Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,443
11,831
5,872
5,155
4,866
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects attempts to bypass User Account Control (UAC) using PowerShell's Start-Process cmdlet with the -Verb RunAs parameter, often seen in techniques like Operation Poisson. This method attempts to trigger the Windows consent dialog for privilege escalation, potentially leveraging auto-elevating binaries like fodhelper.exe, eventvwr.exe, sdclt.exe, or cmstp.exe.
Detects the KuinaExtractor UAC bypass technique, which exploits the auto-elevated 'SilentCleanup' scheduled task. The rule identifies suspicious activity via two patterns: the execution of 'cleanmgr.exe' from an unexpected parent process (bypassing normal task scheduler invocation) or the explicit execution of 'schtasks.exe' to trigger the 'SilentCleanup' task.
Detects potential UAC bypass or privilege escalation attempts involving the 'runas' command. The rule identifies suspicious process patterns such as non-standard parent processes invoking runas, self-relaunching applications with elevated command-line flags, and specific executable naming conventions associated with known threat actor activities.
Detects User Account Control (UAC) bypass attempts where known auto-elevating Windows binaries like fodhelper.exe, eventvwr.exe, or sdclt.exe are used as proxy processes to launch child processes with high integrity without user prompts.
Detects execution of the tc (traffic control) utility with pedit actions by non-root users. This pattern is indicative of exploitation attempts targeting the Linux kernel act_pedit subsystem (CVE-2026-46331), which can lead to page cache corruption and local privilege escalation.
Detects suspicious process execution patterns associated with the exploitation of CVE-2026-46300 (Fragnesia). The rule monitors for the combination of user namespace creation via unshare, network tunnel configuration via ip, and kernel module loading related to ESP or rxrpc, which are indicative of an attempt to trigger a privilege escalation vulnerability in the Linux kernel.
Detects the use of 'unshare' or 'ip' commands by non-root users to manipulate Linux namespaces (e.g., user, network, or xfrm namespaces). These commands can be used to bypass security restrictions, facilitate container escapes, or perform local privilege escalation by exploiting vulnerabilities in the Linux kernel namespace subsystem.
Detects execution artifacts and prerequisite activities associated with the DirtyClone (CVE-2026-43503) local privilege escalation exploit. This includes monitoring for the creation of unprivileged user namespaces, loading specific kernel modules (esp4, esp6, rxrpc) often used in such exploits, compilation of associated exploit source files, and direct interaction with /proc/self/mem to perform memory-based exploitation.
Detects instances where the Windows binary fodhelper.exe spawns various shell or utility processes. This behavior is a common indicator of a User Account Control (UAC) bypass attack, where the attacker leverages the auto-elevation property of fodhelper.exe to execute arbitrary commands with higher privileges.
Detects SYSTEM privilege escalation attempts via ctfmon.exe or cloudfiles.exe processes.
Detects potentially malicious process execution behaviors, including the use of 'runas.exe' with saved credentials, the execution of 'runas.exe' by unauthorized users, and unauthorized cross-process access to sensitive Windows system processes such as lsass.exe, winlogon.exe, or services.exe, which are common indicators of credential access or privilege escalation attempts.
Detects the execution of the 'unshare' utility with arguments that create new user, network, and mount namespaces (-U, -n, -r) by a non-root user. This technique is often used to bypass namespace restrictions or perform privilege escalation by gaining elevated capabilities within a new, user-controlled namespace.
This rule detects the modification of the SID History attribute on Active Directory accounts (Event ID 4765) or failed attempts to do so (Event ID 4766). The SID History attribute can be abused to gain unauthorized access and escalate privileges across domain boundaries by injecting well-known or administrative SIDs, a technique known as SID-History Injection.
Detects attempts to bypass User Account Control (UAC) by abusing 'eventviewer.exe'. This rule specifically looks for 'eventviewer.exe' being initiated by suspicious processes like 'powershell.exe', 'cmd.exe', 'rundll32.exe', or 'Optimax.dll', while excluding legitimate command-line usage of 'eventvwr.exe'.
This rule detects the installation of known vulnerable kernel drivers (Bring Your Own Vulnerable Driver - BYOVD). These drivers are often exploited by adversaries to gain kernel-level code execution, elevate privileges, or disable security tools (EDR).
Detects anomalous activities associated with the Zerologon (CVE-2020-1472) vulnerability. The rule identifies suspicious machine account password changes, NTLM authentication from potentially untrusted subnets or unconfigured workstations, and privilege escalation indicators occurring on domain controllers.
Detects suspicious named pipe server creation by Medium/Low integrity processes followed by a SYSTEM-level process spawned from the same initiating process within a short correlation window. This behavior is indicative of an attacker attempting to escalate privileges using named pipe impersonation.
Detects a process running at SYSTEM integrity level spawned by a parent process that is not typically associated with SYSTEM-level process creation (e.g., services.exe, lsass.exe). This behavior is characteristic of token impersonation or process spawning abuse (e.g., CreateProcessWithTokenW) used by post-exploitation frameworks like Cobalt Strike or tools involved in the StrikeShark campaign to escalate privileges.
This rule detects unauthorized modifications to the Windows Image File Execution Options (IFEO) registry keys for accessibility binaries (sethc.exe, utilman.exe, osk.exe, magnify.exe, narrator.exe). Adversaries often replace or redirect these binaries to execute arbitrary code (often a backdoor or persistent access tool) with high privileges, typically triggered at the Windows login screen. The rule specifically looks for a 'debugger' registry value containing 'win_guard_'.
Detects the execution of a malicious file named wusvc.exe, known as the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update Service. The rule identifies instances where this file is run from suspicious locations (e.g., Downloads folder) or triggers UAC elevation despite not being associated with recognized Windows update processes.
Page 33 of 48