Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
4
2
1
Contributors
2
2
2
1
Categories
5
2
2
1
1
Platforms
2
2
2
1
Products / Services
2
2
1
1
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
IDS Classtypes
2
IDS Protocols
2
Detects a non-system application using the PackageInstaller Session API to perform sideloading followed immediately by a request or binding to an AccessibilityService. This behavior is indicative of malicious droppers or malware (such as the RatHat Android malware family) attempting to bypass install restrictions and gain elevated control over the device to manipulate settings like Developer Options or Wireless Debugging.
Detects the use of osascript to generate fake macOS system-style dialog boxes that solicit user credentials or administrator privileges. This technique is often employed by macOS infostealers to conduct GUI-based credential harvesting or to bypass user interaction requirements for privilege escalation.
Detects the execution of the LANDFALL spyware's SELinux policy manipulation helper (`l.so`). The spyware's loader (`b.so`) sets a `PRELOAD_PATH` environment variable pointing to `l.so` and uses `LD_PRELOAD` to inject another payload into the benign `/system/bin/id` process. This behavior is specific to the "interactive" execution mode of the spyware.
Detects instances where wscript.exe spawns a child process of itself with the /elevated command-line flag, a behavior often indicative of attempts to bypass User Account Control (UAC) or gain elevated script execution privileges.
Detects the execution of the LANDFALL spyware's SELinux policy manipulation helper (`l.so`). The spyware's loader (`b.so`) sets a `PRELOAD_PATH` environment variable pointing to `l.so` and uses `LD_PRELOAD` to inject another payload into the benign `/system/bin/id` process. This behavior is specific to the "interactive" execution mode of the spyware.
This rule detects attempts to abuse the macOS AuthorizationExecuteWithPrivileges function, which allows an application to execute a command with root privileges. The detection is based on the presence of the string "AuthorizationExecuteWithPrivileges" in HTTP response data, indicating a potential attempt by malware or an attacker to escalate privileges on a macOS system.
This rule detects attempts to bypass Windows User Account Control (UAC) elevation prompts by leveraging specific COM objects. It looks for HTTP traffic containing the strings "ICMLuaUtil" and "ShellExec" (case-insensitive) in the file data, which are indicative of this technique. This method is often used by malware to gain elevated privileges without user interaction.