Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
134 detections
Filters
Last updated
All Time
Detection languages
60
33
10
10
9
Contributors
42
25
8
7
6
Categories
84
54
30
20
19
Platforms
116
11
5
4
1
Products / Services
48
38
33
9
7
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
1
1
1
IDS Classtypes
2
1
IDS Protocols
1
1
1
Detects the presence of 'access_token' and 'step' strings in conjunction with 'POST' and 'application/json' within network traffic or files, indicating potential C2 communication or data exfiltration related to the Remus malware distribution ecosystem.
Detects the Pony malware credential harvesting sequence where a non-system process performs repeated interactive logon attempts (LogonUserA dictionary brute force via NetUserEnum) against local accounts and achieves at least one successful logon, after which LoadUserProfileA is used to impersonate the compromised account and harvest profile-scoped credentials.
Detects anomalous user-mode processes requesting the SeLoadDriverPrivilege token privilege, which is essential for loading the EnCase driver (EEDbg.sys) into the kernel. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack using the EnCase driver.
Detects potential privilege escalation attempts by the Remcos RAT loader using token impersonation. The rule looks for process command lines containing keywords related to token manipulation ('impersonate', 'token', 'duplicate', 'SeImpersonate', 'logon') specifically when the initiating process is identified as 'Remcos'.
Detects potential privilege escalation attempts by the Remcos RAT loader using token impersonation. The rule looks for process command lines containing keywords related to token manipulation ('impersonate', 'token', 'duplicate', 'SeImpersonate', 'logon') specifically when the initiating process is identified as 'Remcos'.
Detects multiple instances of a non-SYSTEM or non-LOCAL SERVICE account using 'RunAs' to execute processes as highly privileged accounts (admin, system, root) within a short timeframe. This could indicate an attempt at privilege escalation or token impersonation.
Detects Windows token manipulation for privilege escalation
This rule detects repeated failed or successful logon attempts (EventID 4625 or 4624) to sensitive system accounts like 'SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE', or 'ADMIN$' from non-system accounts. It specifically looks for interactive (LogonType 10), remote interactive (LogonType 3), or unlock (LogonType 9) logons, and triggers if there are 3 or more such attempts within an hour for the same account and computer.
This rule detects repeated failed or successful logon attempts (EventID 4625 or 4624) to sensitive system accounts like 'SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE', or 'ADMIN$' from non-system accounts. It specifically looks for interactive (LogonType 10), remote interactive (LogonType 3), or unlock (LogonType 9) logons, and triggers if there are 3 or more such attempts within an hour for the same account and computer.
Detects multiple instances of a non-SYSTEM or non-LOCAL SERVICE account using 'RunAs' to execute processes as highly privileged accounts (admin, system, root) within a short timeframe. This could indicate an attempt at privilege escalation or token impersonation.
Detects execution of tools known to manipulate Windows access tokens
Detects execution of tools known to manipulate Windows access tokens
This rule detects suspicious command-line activity indicative of potential token impersonation or theft. It specifically looks for the keywords 'token' or 'impersonate' within process creation command lines (EventID 4688) and triggers an alert if these keywords appear 3 or more times within an hour on the same computer by the same account. This could indicate an adversary attempting to manipulate access tokens to elevate privileges or operate under a different security context.
This rule detects attempts to manipulate access tokens via a remote SMB session. Specifically, it looks for the string "ImpersonateLoggedOnUser" within TCP traffic destined for port 445 (SMB). This activity could indicate an attacker attempting to elevate privileges or move laterally by impersonating a logged-on user.
This rule detects the delivery of a token manipulation tool over HTTP. It specifically looks for the presence of the strings "AdjustTokenPrivileges" and "OpenProcessToken" (case-insensitive) within the file data of an HTTP response. These strings are associated with Windows API calls used for modifying process tokens, which is a common technique for privilege escalation.
This rule detects when a user account repeatedly (3 or more times within an hour) requests either 'SeDebugPrivilege' or 'SeImpersonatePrivilege' (Event ID 4672). This behavior can be indicative of an attacker attempting to escalate privileges or manipulate access tokens, often seen in techniques like token impersonation or debugging processes for malicious purposes.
This rule detects an anomaly in Kerberos Ticket Granting Ticket (TGT) requests. Specifically, it triggers an alert if more than 50 UDP Kerberos TGT requests are observed from a single source IP address within a 10-second window to the home network on port 88. This behavior could indicate an attempt to enumerate valid user accounts or perform credential stuffing/brute-force attacks against the Kerberos authentication system, potentially as part of a privilege escalation attempt (ATT&CK T1134).
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators
This detection identifies JSON Web Tokens (JWTs) with an expiration time ("exp" claim) that is set unusually far in the future. Attackers may forge tokens with long lifespans to maintain persistent access after an initial compromise.
Detects critical Windows system processes spawning unusual child processes. While these processes rarely spawn command shells or scripting interpreters legitimately, this behavior could indicate PPID spoofing, process injection, or other malicious process manipulation techniques.
Page 5 of 7