Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
The following query surface network activity associated with exploitation of CVE-2022-22965.
Assuming that you have a machine that is properly BitLocker'ed, then
the machine will need to be running to extract the SAM and SYSTEM
files.
This first query looks for any access to the HKLM that happens via a command
or script that is not executed by system.
The second query looks for usage of reg or regedit by anyone who is not system.
the machine will need to be running to extract the SAM and SYSTEM
files.
This first query looks for any access to the HKLM that happens via a command
or script that is not executed by system.
The second query looks for usage of reg or regedit by anyone who is not system.
This query was originally published in the threat analytics report, ALPC local privilege elevation.
Windows ALPC Elevation of Privilege Vulnerability, CVE-2018-8440, could be exploited to run arbitrary code or to gain access to protected directories and areas of the operating system.
This vulnerability was patched in the September 2018 Security Update.
The following query checks for potential activity related to this vulnerability over the past 7 days. If you wish to check another time period, update the EventTime value.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-8440
https://support.microsoft.com/help/4457143/windows-81-update-kb4457143
Windows ALPC Elevation of Privilege Vulnerability, CVE-2018-8440, could be exploited to run arbitrary code or to gain access to protected directories and areas of the operating system.
This vulnerability was patched in the September 2018 Security Update.
The following query checks for potential activity related to this vulnerability over the past 7 days. If you wish to check another time period, update the EventTime value.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-8440
https://support.microsoft.com/help/4457143/windows-81-update-kb4457143
The query digs in Windows print spooler drivers folder for any file creations,
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Suspicious DLL is load from Spooler Service backup folder.
This behavior is used from PoC Exploit of CVE-2021-34527, CVE-2021-1675 or CVE-2022-21999.
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Suspicious DLL is load from Spooler Service backup folder.
This behavior is used from PoC Exploit of CVE-2021-34527, CVE-2021-1675 or CVE-2022-21999.
This query was originally published in the threat analytics report, Multiple EOP flaws in Dell driver (CVE-2021-21551).
CVE-2021-21551 is a vulnerability found in dbutil_2_3.sys, a driver distributed with Dell firmware updates and tools. Attackers can exploit this vulnerability to escalate privileges on a compromised device. The following query can detect if the affected driver has been added to a device's \temp folders.
Reference - https://nvd.nist.gov/vuln/detail/CVE-2021-21551
CVE-2021-21551 is a vulnerability found in dbutil_2_3.sys, a driver distributed with Dell firmware updates and tools. Attackers can exploit this vulnerability to escalate privileges on a compromised device. The following query can detect if the affected driver has been added to a device's \temp folders.
Reference - https://nvd.nist.gov/vuln/detail/CVE-2021-21551
The following query detects possible CVE-2021-42278 exploitation by finding changes of device names in the network using Microsoft Defender for Identity
Look for the creation of suspicious DLL files spawned in the \spool\ folder along with DLLs that were recently loaded afterwards from \Old.
Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675
The query checks process command lines arguments and parent/child combinations to find machines where there have been.
Attempts to exploit a DHCP remote code command injection CVE-2018-1111.
DynoRoot is a remote command injection present in a script included by the DHCP client in Red Hat Enterprise Linux 6 and 7.
Using it, a malicious attacker could use this flaw to execute arbitrary commands with root privileges.
CVE: CVE-2018-1111.
Read more here:.
Https://access.redhat.com/security/cve/cve-2018-1111.
Https://www.cvedetails.com/cve/CVE-2018-1111.
Tags: #exploit #CVE-2018-1111 #DynoRoot.
Attempts to exploit a DHCP remote code command injection CVE-2018-1111.
DynoRoot is a remote command injection present in a script included by the DHCP client in Red Hat Enterprise Linux 6 and 7.
Using it, a malicious attacker could use this flaw to execute arbitrary commands with root privileges.
CVE: CVE-2018-1111.
Read more here:.
Https://access.redhat.com/security/cve/cve-2018-1111.
Https://www.cvedetails.com/cve/CVE-2018-1111.
Tags: #exploit #CVE-2018-1111 #DynoRoot.
Look for the spoolsv.exe launching rundll32.exe with an empty command line
This query was originally published in the threat analytics report, May 2019 0-day disclosures.
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-0973 (also known as InstallerBypass), the fifth vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-0973 (also known as InstallerBypass), the fifth vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
Monitor for creation of suspicious files in the /spools/driver/ folder. This is a broad-based search that will surface any creation or modification of files in the folder targeted by this exploit. False Positives for legitimate driver activity (when that activity should be present) in this folder are possible
'This query detects a process that runs under SYSTEM user's security context and was spawned by a process that was running under a lower security context indicating an exploitation for privilege escalation.
Ref: https://attack.mitre.org/techniques/T1068/'
Ref: https://attack.mitre.org/techniques/T1068/'
This query was originally published in the threat analytics report, May 2019 0-day disclosures.
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1053 (also known as SandboxEscape), the third vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1053 (also known as SandboxEscape), the third vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
This query was originally published in the threat analytics report, May 2019 0-day disclosures.
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1069 (also known as BearLPE), the second vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1069 (also known as BearLPE), the second vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
This query was originally published in the threat analytics report, Windows 7 zero-day for CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by finding suspicious file creation events associated with Nufsys.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by finding suspicious file creation events associated with Nufsys.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
This query was originally published in the threat analytics report, Windows 7 zero-day for CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by reporting network communication associated with the Nufsys attacks.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by reporting network communication associated with the Nufsys attacks.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
This query was originally published in the threat analytics report, May 2019 0-day disclosures.
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1129 (also known as ByeBear or CVE-2019-0841-Bypass 2), the sixth vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1129 (also known as ByeBear or CVE-2019-0841-Bypass 2), the sixth vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
This query was originally published in the threat analytics report, Windows 7 zero-day for CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by reporting scheduled task creation events associated with the Nufsys attacks.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by reporting scheduled task creation events associated with the Nufsys attacks.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
This query was originally published in the threat analytics report, May 2019 0-day disclosures.
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-0863 (also known as AngryPolarBearBug2), the first vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-0863 (also known as AngryPolarBearBug2), the first vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in Windows Server 2025 Active Directory environments. Successful usage of this tool can let attackers gain domain admin privileges by exploiting the BadSuccessor vulnerability.
Page 42 of 45