CPE
Microsoft Windows: Fastprox privilege escalation (CVE-2026-69451)
1 rule 1 TTP 2 CVEsA public proof-of-concept exploit for CVE-2026-69451 in the Windows Fastprox component enables local privilege escalation via arbitrary command execution.
Microsoft JScript Engine Use-After-Free Remote Code Execution (CVE-2025-30397)
1 rule 1 TTP 1 CVEA public exploit exists for a use-after-free vulnerability in the legacy JScript engine (jscript.dll) that allows remote code execution via Internet Explorer 11.
Microsoft October 2026 Security Updates
3 TTPs 3 CVEsMicrosoft addressed 1,413 vulnerabilities including 75 critical flaws and an exploited zero-day (CVE-2026-96951) bypass in Windows Shell that circumvents Mark of the Web protections.
Microsoft Security Updates - October 2026
1315 CVEsRoundup of Microsoft security advisories published in October 2026.
Microsoft Dataverse Privilege Escalation Vulnerability
1 TTP 1 CVEA vulnerability in Microsoft Dataverse identified as CVE-2024-38064 allows a remote, unauthenticated attacker to escalate privileges and potentially gain administrative access to the service.
Multiple Privilege Escalation Vulnerabilities in Microsoft Authenticator and Xbox Gaming Services
1 TTP 2 CVEsLocal attackers can exploit multiple vulnerabilities in Microsoft Authenticator and Xbox Gaming Services to achieve elevated privileges on Windows systems.
Privilege Escalation Vulnerability in Microsoft Windows Package Manager
1 CVEA local privilege escalation vulnerability in the Microsoft Windows Package Manager allows an authenticated local attacker to gain elevated privileges on the host system.
Suspicious Child Processes of consent.exe
1 rule 3 TTPs 1 CVEDetection of unauthorized child process creation by the Windows UAC consent.exe binary, a common indicator of UAC bypass and privilege escalation activity.
Suspicious Microsoft Office Child Process Activity
1 rule 3 TTPs 1 CVEMicrosoft Office applications are frequently abused to spawn system processes to execute malicious code, download payloads, or facilitate privilege escalation.
Potential Privilege Escalation via InstallerFileTakeOver (CVE-2021-41379)
2 rules 1 TTP 1 CVEThis rule detects potential exploitation of the InstallerTakeOver vulnerability (CVE-2021-41379), where successful exploitation allows an unprivileged user to escalate privileges to SYSTEM.
Suspicious Rundll32 Execution Without Command-Line Arguments
2 rules 1 TTP 1 CVEThe execution of rundll32.exe without command-line arguments is detected via endpoint telemetry, a behavior indicative of potential malicious activity such as Cobalt Strike, leading to arbitrary code execution and system compromise.
Potential CVE-2025-33053 Exploitation via Internet Explorer Diagnostics
2 rules 5 TTPs 1 CVEExploitation of CVE-2025-33053 via a malicious URL file can lead to the spawning of suspicious child processes from the Internet Explorer Diagnostics Utility (iediagcmd.exe), enabling initial access, defense evasion, and execution of arbitrary commands.
Detection of Vulnerable Driver Loading on Windows Systems
2 rules 1 TTP 2 CVEsDetection of loading known vulnerable Windows drivers that may indicate persistence or privilege escalation attempts via exploitation.