program' flag set to an unconventional binary. This behavior is associated with the exploitation of ParaShells (CVE-2026-90894), where an attacker leverages the compression program hook in 'tar' to execute arbitrary commands with root privileges.
Detects suspected exploitation of CVE-2026-81963, an Elevation of Privilege vulnerability in the Windows Update stack. The rule monitors for the creation of reparse points, junctions, or symbolic links within update staging paths by Windows Update processes, followed by either the spawning of suspicious child processes or unauthorized file writes/renames outside of expected directories, which are indicative of a privileged link-following exploit.
Detects modifications to the /etc/sudoers or /etc/sudoers.d configuration files by non-root users. This activity is often associated with privilege escalation attempts where an adversary attempts to modify sudo policies to grant themselves elevated permissions or bypass password requirements.
Detects modifications to the /etc/sudoers or /etc/sudoers.d configuration files by non-root users. This activity is often associated with privilege escalation attempts where an adversary attempts to modify sudo policies to grant themselves elevated permissions or bypass password requirements.
Detects modifications to the /etc/sudoers or /etc/sudoers.d configuration files by non-root users. This activity is often associated with privilege escalation attempts where an adversary attempts to modify sudo policies to grant themselves elevated permissions or bypass password requirements.
Detects unauthorized modifications, creations, or renames of Pluggable Authentication Module (PAM) configuration files or core shared libraries (such as pam_rootok.so or pam_permit.so) by non-root users. Attackers often modify these files to bypass authentication mechanisms and achieve privilege escalation. The rule excludes common package management tools to minimize false positives.
Detects unauthorized modifications, creations, or renames of Pluggable Authentication Module (PAM) configuration files or core shared libraries (such as pam_rootok.so or pam_permit.so) by non-root users. Attackers often modify these files to bypass authentication mechanisms and achieve privilege escalation. The rule excludes common package management tools to minimize false positives.
Detects a sequence of events where a process within a container namespace attempts to interact with the host filesystem (e.g., /proc/1/root, nsenter) followed shortly by an unexpected gain of root privileges or execution of setuid(0) that is not associated with legitimate su or sudo usage.
Detects a sequence of events where a process within a container namespace attempts to interact with the host filesystem (e.g., /proc/1/root, nsenter) followed shortly by an unexpected gain of root privileges or execution of setuid(0) that is not associated with legitimate su or sudo usage.
Detects a sequence of events where a process within a container namespace attempts to interact with the host filesystem (e.g., /proc/1/root, nsenter) followed shortly by an unexpected gain of root privileges or execution of setuid(0) that is not associated with legitimate su or sudo usage.
Detects a sequence of events where a process within a container namespace attempts to interact with the host filesystem (e.g., /proc/1/root, nsenter) followed shortly by an unexpected gain of root privileges or execution of setuid(0) that is not associated with legitimate su or sudo usage.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects modifications to the 'HKCU\Software\Classes\ms-settings\shell\open\command' registry key, a technique used to hijack the fodhelper.exe binary to achieve silent UAC elevation. This allows attackers to execute commands with administrative privileges without triggering a UAC prompt.
Detects potential local privilege escalation (LPE) to root via an unshare invocation, tracking the process lineage from an unprivileged unshare execution to the subsequent spawning of a root-privileged shell within a short time window. This pattern is characteristic of various Linux kernel vulnerability exploits such as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, where the unshare system call is abused to enter new user namespaces to bypass security restrictions.
Detects potential local privilege escalation (LPE) to root via an unshare invocation, tracking the process lineage from an unprivileged unshare execution to the subsequent spawning of a root-privileged shell within a short time window. This pattern is characteristic of various Linux kernel vulnerability exploits such as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, where the unshare system call is abused to enter new user namespaces to bypass security restrictions.
Detects potential local privilege escalation (LPE) to root via an unshare invocation, tracking the process lineage from an unprivileged unshare execution to the subsequent spawning of a root-privileged shell within a short time window. This pattern is characteristic of various Linux kernel vulnerability exploits such as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, where the unshare system call is abused to enter new user namespaces to bypass security restrictions.
Detects the execution of Acronis management or recovery tools (associated with cPanel, WHM, or Plesk environments) by a non-root user that results in a process running with root privileges. This pattern is indicative of potential privilege escalation by exploiting vulnerabilities in service-level utilities.
Detects instances where a non-root user executes commands containing 'acronis' alongside web hosting management keywords (cpanel, whm, plesk) while the target process user is 'root'. This behavior suggests an attempt to abuse backup software or administrative management tools to escalate privileges or perform unauthorized administrative actions.
Detects embedded CVE-2026-46300 (Fragnesia) Linux privilege escalation exploit code used by KATARU IoT malware, copied unmodified from public PoC
Detects the execution of the 'su' binary preceded by command-line strings that are highly indicative of known Linux privilege escalation exploits, specifically those targeting vulnerabilities like PwnKit (CVE-2021-4034). The rule monitors for common exploit payloads or status messages (e.g., 'prctl PR_SET_DUMPABLE', 'fork userns mapper') associated with successful exploitation attempts that manipulate environment variables or process attributes to elevate privileges to root, while filtering out legitimate container-related processes.
Page 14 of 48