Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
This rule detects the execution of specific command-line strings and DLL loading associated with Proof-of-Concept (PoC) exploits targeting the System Informer (formerly Process Hacker) kernel driver service (phsvc). These patterns indicate potential attempts to interact with or exploit the driver for unauthorized purposes, such as privilege escalation.
This rule detects a POST request to the MyBB administrative interface (specifically the user-users module) that contains parameters indicating an attempt to escalate a limited administrative user to a full administrator by assigning the 'usergroup=4' or 'gid=4' identifier, which corresponds to the default Administrator group in MyBB.
Detects potential local privilege escalation attempts targeting the SystemInformer PhSvc service. The rule identifies suspicious child processes spawned from rundll32.exe (acting as a proxy) or other common binaries, where the process chain indicates an interaction with the SiSvcApiPort or the use of phsvc-related command-line arguments, potentially leading to unauthorized elevated process creation or service installation.
Detects evidence of a local privilege escalation attempt targeting the SystemInformer (formerly Process Hacker) phsvc service. The detection identifies the loading of a known proof-of-concept DLL into rundll32.exe, the creation of specific indicator files on disk, or rundll32.exe executing command-line payloads associated with the exploit.
This rule detects potential local privilege escalation attempts targeting the AnyDesk printer service. The rule monitors for unauthorized COM server registration (COM hijacking) and the subsequent spawning of suspicious child processes (e.g., cmd.exe, PowerShell) directly linked to the AnyDesk process tree. This behavior is indicative of exploiting the AnyDesk COM object printer impersonation vulnerability to gain NT AUTHORITY\SYSTEM privileges.
Detects local privilege escalation attempts targeting the SystemInformer (formerly Process Hacker) PHSVC service. Adversaries can abuse the SiSvcApiPort ALPC port by using rundll32.exe to load specific malicious payloads that call privileged service APIs, such as PhSvcCreateProcessIgnoreIfeoDebugger or PhSvcCreateService, effectively bypassing standard user restrictions.
Detects suspicious child processes spawned by AnyDesk.exe or AnyDesk-runtime.exe that may indicate local privilege escalation. This rule specifically targets the abuse of the adprinterpipe named pipe and CoUnmarshalInterface to impersonate SYSTEM-level AnyDesk processes, allowing for the execution of unauthorized child processes.
Detects potential privilege escalation within the MyBB Administrative Control Panel (ACP). The rule identifies POST requests to user management modules that set a user's group ID (gid) or usergroup to 4, which typically corresponds to the administrator group in MyBB. It verifies the escalation by correlating it with a prior session that lacked administrator privileges and identifying a subsequent login event.
Detects unauthorized attempts to escalate privileges within the MyBB Admin Control Panel (ACP) by creating a new account or modifying an existing one to belong to the administrator group (gid=4). This is indicative of an attacker attempting to gain full administrative control by bypassing module-level access restrictions.
Detects exploitation of the SystemInformer PhSvc service by monitoring for rundll32.exe launching with command-line arguments indicative of loading a proof-of-concept DLL and attempting to communicate with the SiSvcApiPort ALPC port. This activity is associated with abusing privileged helper APIs to perform unauthorized SYSTEM-level process creation or service installation.
Detects execution patterns associated with the DirtyClone local privilege escalation exploit. The rule monitors for the execution of the exploit binary, compilation of related exploit source code, the creation of combined user and network namespaces via unshare, manipulation of IPsec xfrm states/policies by unprivileged users, and the spawning of a root shell via su. These activities are indicative of an attempt to elevate privileges from an unprivileged context to root.
This rule detects suspicious activity involving container runtimes (e.g., Docker) that indicates potential container escape attempts or unauthorized host interaction. It flags scenarios where container processes spawn administrative shells (cmd.exe, powershell.exe) with SYSTEM privileges, instances of privileged container creation, or direct access to physical drives from container management tools, which are common indicators of host filesystem manipulation.
This rule detects suspicious activity involving container runtimes (e.g., Docker) that indicates potential container escape attempts or unauthorized host interaction. It flags scenarios where container processes spawn administrative shells (cmd.exe, powershell.exe) with SYSTEM privileges, instances of privileged container creation, or direct access to physical drives from container management tools, which are common indicators of host filesystem manipulation.
Detects the execution of known Windows privilege escalation tools (often referred to as 'Potato' exploits) which leverage various Windows service vulnerabilities or print spooler manipulation to escalate user privileges to SYSTEM level.
Detects the execution of known Windows privilege escalation tools (often referred to as 'Potato' exploits) which leverage various Windows service vulnerabilities or print spooler manipulation to escalate user privileges to SYSTEM level.
Detects potential Windows privilege escalation attempts where a user account is assigned the SeImpersonatePrivilege and subsequently executes known exploitation tools (e.g., Potato-family exploits) within a short window. This pattern often indicates an attempt to escalate to SYSTEM privileges by abusing token impersonation vulnerabilities.
Detects the creation or loading of a driver named Havoc.sys in a temporary directory, or the loading of a known vulnerable Huawei audio driver (HWAuidoOs2Ec.sys) identified by its SHA256 hash. This activity is indicative of the Havoc Process Terminator BYOVD tool, often used in recent campaigns to blind EDR solutions.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects the loading of the K7RKScan.sys driver, which has been associated with CVE-2025-1055 and used in 'Bring Your Own Vulnerable Driver' (BYOVD) campaigns, specifically mentioning Backdoor.Turn. This activity can be indicative of privilege escalation or defense evasion.
Detects the execution of known privilege escalation tools such as SweetPotato, JuicyPotato, RoguePotato, PrintSpoofer, and BadPotato. These tools are commonly used by attackers to escalate privileges on compromised Windows systems.
Detects local privilege escalation attempts targeting the SystemInformer service (phsvc.exe) IPC mechanism. The rule identifies suspicious process activity, including the side-loading of a PoC DLL into rundll32.exe, the spawning of child processes from the SystemInformer service context, and the presence of PoC artifacts in system paths, which are used to gain SYSTEM-level execution.
Page 30 of 45