Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,453
11,837
5,876
5,154
4,865
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects potential abuse of System Informer's phsvc service for privilege escalation or execution via rundll32, as well as unauthorized child process spawning by the SystemInformer process. This behavior is associated with proof-of-concept exploits targeting the System Informer service.
Detects anomalous child process execution spawned by the AnyDesk service, indicative of exploitation of the adprinterpipe named pipe. This vulnerability involves a low-privileged attacker supplying malicious IStream bytes to the service to trigger code execution in the SYSTEM context.
Detects a suspicious sequence of events where a Gitea act_runner process spawns a container with dangerous namespace or capability flags (e.g., --pid=host, --cap-add=ALL) followed by the execution of 'nsenter' in the same environment, indicating an attempt to escape the container to the host.
Detects local privilege escalation attempts targeting the SystemInformer PhSvc helper service. The technique involves abusing the trust check within the PhSvc service by using rundll32.exe to connect to the SiSvcApiPort ALPC port and invoke privileged helper APIs, such as PhSvcApiCreateProcessIgnoreIfeoDebugger, to spawn processes with elevated privileges.
Detects a suspicious UAC bypass pattern associated with the DcRAT malware, where a process relaunches itself using the 'runas' verb via ShellExecuteW to escalate privileges. The rule specifically monitors for instances where an executable triggers a secondary process launch of itself, filtering out standard Windows administrative utility parents.
Detects suspicious process execution patterns associated with the exploitation of CVE-2026-46300 (Fragnesia). The rule monitors for the combination of user namespace creation via unshare, network tunnel configuration via ip, and kernel module loading related to ESP or rxrpc, which are indicative of an attempt to trigger a privilege escalation vulnerability in the Linux kernel.
This rule detects suspicious process spawning patterns where cmd.exe appears as a child of svchost.exe, which is indicative of PPID spoofing (often associated with Cobalt Strike's spawn-to and token impersonation techniques). It validates the relationship by checking if the grandparent process is the legitimate services.exe.
Detects the installation and execution of known APT36 Ghazwa spyware variants (com.ghazwa.updates, com.chragall, or com.chagall) that are sideloaded (not from the official Google Play Store) and attempt to request or activate Device Administrator privileges via intent actions or receiver class activation.
Detects processes running at High or System integrity levels that correlate with the creation of specific file artifacts known to be associated with VILE ransomware. The rule monitors for potential privilege escalation or token manipulation indicative of the ransomware's attempt to gain necessary permissions for encryption operations.
Detects UAC bypass abuse of eventvwr.exe (Event Viewer) used by Remcos RAT to silently escalate privileges. eventvwr.exe is an auto-elevate COM-based binary; malware spawns it as a child process to gain elevated execution without a UAC prompt. The rule filters out legitimate parent processes like explorer.exe, mmc.exe, taskmgr.exe, and SearchProtocolHost.exe, as well as processes originating from standard Windows system directories.
This rule detects a multi-stage Linux privilege escalation exploitation sequence often associated with kernel vulnerabilities (such as CVE-2023-32233). It identifies: 1) The creation of a user namespace to acquire CAP_NET_ADMIN privileges, 2) The use of 'tc' (traffic control) with 'pedit' actions by a non-root user, 3) The loading of the 'act_pedit' kernel module by a non-root user, 4) Execution of known proof-of-concept binaries (e.g., PACKET_EDIT_MEME, pedit_cow_demo), and 5) Post-exploit evidence cleanup involving the clearing of system page caches via 'drop_caches'.
This rule detects potential exploitation of the DirtyClone vulnerability (CVE-2026-43503) by correlating prerequisites (XFRM state/policy creation, specific kernel module loading, or namespace manipulation) with a subsequent local privilege escalation where an unprivileged process spawns a root shell using 'su'.
Detects a process running as NT AUTHORITY\SYSTEM that was spawned by a parent process not belonging to known legitimate SYSTEM-spawning Windows components. This behavioral pattern is a strong indicator of local privilege escalation (LPE), consistent with techniques such as CVE-2026-41091 (RedSun) and similar LPE exploits.
Detects the execution of consent.exe from a temporary directory path, which is often used in UAC bypass attacks to masquerade as the legitimate Windows UAC prompt process.
Detects artifacts and behavioral patterns associated with the exploitation of the SystemInformer PhSvc (Process Hacker Service) ALPC channel to escalate privileges. The rule monitors for unauthorized rundll32.exe process activity spawning cmd.exe with specific command line arguments, the creation of PoC-related files, and the loading of unsigned modules into the rundll32.exe process.
Detects DLL side-loading attacks where consent.exe loads known malicious DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll) from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to load malicious payloads while appearing as a legitimate Windows UAC process.
Detects potentially malicious container escape or privilege escalation attempts initiated by Gitea act runner processes. This includes the spawning of 'nsenter', the use of dangerous Docker flags that provide host-level access (such as host PID/IPC namespaces, all capabilities, or disabled security mechanisms), and the spawning of shells inside containers configured with namespace-entering commands.
Detects anomalous process execution where a non-privileged user attempts to execute /bin/su to transition to UID 0 (root) without a legitimate parent process (such as sudo, sshd, or login). This activity is indicative of the pedit COW (CVE-2026-46331) exploit, which involves poisoning the /bin/su page cache to achieve unauthorized privilege escalation via shellcode injection.
Detects suspicious unprivileged process behavior associated with the exploitation of CVE-2026-43503 (DirtyClone). The rule identifies non-root users invoking 'unshare' or 'clone' with namespace-related flags (CLONE_NEWUSER, CLONE_NEWNET), followed by critical writes to namespace mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) which are prerequisite steps for elevating to CAP_NET_ADMIN privileges.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects local privilege escalation attempts targeting AnyDesk by exploiting COM object registration. The attack involves registering a malicious COM server in HKCU to intercept the AnyDesk service's interaction with the print pipe, followed by process token impersonation to gain SYSTEM privileges. The rule monitors for unauthorized COM registration, anomalous process execution from AnyDesk, and cross-process access.
Page 29 of 48