Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,443
11,831
5,872
5,155
4,866
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.
Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode
Detects potential exploitation of VMware CVE-2025-41244, where a privileged VMware service discovery script executes a binary from a world-writable directory like /tmp. This behavior is consistent with the local privilege escalation technique used by UNC5174.
This rule detects suspicious activities related to Protected Process Light (PPL) and driver loading that could indicate privilege escalation, defense evasion, or impact. Specifically, it looks for:
1. Processes running with 'System' integrity that were initiated by a process with a lower integrity level, which could suggest an attempt to elevate privileges.
2. Driver image load events where 'ntoskrnl.exe' is the initiating process, but the driver is loaded from a location outside of the standard 'System32' or 'System32\drivers' directories. This could indicate an adversary attempting to load malicious drivers to evade detection or persist.
3. DriverLoad actions initiated by 'ntoskrnl.exe' from outside the standard 'System32' or 'System32\drivers' directories, similar to the image load events, pointing to potential malicious driver activity.
1. Processes running with 'System' integrity that were initiated by a process with a lower integrity level, which could suggest an attempt to elevate privileges.
2. Driver image load events where 'ntoskrnl.exe' is the initiating process, but the driver is loaded from a location outside of the standard 'System32' or 'System32\drivers' directories. This could indicate an adversary attempting to load malicious drivers to evade detection or persist.
3. DriverLoad actions initiated by 'ntoskrnl.exe' from outside the standard 'System32' or 'System32\drivers' directories, similar to the image load events, pointing to potential malicious driver activity.
The following analytic detects when a process with low, medium, or high integrity spawns a system integrity process from a user-controlled location. This behavior is indicative of privilege escalation attempts where attackers elevate their privileges to SYSTEM level from a user-controlled process or service. The detection leverages Sysmon data, specifically Event ID 15, to identify such transitions. Monitoring this activity is crucial as it can signify an attacker gaining SYSTEM-level access, potentially leading to full control over the affected system, unauthorized access to sensitive data, and further malicious activities.
This analytic detects when a process running with low or medium integrity from a user account spawns an elevated process with high or system integrity in suspicious locations. This behavior is identified using process execution data from Windows process monitoring or Sysmon EventID 1. This activity is significant as it may indicate a threat actor successfully elevating privileges, which is a common tactic in advanced attacks. If confirmed malicious, this could allow the attacker to execute code with higher privileges, potentially leading to full system compromise and persistent access.
Detects repeated denied UAC elevation attempts (UAC "prompt storms") initiated by the same process within a short time frame.
This detection is based entirely on Microsoft Defender for Endpoint (MDE) telemetry from DeviceProcessEvents and is useful in environments where traditional SecurityEvent logs (e.g. Event ID 4688) are unavailable or not ingested.
It identifies patterns where a process consistently triggers `consent.exe` (the UAC prompt), but no elevated child process follows — indicating the prompt was denied or ignored.
This is particularly useful for detecting UAC bombing attacks, where a malicious process tries to overwhelm the user with repeated elevation prompts to bypass security friction.
This detection is based entirely on Microsoft Defender for Endpoint (MDE) telemetry from DeviceProcessEvents and is useful in environments where traditional SecurityEvent logs (e.g. Event ID 4688) are unavailable or not ingested.
It identifies patterns where a process consistently triggers `consent.exe` (the UAC prompt), but no elevated child process follows — indicating the prompt was denied or ignored.
This is particularly useful for detecting UAC bombing attacks, where a malicious process tries to overwhelm the user with repeated elevation prompts to bypass security friction.
Detects attempts to add sensitive privileges to a process token, a common technique for local privilege escalation. This could be part of an exploit chain following an information disclosure vulnerability like CVE-2025-53136.
Detects a sequence of events indicative of privilege escalation via TrustedInstaller token manipulation, a technique used by MostereRAT. The rule looks for a process starting the 'TrustedInstaller' service and then immediately launching a new process as the SYSTEM user.
Detects potential DLL hijacking attempts used by DarkVision RAT for privilege escalation. The malware places a malicious 'DXGI.dll' in a non-standard path to be loaded by 'WinSAT.exe'.
Detects suspicious downloads or fetches of common privilege-escalation tools such as winPEAS, linPEAS, PowerUp, Seatbelt, SharpUp, WinPwn, PrivescCheck, Sherlock, Watson, BeRoot, LinEnum, LSE/LES, Linux Exploit Suggester, pspy, or GTFObins. These tools are often used by adversaries after initial access to enumerate the environment and attempt local privilege escalation.
The following analytic detects a process attempting to duplicate the handle of winlogon.exe from an uncommon or public source path. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights and excluding common system paths. This activity is significant because it may indicate an adversary trying to escalate privileges by leveraging the high-privilege tokens associated with winlogon.exe. If confirmed malicious, this could allow the attacker to gain elevated access, potentially leading to full system compromise and persistent control over the affected host.
Detects when a non-approved application is granted high-risk permissions via consent in Azure AD.
This is a common method for attackers to achieve persistence and privilege escalation in Microsoft 365 environments.
This is a common method for attackers to achieve persistence and privilege escalation in Microsoft 365 environments.
This detection identifies Windows service installations (Event ID 4697) where potentially dangerous permissions like Everyone:Full Control or Authenticated Users:Full Control may be assigned to the service executable.
Such configurations can lead to privilege escalation via service binary hijacking.
Note:
Field index positions in EventData.Data[] may vary depending on the system and must be manually verified using parse_xml(EventData).
This detection requires the following audit subcategory to be enabled:
Audit Policy: Audit Kernel Object (under Object Access)
Such configurations can lead to privilege escalation via service binary hijacking.
Note:
Field index positions in EventData.Data[] may vary depending on the system and must be manually verified using parse_xml(EventData).
This detection requires the following audit subcategory to be enabled:
Audit Policy: Audit Kernel Object (under Object Access)
Detects the execution of eudcedit.exe, the Windows Private Character Editor, which may be abused to bypass User Account Control (UAC) and achieve privilege escalation. Threat actors can leverage this trusted, auto-elevating binary to execute malicious payloads without prompting the user, particularly when UAC settings are permissive.
This detection identifies instances where a Windows service is installed with a file path that contains spaces but is not enclosed in quotation marks. Such misconfigurations can be exploited by attackers for privilege escalation using unquoted service path vulnerabilities. This detection helps administrators identify and remediate potentially insecure service installations.
Detects potential exploitation of Dell ControlVault vulnerabilities (dubbed 'ReVault') by monitoring for related service crashes or the abnormal loading of the `bcmbipdll.dll` module. An attacker with local access can exploit these vulnerabilities for privilege escalation or persistence.
This rule detects when a user is added to an administrative or management role in Azure Active Directory outside of defined business hours. It specifically looks for 'Add member to role completed' or 'Add app role assignment grant to user' operations where the target role contains 'admin' or 'Manage', and the event occurs outside of the configured business hours (7 AM to 6 PM local time, Monday to Friday).
KQL Query from file: Sentinel UEBA Privilege Escalation Detection
Page 44 of 48