Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1068

Exploitation for Privilege Escalation

Privilege Escalation 151 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
sigma Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation experimental 2026-10-19
elastic Suspicious Print Spooler SPL File Created production 2026-10-19
splunk Windows Non-System Process Querying Definition Update production 2026-10-08
elastic Modification of the msPKIAccountCredentials production 2026-10-06
splunk Child Processes of Spoolsv exe deprecated 2026-10-02
splunk Windows Defender Intermediary Artifact Was Observed production 2026-09-30
splunk Windows Admin Password Changed by Non-Admin production 2026-09-23
splunk First Time Seen Child Process of Zoom experimental 2026-09-22
elastic Spike in Group Application Assignment Change Events production 2026-09-18
elastic Spike in Group Privilege Change Events production 2026-09-18
elastic Spike in Group Membership Events production 2026-09-18
elastic Spike in Group Lifecycle Change Events production 2026-09-18
elastic Unusual Spike in Concurrent Active Sessions by a User production 2026-09-18
elastic Unusual Print Spooler Child Process production 2026-09-18
elastic Remote Computer Account DnsHostName Update production 2026-09-18
elastic Potential Privileged Escalation via SamAccountName Spoofing production 2026-09-18
elastic Suspicious Print Spooler File Deletion production 2026-09-18
elastic Suspicious Print Spooler Point and Print DLL production 2026-09-18
elastic Potential Escalation via Vulnerable MSI Repair production 2026-09-18
elastic Potential Privilege Escalation via InstallerFileTakeOver production 2026-09-18
elastic Potential privilege escalation via CVE-2022-38028 production 2026-09-18
elastic Expired or Revoked Driver Loaded production 2026-09-18
elastic First Time Seen Driver Loaded production 2026-09-18
elastic Unsigned DLL loaded by DNS Service production 2026-09-18
elastic Persistence via Update Orchestrator Service Hijack production 2026-09-18
elastic Unusual Executable File Creation by a System Critical Process production 2026-09-18
elastic Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121) production 2026-09-18
elastic Exploit - Prevented - Elastic Endgame production 2026-09-18
elastic Exploit - Detected - Elastic Endgame production 2026-09-18
elastic Anomalous Linux Compiler Activity production 2026-09-18
elastic Spike in host-based traffic production 2026-09-18
elastic Suspicious Child Process of Adobe Acrobat Reader Update Service production 2026-09-18
elastic SSFileCopySender Executed as Root production 2026-09-18
elastic Potential Privilege Escalation via unshare Followed by Root Process production 2026-09-18
elastic Potential Privilege Escalation via Recently Compiled Executable production 2026-09-18
elastic Privilege Escalation via CAP_SETUID/SETGID Capabilities production 2026-09-18
elastic Suspicious Passwd File Event Action production 2026-09-18
elastic Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities production 2026-09-18
elastic Potential Privilege Escalation via Python cap_setuid production 2026-09-18
elastic Potential Sudo Privilege Escalation via CVE-2019-14287 production 2026-09-18
elastic Potential snap-confine Privilege Escalation via CVE-2026-3888 production 2026-09-18
elastic Potential Shadow File Read via Command Line Utilities production 2026-09-18
elastic Potential Shell via Wildcard Injection Detected production 2026-09-18
elastic Potential Privilege Escalation via SUID/SGID Proxy Execution production 2026-09-18
elastic Privilege Escalation via SUID/SGID production 2026-09-18
elastic Suspicious UID Change to Root via Python production 2026-09-18
elastic Potential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket production 2026-09-18
elastic Potential Buffer Overflow Attack Detected production 2026-09-18
elastic Potential Privilege Escalation via PKEXEC production 2026-09-18
elastic Potential Privilege Escalation via unshare and UID Change production 2026-09-18
elastic Potential Privilege Escalation via CVE-2023-4911 production 2026-09-18
elastic Root Network Connection via GDB CAP_SYS_PTRACE production 2026-09-18
elastic Privilege Escalation via GDB CAP_SYS_PTRACE production 2026-09-18
elastic Potential Privilege Escalation via Enlightenment production 2026-09-18
elastic Potential Privilege Escalation via Linux DAC permissions production 2026-09-18
elastic Potential CVE-2025-32463 Sudo Chroot Execution Attempt production 2026-09-18
elastic Potential CVE-2025-32463 Nsswitch File Creation production 2026-09-18
elastic Potential Unauthorized Access via Wildcard Injection Detected production 2026-09-18
elastic Potential Telnet Authentication Bypass (CVE-2026-24061) production 2026-09-18
elastic Telnet Authentication Bypass via User Environment Variable production 2026-09-18
elastic Unusual Privilege Type assigned to a User production 2026-09-18
elastic Unusual Group Name Accessed by a User production 2026-09-18
elastic Spike in User Account Management Events production 2026-09-18
elastic Spike in Special Privilege Use Events production 2026-09-18
elastic Spike in Special Logon Events production 2026-09-18
elastic Privilege Escalation via Parallels Appliance Extract Argument Injection production 2026-09-17
splunk Linux Ghostscript Exploitation production 2026-09-01
splunk Windows SCCM Smsexec Spawned a Suspicious Child Process production 2026-08-24
splunk Windows Phantom DLL Created on Disk production 2026-08-20
splunk Windows Defender MpClient.dll Loaded by Non-Defender Process production 2026-08-19
elastic Deprecated - Suspicious PrintSpooler Service Executable File Creation deprecated 2026-08-19
splunk Windows Wermgr Spawning System Integrity Process production 2026-08-18
splunk Windows Error Report Created in ReportQueue Manually production 2026-08-18
splunk Windows Defender Threat Detected on Kernel Object Path production 2026-08-18
elastic Potential CVE-2025-41244 vmtoolsd LPE Exploitation Attempt deprecated 2026-08-03
splunk Windows Suspicious Child Process of Consent.EXE production 2026-07-30
splunk Windows MSI Rollback Script Deleted By Non-Msiexec Process production 2026-07-20
splunk Windows Suspicious Defender Update Activity in INetCache production 2026-07-20
splunk Linux Binary Launched Process with Null Argv production 2026-07-17
splunk Linux PF_ALG Registration Outside of Boot Window production 2026-07-17
splunk Linux Suspicious GCC Invocation Building Init Shared Object production 2026-07-08
splunk Linux Possible Privilege Escalation via PYTHONPATH production 2026-07-08
splunk Linux Possible Nimbuspwn Privilege Escalation production 2026-07-08
splunk Linux Possible GSM Privilege Escalation production 2026-07-08
splunk Linux Dirty Frag Kernel Privilege Escalation production 2026-07-06
splunk Linux Pedit Offset Out Of Bounds production 2026-07-06
splunk Linux Auditd Possible Setuid Execve Privesc production 2026-07-06
elastic Deprecated - Sudo Heap-Based Buffer Overflow Attempt deprecated 2026-07-02
splunk Linux Apparmor Bypass Via Aaexec production 2026-06-30
sigma Process Explorer Driver Creation By Non-Sysinternals Binary test 2026-06-29
sigma Process Monitor Driver Creation By Non-Sysinternals Binary test 2026-06-29
splunk Linux Auditd Copy Fail Privilege Escalation production 2026-05-13
splunk Windows Privilege Escalation User Process Spawn System Process production 2026-05-13
splunk Windows Service Create Kernel Mode Driver production 2026-05-13
splunk Windows System File on Disk production 2026-05-13
splunk Microsoft SharePoint Server Elevation of Privilege production 2026-05-13
splunk VMWare Aria Operations Exploit Attempt production 2026-05-13
splunk Windows Privilege Escalation System Process Without System Parent production 2026-05-13
splunk Windows Privilege Escalation Suspicious Process Elevation production 2026-05-13
splunk Windows Privilege Escalation Attempt Via MSI Rollback production 2026-05-13
splunk Windows Potato Privilege Escalation Tool Execution production 2026-05-13
splunk Windows Drivers Loaded by Signature production 2026-05-13
splunk Windows Driver Load Non-Standard Path production 2026-05-13
splunk Windows Driver Inventory production 2026-05-13
splunk Spoolsv Suspicious Process Access production 2026-05-13
splunk Linux pkexec Privilege Escalation production 2026-05-13
splunk Windows Remote Image Load production 2026-05-13
splunk Detect Baron Samedit CVE-2021-3156 via OSQuery experimental 2026-05-13
splunk Detect Baron Samedit CVE-2021-3156 Segfault experimental 2026-05-13
splunk Detect Baron Samedit CVE-2021-3156 experimental 2026-05-13
splunk Cisco Isovalent - Kprobe Spike production 2026-05-13
splunk Linux Suspicious Namespace Creation production 2026-05-12
sigma Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator experimental 2026-05-09
splunk Linux Malformed Auth Entry production 2026-05-06
splunk Windows VSSVC Process Accessing Defender Engine production 2026-05-01
splunk Windows Cloud Files Filter Log Created by Non-System Process production 2026-05-01
splunk Windows Suspicious Child Process of TieringEngineService.exe production 2026-05-01
sigma Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator experimental 2026-04-30
splunk Windows Suspicious Burst of Password Changes production 2026-04-29
splunk Windows MsMpEng Writing to System32 production 2026-04-27
splunk Windows Suspicious Defender Engine or Signature Files Created production 2026-04-27
elastic Deprecated - Potential Privilege Escalation via UID INT_MAX Bug Detected deprecated 2026-02-04
sigma Potential Nimbuspwn Exploit CVE-2022-29799 and CVE-2022-27800 test 2025-11-03
sigma OMIGOD HTTP No Authentication RCE - CVE-2021-38647 stable 2025-11-03
sigma Linux Sudo Chroot Execution experimental 2025-10-02
sigma Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) experimental 2025-08-01
sigma Suspicious Sysmon as Execution Parent test 2025-07-04
sigma HKTL - SharpSuccessor Privilege Escalation Tool Execution experimental 2025-06-06
sigma Buffer Overflow Attempts test 2025-03-17
sigma Potential CVE-2024-35250 Exploitation Activity experimental 2025-02-19
sigma Exploiting CVE-2019-1388 stable 2024-12-01
sigma Potential CVE-2021-41379 Exploitation Attempt test 2024-12-01
sigma Suspicious Spool Service Child Process test 2024-12-01
sigma HackTool - SysmonEOP Execution test 2024-11-23
sigma Malicious Driver Load test 2023-12-02
sigma Vulnerable Driver Load By Name test 2023-12-02
sigma Malicious Driver Load By Name test 2023-12-02
sigma Vulnerable Driver Load test 2023-12-02
sigma Potential SystemNightmare Exploitation Attempt test 2023-02-04
sigma InstallerFileTakeOver LPE CVE-2021-41379 File Create Event test 2022-12-25
sigma Possible Coin Miner CPU Priority Param test 2022-12-25
sigma Sudo Privilege Escalation CVE-2019-14287 - Builtin test 2022-11-26
sigma Audit CVE Event test 2022-10-22
sigma OMIGOD SCX RunAsProvider ExecuteScript test 2022-10-05
sigma OMIGOD SCX RunAsProvider ExecuteShellCommand test 2022-10-05
sigma Sudo Privilege Escalation CVE-2019-14287 test 2022-10-05
elastic Strace Process Activity deprecated 2022-07-28
elastic Potential PrintNightmare Exploit Registry Modification deprecated 2022-03-16
elastic Potential PrintNightmare File Modification deprecated 2022-03-16
sigma Exploiting SetupComplete.cmd CVE-2019-1378 test 2021-11-27
sentinel Email access via active sync Scheduled —