Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
134 detections
Filters
Last updated
All Time
Detection languages
60
33
10
10
9
Contributors
42
25
8
7
6
Categories
84
54
30
20
19
Platforms
116
11
5
4
1
Products / Services
48
38
33
9
7
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
1
1
1
IDS Classtypes
2
1
IDS Protocols
1
1
1
Detects the execution of known Windows privilege escalation tools commonly referred to as 'potato' exploits (e.g., JuicyPotato, SweetPotato, PrintSpoofer). These tools typically exploit service account misconfigurations or Windows APIs to achieve local privilege escalation to SYSTEM.
Detects LogonUser API used with token impersonation for privilege escalation
Detects suspicious named pipe server creation by Medium/Low integrity processes followed by a SYSTEM-level process spawned from the same initiating process within a short correlation window. This behavior is indicative of an attacker attempting to escalate privileges using named pipe impersonation.
This rule detects potential VILE ransomware activity by identifying a specific combination of Windows token manipulation APIs (e.g., AdjustTokenPrivileges, DuplicateTokenEx) paired with the usage of VILE-specific direct NT syscalls (NtCreateWaitCompletionPacket, ProcessPrng) within the same process context. This behavioral pairing serves as a high-fidelity indicator of VILE ransomware execution.
Detects the execution behavior associated with the VILE ransomware, specifically focusing on the combination of privilege manipulation API usage (e.g., AdjustTokenPrivileges, DuplicateTokenEx) and the creation of known ransomware-related artifacts like configuration files or decoy files.
Detects evidence of AnyDesk exploiting an COM impersonation vulnerability via the adprinterpipe named pipe. The rule monitors for AnyDesk spawning SYSTEM-level child processes, interaction with the adprinterpipe, or modification of critical print-related registry keys.
This rule monitors process-related logs for specific XGU-prefixed function strings related to access token manipulation and lateral movement, such as token stealing, impersonation, and privilege/UID gathering. The detection looks for these indicators within command line and additional process metadata.
Detects the presence of strings associated with the SPECTRALVIPER backdoor in process command lines. These strings correspond to RTTI class names and methods related to its XGU::Feature token theft and impersonation capabilities, specifically targeting functionality for lateral movement and credential manipulation.
Detects evidence of the SPECTRALVIPER backdoor, specifically targeting its token theft and impersonation capabilities ('XGU::Feature'). The rule monitors for presence of specific internal RTTI class names and method strings in process command lines or activity associated with specific potentially compromised host processes such as OneDrive or Intel Audio services.
Detects user-mode processes abnormally requesting the SeLoadDriverPrivilege token privilege, which is required to load vulnerable drivers into the kernel. This activity is often associated with Bring Your Own Vulnerable Driver (BYOVD) attacks.
Detects instances where a non-SYSTEM parent process spawns a child process running as SYSTEM, characteristic of 'Potato' family exploits (e.g., JuicyPotato, PrintSpoofer) leveraging SeImpersonatePrivilege to elevate privileges. The rule specifically filters for known legitimate SYSTEM process spawners while highlighting suspicious parent-child process relationships.
Detects instances where a non-SYSTEM parent process spawns a child process running as SYSTEM, characteristic of 'Potato' family exploits (e.g., JuicyPotato, PrintSpoofer) leveraging SeImpersonatePrivilege to elevate privileges. The rule specifically filters for known legitimate SYSTEM process spawners while highlighting suspicious parent-child process relationships.
Detects a sequence of sensitive Windows API calls (AllocateAndInitializeSid, CheckTokenMembership, or ShellExecuteW with runas) occurring within the same process on a host. This behavior is indicative of privilege escalation attempts or unauthorized token manipulation, often observed in malicious processes attempting to elevate privileges or verify token permissions.
Detects a mismatched/synthetic iOS 18 User-Agent (Version/26.x) used by Kali365 to bypass detection. This specific User-Agent string is indicative of malicious activity as 'Version/26' does not natively exist on iOS 18.
This rule detects various suspicious activities related to privilege escalation and access token manipulation. It identifies the enablement of sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeImpersonatePrivilege) by non-system processes, suspicious API calls for token impersonation/duplication (ImpersonateNamedPipeClient, DuplicateTokenEx) from non-privileged processes, and the creation of SYSTEM child processes by medium-integrity parent processes. These behaviors are often indicative of an attacker attempting to elevate privileges on a compromised system.
Detects exploitation of the SystemInformer phsvc service via ALPC port abuse and trusted-host bypass. The attack involves loading a malicious DLL into the Microsoft-signed rundll32.exe process to bypass trust checks, subsequently connecting to the '\BaseNamedObjects\SiSvcApiPort' to invoke privileged APIs for LPE.
Detects suspicious child processes spawned by AnyDesk.exe or AnyDesk-runtime.exe that may indicate local privilege escalation. This rule specifically targets the abuse of the adprinterpipe named pipe and CoUnmarshalInterface to impersonate SYSTEM-level AnyDesk processes, allowing for the execution of unauthorized child processes.
Detects Device Code Flow authentication originating from abused Railway.com infrastructure, widely abused by Kali365.
Detects token manipulation activity indicative of VILE ransomware attempting privilege escalation. The rule monitors for the usage of Windows token-related APIs such as AdjustTokenPrivileges, LookupPrivilegeValueW, DuplicateTokenEx, and SetTokenInformation, which are commonly used by malicious actors to elevate their security context.
Detects the execution of known Windows privilege escalation tools commonly used in post-exploitation scenarios, such as JuicyPotato, PrintSpoofer, and other 'Potato' variants, by monitoring for process file names associated with these utilities.
This rule monitors process events for the combined usage of multiple Windows security APIs associated with access token manipulation. Specifically, it flags processes that call two or more of the following functions: AdjustTokenPrivileges, LookupPrivilegeValueW, SetTokenInformation, OpenProcessToken, DuplicateTokenEx, or GetTokenInformation. This behavior is indicative of token stealing or impersonation attempts, often used by malware such as Vile Ransomware to escalate privileges or bypass security controls. The rule also includes heuristic filtering for common system processes.
Page 4 of 7