Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
8
5
4
4
3
Contributors
25
4
Categories
28
23
18
8
2
Platforms
26
3
2
1
Products / Services
22
7
3
2
2
MITRE Techniques
27
25
12
11
9
CVEs
68
68
63
58
50
29
Detects indicators of the DirtyClone (CVE-2026-43503) Linux kernel local privilege escalation exploit. The rule identifies the execution or compilation of the PoC binary, the specific su invocation used for shell spawning by the exploit, and subsequent post-exploitation actions including modifying sensitive files (/etc/passwd, /etc/sudoers) and creating new local accounts with sudo privileges.
This rule detects command-line activity and process execution associated with the exploitation of various Linux kernel vulnerabilities, including CVE-2026-43503, CVE-2026-46300, CVE-2026-43284, CVE-2026-31431, and CVE-2026-43500. It monitors for the compilation and execution of exploit code, manipulation of kernel modules via modprobe for specific network protocols (esp4, esp6, rxrpc), configuration changes to network namespaces (xfrm, unshare), and the presence of known exploit filenames like DirtyClone or DirtyFrag.
This rule detects potential unauthorized access and environment variable disclosure attempts against the Flowise API, specifically targeting the MCP (Model Context Protocol) endpoints. It monitors for path traversal-like patterns using case variants (e.g., /api/v1/env), unauthorized access to configuration endpoints, and the exposure of sensitive data like API keys, database URLs, and passwords in API responses or request headers.
This rule detects the extraction of files from RAR5 archives using 7-Zip (7z.exe/7zG.exe), followed closely by the execution of a file from a user-writable directory (e.g., Downloads, Temp, AppData). This behavior is characteristic of an attempt to bypass Mark-of-the-Web (MotW) protections, as files extracted from certain container formats may not inherit the original MotW Zone.Identifier alternate data stream, potentially allowing malicious files to execute without standard Windows security warnings.
Detects the AnyDesk service-side printer worker process spawning suspicious child processes (e.g., cmd.exe, powershell.exe). This activity is indicative of exploitation attempts against CVE-2026-43503, where an attacker leverages the 'adprinterpipe' named pipe to send malicious COM marshaling bytes and impersonate the LocalSystem identity to escalate privileges.
Detects suspicious system calls by unprivileged users involving unshare, IPsec XFRM policy configuration, and kernel module loading. This specific sequence is used in the DirtyClone (CVE-2026-43503) exploit, which leverages local IPsec tunnels to perform page-cache corruption and modify sensitive system binaries in memory.
Detects the use of 'docker cp' to copy files out of a container to the host filesystem. This rule identifies suspicious patterns that may exploit the path traversal vulnerability CVE-2026-43503, which allows an attacker to escape the intended destination directory on the host.
Detects the initialization of unprivileged user and network namespaces combined with specific IPsec tunnel configurations (xfrm/esp/veth). This sequence of operations is a known prerequisite for exploiting the DirtyClone (CVE-2026-43503) vulnerability, a Local Privilege Escalation (LPE) in the Linux kernel.
Detects post-exploitation persistence activity following a DirtyClone (CVE-2026-43503) privilege escalation. The rule monitors for the creation of local user accounts via binaries like useradd and usermod, as well as unauthorized modifications to sensitive Linux configuration files such as /etc/sudoers or /etc/shadow, specifically when executed with root-level privileges.
Detects execution and compilation activities associated with the DirtyPipe (CVE-2022-0847) vulnerability, which allows an unprivileged user to overwrite data in read-only files, leading to privilege escalation to root. The rule tracks common exploit filenames, compilation patterns, and specific commands used for privilege escalation via unshare or su.
Detects a potential privilege escalation attempt targeting the DirtyClone (CVE-2026-43503) vulnerability, where an unprivileged process executes /usr/bin/su with specific command line arguments to spawn a shell without proper authentication, effectively gaining root access.
Detects a suspected 5-step exploit sequence targeting CVE-2026-43503 on Linux systems. The rule monitors for unprivileged user and network namespace creation, followed by XFRM state modification, kernel module loading, raw ESP socket creation, and finally writing to /proc/[pid]/mem to facilitate page-cache corruption and bypass Copy-on-Write (CoW) protections.
Detects unprivileged processes creating a new user namespace (CLONE_NEWUSER) followed by a network namespace (CLONE_NEWNET) and modifying procfs mapping files (uid_map, gid_map). This sequence is characteristic of the exploitation staging phase for CVE-2026-43503 (DirtyClone) to gain CAP_NET_ADMIN privileges and overwrite the page cache.
Detects the exploitation chain of the DirtyClone (CVE-2026-43503) vulnerability on Linux systems. The rule monitors for a sequence involving an unprivileged user (UID > 1000) creating a new user/network namespace, configuring an IPsec XFRM state with loopback source/destination addresses, modifying sensitive memory via /proc/self/mem or /proc/<pid>/mem to bypass Copy-on-Write (CoW) protections, and ultimately spawning a process with root privileges.
Detects evidence of CVE-2026-43503 (DirtyClone) exploitation, where an unprivileged user attempts to gain root access by corrupting the in-memory page cache of /usr/bin/su. The detection monitors for suspicious invocation of 'su -c /bin/sh' by non-root users and the subsequent spawning of root shells from an unprivileged parent process.
Detects evidence of the DirtyClone (CVE-2026-43503) Linux kernel privilege escalation exploit. The rule identifies a multi-stage attack chain, including the compilation of the exploit binary, creation of unprivileged user and network namespaces required for the exploit, and the use of the 'ip' utility to configure XFRM states/policies for page cache corruption.
Detects activities related to the compilation and execution of the DirtyClone PoC exploit (CVE-2026-43503) on Linux systems, including compilation from source, direct execution of the binary, and permission modifications on binaries within world-writable directories.
This rule detects activities associated with the DirtyClone (CVE-2026-43503) privilege escalation vulnerability on Linux systems. It monitors for the execution of exploit binaries from world-writable directories, the modification of critical process memory mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) by non-root users, the use of unshare to create user namespaces as a precondition, and the anomalous spawning of shells by the SUID binary /usr/bin/su.
Detects the post-exploitation pattern associated with the DirtyClone (CVE-2026-43503) vulnerability, where a non-root process executes '/usr/bin/su' with the '-c /bin/sh' argument, resulting in a spawned shell running with root privileges. This behavior is indicative of an in-memory patch to the su binary's page cache, allowing for unauthorized privilege escalation without modifying the on-disk binary or triggering standard PAM authentication events.
Detects suspicious unprivileged process behavior associated with the exploitation of CVE-2026-43503 (DirtyClone). The rule identifies non-root users invoking 'unshare' or 'clone' with namespace-related flags (CLONE_NEWUSER, CLONE_NEWNET), followed by critical writes to namespace mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) which are prerequisite steps for elevating to CAP_NET_ADMIN privileges.
Detects in-memory privilege escalation patterns associated with the 'DirtyClone' (CVE-2026-43503) vulnerability. The rule monitors for a sequence of events where an unprivileged process utilizes 'unshare' to create user and network namespaces in conjunction with IPsec XFRM tunnel configurations, immediately followed by the execution of 'su' or 'sudo', resulting in unauthorized root access without disk-based modification of binary files.
Page 1 of 2