Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
8
5
4
4
3
Contributors
25
4
Categories
28
23
18
8
2
Platforms
26
3
2
1
Products / Services
22
7
3
2
2
MITRE Techniques
27
25
12
11
9
CVEs
68
68
63
58
50
29
Detects a sequence of events consistent with the DirtyClone/DirtyFrag kernel exploit: first, identifying precursor activities such as namespace manipulation (unshare), kernel module loading of networking components (esp4/6, rxrpc), or specific exploit binary execution; followed by an anomalous spawn of a root shell from an unprivileged parent process within a short 5-minute window.
This rule detects potential exploitation of the DirtyClone vulnerability (CVE-2026-43503) by correlating prerequisites (XFRM state/policy creation, specific kernel module loading, or namespace manipulation) with a subsequent local privilege escalation where an unprivileged process spawns a root shell using 'su'.
Detects execution artifacts and prerequisite activities associated with the DirtyClone (CVE-2026-43503) local privilege escalation exploit. This includes monitoring for the creation of unprivileged user namespaces, loading specific kernel modules (esp4, esp6, rxrpc) often used in such exploits, compilation of associated exploit source files, and direct interaction with /proc/self/mem to perform memory-based exploitation.
Detects execution patterns associated with the DirtyClone (CVE-2026-43503) exploit, which involves an unprivileged process utilizing user and network namespaces to configure IPsec XFRM Security Associations (SAs) to corrupt the kernel page cache of sensitive binaries such as /usr/bin/su.
Detects the execution of 'unshare' by an unprivileged user to create a new user namespace, followed by a write operation to '/proc/self/uid_map', '/proc/self/gid_map', or '/proc/self/setgroups'. This sequence is a known technique for local privilege escalation (LPE) vulnerabilities, such as those related to unprivileged user namespaces.
This rule detects activities related to the DirtyClone exploit (CVE-2026-43503), including the execution of the exploit binary, the compilation of the exploit from source code using gcc, the use of unshare to prepare network and user namespaces, and suspicious execution of su by non-standard parent processes indicating potential post-exploit root shell acquisition.
Detects execution patterns associated with the DirtyClone local privilege escalation exploit. The rule monitors for the execution of the exploit binary, compilation of related exploit source code, the creation of combined user and network namespaces via unshare, manipulation of IPsec xfrm states/policies by unprivileged users, and the spawning of a root shell via su. These activities are indicative of an attempt to elevate privileges from an unprivileged context to root.
Detects the exploit chain for CVE-2026-43503, an unprivileged kernel exploitation vulnerability. The rule identifies the creation of user and network namespaces by non-root users, followed by the manipulation of XFRM states or policies, and the subsequent loading of ESP kernel modules, which together facilitate privilege escalation.
Page 2 of 2