Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,443
11,831
5,875
5,151
4,864
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects the execution of elevated cmd.exe processes (running with High or System integrity) spawned by parent processes originating from the AppData directory. This pattern is commonly associated with malicious installers, droppers, or payload execution where a staged binary in the user profile attempts to perform administrative actions.
Detects a SYSTEM-level dllhost.exe process, associated with specific COM object instantiation (CLSID {135fd325-45b7-4c30-89f8-4386961669f0}), loading a DLL from the C:\ProgramData\ directory. This behavior is indicative of an attacker-planted DLL being unmarshaled through a crafted OBJREF, effectively bypassing security controls like EOAC_NO_CUSTOM_MARSHAL.
Detects a specific execution pattern associated with the PIVOTPIPE RAT involving two consecutive operator-issued commands. First, a process impersonation action (token theft/impersonation) is detected via PROCESS_OPEN activity, followed by a 'RevertToSelf' call within the same process context. This sequence indicates an attempt to temporarily shift privilege context to impersonate another user before returning to the original security context.
Detects high-risk IAM policy modifications, specifically the attachment or creation of policies that grant wildcard permissions or full administrator access. The rule optionally correlates these permission changes with the recent creation of access keys or service account credentials for the same principal, indicating potential preparation for persistence or unauthorized access escalation.
Detects high-risk AWS IAM privilege escalation activities, such as attaching AdministratorAccess policies, creating new access keys, roles, or users, occurring shortly after a suspicious sign-in event (e.g., impossible travel or new device login with MFA) for the same principal.
This rule detects potential privilege escalation exploiting a dangling COM object registration (CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}). It monitors for a non-SYSTEM user creating a DLL within the 'CrossDevice' ProgramData folder, followed by a scheduled task trigger, and subsequently detects 'dllhost.exe' running as SYSTEM loading that specific malicious DLL, indicating successful execution of unauthorized code with elevated privileges.
This rule detects potential privilege escalation exploiting a dangling COM object registration (CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}). It monitors for a non-SYSTEM user creating a DLL within the 'CrossDevice' ProgramData folder, followed by a scheduled task trigger, and subsequently detects 'dllhost.exe' running as SYSTEM loading that specific malicious DLL, indicating successful execution of unauthorized code with elevated privileges.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
Detects the suspicious execution of ServiceModelReg.exe or command lines containing the 'Elevation:Administrator!new:' string, which is associated with bypasses of Windows User Account Control (UAC). The rule excludes trusted system processes like msiexec, TrustedInstaller, and svchost to reduce noise.
Detects the loading or execution of pkexec.so, which is indicative of exploitation attempts targeting CVE-2021-4034 (PwnKit). This vulnerability allows for local privilege escalation on Linux systems, including within compromised containers.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects the execution of command interpreters or scripting engines spawned by the ManageEngine ADSelfService Plus GINA client process (typically present at the Windows logon screen). This activity is highly suspicious as it indicates potential command injection or abuse of a pre-authentication component running at SYSTEM privileges.
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
Detects modifications to the Windows Registry subkeys associated with the 'ms-settings' URI scheme, which are targeted by the 'fodhelper.exe' UAC bypass technique. The rule correlates registry operations in HKCU with the execution of fodhelper.exe to identify attempts to elevate privileges without triggering a UAC prompt.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Detects exploitation attempts by the CARBONATO botnet targeting exposed Docker daemons. The rule monitors for container escape techniques using 'nsenter' to access host namespaces, the execution of specific malicious entrypoint scripts, the use of known malicious container image references, and the creation of privileged containers with host bind mounts, which are indicative of host filesystem and network compromise.
Detects exploitation attempts by the CARBONATO botnet targeting exposed Docker daemons. The rule monitors for container escape techniques using 'nsenter' to access host namespaces, the execution of specific malicious entrypoint scripts, the use of known malicious container image references, and the creation of privileged containers with host bind mounts, which are indicative of host filesystem and network compromise.
Page 8 of 48