Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
20
5
1
Contributors
20
5
1
Categories
14
6
5
5
4
Platforms
26
Products / Services
8
5
1
1
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
This rule detects a specific pattern indicative of a User Account Control (UAC) bypass technique using 'IEInstal.exe'. Specifically, it looks for 'IEInstal.exe' creating a file named 'consent.exe' within a user's temporary application data directory (e.g., 'C:\Users\<username>\AppData\Local\Temp\'). This behavior is characteristic of UACMe, an open-source tool designed to exploit various UAC bypass methods.
Detects a specific User Account Control (UAC) bypass technique that involves modifying the msconfig GUI. This rule specifically looks for the creation of a file named 'pkgmgr.exe' within a user's temporary directory, which is a known indicator for the UACMe bypass method 55.
This rule detects a specific UAC bypass technique (UACMe method 39) that leverages .NET Code Profiler and DLL hijacking against mmc.exe. It specifically looks for the creation of a DLL named 'pe386.dll' within a user's temporary AppData directory, which is characteristic of this bypass method.
Detects the creation of specific files (winsat.exe or winmm.dll) in a user's temporary directory under a 'system32' subdirectory. This pattern is indicative of a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in winsat.exe, often associated with UACMe (specifically UACMe method 52). The rule looks for files created in 'C:\Users\<username>\AppData\Local\Temp\system32\' with the names 'winsat.exe' or 'winmm.dll'.
This rule detects a User Account Control (UAC) bypass technique that leverages a WoW64 logger DLL hijack, specifically referencing UACMe method 30. It identifies process access events where the source image is located in 'C:\Windows\SysWOW64\', requests full access ('0x1fffff'), and exhibits an unknown call trace pattern starting with 'UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|'. This combination of indicators suggests an attempt to elevate privileges by injecting a malicious DLL into a trusted process.
Page 2 of 2