Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
938 detections
Filters
Last updated
All Time
Detection languages
476
185
75
50
39
Contributors
235
180
110
57
47
Categories
424
381
352
169
128
Platforms
583
297
49
29
22
Products / Services
221
160
135
103
88
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
938
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects the use of vulnerable kernel drivers, specifically TrueSight.sys and rentdrv2.sys, as part of a Bring Your Own Vulnerable Driver (BYOVD) technique. This activity, associated with DragonForce ransomware, involves registering or accessing these drivers and sending specific IOCTL codes (0x22E044 or 0x22E010) to terminate security software processes.
Detects indicators of the 'ShieldCrash' proof-of-concept (CVE-2026-69414 exploit bypass) on Windows systems. The rule monitors for specific malicious file activity, module loading, and the presence of decoy archive files associated with the PoC, which are used to achieve arbitrary file read as SYSTEM.
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects the execution of Certipy, an open-source tool used for enumerating and exploiting Active Directory Certificate Services (AD CS). The rule monitors for common command-line arguments used during various stages of AD CS attack lifecycle, including finding misconfigurations, requesting certificates, relaying, and template exploitation.
Detects embedded CVE-2026-46300 (Fragnesia) Linux privilege escalation exploit code used by KATARU IoT malware, copied unmodified from public PoC
Detects the execution of the 'su' binary preceded by command-line strings that are highly indicative of known Linux privilege escalation exploits, specifically those targeting vulnerabilities like PwnKit (CVE-2021-4034). The rule monitors for common exploit payloads or status messages (e.g., 'prctl PR_SET_DUMPABLE', 'fork userns mapper') associated with successful exploitation attempts that manipulate environment variables or process attributes to elevate privileges to root, while filtering out legitimate container-related processes.
Detects the execution of the 'su' binary preceded by command-line strings that are highly indicative of known Linux privilege escalation exploits, specifically those targeting vulnerabilities like PwnKit (CVE-2021-4034). The rule monitors for common exploit payloads or status messages (e.g., 'prctl PR_SET_DUMPABLE', 'fork userns mapper') associated with successful exploitation attempts that manipulate environment variables or process attributes to elevate privileges to root, while filtering out legitimate container-related processes.
Detects KATARU IoT malware samples embedding the DirtyFrag (CVE-2026-43284) Linux local privilege escalation exploit copied from public PoC code, as part of a chained LPE attempt targeting root shell spawning
Detects KATARU IoT malware samples embedding the DirtyFrag (CVE-2026-43284) Linux local privilege escalation exploit copied from public PoC code, as part of a chained LPE attempt targeting root shell spawning
Detects KATARU IoT malware embedded exploit code for CVE-2026-31431 (Copy Fail) Linux privilege escalation, identified by shared exploit-chain strings and syscall sequences used to spawn su as root
Detects KATARU IoT malware embedded exploit code for CVE-2026-31431 (Copy Fail) Linux privilege escalation, identified by shared exploit-chain strings and syscall sequences used to spawn su as root
Detects HTTP requests attempting to access 'cmd.jar' on Cisco Firepower Management Center (FMC) devices, which is indicative of post-exploitation activity related to CVE-2026-20079, where an attacker may be attempting to retrieve or upload a command executor.
Detects the loading and service creation of the CcProtect/Alinubx kernel driver, a known technique for Bring Your Own Vulnerable Driver (BYOVD) attacks. The rule identifies suspicious characteristics such as file name mismatches, unauthorized product/company signatures, and the creation of services associated with this malicious driver family (e.g., NvFsFilter) to facilitate EDR/AV termination or privilege escalation.
This rule detects the potential bypassing of Protected Process Light (PPL) in Windows, characterized by kernel-mode driver activity (such as ObOpenObjectByPointer) correlated with the mass termination of security-related processes (e.g., Defender, CrowdStrike, SentinelOne). The correlation between driver-level object handle manipulation and the termination of protected security binaries is a strong indicator of an adversary attempting to disable EDR/AV protections via kernel exploitation or driver abuse.
Detects suspicious activities originating from CrowdStrike Falcon remediation processes (e.g., CSFalconService.exe, CSFalconContainer.exe). The rule identifies two distinct patterns: either a file operation (delete, modify, rename, quarantine, or restore) followed within 2 minutes by the loading of an unsigned or non-standard DLL, or the spawning of an elevated SYSTEM process from a non-SYSTEM parent process. This behavior is indicative of potential LPE (Local Privilege Escalation) abuse via the Falcon remediation engine, often referred to as FalconFlank-style exploitation.
Detects attempts by non-privileged (non-PROXY_ADMIN) API keys to modify pass-through routes in LiteLLM via configuration update endpoints. This activity is indicative of exploitation of CVE-2026-35029, which allows unauthenticated or low-privilege users to bypass configuration restrictions.
Detects execution of shell interpreters (tar, sh, bash) by the Parallels Desktop dispatcher service (prl_disp_service) or usage of compression flags containing specific markers associated with UCP/ACTOR privilege escalation patterns, specifically when executed with root privileges or by a root user.
Detects execution of shell interpreters (tar, sh, bash) by the Parallels Desktop dispatcher service (prl_disp_service) or usage of compression flags containing specific markers associated with UCP/ACTOR privilege escalation patterns, specifically when executed with root privileges or by a root user.
Detects execution of shell interpreters (tar, sh, bash) by the Parallels Desktop dispatcher service (prl_disp_service) or usage of compression flags containing specific markers associated with UCP/ACTOR privilege escalation patterns, specifically when executed with root privileges or by a root user.
Detects execution of shell interpreters (tar, sh, bash) by the Parallels Desktop dispatcher service (prl_disp_service) or usage of compression flags containing specific markers associated with UCP/ACTOR privilege escalation patterns, specifically when executed with root privileges or by a root user.
Detects interactive root shell requests via 'sudo -i' that occur shortly after a failed Parallels appliance installation or tar extraction event containing specific error codes or configuration markers (UCP_UID=0). This pattern aligns with the exploitation chain for CVE-2026-90894, where an attacker leverages an extraction failure to escalate privileges.
Page 9 of 45