Coverage › CVE-2023-28252
CVE-2023-28252 Mapped Sigma
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
- Vendor / product
- Microsoft — Windows
- Description (CISA)
- Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
- Added to KEV
- 2023-04-11
- Due date
- 2023-05-02
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Known
- CWE
- CWE-122
- CISA notes
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252
https://nvd.nist.gov/vuln/detail/CVE-2023-28252 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
7 mapping objects across 7 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1078 Valid Accounts | exploitation technique | This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs. ref 1 · ref 2 · ref 3 · ref 4 · ref 5 |
live |
| T1003 OS Credential Dumping | secondary impact | This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE: ref 1 · ref 2 · ref 3 · ref 4 · ref 5 |
live |
| T1021 Remote Services | secondary impact | This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE: ref 1 · ref 2 · ref 3 · ref 4 · ref 5 |
live |
| T1059 Command and Scripting Interpreter | secondary impact | This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE: ref 1 · ref 2 · ref 3 · ref 4 · ref 5 |
live |
| T1068 Exploitation for Privilege Escalation | primary impact | This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE: ref 1 · ref 2 · ref 3 · ref 4 · ref 5 |
live |
| T1136 Create Account | secondary impact | This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE: ref 1 · ref 2 · ref 3 · ref 4 · ref 5 |
live |
| T1486 Data Encrypted for Impact | secondary impact | This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE: ref 1 · ref 2 · ref 3 · ref 4 · ref 5 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1003 OS Credential Dumping secondary impact
- DET0234 Credential Dumping via Sensitive Memory and Registry Access Correlation
AN0648 WindowsProcesses accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.Tunable:
AccessMaskTimeWindowParentProcessFilterAN0649 LinuxProcesses opening /proc//mem or /proc//maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.Tunable:TargetProcessNameToolProcessNameAN0650 macOSUnsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.Tunable:KeychainAccessPathSignedBinaryStatus
Sigma rules tagged attack.t1003 (37)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0442defa-b4a2-41c9-ae2c-ea7042fc4701
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 · logsource: product=windows category=ps_script · 189e3b02-82b2-4b90-9662-411eb64486d4
Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.
Author: Thomas Patzke
· 2017-06-14 (modified 2025-01-30) · logsource: product=windows service=security · 1de68c67-af5c-4097-9c85-fe5578e09e67
Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
Author: Florian Roth (Nextron Systems)
· 2022-03-04 (modified 2024-11-23) · logsource: product=windows category=process_creation · 24e3e58a-646b-4b50-adef-02ef935b9fc8
Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
· 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Author: Tim Rauch, Janantha Marasinghe, Elastic (original idea)
· 2022-11-08 (modified 2023-01-22) · logsource: product=windows category=process_creation · 2d3cdeec-c0db-45b4-aa86-082f7eb75701
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)
· 2023-04-27 · logsource: product=windows category=ps_script · 3245cd30-e015-40ff-a31d-5cadd5f377ec
Detects the execution of the hacktool Rubeus using specific command line flags
Author: Milad Cheraghi
· 2026-04-28 · logsource: product=linux category=process_creation · 33b3cfb1-574e-44b9-b527-fbf9303b9d7b
Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.
Author: Swachchhanda Shrawan Poudel
· 2024-02-12 (modified 2024-03-13) · logsource: product=windows category=process_creation · 34275eb8-fa19-436b-b959-3d9ecd53fa1f
Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe".
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.
Author: Florian Roth (Nextron Systems)
· 2022-04-27 (modified 2024-01-15) · logsource: product=windows category=process_creation · 37c1333a-a0db-48be-b64b-7393b2386e3b
Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-11 (modified 2026-07-28) · logsource: product=windows category=file_access · 407aecb1-e762-4acf-8c7b-d087bcff3bb6
Detects suspicious processes based on name and location that access the windows credential manager and vault.
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-27 (modified 2026-01-09) · logsource: product=windows category=image_load · 416bc4a2-7217-4519-8dc7-c3271817f1d5
Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.
These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.
Author: Pawel Mazur
· 2021-05-24 (modified 2022-12-18) · logsource: product=linux service=auditd · 49aae26c-450e-448b-911d-b3c13d178dfc
Detect attempt to enable auditing of TTY input
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 547dfc53-ebf6-4afe-8d2e-793d9574975d
Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.
All 37 rules on the technique page →
T1021 Remote Services secondary impact
- DET0269 Behavioral Detection Strategy for Remote Service Logins and Post-Access Activity
AN0750 WindowsLogon via RDP or WMI by a user account followed by uncommon command execution, file manipulation, or lateral network connections.Tunable:
TimeWindowLogonUserRemoteHostListAN0751 LinuxSSH session from new source IP followed by interactive shell or privilege escalation (e.g., sudo, su) and outbound lateral connection.Tunable:SourceIPCommandListAN0752 macOSRemote login via ARD or SSH followed by screensharingd process activity or modification of TCC-protected files.macos:unifiedlogeventMessage CONTAINS 'screensharingd' or 'AuthorizationRefCreate'→ DC0067 Logon Session CreationTunable:RemoteServiceTargetedPathAN0753 IaaSUse of cloud-based bastion or VM console session followed by commands that initiate outbound SSH or RDP sessions from the cloud instance to other environments.Tunable:SourceAssetTagTargetPortListAN0754 ESXivSphere API logins (vimService) or SSH to ESXi host followed by unauthorized shell commands or lateral remote logins from the ESXi host.Tunable:SessionTypeCommandPattern
Sigma rules tagged attack.t1021 (11)
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 6991bc2b-ae2e-447f-bc55-3a1ba04c14e5
Detects instances where an FTP service on an OpenCanary node has had a login attempt.
Author: omkar72
· 2020-10-30 (modified 2023-02-28) · logsource: product=windows category=process_creation · 730fc21b-eaff-474b-ad23-90fd265d4988
Detects user accept agreement execution in psexec commandline
Author: Chirag Damani
· 2026-03-29 · logsource: product=windows category=process_creation · 7638e5fe-600c-4289-a968-f49dd537ec7d
Detects execution of the hacktool NetExec.
NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration
In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems.
Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.
Author: Tim Rauch, Elastic (idea)
· 2022-09-27 · logsource: product=windows category=process_creation · 8a3038e8-9c9d-46f8-b184-66234a160f6f
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Author: Tim Rauch, Elastic (idea)
· 2022-09-27 (modified 2022-12-30) · logsource: product=windows category=process_creation · 9bd04a79-dabe-4f1f-a5ff-92430265c96b
Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 9db5446c-b44a-4291-8b89-fcab5609c3b3
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d
Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · e9856028-fd4e-46e6-b3d1-10f7ceb95078
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Author: Josh Nickels
· 2024-05-10 · logsource: product=windows category=network_connection · fda34293-718e-4b36-b018-38caab0d1209
Detects an RDP connection originating from a domain controller.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · ff7139bc-fdb1-4437-92f2-6afefe8884cb
Detects instances where an SSH service on an OpenCanary node has had a login attempt.
T1059 Command and Scripting Interpreter secondary impact
- DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 WindowsDetects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.Tunable:
CommandLinePatternParentProcessNameTimeWindowAN1429 LinuxDetects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.Tunable:InterpreterNameUserContextExecutionChainLengthAN1430 macOSDetects launch of command-line interpreters via Terminal, Automator, or hiddenosascript, especially when parent process lineage deviates from user-initiated applications.macos:unifiedloglog stream --info --predicate 'eventMessage CONTAINS "exec"'→ DC0032 Process CreationTunable:LaunchAgentNameScriptNameTerminalAppUsageAN1431 ESXiDetects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.Tunable:ShellEnabledFlagSSHContextAN1432 Network DevicesIdentifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) viaenablemode or scripting-capable sessions used by uncommon accounts or from unknown IPs.Tunable:UserRoleDeviceType
Sigma rules tagged attack.t1059 (95)
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Author: Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Author: Florian Roth (Nextron Systems)
· 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Author: frack113, Tim Shelton (update fp)
· 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
All 95 rules on the technique page →
T1068 Exploitation for Privilege Escalation primary impact
- DET0514 Detection Strategy for Exploitation for Privilege Escalation
AN1419 WindowsDetects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.Tunable:
DriverNamePatternTimeWindowParentProcessPathAN1420 LinuxDetects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.Tunable:SetUIDBinaryListTimeWindowEffectiveUIDThresholdAN1421 macOSDetects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.Tunable:EntitlementListTimeWindowAN1422 ContainersDetects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.Tunable:NamespaceEscapePatternTimeWindow
Sigma rules tagged attack.t1068 (31)
Author: Florian Roth (Nextron Systems)
· 2019-11-20 (modified 2024-12-01) · logsource: product=windows category=process_creation · 02e0b2ea-a597-428e-b04a-af6a1a403e5c
Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-18 (modified 2023-12-02) · logsource: product=windows category=driver_load · 05296024-fe8a-4baf-8f3d-9a5f5624ceb2
Detects loading of known malicious drivers via their hash.
Author: Florian Roth (Nextron Systems)
· 2021-10-09 (modified 2022-12-25) · logsource: product=linux service=auditd · 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed
Detects command line parameter very often used with coin miners
Author: Nisarg Suthar
· 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72
Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
Author: Swachchhanda Shrawn Poudel (Nextron Systems)
· 2025-10-02 (modified 2026-03-31) · logsource: product=linux category=file_event · 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463.
This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations.
When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment,
potentially leading to arbitrary code execution and privilege escalation.
Author: @eyezuhk Isaac Fernandes
· 2025-02-19 · logsource: product=windows category=image_load · 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1
Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.
Author: Florian Roth (Nextron Systems)
· 2017-03-01 (modified 2025-03-17) · logsource: product=linux · 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
Detects buffer overflow attempts in Unix system log files
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-06 · logsource: product=windows category=process_creation · 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments.
Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-03 (modified 2023-12-02) · logsource: product=windows category=driver_load · 39b64854-5497-4b57-a448-40977b8c9679
Detects loading of known malicious drivers via the file name of the drivers.
Author: Florian Roth (Nextron Systems)
· 2021-11-22 (modified 2022-12-25) · logsource: product=windows category=file_event · 3be82d5d-09fe-4d6a-a275-0d40d234d324
Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file
Author: Gene Kazimiarovich
· 2026-04-30 · logsource: product=linux service=auditd · 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94
Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall.
AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431
to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD
splice path that corrupts the page cache of SUID binaries.
Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN
daemons using non-default kernel offload configurations.
Author: Gene Kazimiarovich
· 2026-05-09 · logsource: product=linux category=process_creation · 474b415a-d917-4f3b-8c62-9e1a0d5f7b48
Detects kernel auto-loading of the authencesn crypto module via modprobe
This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher
(e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the
crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation,
where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path,
corrupting the page cache of SUID binaries for local privilege escalation.
On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod)
with 'modprobe' appearing in the command line.
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
All 31 rules on the technique page →
T1078 Valid Accounts exploitation technique
- DET0560 Detection of Valid Account Abuse Across Platforms
AN1543 WindowsDetection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.Tunable:
LogonTypeTimeWindowGeoIPMismatchAN1544 LinuxDetection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.Tunable:UserContextHostDensityThresholdLoginMethodAN1545 macOSDetection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.Tunable:LoginOriginProcessTreeDepthAN1546 Identity ProviderDetection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.Tunable:MFAFailureCountRiskScoreThresholdIPGeoVelocityAN1547 ContainersDetection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.Tunable:ServiceAccountScopeClusterIPWhitelist
Sigma rules tagged attack.t1078 (56)
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 128faeef-79dd-44ca-b43c-a9e236a60f49
Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.
Author: Josh Nickels, Marius Rothenbücher
· 2025-01-08 · logsource: product=m365 service=audit · 13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 1a41023f-1e70-4026-921a-4d9341a9038e
Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-01 · logsource: product=azure service=signinlogs · 248649b7-d64f-46f0-9fb2-a52774166fb5
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Author: Austin Songer
· 2021-09-06 (modified 2022-06-08) · logsource: product=azure service=auditlogs · 352a54e1-74ba-4929-9d47-8193d67aba1e
Identifies when an user or application modified the federation settings on the domain.
Author: jamesc-grafana
· 2024-07-11 · logsource: product=aws service=cloudtrail · 352a918a-34d8-4882-8470-44830c507aa3
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
Author: elhoim
· 2022-09-09 (modified 2023-01-04) · logsource: product=windows service=security · 39698b3f-da92-4bc6-bfb5-645a98386e45
Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool
Author: Florian Roth (Nextron Systems)
· 2017-03-17 (modified 2023-12-15) · logsource: product=windows service=security · 3ff152b2-1388-4984-9cd9-a323323fdadf
Detects interactive console logons to Server Systems
Author: MikeDuddington, '@dudders1'
· 2022-07-28 (modified 2026-05-09) · logsource: product=azure service=auditlogs · 4ad97bf5-a514-41a4-abd3-4f3455ad4865
Detects guest users being invited to tenant by non-approved inviters
Author: Tim Brown
· 2023-01-09 · logsource: product=cisco service=ldp · 50e606bf-04ce-4ca7-9d54-3449494bbd4b
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36
Detects instances where a Telnet service on an OpenCanary node has had a login attempt.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-01 · logsource: product=azure service=signinlogs · 55695bc0-c8cf-461f-a379-2535f563c854
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.
The application then uses those credentials to authenticate the user against the identity provider.
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=cisco service=bgp · 56fa3cd6-f8d6-4520-a8c7-607292971886
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Author: Harjot Singh, '@cyb3rjy0t'
· 2023-01-10 (modified 2025-07-02) · logsource: product=azure service=signinlogs · 572b12d4-9062-11ed-a1eb-0242ac120002
Detects risky authentication from a non AD registered device without MFA being required.
All 56 rules on the technique page →
T1136 Create Account secondary impact
- DET0583 Detection Strategy for T1136 - Create Account across platforms
AN1604 WindowsAdversary uses built-in OS tools or API calls to create local or domain accounts for persistence or lateral movement. Tools such as 'net user', PowerShell, or MMC snap-ins may be used. Detection focuses on Event ID 4720 paired with process lineage and user context.Tunable:
TimeWindowParentProcessNameUserContextAN1605 LinuxAdversary invokes 'useradd', 'adduser', or equivalent system commands or scripts to create local users. Detection focuses on command execution and audit trail of passwd/shadow file modifications.Tunable:BinaryPathExecutionTimeAN1606 macOSAdversary creates new users using 'dscl' commands, GUI tools, or by modifying user plist files. Detection includes monitoring dscl invocation and user-related plist changes.Tunable:UsernamePatternExecutionSourceAN1607 Identity ProviderAdversary creates users via IAM/IdP API or portal (e.g., Azure AD, Okta). Detection involves monitoring API calls, admin action logs, and correlation with role assignments.Tunable:AdminThresholdAutomationExemptionsAN1608 IaaSAccount creation via cloud service APIs or CLI, often associated with key generation. Monitored via CloudTrail or equivalent audit logs.Tunable:RegionServiceScope
Sigma rules tagged attack.t1136 (3)
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 4ae68615-866f-4304-b24b-ba048dfa5ca7
Detects when an ElastiCache security group has been created.
Author: Cedric Maurugeon
· 2023-08-22 · logsource: product=linux category=process_creation · b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
Detects user account creation on ESXi system via esxcli
Author: Leo Tsaousis (@laripping)
· 2024-03-26 · logsource: product=kubernetes category=application service=audit · e31bae15-83ed-473e-bf31-faf4f8a17d36
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.
T1486 Data Encrypted for Impact secondary impact
- DET0215 Detection of Multi-Platform File Encryption for Impact
AN0602 WindowsHigh-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.Tunable:
FileExtensionTargetFolderTimeWindowCommandLineAN0603 LinuxEncryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.Tunable:FilenamePatternSyscallBurstRateDirectoryTargetedAN0604 macOSUserland or kernel-level ransomware encrypting user files (Documents, Desktop) usingsrm,gpg, or compiled payloads. Often correlated with ransom note creation in multiple directories.macos:unifiedlogfile encrypted|new file with .encrypted extension|disk write burst→ DC0061 File ModificationTunable:ExtensionPatternVolumeTargetedAN0605 ESXiRansomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run throughdcui, SSH, or vSphere.Tunable:FileTypeUserContextAN0606 IaaSEncryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.Tunable:SSEHeaderAffectedBucketUserAgent
Sigma rules tagged attack.t1486 (16)
Author: frack113
· 2021-11-15 (modified 2022-09-09) · logsource: product=windows category=process_creation · 0e0255bf-2548-47b8-9582-c0955c9283f5
Detects suspicious addition to BitLocker related registry keys via the reg.exe utility
Author: toopricey
· 2025-10-18 · logsource: product=aws service=cloudtrail · 1279262f-1464-422f-ac0d-5b545320c526
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
Author: Sittikorn S
· 2021-06-29 (modified 2021-08-20) · logsource: product=aws service=cloudtrail · 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Author: Saiprashanth Pulisetti ( @Prashanthblogs)
· 2025-08-08 · logsource: product=windows category=file_event · 2c76a22b-702d-48fd-8fa9-e41e2fe203b3
Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.
Author: Luc Génaux
· 2023-11-28 (modified 2026-07-28) · logsource: product=windows category=image_load · 3669afd2-9891-4534-a626-e5cf03810a61
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
· 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079
Detects WannaCry ransomware activity
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2022-05-12 (modified 2026-06-15) · logsource: category=antivirus · 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: frack113
· 2021-10-12 (modified 2023-02-13) · logsource: product=windows category=process_creation · 689308fc-cfba-4f72-9897-796c1dc61487
Detects a specific command used by the Conti ransomware group
Author: Vasiliy Burov, oscd.community
· 2020-10-18 (modified 2023-02-03) · logsource: product=windows category=process_creation · 74db3488-fd28-480a-95aa-b7af626de068
Detects LockerGoga ransomware activity via specific command line.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2023-08-06 (modified 2023-11-10) · logsource: product=windows category=process_creation · 77df53a5-1d78-4f32-bc5a-0e7465bd8f41
Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.
Author: Luc Génaux
· 2023-11-28 · logsource: product=windows category=image_load · b48492dc-c5ef-4572-8dff-32bc241c15c8
Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Author: austinsonger
· 2021-08-19 (modified 2022-10-09) · logsource: product=m365 service=threat_management · bd132164-884a-48f1-aa2d-c6d646b04c69
Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.
Author: frack113
· 2021-12-26 (modified 2026-01-09) · logsource: product=windows category=file_event · caf02a0a-1e1c-4552-9b48-5e070bd88d11
Detects creation of .txt files in user desktop folders via cmd.exe. This behavior may indicate ransomware deploying ransom notes, but can also occur during legitimate administrative tasks.
Analysts should investigate for suspicious filenames (e.g., "RANSOM", "DECRYPT", "READ_ME"), bulk file creation patterns, or concurrent encryption activity to determine if this is part of a ransomware attack.
Author: frack113
· 2022-07-16 (modified 2023-11-11) · logsource: product=windows category=file_rename · e3f673b3-65d1-4d80-9146-466f8b63fa99
Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2023-08-09 · logsource: product=windows category=process_creation · ec0722a3-eb5c-4a56-8ab2-bf6f20708592
Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.