Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Credential Manipulation - Prevented - Elastic Endgame

Elastic Endgame prevented Credential Manipulation. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

ATT&CK coverage

Privilege Escalation

T1134Access Token ManipulationAlso under Stealth.28 detections cover this technique

Detection requirements

Log source category: event_index

What the source says

Tagged by the source as

Data Source: Elastic EndgameResources: Investigation GuideTactic: Privilege EscalationUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.