Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
489 detections
Filters
Last updated
All Time
Detection languages
254
128
40
20
20
Contributors
118
95
93
33
29
Categories
314
166
79
66
36
Platforms
477
2
2
2
2
Products / Services
169
116
90
25
21
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects attempts to bypass User Account Control (UAC) by modifying the registry to leverage the DelegateExecute verb. Specifically, it looks for modifications to registry keys ending with '\open\command\DelegateExecute' where the 'Details' field is empty, which is indicative of a fileless UAC bypass technique.
Detects a specific UAC bypass technique leveraging Windows Media Player's `osk.exe` by monitoring modifications to a particular registry key. This technique, often associated with UACMe (specifically method 32), involves setting a 'Binary Data' value in the AppCompatFlags\Compatibility Assistant\Store registry path for `C:\Program Files\Windows Media Player\osk.exe`.
Detects when the 'windir' environment variable is modified from its default value. This modification is often a precursor to a User Account Control (UAC) bypass technique leveraging the 'SilentCleanup' scheduled task, which is an auto-elevated task that can execute with administrator privileges without prompting the user.
Detects a specific UAC bypass technique (UACMe 52) that abuses a path parsing vulnerability in `winsat.exe`. This bypass involves modifying registry keys related to `winsat.exe` to point to a malicious executable located in a temporary directory, allowing for privilege escalation without a UAC prompt.
UAC Disabled
Sigma
Detects when an attacker tries to disable User Account Control (UAC) by setting the registry value "EnableLUA" to 0.
A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.
Page 24 of 24