May 2026 (30)
Privilege Escalation via Rogue Windir Environment Variable
2 rules 1 TTPA privilege escalation attempt is detected through modification of the Windows directory (Windir) environment variable, a technique often combined with other vulnerabilities to elevate privileges by redirecting system processes.
Privilege Escalation via Named Pipe Impersonation
2 rules 1 TTPAdversaries may escalate privileges by abusing named pipe impersonation, a technique often used with tools like Metasploit's meterpreter getsystem command, where a process writes to a named pipe to facilitate a SYSTEM-token handoff.
Fortinet Patches Multiple Vulnerabilities in FortiAuthenticator, FortiOS, and FortiSandbox
2 rulesFortinet released security advisories on May 12, 2026, addressing critical vulnerabilities including improper access control, incorrect global authorization, and out-of-bounds access across FortiAuthenticator, FortiOS, and FortiSandbox product lines, urging users to apply necessary updates.
Service Creation via Local Kerberos Authentication Leading to Privilege Escalation
3 rules 1 TTPThe rule detects a local successful logon event with Kerberos authentication from localhost, followed by service creation from the same LogonId, indicating a potential Kerberos relay attack for local privilege escalation to LocalSystem.
Potential Privilege Escalation via InstallerFileTakeOver (CVE-2021-41379)
2 rules 1 TTP 1 CVEThis rule detects potential exploitation of the InstallerTakeOver vulnerability (CVE-2021-41379), where successful exploitation allows an unprivileged user to escalate privileges to SYSTEM.
Group Policy Abuse for Privilege Addition
2 rules 1 TTPDetects modifications to Group Policy Object Attributes that grant privileges to user accounts or add users as local administrators, indicating potential privilege escalation attempts.
Unusual dMSA Account Creation for Privilege Escalation
3 rules 1 TTPDetects the creation of a delegated Managed Service Account (dMSA) by an unusual subject account, potentially indicating an attempt to abuse weak permissions for privilege escalation in Active Directory.
Unusual Modification of Delegated Managed Service Account Attribute
3 rules 1 TTPDetection of modifications to the msDS-ManagedAccountPrecededByLink attribute of a delegated managed service account (dMSA) by an unusual subject account, which attackers can abuse to inherit permissions and elevate privileges in Active Directory.
Persistence via WMI Standard Registry Provider
3 rules 1 TTPThe rule identifies the use of Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence by detecting registry changes made by WmiPrvSe.exe in specific registry paths.
CVE-2026-40410 - Windows SMB Client Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-40410 is a use-after-free vulnerability in the Windows SMB Client that allows an authorized attacker to elevate privileges locally.
Intel Addresses Vulnerabilities in Multiple Software Products
3 rulesIntel released security advisories addressing vulnerabilities in Display Virtualization for Windows OS driver software, Intel EMA software, AI Playground software, and Intel Vision software, requiring users to update to the latest versions.
CVE-2026-42899 - ASP.NET Core Infinite Loop Denial of Service
2 rules 1 TTP 1 CVECVE-2026-42899 describes an infinite loop vulnerability in ASP.NET Core that allows an unauthorized attacker to perform a denial of service attack over a network.
CVE-2026-42896 - Windows DWM Core Library Integer Overflow Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-42896 describes an integer overflow vulnerability in the Windows DWM Core Library, allowing an authorized local attacker to elevate privileges.
CVE-2026-42893: M365 Copilot Command Injection Vulnerability
1 rule 1 TTP 1 CVECVE-2026-42893 is a command injection vulnerability in M365 Copilot that allows an unauthorized attacker to perform tampering over a network.
CVE-2026-42832 - Microsoft Office Improper Access Control Vulnerability Leading to Spoofing
2 rules 2 TTPs 1 CVECVE-2026-42832 is an improper access control vulnerability in Microsoft Office that allows an unauthorized attacker to perform local spoofing.
CVE-2026-42831 Heap-based Buffer Overflow in Microsoft Office
1 rule 1 TTP 1 CVECVE-2026-42831 is a heap-based buffer overflow vulnerability in Microsoft Office, allowing a local attacker to execute arbitrary code with a CVSS score of 7.8.
CVE-2026-42825: Use-After-Free in Windows Telephony Service
2 rules 1 TTP 1 CVECVE-2026-42825 is a use-after-free vulnerability in the Windows Telephony Service that allows an authorized, local attacker to elevate privileges.
CVE-2026-41613 - Visual Studio Code Session Fixation Vulnerability
2 rules 1 TTP 1 CVECVE-2026-41613 is a session fixation vulnerability in Visual Studio Code that allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-41611: Visual Studio Code XSS Vulnerability
2 rules 4 TTPs 1 CVECVE-2026-41611 is a cross-site scripting (XSS) vulnerability in Visual Studio Code that allows an attacker to execute code locally due to improper neutralization of script-related HTML tags.
CVE-2026-41109: Improper Neutralization of Special Elements in GitHub Copilot and Visual Studio
2 rules 1 TTP 1 CVECVE-2026-41109 describes an improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in GitHub Copilot and Visual Studio, allowing an unauthorized attacker to bypass a security feature over a network.
CVE-2026-41102: Microsoft PowerPoint Improper Access Control Vulnerability Leading to Local Spoofing
2 rules 1 TTP 1 CVECVE-2026-41102 is an improper access control vulnerability in Microsoft Office PowerPoint that allows an authorized attacker to perform spoofing locally.
CVE-2026-41101: Microsoft Office Word Improper Access Control Vulnerability Leading to Local Spoofing
2 rules 1 TTP 1 CVECVE-2026-41101 is a vulnerability in Microsoft Office Word due to improper access control, which allows an authorized attacker to perform spoofing locally, with a CVSS v3.1 base score of 7.1.
CVE-2026-41095: Use-After-Free in Data Deduplication Leads to Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-41095 is a use-after-free vulnerability in the Data Deduplication component of Windows that allows an authenticated attacker to elevate privileges locally.
CVE-2026-41094: Microsoft Data Formulator Code Injection Vulnerability
2 rules 1 TTP 1 CVECVE-2026-41094 is a code injection vulnerability in Microsoft Data Formulator, allowing an unauthorized attacker to execute arbitrary code over a network.
CVE-2026-41088: Windows Ancillary Function Driver for WinSock Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-41088 is a vulnerability in Windows Ancillary Function Driver for WinSock that allows an authorized attacker to elevate privileges locally due to external control of file name or path.
CVE-2026-41086: Windows Admin Center Privilege Escalation via Improper Access Control
2 rules 1 TTP 1 CVECVE-2026-41086 describes an improper access control vulnerability in Windows Admin Center, allowing an authorized attacker to elevate privileges over a network.
CVE-2026-40420 - Microsoft Office Click-To-Run Improper Access Control Vulnerability
2 rules 1 TTP 1 CVECVE-2026-40420 is an improper access control vulnerability in Microsoft Office Click-To-Run allowing an authorized attacker to elevate privileges locally.
CVE-2026-40419: Microsoft Office Use-After-Free Vulnerability for Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-40419 is a use-after-free vulnerability in Microsoft Office that allows an authenticated, local attacker to elevate privileges.
CVE-2026-40418: Microsoft Office Click-To-Run Use-After-Free Vulnerability
2 rules 1 TTP 1 CVECVE-2026-40418 is a use-after-free vulnerability in Microsoft Office Click-To-Run that allows an authorized attacker to elevate privileges locally.
CVE-2026-40415 Use-After-Free Vulnerability in Windows TCP/IP
2 rules 1 TTP 1 CVECVE-2026-40415 is a use-after-free vulnerability in Windows TCP/IP that allows an unauthorized attacker to execute code over a network.