Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
7
6
4
3
2
Contributors
7
4
3
2
2
Categories
5
4
4
4
4
Platforms
22
2
2
Products / Services
6
4
4
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule detects suspicious command-line flag combinations often used by tools like PsExec to execute commands with elevated privileges, specifically targeting 'system' or 'administrator' accounts. It looks for the presence of user-setting flags ('-u system', '--user system', '-u NT', etc.) combined with command execution flags ('-c cmd', '-c powershell', '-c whoami', etc.). This pattern is indicative of an attempt to escalate privileges or execute commands as a highly privileged user.
Page 2 of 2