Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,443
11,831
5,872
5,155
4,866
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects attempts to bypass User Account Control (UAC) by launching specific Windows applications (eventvwr.exe, fodhelper.exe, computerdefaults.exe, slui.exe) that can auto-elevate, when initiated by cmd.exe or powershell.exe. This rule specifically excludes executions from standard system directories (system32, syswow64) to reduce false positives from legitimate system operations.
Detects potential PPID spoofing and process injection activity associated with SharkLoader and Cobalt Strike. The rule monitors for cross-process injection into critical system processes or shell spawning from suspicious directories (AppData/Roaming or ProgramData/KasperskyLab), typically used by SharkLoader to stage payloads or perform parent process spoofing.
Detects unauthorized User Account Control (UAC) bypass attempts involving the SNOWLIGHT dropper (UNC5221). The rule identifies child processes running at High or System integrity levels that were spawned by a Medium integrity parent process. It specifically triggers when the child binary contains a 'requireAdministrator' manifest, suggesting silent elevation without a user prompt, and exhibits process token impersonation capabilities.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP) by monitoring limited-privilege accounts accessing restricted modules (e.g., plugins, templates, user groups). It correlates these web requests with file system changes in the plugin directory by the web server process and monitors application logs for suspicious administrative activity.
Detects token manipulation activity indicative of VILE ransomware attempting privilege escalation. The rule monitors for the usage of Windows token-related APIs such as AdjustTokenPrivileges, LookupPrivilegeValueW, DuplicateTokenEx, and SetTokenInformation, which are commonly used by malicious actors to elevate their security context.
Detects HTTP POST requests to MyBB Admin Control Panel modules restricted to superadministrators (e.g., user management, group configuration, settings) initiated by non-privileged accounts. This activity is consistent with privilege escalation exploitation patterns where internal authorization checks might be bypassed.
Detects local privilege escalation attempts targeting the SystemInformer service (phsvc.exe) IPC mechanism. The rule identifies suspicious process activity, including the side-loading of a PoC DLL into rundll32.exe, the spawning of child processes from the SystemInformer service context, and the presence of PoC artifacts in system paths, which are used to gain SYSTEM-level execution.
This rule correlates commands indicative of privilege escalation (checking local administrator groups or user privileges) with subsequent manipulation of Quality of Service (QoS) policies via WMI. This sequence of events suggests an attacker gaining elevated privileges and then attempting to throttle network traffic, potentially to hinder EDR/security tool communication or data exfiltration.
Detects the use of command-line arguments associated with Windows token impersonation techniques (e.g., 'SeImpersonate', 'ImpersonateLoggedOnUser') initiated by common command-line interpreters (powershell.exe, cmd.exe, wmic.exe). This activity is often indicative of an adversary attempting to elevate privileges by stealing or manipulating access tokens.
This rule detects the execution of 'GodPotato-NET4.exe', a known tool used to escalate privileges to SYSTEM on Windows systems. Detection is based on the file name or its presence in the process command line.
Detects the execution of known Windows privilege escalation tools commonly used in post-exploitation scenarios, such as JuicyPotato, PrintSpoofer, and other 'Potato' variants, by monitoring for process file names associated with these utilities.
This rule detects the execution of 'eventviewer.exe' by scripting engines such as 'wscript.exe', 'cscript.exe', or 'vbscript.exe'. This behavior is indicative of a User Account Control (UAC) bypass technique where 'eventviewer.exe' is abused to elevate privileges without user interaction.
This rule monitors process events for the combined usage of multiple Windows security APIs associated with access token manipulation. Specifically, it flags processes that call two or more of the following functions: AdjustTokenPrivileges, LookupPrivilegeValueW, SetTokenInformation, OpenProcessToken, DuplicateTokenEx, or GetTokenInformation. This behavior is indicative of token stealing or impersonation attempts, often used by malware such as Vile Ransomware to escalate privileges or bypass security controls. The rule also includes heuristic filtering for common system processes.
Detects 'gp_v6_exec.py', a script automating GodPotato privesc for MuddyWater. This rule specifically looks for the execution of this Python script via its command line.
Detects the Go binary executing Windows token manipulation APIs to duplicate tokens and elevate to SYSTEM. Specifically looks for 'setup.exe' performing 'DuplicateTokenExApiCall' or 'SetThreadTokenApiCall'.
Detects the use of specific Linux utilities often associated with container escape or privilege escalation exploits. This includes the use of 'aa-exec' with restricted profiles, 'unshare' for namespace manipulation, and specific command-line patterns targeting vulnerability-related exploitation scripts.
Detects activities associated with the exploitation of the Netfilter vulnerability CVE-2023-32233. The rule monitors for the compilation or execution of known exploit binaries (e.g., packet_edit_meme), the use of 'unshare' for namespace-based privilege escalation (gaining CAP_NET_ADMIN), the loading of the 'act_pedit' kernel module, and potential AppArmor bypass attempts via 'aa-exec'.
Detects the use of 'unshare' to create new kernel namespaces or 'tc' (Traffic Control) with specific parameters (pedit) to manipulate packet headers. These tools are often leveraged by adversaries to perform privilege escalation or network redirection/manipulation within a Linux environment.
Detects the script escalating privileges using the stolen password via sudo to strip quarantine extended attributes from the payload.
Detects execution of Linux Traffic Control (tc) commands, module loading, or specific strings related to the exploitation of CVE-2026-46331, involving the act_pedit kernel component. These activities are associated with a potential kernel-level copy-on-write (COW) page cache corruption vulnerability that could be used for privilege escalation.
Detects the execution of the Linux 'tc' (traffic control) utility with 'act_pedit' by an unprivileged (non-root) user. This pattern is associated with attempts to leverage the CVE-2026-46331 vulnerability, which involves a Copy-on-Write (COW) kernel exploit triggered through malicious netlink operations in the traffic control subsystem to achieve privilege escalation.
Page 38 of 48