attack.t1134 | Detection.FYI

Suspicious SYSTEM User Process Creation

Oct 29, 2025 · attack.credential-access attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1003 attack.t1027 ·
Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More
HackTool - NoFilter Execution

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1134.001 ·
Share on:

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

Read More
Detection of Possible Rotten Potato

Apr 21, 2023 · attack.privilege_escalation attack.t1134 attack.t1134.002 ·
Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE privileges

Read More