Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,443
11,831
5,872
5,155
4,866
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects User Account Control (UAC) bypass attempts where a registry key (e.g., ms-settings, mscfile, or Folder shell open command) is created or modified in HKCU, followed within 2 minutes by the execution of an elevated child process (High or System integrity level) by known auto-elevating binaries: fodhelper.exe, computerdefaults.exe, or eventvwr.exe.
Detects potential User Account Control (UAC) bypass attempts where a process hijacks registry keys associated with 'ms-settings' or 'mscfile' handlers (commonly used for auto-elevating binaries) and subsequently executes an arbitrary binary from a suspicious location like AppData or Temp.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
This rule detects scenarios where an unknown or suspicious executable (named HFY.exe) interacts with Windows binaries commonly used for User Account Control (UAC) bypass attacks, such as eventvwr.exe, fodhelper.exe, and consent.exe. The detection monitors process creation events (Sysmon Event ID 1 or Windows Event ID 4688) for direct execution or parent-child relationships involving these binaries, which are often used to elevate privileges without user interaction.
Detects suspicious process execution patterns associated with the 'HFY.exe' utility, including potential User Account Control (UAC) bypass attempts via auto-elevating Windows binaries like eventvwr, fodhelper, and sdclt, as well as specific command-line parameters for 'tcc.exe'.
Detects the execution of tcc.exe with command-line arguments indicative of file operations often associated with UAC bypass techniques. The rule also monitors for the loading of UAC-related DLLs or child processes by tcc.exe, which further suggests activity aimed at gaining elevated privileges.
Detects local privilege escalation attempts targeting the SystemInformer (ProcessHacker) PHSVC service. The rule identifies suspicious child process execution from trusted hosts (rundll32.exe, SystemInformer.exe) occurring simultaneously with a connection to the SiSvcApiPort named pipe, which is indicative of the abuse of the SystemInformer service channel for privilege escalation.
Detects UAC bypass activity associated with BeepRAT (Operation DragonClone) which involves modifying registry keys associated with auto-elevating Windows binaries (fodhelper, eventvwr, sdclt, ComputerDefaults), followed by the execution of these binaries and the subsequent loading of DLL/bin payloads from user-writable AppData directories. The rule also detects reads of the 'Creeper' registry key used for BeepRAT C2 configuration.
Detects execution of rundll32.exe with 'phsvc' command line arguments, and the subsequent spawning of potentially malicious child processes (cmd, powershell, wscript, mshta, calc) from the SystemInformer.exe process. This behavior indicates potential abuse of the PhSvcApiCreateProcessIgnoreIfeoDebugger functionality within SystemInformer to bypass debugger-related detection or gain unauthorized execution context.
This rule detects the loading or execution of known vulnerable kernel drivers. These drivers are often leveraged by adversaries in Bring Your Own Vulnerable Driver (BYOVD) attacks to achieve privilege escalation by exploiting vulnerabilities in the driver to execute code in kernel mode.
Detects Potato attack tools for Windows privilege escalation
This rule detects various suspicious activities related to privilege escalation and access token manipulation. It identifies the enablement of sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeImpersonatePrivilege) by non-system processes, suspicious API calls for token impersonation/duplication (ImpersonateNamedPipeClient, DuplicateTokenEx) from non-privileged processes, and the creation of SYSTEM child processes by medium-integrity parent processes. These behaviors are often indicative of an attacker attempting to elevate privileges on a compromised system.
This rule detects various stages of exploitation activity associated with the System Informer PHSVC (Process Hacker Service) proof-of-concept (PoC). It monitors for the loading of the PoC DLL via rundll32, the spawning of processes using the specific PoC marker string, unexpected elevated child processes spawned by SystemInformer.exe, and the creation of services or PoC artifacts that facilitate privilege escalation or persistence.
This rule detects suspicious activities associated with the exploitation of AnyDesk, specifically targeting COM printer impersonation for privilege escalation and subsequent persistence. It monitors for: 1) AnyDesk or AnyDesk-runtime spawning suspicious child processes (e.g., cmd, powershell, sc), 2) unauthorized processes accessing the 'adprinterpipe' named pipe used for privilege escalation, and 3) the creation of new Windows services originating from the AnyDesk process chain.
Detects exploitation of the SystemInformer phsvc service via ALPC port abuse and trusted-host bypass. The attack involves loading a malicious DLL into the Microsoft-signed rundll32.exe process to bypass trust checks, subsequently connecting to the '\BaseNamedObjects\SiSvcApiPort' to invoke privileged APIs for LPE.
This rule detects a POST request to the MyBB administrative interface (specifically the user-users module) that contains parameters indicating an attempt to escalate a limited administrative user to a full administrator by assigning the 'usergroup=4' or 'gid=4' identifier, which corresponds to the default Administrator group in MyBB.
Detects potential local privilege escalation attempts targeting the SystemInformer PhSvc service. The rule identifies suspicious child processes spawned from rundll32.exe (acting as a proxy) or other common binaries, where the process chain indicates an interaction with the SiSvcApiPort or the use of phsvc-related command-line arguments, potentially leading to unauthorized elevated process creation or service installation.
Detects evidence of a local privilege escalation attempt targeting the SystemInformer (formerly Process Hacker) phsvc service. The detection identifies the loading of a known proof-of-concept DLL into rundll32.exe, the creation of specific indicator files on disk, or rundll32.exe executing command-line payloads associated with the exploit.
Detects anomalous process execution patterns associated with the Gitea Act Runner that indicate attempts to break out of container isolation. This includes the use of sensitive Docker flags like --privileged, --pid=host, or --ipc=host, the mounting of the Docker daemon socket, or the execution of nsenter to gain access to the host namespace, which are indicative of container escape techniques.
This rule detects potential local privilege escalation attempts targeting the AnyDesk printer service. The rule monitors for unauthorized COM server registration (COM hijacking) and the subsequent spawning of suspicious child processes (e.g., cmd.exe, PowerShell) directly linked to the AnyDesk process tree. This behavior is indicative of exploiting the AnyDesk COM object printer impersonation vulnerability to gain NT AUTHORITY\SYSTEM privileges.
Detects local privilege escalation attempts targeting the SystemInformer (formerly Process Hacker) PHSVC service. Adversaries can abuse the SiSvcApiPort ALPC port by using rundll32.exe to load specific malicious payloads that call privileged service APIs, such as PhSvcCreateProcessIgnoreIfeoDebugger or PhSvcCreateService, effectively bypassing standard user restrictions.
Page 36 of 48