Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,376
detections

Search detections

Filters

Showing 30 of 11,376

Windows Defender Intermediary Artifact Was Observed

The following analytic detects creation and removal of intermediary remediation artifacts of Windows Defender, during exploitation of ShieldCrash attacks. Exploit abuses the race condition between file validation and its remediation performed by Windows Defender. In between these steps, ShieldCrash changes the symbolic link to redirect the remediation process to a staging directory controlled by the attacker.

T1068

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 2, 2026

InformationalSplunk security content

Windows Alternate Data Stream Created Over Local Share

The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. Legitimate local processes access files directly rather than through a local SMB share.

T1021.002T1564.004

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 2, 2026

MediumSplunk security content

Windows Admin Password Changed by Non-Admin

The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.

T1068T1543.003

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 2, 2026

MediumSplunk security content

Windows AD User Suspicious UPN Change

The following analytic detects a user account modifying its own userPrincipalName (UPN) to match the sAMAccountName of another account via Windows Security Event 4738. This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account.

T1078.002

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 2, 2026

HighMicrosoft Sentinel analytics

SAP BTP - Critical vulnerability finding in custom app

Identifies SAP BTP Application Vulnerability Report Service findings where the CVSS score exceeds a configurable threshold (default 9.0, i.e. Critical severity). Such findings indicate custom applications deployed on SAP BTP that carry vulnerable open-source packages or components with a known, high-impact CVE. These risky applications should be prioritized for remediation and reviewed for signs of exploitation.

T1190

Licence: MIT License
Published: Oct 2, 2026

MediumElastic detection rules

Lure-Themed Internet-Delivered RMM Executable

Identifies an Internet-delivered remote monitoring and management (RMM) executable whose filename disguises it as a document, invitation, or another company's application. Attackers may use that lure, often through social engineering, to gain remote access to the endpoint.

T1036T1204T1204.002T1219T1219.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

LowElastic detection rules

Potential RMM Execution from a Commonly Abused Web Service

Identifies execution of software whose reported code-signature subject matches a known remote monitoring and management (RMM) publisher with a download origin on a commonly abused web service. Adversaries use these services to deliver remote-access software during social engineering and intrusion campaigns.

T1105T1219T1219.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

First Time Python Created a LaunchAgent or LaunchDaemon

Detects the first time a Python process creates or modifies a LaunchAgent or LaunchDaemon plist file on a given host. Malicious Python scripts, compromised dependencies, or model file deserialization can establish persistence on macOS by writing plist files to LaunchAgent or LaunchDaemon directories. Legitimate Python processes do not typically create persistence mechanisms, so a first occurrence is a strong indicator of compromise.

T1543T1543.001T1543.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

First Time Python Spawned a Shell on Host

Detects the first time a Python process spawns a shell on a given host. Malicious Python scripts, compromised dependencies, or model file deserialization can result in shell spawns that would not occur during normal workflows. Since legitimate Python processes rarely shell out to interactive shells, a first occurrence of this behavior on a host is a strong signal of potential compromise.

T1059T1059.004T1059.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

First Time Python Accessed Sensitive Credential Files

Detects the first time a Python process accesses sensitive credential files on a given host. This behavior may indicate post-exploitation credential theft via a malicious Python script, compromised dependency, or malicious model file deserialization. Legitimate Python processes do not typically access credential files such as SSH keys, AWS credentials, browser cookies, Kerberos tickets, or keychain databases, so a first occurrence is a strong indicator of compromise.

T1539T1552T1552.001T1555T1555.001+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

CriticalElastic detection rules

Zimbra Swatchdog SNMP Command Injection Execution

Detects a Unix shell launched by Perl from a generated Zimbra ".swatchdog_script" when the shell command line contains an "snmptrap" invocation and Zimbra SNMP service fields, followed by an unexpected child process other than "snmptrap". This sequence provides high-confidence evidence of external command execution through CVE-2026-73570, an unauthenticated command-injection vulnerability in Zimbra's SNMP monitoring path.

T1059T1059.004T1190

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Root Password Changed

Detects a change to the ESXi root password, the credential for SSH, the Host Client, and the API. Replacing it locks out the previous password and gives the new value full control of the host. Hostd records `Password was changed for account root`. The shell records `esxcli system account set -i root`.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Account Granted Admin Role

Detects an ESXi account being granted the Administrator role. Administrator is full control of the host, including the firewall, SSH, accounts, and every virtual machine. Granting it to another account keeps that access after the original session ends.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Local Account Created

Detects creation of a local ESXi account. A new account is a separate login that remains after the session that created it. It has no rights until a role is assigned, and it is the first step toward a persistent login on the host.

T1136T1136.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi SSH Session from vpxuser

Identifies a successful SSH session opened by the privileged vpxuser account. vpxuser is a service account used by VMware vCenter Server to manage ESXi hosts. An SSH session from that account reaches the host shell directly, outside the vCenter management path, and is a sign the credential is being reused with malicious intent.

T1021T1021.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi SSH Access Enabled

Detects ESXi SSH being turned on. SSH is often left disabled so the host is managed through the local console, the Host Client, or vCenter. Enabling it opens a remote shell that can copy files onto the host and run commands against the datastore.

T1021T1021.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Root Password Accepted from Remote Host

Detects hostd accepting the ESXi root password from a remote address. A successful remote root login opens the Host Client or the API with full control of the host. Local sessions from 127.0.0.1 are left out of the rule.

T1078T1078.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Virtual Machine Process Killed

Detects termination of a virtual machine process on an ESXi host, including `esxcli vm process kill`, `pkill` of `vmx` processes, and `vmdumper` suspend. A running VM holds a lock on its disks. Stopping the process releases that lock and makes the disks writable.

T1489

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Virtual Machine Powered Off

Detects `vim-cmd vmsvc/power.off` on an ESXi host. Powering a virtual machine off releases the lock the hypervisor holds on its virtual disks. With the guest stopped, those disks can be rewritten or encrypted while the machine is down.

T1529

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Virtual Machine Snapshot Removed

Detects removal of all snapshots for an ESXi virtual machine. Snapshots are on-host recovery points for a guest. Removing all of them deletes those recovery points, so the virtual machine cannot be reverted to an earlier disk state.

T1490

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Payload Executed Against Datastore

Detects a program launched from the ESXi shell against `/vmfs/volumes`. The datastore holds the virtual disks of every guest. A process pointed at that path can read or encrypt those disks and take the hosted virtual machines offline.

T1059T1059.004T1486

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

LowElastic detection rules

ESXi Virtual Machine Process List

Detects `esxcli vm process list` on an ESXi host. The command lists running virtual machines and the world IDs of their `vmx` processes. Those IDs are what a later kill command uses to stop the VMs and release the locks on their virtual disks.

T1057

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

LowElastic detection rules

ESXi Virtual Disk Files Enumerated

Detects a shell search under `/vmfs/volumes` for virtual disk and snapshot files (`vmdk`, `vmsn`, `vmsd`). Those files are the guest disks and their on-host recovery points. Listing them builds the set of files a later process can encrypt or delete.

T1083

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

LowElastic detection rules

ESXi System and Account Enumeration

Detects shell commands that collect ESXi host details or the local account list, including `uname -a`, system version, hostname, and `esxcli system account list`. The output identifies the build and the accounts that can log in. Listing accounts shows which identities exist before one of them is changed or used.

T1082T1087T1087.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Syslog Remote Host Reset

Detects the ESXi remote syslog destination being cleared with `--reset=loghost`. The loghost is where host logs are forwarded for retention and detection. Clearing it keeps later commands on the host only, so an external collector stops receiving them.

T1562T1562.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

CriticalElastic detection rules

ESXi Host Prepared for an Unsigned Install

Detects three changes on the same ESXi host within 1 hour: SSH enabled, ExecInstalledOnly turned off, and a VIB install with `-f` or `--force` and `--no-sig-check`. Together they open a remote shell, allow unsigned code to run, and bypass VIB signature checks. That sequence prepares the host to receive and run a package the normal controls would reject.

T1021T1021.004T1553T1553.006T1562+1 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Shell Command Obfuscation

Detects ESXi shell commands that rebuild a command with encoding instead of writing it in clear text, including octal and hex `printf`, Python `chr()`, `awk` `%c` sequences, reversed strings, and invisible Unicode. The shell log then hides the administrative command. The decoded action can still change syslog, the firewall, or other host settings.

T1027T1059T1059.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Lockdown Mode Disabled

Detects the disabling of ESXi lockdown mode, a critical security feature that restricts remote access to ESXi hosts. When lockdown mode is disabled, remote users can directly access and modify ESXi host configurations using the root login. When enabled, the ESXi host is accessible only through the local console or vCenter Server.

T1562T1562.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Host Logs Deleted with rm

Detects a shell `rm` of a path under `/var/log` or of a `*.log` name. Those files hold shell commands, authentication, and hostd activity. Removing them takes away the record of what changed on the host.

T1070T1070.002T1070.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Attempt to Force Install a VMware VIB Package

Detects an attempt to install a VMware VIB with `--force`. A VIB is how ESXi adds drivers and host software, and signature checks normally block an unsigned package. `--force` skips that validation, so an untrusted package can be written onto the hypervisor and affect every virtual machine it runs.

T1553T1553.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

Load more detections

Loading detection rules

Back to results

InformationalSplunk security content Onur Mustafa Erdogan +1

Windows Defender Intermediary Artifact Was Observed

Description

Detection logic

Detection requirements

Platform: Containers Linux macOS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source category: sysmon_eventid_11_and_sysmon_eventid_15_and_sysmon_eventid_23

Known benign triggers

Remediation of various container files, such as archives, might also lead to creation various defender artifacts SmartScreen interferes with the remediation process, potentially causing additional defender artifacts to be created.

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Privilege Escalation

T1068Exploitation for Privilege Escalation 164 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
socradar.io/blog/shieldcrash-poc-microsoft-defender-fix-bypass/	Unclassified	Only this detection cites it
www.cyderes.com/howler-cell/rogueplanet-windows-zero-day	Unclassified	7
www.cyderes.com/howler-cell/shieldcrash-microsoft-zero-day?hs_amp=true	Unclassified	Only this detection cites it

From the source

At source: Open at source
Upstream identifier: 5234fb35-da15-4e45-8e17-3b7ae0e0fc9e
Tagged by the source as: RoguePlanetWindows Privilege EscalationEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Licence

Published under: Apache License 2.0Read the licence
Attribution: Required
Obtained under: Apache-2.0Read the origin licence

Authorship

Written by: Onur Mustafa Erdogan
Splunk
Published: Oct 2, 2026
Version: 1