Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,443
11,831
5,875
5,151
4,864
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects a specific privilege escalation and code execution chain attributed to the PUROSANGUE methodology. This activity involves using a COM Elevation Moniker (specifically with the 'Elevation:Administrator!new:' syntax) to bypass UAC, followed by process hollowing into ServiceModelReg.exe. The attack is initiated from unconventional parent processes such as vsdbg.exe or its associated DLL.
Detects the execution of pythonw.exe spawned by ComputerDefaults.exe, which is a known technique for bypassing User Account Control (UAC) to achieve elevated privileges. This rule specifically tracks instances where a Python script is initiated and subsequently triggered by the UAC-bypassing binary within a 5-minute window.
This rule monitors for potential privilege escalation activity occurring shortly after an initial authentication event. It includes two primary vectors: 1) Azure AD users assigned to highly privileged roles shortly after a successful sign-in; 2) Users performing interactive or remote logons to Linux/Unix systems followed quickly by sudo or su commands to obtain root privileges.
Detects the use of the Windows Terminal Services console tool (tscon.exe) to hijack active or disconnected Remote Desktop sessions. Attackers often execute this with SYSTEM privileges, frequently initiated via service control utilities like sc.exe, schtasks.exe, or services.exe, to gain unauthorized access to user sessions without requiring credentials.
Detects the assignment of SeDebugPrivilege or SeImpersonatePrivilege to a non-SYSTEM account, followed by the execution of a new process from common service parents (spoolsv.exe, w3wp.exe, dllhost.exe) within the same logon session. This behavior is indicative of privilege escalation attempts using local potato-style exploits (e.g., PrintSpoofer, JuicyPotato) that leverage service tokens for impersonation.
Detects the execution of known privilege escalation tools and the use of specific Windows privilege keywords (such as SeImpersonatePrivilege) often associated with access token manipulation and token impersonation attacks to elevate privileges to SYSTEM.
This rule detects potential Windows token manipulation by correlating logon events containing sensitive privileges (SeDebugPrivilege/SeImpersonatePrivilege) with subsequent process creation events under a different user context within a short timeframe. It further validates the activity by incorporating Sysmon Event ID 10 alerts that identify process access patterns commonly associated with token duplication or impersonation techniques used in post-exploitation frameworks like Cobalt Strike.
Detects the assignment of special, highly privileged rights (e.g., SeDebugPrivilege, SeImpersonatePrivilege) to standard user accounts using Windows Security Event ID 4672. This activity, without an associated new logon event, is a common indicator of access token manipulation or impersonation techniques (such as those used by tools like Incognito) to gain elevated system privileges.
Detects the loading of known-vulnerable signed drivers typically associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks. These drivers are frequently abused to gain kernel-mode privileges, allowing attackers to disable or terminate EDR, antivirus, and other security processes.
KQL Query
Detects execution of the Microsoft Connection Manager Profile Installer (cmstp.exe) with suspicious command-line parameters (using remote INF files via UNC or HTTP) or when it spawns unexpected child processes, both of which are indicative of potential bypass of User Account Control (UAC) or security controls.
Detects a shell launched with the privilege-preserving -p flag from a location outside the
standard binary directories - the execution step that converts a SUID-root shell copy into
an interactive root shell. Pairs directly with OS-DET-LNX-005 (see correlation
OS-DET-LNX-007). Detection logic adapted from Elastic Security Labs.
standard binary directories - the execution step that converts a SUID-root shell copy into
an interactive root shell. Pairs directly with OS-DET-LNX-005 (see correlation
OS-DET-LNX-007). Detection logic adapted from Elastic Security Labs.
Detects the creation or execution of a scheduled task named 'CreateObjectTask' via schtasks or PowerShell, which is associated with spawning 'dllhost.exe' as a child process under high-privileged parent processes (svchost, taskeng, or schtasks). This behavior is indicative of potential COM hijacking or privilege escalation techniques leveraging system tasks.
Detects the dllhost.exe process, running with SYSTEM privileges, loading a dynamic link library (DLL) from a user-writable path within the ProgramData directory. This behavior is consistent with the abuse of COM marshaling, specifically exploiting dangling CLSID entries to force a privileged COM host process to unmarshal and load an attacker-controlled DLL.
This rule detects potential privilege escalation exploiting a dangling COM object registration (CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}). It monitors for a non-SYSTEM user creating a DLL within the 'CrossDevice' ProgramData folder, followed by a scheduled task trigger, and subsequently detects 'dllhost.exe' running as SYSTEM loading that specific malicious DLL, indicating successful execution of unauthorized code with elevated privileges.
This rule detects potential privilege escalation exploiting a dangling COM object registration (CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}). It monitors for a non-SYSTEM user creating a DLL within the 'CrossDevice' ProgramData folder, followed by a scheduled task trigger, and subsequently detects 'dllhost.exe' running as SYSTEM loading that specific malicious DLL, indicating successful execution of unauthorized code with elevated privileges.
Detects potential abuse of SeLoadDriverPrivilege to load unsigned or malicious drivers, often associated with Bring Your Own Vulnerable Driver (BYOVD) attacks. The rule identifies the creation of randomized service keys used to facilitate driver loading, followed by the actual loading of a driver, or explicit command-line references to the privilege being utilized.
Detects process execution events where a process is launched with command line arguments containing 's' as an isolated character (often indicative of token stealing tools like Incognito or similar utilities) combined with a discrepancy in the initiating process account or logon session, suggesting potential token duplication or impersonation.
Detects instances where the suspicious binary 'x47_bot.exe' performs process injection or hollows a process, followed by an attempt to gain or elevate privileges (such as via UAC bypass, token manipulation, or privilege checking) on the same host within a 15-minute window.
Detects the execution of command interpreters or scripting engines spawned by the ManageEngine ADSelfService Plus GINA client process (typically present at the Windows logon screen). This activity is highly suspicious as it indicates potential command injection or abuse of a pre-authentication component running at SYSTEM privileges.
Detects potential local privilege escalation via Windows ALPC (Advanced Local Procedure Call) heap-based buffer overflow by identifying a non-SYSTEM Chrome process tree spawning child processes with SYSTEM privileges. The rule specifically monitors for suspicious child binaries or paths characteristic of exploit payloads while excluding legitimate Chrome update and crash handler processes.
Page 7 of 48