Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,443
11,831
5,872
5,155
4,866
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects suspicious child processes spawned by AnyDesk.exe or AnyDesk-runtime.exe that may indicate local privilege escalation. This rule specifically targets the abuse of the adprinterpipe named pipe and CoUnmarshalInterface to impersonate SYSTEM-level AnyDesk processes, allowing for the execution of unauthorized child processes.
Detects potential privilege escalation within the MyBB Administrative Control Panel (ACP). The rule identifies POST requests to user management modules that set a user's group ID (gid) or usergroup to 4, which typically corresponds to the administrator group in MyBB. It verifies the escalation by correlating it with a prior session that lacked administrator privileges and identifying a subsequent login event.
Detects unauthorized attempts to escalate privileges within the MyBB Admin Control Panel (ACP) by creating a new account or modifying an existing one to belong to the administrator group (gid=4). This is indicative of an attacker attempting to gain full administrative control by bypassing module-level access restrictions.
Detects exploitation of the SystemInformer PhSvc service by monitoring for rundll32.exe launching with command-line arguments indicative of loading a proof-of-concept DLL and attempting to communicate with the SiSvcApiPort ALPC port. This activity is associated with abusing privileged helper APIs to perform unauthorized SYSTEM-level process creation or service installation.
Detects attempts to bypass User Account Control (UAC) by abusing 'eventviewer.exe'. This rule specifically looks for 'eventviewer.exe' being initiated by suspicious processes like 'powershell.exe', 'cmd.exe', 'rundll32.exe', or 'Optimax.dll', while excluding legitimate command-line usage of 'eventvwr.exe'.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring specific registry modifications (ms-settings, mscfile) and the unexpected execution of child processes from high-integrity binaries like fodhelper.exe and eventvwr.exe, or processes launched with the runas command from high-integrity contexts.
Detects execution patterns associated with the DirtyClone local privilege escalation exploit. The rule monitors for the execution of the exploit binary, compilation of related exploit source code, the creation of combined user and network namespaces via unshare, manipulation of IPsec xfrm states/policies by unprivileged users, and the spawning of a root shell via su. These activities are indicative of an attempt to elevate privileges from an unprivileged context to root.
Detects the execution of the Windows runas command using the /savecred flag. This flag instructs Windows to save the supplied credentials locally, which can be abused by unauthorized users to elevate privileges or execute processes in the context of a saved account without providing a password again.
Detects potentially malicious process execution behaviors, including the use of 'runas.exe' with saved credentials, the execution of 'runas.exe' by unauthorized users, and unauthorized cross-process access to sensitive Windows system processes such as lsass.exe, winlogon.exe, or services.exe, which are common indicators of credential access or privilege escalation attempts.
This rule detects suspicious activity involving container runtimes (e.g., Docker) that indicates potential container escape attempts or unauthorized host interaction. It flags scenarios where container processes spawn administrative shells (cmd.exe, powershell.exe) with SYSTEM privileges, instances of privileged container creation, or direct access to physical drives from container management tools, which are common indicators of host filesystem manipulation.
Detects the execution of known privilege escalation tools (JuicyPotato, RoguePotato, PrintSpoofer) or command-line arguments indicative of token impersonation attempts (e.g., usage of SeImpersonatePrivilege) to escalate privileges on Windows systems.
This rule detects suspicious activity involving container runtimes (e.g., Docker) that indicates potential container escape attempts or unauthorized host interaction. It flags scenarios where container processes spawn administrative shells (cmd.exe, powershell.exe) with SYSTEM privileges, instances of privileged container creation, or direct access to physical drives from container management tools, which are common indicators of host filesystem manipulation.
Detects attempts to bypass User Account Control (UAC) by either modifying the registry key associated with the ms-settings protocol handler or by executing the fodhelper.exe binary via cmd.exe. These techniques are commonly used by attackers to gain elevated privileges without triggering a UAC prompt.
Detects attempts to bypass User Account Control (UAC) by either modifying the registry key associated with the ms-settings protocol handler or by executing the fodhelper.exe binary via cmd.exe. These techniques are commonly used by attackers to gain elevated privileges without triggering a UAC prompt.
Detects the execution of the 'unshare' utility with arguments that create new user, network, and mount namespaces (-U, -n, -r) by a non-root user. This technique is often used to bypass namespace restrictions or perform privilege escalation by gaining elevated capabilities within a new, user-controlled namespace.
Detects the execution of known Windows privilege escalation tools (often referred to as 'Potato' exploits) which leverage various Windows service vulnerabilities or print spooler manipulation to escalate user privileges to SYSTEM level.
Detects the execution of known Windows privilege escalation tools (often referred to as 'Potato' exploits) which leverage various Windows service vulnerabilities or print spooler manipulation to escalate user privileges to SYSTEM level.
Detects attempts to bypass User Account Control (UAC) using fodhelper.exe or eventvwr.exe. This rule specifically looks for these processes initiating other processes with 'High' or 'System' integrity levels, where the initiated process is not fodhelper.exe or eventvwr.exe itself. This behavior is indicative of UAC bypass techniques.
Detects potential Windows privilege escalation attempts where a user account is assigned the SeImpersonatePrivilege and subsequently executes known exploitation tools (e.g., Potato-family exploits) within a short window. This pattern often indicates an attempt to escalate to SYSTEM privileges by abusing token impersonation vulnerabilities.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects the execution of known privilege escalation tools such as SweetPotato, JuicyPotato, RoguePotato, PrintSpoofer, and BadPotato. These tools are commonly used by attackers to escalate privileges on compromised Windows systems.
Page 37 of 48