Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
489 detections
Filters
Last updated
All Time
Detection languages
254
128
40
20
20
Contributors
118
95
93
33
29
Categories
314
166
79
66
36
Platforms
477
2
2
2
2
Products / Services
169
116
90
25
21
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects a specific User Account Control (UAC) bypass technique that leverages the Disk Cleanup utility (cleanmgr.exe) in conjunction with scheduled tasks. The detection logic looks for a process creation event where 'cleanmgr.exe' is executed with the '/autoclean /d C:' arguments, and its parent process is 'svchost.exe -k netsvcs -p -s Schedule', indicating it was launched by the Task Scheduler service. Furthermore, the rule specifies that the integrity level of the 'cleanmgr.exe' process must be 'High' or 'System', which is indicative of an elevated process, thus confirming a successful UAC bypass. This technique is associated with UACMe method 34.
This rule detects attempts to bypass User Account Control (UAC) using the Microsoft Connection Manager Profile Installer (CMSTP) by abusing specific autoelevate-capable COM objects. The detection logic looks for processes where 'DllHost.exe' is the parent process, the parent command line contains specific COM Process IDs associated with CMSTP or related components, and the process is running with 'High' or 'System' integrity levels. This technique is often used by adversaries to elevate privileges without user interaction.
Detects the execution of 'wsreset.exe' with elevated privileges (High or System integrity levels). This behavior is indicative of a User Account Control (UAC) bypass attempt, as 'wsreset.exe' is a legitimate Windows utility that can be abused to elevate privileges without a UAC prompt.
This rule detects attempts to bypass User Account Control (UAC) using the 'ComputerDefaults.exe' utility, specifically when it is executed with elevated integrity levels (High or System) and not as a child process of common system directories like 'System32' or 'Program Files'. This behavior is characteristic of UAC bypass tools such as UACMe (method 59).
Detects a specific User Account Control (UAC) bypass technique leveraging 'ieinstal.exe' as a parent process. The rule looks for processes with 'High' or 'System' integrity levels, where the parent process is 'ieinstal.exe' and the created process is 'consent.exe' located in a temporary directory ('\AppData\Local\Temp\'). This pattern is characteristic of the UACMe tool's method 64.
This rule detects a specific User Account Control (UAC) bypass technique that involves `pkgmgr.exe` launching `dism.exe` with elevated integrity levels. This behavior is characteristic of UACMe, a tool used to discover and implement UAC bypasses. The rule specifically looks for `dism.exe` being spawned as a child process of `pkgmgr.exe` and operating at 'High' or 'System' integrity levels, or their corresponding Security Identifier (SID) representations.
Detects a specific User Account Control (UAC) bypass technique that leverages the 'changepk.exe' and 'slui.exe' executables. This method is associated with UACMe bypass technique #61, where 'slui.exe' is used as a parent process to launch 'changepk.exe' with elevated privileges, bypassing the UAC prompt. The rule specifically looks for 'changepk.exe' being spawned by 'slui.exe' with an integrity level of 'High' or 'System'.
Detects User Account Control (UAC) bypass attempts leveraging NTFS reparse points and wusa.exe DLL hijacking, specifically targeting techniques similar to UACMe method 36. This rule identifies the creation of processes with elevated integrity levels (High or System) executing 'wusa.exe' with a specific command line pattern pointing to a temporary update.msu file, or 'dism.exe' as a parent process launching 'DismHost.exe' with a suspicious command line containing temporary paths.
Detects a User Account Control (UAC) bypass technique leveraging Windows Media Player's `osk.exe` in conjunction with `cmd.exe` and `mmc.exe` to achieve elevated privileges. This specific pattern is associated with UACMe bypass method 32, which exploits the `osksupport.dll` vulnerability. The rule looks for the creation of `osk.exe` from the Windows Media Player directory, followed by `cmd.exe` being launched with a specific parent command line involving `mmc.exe` and `eventvwr.msc`, all while maintaining a high or system integrity level.
Detects a specific pattern indicative of a User Account Control (UAC) bypass technique using DismHost DLL hijacking. This method, often associated with UACMe (specifically UACMe 63), involves a process named 'DismHost.exe' being launched from a user's temporary directory with elevated integrity levels (High or System). This behavior is suspicious because DismHost.exe is a legitimate Windows component, but its execution from a temporary user-specific path with elevated privileges suggests an attempt to bypass UAC.
Detects a specific UAC bypass technique involving the modification of the msconfig token, often associated with tools like UACMe (specifically method 55). The rule looks for a process with High or System integrity level, whose parent process is 'pkgmgr.exe' located in a temporary directory, and executes 'msconfig.exe' with the '-5' command-line argument.
This rule detects the execution of 'sdclt.exe' with elevated privileges (High integrity level). This behavior is often indicative of an attempt to bypass User Account Control (UAC) mechanisms on Windows systems. Attackers may leverage sdclt.exe, a legitimate Windows utility, to execute arbitrary commands or processes with administrative rights without triggering a UAC prompt.
Detects a specific User Account Control (UAC) bypass technique known as "IDiagnosticProfileUAC". This technique involves a process with high or system integrity level launching 'DllHost.exe' with a specific command-line argument containing '{12C21EA7-2EB8-4B55-9249-AC243DA8C666}'. This behavior is indicative of an attempt to elevate privileges by bypassing UAC.
This rule detects a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in `winsat.exe`. Specifically, it looks for the creation of a process with 'High' or 'System' integrity levels where the parent process image path ends with `\AppData\Local\Temp\system32\winsat.exe` and the parent command line contains `C:\Windows \system32\winsat.exe`. This pattern is indicative of UACMe method 52, which leverages a specially crafted path to trick `winsat.exe` into executing an arbitrary payload with elevated privileges.
This rule detects the creation of a named file stream (Alternate Data Stream - ADS) containing specific Imphash values associated with known hack tools. The Imphash values are for tools such as Mimikatz, PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, NanoDump, HandleKatz, DripLoader, UACMe, Dumpert, EDRSandBlast, and others. Adversaries often use ADSs to hide malicious executables or data to evade detection by traditional security tools that may not scan alternate data streams.
Detects the execution of UACMe, a tool used for User Account Control (UAC) bypasses, by identifying specific PE metadata (Product, Company, Description, OriginalFileName) or image names. It also includes a selection of known IMPHASH values associated with UACMe's 'Akagi' component.
Detects command-line keywords indicative of the execution of the WinPwn tool, which is used for Windows and Active Directory reconnaissance and exploitation. This rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' in the command line.
Detects scriptblock text keywords indicative of potential usage of the tool WinPwn. WinPwn is a tool for Windows and Active Directory reconnaissance and exploitation. The rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' within PowerShell script block logs.
Detects the installation or execution of services associated with known hack tools or UAC bypass techniques. The rule specifically looks for Windows Service Control Manager events (7045 for service installation, 7036 for service state changes) in conjunction with service names or image paths that are indicative of tools like cachedump, gsecdump, pwdump, PsExec, or UAC bypass mechanisms.
Detects when an attacker attempts to disable User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. This action can be part of privilege escalation or defense evasion tactics to bypass UAC prompts.
Detects a specific User Account Control (UAC) bypass technique involving the creation of a file named 'comctl32.dll' within a directory structure that starts with 'C:\Windows\System32\consent.exe.@'. This pattern is indicative of UACMe (specifically UACMe 22) attempting to elevate privileges by manipulating how consent.exe loads libraries.
Page 22 of 24