Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
Products / Services
1
CVEs
71
71
64
58
49
This rule detects suspicious activity related to the Windows User Profile Service, specifically looking for EventID 1511 (Windows cannot find the local profile and is logging you on with a temporary profile) from the 'Microsoft-Windows-User Profiles Service' provider. This event, especially when combined with EventID 1515 (user profile loaded successfully) and the creation of a '\Users\TEMP' directory, can indicate an attempt to exploit vulnerabilities like CVE-2021-34484 or CVE-2022-21919 for privilege escalation. The rule focuses on the initial indication of a temporary profile being loaded.
