Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
This rule detects exploitation attempts of the privilege escalation vulnerability CVE-2019-1378. The vulnerability involves the Windows 10 Update Assistant (WUA) executing `SetupComplete.cmd` or `PartnerSetupComplete.cmd` with elevated privileges. An attacker can place a malicious script in `C:\Windows\Setup\Scripts\` which will then be executed by `cmd.exe` during the update process, leading to privilege escalation. The rule specifically looks for `cmd.exe` being the parent process, executing a command line that contains `C:\Windows\Setup\Scripts\` and ends with either `SetupComplete.cmd` or `PartnerSetupComplete.cmd`, while filtering out legitimate system processes that might also execute commands from these directories.
Detects the loading of the kernel driver associated with the Process Hacker tool. This tool, while legitimate, can be used by adversaries for various malicious activities, including bypassing security controls, inspecting processes, and potentially escalating privileges. The rule identifies the driver by its filename and specific import hashes.
Detects the invocation of TabTip.exe via DCOM with a specific error ID, which is indicative of the JuicyPotatoNG tool being used in brute force mode for local privilege escalation. This technique leverages a DCOM vulnerability to elevate privileges.
Detects a suspicious printer driver installation where the 'Manufacturer' registry value is set to an empty string. This behavior can be indicative of malicious activity, potentially related to privilege escalation or defense evasion, as seen in some exploits like PrintNightmare (CVE-2021-1675).
Detects the execution of the 'sudo' command with the '--chroot' option, which is used to change the root directory for command execution. Attackers may use this technique to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
Detects loading of known malicious drivers via their hash.
Detects loading of known malicious drivers via the file name of the drivers.
Detects the load of known vulnerable drivers via the file name of the drivers.
Detects potential exploitation of CVE-2025-41244, a local privilege escalation vulnerability in VMware Tools and Aria Operations.
An attacker can stage a malicious binary in a world-writable directory (e.g., /tmp) which is then executed with root privileges by the VMware service discovery mechanism when it attempts to determine the binary's version.
An attacker can stage a malicious binary in a world-writable directory (e.g., /tmp) which is then executed with root privileges by the VMware service discovery mechanism when it attempts to determine the binary's version.
Detects potential exploitation of VMware CVE-2025-41244, where a privileged VMware service discovery script executes a binary from a world-writable directory like /tmp. This behavior is consistent with the local privilege escalation technique used by UNC5174.
Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
This rule detects instances of 'WerFaultSecure.exe' being spawned by an unusual or unexpected parent process. 'WerFaultSecure.exe' is a legitimate Windows component responsible for error reporting and crash dumping. Adversaries may abuse this process, particularly for memory dumping (e.g., LSASS dumping) to evade defenses and escalate privileges. The rule identifies parent processes that are not part of a predefined list of legitimate parents (wermgr.exe, svchost.exe, csrss.exe, WerFault.exe). It assigns a suspicion score and risk level based on the initiating process's filename (e.g., PowerShell, CMD, Explorer) and folder path (e.g., Temp, AppData, Users). It also extracts the target Process ID (PID) and dump type from the command line, and checks for suspicious parameters, to provide a comprehensive risk assessment.
Detects the execution of CoercedPotato, a tool used for privilege escalation. The rule specifically looks for the executable name 'CoercedPotato.exe', the command-line argument '--exploitId', or specific import hashes (IMPHASH) associated with the tool. This tool leverages vulnerabilities to achieve higher privileges on a system.
The analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. It identifies drivers not located in typical directories like Windows, Program Files, or SystemRoot. This activity is significant because adversaries may use these non-standard paths to load malicious or vulnerable drivers, potentially bypassing security controls. If confirmed malicious, this could allow attackers to execute code at the kernel level, escalate privileges, or maintain persistence within the environment, posing a severe threat to system integrity and security.
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID). This could be a sign of exploitation of elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
Detects the creation of the Active Directory group "ESX Admins". Threat actors create this group to exploit CVE-2024-37085, which grants any member of this group administrative privileges on domain-joined VMware ESXi hypervisors.
This rule detects suspicious activities related to Protected Process Light (PPL) and driver loading that could indicate privilege escalation, defense evasion, or impact. Specifically, it looks for:
1. Processes running with 'System' integrity that were initiated by a process with a lower integrity level, which could suggest an attempt to elevate privileges.
2. Driver image load events where 'ntoskrnl.exe' is the initiating process, but the driver is loaded from a location outside of the standard 'System32' or 'System32\drivers' directories. This could indicate an adversary attempting to load malicious drivers to evade detection or persist.
3. DriverLoad actions initiated by 'ntoskrnl.exe' from outside the standard 'System32' or 'System32\drivers' directories, similar to the image load events, pointing to potential malicious driver activity.
1. Processes running with 'System' integrity that were initiated by a process with a lower integrity level, which could suggest an attempt to elevate privileges.
2. Driver image load events where 'ntoskrnl.exe' is the initiating process, but the driver is loaded from a location outside of the standard 'System32' or 'System32\drivers' directories. This could indicate an adversary attempting to load malicious drivers to evade detection or persist.
3. DriverLoad actions initiated by 'ntoskrnl.exe' from outside the standard 'System32' or 'System32\drivers' directories, similar to the image load events, pointing to potential malicious driver activity.
The following analytic detects when a process with low, medium, or high integrity spawns a system integrity process from a user-controlled location. This behavior is indicative of privilege escalation attempts where attackers elevate their privileges to SYSTEM level from a user-controlled process or service. The detection leverages Sysmon data, specifically Event ID 15, to identify such transitions. Monitoring this activity is crucial as it can signify an attacker gaining SYSTEM-level access, potentially leading to full control over the affected system, unauthorized access to sensitive data, and further malicious activities.
This analytic detects when a process running with low or medium integrity from a user account spawns an elevated process with high or system integrity in suspicious locations. This behavior is identified using process execution data from Windows process monitoring or Sysmon EventID 1. This activity is significant as it may indicate a threat actor successfully elevating privileges, which is a common tactic in advanced attacks. If confirmed malicious, this could allow the attacker to execute code with higher privileges, potentially leading to full system compromise and persistent access.
Page 37 of 45