Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

13 detectors match the current filters. technique: T1548 ✕

Download CSV
Type Name Severity Module Data source / event ATT&CK
BIOC Bypass UAC using the control.exe Registry key Control.exe is a Registry key known to be altered by attackers to allow themselves to run their malware with elevated privileges. Medium Platform Analytics Registry Privilege Escalation
BIOC Bypass UAC using the IsolatedCommand Registry value IsolatedCommand is a Registry value known to be altered by attackers to allow themselves to run their malware with elevated privileges. Medium Platform Analytics Registry Privilege Escalation
BIOC Bypassing Windows UAC using sysprep Attackers may use the sysprep.exe built-in Windows tools to bypass Windows UAC. Informational Platform Analytics Process execution Privilege Escalation
BIOC Command enumeration via sudo The 'sudo -l' command was executed to enumerate commands that can be executed by a user. Informational Platform Analytics Process execution Privilege Escalation
BIOC Discovery of files with setgid or setuid bits Attackers may try to locate files with setgid or setuid bits set to escalate privileges. Informational Platform Analytics Process execution Privilege Escalation
BIOC Manipulation of MMC Registry configuration Creation or modification of these Microsoft Management Console related entries can cause the execution of the specified programs, bypassing UAC. Informational Platform Analytics Registry Privilege Escalation
BIOC Possible UAC bypass via Event Viewer Eventvwr.exe normally only spawns mmc.exe. Attackers may use it for bypassing UAC (User Account Control) by having it spawn a different process. Medium Platform Analytics Process execution Privilege Escalation
BIOC Setuid on file Setting user identification on an executable file causes it to run with the privileges of the owning user. Informational Platform Analytics Process execution Privilege Escalation
BIOC Sudoers discovery Attackers may enumerate the sudoers file or use the 'sudo -l' command to discover user privileges. Informational Platform Analytics Process execution Discovery, Privilege Escalation
BIOC UAC bypass using the changepk.exe Registry key Attackers may use the changepk.exe built-in Windows tool to bypass Windows UAC by modifying Registry keys. Medium Platform Analytics Registry Privilege Escalation
BIOC Unsigned integer Sudo privilege escalation Fixed in CVE-2019-14287, this known command line is used to exploit a bug in sudo to gain root privileges. Medium Platform Analytics Process execution Privilege Escalation
BIOC Unusual process spawned by changepk.exe Attackers may use the changepk.exe built-in Windows tool to bypass UAC using an unusual initiator. Informational Platform Analytics Process execution Privilege Escalation
BIOC WSReset.exe UAC bypass Attackers may use WSReset.exe to bypass User Account Control (UAC). Low Platform Analytics Process execution Privilege Escalation