Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,453
11,837
5,876
5,154
4,865
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects modifications to the 'Software\Classes\ms-settings\shell\open\command' registry key, a technique commonly used to bypass User Account Control (UAC). By setting the default handler for the ms-settings protocol to a malicious command, an attacker can achieve elevated execution when the protocol is triggered by a legitimate Windows component.
Detects modifications to the 'Software\Classes\ms-settings\shell\open\command' registry key, a technique commonly used to bypass User Account Control (UAC). By setting the default handler for the ms-settings protocol to a malicious command, an attacker can achieve elevated execution when the protocol is triggered by a legitimate Windows component.
Detects the execution of the Windows runas command using the /savecred flag. This flag instructs Windows to save the supplied credentials locally, which can be abused by unauthorized users to elevate privileges or execute processes in the context of a saved account without providing a password again.
Detects the execution of known privilege escalation tools (JuicyPotato, RoguePotato, PrintSpoofer) or command-line arguments indicative of token impersonation attempts (e.g., usage of SeImpersonatePrivilege) to escalate privileges on Windows systems.
This rule monitors for suspicious activity linked to files or processes within the Windows temporary directory. It identifies three distinct malicious patterns: (1) sensitive privilege usage (e.g., SeDebugPrivilege) by processes running from temp; (2) presence of known malicious file names associated with a specific campaign (vile_*.ico, vile_*.lnk, etc.); and (3) PowerShell execution of a specific decryptor shortcut file from the temp directory.
Detects suspicious activity involving the combination of user or network namespace creation using 'unshare' or 'ip' and subsequent manipulation of kernel networking queues using 'tc' (Traffic Control). This behavioral pattern is frequently observed in Linux kernel exploits designed to achieve local privilege escalation by creating namespaces and using the 'tc' subsystem to trigger vulnerabilities. The rule further refines matches by flagging commands or parent processes residing in directories associated with staging or temporary storage, such as /tmp or /dev/shm.
Detects a potential privilege escalation attempt where an unprivileged user executes a SUID-capable binary (su, sudo, passwd), followed immediately by the creation of a root-owned shell process. This pattern is indicative of exploitation of local privilege escalation vulnerabilities, such as page cache poisoning (e.g., CVE-2026-46331).
Detects the suspicious combination of 'aa-exec' (commonly associated with AppArmor or specific container runtime wrappers) being followed by the execution of 'unshare' with flags used to manipulate kernel namespaces (user, network). This pattern is often indicative of container breakouts or privilege escalation attempts where an adversary leverages namespace isolation to gain higher privileges on the host.
Detects the execution of the 'unshare' utility by non-root users with flags designed to create new user or network namespaces. This behavior is often associated with container escape attempts, privilege escalation, or efforts to bypass local security controls by creating isolated environments.
Detects evidence of the DirtyClone (CVE-2026-43503) Linux kernel privilege escalation exploit. The rule identifies a multi-stage attack chain, including the compilation of the exploit binary, creation of unprivileged user and network namespaces required for the exploit, and the use of the 'ip' utility to configure XFRM states/policies for page cache corruption.
Detects in-memory privilege escalation patterns associated with the 'DirtyClone' (CVE-2026-43503) vulnerability. The rule monitors for a sequence of events where an unprivileged process utilizes 'unshare' to create user and network namespaces in conjunction with IPsec XFRM tunnel configurations, immediately followed by the execution of 'su' or 'sudo', resulting in unauthorized root access without disk-based modification of binary files.
This rule detects command line activity associated with the exploitation of a Linux kernel vulnerability involving packet editing (often referred to as the 'pedit' or 'act_pedit' vulnerability). It monitors for the execution of exploit-specific binaries, kernel module loading of 'act_pedit', use of 'unshare' for namespace abuse, and configuration of 'tc' (traffic control) filters related to the exploit.
This rule detects activities associated with the DirtyClone (CVE-2026-43503) privilege escalation vulnerability on Linux systems. It monitors for the execution of exploit binaries from world-writable directories, the modification of critical process memory mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) by non-root users, the use of unshare to create user namespaces as a precondition, and the anomalous spawning of shells by the SUID binary /usr/bin/su.
Detects execution of the CVE-2026-46331 exploit chain, which utilizes unprivileged user namespace creation to escalate privileges followed by malicious Linux traffic control (tc) pedit actions to achieve kernel-level page cache corruption.
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
Detects a potential User Account Control (UAC) bypass by correlating registry value updates in the 'ms-settings' class with the subsequent execution of auto-elevating Windows binaries (fodhelper.exe, computerdefaults.exe, or sdclt.exe) from suspicious locations such as AppData or Temp directories.
Detects a privilege escalation technique that exploits the Windows Error Reporting (WER) 'QueueReporting' scheduled task. An attacker leverages the Task Scheduler COM API to trigger this task, causing 'wermgr.exe' to execute as SYSTEM from an attacker-controlled directory (often via directory junction redirection), subsequently spawning shell processes.
This rule detects potentially malicious activity involving the Windows Error Reporting service (wermgr.exe). It monitors for two primary conditions: 1) Execution of wermgr.exe from a location other than the standard System32 directory, indicating potential binary masquerading. 2) wermgr.exe spawning common command-line shells (cmd, powershell, etc.) while running under the SYSTEM account, which is indicative of potential task abuse or privilege escalation.
This rule detects suspicious use of sudo, modification of the sudoers file, or privilege escalation patterns specifically targeting edge network appliances (e.g., pfSense, Synology, Egnyte). It monitors for commands like sudo tee, sudo -l for permission enumeration, or the introduction of NOPASSWD entries, which are common indicators of persistence or privilege escalation attempts by service accounts.
Detects potential User Account Control (UAC) bypass attempts using known techniques involving the execution of fodhelper.exe or eventvwr.exe, or by abusing the Mozilla ElevateTask task scheduler configuration.
Detects potential container breakout attempts on Windows systems by monitoring for the launch of privileged containers with sensitive host paths mounted, the execution of host-level processes directly spawned by container runtime binaries (docker.exe, containerd.exe), and direct access to sensitive host filesystems (e.g., C:\windows, C:\etc, C:\programdata) by container runtimes.
Page 30 of 48