Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
The following analytic detects suspicious process access by spoolsv.exe, potentially indicating exploitation of the PrintNightmare vulnerability (CVE-2021-34527). It leverages Sysmon EventCode 10 to identify when spoolsv.exe accesses critical system files or processes like rundll32.exe with elevated privileges. This activity is significant as it may signal an attempt to gain unauthorized privilege escalation on a vulnerable machine. If confirmed malicious, an attacker could achieve elevated privileges, leading to further system compromise, persistent access, or unauthorized control over the affected environment.
The following analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2023-29357. It leverages the Web datamodel to monitor for specific API calls and HTTP methods indicative of privilege escalation attempts. This activity is significant as it may indicate an attacker is trying to gain unauthorized privileged access to the SharePoint environment. If confirmed malicious, the impact could include unauthorized access to sensitive data, potential data theft, and further compromise of the SharePoint server, leading to a broader security breach.
The following analytic identifies all drivers being loaded on Windows systems using Sysmon EventCode 6 (Driver Load). It leverages fields such as driver path, signature status, and hash to detect potentially suspicious drivers. This activity is significant for a SOC as malicious drivers can be used to gain kernel-level access, bypass security controls, or persist in the environment. If confirmed malicious, this activity could allow an attacker to execute arbitrary code with high privileges, leading to severe system compromise and potential data exfiltration.
This analytic identifies the creation of a new kernel mode driver using the `sc.exe` command. The detection leverages process execution logs from Endpoint Detection and Response (EDR) agents, specifically focusing on command-line details. Adding a kernel driver is an uncommon activity in regular operations and can indicate an attempt to gain low-level access to the system. If confirmed malicious, this could allow an attacker to execute code with high privileges, potentially compromising the entire system and evading traditional security measures.
The following analytic identifies Windows endpoints that have not generated an event indicating a successful Windows update in the last 60 days. It leverages the 'Update' data model in Splunk, specifically looking for the latest 'Installed' status events from Microsoft Windows. This activity is significant for a SOC because endpoints that are not regularly patched are vulnerable to known exploits and security vulnerabilities. If confirmed malicious, this could indicate a compromised endpoint that is intentionally being kept unpatched, potentially allowing attackers to exploit unpatched vulnerabilities and gain unauthorized access or control.
This analytic detects any system integrity level process spawned by a non-system account. It leverages Sysmon EventID 1, focusing on process integrity and parent user data. This behavior is significant as it often indicates successful privilege escalation to SYSTEM from a user-controlled process or service. If confirmed malicious, this activity could allow an attacker to gain full control over the system, execute arbitrary code, and potentially compromise the entire environment.
WinPEAS is a widely used privilege escalation and discovery tool. This rule detects the execution of winPEAS by monitoring process creation events for specific filenames and command-line arguments. It also looks for command-line options related to information gathering (applications, browser, events, files, processes, services, windows credentials) and attempts to download the tool from its GitHub repository. The rule aims to identify potential privilege escalation attempts and extensive system discovery activities by adversaries.
Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250. This vulnerability allows for privilege escalation.
Detects an exploitation attempt of CVE-2019-1388, a privilege escalation vulnerability. This involves the UAC consent dialogue (consent.exe) invoking an Internet Explorer process (iexplore.exe) with system-level privileges, indicated by 'System' or 'S-1-16-16384' integrity level and a command line containing ' http'.
Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability. This rule specifically looks for instances where a command interpreter (cmd.exe, powershell.exe, or pwsh.exe) is spawned as a child process of the Microsoft Edge elevation service (elevation_service.exe) with SYSTEM integrity level, indicating a successful privilege escalation.
This rule detects suspicious child processes spawned by the Windows Print Spooler service (spoolsv.exe) running with System integrity. The detection logic specifically looks for the execution of various Windows utilities and command-line interpreters (like cmd.exe, powershell.exe, net.exe, wmic.exe, certutil.exe, bitsadmin.exe, rundll32.exe, etc.) that are commonly abused by attackers for execution, privilege escalation, or reconnaissance after exploiting vulnerabilities in the Print Spooler service (e.g., PrintNightmare). The rule includes filters to reduce false positives for some commands.
Detects the execution of the LocalPotato Proof-of-Concept (POC) tool. This detection is based on specific characteristics of the executable's image name, command-line arguments, and known import hashes (IMPHASH) associated with LocalPotato. The tool is known for exploiting vulnerabilities to achieve privilege escalation.
Detects the execution of a Proof-of-Concept (PoC) tool named 'SysmonEOP.exe' or a variant identified by specific IMPHASH values. This tool is designed to exploit CVE-2022-41120, a vulnerability in Sysmon that can lead to privilege escalation.
Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120
Detects potential exploitation attempts of the Netlogon Elevation of Privilege Vulnerability (CVE-2020-1472), also known as Zerologon. This rule specifically looks for Event ID 4742 (A computer account was changed) where the SubjectUserName is 'ANONYMOUS LOGON' and the TargetUserName matches a Domain Controller's machine account name (ending with '$'), while filtering out legitimate password changes by checking if 'PasswordLastSet' is not '-'.
Detects signs of the exploitation of Local Privilege Escalation (LPE) vulnerability CVE-2021-41379. This specific rule identifies the creation of an 'elevation_service.exe' file by 'msiexec.exe' within the Microsoft Edge application directory, which is a known indicator of this exploit.
This rule detects exploitation indicators for CVE-2023-20198, a privilege escalation vulnerability in Cisco IOS XE Software Web UI. It looks for specific log messages related to Web UI installation operations, system configuration changes, or successful web logins, in conjunction with the use of specific user accounts ('cisco_tac_admin', 'cisco_support', 'cisco_sys_manager') that are not typically created by default or used by Cisco representatives. The combination of these events suggests an attempt to exploit the vulnerability.
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify successful exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
Detects when a kernel module that does not meet WHQL (Windows Hardware Quality Labs) signing requirements is loaded into the system. This can indicate the presence of unsigned or improperly signed drivers, which might be malicious or unstable. The rule specifically looks for Code Integrity Event IDs 3082 and 3083, which signify that such a module was loaded, even if allowed due to auditing policy.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
Detects the execution of the 'execve_hijack' component of the Triple Cross eBPF rootkit. This specific file is used by the rootkit to elevate privileges by hijacking the 'execve' system call, often in conjunction with the 'sudo' command.
Page 44 of 45