Coverage › CVE-2022-21999
CVE-2022-21999 Mapped Sigma
Microsoft Windows Print Spooler Privilege Escalation Vulnerability
- Vendor / product
- Microsoft — Windows
- Description (CISA)
- Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.
- Added to KEV
- 2022-03-25
- Due date
- 2022-04-15
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Known
- CWE
- CWE-40, CWE-1386
- CISA notes
- https://nvd.nist.gov/vuln/detail/CVE-2022-21999
- Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
5 mapping objects across 5 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1078 Valid Accounts | exploitation technique | This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.
The exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\Windows\System32\spool\drivers\x64\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.
The vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns. ref 1 · ref 2 · ref 3 · ref 4 |
live |
| T1059 Command and Scripting Interpreter | secondary impact | This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.
The exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\Windows\System32\spool\drivers\x64\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.
The vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns. ref 1 · ref 2 · ref 3 · ref 4 |
live |
| T1068 Exploitation for Privilege Escalation | primary impact | This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.
The exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\Windows\System32\spool\drivers\x64\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.
The vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns. ref 1 · ref 2 · ref 3 · ref 4 |
live |
| T1136.001 Local Account | secondary impact | This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.
The exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\Windows\System32\spool\drivers\x64\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.
The vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns. ref 1 · ref 2 · ref 3 · ref 4 |
live |
| T1211 Exploitation for Stealth | secondary impact | This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.
The exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\Windows\System32\spool\drivers\x64\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.
The vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns. ref 1 · ref 2 · ref 3 · ref 4 |
live renamed from “Exploitation for Defense Evasion” |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1059 Command and Scripting Interpreter secondary impact
- DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 WindowsDetects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.Tunable:
CommandLinePatternParentProcessNameTimeWindowAN1429 LinuxDetects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.Tunable:InterpreterNameUserContextExecutionChainLengthAN1430 macOSDetects launch of command-line interpreters via Terminal, Automator, or hiddenosascript, especially when parent process lineage deviates from user-initiated applications.macos:unifiedloglog stream --info --predicate 'eventMessage CONTAINS "exec"'→ DC0032 Process CreationTunable:LaunchAgentNameScriptNameTerminalAppUsageAN1431 ESXiDetects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.Tunable:ShellEnabledFlagSSHContextAN1432 Network DevicesIdentifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) viaenablemode or scripting-capable sessions used by uncommon accounts or from unknown IPs.Tunable:UserRoleDeviceType
Sigma rules tagged attack.t1059 (95)
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Author: Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Author: Florian Roth (Nextron Systems)
· 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Author: frack113, Tim Shelton (update fp)
· 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
All 95 rules on the technique page →
T1068 Exploitation for Privilege Escalation primary impact
- DET0514 Detection Strategy for Exploitation for Privilege Escalation
AN1419 WindowsDetects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.Tunable:
DriverNamePatternTimeWindowParentProcessPathAN1420 LinuxDetects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.Tunable:SetUIDBinaryListTimeWindowEffectiveUIDThresholdAN1421 macOSDetects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.Tunable:EntitlementListTimeWindowAN1422 ContainersDetects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.Tunable:NamespaceEscapePatternTimeWindow
Sigma rules tagged attack.t1068 (31)
Author: Florian Roth (Nextron Systems)
· 2019-11-20 (modified 2024-12-01) · logsource: product=windows category=process_creation · 02e0b2ea-a597-428e-b04a-af6a1a403e5c
Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-18 (modified 2023-12-02) · logsource: product=windows category=driver_load · 05296024-fe8a-4baf-8f3d-9a5f5624ceb2
Detects loading of known malicious drivers via their hash.
Author: Florian Roth (Nextron Systems)
· 2021-10-09 (modified 2022-12-25) · logsource: product=linux service=auditd · 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed
Detects command line parameter very often used with coin miners
Author: Nisarg Suthar
· 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72
Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
Author: Swachchhanda Shrawn Poudel (Nextron Systems)
· 2025-10-02 (modified 2026-03-31) · logsource: product=linux category=file_event · 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463.
This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations.
When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment,
potentially leading to arbitrary code execution and privilege escalation.
Author: @eyezuhk Isaac Fernandes
· 2025-02-19 · logsource: product=windows category=image_load · 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1
Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.
Author: Florian Roth (Nextron Systems)
· 2017-03-01 (modified 2025-03-17) · logsource: product=linux · 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
Detects buffer overflow attempts in Unix system log files
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-06 · logsource: product=windows category=process_creation · 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments.
Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-03 (modified 2023-12-02) · logsource: product=windows category=driver_load · 39b64854-5497-4b57-a448-40977b8c9679
Detects loading of known malicious drivers via the file name of the drivers.
Author: Florian Roth (Nextron Systems)
· 2021-11-22 (modified 2022-12-25) · logsource: product=windows category=file_event · 3be82d5d-09fe-4d6a-a275-0d40d234d324
Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file
Author: Gene Kazimiarovich
· 2026-04-30 · logsource: product=linux service=auditd · 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94
Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall.
AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431
to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD
splice path that corrupts the page cache of SUID binaries.
Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN
daemons using non-default kernel offload configurations.
Author: Gene Kazimiarovich
· 2026-05-09 · logsource: product=linux category=process_creation · 474b415a-d917-4f3b-8c62-9e1a0d5f7b48
Detects kernel auto-loading of the authencesn crypto module via modprobe
This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher
(e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the
crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation,
where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path,
corrupting the page cache of SUID binaries for local privilege escalation.
On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod)
with 'modprobe' appearing in the command line.
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
All 31 rules on the technique page →
T1078 Valid Accounts exploitation technique
- DET0560 Detection of Valid Account Abuse Across Platforms
AN1543 WindowsDetection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.Tunable:
LogonTypeTimeWindowGeoIPMismatchAN1544 LinuxDetection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.Tunable:UserContextHostDensityThresholdLoginMethodAN1545 macOSDetection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.Tunable:LoginOriginProcessTreeDepthAN1546 Identity ProviderDetection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.Tunable:MFAFailureCountRiskScoreThresholdIPGeoVelocityAN1547 ContainersDetection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.Tunable:ServiceAccountScopeClusterIPWhitelist
Sigma rules tagged attack.t1078 (56)
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 128faeef-79dd-44ca-b43c-a9e236a60f49
Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.
Author: Josh Nickels, Marius Rothenbücher
· 2025-01-08 · logsource: product=m365 service=audit · 13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 1a41023f-1e70-4026-921a-4d9341a9038e
Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-01 · logsource: product=azure service=signinlogs · 248649b7-d64f-46f0-9fb2-a52774166fb5
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Author: Austin Songer
· 2021-09-06 (modified 2022-06-08) · logsource: product=azure service=auditlogs · 352a54e1-74ba-4929-9d47-8193d67aba1e
Identifies when an user or application modified the federation settings on the domain.
Author: jamesc-grafana
· 2024-07-11 · logsource: product=aws service=cloudtrail · 352a918a-34d8-4882-8470-44830c507aa3
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
Author: elhoim
· 2022-09-09 (modified 2023-01-04) · logsource: product=windows service=security · 39698b3f-da92-4bc6-bfb5-645a98386e45
Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool
Author: Florian Roth (Nextron Systems)
· 2017-03-17 (modified 2023-12-15) · logsource: product=windows service=security · 3ff152b2-1388-4984-9cd9-a323323fdadf
Detects interactive console logons to Server Systems
Author: MikeDuddington, '@dudders1'
· 2022-07-28 (modified 2026-05-09) · logsource: product=azure service=auditlogs · 4ad97bf5-a514-41a4-abd3-4f3455ad4865
Detects guest users being invited to tenant by non-approved inviters
Author: Tim Brown
· 2023-01-09 · logsource: product=cisco service=ldp · 50e606bf-04ce-4ca7-9d54-3449494bbd4b
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36
Detects instances where a Telnet service on an OpenCanary node has had a login attempt.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-01 · logsource: product=azure service=signinlogs · 55695bc0-c8cf-461f-a379-2535f563c854
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.
The application then uses those credentials to authenticate the user against the identity provider.
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=cisco service=bgp · 56fa3cd6-f8d6-4520-a8c7-607292971886
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Author: Harjot Singh, '@cyb3rjy0t'
· 2023-01-10 (modified 2025-07-02) · logsource: product=azure service=signinlogs · 572b12d4-9062-11ed-a1eb-0242ac120002
Detects risky authentication from a non AD registered device without MFA being required.
All 56 rules on the technique page →
T1136.001 Local Account secondary impact
- DET0447 T1136.001 Detection Strategy - Local Account Creation Across Platforms
AN1235 WindowsAdversary uses built-in tools like 'net user /add', PowerShell, or WMI to create a local user. Sequence: Account creation event (4720) follows process creation of a suspicious executable (e.g., powershell.exe or net.exe).Tunable:
ParentProcessNameTimeWindowUserContextAN1236 LinuxLocal user accounts are created via binaries like 'useradd', 'adduser', or by editing passwd/shadow. Behavior chain includes execution of user management binaries or modification of user database files.Tunable:BinaryPathExecutionSourceAN1237 macOSAccount creation using 'dscl -create' or via GUI tools. Detection involves command execution and file changes to the local directory services database.Tunable:UsernamePatternSessionOriginAN1238 ESXiAccount created using esxcli commands. Sequence includes esxcli execution and successful modification to account DB.Tunable:CommandOriginAN1239 ContainersAccount created in a running container (e.g., via 'useradd' or by modifying /etc/passwd directly). Detectable via runtime telemetry (e.g., Falco or eBPF hooks).Tunable:ContainerContextNamespaceScopeAN1240 Network DevicesAccount created via CLI using 'username' command or REST API. Detectable through AAA logging or CLI history telemetry.Tunable:PrivilegeLevelRemoteSessionFlag
Sigma rules tagged attack.t1136.001 (18)
Author: Pawel Mazur
· 2022-12-21 (modified 2025-01-21) · logsource: product=linux · 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Author: James Pemberton / @4A616D6573
· 2019-10-31 (modified 2022-10-09) · logsource: product=windows service=security · 1bbf25b9-8038-4154-a50b-118f2a32be27
Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.
Author: @ROxPinTeddy
· 2020-04-11 (modified 2022-12-25) · logsource: product=windows category=ps_script · 243de76f-4725-4f2e-8225-a8a69b15ad61
Detects creation of a local user via PowerShell
Author: Christian Burkard (Nextron Systems)
· 2021-05-03 (modified 2025-10-31) · logsource: product=windows category=registry_event · 460479f3-80b7-42da-9c43-2cc1d54dbccd
Sysmon registry detection of a local hidden user account.
Author: Alejandro Ortuno, oscd.community
· 2020-10-06 (modified 2023-02-18) · logsource: product=macos category=process_creation · 51719bf5-e4fd-4e44-8ba8-b830e7ac0731
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Author: Patrick Bareiss
· 2019-04-18 (modified 2021-01-17) · logsource: product=windows service=security · 66b6be3d-55d0-4f47-9855-d69df21740ea
Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 6d844f0f-1c18-41af-8f19-33e7654edfc3
Find local accounts being created or modified as well as remote authentication configurations
Author: Florian Roth (Nextron Systems)
· 2021-07-14 (modified 2022-12-18) · logsource: product=windows category=process_creation · 75578840-9526-4b2a-9462-af469a45e767
Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322
Author: Marie Euler, Pawel Mazur
· 2020-05-18 (modified 2022-12-20) · logsource: product=linux service=auditd · 759d0d51-bc99-4b5e-9add-8f5b2c8e7512
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Author: Christian Burkard (Nextron Systems)
· 2021-05-03 (modified 2024-01-16) · logsource: product=windows service=security · 7b449a5e-1db5-4dd0-a2dc-4e3a67282538
Detects the creation of a local hidden user account which should not happen for event ID 4720.
Author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-08-13 · logsource: product=windows category=process_creation · 7c9fed65-039a-4055-8c23-fa763d94aff6
Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns
trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create
user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-12 (modified 2023-02-21) · logsource: product=windows category=process_creation · b9f0e6f5-09b4-4358-bae4-08408705bd5c
Detects creation of local users via the net.exe command with the option "never expire"
Author: X__Junior (Nextron Systems)
· 2023-08-27 (modified 2023-10-15) · logsource: product=windows category=process_creation · bf906d7b-7070-4642-8383-e404cf26eba5
Detects creation of local users via the net.exe command with the name of "DarkGate"
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 · logsource: product=fortigate service=event · cd0a4943-0edd-42cf-b50c-06f77a10d4c1
Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
Author: Endgame, JHasenbusch (adapted to Sigma for oscd.community)
· 2018-10-30 (modified 2023-02-21) · logsource: product=windows category=process_creation · cd219ff3-fa99-45d4-8380-a7d15116c6dc
Identifies the creation of local users via the net.exe command.
All 18 rules on the technique page →
T1211 Exploitation for Stealth secondary impact
- DET0595 Detection Strategy for Exploitation for Stealth
AN1633 WindowsDetects exploitation attempts targeting defensive security software or OS services. Defender observation includes abnormal process behavior (e.g., AV or EDR crashing unexpectedly), unsigned/untrusted modules loaded into defensive processes, or privilege escalation from security agent services. Multi-event correlation ties exploitation attempts to subsequent evasive behavior like service termination or missing logs.Tunable:
DefensiveProcessListAllowedModulePathsCrashThresholdAN1634 LinuxDetects kernel- or user-space exploitation attempts targeting auditd, AV daemons, or security monitoring agents. Defender observation includes unexpected segfaults, privilege escalation attempts from low-privileged processes, or modifications to security binaries. Correlates exploitation attempts with subsequent gaps in logging or terminated processes.auditd:SYSCALLexecve: Execution of suspicious exploit binaries targeting security daemons→ DC0032 Process Creationlinux:syslogSegfaults, kernel oops, or crashes in security software processes→ DC0038 Application Log ContentTunable:WatchedBinariesCrashPatternsAN1635 macOSDetects exploitation of macOS security and integrity services, such as Gatekeeper, XProtect, or EDR agents. Defender observations include unsigned processes attempting privileged operations, abnormal termination of security daemons, or modification of system integrity logs.macos:unifiedlogAbnormal terminations of com.apple.security.* or 3rd-party security daemons→ DC0038 Application Log Contentmacos:osqueryexecve: Unsigned or unnotarized processes launched with high privileges→ DC0032 Process CreationTunable:SecurityDaemonsUnsignedProcessThresholdAN1636 IaaSDetects exploitation of IaaS cloud security boundaries to evade defense controls. Defender perspective includes anomalous API calls that bypass audit logging, disable monitoring, or manipulate guardrails (e.g., CloudTrail tampering). Correlation highlights when exploitation attempts precede sudden absence of expected telemetry.AWS:CloudTrailStopLogging, DeleteTrail, UpdateTrail: API calls that disable or modify logging services→ DC0038 Application Log ContentTunable:CriticalAPIsTimeWindowAN1637 SaaSDetects adversary abuse of SaaS platform vulnerabilities to bypass logging, monitoring, or consent boundaries. Defender perspective focuses on abnormal application integration events, missing audit logs, or API calls from unauthorized service principals that align with exploitation attempts.m365:unifiedApplicationModified, ConsentGranted: Unexpected app consent or modification events linked to security evasion→ DC0038 Application Log ContentTunable:MonitoredAppsConsentAnomalyThreshold
Sigma rules tagged attack.t1211 (4)
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Author: Florian Roth (Nextron Systems)
· 2017-05-09 (modified 2023-04-14) · logsource: product=windows service=application · 545a5da6-f103-4919-a519-e9aec1026ee4
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Author: Florian Roth (Nextron Systems)
· 2017-05-09 (modified 2023-04-14) · logsource: product=windows service=application · 6c82cf5c-090d-4d57-9188-533577631108
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Author: Sreeman
· 2020-04-21 (modified 2022-03-08) · logsource: product=windows category=process_creation · ae9b0bd7-8888-4606-b444-0ed7410cb728
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.