Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
20
5
1
Contributors
20
5
1
Categories
14
6
5
5
4
Platforms
26
Products / Services
8
5
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
Detects execution of auto.exe (associated with AvisLoader) combined with a specific registry-based UAC bypass technique using the ICMLuaUtil COM elevation moniker (CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7). This pattern is characteristic of UACME method 41 to achieve privilege escalation.
Detects execution of auto.exe (associated with AvisLoader) combined with a specific registry-based UAC bypass technique using the ICMLuaUtil COM elevation moniker (CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7). This pattern is characteristic of UACME method 41 to achieve privilege escalation.
Detects execution of auto.exe (associated with AvisLoader) combined with a specific registry-based UAC bypass technique using the ICMLuaUtil COM elevation moniker (CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7). This pattern is characteristic of UACME method 41 to achieve privilege escalation.
Detects execution of auto.exe (associated with AvisLoader) combined with a specific registry-based UAC bypass technique using the ICMLuaUtil COM elevation moniker (CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7). This pattern is characteristic of UACME method 41 to achieve privilege escalation.
Detects execution of auto.exe (associated with AvisLoader) combined with a specific registry-based UAC bypass technique using the ICMLuaUtil COM elevation moniker (CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7). This pattern is characteristic of UACME method 41 to achieve privilege escalation.
This rule detects modifications to specific registry keys related to shell open commands for 'ms-settings' and 'exefile'. These modifications are commonly used for persistence and UAC bypass techniques, particularly those leveraging tools like UACMe and targeting executables such as fodhelper.exe, computerdefaults.exe, and slui.exe. The rule looks for changes to 'SymbolicLinkValue', 'DelegateExecute', and '(Default)' values within these registry paths, while filtering out empty default values.
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
The following analytic detects suspicious modifications to the registry that may indicate a UAC (User Account Control) bypass attempt via the SilentCleanup task. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry changes in the path "*\Environment\windir" with executable values. This activity is significant as it can allow an attacker to gain high-privilege execution without user consent, bypassing UAC protections. If confirmed malicious, this could lead to unauthorized administrative access, enabling further system compromise and persistence.
This rule detects the execution of various Windows-based hacktools by matching their import hash (imphash). This method allows for detection even if the tool's filename has been changed. The rule includes imphashes for tools such as PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, PPLDump, NanoDump, HandleKatz, DripLoader, UACMe, WCE, Sliver Stagers, Dumpert, SysmonEnte, SysmonQuiet, ShaprEvtMute Hook, Forkatz, PPLKiller, Backstab, Forensia, EDRSandBlast, and EDRSilencer.
This rule detects a specific User Account Control (UAC) bypass technique often associated with UACMe (specifically method 22). It triggers when 'werfault.exe' is spawned with high or system integrity levels, and its parent process is 'consent.exe'. This indicates an attempt to elevate privileges by exploiting a vulnerability in how consent.exe handles process creation, leading to an auto-elevated werfault.exe.
This rule detects a specific User Account Control (UAC) bypass technique that leverages the Disk Cleanup utility (cleanmgr.exe) in conjunction with scheduled tasks. The detection logic looks for a process creation event where 'cleanmgr.exe' is executed with the '/autoclean /d C:' arguments, and its parent process is 'svchost.exe -k netsvcs -p -s Schedule', indicating it was launched by the Task Scheduler service. Furthermore, the rule specifies that the integrity level of the 'cleanmgr.exe' process must be 'High' or 'System', which is indicative of an elevated process, thus confirming a successful UAC bypass. This technique is associated with UACMe method 34.
This rule detects attempts to bypass User Account Control (UAC) using the Microsoft Connection Manager Profile Installer (CMSTP) by abusing specific autoelevate-capable COM objects. The detection logic looks for processes where 'DllHost.exe' is the parent process, the parent command line contains specific COM Process IDs associated with CMSTP or related components, and the process is running with 'High' or 'System' integrity levels. This technique is often used by adversaries to elevate privileges without user interaction.
This rule detects attempts to bypass User Account Control (UAC) using the 'ComputerDefaults.exe' utility, specifically when it is executed with elevated integrity levels (High or System) and not as a child process of common system directories like 'System32' or 'Program Files'. This behavior is characteristic of UAC bypass tools such as UACMe (method 59).
Detects a specific User Account Control (UAC) bypass technique leveraging 'ieinstal.exe' as a parent process. The rule looks for processes with 'High' or 'System' integrity levels, where the parent process is 'ieinstal.exe' and the created process is 'consent.exe' located in a temporary directory ('\AppData\Local\Temp\'). This pattern is characteristic of the UACMe tool's method 64.
Detects a specific User Account Control (UAC) bypass technique that leverages the 'changepk.exe' and 'slui.exe' executables. This method is associated with UACMe bypass technique #61, where 'slui.exe' is used as a parent process to launch 'changepk.exe' with elevated privileges, bypassing the UAC prompt. The rule specifically looks for 'changepk.exe' being spawned by 'slui.exe' with an integrity level of 'High' or 'System'.
Detects User Account Control (UAC) bypass attempts leveraging NTFS reparse points and wusa.exe DLL hijacking, specifically targeting techniques similar to UACMe method 36. This rule identifies the creation of processes with elevated integrity levels (High or System) executing 'wusa.exe' with a specific command line pattern pointing to a temporary update.msu file, or 'dism.exe' as a parent process launching 'DismHost.exe' with a suspicious command line containing temporary paths.
This rule detects the creation of a named file stream (Alternate Data Stream - ADS) containing specific Imphash values associated with known hack tools. The Imphash values are for tools such as Mimikatz, PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, NanoDump, HandleKatz, DripLoader, UACMe, Dumpert, EDRSandBlast, and others. Adversaries often use ADSs to hide malicious executables or data to evade detection by traditional security tools that may not scan alternate data streams.
Detects the execution of UACMe, a tool used for User Account Control (UAC) bypasses, by identifying specific PE metadata (Product, Company, Description, OriginalFileName) or image names. It also includes a selection of known IMPHASH values associated with UACMe's 'Akagi' component.
Detects a specific User Account Control (UAC) bypass technique involving the creation of a file named 'comctl32.dll' within a directory structure that starts with 'C:\Windows\System32\consent.exe.@'. This pattern is indicative of UACMe (specifically UACMe 22) attempting to elevate privileges by manipulating how consent.exe loads libraries.
Detects the creation of a specific DLL file ('api-ms-win-core-kernel32-legacy-l1.DLL') within a user's temporary directory. This pattern is indicative of a User Account Control (UAC) bypass technique that leverages NTFS reparse points and DLL hijacking, often associated with tools like UACMe (specifically UACMe 36). The rule looks for the exact file path in a user's AppData\Local\Temp directory.
This rule detects a specific User Account Control (UAC) bypass technique leveraging the Windows Media Player component. Specifically, it looks for the creation of a file named 'OskSupport.dll' within a user's temporary directory, combined with 'DllHost.exe' accessing 'osk.exe' located in the Windows Media Player directory. This pattern is indicative of the UACMe tool's method 32, which exploits a vulnerability related to Windows Media Player to elevate privileges without user interaction.
Page 1 of 2