Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,443
11,831
5,875
5,151
4,864
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects the loading of the known vulnerable GIGABYTE driver (gdrv.sys) on Windows systems. Attackers leverage this driver as part of Bring Your Own Vulnerable Driver (BYOVD) attacks to perform privilege escalation by exploiting kernel-mode vulnerabilities.
The following analytic detects potential privilege escalation threats in Azure Active Directory (AD). This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals. This detection leverages the O365 Universal Audit Log data source.
Detects instances where a service account, identified by 'svc' in the account name, logs on and is assigned special privileges (Event ID 4672). This rule excludes computer accounts (ending in $) to minimize noise, as service accounts typically operate with specific, limited privileges and unusual privilege assignment could indicate an adversary abusing a service account for persistence or privilege escalation.
This rule detects potential container escape and privilege escalation attempts within a Kubernetes environment by monitoring for the creation of privileged pods, dangerous host mounts (such as /var/run/docker.sock or hostPath root mounts), and the use of escape-oriented utilities like nsenter or chroot, or access to the host's filesystem via /proc/1/root.
Detects potential local privilege escalation via Windows ALPC (Advanced Local Procedure Call) heap-based buffer overflow by identifying a non-SYSTEM Chrome process tree spawning child processes with SYSTEM privileges. The rule specifically monitors for suspicious child binaries or paths characteristic of exploit payloads while excluding legitimate Chrome update and crash handler processes.
Detects the loading of suspicious kernel drivers (Sysmon Event ID 6) that are unsigned, have invalid/revoked signatures, or are located in user-writable directories (e.g., Temp folders). This rule aims to identify Bring Your Own Vulnerable Driver (BYOVD) attacks, where adversaries load vulnerable drivers to escalate privileges or bypass security controls.
Detects high-risk AWS API calls indicative of privilege escalation within IAM (e.g., policy attachments, credential creation) or activities aimed at tampering with or disabling CloudTrail logging, which is often a precursor to or indication of unauthorized activity to evade detection.
Detects a non-root user invoking 'busctl call' against the system bus - the core of the
ptrace_may_dream / AccountsService abuse path (CVE-2026-46333 class). Enriched by decoding
the D-Bus call target (service/member), a CallCategory verdict (AccountsService account
modification, systemd run-as-root, polkit, PackageKit, generic mutating call), a burst
counter that surfaces the pidfd_getfd race loop, RiskScore / TriagePriority and DeviceInfo
context. NOTE: the FD-theft primitive itself is invisible to MDE; this detects the busctl
trigger and account-modification aftermath. Detection logic adapted from Elastic Security Labs.
ptrace_may_dream / AccountsService abuse path (CVE-2026-46333 class). Enriched by decoding
the D-Bus call target (service/member), a CallCategory verdict (AccountsService account
modification, systemd run-as-root, polkit, PackageKit, generic mutating call), a burst
counter that surfaces the pidfd_getfd race loop, RiskScore / TriagePriority and DeviceInfo
context. NOTE: the FD-theft primitive itself is invisible to MDE; this detects the busctl
trigger and account-modification aftermath. Detection logic adapted from Elastic Security Labs.
This rule identifies two distinct security threats on Windows systems: the execution or presence of files matching a known malicious SHA256 hash list, and modifications to the 'PromptOnSecureDesktop' registry key, which could indicate an attempt to weaken User Account Control (UAC) protections.
Detects the abuse of the CMSTPLUA COM object, a known technique for UAC bypass, to execute a hidden and non-profile PowerShell process. This behavior is associated with malicious activity chains like RemotePanel or BoundSiphon that aim to achieve elevated execution.
Detects potential exploitation of Active Directory Certificate Services (AD CS) misconfigurations (specifically ESC1, involving client-auth EKU and enrollee-supplies-subject). The rule correlates certificate issuance events (4886, 4887, 4888) involving sensitive templates or suspicious subject alternative name (SAN) mismatches with subsequent Kerberos PKINIT authentication (4768) events using the issued certificate.
High-fidelity correlation of OS-DET-LNX-005 and OS-DET-LNX-006: a system shell copied to a
non-standard/writable path, followed within 15 minutes on the same host by execution of a
shell with the privilege-preserving -p flag from a non-standard path. The two events
together are a near-certain SUID-root shell misconfiguration abuse (bash -p to root) and a
lower-FP signal than either component alone. Detection logic adapted from Elastic Security Labs.
non-standard/writable path, followed within 15 minutes on the same host by execution of a
shell with the privilege-preserving -p flag from a non-standard path. The two events
together are a near-certain SUID-root shell misconfiguration abuse (bash -p to root) and a
lower-FP signal than either component alone. Detection logic adapted from Elastic Security Labs.
Detects instances where a principal utilizes the iam:PassRole permission to assign a role with higher privileges to a newly created or updated compute resource (Lambda or EC2), potentially allowing the principal to assume the identity and elevated permissions of the passed role.
Detects the 'mscopilot.exe' binary performing token manipulation operations (DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken) followed by the creation of a new process with a different security context (CreateProcessAsUserW) within a five-minute window, indicative of C2 agent functionality.
Detects a sequence of events on a single device involving a remote MSI installation followed by PowerShell-based process elevation and administrative checks using fltmc.exe. This pattern is indicative of an attacker attempting to deploy malicious packages remotely and escalate privileges within the environment.
Detects 'unshare' creating a user/mount/net namespace by a non-root user, outside
sanctioned container and sandbox runtimes. This is the shared precursor across CIFSwitch,
OVSwrap, pedit COW and container escapes. Enriched with a namespace-flag decode, an
exploit-family ProfileHint (user+net = OVSwrap shape, user+mount = CIFSwitch/overlay
shape), sandbox-lineage FP suppression, RiskScore / TriagePriority and DeviceInfo context.
Treat as a precursor/triage signal - MDE cannot tie unshare to the subsequent root
transition (no uid_change event). Detection logic adapted from Elastic Security Labs.
sanctioned container and sandbox runtimes. This is the shared precursor across CIFSwitch,
OVSwrap, pedit COW and container escapes. Enriched with a namespace-flag decode, an
exploit-family ProfileHint (user+net = OVSwrap shape, user+mount = CIFSwitch/overlay
shape), sandbox-lineage FP suppression, RiskScore / TriagePriority and DeviceInfo context.
Treat as a precursor/triage signal - MDE cannot tie unshare to the subsequent root
transition (no uid_change event). Detection logic adapted from Elastic Security Labs.
Detects creation or modification of files under /etc/sudoers or /etc/sudoers.d/ by a
process outside sanctioned package- and configuration-management tooling. Writing a
passwordless sudo rule is the finishing move in CIFSwitch (CVE-2026-46243) and OVSwrap
(CVE-2026-64531) and a common root-persistence step generally. Enriched with writer
context (non-root, writable-path, shell one-liner, NOPASSWD) and a heuristic RiskScore /
TriagePriority, plus DeviceInfo host context (MachineGroup, OS, logged-on users).
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
process outside sanctioned package- and configuration-management tooling. Writing a
passwordless sudo rule is the finishing move in CIFSwitch (CVE-2026-46243) and OVSwrap
(CVE-2026-64531) and a common root-persistence step generally. Enriched with writer
context (non-root, writable-path, shell one-liner, NOPASSWD) and a heuristic RiskScore /
TriagePriority, plus DeviceInfo host context (MachineGroup, OS, logged-on users).
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
Detects the Kothamine UAC-bypass technique, which uses fodhelper.exe to spawn an elevated PowerShell process. The rule monitors for fodhelper.exe being launched without arguments (a common indicator of this bypass) followed immediately by an elevated PowerShell process containing indicators like 'elevated.ps1' or 'TailscalePortable' paths.
Detects the execution of binaries using the '-i -c <batch_file>' command-line argument pattern, which is characteristic of the NetworkServiceExploit tool used for token impersonation and privilege escalation. This rule specifically monitors for this pattern when spawned by processes like sqlservr.exe, commonly seen in exploitation chains involving xp_cmdshell.
Detects Android malware attempting to abuse accessibility services or system settings to enable wireless debugging and spawn an ADB shell with elevated privileges. This behavior is indicative of unauthorized control over the device via Android Debug Bridge (ADB).
Detects the execution of the suspicious shared library 'liblocal-service.so' from the '/data/local/tmp/' directory, initiated by the 'shell' user or an ADB parent process. This activity is associated with malicious behavior where Android debug bridge (ADB) is abused to stage and execute native daemons for privilege escalation or unauthorized system access.
Page 2 of 48