Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,456
11,839
5,876
5,155
4,865
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
This rule detects potential attempts to exploit kernel vulnerabilities related to the Stream Control Transmission Protocol (SCTP) within a containerized environment, followed by suspicious file creation activity in sensitive system directories (e.g., /root/). It correlates logs showing SCTP socket configuration activity with subsequent filesystem modifications within a short 5-minute window.
This rule detects the execution of 'pkexec' or 'sudo' by a low-privilege web server process (e.g., Apache, Nginx, PHP-FPM) that results in a process running with root privileges. This pattern is indicative of privilege escalation attempts targeting local vulnerabilities, such as CVE-2021-4034 (PwnKit) or CVE-2021-3156 (Baron Samedit), where a compromised web application account attempts to elevate to root.
Detects the UAC self-elevation behavior associated with DeadLock ransomware, specifically the repeated creation and execution of randomly named 8-character .cmd files in user-writable directories (Temp, ProgramData, AppData). The detection triggers when multiple execution attempts are identified within a short window, suggesting a retry loop when UAC prompts are not immediately accepted.
Detects potentially suspicious explicit credential logon events where the user
is trying to logon with explicit credentials (username and password) that are
different from the current user context. It might indicate an attacker attempting
to escalate privileges after obtaining credentials for a different user account.
is trying to logon with explicit credentials (username and password) that are
different from the current user context. It might indicate an attacker attempting
to escalate privileges after obtaining credentials for a different user account.
This rule detects potential token impersonation or duplication events, often used to escalate privileges or move laterally, by monitoring 'TokenDuplication' and 'ImpersonationEvent' actions. It further refines these signals by looking for associated in-memory DLL loads performed by processes other than standard system components (svchost.exe or services.exe).
Detects the execution of 'su' or 'sh' binaries from within suspicious application-specific directories on Android devices. These directories typically house application libraries or data, and execution of system binaries from these locations, particularly when combined with arguments like 'persisted' or 'exit', is indicative of privilege escalation attempts or malicious persistence mechanisms by Android malware.
This rule detects instances where a Google Cloud Platform (GCP) identity attempts to grant themselves highly privileged IAM roles at the project level. It monitors 'SetIamPolicy' events in GCP audit logs, filtering for activities where the actor (user) is included in the set of members receiving high-privilege roles such as owner, editor, or various administrative roles (e.g., storage.admin, compute.admin).
This rule detects potential token impersonation or duplication events, often used to escalate privileges or move laterally, by monitoring 'TokenDuplication' and 'ImpersonationEvent' actions. It further refines these signals by looking for associated in-memory DLL loads performed by processes other than standard system components (svchost.exe or services.exe).
Detects local processes invoking the splice() syscall with the MSG_SPLICE_PAGES flag to map file descriptors of readable SUID-root binaries directly into network socket buffers. This is the core technique behind CVE-2026-31635 (DirtyDecrypt), which corrupts the page cache of SUID-root binaries by placing their pages into attacker-controlled network packets before authentication completes.
Detects a non-root local process gaining a root shell or executing a SUID-root binary shortly after AF_RXRPC (rxrpc) network socket activity on the same device, consistent with exploitation of the DirtyDecrypt RxGK decrypt-before-authentication flaw to corrupt page-cache pages of SUID-root binaries and gain root.
Detects an unprivileged local user invoking keyctl to add a key of type rxrpc_s to a keyring they control, enabling userspace reproduction of the kernel's RxGK token encryption key derivation as part of CVE-2026-31635 (DirtyDecrypt) exploitation.
Detects a suspicious sequence of events where a browser process (Firefox or Tor) is followed by a process escalation to root within 15 minutes on the same device. This pattern is indicative of a browser sandbox escape combined with kernel privilege escalation (e.g., exploitation of CVE-2026-10702 and CVE-2026-43499).
Detects the full LegacyHive local privilege escalation chain (disclosed by Nightmare-Eclipse, July 2026): a TOCTOU race against the Windows User Profile Service (ProfSvc) using GLOBALROOT Object Manager symlinks and an oplock to trick ProfSvc, running as SYSTEM, into loading a different user's UsrClass.dat registry hive than the one it authenticated for.
This rule chains 3 stages on the same host within a 15-minute window:
(1) a staging copy of UsrClass.dat appearing outside its normal AppData profile path, typically in a randomly named folder off a drive root;
(2) an explicit-credential logon (Security 4648) immediately followed by a secondary-logon session (4624, LogonType 2, seclogon/Advapi) consistent with CreateProcessWithLogonW + LOGON_WITH_PROFILE;
(3) svchost.exe (ProfSvc) subsequently loading a UsrClass.dat whose profile owner does not match the helper account used in stage 2.
Requires Windows Security Event logs (Logon/Logoff auditing for 4648/4624) and Microsoft Defender for Endpoint DeviceFileEvents ingested into the same Sentinel workspace.
Known gap: Object Manager symlink creation and oplock placement, the mechanisms that perform the actual redirection, are not natively covered by Security auditing or MDE; consider supplementing with Sysmon/ETW if available.
Lab simulation checklist before enabling as high severity:
- Run the public PoC (https://github.com/MSNightmare/LegacyHive) against a lab VM with Security auditing (Logon/Logoff, Account Logon) and MDE onboarded.
- Confirm Stage 1 fires on the staging UsrClass.dat copy path and folder-name pattern.
- Confirm Stage 2's 4648/4624 pairing and LogonProcessName value match your OS build (may differ across Windows 10/11/Server releases).
- Confirm Stage 3's InitiatingProcessAccountName attribution for svchost.exe/ProfSvc; if it reports SYSTEM instead of the helper account, replace the ProfileOwner != Helper check with a LogonId/TargetLogonId correlation to Stage 2.
- Tune the staging-folder regex ag
This rule chains 3 stages on the same host within a 15-minute window:
(1) a staging copy of UsrClass.dat appearing outside its normal AppData profile path, typically in a randomly named folder off a drive root;
(2) an explicit-credential logon (Security 4648) immediately followed by a secondary-logon session (4624, LogonType 2, seclogon/Advapi) consistent with CreateProcessWithLogonW + LOGON_WITH_PROFILE;
(3) svchost.exe (ProfSvc) subsequently loading a UsrClass.dat whose profile owner does not match the helper account used in stage 2.
Requires Windows Security Event logs (Logon/Logoff auditing for 4648/4624) and Microsoft Defender for Endpoint DeviceFileEvents ingested into the same Sentinel workspace.
Known gap: Object Manager symlink creation and oplock placement, the mechanisms that perform the actual redirection, are not natively covered by Security auditing or MDE; consider supplementing with Sysmon/ETW if available.
Lab simulation checklist before enabling as high severity:
- Run the public PoC (https://github.com/MSNightmare/LegacyHive) against a lab VM with Security auditing (Logon/Logoff, Account Logon) and MDE onboarded.
- Confirm Stage 1 fires on the staging UsrClass.dat copy path and folder-name pattern.
- Confirm Stage 2's 4648/4624 pairing and LogonProcessName value match your OS build (may differ across Windows 10/11/Server releases).
- Confirm Stage 3's InitiatingProcessAccountName attribution for svchost.exe/ProfSvc; if it reports SYSTEM instead of the helper account, replace the ProfileOwner != Helper check with a LogonId/TargetLogonId correlation to Stage 2.
- Tune the staging-folder regex ag
Detects osascript executing AppleScript containing 'do shell script ... with administrator privileges' to elevate execution, where the osascript process was spawned by a non-shell parent process, consistent with the EtherHiding macOS loader technique.
Detects execution of the LegacyHive proof-of-concept (PoC) binary or its unique command-line indicators. LegacyHive exploits a Windows User Profile Service vulnerability to perform arbitrary registry hive loading, which can be utilized for privilege escalation.
Detects attempts to bypass User Account Control (UAC) by modifying specific registry keys (ms-settings or mscfile) used for shell execution. By hijacking these classes and adding a command, attackers can force a system-native, auto-elevating binary (like fodhelper.exe, eventvwr.exe, or computerdefaults.exe) to execute malicious code with high integrity.
This rule detects execution of msiexec.exe involving specific internal method calls ('CElevate', 'CleanupTempPackages', 'FDeleteFolder'). These calls are associated with abusing the Windows Installer elevation mechanism to perform folder deletion with SYSTEM-level privileges.
Detects the use of the Windows 'reg.exe load' command to mount registry hive files from file paths other than the standard user-specific hive locations (ntuser.dat or usrclass.dat). This behavior is often associated with privilege escalation or post-exploitation techniques where attackers attempt to load sensitive system hives, such as SAM or SECURITY, into the registry for offline analysis or credential dumping.
Detects the mounting of a registry hive into an HKEY_USERS Classes root where the SID embedded in the registry key path does not match the SID of the process account that initiated the operation. This behavior is associated with the 'LegacyHive' exploitation technique, where an attacker attempts to mount another user's (or administrator's) registry hive into their own context to facilitate privilege escalation.
Detects attempts to bypass User Account Control (UAC) by invoking the CMSTPLUA COM interface (CLSID: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}). This technique allows an attacker to execute processes with elevated privileges by leveraging the auto-elevation property of this COM object, often using the 'Elevation:Administrator!new' moniker.
Detects a registry hijack of the 'ms-settings\Shell\Open\command' key, followed by the execution of auto-elevated binaries 'fodhelper.exe' or 'computerdefaults.exe'. The rule identifies potential UAC bypass attempts by correlating these registry modifications with the subsequent spawning of an unsigned or unrecognized child process by the auto-elevated binary.
Page 20 of 48