Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleHigh

Samsung Knox - Application Privilege Escalation or Change Events

View on GitHub ↗Original file ↗

Description

When a Knox mobile app has transitioned from an acceptable uid/esuid/fsuid to a different, non-App id.
Rule type
NRT
Version
1.0.2
Declared status
Available

Declared MITRE coverage

PrivilegeEscalationT1548

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

SamsungDCDefinition

Data types

Samsung_Knox_Process_CL

KQL query

Original query, unchanged.

Samsung_Knox_Process_CL 
| where Name == "PROCESS_PRIVILEGE_ESCALATION"
| where MitreTtp has "T1548"

Related content

Links established from declared identifiers and solution manifests.

Solutions1
Connectors1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
215e89ca-cdbc-4661-b8b2-7041f6ecc7fb
Additional source files 2Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxApplicationPrivilegeEscalationOrChange.yamlsource ↗Solutions/Samsung Knox Asset Intelligence/Data/Solution_Samsung.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.