Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
938 detections
Filters
Last updated
All Time
Detection languages
476
185
75
50
39
Contributors
235
180
110
57
47
Categories
424
381
352
169
128
Platforms
583
297
49
29
22
Products / Services
221
160
135
103
88
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
938
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
This rule detects a suspicious `explorer.exe` subprocess spawned by `RazerInstaller.exe` with elevated privileges (System integrity level). While `explorer.exe` can be legitimately invoked by the installer to select a different installation folder, this specific behavior with System integrity can indicate an attempt to exploit a vulnerability in the RazerInstaller software for privilege escalation to LOCAL SYSTEM.
Detects suspicious child processes created by CrushFTP, which could indicate the exploitation of a Remote Code Execution (RCE) vulnerability like CVE-2025-54309. The rule specifically looks for PowerShell, cmd, bitsadmin, certutil, mshta, cscript, or wscript processes spawned by CrushFTP, often with command-line arguments indicative of malicious activity (e.g., IEX, encoded commands for PowerShell, or common system commands for cmd).
This rule detects exploitation attempts of the privilege escalation vulnerability CVE-2019-1378. The vulnerability involves the Windows 10 Update Assistant (WUA) executing `SetupComplete.cmd` or `PartnerSetupComplete.cmd` with elevated privileges. An attacker can place a malicious script in `C:\Windows\Setup\Scripts\` which will then be executed by `cmd.exe` during the update process, leading to privilege escalation. The rule specifically looks for `cmd.exe` being the parent process, executing a command line that contains `C:\Windows\Setup\Scripts\` and ends with either `SetupComplete.cmd` or `PartnerSetupComplete.cmd`, while filtering out legitimate system processes that might also execute commands from these directories.
Detects the loading of the kernel driver associated with the Process Hacker tool. This tool, while legitimate, can be used by adversaries for various malicious activities, including bypassing security controls, inspecting processes, and potentially escalating privileges. The rule identifies the driver by its filename and specific import hashes.
Detects the invocation of TabTip.exe via DCOM with a specific error ID, which is indicative of the JuicyPotatoNG tool being used in brute force mode for local privilege escalation. This technique leverages a DCOM vulnerability to elevate privileges.
Detects a suspicious printer driver installation where the 'Manufacturer' registry value is set to an empty string. This behavior can be indicative of malicious activity, potentially related to privilege escalation or defense evasion, as seen in some exploits like PrintNightmare (CVE-2021-1675).
Detects the execution of the 'sudo' command with the '--chroot' option, which is used to change the root directory for command execution. Attackers may use this technique to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
Detects loading of known malicious drivers via their hash.
Detects loading of known malicious drivers via the file name of the drivers.
Detects the load of known vulnerable drivers via the file name of the drivers.
Detects potential exploitation of CVE-2025-41244, a local privilege escalation vulnerability in VMware Tools and Aria Operations.
An attacker can stage a malicious binary in a world-writable directory (e.g., /tmp) which is then executed with root privileges by the VMware service discovery mechanism when it attempts to determine the binary's version.
An attacker can stage a malicious binary in a world-writable directory (e.g., /tmp) which is then executed with root privileges by the VMware service discovery mechanism when it attempts to determine the binary's version.
Detects potential exploitation of VMware CVE-2025-41244, where a privileged VMware service discovery script executes a binary from a world-writable directory like /tmp. This behavior is consistent with the local privilege escalation technique used by UNC5174.
Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
This rule detects instances of 'WerFaultSecure.exe' being spawned by an unusual or unexpected parent process. 'WerFaultSecure.exe' is a legitimate Windows component responsible for error reporting and crash dumping. Adversaries may abuse this process, particularly for memory dumping (e.g., LSASS dumping) to evade defenses and escalate privileges. The rule identifies parent processes that are not part of a predefined list of legitimate parents (wermgr.exe, svchost.exe, csrss.exe, WerFault.exe). It assigns a suspicion score and risk level based on the initiating process's filename (e.g., PowerShell, CMD, Explorer) and folder path (e.g., Temp, AppData, Users). It also extracts the target Process ID (PID) and dump type from the command line, and checks for suspicious parameters, to provide a comprehensive risk assessment.
Detects the execution of CoercedPotato, a tool used for privilege escalation. The rule specifically looks for the executable name 'CoercedPotato.exe', the command-line argument '--exploitId', or specific import hashes (IMPHASH) associated with the tool. This tool leverages vulnerabilities to achieve higher privileges on a system.
The analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. It identifies drivers not located in typical directories like Windows, Program Files, or SystemRoot. This activity is significant because adversaries may use these non-standard paths to load malicious or vulnerable drivers, potentially bypassing security controls. If confirmed malicious, this could allow attackers to execute code at the kernel level, escalate privileges, or maintain persistence within the environment, posing a severe threat to system integrity and security.
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID). This could be a sign of exploitation of elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
Detects the creation of the Active Directory group "ESX Admins". Threat actors create this group to exploit CVE-2024-37085, which grants any member of this group administrative privileges on domain-joined VMware ESXi hypervisors.
This rule detects suspicious activities related to Protected Process Light (PPL) and driver loading that could indicate privilege escalation, defense evasion, or impact. Specifically, it looks for:
1. Processes running with 'System' integrity that were initiated by a process with a lower integrity level, which could suggest an attempt to elevate privileges.
2. Driver image load events where 'ntoskrnl.exe' is the initiating process, but the driver is loaded from a location outside of the standard 'System32' or 'System32\drivers' directories. This could indicate an adversary attempting to load malicious drivers to evade detection or persist.
3. DriverLoad actions initiated by 'ntoskrnl.exe' from outside the standard 'System32' or 'System32\drivers' directories, similar to the image load events, pointing to potential malicious driver activity.
1. Processes running with 'System' integrity that were initiated by a process with a lower integrity level, which could suggest an attempt to elevate privileges.
2. Driver image load events where 'ntoskrnl.exe' is the initiating process, but the driver is loaded from a location outside of the standard 'System32' or 'System32\drivers' directories. This could indicate an adversary attempting to load malicious drivers to evade detection or persist.
3. DriverLoad actions initiated by 'ntoskrnl.exe' from outside the standard 'System32' or 'System32\drivers' directories, similar to the image load events, pointing to potential malicious driver activity.
Page 37 of 45