attack.t1134 | Detection.FYI

HackTool - NoFilter Execution

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.t1134 attack.t1134.001 ·
Share on:

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

Read More
Suspicious SYSTEM User Process Creation

Apr 28, 2026 · attack.credential-access attack.privilege-escalation attack.stealth attack.t1134 attack.t1003 attack.t1027 ·
Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More
Detection of Possible Rotten Potato

Apr 21, 2023 · attack.privilege_escalation attack.t1134 attack.t1134.002 ·
Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE privileges

Read More