Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
489 detections
Filters
Last updated
All Time
Detection languages
254
128
40
20
20
Contributors
118
95
93
33
29
Categories
314
166
79
66
36
Platforms
477
2
2
2
2
Products / Services
169
116
90
25
21
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects attempts to bypass User Account Control (UAC) by invoking the CMSTPLUA COM interface (CLSID: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}). This technique allows an attacker to execute processes with elevated privileges by leveraging the auto-elevation property of this COM object, often using the 'Elevation:Administrator!new' moniker.
Detects instances of dllhost.exe running with elevated integrity (High or System) that were not spawned by the standard DCOM Server Process Launcher (svchost.exe). This behavior is characteristic of COM object hijacking or auto-elevation techniques used to bypass UAC.
Detects modifications to Windows Registry keys associated with UI lockdown behaviors, specifically disabling Task Manager, altering User Account Control (UAC) settings, modifying auto-colorization, or resetting default UI tiles. These modifications are often used by malware or malicious actors to inhibit user interaction, bypass security prompts, or persist UI-level restrictions.
Detects potential User Account Control (UAC) bypass attempts using the PowerShell 'Start-Process' cmdlet with the 'runAs' verb, which requests administrative privileges for a new process. The rule also includes a specific check for command-line artifacts associated with the 'wipe32' malware campaign, which utilizes this method for privilege escalation.
Detects potential User Account Control (UAC) bypass attempts using the PowerShell 'Start-Process' cmdlet with the 'runAs' verb, which requests administrative privileges for a new process. The rule also includes a specific check for command-line artifacts associated with the 'wipe32' malware campaign, which utilizes this method for privilege escalation.
Detects modifications to the Windows Registry where the 'EnableLUA' value is set to 0, which effectively disables User Account Control (UAC). This action is often performed by attackers to evade security prompts and maintain higher integrity levels during execution.
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Rule for T1548.002 technique "Bypass UAC using Event Viewer (cmd)"
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Detects instances where known Windows auto-elevate binaries (fodhelper.exe, computerdefaults.exe, eventvwr.exe) are executed without a corresponding UAC consent.exe process. This behavior is indicative of a UAC bypass, often facilitated by registry key modifications (COM hijacking) to manipulate how these binaries are launched.
Detects high-integrity or system-level processes launched by specific shellcode-like filenames or processes containing 'ICMLuaUtil' in the command line. This technique is often indicative of a UAC bypass attempt, where malicious actors attempt to elevate privileges by abusing the ICMLuaUtil COM interface, while excluding the standard Windows consent dialog processes.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring for suspicious registry modifications in HKCU\Software\Classes associated with auto-elevating binaries (such as fodhelper.exe, computerdefaults.exe, or eventvwr.exe), followed shortly by the execution of these binaries or their child processes. This pattern is indicative of an adversary attempting to elevate privileges by hijacking the command registry keys used by these trusted Windows binaries.
Detects the execution of 'ElevatorShellCode.exe' or the presence of 'ICMLuaUtil' in command-line arguments. 'ICMLuaUtil' is a known Windows COM interface frequently abused for UAC bypass and privilege escalation, while 'ElevatorShellCode' is indicative of suspicious tools attempting to gain higher integrity levels.
Detects the execution of known Windows binaries (fodhelper.exe, eventvwr.exe, computerdefaults.exe) which are frequently abused for User Account Control (UAC) bypass by exploiting their auto-elevation capability. These binaries are monitored as either the parent process or the target image, which is a common indicator of a UAC bypass attempt.
Detects specific User Account Control (UAC) bypass techniques involving fodhelper.exe, eventvwr.exe, and sdclt.exe, often used in conjunction with PowerShell 'RunAs' elevation to install system-level tools like Tailscale or OpenSSH, as observed in Operation Poisson.
Rule for T1548.002 technique "Bypass UAC using Event Viewer (cmd)"
Detects unauthorized processes attempting to access the ICMLuaUtil Elevated COM interface CLSID. This registry-based activity is indicative of a UAC bypass technique, where malicious actors, such as the ResiLoader threat, gain elevated privileges without triggering a standard UAC consent prompt.
Detects the modification of the EnableLUA registry key via the reg.exe utility. Setting EnableLUA to 0 effectively disables Windows User Account Control (UAC), which is a common post-exploitation technique used to elevate privileges or bypass security prompts.
Detects User Account Control (UAC) bypass attempts involving registry hijacking of 'mscfile' or 'ms-settings' classes to execute arbitrary commands, and monitors for associated suspicious child process spawning from eventvwr.exe or fodhelper.exe.
Detects registry access attempts to the CLSID registration entries for Chrome, Brave, and Edge IElevator COM interfaces. These interfaces are designed for browser-internal maintenance tasks. Adversaries, such as the operators of WEES Stealer, abuse these interfaces by invoking the IElevator DecryptData method via out-of-process COM activation to decrypt App-Bound encryption keys, bypassing standard browser security boundaries.
Page 6 of 24