Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects an unprivileged local user invoking keyctl to add a key of type rxrpc_s to a keyring they control, enabling userspace reproduction of the kernel's RxGK token encryption key derivation as part of CVE-2026-31635 (DirtyDecrypt) exploitation.
Detects creation of WindowsData*.log files directly under the KnownDllPath directory (C:\Windows\System32) by an unsigned process, consistent with Phantom Mantis G13 kernel-assisted EDR killer driver activity.
Detects driver IOCTL calls associated with Object Manager callback-based anti-tamper protection combined with CR0.WP manipulation and access-right stripping (PROCESS_TERMINATE/PROCESS_VM_WRITE/PROCESS_DUP_HANDLE) targeting security-product process handles.
Detects G13 kernel driver IOCTL calls used to enumerate and unregister security-vendor minifilter drivers, restricted to unsigned callers targeting known AV/EDR minifilter altitude ranges.
Detects a suspicious sequence of events where a browser process (Firefox or Tor) is followed by a process escalation to root within 15 minutes on the same device. This pattern is indicative of a browser sandbox escape combined with kernel privilege escalation (e.g., exploitation of CVE-2026-10702 and CVE-2026-43499).
Detects the full LegacyHive local privilege escalation chain (disclosed by Nightmare-Eclipse, July 2026): a TOCTOU race against the Windows User Profile Service (ProfSvc) using GLOBALROOT Object Manager symlinks and an oplock to trick ProfSvc, running as SYSTEM, into loading a different user's UsrClass.dat registry hive than the one it authenticated for.
This rule chains 3 stages on the same host within a 15-minute window:
(1) a staging copy of UsrClass.dat appearing outside its normal AppData profile path, typically in a randomly named folder off a drive root;
(2) an explicit-credential logon (Security 4648) immediately followed by a secondary-logon session (4624, LogonType 2, seclogon/Advapi) consistent with CreateProcessWithLogonW + LOGON_WITH_PROFILE;
(3) svchost.exe (ProfSvc) subsequently loading a UsrClass.dat whose profile owner does not match the helper account used in stage 2.
Requires Windows Security Event logs (Logon/Logoff auditing for 4648/4624) and Microsoft Defender for Endpoint DeviceFileEvents ingested into the same Sentinel workspace.
Known gap: Object Manager symlink creation and oplock placement, the mechanisms that perform the actual redirection, are not natively covered by Security auditing or MDE; consider supplementing with Sysmon/ETW if available.
Lab simulation checklist before enabling as high severity:
- Run the public PoC (https://github.com/MSNightmare/LegacyHive) against a lab VM with Security auditing (Logon/Logoff, Account Logon) and MDE onboarded.
- Confirm Stage 1 fires on the staging UsrClass.dat copy path and folder-name pattern.
- Confirm Stage 2's 4648/4624 pairing and LogonProcessName value match your OS build (may differ across Windows 10/11/Server releases).
- Confirm Stage 3's InitiatingProcessAccountName attribution for svchost.exe/ProfSvc; if it reports SYSTEM instead of the helper account, replace the ProfileOwner != Helper check with a LogonId/TargetLogonId correlation to Stage 2.
- Tune the staging-folder regex ag
This rule chains 3 stages on the same host within a 15-minute window:
(1) a staging copy of UsrClass.dat appearing outside its normal AppData profile path, typically in a randomly named folder off a drive root;
(2) an explicit-credential logon (Security 4648) immediately followed by a secondary-logon session (4624, LogonType 2, seclogon/Advapi) consistent with CreateProcessWithLogonW + LOGON_WITH_PROFILE;
(3) svchost.exe (ProfSvc) subsequently loading a UsrClass.dat whose profile owner does not match the helper account used in stage 2.
Requires Windows Security Event logs (Logon/Logoff auditing for 4648/4624) and Microsoft Defender for Endpoint DeviceFileEvents ingested into the same Sentinel workspace.
Known gap: Object Manager symlink creation and oplock placement, the mechanisms that perform the actual redirection, are not natively covered by Security auditing or MDE; consider supplementing with Sysmon/ETW if available.
Lab simulation checklist before enabling as high severity:
- Run the public PoC (https://github.com/MSNightmare/LegacyHive) against a lab VM with Security auditing (Logon/Logoff, Account Logon) and MDE onboarded.
- Confirm Stage 1 fires on the staging UsrClass.dat copy path and folder-name pattern.
- Confirm Stage 2's 4648/4624 pairing and LogonProcessName value match your OS build (may differ across Windows 10/11/Server releases).
- Confirm Stage 3's InitiatingProcessAccountName attribution for svchost.exe/ProfSvc; if it reports SYSTEM instead of the helper account, replace the ProfileOwner != Helper check with a LogonId/TargetLogonId correlation to Stage 2.
- Tune the staging-folder regex ag
Detects execution of the LegacyHive proof-of-concept (PoC) binary or its unique command-line indicators. LegacyHive exploits a Windows User Profile Service vulnerability to perform arbitrary registry hive loading, which can be utilized for privilege escalation.
Detects the use of the Windows 'reg.exe load' command to mount registry hive files from file paths other than the standard user-specific hive locations (ntuser.dat or usrclass.dat). This behavior is often associated with privilege escalation or post-exploitation techniques where attackers attempt to load sensitive system hives, such as SAM or SECURITY, into the registry for offline analysis or credential dumping.
Detects the mounting of a registry hive into an HKEY_USERS Classes root where the SID embedded in the registry key path does not match the SID of the process account that initiated the operation. This behavior is associated with the 'LegacyHive' exploitation technique, where an attacker attempts to mount another user's (or administrator's) registry hive into their own context to facilitate privilege escalation.
This rule detects the creation of the 'C:\Config.Msi' folder or files within it that have weak security descriptors (SDDL). This folder is frequently used by the Windows Installer service, and if insecure permissions are applied, an attacker can perform privilege escalation or perform DLL hijacking by placing malicious files within this directory.
Detects the creation or modification of a file named 'g11.sys'. This filename is often associated with the deployment of malicious or vulnerable drivers used for kernel-mode exploitation, such as Bring Your Own Vulnerable Driver (BYOVD) attacks or rootkit activity.
This rule detects potential Local Privilege Escalation (LPE) activity related to a threat dubbed 'Rogue Planet'. It monitors for the creation of temporary files in the local AppData directory with a 'RP_' prefix and the usage of a specific named pipe named 'RoguePlanet'. The rule further isolates suspicious behavior by identifying processes that are not the standard Windows Error Reporting Manager (wermgr.exe) executing from its legitimate path.
This rule detects instances of the 'su' utility being executed in a manner inconsistent with normal system administration patterns. By filtering out common, expected parent processes (such as login shells, terminal multiplexers, or established system services) and identifying 'su' command-line execution or shell commands attempting to invoke it, the rule flags potentially malicious privilege escalation attempts, such as those exploiting local vulnerabilities.
Detects a suspicious sequence of events where a non-standard process writes to the Windows Installer TempPackages registry key, followed by the msiexec.exe process running as SYSTEM deleting the C:\Config.Msi folder. This behavior is indicative of potential privilege escalation or exploitation, such as CVE-2025-27727, where an attacker leverages msiexec's high-privilege context to perform unauthorized file operations.
This rule detects the presence of a specific file named 'g11.sys' being loaded or accessed on a system, followed by the execution of 'sc.exe' to register or create a system service involving the same driver file. This pattern is commonly associated with the installation of kernel-mode drivers, which could be part of a rootkit deployment or a 'Bring Your Own Vulnerable Driver' (BYOVD) attack.
Detects Docker CLI execution attempting to bind mount sensitive host system directories (e.g., Windows, ProgramData) into a container. This technique is often used as a container escape vector to gain unauthorized access to host files and escalate privileges to SYSTEM.
Detects termination of security services or tampering with real-time protection configurations shortly after the loading of the PoisonX (g11.sys) kernel driver. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack aimed at disabling endpoint defenses prior to the deployment of ransomware or other malicious payloads.
Detects attempts to grant world-writable (0666) permissions to the /dev/kvm device node using chmod or setfacl, or unauthorized (non-root) accounts interacting directly with the device. Such configuration changes are associated with the Januscape (CVE-2026-53359) vulnerability, which allows local users to exploit a shadow MMU use-after-free in the kernel to escalate privileges to root or escape into the host from a virtualized environment.
Detects the presence of the PoisonX malicious kernel driver (g11.sys), which is used by the Hyadina group in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software and disable user-mode API hooks.
Detects the loading of a kernel driver named 'g11.sys', which is associated with the PoisonX campaign, a technique typically used for kernel-level persistence or exploitation.
Detects the creation of working directories in temporary locations matching the RoguePlanet exploit staging pattern, specifically associated with CVE-2026-50656 (Nightmare Eclipse). The rule identifies the creation of directories containing fake System32 subdirectories or suspicious files (wermgr.exe) used in a TOCTOU (Time-of-Check Time-of-Use) exploit chain against MsMpEng.exe.
Page 19 of 45