Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
74 detections
Filters
Last updated
All Time
Detection languages
30
24
9
6
3
Contributors
16
14
13
10
5
Categories
48
42
15
13
12
Platforms
74
1
Products / Services
26
25
17
4
4
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
1
IDS Classtypes
1
IDS Protocols
1
The following analytic detects a process enabling the "SeDebugPrivilege" privilege token. It leverages Windows Security Event Logs with EventCode 4703, filtering out common legitimate processes. This activity is significant because SeDebugPrivilege allows a process to inspect and modify the memory of other processes, potentially leading to credential dumping or code injection. If confirmed malicious, an attacker could gain extensive control over system processes, enabling them to escalate privileges, persist in the environment, or access sensitive information.
Detects the 'mscopilot.exe' binary performing token manipulation operations (DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken) followed by the creation of a new process with a different security context (CreateProcessAsUserW) within a five-minute window, indicative of C2 agent functionality.
This rule detects potential Windows token manipulation by correlating logon events containing sensitive privileges (SeDebugPrivilege/SeImpersonatePrivilege) with subsequent process creation events under a different user context within a short timeframe. It further validates the activity by incorporating Sysmon Event ID 10 alerts that identify process access patterns commonly associated with token duplication or impersonation techniques used in post-exploitation frameworks like Cobalt Strike.
Detects a process re-launching itself with a specific command-line argument format (a single 's' character followed by a numeric session ID). This behavior is characteristic of the SparroWocky malware, which enumerates user sessions and spawns a new backdoor instance under a different session using CreateProcessAsUserW after duplicating the target session's token.
Detects instances where a non-SYSTEM process attempts to open a handle to winlogon.exe. Since winlogon.exe typically runs as SYSTEM and manages user sessions, unauthorized access to its process handle is often a precursor to credential dumping or token manipulation attacks aimed at escalating privileges to SYSTEM.
Detects instances where a non-SYSTEM process attempts to open a handle to winlogon.exe. Since winlogon.exe typically runs as SYSTEM and manages user sessions, unauthorized access to its process handle is often a precursor to credential dumping or token manipulation attacks aimed at escalating privileges to SYSTEM.
This rule detects attempts to manipulate process access tokens using the Windows 'SetTokenInformation' API. Specifically, it monitors for adjustments to token privileges or integrity levels, or the presence of 'Untrusted' markers. These behaviors are often indicative of an adversary attempting to bypass Windows access controls, perform token manipulation, or conduct privilege escalation.
Detects instances where a non-SYSTEM process attempts to open a handle to winlogon.exe. Since winlogon.exe typically runs as SYSTEM and manages user sessions, unauthorized access to its process handle is often a precursor to credential dumping or token manipulation attacks aimed at escalating privileges to SYSTEM.
This rule detects attempts to manipulate process access tokens using the Windows 'SetTokenInformation' API. Specifically, it monitors for adjustments to token privileges or integrity levels, or the presence of 'Untrusted' markers. These behaviors are often indicative of an adversary attempting to bypass Windows access controls, perform token manipulation, or conduct privilege escalation.
This rule detects command-line activity that references sensitive Windows API functions or privileges associated with token manipulation and process privilege escalation, such as SeDebugPrivilege, SeImpersonatePrivilege, DuplicateTokenEx, CreateProcessWithTokenW, and NtSetInformationToken. The rule excludes common service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) to focus on potentially unauthorized use by standard or administrative accounts.
This rule detects command-line activity that references sensitive Windows API functions or privileges associated with token manipulation and process privilege escalation, such as SeDebugPrivilege, SeImpersonatePrivilege, DuplicateTokenEx, CreateProcessWithTokenW, and NtSetInformationToken. The rule excludes common service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) to focus on potentially unauthorized use by standard or administrative accounts.
Detects instances where notepad.exe is executed with a security context (AccountName) that differs from the initiating process's account (InitiatingProcessAccountName). This pattern is consistent with the LegacyHive technique, which utilizes CreateProcessWithLogonW to load a target user's registry hive by spawning a suspended process as that user.
Detects instances where runas.exe is used to launch PowerShell and monitors subsequent child processes for suspicious commands or activity, such as credential dumping tools, encoded commands, or access to sensitive browser data locations, which may indicate credential theft or unauthorized lateral movement.
Detects the privilege escalation sequence used by VILE ransomware, which involves manipulating process tokens via a combination of OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, GetTokenInformation, SetTokenInformation, and DuplicateTokenEx. This is followed by the termination of processes using TerminateProcess, typically performed to release locked files before encryption.
Detects potential privilege escalation attempts targeting AnyDesk runtime via named pipe exploitation. The rule monitors for unauthorized cross-process access to AnyDesk processes, AnyDesk spawning suspicious child processes indicative of post-exploitation activity, and the execution of a known vulnerable AnyDesk binary version.
Detects potential local privilege escalation activity involving AnyDesk. The rule monitors for malicious registry modifications (COM hijack), spawning of suspicious child processes by AnyDesk, creation of specific named-pipe artifacts, unsigned DLL loads from user-writable directories, and unauthorized cross-process injection, potentially linked to CVE-2026-20253.
This rule detects token manipulation and impersonation behaviors characteristic of Cobalt Strike post-exploitation activity. It specifically identifies instances where common child processes (cmd.exe, powershell.exe, net.exe, whoami.exe) are spawned from non-standard parent processes associated with Cobalt Strike payloads (e.g., rundll32.exe, msiexec.exe, svchost.exe), often accompanied by a discrepancy between the effective username and the parent process username or the use of discovery tools post-impersonation.
Detects multiple suspicious activities associated with the AnyDesk remote access application, including the creation of specific named pipes, execution of processes with sensitive command-line arguments (e.g., comsvcs, impersonation privileges), non-standard DLL loads by the application, and the spawning of system-level processes. These behaviors are indicative of abuse of remote access software for post-exploitation activities or privilege escalation.
Detects evidence of PPID spoofing associated with the StrikeShark/Cobalt Strike framework. The detection identifies suspicious child processes (e.g., cmd.exe, powershell.exe) originating from common system processes (e.g., explorer.exe, svchost.exe) while the actual ancestor is a malicious SystemSettings.exe binary located in non-standard AppData paths. It correlates these process events with account mismatches between the spoofed parent and child process, indicating CreateProcessWithTokenW usage for token impersonation.
Detects evidence of VILE ransomware behavior involving token and privilege manipulation, including the use of Windows API functions such as AdjustTokenPrivileges, OpenProcessToken, and DuplicateTokenEx, as well as potential EDR bypass indicators via NT syscalls like NtCreateWaitCompletionPacket.
Detects signs of access token manipulation and impersonation, including the use of 'runas' with saved credentials, suspicious PowerShell API calls for identity management, usage of known token-manipulation tools (e.g., incognito), and reconnaissance using 'whoami /priv'. These activities are indicative of privilege escalation attempts or lateral movement.
Page 1 of 4