Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
938 detections
Filters
Last updated
All Time
Detection languages
476
185
75
50
39
Contributors
235
180
110
57
47
Categories
424
381
352
169
128
Platforms
583
297
49
29
22
Products / Services
221
160
135
103
88
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
938
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects suspicious process execution patterns associated with the exploitation of CVE-2026-46300 (Fragnesia). The rule monitors for the combination of user namespace creation via unshare, network tunnel configuration via ip, and kernel module loading related to ESP or rxrpc, which are indicative of an attempt to trigger a privilege escalation vulnerability in the Linux kernel.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP). The rule identifies HTTP POST requests, likely generated by a limited-privilege account, that attempt to create a new user with Administrator permissions (gid=4) or modify an existing user's group assignment to the Administrator group, bypassing standard ACP permission controls.
Detects the execution of known exploit-related binaries or command lines, including references to specific exploit source files (e.g., 'pedit_cow_demo', 'packet_edit_meme'), CVE identifiers, or specific traffic control (tc) configurations potentially used in exploitation activities.
This rule detects potential exploitation of the DirtyClone vulnerability (CVE-2026-43503) by correlating prerequisites (XFRM state/policy creation, specific kernel module loading, or namespace manipulation) with a subsequent local privilege escalation where an unprivileged process spawns a root shell using 'su'.
Detects a process running as NT AUTHORITY\SYSTEM that was spawned by a parent process not belonging to known legitimate SYSTEM-spawning Windows components. This behavioral pattern is a strong indicator of local privilege escalation (LPE), consistent with techniques such as CVE-2026-41091 (RedSun) and similar LPE exploits.
Detects artifacts and behavioral patterns associated with the exploitation of the SystemInformer PhSvc (Process Hacker Service) ALPC channel to escalate privileges. The rule monitors for unauthorized rundll32.exe process activity spawning cmd.exe with specific command line arguments, the creation of PoC-related files, and the loading of unsigned modules into the rundll32.exe process.
Detects suspicious unprivileged process behavior associated with the exploitation of CVE-2026-43503 (DirtyClone). The rule identifies non-root users invoking 'unshare' or 'clone' with namespace-related flags (CLONE_NEWUSER, CLONE_NEWNET), followed by critical writes to namespace mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) which are prerequisite steps for elevating to CAP_NET_ADMIN privileges.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects local privilege escalation attempts targeting AnyDesk by exploiting COM object registration. The attack involves registering a malicious COM server in HKCU to intercept the AnyDesk service's interaction with the print pipe, followed by process token impersonation to gain SYSTEM privileges. The rule monitors for unauthorized COM registration, anomalous process execution from AnyDesk, and cross-process access.
Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.
Detects the use of legitimate administrative tools (regsvcs.exe, infinstall.exe, devcon.exe) being executed with command-line arguments indicative of driver or kernel-level installations (e.g., 'kernel', 'ring0', 'driver install'). This behavior is commonly associated with the installation of rootkits or the execution of Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode privileges.
Detects suspicious activity involving the combination of user or network namespace creation using 'unshare' or 'ip' and subsequent manipulation of kernel networking queues using 'tc' (Traffic Control). This behavioral pattern is frequently observed in Linux kernel exploits designed to achieve local privilege escalation by creating namespaces and using the 'tc' subsystem to trigger vulnerabilities. The rule further refines matches by flagging commands or parent processes residing in directories associated with staging or temporary storage, such as /tmp or /dev/shm.
Detects a potential privilege escalation attempt where an unprivileged user executes a SUID-capable binary (su, sudo, passwd), followed immediately by the creation of a root-owned shell process. This pattern is indicative of exploitation of local privilege escalation vulnerabilities, such as page cache poisoning (e.g., CVE-2026-46331).
Detects the suspicious combination of 'aa-exec' (commonly associated with AppArmor or specific container runtime wrappers) being followed by the execution of 'unshare' with flags used to manipulate kernel namespaces (user, network). This pattern is often indicative of container breakouts or privilege escalation attempts where an adversary leverages namespace isolation to gain higher privileges on the host.
Detects evidence of the DirtyClone (CVE-2026-43503) Linux kernel privilege escalation exploit. The rule identifies a multi-stage attack chain, including the compilation of the exploit binary, creation of unprivileged user and network namespaces required for the exploit, and the use of the 'ip' utility to configure XFRM states/policies for page cache corruption.
Detects in-memory privilege escalation patterns associated with the 'DirtyClone' (CVE-2026-43503) vulnerability. The rule monitors for a sequence of events where an unprivileged process utilizes 'unshare' to create user and network namespaces in conjunction with IPsec XFRM tunnel configurations, immediately followed by the execution of 'su' or 'sudo', resulting in unauthorized root access without disk-based modification of binary files.
This rule detects command line activity associated with the exploitation of a Linux kernel vulnerability involving packet editing (often referred to as the 'pedit' or 'act_pedit' vulnerability). It monitors for the execution of exploit-specific binaries, kernel module loading of 'act_pedit', use of 'unshare' for namespace abuse, and configuration of 'tc' (traffic control) filters related to the exploit.
This rule detects activities associated with the DirtyClone (CVE-2026-43503) privilege escalation vulnerability on Linux systems. It monitors for the execution of exploit binaries from world-writable directories, the modification of critical process memory mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) by non-root users, the use of unshare to create user namespaces as a precondition, and the anomalous spawning of shells by the SUID binary /usr/bin/su.
Detects execution of the CVE-2026-46331 exploit chain, which utilizes unprivileged user namespace creation to escalate privileges followed by malicious Linux traffic control (tc) pedit actions to achieve kernel-level page cache corruption.
Detects a privilege escalation technique that exploits the Windows Error Reporting (WER) 'QueueReporting' scheduled task. An attacker leverages the Task Scheduler COM API to trigger this task, causing 'wermgr.exe' to execute as SYSTEM from an attacker-controlled directory (often via directory junction redirection), subsequently spawning shell processes.
Detects attempts to exploit the Zerologon vulnerability (CVE-2020-1472) for privilege escalation and domain compromise. This rule monitors for a high volume of Netlogon secure channel failures (Event ID 5805), machine account password resets to a zeroed/blank state (Event ID 4742 for computer accounts with specific password indicators), anomalous Netlogon service restarts (Event ID 7036), and Azure AD Identity Protection risk events referencing Zerologon or Netlogon anomalies. These indicators collectively suggest an active exploitation attempt of the Zerologon vulnerability.
Page 26 of 45