Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
489 detections
Filters
Last updated
All Time
Detection languages
254
128
40
20
20
Contributors
118
95
93
33
29
Categories
314
166
79
66
36
Platforms
477
2
2
2
2
Products / Services
169
116
90
25
21
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the creation of a specific DLL file ('api-ms-win-core-kernel32-legacy-l1.DLL') within a user's temporary directory. This pattern is indicative of a User Account Control (UAC) bypass technique that leverages NTFS reparse points and DLL hijacking, often associated with tools like UACMe (specifically UACMe 36). The rule looks for the exact file path in a user's AppData\Local\Temp directory.
This rule detects a specific User Account Control (UAC) bypass technique leveraging the Windows Media Player component. Specifically, it looks for the creation of a file named 'OskSupport.dll' within a user's temporary directory, combined with 'DllHost.exe' accessing 'osk.exe' located in the Windows Media Player directory. This pattern is indicative of the UACMe tool's method 32, which exploits a vulnerability related to Windows Media Player to elevate privileges without user interaction.
This rule detects a specific pattern indicative of a User Account Control (UAC) bypass technique using 'IEInstal.exe'. Specifically, it looks for 'IEInstal.exe' creating a file named 'consent.exe' within a user's temporary application data directory (e.g., 'C:\Users\<username>\AppData\Local\Temp\'). This behavior is characteristic of UACMe, an open-source tool designed to exploit various UAC bypass methods.
Detects a specific User Account Control (UAC) bypass technique that involves modifying the msconfig GUI. This rule specifically looks for the creation of a file named 'pkgmgr.exe' within a user's temporary directory, which is a known indicator for the UACMe bypass method 55.
Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a User Account Control (UAC) bypass attempt. The rule specifically filters out legitimate child processes like 'mmc.exe' and 'WerFault.exe' to reduce false positives.
Detects specific command-line patterns associated with Empire PowerShell UAC bypass methods. These patterns involve PowerShell commands designed to retrieve and execute content from the 'Update' registry key within 'HKCU:Software\Microsoft\Windows Update', which is a known technique used by Empire for privilege escalation.
This rule detects a specific UAC bypass technique (UACMe method 39) that leverages .NET Code Profiler and DLL hijacking against mmc.exe. It specifically looks for the creation of a DLL named 'pe386.dll' within a user's temporary AppData directory, which is characteristic of this bypass method.
Detects the pattern of User Account Control (UAC) Bypass using the ICMLuaUtil Elevated COM interface. This technique involves a specific parent process (dllhost.exe) launching with particular Process IDs associated with the ICMLuaUtil interface, which can be abused to elevate privileges without user interaction. The rule filters out legitimate WerFault.exe processes to reduce false positives.
This rule detects a User Account Control (UAC) bypass technique that leverages the Windows Event Viewer (eventvwr.exe). Specifically, it looks for modifications to the registry key `\mscfile\shell\open\command`. This registry key is associated with how .msc files (Microsoft Management Console snap-ins) are opened. By manipulating this key, an attacker can hijack the execution flow when eventvwr.exe is launched, causing it to execute an arbitrary command with elevated privileges without a UAC prompt. This is a known method for privilege escalation and defense evasion.
Detects the creation of a DLL file by "dllhost.exe" in the System32 directory, which is indicative of the "IDiagnosticProfileUAC" UAC bypass technique. This technique leverages a legitimate Windows process to write a malicious DLL into a system directory, allowing for privilege escalation.
Detects a User Account Control (UAC) bypass technique that leverages the Windows Event Viewer (eventvwr.exe). This method involves manipulating the registry to execute an arbitrary binary or script with elevated privileges when eventvwr.exe is launched. The rule specifically looks for file creation events in the 'RecentViews' directory associated with Event Viewer, where the creating process is not a standard system process (i.e., not originating from C:\Windows\System32\ or C:\Windows\SysWOW64\).
Detects the creation of specific files (winsat.exe or winmm.dll) in a user's temporary directory under a 'system32' subdirectory. This pattern is indicative of a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in winsat.exe, often associated with UACMe (specifically UACMe method 52). The rule looks for files created in 'C:\Users\<username>\AppData\Local\Temp\system32\' with the names 'winsat.exe' or 'winmm.dll'.
This rule detects a User Account Control (UAC) bypass technique that leverages a WoW64 logger DLL hijack, specifically referencing UACMe method 30. It identifies process access events where the source image is located in 'C:\Windows\SysWOW64\', requests full access ('0x1fffff'), and exhibits an unknown call trace pattern starting with 'UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|'. This combination of indicators suggests an attempt to elevate privileges by injecting a malicious DLL into a trusted process.
Detects a User Account Control (UAC) bypass technique that exploits the 'iscsicpl.exe' process. This bypass leverages DLL Search Order Hijacking to load a malicious 'iscsiexe.dll' from a user-controlled location (e.g., temporary directory or a modified PATH environment variable) instead of the legitimate system directory. The rule specifically looks for 'iscsicpl.exe' loading 'iscsiexe.dll' from any location other than 'C:\Windows\'.
This rule detects an unfixed User Account Control (UAC) bypass method in Windows 10 that leverages WSReset.exe. The bypass works by modifying a specific registry key associated with the Windows Store, allowing a low-privilege binary to be executed with elevated privileges when WSReset.exe is run.
This rule detects User Account Control (UAC) bypass attempts by monitoring specific registry key modifications related to `sdclt.exe`. Attackers can manipulate these registry keys to hijack the execution flow of `sdclt.exe`, a legitimate Windows utility, to run arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for modifications to `Software\Classes\exefile\shell\runas\command\isolatedCommand` or `Software\Classes\Folder\shell\open\command\SymbolicLinkValue` with a specific pattern indicating a UAC bypass technique.
Detects function calls from the EditionUpgradeManager COM interface, which is not typically used by standard executables. This activity can be indicative of a User Account Control (UAC) bypass attempt.
This rule detects the creation of new processes where the parent process is `taskmgr.exe`. This activity could indicate an attempt to bypass User Account Control (UAC) by leveraging the Windows Task Manager, which is often auto-elevated. The rule filters out common legitimate processes that `taskmgr.exe` might launch, such as `mmc.exe`, `resmon.exe`, and `Taskmgr.exe` itself, to reduce false positives.
Bypass UAC via CMSTP
Sigma
Detects command-line usage of Microsoft Connection Manager Profile Installer (cmstp.exe) with specific flags often used to install specially formatted local .INF files for privilege escalation or defense evasion. This technique is commonly associated with UAC bypasses.
Detects a User Account Control (UAC) bypass technique that leverages the Event Viewer's RecentViews functionality. This method involves manipulating the RecentViews file to execute arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for command-line arguments that reference 'Event Viewer\RecentViews' or 'EventV~1\RecentViews' in conjunction with a redirection operator ('>'), indicating an attempt to write to or modify this file.
Detects the use of WSReset.exe to bypass User Account Control (UAC). This technique allows adversaries to execute privileged processes without a UAC prompt.
Page 23 of 24