Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Potential privilege escalation via CVE-2022-38028

Identifies a potential privilege escalation attempt via CVE-2022-38028 through modification of the protected Print to PDF MPDW constraints script.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: event_index

What the source says

References

https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/

Tagged by the source as

Data Source: CrowdstrikeData Source: Elastic DefendData Source: Elastic EndgameData Source: Microsoft Defender XDRData Source: SentinelOneData Source: SysmonDomain: EndpointOS: WindowsResources: Investigation GuideTactic: Privilege EscalationUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.