Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
938 detections
Filters
Last updated
All Time
Detection languages
476
185
75
50
39
Contributors
235
180
110
57
47
Categories
424
381
352
169
128
Platforms
583
297
49
29
22
Products / Services
221
160
135
103
88
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
938
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects interactive root shell requests via 'sudo -i' that occur shortly after a failed Parallels appliance installation or tar extraction event containing specific error codes or configuration markers (UCP_UID=0). This pattern aligns with the exploitation chain for CVE-2026-90894, where an attacker leverages an extraction failure to escalate privileges.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects the 'prl_disp_service' process spawning 'tar' with the '--use-compress-program' flag set to an unconventional binary. This behavior is associated with the exploitation of ParaShells (CVE-2026-90894), where an attacker leverages the compression program hook in 'tar' to execute arbitrary commands with root privileges.
Detects the 'prl_disp_service' process spawning 'tar' with the '--use-compress-program' flag set to an unconventional binary. This behavior is associated with the exploitation of ParaShells (CVE-2026-90894), where an attacker leverages the compression program hook in 'tar' to execute arbitrary commands with root privileges.
Detects the 'prl_disp_service' process spawning 'tar' with the '--use-compress-program' flag set to an unconventional binary. This behavior is associated with the exploitation of ParaShells (CVE-2026-90894), where an attacker leverages the compression program hook in 'tar' to execute arbitrary commands with root privileges.
Detects unexpected crashes or restarts of the Windows Defender service (MsMpEng.exe) occurring in temporal proximity to activities associated with the ShieldCrash PoC or tampering within the Windows Defender object manager namespace. This rule aims to identify potential exploitation attempts targeting Windows Defender, specifically correlating security service instability with known malicious indicators.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Detects suspected exploitation of CVE-2026-81963, an Elevation of Privilege vulnerability in the Windows Update stack. The rule monitors for the creation of reparse points, junctions, or symbolic links within update staging paths by Windows Update processes, followed by either the spawning of suspicious child processes or unauthorized file writes/renames outside of expected directories, which are indicative of a privileged link-following exploit.
Detects anomalous staging activity associated with the 'PPPoEject' exploit. The rule identifies the creation of GRE or IP6GRE interfaces on bonding devices immediately preceding or concurrent with FUSE filesystem mounting or I/O activity. This pattern matches the exploitation workflow of racing pppoe_sendmsg() skb reallocation via dev_hard_header() to achieve privilege escalation.
Detects anomalous staging activity associated with the 'PPPoEject' exploit. The rule identifies the creation of GRE or IP6GRE interfaces on bonding devices immediately preceding or concurrent with FUSE filesystem mounting or I/O activity. This pattern matches the exploitation workflow of racing pppoe_sendmsg() skb reallocation via dev_hard_header() to achieve privilege escalation.
Detects anomalous staging activity associated with the 'PPPoEject' exploit. The rule identifies the creation of GRE or IP6GRE interfaces on bonding devices immediately preceding or concurrent with FUSE filesystem mounting or I/O activity. This pattern matches the exploitation workflow of racing pppoe_sendmsg() skb reallocation via dev_hard_header() to achieve privilege escalation.
Detects anomalous staging activity associated with the 'PPPoEject' exploit. The rule identifies the creation of GRE or IP6GRE interfaces on bonding devices immediately preceding or concurrent with FUSE filesystem mounting or I/O activity. This pattern matches the exploitation workflow of racing pppoe_sendmsg() skb reallocation via dev_hard_header() to achieve privilege escalation.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.
Page 10 of 45