Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
232 detections
Filters
Last updated
All Time
Detection languages
92
81
28
10
8
Contributors
42
40
36
26
17
Categories
110
82
65
31
22
Platforms
87
83
18
17
11
Products / Services
32
28
25
23
21
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
6
5
5
3
3
IDS Classtypes
2
IDS Protocols
2
This rule detects the addition of a new conditional access policy within an Azure environment. Conditional Access policies are critical security controls that determine when and how users can access resources. Unauthorized or unexpected changes to these policies could indicate an attacker attempting to establish persistence, bypass existing security controls (like MFA), or gain unauthorized access by modifying access conditions.
This rule identifies the suspicious use of the AWS Security Token Service (STS) API call `GetSessionToken`. This API call is used to request temporary, limited-privilege credentials for an IAM user or role. Attackers may use `GetSessionToken` to generate temporary tokens to move laterally within an AWS environment or escalate privileges by assuming roles with broader permissions. The rule specifically looks for `GetSessionToken` calls made by an `IAMUser`.
This rule identifies suspicious activity related to Security Assertion Markup Language (SAML) in AWS. Specifically, it looks for two events: `AssumeRoleWithSAML` from the `sts.amazonaws.com` service and `UpdateSAMLProvider` from the `iam.amazonaws.com` service. An adversary could leverage these actions to gain unauthorized access, establish persistence, or escalate privileges within an AWS environment by manipulating SAML providers or assuming roles via SAML.
Detects the execution of the 'doas' utility on Linux systems. 'doas' allows standard users to execute commands as another user, typically root, similar to 'sudo'. This can be used by adversaries for privilege escalation or defense evasion.
Detects non-system users performing privileged operations on the Service Control Manager (SCM) database, specifically taking ownership of the 'servicesactive' object. This could indicate an attempt to manipulate Windows services for privilege escalation or persistence.
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472, also known as Zerologon. This vulnerability allows an unauthenticated attacker to gain domain administrator privileges.
Detection of unusual child processes (PowerShell or Command Prompt) spawned by critical system processes (winlogon.exe, services.exe, lsass.exe, csrss.exe, smss.exe, wininit.exe, spoolsv.exe, searchindexer.exe) running under an authorized user context. This behavior can indicate privilege escalation or defense evasion, especially if the spawned process is not related to legitimate network routing commands.
This rule detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Specifically, it looks for the creation of a process where the parent process is 'mmc.exe' and its command line contains 'WF.msc', while filtering out legitimate 'WerFault.exe' processes.
This rule detects modifications to the 'DelegateExecute' registry value within the 'HKCU\Software\Classes\Folder\shell\open\command' key. This specific registry modification is a known technique used for COM hijacking, often leveraged in UAC bypasses, such as those involving sdclt.exe. An attacker can modify this key to execute an arbitrary program when a user attempts to open a folder, leading to persistence or privilege escalation.
Detects the creation of doas.conf file in linux host platform.
Detects when 'regedit.exe' is launched with elevated privileges by either 'TrustedInstaller.exe' or 'ProcessHacker.exe'. This activity is highly suspicious as it indicates an attempt to modify the registry with system-level permissions, potentially for defense evasion or privilege escalation.
The following analytic detects when a process with low, medium, or high integrity spawns a system integrity process from a user-controlled location. This behavior is indicative of privilege escalation attempts where attackers elevate their privileges to SYSTEM level from a user-controlled process or service. The detection leverages Sysmon data, specifically Event ID 15, to identify such transitions. Monitoring this activity is crucial as it can signify an attacker gaining SYSTEM-level access, potentially leading to full control over the affected system, unauthorized access to sensitive data, and further malicious activities.
This analytic detects when a process running with low or medium integrity from a user account spawns an elevated process with high or system integrity in suspicious locations. This behavior is identified using process execution data from Windows process monitoring or Sysmon EventID 1. This activity is significant as it may indicate a threat actor successfully elevating privileges, which is a common tactic in advanced attacks. If confirmed malicious, this could allow the attacker to execute code with higher privileges, potentially leading to full system compromise and persistent access.
Detects repeated denied UAC elevation attempts (UAC "prompt storms") initiated by the same process within a short time frame.
This detection is based entirely on Microsoft Defender for Endpoint (MDE) telemetry from DeviceProcessEvents and is useful in environments where traditional SecurityEvent logs (e.g. Event ID 4688) are unavailable or not ingested.
It identifies patterns where a process consistently triggers `consent.exe` (the UAC prompt), but no elevated child process follows — indicating the prompt was denied or ignored.
This is particularly useful for detecting UAC bombing attacks, where a malicious process tries to overwhelm the user with repeated elevation prompts to bypass security friction.
This detection is based entirely on Microsoft Defender for Endpoint (MDE) telemetry from DeviceProcessEvents and is useful in environments where traditional SecurityEvent logs (e.g. Event ID 4688) are unavailable or not ingested.
It identifies patterns where a process consistently triggers `consent.exe` (the UAC prompt), but no elevated child process follows — indicating the prompt was denied or ignored.
This is particularly useful for detecting UAC bombing attacks, where a malicious process tries to overwhelm the user with repeated elevation prompts to bypass security friction.
Detects suspicious downloads or fetches of common privilege-escalation tools such as winPEAS, linPEAS, PowerUp, Seatbelt, SharpUp, WinPwn, PrivescCheck, Sherlock, Watson, BeRoot, LinEnum, LSE/LES, Linux Exploit Suggester, pspy, or GTFObins. These tools are often used by adversaries after initial access to enumerate the environment and attempt local privilege escalation.
Detects suspicious driver loads indicative of rootkits or BYOVD attacks. Flags unsigned/non-Microsoft drivers loaded from temp paths or by unusual processes. Targets random-named drivers (e.g., 'a1b2c3.sys'), known vulnerable drivers, and system driver impersonators.
KQL Query
KQL Query
KQL Query
'This hunting query will alert on any Impossible travel activity in correlation with mailbox permission tampering followed by account being added to a PIM managed privileged group.
Ensure this impossible travel incident with increase of privileges is legitimate in your environment.'
Ensure this impossible travel incident with increase of privileges is legitimate in your environment.'
COM Hijack via Sdclt
Sigma
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Page 9 of 12