Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
938 detections
Filters
Last updated
All Time
Detection languages
476
185
75
50
39
Contributors
235
180
110
57
47
Categories
424
381
352
169
128
Platforms
583
297
49
29
22
Products / Services
221
160
135
103
88
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
938
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects potential local privilege escalation (LPE) to root via an unshare invocation, tracking the process lineage from an unprivileged unshare execution to the subsequent spawning of a root-privileged shell within a short time window. This pattern is characteristic of various Linux kernel vulnerability exploits such as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, where the unshare system call is abused to enter new user namespaces to bypass security restrictions.
Detects potential local privilege escalation (LPE) to root via an unshare invocation, tracking the process lineage from an unprivileged unshare execution to the subsequent spawning of a root-privileged shell within a short time window. This pattern is characteristic of various Linux kernel vulnerability exploits such as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, where the unshare system call is abused to enter new user namespaces to bypass security restrictions.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Detects the execution of Certipy, an open-source tool used for enumerating and exploiting Active Directory Certificate Services (AD CS). The rule monitors for common command-line arguments used during various stages of AD CS attack lifecycle, including finding misconfigurations, requesting certificates, relaying, and template exploitation.
Detects indicators of the 'ShieldCrash' proof-of-concept (CVE-2026-69414 exploit bypass) on Windows systems. The rule monitors for specific malicious file activity, module loading, and the presence of decoy archive files associated with the PoC, which are used to achieve arbitrary file read as SYSTEM.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Detects the presence of the known vulnerable GIGABYTE driver (gdrv.sys) used in Bring Your Own Vulnerable Driver (BYOVD) attacks to bypass security controls and facilitate kernel-mode execution, as associated with Settra ransomware campaigns.
Detects the loading of the 'gdrv.sys' driver, which is a known vulnerable driver often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks to facilitate privilege escalation to kernel mode.
Detects the loading of the 'gdrv.sys' driver, which is a known vulnerable driver often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks to facilitate privilege escalation to kernel mode.
This rule detects the presence, installation, or execution attempts of the known vulnerable GIGABYTE driver (gdrv.sys). Monitoring for this specific driver is a common practice to identify attempts to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, which can be used for kernel-mode code execution and privilege escalation.
Detects the loading or execution of pkexec.so, which is indicative of exploitation attempts targeting CVE-2021-4034 (PwnKit). This vulnerability allows for local privilege escalation on Linux systems, including within compromised containers.
Detects the loading or execution of pkexec.so, which is indicative of exploitation attempts targeting CVE-2021-4034 (PwnKit). This vulnerability allows for local privilege escalation on Linux systems, including within compromised containers.
Detects interactive root shell requests via 'sudo -i' that occur shortly after a failed Parallels appliance installation or tar extraction event containing specific error codes or configuration markers (UCP_UID=0). This pattern aligns with the exploitation chain for CVE-2026-90894, where an attacker leverages an extraction failure to escalate privileges.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects unauthorized programmatic invocation of ADB pair or connect commands by an Android application. This activity is indicative of the RatHat malware family attempting to abuse Accessibility Services and Wireless Debugging to self-pair with the local ADB daemon, thereby bypassing the Android application sandbox.
Detects anomalous MS_T120 channel binding and MCS handshake patterns characteristic of the BlueKeep (CVE-2019-0708) remote code execution vulnerability in Microsoft RDP services.
Page 8 of 45