1200KM / tag
attack.privilege-escalation — sigma-tag tag
622 related reference pages for sigma-tag: attack.privilege-escalation.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- A Member Was Added to a Security-Enabled Global Group · sigma-rule
- A Member Was Removed From a Security-Enabled Global Group · sigma-rule
- A New Trust Was Created To A Domain · sigma-rule
- A Security-Enabled Global Group Was Deleted · sigma-rule
- Abuse of Service Permissions to Hide Services Via Set-Service · sigma-rule
- Abuse of Service Permissions to Hide Services Via Set-Service - PS · sigma-rule
- Abused Debug Privilege by Arbitrary Parent Processes · sigma-rule
- Account Created And Deleted Within A Close Time Frame · sigma-rule
- Account Disabled or Blocked for Sign in Attempts · sigma-rule
- Account Tampering - Suspicious Failed Logon Reasons · sigma-rule
- Active Directory User Backdoors · sigma-rule
- Activity From Anonymous IP Address · sigma-rule
- Add Port Monitor Persistence in Registry · sigma-rule
- Added Credentials to Existing Application · sigma-rule
- Addition of SID History to Active Directory Object · sigma-rule
- Admin User Remote Logon · sigma-rule
- Allow Service Access Using Security Descriptor Tampering Via Sc.EXE · sigma-rule
- Always Install Elevated MSI Spawned Cmd And Powershell · sigma-rule
- Always Install Elevated Windows Installer · sigma-rule
- Anomalous User Activity · sigma-rule
- App Assigned To Azure RBAC/Microsoft Entra Role · sigma-rule
- App Granted Privileged Delegated Or App Permissions · sigma-rule
- Application AppID Uri Configuration Changes · sigma-rule
- Application URI Configuration Changes · sigma-rule
- Application Using Device Code Authentication Flow · sigma-rule
- Applications That Are Using ROPC Authentication Flow · sigma-rule
- Aruba Network Service Potential DLL Sideloading · sigma-rule
- ASLR Disabled Via Sysctl or Direct Syscall - Linux · sigma-rule
- Atbroker Registry Change · sigma-rule
- Attempts of Kerberos Coercion Via DNS SPN Spoofing · sigma-rule
- Atypical Travel · sigma-rule
- Audit CVE Event · sigma-rule
- Authentications To Important Apps Using Single Factor Authentication · sigma-rule
- AWS IAM Backdoor Users Keys · sigma-rule
- AWS IAM S3Browser LoginProfile Creation · sigma-rule
- AWS IAM S3Browser Templated S3 Bucket Policy Creation · sigma-rule
- AWS IAM S3Browser User or AccessKey Creation · sigma-rule
- AWS Key Pair Import Activity · sigma-rule
- AWS Root Credentials · sigma-rule
- AWS Route 53 Domain Transfer Lock Disabled · sigma-rule
- AWS Route 53 Domain Transferred to Another Account · sigma-rule
- AWS SAML Provider Deletion Activity · sigma-rule
- AWS STS AssumeRole Misuse · sigma-rule
- AWS STS GetSessionToken Misuse · sigma-rule
- AWS Successful Console Login Without MFA · sigma-rule
- AWS Suspicious SAML Activity · sigma-rule
- AWS User Login Profile Was Modified · sigma-rule
- Azure AD Only Single Factor Authentication Required · sigma-rule
- Azure AD Threat Intelligence · sigma-rule
- Azure Domain Federation Settings Modified · sigma-rule
- Azure Kubernetes Admission Controller · sigma-rule
- Azure Kubernetes CronJob · sigma-rule
- Azure Login Bypassing Conditional Access Policies · sigma-rule
- Azure Subscription Permission Elevation Via ActivityLogs · sigma-rule
- Azure Subscription Permission Elevation Via AuditLogs · sigma-rule
- Azure Unusual Authentication Interruption · sigma-rule
- Bitbucket Global Permission Changed · sigma-rule
- Bitbucket User Login Failure · sigma-rule
- Bitlocker Key Retrieval · sigma-rule
- Buffer Overflow Attempts · sigma-rule
- Bulk Deletion Changes To Privileged Account Permissions · sigma-rule
- Bypass UAC Using DelegateExecute · sigma-rule
- Bypass UAC Using Event Viewer · sigma-rule
- Bypass UAC Using SilentCleanup Task · sigma-rule
- Bypass UAC via CMSTP · sigma-rule
- Bypass UAC via Fodhelper.exe · sigma-rule
- Bypass UAC via WSReset.exe · sigma-rule
- CA Policy Removed by Non Approved Actor · sigma-rule
- CA Policy Updated by Non Approved Actor · sigma-rule
- Certificate-Based Authentication Enabled · sigma-rule
- Change Default File Association To Executable Via Assoc · sigma-rule
- Change Default File Association Via Assoc · sigma-rule
- Change to Authentication Method · sigma-rule
- Changes to Device Registration Policy · sigma-rule
- Changes To PIM Settings · sigma-rule
- Changing Existing Service ImagePath Value Via Reg.EXE · sigma-rule
- Cisco BGP Authentication Failures · sigma-rule
- Cisco LDP Authentication Failures · sigma-rule
- Cisco Local Accounts · sigma-rule
- Cisco Modify Configuration · sigma-rule
- Classes Autorun Keys Modification · sigma-rule
- CMSTP UAC Bypass via COM Object Access · sigma-rule
- CobaltStrike Named Pipe · sigma-rule
- CobaltStrike Named Pipe Pattern Regex · sigma-rule
- CobaltStrike Named Pipe Patterns · sigma-rule
- CobaltStrike Service Installations - Security · sigma-rule
- CobaltStrike Service Installations - System · sigma-rule
- Code Injection by ld.so Preload · sigma-rule
- CodeIntegrity - Blocked Driver Load With Revoked Certificate · sigma-rule
- CodeIntegrity - Blocked Image/Driver Load For Policy Violation · sigma-rule
- COM Hijack via Sdclt · sigma-rule
- COM Hijacking via TreatAs · sigma-rule
- COM Object Hijacking Via Modification Of Default System CLSID Default Value · sigma-rule
- Common Autorun Keys Modification · sigma-rule
- Container With A hostPath Mount Created · sigma-rule
- Control Panel Items · sigma-rule
- Created Files by Microsoft Sync Center · sigma-rule
- Creation Exe for Service with Unquoted Path · sigma-rule
- Creation Of Non-Existent System DLL · sigma-rule
- Creation of WerFault.exe/Wer.dll in Unusual Folder · sigma-rule
- Credential Dumping Attempt Via Svchost · sigma-rule
- CurrentControlSet Autorun Keys Modification · sigma-rule
- CurrentVersion Autorun Keys Modification · sigma-rule
- CurrentVersion NT Autorun Keys Modification · sigma-rule
- Default RDP Port Changed to Non Standard Port · sigma-rule
- Deny Service Access Using Security Descriptor Tampering Via Sc.EXE · sigma-rule
- Desktop.INI Created by Uncommon Process · sigma-rule
- Devcon Execution Disabling VMware VMCI Device · sigma-rule
- Device Registration or Join Without MFA · sigma-rule
- DHCP Callout DLL Installation · sigma-rule
- DHCP Server Error Failed Loading the CallOut DLL · sigma-rule
- DHCP Server Loaded the CallOut DLL · sigma-rule
- Direct Autorun Keys Modification · sigma-rule
- DLL Execution Via Register-cimprovider.exe · sigma-rule
- DLL Load via LSASS · sigma-rule
- DLL Search Order Hijackig Via Additional Space in Path · sigma-rule
- DLL Sideloading by VMware Xfer Utility · sigma-rule
- DLL Sideloading Of ShellChromeAPI.DLL · sigma-rule
- Dllhost.EXE Execution Anomaly · sigma-rule
- DMSA Link Attributes Modified · sigma-rule
- DMSA Service Account Created in Specific OUs - PowerShell · sigma-rule
- DNS Server Error Failed Loading the ServerLevelPluginDLL · sigma-rule
- DotNet CLR DLL Loaded By Scripting Applications · sigma-rule
- Driver Load From A Temporary Directory · sigma-rule
- Elevated System Shell Spawned From Uncommon Parent Location · sigma-rule
- Enabled User Right in AD to Control User Objects · sigma-rule
- Enabling COR Profiler Environment Variables · sigma-rule
- ESXi Admin Permission Assigned To Account Via ESXCLI · sigma-rule
- Explorer NOUACCHECK Flag · sigma-rule
- External Remote RDP Logon from Public IP · sigma-rule
- External Remote SMB Logon from Public IP · sigma-rule
- Failed Authentications From Countries You Do Not Operate Out Of · sigma-rule
- Failed Logon From Public IP · sigma-rule
- Fax Service DLL Search Order Hijack · sigma-rule
- File Creation In Suspicious Directory By Msdt.EXE · sigma-rule
- Function Call From Undocumented COM Interface EditionUpgradeManager · sigma-rule
- GCP Access Policy Deleted · sigma-rule
- GCP Break-glass Container Workload Deployed · sigma-rule
- Github New Secret Created · sigma-rule
- Github Outside Collaborator Detected · sigma-rule
- Github Self Hosted Runner Changes Detected · sigma-rule
- Github SSH Certificate Configuration Changed · sigma-rule
- Google Cloud Kubernetes Admission Controller · sigma-rule
- Google Workspace Application Access Level Modified · sigma-rule
- Google Workspace Government Attack Warning · sigma-rule
- Google Workspace Granted Domain API Access · sigma-rule
- Google Workspace User Granted Admin Privileges · sigma-rule
- Granting Of Permissions To An Account · sigma-rule
- Group Policy Abuse for Privilege Addition · sigma-rule
- Guest Account Enabled Via Sysadminctl · sigma-rule
- Guest User Invited By Non Approved Inviters · sigma-rule
- Guest Users Invited To Tenant By Non Approved Inviters · sigma-rule
- HackTool - CACTUSTORCH Remote Thread Creation · sigma-rule
- HackTool - CoercedPotato Execution · sigma-rule
- HackTool - CoercedPotato Named Pipe Creation · sigma-rule
- HackTool - CrackMapExec Execution · sigma-rule
- HackTool - CrackMapExec Execution Patterns · sigma-rule
- HackTool - Default PowerSploit/Empire Scheduled Task Creation · sigma-rule
- HackTool - DInjector PowerShell Cradle Execution · sigma-rule
- HackTool - EfsPotato Named Pipe Creation · sigma-rule
- HackTool - Empire PowerShell UAC Bypass · sigma-rule
- HackTool - HollowReaper Execution · sigma-rule
- HackTool - Impersonate Execution · sigma-rule
- HackTool - Koh Default Named Pipe · sigma-rule
- HackTool - LittleCorporal Generated Maldoc Injection · sigma-rule
- HackTool - NoFilter Execution · sigma-rule
- HackTool - Potential CobaltStrike Process Injection · sigma-rule
- HackTool - Powerup Write Hijack DLL · sigma-rule
- HackTool - PPID Spoofing SelectMyParent Tool Execution · sigma-rule
- HackTool - SharpDPAPI Execution · sigma-rule
- HackTool - SharPersist Execution · sigma-rule
- HackTool - SharpImpersonation Execution · sigma-rule
- HackTool - SharpUp PrivEsc Tool Execution · sigma-rule
- HackTool - SysmonEOP Execution · sigma-rule
- HackTool - UACMe Akagi Execution · sigma-rule
- HackTool - winPEAS Execution · sigma-rule
- HackTool - WinPwn Execution · sigma-rule
- HackTool - WinPwn Execution - ScriptBlock · sigma-rule
- HKTL - SharpSuccessor Privilege Escalation Tool Execution · sigma-rule
- Huawei BGP Authentication Failures · sigma-rule
- Important Scheduled Task Deleted/Disabled · sigma-rule
- Impossible Travel · sigma-rule
- Increased Failed Authentications Of Any Type · sigma-rule
- Interactive AT Job · sigma-rule
- Internet Explorer Autorun Keys Modification · sigma-rule
- Invalid PIM License · sigma-rule
- ISATAP Router Address Was Set · sigma-rule
- Juniper BGP Missing MD5 · sigma-rule
- KrbRelayUp Service Installation · sigma-rule
- Kubernetes Admission Controller Modification · sigma-rule
- Launch Agent/Daemon Execution Via Launchctl · sigma-rule
- Linux Capabilities Discovery · sigma-rule
- Linux Doas Conf File Creation · sigma-rule
- Linux Doas Tool Execution · sigma-rule
- Linux Setgid Capability Set on a Binary via Setcap Utility · sigma-rule
- Linux Setuid Capability Set on a Binary via Setcap Utility · sigma-rule
- Linux Sudo Chroot Execution · sigma-rule
- Loading of Kernel Module via Insmod · sigma-rule
- Login to Disabled Account · sigma-rule
- Logon from a Risky IP Address · sigma-rule
- MacOS Emond Launch Daemon · sigma-rule
- Malicious DLL File Dropped in the Teams or OneDrive Folder · sigma-rule
- Malicious Driver Load · sigma-rule
- Malicious Driver Load By Name · sigma-rule
- Malicious Named Pipe Created · sigma-rule
- Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure · sigma-rule
- ManageEngine Endpoint Central Dctask64.EXE Potential Abuse · sigma-rule
- Mavinject Inject DLL Into Running Process · sigma-rule
- Measurable Increase Of Successful Authentications · sigma-rule
- Meterpreter or Cobalt Strike Getsystem Service Installation - Security · sigma-rule
- Meterpreter or Cobalt Strike Getsystem Service Installation - System · sigma-rule
- Microsoft 365 - Impossible Travel Activity · sigma-rule
- Microsoft Defender Blocked from Loading Unsigned DLL · sigma-rule
- Microsoft Office DLL Sideload · sigma-rule
- Microsoft Sync Center Suspicious Network Connections · sigma-rule
- MITRE BZAR Indicators for Execution · sigma-rule
- MITRE BZAR Indicators for Persistence · sigma-rule
- Modification of ld.so.preload · sigma-rule
- Modify Group Policy Settings · sigma-rule
- Modify Group Policy Settings - ScriptBlockLogging · sigma-rule
- Modify User Shell Folders Startup Value · sigma-rule
- Modifying Crontab · sigma-rule
- Moriya Rootkit - System · sigma-rule
- Multifactor Authentication Denied · sigma-rule
- Multifactor Authentication Interrupted · sigma-rule
- Narrator's Feedback-Hub Persistence · sigma-rule
- Network Connection Initiated Via Notepad.EXE · sigma-rule
- New CA Policy by Non-approved Actor · sigma-rule
- New Country · sigma-rule
- New Cron File Created · sigma-rule
- New Custom Shim Database Created · sigma-rule
- New DLL Added to AppCertDlls Registry Key · sigma-rule
- New DLL Added to AppInit_DLLs Registry Key · sigma-rule
- New DMSA Service Account Created in Specific OUs · sigma-rule
- New DNS ServerLevelPluginDll Installed · sigma-rule
- New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE · sigma-rule
- New Federated Domain Added · sigma-rule
- New Kernel Driver Via SC.EXE · sigma-rule
- New Netsh Helper DLL Registered From A Suspicious Location · sigma-rule
- New Outlook Macro Created · sigma-rule
- New PDQDeploy Service - Client Side · sigma-rule
- New PDQDeploy Service - Server Side · sigma-rule
- New Root Certificate Authority Added · sigma-rule
- New RUN Key Pointing to Suspicious Folder · sigma-rule
- New Service Creation Using PowerShell · sigma-rule
- New Service Creation Using Sc.EXE · sigma-rule
- New TimeProviders Registered With Uncommon DLL Name · sigma-rule
- NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE · sigma-rule
- Number Of Resource Creation Or Deployment Activities · sigma-rule
- Office Autorun Keys Modification · sigma-rule
- Okta Admin Role Assigned to an User or Group · sigma-rule
- Okta Identity Provider Created · sigma-rule
- Okta New Admin Console Behaviours · sigma-rule
- OMIGOD SCX RunAsProvider ExecuteScript · sigma-rule
- OMIGOD SCX RunAsProvider ExecuteShellCommand · sigma-rule
- OpenCanary - SSH Login Attempt · sigma-rule
- OpenCanary - SSH New Connection Attempt · sigma-rule
- OpenCanary - Telnet Login Attempt · sigma-rule
- Outlook Macro Execution Without Warning Setting Enabled · sigma-rule
- Password Change on Directory Service Restore Mode (DSRM) Account · sigma-rule
- Password Provided In Command Line Of Net.EXE · sigma-rule
- Password Reset By User Account · sigma-rule
- Password Set to Never Expire via WMI · sigma-rule
- Path To Screensaver Binary Modified · sigma-rule
- Persistence and Execution at Scale via GPO Scheduled Task · sigma-rule
- Persistence Via Sticky Key Backdoor · sigma-rule
- Persistence Via Sudoers.d Files · sigma-rule
- PIM Alert Setting Changes To Disabled · sigma-rule
- PIM Approvals And Deny Elevation · sigma-rule
- Possible Coin Miner CPU Priority Param · sigma-rule
- Possible Privilege Escalation via Weak Service Permissions · sigma-rule
- Potential 7za.DLL Sideloading · sigma-rule
- Potential Access Token Abuse · sigma-rule
- Potential Antivirus Software DLL Sideloading · sigma-rule
- Potential appverifUI.DLL Sideloading · sigma-rule
- Potential AVKkid.DLL Sideloading · sigma-rule
- Potential Azure Browser SSO Abuse · sigma-rule
- Potential CCleanerDU.DLL Sideloading · sigma-rule
- Potential CCleanerReactivator.DLL Sideloading · sigma-rule
- Potential Chrome Frame Helper DLL Sideloading · sigma-rule
- Potential CobaltStrike Service Installations - Registry · sigma-rule
- Potential COM Object Hijacking Via TreatAs Subkey - Registry · sigma-rule
- Potential DLL Injection Or Execution Using Tracker.exe · sigma-rule
- Potential DLL Sideloading Of DBGCORE.DLL · sigma-rule
- Potential DLL Sideloading Of DBGHELP.DLL · sigma-rule
- Potential DLL Sideloading Of DbgModel.DLL · sigma-rule
- Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE · sigma-rule
- Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE · sigma-rule
- Potential DLL Sideloading Of MpSvc.DLL · sigma-rule
- Potential DLL Sideloading Of MsCorSvc.DLL · sigma-rule
- Potential DLL Sideloading Of Non-Existent DLLs From System Folders · sigma-rule
- Potential DLL Sideloading Using Coregen.exe · sigma-rule
- Potential DLL Sideloading Via ClassicExplorer32.dll · sigma-rule
- Potential DLL Sideloading Via comctl32.dll · sigma-rule
- Potential DLL Sideloading Via DeviceEnroller.EXE · sigma-rule
- Potential DLL Sideloading Via JsSchHlp · sigma-rule
- Potential DLL Sideloading Via VMware Xfer · sigma-rule
- Potential EACore.DLL Sideloading · sigma-rule
- Potential Edputil.DLL Sideloading · sigma-rule
- Potential Goopdate.DLL Sideloading · sigma-rule
- Potential Initial Access via DLL Search Order Hijacking · sigma-rule
- Potential Iviewers.DLL Sideloading · sigma-rule
- Potential JLI.dll Side-Loading · sigma-rule
- Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation · sigma-rule
- Potential Libvlc.DLL Sideloading · sigma-rule
- Potential Linux Process Code Injection Via DD Utility · sigma-rule
- Potential Malicious Usage of CloudTrail System Manager · sigma-rule
- Potential Meterpreter/CobaltStrike Activity · sigma-rule
- Potential MFA Bypass Using Legacy Client Authentication · sigma-rule
- Potential Mfdetours.DLL Sideloading · sigma-rule
- Potential Mpclient.DLL Sideloading · sigma-rule
- Potential Mpclient.DLL Sideloading Via Defender Binaries · sigma-rule
- Potential Persistence Attempt Via Existing Service Tampering · sigma-rule
- Potential Persistence Attempt Via Run Keys Using Reg.EXE · sigma-rule
- Potential Persistence Using DebugPath · sigma-rule
- Potential Persistence Via App Paths Default Property · sigma-rule
- Potential Persistence Via AppCompat RegisterAppRestart Layer · sigma-rule
- Potential Persistence Via GlobalFlags · sigma-rule
- Potential Persistence Via Logon Scripts - CommandLine · sigma-rule
- Potential Persistence Via Logon Scripts - Registry · sigma-rule
- Potential Persistence Via Microsoft Compatibility Appraiser · sigma-rule
- Potential Persistence Via Netsh Helper DLL · sigma-rule
- Potential Persistence Via Netsh Helper DLL - Registry · sigma-rule
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting · sigma-rule
- Potential Persistence Via PlistBuddy · sigma-rule
- Potential Persistence Via Powershell Search Order Hijacking - Task · sigma-rule
- Potential Persistence Via PowerShell User Profile Using Add-Content · sigma-rule
- Potential Persistence Via Scrobj.dll COM Hijacking · sigma-rule
- Potential Persistence Via Shim Database In Uncommon Location · sigma-rule
- Potential Persistence Via Shim Database Modification · sigma-rule
- Potential Privilege Escalation Using Symlink Between Osk and Cmd · sigma-rule
- Potential Privilege Escalation via Local Kerberos Relay over LDAP · sigma-rule
- Potential Privilege Escalation via Service Permissions Weakness · sigma-rule
- Potential Process Hollowing Activity · sigma-rule
- Potential Process Injection Via Msra.EXE · sigma-rule
- Potential PSFactoryBuffer COM Hijacking · sigma-rule
- Potential Python DLL SideLoading · sigma-rule
- Potential Rcdll.DLL Sideloading · sigma-rule
- Potential Registry Persistence Attempt Via DbgManagedDebugger · sigma-rule
- Potential Registry Persistence Attempt Via Windows Telemetry · sigma-rule
- Potential RipZip Attack on Startup Folder · sigma-rule
- Potential RjvPlatform.DLL Sideloading From Default Location · sigma-rule
- Potential RjvPlatform.DLL Sideloading From Non-Default Location · sigma-rule
- Potential RoboForm.DLL Sideloading · sigma-rule
- Potential ShellDispatch.DLL Sideloading · sigma-rule
- Potential Shim Database Persistence via Sdbinst.EXE · sigma-rule
- Potential SmadHook.DLL Sideloading · sigma-rule
- Potential SolidPDFCreator.DLL Sideloading · sigma-rule
- Potential SSH Tunnel Persistence Install Using A Scheduled Task · sigma-rule
- Potential Startup Shortcut Persistence Via PowerShell.EXE · sigma-rule
- Potential Suspicious Activity Using SeCEdit · sigma-rule
- Potential System DLL Sideloading From Non System Locations · sigma-rule
- Potential UAC Bypass Via Sdclt.EXE · sigma-rule
- Potential Vcruntime140 DLL Sideloading · sigma-rule
- Potential Vivaldi_elf.DLL Sideloading · sigma-rule
- Potential Waveedit.DLL Sideloading · sigma-rule
- Potential Wazuh Security Platform DLL Sideloading · sigma-rule
- Potential WWlib.DLL Sideloading · sigma-rule
- Potentially Suspicious Child Process of KeyScrambler.exe · sigma-rule
- Potentially Suspicious Event Viewer Child Process · sigma-rule
- Powershell Create Scheduled Task · sigma-rule
- Powershell LocalAccount Manipulation · sigma-rule
- PowerShell Profile Modification · sigma-rule
- PowerShell ShellCode · sigma-rule
- PowerShell Web Access Feature Enabled Via DISM · sigma-rule
- Powershell WMI Persistence · sigma-rule
- Powerview Add-DomainObjectAcl DCSync AD Extend Right · sigma-rule
- Privileged Account Creation · sigma-rule
- Privileged Container Deployed · sigma-rule
- Privileged User Has Been Created · sigma-rule
- Process Creation Using Sysnative Folder · sigma-rule
- Process Explorer Driver Creation By Non-Sysinternals Binary · sigma-rule
- Process Monitor Driver Creation By Non-Sysinternals Binary · sigma-rule
- ProcessHacker Privilege Elevation · sigma-rule
- PSEXEC Remote Execution File Artefact · sigma-rule
- PUA - AdvancedRun Execution · sigma-rule
- PUA - AdvancedRun Suspicious Execution · sigma-rule
- PUA - Kernel Driver Utility (KDU) Execution · sigma-rule
- PUA - Process Hacker Driver Load · sigma-rule
- PUA - Process Hacker Execution · sigma-rule
- PUA - System Informer Driver Load · sigma-rule
- PUA - System Informer Execution · sigma-rule
- PUA - Wsudo Suspicious Execution · sigma-rule
- Rare Remote Thread Creation By Uncommon Source Image · sigma-rule
- Regedit as Trusted Installer · sigma-rule
- Register new Logon Process by Rubeus · sigma-rule
- Registry Modification for OCI DLL Redirection · sigma-rule
- Registry Modification of MS-settings Protocol Handler · sigma-rule
- Registry Persistence Mechanisms in Recycle Bin · sigma-rule
- Registry Persistence via Explorer Run Key · sigma-rule
- Registry-Free Process Scope COR_PROFILER · sigma-rule
- Regsvr32 DLL Execution With Uncommon Extension · sigma-rule
- Remote Access Tool Services Have Been Installed - Security · sigma-rule
- Remote Access Tool Services Have Been Installed - System · sigma-rule
- Remote Schedule Task Lateral Movement via ATSvc · sigma-rule
- Remote Schedule Task Lateral Movement via ITaskSchedulerService · sigma-rule
- Remote Schedule Task Lateral Movement via SASec · sigma-rule
- Remote Task Creation via ATSVC Named Pipe · sigma-rule
- Remote Task Creation via ATSVC Named Pipe - Zeek · sigma-rule
- Remote Thread Creation By Uncommon Source Image · sigma-rule
- Remote Thread Creation In Uncommon Target Image · sigma-rule
- Renamed Mavinject.EXE Execution · sigma-rule
- Renamed Schtasks Execution · sigma-rule
- Renamed Vmnat.exe Execution · sigma-rule
- Renamed ZOHO Dctask64 Execution · sigma-rule
- Roles Activated Too Frequently · sigma-rule
- Roles Activation Doesn't Require MFA · sigma-rule
- Roles Are Not Being Used · sigma-rule
- Roles Assigned Outside PIM · sigma-rule
- Root Account Enable Via Dsenableroot · sigma-rule
- RottenPotato Like Attack Pattern · sigma-rule
- Rundll32 Registered COM Objects · sigma-rule
- Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE · sigma-rule
- Scheduled Cron Task/Job - Linux · sigma-rule
- Scheduled Cron Task/Job - MacOs · sigma-rule
- Scheduled Task Creation Masquerading as System Processes · sigma-rule
- Scheduled Task Creation Via Schtasks.EXE · sigma-rule
- Scheduled Task Creation with Curl and PowerShell Execution Combo · sigma-rule
- Scheduled Task Executed From A Suspicious Location · sigma-rule
- Scheduled Task Executed Uncommon LOLBIN · sigma-rule
- Scheduled Task Executing Encoded Payload from Registry · sigma-rule
- Scheduled Task Executing Payload from Registry · sigma-rule
- Scheduled Task/Job At · sigma-rule
- Scheduled TaskCache Change by Uncommon Program · sigma-rule
- Schtasks Creation Or Modification With SYSTEM Privileges · sigma-rule
- Schtasks From Suspicious Folders · sigma-rule
- SCM Database Privileged Operation · sigma-rule
- Sdclt Child Processes · sigma-rule
- Security Privileges Enumeration Via Whoami.EXE · sigma-rule
- Security Support Provider (SSP) Added to LSA Configuration · sigma-rule
- Service DACL Abuse To Hide Services Via Sc.EXE · sigma-rule
- Service Installation in Suspicious Folder · sigma-rule
- Service Installation with Suspicious Folder Pattern · sigma-rule
- Service Installed By Unusual Client - Security · sigma-rule
- Service Installed By Unusual Client - System · sigma-rule
- Service Registry Key Read Access Request · sigma-rule
- Service Registry Permissions Weakness Check · sigma-rule
- Service Reload or Start - Linux · sigma-rule
- Service Security Descriptor Tampering Via Sc.EXE · sigma-rule
- ServiceDll Hijack · sigma-rule
- Session Manager Autorun Keys Modification · sigma-rule
- Setuid and Setgid · sigma-rule
- Setup16.EXE Execution With Custom .Lst File · sigma-rule
- Shell Open Registry Keys Manipulation · sigma-rule
- Sign-in Failure Due to Conditional Access Requirements Not Met · sigma-rule
- Sign-ins by Unknown Devices · sigma-rule
- Sign-ins from Non-Compliant Devices · sigma-rule
- Sliver C2 Default Service Installation · sigma-rule
- Special File Creation via Mknod Syscall · sigma-rule
- Stale Accounts In A Privileged Role · sigma-rule
- Startup Folder File Write · sigma-rule
- Startup Item File Created - MacOS · sigma-rule
- Startup/Logon Script Added to Group Policy Object · sigma-rule
- Sticky Key Like Backdoor Execution · sigma-rule
- Sticky Key Like Backdoor Usage - Registry · sigma-rule
- Successful Authentications From Countries You Do Not Operate Out Of · sigma-rule
- Suspect Svchost Activity · sigma-rule
- Suspicious Autorun Registry Modified via WMI · sigma-rule
- Suspicious Browser Activity · sigma-rule
- Suspicious Child Process Created as System · sigma-rule
- Suspicious Child Process Of SQL Server · sigma-rule
- Suspicious Child Process Of Wermgr.EXE · sigma-rule
- Suspicious Command Patterns In Scheduled Task Creation · sigma-rule
- Suspicious Computer Machine Password by PowerShell · sigma-rule
- Suspicious Debugger Registration Cmdline · sigma-rule
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing · sigma-rule
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network · sigma-rule
- Suspicious Driver Install by pnputil.exe · sigma-rule
- Suspicious Encoded Scripts in a WMI Consumer · sigma-rule
- Suspicious Get-Variable.exe Creation · sigma-rule
- Suspicious GetTypeFromCLSID ShellExecute · sigma-rule
- Suspicious GrpConv Execution · sigma-rule
- Suspicious GUP Usage · sigma-rule
- Suspicious Login Activity Classified By Google · sigma-rule
- Suspicious Modification Of Scheduled Tasks · sigma-rule
- Suspicious New Service Creation · sigma-rule
- Suspicious NTLM Authentication on the Printer Spooler Service · sigma-rule
- Suspicious Outlook Macro Created · sigma-rule
- Suspicious PowerShell In Registry Run Keys · sigma-rule
- Suspicious Printer Driver Empty Manufacturer · sigma-rule
- Suspicious Processes Spawned by WinRM · sigma-rule
- Suspicious Remote Logon with Explicit Credentials · sigma-rule
- Suspicious Run Key from Download · sigma-rule
- Suspicious Rundll32 Invoking Inline VBScript · sigma-rule
- Suspicious Scheduled Task Creation · sigma-rule
- Suspicious Scheduled Task Creation Involving Temp Folder · sigma-rule
- Suspicious Scheduled Task Creation via Masqueraded XML File · sigma-rule
- Suspicious Scheduled Task Name As GUID · sigma-rule
- Suspicious Scheduled Task Update · sigma-rule
- Suspicious Scheduled Task Write to System32 Tasks · sigma-rule
- Suspicious Schtasks Execution AppData Folder · sigma-rule
- Suspicious Schtasks Schedule Type With High Privileges · sigma-rule
- Suspicious Schtasks Schedule Types · sigma-rule
- Suspicious ScreenSave Change by Reg.exe · sigma-rule
- Suspicious Screensaver Binary File Creation · sigma-rule
- Suspicious Service DACL Modification Via Set-Service Cmdlet · sigma-rule
- Suspicious Service DACL Modification Via Set-Service Cmdlet - PS · sigma-rule
- Suspicious Service Installation · sigma-rule
- Suspicious Service Installation Script · sigma-rule
- Suspicious Service Path Modification · sigma-rule
- Suspicious Shell Open Command Registry Modification · sigma-rule
- Suspicious Shim Database Patching Activity · sigma-rule
- Suspicious SignIns From A Non Registered Device · sigma-rule
- Suspicious Spool Service Child Process · sigma-rule
- Suspicious SQL Query · sigma-rule
- Suspicious Startup Folder Persistence · sigma-rule
- Suspicious SYSTEM User Process Creation · sigma-rule
- Suspicious Unsigned Thor Scanner Execution · sigma-rule
- Suspicious Userinit Child Process · sigma-rule
- Sysinternals PsService Execution · sigma-rule
- Sysinternals PsSuspend Execution · sigma-rule
- System Control Panel Item Loaded From Uncommon Location · sigma-rule
- System Scripts Autorun Keys Modification · sigma-rule
- Systemd Service Creation · sigma-rule
- Tasks Folder Evasion · sigma-rule
- Temporary Access Pass Added To An Account · sigma-rule
- Third Party Software DLL Sideloading · sigma-rule
- Too Many Global Admins · sigma-rule
- Triple Cross eBPF Rootkit Default Persistence · sigma-rule
- Trusted Path Bypass via Windows Directory Spoofing · sigma-rule
- TrustedPath UAC Bypass Pattern · sigma-rule
- UAC Bypass Abusing Winsat Path Parsing - File · sigma-rule
- UAC Bypass Abusing Winsat Path Parsing - Process · sigma-rule
- UAC Bypass Abusing Winsat Path Parsing - Registry · sigma-rule
- UAC Bypass Tools Using ComputerDefaults · sigma-rule
- UAC Bypass Using .NET Code Profiler on MMC · sigma-rule
- UAC Bypass Using ChangePK and SLUI · sigma-rule
- UAC Bypass Using Consent and Comctl32 - File · sigma-rule
- UAC Bypass Using Consent and Comctl32 - Process · sigma-rule
- UAC Bypass Using Disk Cleanup · sigma-rule
- UAC Bypass Using DismHost · sigma-rule
- UAC Bypass Using IDiagnostic Profile · sigma-rule
- UAC Bypass Using IDiagnostic Profile - File · sigma-rule
- UAC Bypass Using IEInstal - File · sigma-rule
- UAC Bypass Using IEInstal - Process · sigma-rule
- UAC Bypass Using Iscsicpl - ImageLoad · sigma-rule
- UAC Bypass Using MSConfig Token Modification - File · sigma-rule
- UAC Bypass Using MSConfig Token Modification - Process · sigma-rule
- UAC Bypass Using NTFS Reparse Point - File · sigma-rule
- UAC Bypass Using NTFS Reparse Point - Process · sigma-rule
- UAC Bypass Using PkgMgr and DISM · sigma-rule
- UAC Bypass Using Windows Media Player - File · sigma-rule
- UAC Bypass Using Windows Media Player - Process · sigma-rule
- UAC Bypass Using Windows Media Player - Registry · sigma-rule
- UAC Bypass Using WOW64 Logger DLL Hijack · sigma-rule
- UAC Bypass via Event Viewer · sigma-rule
- UAC Bypass via ICMLuaUtil · sigma-rule
- UAC Bypass via Sdclt · sigma-rule
- UAC Bypass via Windows Firewall Snap-In Hijack · sigma-rule
- UAC Bypass Via Wsreset · sigma-rule
- UAC Bypass With Fake DLL · sigma-rule
- UAC Bypass WSReset · sigma-rule
- UAC Disabled · sigma-rule
- UAC Notification Disabled · sigma-rule
- UAC Secure Desktop Prompt Disabled · sigma-rule
- Uncommon Extension Shim Database Installation Via Sdbinst.EXE · sigma-rule
- Uncommon One Time Only Scheduled Task At 00:00 · sigma-rule
- Uncommon Process Access Rights For Target Image · sigma-rule
- Uncommon Service Installation Image Path · sigma-rule
- Uncommon Svchost Command Line Parameter · sigma-rule
- Uncommon Userinit Child Process · sigma-rule
- Unfamiliar Sign-In Properties · sigma-rule
- Unix Shell Configuration Modification · sigma-rule
- Unsigned .node File Loaded · sigma-rule
- Unsigned Binary Loaded From Suspicious Location · sigma-rule
- Unsigned Mfdetours.DLL Sideloading · sigma-rule
- Unsigned Module Loaded by ClickOnce Application · sigma-rule
- Use Of Hidden Paths Or Files · sigma-rule
- Use of Legacy Authentication Protocols · sigma-rule
- User Access Blocked by Azure Conditional Access · sigma-rule
- User Added To Admin Group Via Dscl · sigma-rule
- User Added To Admin Group Via DseditGroup · sigma-rule
- User Added To Admin Group Via Sysadminctl · sigma-rule
- User Added to an Administrator's Azure AD Role · sigma-rule
- User Added To Group With CA Policy Modification Access · sigma-rule
- User Added To Highly Privileged Group · sigma-rule
- User Added to Local Administrator Group · sigma-rule
- User Added to Local Administrators Group · sigma-rule
- User Added To Privilege Role · sigma-rule
- User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess' · sigma-rule
- User Removed From Group With CA Policy Modification Access · sigma-rule
- User Shell Folders Registry Modification via CommandLine · sigma-rule
- User State Changed From Guest To Member · sigma-rule
- Users Added to Global or Device Admin Roles · sigma-rule
- Users Authenticating To Other Azure AD Tenants · sigma-rule
- Using SettingSyncHost.exe as LOLBin · sigma-rule
- VBScript Payload Stored in Registry · sigma-rule
- VMGuestLib DLL Sideload · sigma-rule
- VMMap Signed Dbghelp.DLL Potential Sideloading · sigma-rule
- VMMap Unsigned Dbghelp.DLL Potential Sideloading · sigma-rule
- VsCode Powershell Profile Modification · sigma-rule
- Vulnerable Driver Load · sigma-rule
- Vulnerable Driver Load By Name · sigma-rule
- Vulnerable HackSys Extreme Vulnerable Driver Load · sigma-rule
- Vulnerable Netlogon Secure Channel Connection Allowed · sigma-rule
- Vulnerable WinRing0 Driver Load · sigma-rule
- Whoami.EXE Execution From Privileged Process · sigma-rule
- Win Susp Computer Name Containing Samtheadmin · sigma-rule
- Windows Default Domain GPO Modification · sigma-rule
- Windows Default Domain GPO Modification via GPME · sigma-rule
- Windows Event Log Access Tampering Via Registry · sigma-rule
- Windows LAPS Credential Dump From Entra ID · sigma-rule
- Windows Network Access Suspicious desktop.ini Action · sigma-rule
- Windows Terminal Profile Settings Modification By Uncommon Process · sigma-rule
- WINEKEY Registry Modification · sigma-rule
- Winlogon Helper DLL · sigma-rule
- Winlogon Notify Key Logon Persistence · sigma-rule
- WinRAR Creating Files in Startup Locations · sigma-rule
- WinSock2 Autorun Keys Modification · sigma-rule
- WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load · sigma-rule
- WMI Backdoor Exchange Transport Agent · sigma-rule
- WMI Event Subscription · sigma-rule
- WMI Persistence · sigma-rule
- WMI Persistence - Command Line Event Consumer · sigma-rule
- WMI Persistence - Script Event Consumer · sigma-rule
- WMI Persistence - Script Event Consumer File Write · sigma-rule
- WMI Persistence - Security · sigma-rule
- Wow6432Node Classes Autorun Keys Modification · sigma-rule
- Wow6432Node CurrentVersion Autorun Keys Modification · sigma-rule
- Wow6432Node Windows NT CurrentVersion Autorun Keys Modification · sigma-rule
- Writing Local Admin Share · sigma-rule
- Xwizard.EXE Execution From Non-Default Location · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.