Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,456
11,839
5,876
5,155
4,865
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Detects instances where the msiexec.exe process, running under the local system account (S-1-5-18), deletes files located within the 'C:\Config\.Msi' directory. This behavior is often associated with the misuse of the Windows Installer service or exploitation techniques intended to leverage system-level file operations for privilege escalation or persistence.
Detects the usage of the Google Cloud IAM Credentials API to generate OAuth access tokens, OIDC ID tokens, sign JWTs, or sign blobs as a service account. This behavior indicates an identity assuming a service account's permissions, a common technique for privilege escalation or lateral movement in GCP environments.
Detects potential token impersonation activities where 'DuplicateTokenEx' or 'ImpersonateLoggedOnUser' functions are used in conjunction with 'explorer.exe'. This pattern is often used by adversaries to perform unauthorized privilege escalation or lateral movement by impersonating the security context of a logged-on user.
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Detects the creation or modification of Registry keys and values associated with Image File Execution Options (IFEO). Adversaries commonly abuse IFEO for persistence, privilege escalation, or to hijack process execution by attaching malicious debuggers to legitimate system binaries, such as MsMpEng.exe, or by creating temp hive mounts.
Detects instances where known Windows auto-elevate binaries (fodhelper.exe, computerdefaults.exe, eventvwr.exe) are executed without a corresponding UAC consent.exe process. This behavior is indicative of a UAC bypass, often facilitated by registry key modifications (COM hijacking) to manipulate how these binaries are launched.
Detects high-integrity or system-level processes launched by specific shellcode-like filenames or processes containing 'ICMLuaUtil' in the command line. This technique is often indicative of a UAC bypass attempt, where malicious actors attempt to elevate privileges by abusing the ICMLuaUtil COM interface, while excluding the standard Windows consent dialog processes.
Detects potential local privilege escalation attempts leveraging the AnyDesk printer named pipe (adprinterpipe). The rule monitors for the creation of the adprinterpipe, the spawning of processes with SYSTEM privileges from an AnyDesk parent, and the loading of suspicious DLLs by AnyDesk, which are indicative of an exploit leveraging insecure COM unmarshaling callbacks.
This rule monitors system and audit logs on network appliances (like Cisco vManage) for unauthorized attempts to escalate privileges to a rogue root user ('troot') and suspicious file manipulation or command execution related to tenant list management, often associated with exploitation of specific vulnerabilities.
Detects modifications to the Image File Execution Options (IFEO) registry keys for critical Windows accessibility binaries such as osk.exe, utilman.exe, sethc.exe, magnify.exe, and narrator.exe. This technique is commonly used by adversaries to establish persistence or facilitate unauthenticated privilege escalation by replacing these tools with malicious executables (e.g., cmd.exe) that execute when triggered from the Windows login screen.
Detects the loading of the vulnerable OPSWAT AppRemover driver (pcdhost.sys) from a non-standard file path, often used as a Bring Your Own Vulnerable Driver (BYOVD) technique by the ResiLoader malware to elevate privileges and gain kernel-level access to terminate security software. The rule also monitors for mass process termination events indicative of successful security product disabling.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring for suspicious registry modifications in HKCU\Software\Classes associated with auto-elevating binaries (such as fodhelper.exe, computerdefaults.exe, or eventvwr.exe), followed shortly by the execution of these binaries or their child processes. This pattern is indicative of an adversary attempting to elevate privileges by hijacking the command registry keys used by these trusted Windows binaries.
Detects instances where a process is spawned with a spoofed parent process ID (PPID) that points to a known security software or EDR component. Attackers perform this technique to inherit the security exclusions applied to trusted security processes, thereby effectively bypassing EDR/AV monitoring.
Detects the creation of or connection to the specific named pipe '\\pipe\\RoguePlanet', which is used as a synchronization and callback channel by the Nightmare Eclipse RoguePlanet exploit (CVE-2026-50656). This exploit leverages the named pipe to facilitate communication between a low-privileged exploit process and a SYSTEM-level Windows Error Reporting (WER) task payload during a local privilege escalation attempt.
Detects the creation of the named pipe '\pipe\RoguePlanet', which is specifically utilized by the RoguePlanet CVE-2026-50656 exploit. The exploit uses this pipe for synchronization during a TOCTOU race condition against MsMpEng.exe. Once the race is won, a SYSTEM-level payload (typically masquerading as a child process of wermgr.exe) uses this pipe to verify the originating session and subsequently spawn an interactive shell as NT AUTHORITY\SYSTEM. This pipe name is unique to this exploit and not used by legitimate software.
Detects the execution of 'ElevatorShellCode.exe' or the presence of 'ICMLuaUtil' in command-line arguments. 'ICMLuaUtil' is a known Windows COM interface frequently abused for UAC bypass and privilege escalation, while 'ElevatorShellCode' is indicative of suspicious tools attempting to gain higher integrity levels.
Detects specific User Account Control (UAC) bypass techniques involving fodhelper.exe, eventvwr.exe, and sdclt.exe, often used in conjunction with PowerShell 'RunAs' elevation to install system-level tools like Tailscale or OpenSSH, as observed in Operation Poisson.
Detects the abuse of the Windows Error Reporting (WER) service mechanism, specifically targeting the 'QueueReporting' scheduled task. Attackers may employ junction-based path redirection to execute a malicious wermgr.exe binary located outside of the standard system directory. The rule identifies instances where wermgr.exe is running from non-standard locations, or running at SYSTEM integrity level spawned by standard task-related parent processes, which indicates a potential privilege escalation or persistence attempt (linked to CVE-2026-50656).
This rule detects activities indicative of the RoguePlanet exploit, which utilizes NTFS junction swapping to stage malicious operations. It monitors for the creation of suspicious system-like directories within temporary paths, writing of executables (like wermgr.exe) to those paths, unprivileged manipulation of the Windows Defender Quarantine directory, and virtual disk image mounting from user-writable directories.
Detects the execution of known Windows binaries (fodhelper.exe, eventvwr.exe, computerdefaults.exe) which are frequently abused for User Account Control (UAC) bypass by exploiting their auto-elevation capability. These binaries are monitored as either the parent process or the target image, which is a common indicator of a UAC bypass attempt.
Page 22 of 48