| elastic |
Permission Theft - Prevented - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Named Pipe Impersonation |
production |
2026-09-18 |
| elastic |
Process Created with a Duplicated Token |
production |
2026-09-18 |
| elastic |
Permission Theft - Detected - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Rogue Named Pipe Impersonation |
production |
2026-09-18 |
| elastic |
PowerShell Script with Token Impersonation Capabilities |
production |
2026-09-18 |
| elastic |
First Time Seen NewCredentials Logon Process |
production |
2026-09-18 |
| splunk |
Windows Handle Duplication in Known UAC-Bypass Binaries |
production |
2026-09-08 |
| splunk |
Windows Access Token Winlogon Duplicate Handle In Uncommon Path |
production |
2026-09-08 |
| splunk |
Windows Access Token Manipulation Winlogon Duplicate Token Handle |
production |
2026-09-08 |
| splunk |
Windows Wermgr Spawning System Integrity Process |
production |
2026-08-18 |
| splunk |
Runas Execution in CommandLine |
production |
2026-05-13 |
| sigma |
HackTool - Impersonate Execution |
test |
2024-11-23 |
| sigma |
HackTool - SharpDPAPI Execution |
test |
2024-06-26 |
| sigma |
HackTool - NoFilter Execution |
test |
2024-01-05 |
| sigma |
Meterpreter or Cobalt Strike Getsystem Service Installation - System |
test |
2023-11-15 |
| sigma |
Meterpreter or Cobalt Strike Getsystem Service Installation - Security |
test |
2023-11-15 |
| sigma |
HackTool - Koh Default Named Pipe |
test |
2023-08-07 |
| sigma |
Potential Access Token Abuse |
test |
2023-04-26 |
| sigma |
HackTool - SharpImpersonation Execution |
test |
2023-02-13 |
| sigma |
Potential Meterpreter/CobaltStrike Activity |
test |
2023-02-05 |