Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
1
1
1
1
Platforms
1
1
Products / Services
1
1
MITRE Techniques
2
1
1
1
1
CVEs
71
71
64
58
49
Identifies the presence of the known ITScape (CVE-2026-46316) proof-of-concept executable by its SHA256 hash. This vulnerability enables a critical guest-to-host escape affecting ARM64 infrastructure.
Detects the host-level command execution artifact left behind by the published ITScape (CVE-2026-46316) exploit proof-of-concept. The PoC specifically executes a payload containing '/bin/touch /ITScape' after achieving host kernel privilege from a KVM/arm64 guest. This rule looks for processes executing this specific command string.