Sigma | Detection.FYI

Potential Malicious Usage of CloudTrail System Manager

Dec 9, 2025 · attack.privilege-escalation attack.initial-access attack.t1566 attack.t1566.002 ·
Share on:

Detect when System Manager successfully executes commands against an instance.

Read More
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities

Dec 9, 2025 · attack.credential-access attack.discovery attack.t1552 attack.t1087 ·
Share on:

Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.

Read More
Creation of WerFault.exe/Wer.dll in Unusual Folder

Dec 9, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

Read More
Files With System Process Name In Unsuspected Locations

Dec 9, 2025 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial baseline before using this rule in production.

Read More
Potential Defense Evasion Via Raw Disk Access By Uncommon Tools

Dec 9, 2025 · attack.defense-evasion attack.t1006 ·
Share on:

Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts

Read More
Potential System DLL Sideloading From Non System Locations

Dec 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

Read More
Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load

Dec 9, 2025 · attack.defense-evasion attack.impact attack.t1490 ·
Share on:

Detects the image load of VSS DLL by uncommon executables

Read More
Potentially Suspicious WDAC Policy File Creation

Dec 9, 2025 · attack.defense-evasion ·
Share on:

Detects suspicious Windows Defender Application Control (WDAC) policy file creation from abnormal processes that could be abused by attacker to block EDR/AV components while allowing their own malicious code to run on the system.

Read More
Startup Folder File Write

Dec 9, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.

Read More
Unauthorized System Time Modification

Dec 9, 2025 · attack.defense-evasion attack.t1070.006 ·
Share on:

Detect scenarios where a potentially unauthorized application or user is modifying the system time.

Read More
Uncommon AppX Package Locations

Dec 9, 2025 · attack.defense-evasion ·
Share on:

Detects an appx package added the pipeline of the "to be processed" packages which is located in uncommon locations

Read More
WMIC Loading Scripting Libraries

Dec 9, 2025 · attack.defense-evasion attack.t1220 ·
Share on:

Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the /FORMAT argument switch to download and execute an XSL file (i.e js, vbs, etc).

Read More
Load Of RstrtMgr.DLL By An Uncommon Process

Dec 9, 2025 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·
Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Read More
Rare Remote Thread Creation By Uncommon Source Image

Dec 9, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects uncommon processes creating remote threads.

Read More
Wow6432Node CurrentVersion Autorun Keys Modification

Dec 9, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CredUI.DLL Loaded By Uncommon Process

Dec 9, 2025 · attack.credential-access attack.collection attack.t1056.002 ·
Share on:

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

Read More
Desktop.INI Created by Uncommon Process

Dec 9, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Read More
Renamed Office Binary Execution

Dec 9, 2025 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed office binary

Read More
GUI Input Capture - macOS

Dec 9, 2025 · attack.collection attack.credential-access attack.t1056.002 ·
Share on:

Detects attempts to use system dialog prompts to capture user credentials

Read More
ASLR Disabled Via Sysctl or Direct Syscall - Linux

Dec 8, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1562.001 attack.t1055.009 ·
Share on:
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use of the personality syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
- Modification of the /proc/sys/kernel/randomize_va_space file
- Execution of the sysctl command to set kernel.randomize_va_space=0 Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms. A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.
Read More
Audio Capture

Dec 8, 2025 · attack.collection attack.t1123 ·
Share on:

Detects attempts to record audio using the arecord and ecasound utilities.

Read More
Auditing Configuration Changes on Linux Host

Dec 8, 2025 · attack.defense-evasion attack.t1562.006 ·
Share on:

Detect changes in auditd configuration files

Read More
Binary Padding - Linux

Dec 8, 2025 · attack.defense-evasion attack.t1027.001 ·
Share on:

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Read More
BPFDoor Abnormal Process ID or Lock File Accessed

Dec 8, 2025 · attack.execution attack.t1106 attack.t1059 ·
Share on:

detects BPFDoor .lock and .pid files access in temporary file storage facility

Read More
Bpfdoor TCP Ports Redirect

Dec 8, 2025 · attack.defense-evasion attack.t1562.004 ·
Share on:

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

Read More
Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall

Dec 8, 2025 · attack.defense-evasion attack.t1070.002 ·
Share on:

Detects the use of the syslog syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation or privilege escalation. A common technique is running dmesg -c, which triggers this syscall internally.

Read More
Clipboard Collection of Image Data with Xclip Tool

Dec 8, 2025 · attack.collection attack.t1115 ·
Share on:

Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Read More
Clipboard Collection with Xclip Tool - Auditd

Dec 8, 2025 · attack.collection attack.t1115 ·
Share on:

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Read More
Creation Of An User Account

Dec 8, 2025 · attack.t1136.001 attack.persistence ·
Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Read More
Credentials In Files - Linux

Dec 8, 2025 · attack.credential-access attack.t1552.001 ·
Share on:

Detecting attempts to extract passwords with grep

Read More
Data Compressed

Dec 8, 2025 · attack.exfiltration attack.collection attack.t1560.001 ·
Share on:

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Read More
Data Exfiltration with Wget

Dec 8, 2025 · attack.exfiltration attack.t1048.003 ·
Share on:

Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.

Read More
Disable System Firewall

Dec 8, 2025 · attack.t1562.004 attack.defense-evasion ·
Share on:

Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.

Read More
File or Folder Permissions Change

Dec 8, 2025 · attack.defense-evasion attack.t1222.002 ·
Share on:

Detects file and folder permission changes.

Read More
File Time Attribute Change - Linux

Dec 8, 2025 · attack.defense-evasion attack.t1070.006 ·
Share on:

Detect file time attribute change to hide new or changes to existing files.

Read More
Hidden Files and Directories

Dec 8, 2025 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

Read More
Linux Capabilities Discovery

Dec 8, 2025 · attack.discovery attack.defense-evasion attack.privilege-escalation attack.t1083 attack.t1548 ·
Share on:

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

Read More
Linux Network Service Scanning - Auditd

Dec 8, 2025 · attack.discovery attack.t1046 ·
Share on:

Detects enumeration of local or remote network services.

Read More
Loading of Kernel Module via Insmod

Dec 8, 2025 · attack.persistence attack.privilege-escalation attack.t1547.006 ·
Share on:

Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

Read More
Logging Configuration Changes on Linux Host

Dec 8, 2025 · attack.defense-evasion attack.t1562.006 ·
Share on:

Detect changes of syslog daemons configuration files

Read More
Masquerading as Linux Crond Process

Dec 8, 2025 · attack.defense-evasion attack.t1036.003 ·
Share on:

Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.

Read More
Modification of ld.so.preload

Dec 8, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.006 ·
Share on:

Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.

Read More
Modify System Firewall

Dec 8, 2025 · attack.t1562.004 attack.defense-evasion ·
Share on:

Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this.

Read More
Network Sniffing - Linux

Dec 8, 2025 · attack.credential-access attack.discovery attack.t1040 ·
Share on:

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Read More
Overwriting the File with Dev Zero or Null

Dec 8, 2025 · attack.impact attack.t1485 ·
Share on:

Detects overwriting (effectively wiping/deleting) of a file.

Read More
Possible Coin Miner CPU Priority Param

Dec 8, 2025 · attack.privilege-escalation attack.t1068 ·
Share on:

Detects command line parameter very often used with coin miners

Read More
Potential Abuse of Linux Magic System Request Key

Dec 8, 2025 · attack.execution attack.t1059.004 attack.impact attack.t1529 attack.t1489 attack.t1499 ·
Share on:

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

Read More
Program Executions in Suspicious Folders

Dec 8, 2025 · attack.t1587 attack.t1584 attack.resource-development ·
Share on:

Detects program executions in suspicious non-program folders related to malware or hacking activity

Read More
Remove Immutable File Attribute - Auditd

Dec 8, 2025 · attack.defense-evasion attack.t1222.002 ·
Share on:

Detects removing immutable file attribute.

Read More
Screen Capture with Import Tool

Dec 8, 2025 · attack.collection attack.t1113 ·
Share on:

Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed.

Read More
Screen Capture with Xwd

Dec 8, 2025 · attack.collection attack.t1113 ·
Share on:

Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations

Read More
Service Reload or Start - Linux

Dec 8, 2025 · attack.privilege-escalation attack.persistence attack.t1543.002 ·
Share on:

Detects the start, reload or restart of a service.

Read More
Special File Creation via Mknod Syscall

Dec 8, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects usage of the mknod syscall to create special files (e.g., character or block devices). Attackers or malware might use mknod to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of mknod is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors.

Read More
Split A File Into Pieces - Linux

Dec 8, 2025 · attack.exfiltration attack.t1030 ·
Share on:

Detection use of the command "split" to split files into parts and possible transfer.

Read More
Steganography Extract Files with Steghide

Dec 8, 2025 · attack.defense-evasion attack.t1027.003 ·
Share on:

Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

Read More
Steganography Hide Files with Steghide

Dec 8, 2025 · attack.defense-evasion attack.t1027.003 ·
Share on:

Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

Read More
Steganography Hide Zip Information in Picture File

Dec 8, 2025 · attack.defense-evasion attack.t1027.003 ·
Share on:

Detects appending of zip file to image

Read More
Steganography Unzip Hidden Information From Picture File

Dec 8, 2025 · attack.defense-evasion attack.t1027.003 ·
Share on:

Detects extracting of zip file from image file

Read More
Suspicious Commands Linux

Dec 8, 2025 · attack.execution attack.t1059.004 ·
Share on:

Detects relevant commands often related to malware or hacking activity

Read More
Suspicious History File Operations - Linux

Dec 8, 2025 · attack.credential-access attack.t1552.003 ·
Share on:

Detects commandline operations on shell history files

Read More
System and Hardware Information Discovery

Dec 8, 2025 · attack.discovery attack.t1082 ·
Share on:

Detects system information discovery commands

Read More
System Info Discovery via Sysinfo Syscall

Dec 8, 2025 · attack.discovery attack.t1057 attack.t1082 ·
Share on:

Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.

Read More
System Owner or User Discovery - Linux

Dec 8, 2025 · attack.discovery attack.t1033 ·
Share on:

Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Read More
System Shutdown/Reboot - Linux

Dec 8, 2025 · attack.impact attack.t1529 ·
Share on:

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Read More
Systemd Service Creation

Dec 8, 2025 · attack.privilege-escalation attack.persistence attack.t1543.002 ·
Share on:

Detects a creation of systemd services which could be used by adversaries to execute malicious code.

Read More
Unix Shell Configuration Modification

Dec 8, 2025 · attack.privilege-escalation attack.persistence attack.t1546.004 ·
Share on:

Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.

Read More
Use Of Hidden Paths Or Files

Dec 8, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects calls to hidden files or files located in hidden directories in NIX systems.

Read More
Webshell Remote Command Execution

Dec 8, 2025 · attack.persistence attack.t1505.003 ·
Share on:

Detects possible command execution by web application/web shell

Read More
Github Self-Hosted Runner Execution

Dec 3, 2025 · attack.command-and-control attack.t1102.002 attack.t1071 ·
Share on:

Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. Shai-Hulud is an npm supply chain worm targeting CI/CD environments. It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.

Read More
Suspicious Download Via Certutil.EXE

Dec 3, 2025 · attack.defense-evasion attack.t1027 attack.command-and-control attack.t1105 ·
Share on:

Detects the execution of certutil with certain flags that allow the utility to download files.

Read More
Suspicious File Downloaded From Direct IP Via Certutil.EXE

Dec 3, 2025 · attack.defense-evasion attack.t1027 attack.command-and-control attack.t1105 ·
Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Read More
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE

Dec 3, 2025 · attack.defense-evasion attack.t1027 attack.command-and-control attack.t1105 ·
Share on:

Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

Read More
AWS GuardDuty Detector Deleted Or Updated

Nov 28, 2025 · attack.defense-evasion attack.t1562.001 attack.t1562.008 ·
Share on:

Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. Verify with the user identity that this activity is legitimate.

Read More
LOL-Binary Copied From System Directory

Nov 27, 2025 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

Read More
Suspicious Copy From or To System Directory

Nov 27, 2025 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk. Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.

Read More
Renamed Schtasks Execution

Nov 27, 2025 · attack.defense-evasion attack.execution attack.persistence attack.privilege-escalation attack.t1036.003 attack.t1053.005 ·
Share on:

Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks. One of the very common persistence techniques is schedule malicious tasks using schtasks.exe. Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.

Read More
DNS Query by Finger Utility

Nov 27, 2025 · attack.command-and-control attack.t1071.004 attack.execution attack.t1059.003 ·
Share on:

Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.

Read More
FileFix - Command Evidence in TypedPaths

Nov 27, 2025 · attack.execution attack.t1204.004 ·
Share on:

Detects commonly-used chained commands and strings in the most recent 'url' value of the 'TypedPaths' key, which could be indicative of a user being targeted by the FileFix technique.

Read More
Finger.EXE Execution

Nov 27, 2025 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

Read More
Network Connection Initiated via Finger.EXE

Nov 27, 2025 · attack.command-and-control attack.t1071.004 attack.execution attack.t1059.003 ·
Share on:

Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such network connections can also help identify potential malicious infrastructure used by threat actors

Read More
Potential ClickFix Execution Pattern - Registry

Nov 27, 2025 · attack.execution attack.t1204.001 ·
Share on:

Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links. ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages. Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content, such as one-liners that execute remotely hosted malicious files or scripts.

Read More
Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix

Nov 27, 2025 · attack.execution attack.t1204.004 attack.defense-evasion attack.t1027.010 ·
Share on:

Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection. ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar. The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.

Read More
Suspicious FileFix Execution Pattern

Nov 27, 2025 · attack.execution attack.t1204.004 ·
Share on:

Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation. This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms, which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content. The clipboard content usually contains commands that download and execute malware, such as information stealing tools.

Read More
Grixba Malware Reconnaissance Activity

Nov 27, 2025 · attack.reconnaissance attack.t1595.001 attack.discovery attack.t1046 detection.emerging-threats ·
Share on:

Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations. This tool is used by the Play ransomware group for network enumeration, data gathering, and event log clearing.

Read More
DNS Query to External Service Interaction Domains

Nov 26, 2025 · attack.initial-access attack.t1190 attack.reconnaissance attack.t1595.002 ·
Share on:

Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE

Read More
Add Port Monitor Persistence in Registry

Nov 26, 2025 · attack.privilege-escalation attack.persistence attack.t1547.010 ·
Share on:

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Read More
Add SafeBoot Keys Via Reg Utility

Nov 26, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

Read More
Advanced IP Scanner - File Event

Nov 26, 2025 · attack.discovery attack.t1046 ·
Share on:

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Read More
Allow RDP Remote Assistance Feature

Nov 26, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

Read More
Anydesk Temporary Artefact

Nov 26, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Bypass UAC Using DelegateExecute

Nov 26, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Bypasses User Account Control using a fileless method

Read More
Bypass UAC Using Event Viewer

Nov 26, 2025 · attack.privilege-escalation attack.persistence attack.t1547.010 ·
Share on:

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

Read More
Bypass UAC Using SilentCleanup Task

Nov 26, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.

Read More
Certificate Exported Via Certutil.EXE

Nov 26, 2025 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

Read More
Change Default File Association Via Assoc

Nov 26, 2025 · attack.privilege-escalation attack.persistence attack.t1546.001 ·
Share on:

Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Read More
Chromium Browser Headless Execution To Mockbin Like Site

Nov 26, 2025 · attack.execution ·
Share on:

Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).

Read More
Chromium Browser Instance Executed With Custom Extension

Nov 26, 2025 · attack.persistence attack.t1176.001 ·
Share on:

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

Read More
Console CodePage Lookup Via CHCP

Nov 26, 2025 · attack.discovery attack.t1614.001 ·
Share on:

Detects use of chcp to look up the system locale value as part of host discovery

Read More
Creation of a Local Hidden User Account by Registry

Nov 26, 2025 · attack.persistence attack.t1136.001 ·
Share on:

Sysmon registry detection of a local hidden user account.

Read More
Creation Of Non-Existent System DLL

Nov 26, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). Usually this technique is used to achieve DLL hijacking.

Read More
Cred Dump Tools Dropped Files

Nov 26, 2025 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.003 attack.t1003.004 attack.t1003.005 ·
Share on:

Files with well-known filenames (parts of credential dump software or files produced by them) creation

Read More
Data Copied To Clipboard Via Clip.EXE

Nov 26, 2025 · attack.collection attack.t1115 ·
Share on:

Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Read More
Default RDP Port Changed to Non Standard Port

Nov 26, 2025 · attack.privilege-escalation attack.persistence attack.t1547.010 ·
Share on:

Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Read More
Deleted Data Overwritten Via Cipher.EXE

Nov 26, 2025 · attack.impact attack.t1485 ·
Share on:

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

Read More
Directory Removal Via Rmdir

Nov 26, 2025 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Read More
DirLister Execution

Nov 26, 2025 · attack.discovery attack.t1083 ·
Share on:

Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

Read More
Disable Administrative Share Creation at Startup

Nov 26, 2025 · attack.defense-evasion attack.t1070.005 ·
Share on:

Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system

Read More
Disable Microsoft Defender Firewall via Registry

Nov 26, 2025 · attack.defense-evasion attack.t1562.004 ·
Share on:

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage

Read More
Disable Windows Security Center Notifications

Nov 26, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect set UseActionCenterExperience to 0 to disable the Windows security center notification

Read More
Dism Remove Online Package

Nov 26, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Read More
Domain Trust Discovery Via Dsquery

Nov 26, 2025 · attack.discovery attack.t1482 ·
Share on:

Detects execution of "dsquery.exe" for domain trust discovery

Read More
DriverQuery.EXE Execution

Nov 26, 2025 · attack.discovery ·
Share on:

Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers

Read More
EVTX Created In Uncommon Location

Nov 26, 2025 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting.

Read More
File And SubFolder Enumeration Via Dir Command

Nov 26, 2025 · attack.discovery attack.t1217 ·
Share on:

Detects usage of the "dir" command part of Windows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories.

Read More
File Decoded From Base64/Hex Via Certutil.EXE

Nov 26, 2025 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

Read More
File Download From Browser Process Via Inline URL

Nov 26, 2025 · attack.command-and-control attack.t1105 ·
Share on:

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

Read More
File Download with Headless Browser

Nov 26, 2025 · attack.defense-evasion attack.command-and-control attack.t1105 attack.t1564.003 ·
Share on:

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Read More
File Encoded To Base64 Via Certutil.EXE

Nov 26, 2025 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration

Read More
File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell

Nov 26, 2025 · attack.discovery attack.t1135 ·
Share on:

Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.

Read More
File In Suspicious Location Encoded To Base64 Via Certutil.EXE

Nov 26, 2025 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

Read More
Files With System DLL Name In Unsuspected Locations

Nov 26, 2025 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.). It is highly recommended to perform an initial baseline before using this rule in production.

Read More
Findstr GPP Passwords

Nov 26, 2025 · attack.credential-access attack.t1552.006 ·
Share on:

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

Read More
Gpresult Display Group Policy Information

Nov 26, 2025 · attack.discovery attack.t1615 ·
Share on:

Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information

Read More
HH.EXE Execution

Nov 26, 2025 · attack.defense-evasion attack.t1218.001 ·
Share on:

Detects the execution of "hh.exe" to open ".chm" files.

Read More
Hiding User Account Via SpecialAccounts Registry Key

Nov 26, 2025 · attack.defense-evasion attack.t1564.002 ·
Share on:

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Read More
Hiding User Account Via SpecialAccounts Registry Key - CommandLine

Nov 26, 2025 · attack.defense-evasion attack.t1564.002 ·
Share on:

Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Read More
Hypervisor Enforced Code Integrity Disabled

Nov 26, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel

Read More
IE Change Domain Zone

Nov 26, 2025 · attack.persistence attack.t1137 ·
Share on:

Hides the file extension through modification of the registry

Read More
LSASS Process Memory Dump Creation Via Taskmgr.EXE

Nov 26, 2025 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.

Read More
LSASS Process Reconnaissance Via Findstr.EXE

Nov 26, 2025 · attack.credential-access attack.t1552.006 ·
Share on:

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

Read More
New Custom Shim Database Created

Nov 26, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

Read More
New Generic Credentials Added Via Cmdkey.EXE

Nov 26, 2025 · attack.credential-access attack.t1003.005 ·
Share on:

Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP session via command line interface.

Read More
New Root Certificate Installed Via Certutil.EXE

Nov 26, 2025 · attack.defense-evasion attack.t1553.004 ·
Share on:

Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Read More
Permission Misconfiguration Reconnaissance Via Findstr.EXE

Nov 26, 2025 · attack.credential-access attack.t1552.006 ·
Share on:

Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.

Read More
Potential COM Object Hijacking Via TreatAs Subkey - Registry

Nov 26, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects COM object hijacking via TreatAs subkey

Read More
Potential Defense Evasion Via Binary Rename

Nov 26, 2025 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Read More
Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Nov 26, 2025 · attack.defense-evasion attack.t1036.003 car.2013-05-009 ·
Share on:

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Read More
Potential NTLM Coercion Via Certutil.EXE

Nov 26, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects possible NTLM coercion via certutil using the 'syncwithWU' flag

Read More
Potential Persistence Attempt Via Run Keys Using Reg.EXE

Nov 26, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects suspicious command line reg.exe tool adding key to RUN key in Registry

Read More
Potential Persistence Via Logon Scripts - Registry

Nov 26, 2025 · attack.privilege-escalation attack.t1037.001 attack.persistence attack.lateral-movement ·
Share on:

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

Read More
Potential Persistence Via New AMSI Providers - Registry

Nov 26, 2025 · attack.persistence ·
Share on:

Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections. Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content. This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.

Read More
Potential Privilege Escalation Using Symlink Between Osk and Cmd

Nov 26, 2025 · attack.privilege-escalation attack.persistence attack.t1546.008 ·
Share on:

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

Read More
Potential Recon Activity Using DriverQuery.EXE

Nov 26, 2025 · attack.discovery ·
Share on:

Detect usage of the "driverquery" utility to perform reconnaissance on installed drivers

Read More
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

Nov 26, 2025 · attack.credential-access attack.t1003.005 ·
Share on:

Detects usage of cmdkey to look for cached credentials on the system

Read More
Potentially Suspicious DMP/HDMP File Creation

Nov 26, 2025 · attack.defense-evasion ·
Share on:

Detects the creation of a file with the ".dmp"/".hdmp" extension by a shell or scripting application such as "cmd", "powershell", etc. Often created by software during a crash. Memory dumps can sometimes contain sensitive information such as credentials. It's best to determine the source of the crash.

Read More
Powershell Executed From Headless ConHost Process

Nov 26, 2025 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1059.003 attack.t1564.003 ·
Share on:

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

Read More
PowerShell Logging Disabled Via Registry Key Tampering

Nov 26, 2025 · attack.defense-evasion attack.t1564.001 attack.t1112 attack.persistence ·
Share on:

Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

Read More
PUA - AdFind Suspicious Execution

Nov 26, 2025 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 stp.1u ·
Share on:

Detects AdFind execution with common flags seen used during attacks

Read More
PUA - AdFind.EXE Execution

Nov 26, 2025 · attack.discovery attack.t1087.002 ·
Share on:

Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment

Read More
PUA - Advanced IP Scanner Execution

Nov 26, 2025 · attack.discovery attack.t1046 attack.t1135 ·
Share on:

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Read More
PUA - Advanced Port Scanner Execution

Nov 26, 2025 · attack.discovery attack.t1046 attack.t1135 ·
Share on:

Detects the use of Advanced Port Scanner.

Read More
PUA - AdvancedRun Execution

Nov 26, 2025 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·
Share on:

Detects the execution of AdvancedRun utility

Read More
PUA - AdvancedRun Suspicious Execution

Nov 26, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134.002 ·
Share on:

Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

Read More
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE

Nov 26, 2025 · attack.discovery attack.t1087.002 ·
Share on:

Detects active directory enumeration activity using known AdFind CLI flags

Read More
PUA - Sysinternal Tool Execution - Registry

Nov 26, 2025 · attack.resource-development attack.t1588.002 ·
Share on:

Detects the execution of a Sysinternals Tool via the creation of the "accepteula" registry key

Read More
PUA - Sysinternals Tools Execution - Registry

Nov 26, 2025 · attack.resource-development attack.t1588.002 ·
Share on:

Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key.

Read More
Recon Command Output Piped To Findstr.EXE

Nov 26, 2025 · attack.discovery attack.t1057 ·
Share on:

Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this technique to extract specific information they require in their reconnaissance phase.

Read More
Registry Persistence via Service in Safe Mode

Nov 26, 2025 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Read More
Removal Of AMSI Provider Registry Keys

Nov 26, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.

Read More
Removal Of Index Value to Hide Schedule Task - Registry

Nov 26, 2025 · attack.defense-evasion attack.t1562 ·
Share on:

Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"

Read More
Removal Of SD Value to Hide Schedule Task - Registry

Nov 26, 2025 · attack.defense-evasion attack.t1562 ·
Share on:

Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware

Read More
Renamed AdFind Execution

Nov 26, 2025 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 ·
Share on:

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Read More
Renamed CURL.EXE Execution

Nov 26, 2025 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

Read More
Renamed FTP.EXE Execution

Nov 26, 2025 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields

Read More
Renamed Msdt.EXE Execution

Nov 26, 2025 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed "Msdt.exe" binary

Read More
RunMRU Registry Key Deletion - Registry

Nov 26, 2025 · attack.defense-evasion attack.t1070.003 ·
Share on:

Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands.

Read More
Security Tools Keyword Lookup Via Findstr.EXE

Nov 26, 2025 · attack.discovery attack.t1518.001 ·
Share on:

Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results. This detection focuses on the keywords that the attacker might use as a filter.

Read More
Stop Windows Service Via Sc.EXE

Nov 26, 2025 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service via the "sc.exe" utility

Read More
Suspicious Binaries and Scripts in Public Folder

Nov 26, 2025 · attack.execution attack.t1204 ·
Share on:

Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.

Read More
Suspicious Chromium Browser Instance Executed With Custom Extension

Nov 26, 2025 · attack.persistence attack.t1176.001 ·
Share on:

Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension

Read More
Suspicious CodePage Switch Via CHCP

Nov 26, 2025 · attack.t1036 attack.defense-evasion ·
Share on:

Detects a code page switch in command line or batch scripts to a rare language

Read More
Suspicious Curl.EXE Download

Nov 26, 2025 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

Read More
Suspicious Execution Of Renamed Sysinternals Tools - Registry

Nov 26, 2025 · attack.resource-development attack.t1588.002 ·
Share on:

Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool)

Read More
Suspicious File Creation Activity From Fake Recycle.Bin Folder

Nov 26, 2025 · attack.persistence attack.defense-evasion ·
Share on:

Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware

Read More
Suspicious File Encoded To Base64 Via Certutil.EXE

Nov 26, 2025 · attack.defense-evasion attack.t1027 ·
Share on:

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious

Read More
Suspicious Kernel Dump Using Dtrace

Nov 26, 2025 · attack.discovery attack.t1082 ·
Share on:

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

Read More
Suspicious LNK Double Extension File Created

Nov 26, 2025 · attack.defense-evasion attack.t1036.007 ·
Share on:

Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.

Read More
Sysmon Configuration Change

Nov 26, 2025 · attack.defense-evasion ·
Share on:

Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration

Read More
System Information Discovery via Registry Queries

Nov 26, 2025 · attack.discovery attack.t1082 ·
Share on:

Detects attempts to query system information directly from the Windows Registry.

Read More
Tor Client/Browser Execution

Nov 26, 2025 · attack.command-and-control attack.t1090.003 ·
Share on:

Detects the use of Tor or Tor-Browser to connect to onion routing networks

Read More
ArcSOC.exe Creating Suspicious Files

Nov 25, 2025 · attack.defense-evasion attack.command-and-control attack.persistence attack.t1127 attack.t1105 attack.t1133 ·
Share on:

Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates files with suspicious file types, indicating that they may be executables, script files, or otherwise unusual.

Read More
Suspicious ArcSOC.exe Child Process

Nov 25, 2025 · attack.execution attack.t1059 attack.t1203 ·
Share on:

This rule detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding service endpoint and remotely execute code from the ArcSOC.exe process.

Read More
Potential Container Discovery Via Inodes Listing

Nov 25, 2025 · attack.discovery attack.t1082 ·
Share on:

Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.

Read More
Boot Configuration Tampering Via Bcdedit.EXE

Nov 25, 2025 · attack.impact attack.t1490 ·
Share on:

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

Read More
Interactive AT Job

Nov 25, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1053.002 ·
Share on:

Detects an interactive AT job, which may be used as a form of privilege escalation.

Read More
Potential Persistence Via Disk Cleanup Handler - Registry

Nov 25, 2025 · attack.persistence ·
Share on:

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

Read More
Unsigned .node File Loaded

Nov 25, 2025 · attack.execution attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1129 attack.t1574.001 attack.t1036.005 ·
Share on:

Detects the loading of unsigned .node files. Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack. .node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code. This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.

Read More
Suspicious Filename with Embedded Base64 Commands

Nov 24, 2025 · attack.execution attack.t1059.004 attack.defense-evasion attack.t1027 ·
Share on:

Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.

Read More
Abused Debug Privilege by Arbitrary Parent Processes

Nov 24, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detection of unusual child processes by different system processes

Read More
Active Directory Replication from Non Machine Account

Nov 24, 2025 · attack.credential-access attack.t1003.006 ·
Share on:

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

Read More
Always Install Elevated MSI Spawned Cmd And Powershell

Nov 24, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

Read More
APT User Agent

Nov 24, 2025 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used in APT malware in proxy logs

Read More
Arbitrary Shell Command Execution Via Settingcontent-Ms

Nov 24, 2025 · attack.t1204 attack.t1566.001 attack.execution attack.initial-access ·
Share on:

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Read More
AWS IAM Backdoor Users Keys

Nov 24, 2025 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

Read More
AWS SecurityHub Findings Evasion

Nov 24, 2025 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the modification of the findings on SecurityHub.

Read More
Bitsadmin to Uncommon TLD

Nov 24, 2025 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

Read More
Bypass UAC via CMSTP

Nov 24, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 attack.t1218.003 ·
Share on:

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Read More
Bypass UAC via Fodhelper.exe

Nov 24, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

Read More
Cisco ASA FTD Exploit CVE-2020-3452

Nov 24, 2025 · attack.t1190 attack.initial-access cve.2020-3452 detection.emerging-threats ·
Share on:

Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code of 200 (sccessful exploitation)

Read More
Cisco BGP Authentication Failures

Nov 24, 2025 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Read More
Cisco Denial of Service

Nov 24, 2025 · attack.impact attack.t1495 attack.t1529 attack.t1565.001 ·
Share on:

Detect a system being shutdown or put into different boot mode

Read More
Cisco Disabling Logging

Nov 24, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Turn off logging locally or remote

Read More
Cisco File Deletion

Nov 24, 2025 · attack.defense-evasion attack.impact attack.t1070.004 attack.t1561.001 attack.t1561.002 ·
Share on:

See what files are being deleted from flash file systems

Read More
Cisco LDP Authentication Failures

Nov 24, 2025 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Read More
Cisco Local Accounts

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1136.001 attack.t1098 ·
Share on:

Find local accounts being created or modified as well as remote authentication configurations

Read More
Cisco Modify Configuration

Nov 24, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.impact attack.t1490 attack.t1505 attack.t1565.002 attack.t1053 ·
Share on:

Modifications to a config that will serve an adversary's impacts or persistence

Read More
Cisco Show Commands Input

Nov 24, 2025 · attack.credential-access attack.t1552.003 ·
Share on:

See what commands are being input into the device by other people, full credentials can be in the history

Read More
Cisco Sniffing

Nov 24, 2025 · attack.credential-access attack.discovery attack.t1040 ·
Share on:

Show when a monitor or a span/rspan is setup or modified

Read More
Cisco Stage Data

Nov 24, 2025 · attack.collection attack.lateral-movement attack.command-and-control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·
Share on:

Various protocols maybe used to put data on the device for exfil or infil

Read More
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195

Nov 24, 2025 · attack.initial-access attack.t1190 cve.2020-8193 cve.2020-8195 detection.emerging-threats ·
Share on:

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Read More
Citrix Netscaler Attack CVE-2019-19781

Nov 24, 2025 · attack.initial-access attack.t1190 cve.2019-19781 detection.emerging-threats ·
Share on:

Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack

Read More
Clipboard Data Collection Via OSAScript

Nov 24, 2025 · attack.collection attack.execution attack.t1115 attack.t1059.002 ·
Share on:

Detects possible collection of data from the clipboard via execution of the osascript binary

Read More
CMSTP Execution Process Creation

Nov 24, 2025 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
CMSTP Execution Registry Event

Nov 24, 2025 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Read More
Command Line Execution with Suspicious URL and AppData Strings

Nov 24, 2025 · attack.execution attack.command-and-control attack.t1059.003 attack.t1059.001 attack.t1105 ·
Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Read More
Conti Volume Shadow Listing

Nov 24, 2025 · attack.t1587.001 attack.resource-development detection.emerging-threats ·
Share on:

Detects a command used by conti to find volume shadow backups

Read More
Cross Site Scripting Strings

Nov 24, 2025 · attack.initial-access attack.t1189 ·
Share on:

Detects XSS attempts injected via GET requests in access logs

Read More
Crypto Miner User Agent

Nov 24, 2025 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used by crypto miners in proxy logs

Read More
CurrentControlSet Autorun Keys Modification

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CVE-2020-0688 Exchange Exploitation via Web Log

Nov 24, 2025 · attack.initial-access attack.t1190 cve.2020-0688 detection.emerging-threats ·
Share on:

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

Read More
CVE-2020-5902 F5 BIG-IP Exploitation Attempt

Nov 24, 2025 · attack.initial-access attack.t1190 cve.2020-5902 detection.emerging-threats ·
Share on:

Detects the exploitation attempt of the vulnerability found in F5 BIG-IP and described in CVE-2020-5902

Read More
CVE-2021-1675 Print Spooler Exploitation

Nov 24, 2025 · attack.execution attack.t1569 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675

Read More
CVE-2021-26858 Exchange Exploitation

Nov 24, 2025 · attack.t1203 attack.execution cve.2021-26858 detection.emerging-threats ·
Share on:

Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

Read More
CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit

Nov 24, 2025 · attack.initial-access attack.t1190 attack.persistence attack.t1505.003 cve.2021-40539 detection.emerging-threats ·
Share on:

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

Read More
Default Cobalt Strike Certificate

Nov 24, 2025 · attack.command-and-control attack.s0154 ·
Share on:

Detects the presence of default Cobalt Strike certificate in the HTTPS traffic

Read More
Denied Access To Remote Desktop

Nov 24, 2025 · attack.lateral-movement attack.t1021.001 ·
Share on:

This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.

Read More
DEWMODE Webshell Access

Nov 24, 2025 · attack.persistence attack.t1505.003 detection.emerging-threats ·
Share on:

Detects access to DEWMODE webshell as described in FIREEYE report

Read More
Direct Autorun Keys Modification

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

Read More
Disable Security Events Logging Adding Reg Key MiniNt

Nov 24, 2025 · attack.persistence attack.defense-evasion attack.t1562.002 attack.t1112 car.2022-03-001 ·
Share on:

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.

Read More
DLL Execution Via Register-cimprovider.exe

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574 ·
Share on:

Detects using register-cimprovider.exe to execute arbitrary dll file.

Read More
DLL Loaded via CertOC.EXE

Nov 24, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.

Read More
DNS Events Related To Mining Pools

Nov 24, 2025 · attack.execution attack.t1569.002 attack.impact attack.t1496 ·
Share on:

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Read More
DNS TOR Proxies

Nov 24, 2025 · attack.exfiltration attack.t1048 ·
Share on:

Identifies IPs performing DNS lookups associated with common Tor proxies.

Read More
Download from Suspicious Dyndns Hosts

Nov 24, 2025 · attack.defense-evasion attack.command-and-control attack.t1105 attack.t1568 ·
Share on:

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Read More
Download From Suspicious TLD - Blacklist

Nov 24, 2025 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·
Share on:

Detects download of certain file types from hosts in suspicious TLDs

Read More
Download From Suspicious TLD - Whitelist

Nov 24, 2025 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·
Share on:

Detects executable downloads from suspicious remote systems

Read More
DPAPI Domain Master Key Backup Attempt

Nov 24, 2025 · attack.credential-access attack.t1003.004 ·
Share on:

Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.

Read More
Droppers Exploiting CVE-2017-11882

Nov 24, 2025 · attack.execution attack.t1203 attack.t1204.002 attack.initial-access attack.t1566.001 cve.2017-11882 detection.emerging-threats ·
Share on:

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Read More
Esentutl Gather Credentials

Nov 24, 2025 · attack.credential-access attack.t1003 attack.t1003.003 attack.s0404 ·
Share on:

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Read More
Execute Files with Msdeploy.exe

Nov 24, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects file execution using the msdeploy.exe lolbin

Read More
Execution of Powershell Script in Public Folder

Nov 24, 2025 · attack.execution attack.t1059.001 ·
Share on:

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

Read More
Exploit Framework User Agent

Nov 24, 2025 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

Read More
Exploitation of CVE-2021-26814 in Wazuh

Nov 24, 2025 · attack.initial-access attack.t1190 cve.2021-21978 cve.2021-26814 detection.emerging-threats ·
Share on:

Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814

Read More
Exports Critical Registry Keys To a File

Nov 24, 2025 · attack.exfiltration attack.discovery attack.t1012 ·
Share on:

Detects the export of a crital Registry key to a file.

Read More
Exports Registry Key To a File

Nov 24, 2025 · attack.exfiltration attack.discovery attack.t1012 ·
Share on:

Detects the export of the target Registry key to a file.

Read More
Exports Registry Key To an Alternate Data Stream

Nov 24, 2025 · attack.defense-evasion attack.t1564.004 ·
Share on:

Exports the target Registry key and hides it in the specified alternate data stream.

Read More
Failed MSExchange Transport Agent Installation

Nov 24, 2025 · attack.persistence attack.t1505.002 ·
Share on:

Detects a failed installation of a Exchange Transport Agent

Read More
File Download Via Bitsadmin

Nov 24, 2025 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file

Read More
File Download Via Bitsadmin To An Uncommon Target Folder

Nov 24, 2025 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file to uncommon target folder

Read More
File Was Not Allowed To Run

Nov 24, 2025 · attack.execution attack.t1204.002 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.006 attack.t1059.007 ·
Share on:

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

Read More
Fireball Archer Install

Nov 24, 2025 · attack.execution attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects Archer malware invocation via rundll32

Read More
Formbook Process Creation

Nov 24, 2025 · attack.resource-development attack.t1587.001 detection.emerging-threats ·
Share on:

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

Read More
Fortinet CVE-2018-13379 Exploitation

Nov 24, 2025 · attack.initial-access attack.t1190 cve.2018-13379 detection.emerging-threats ·
Share on:

Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs

Read More
Fortinet CVE-2021-22123 Exploitation

Nov 24, 2025 · attack.initial-access attack.t1190 cve.2021-22123 detection.emerging-threats ·
Share on:

Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs

Read More
Grafana Path Traversal Exploitation CVE-2021-43798

Nov 24, 2025 · attack.initial-access attack.t1190 cve.2021-43798 detection.emerging-threats ·
Share on:

Detects a successful Grafana path traversal exploitation

Read More
Hack Tool User Agent

Nov 24, 2025 · attack.initial-access attack.t1190 attack.credential-access attack.t1110 ·
Share on:

Detects suspicious user agent strings user by hack tools in proxy logs

Read More
HackTool - CrackMapExec Execution

Nov 24, 2025 · attack.execution attack.persistence attack.privilege-escalation attack.credential-access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·
Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Read More
HackTool - CrackMapExec PowerShell Obfuscation

Nov 24, 2025 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027.005 ·
Share on:

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

Read More
HackTool - Empire PowerShell UAC Bypass

Nov 24, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects some Empire PowerShell UAC bypass methods

Read More
HackTool - Koadic Execution

Nov 24, 2025 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·
Share on:

Detects command line parameters used by Koadic hack tool

Read More
HackTool - Potential Impacket Lateral Movement Activity

Nov 24, 2025 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

Read More
Huawei BGP Authentication Failures

Nov 24, 2025 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Read More
Imports Registry Key From a File

Nov 24, 2025 · attack.persistence attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of the specified file to the registry with regedit.exe.

Read More
Imports Registry Key From an ADS

Nov 24, 2025 · attack.persistence attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of a alternate datastream to the registry with regedit.exe.

Read More
Indirect Command Execution By Program Compatibility Wizard

Nov 24, 2025 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detect indirect command execution via Program Compatibility Assistant pcwrun.exe

Read More
InfDefaultInstall.exe .inf Execution

Nov 24, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.

Read More
InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Nov 24, 2025 · attack.privilege-escalation attack.t1068 detection.emerging-threats ·
Share on:

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Read More
Internet Explorer Autorun Keys Modification

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
ISO File Created Within Temp Folders

Nov 24, 2025 · attack.initial-access attack.t1566.001 ·
Share on:

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

Read More
Java Running with Remote Debugging

Nov 24, 2025 · attack.t1203 attack.execution ·
Share on:

Detects a JAVA process running with remote debugging allowing more than just localhost to connect

Read More
JexBoss Command Sequence

Nov 24, 2025 · attack.execution attack.t1059.004 ·
Share on:

Detects suspicious command sequence that JexBoss

Read More
Juniper BGP Missing MD5

Nov 24, 2025 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Read More
JXA In-memory Execution Via OSAScript

Nov 24, 2025 · attack.t1059.002 attack.t1059.007 attack.execution ·
Share on:

Detects possible malicious execution of JXA in-memory via OSAScript

Read More
LOLBAS Data Exfiltration by DataSvcUtil.exe

Nov 24, 2025 · attack.exfiltration attack.t1567 ·
Share on:

Detects when a user performs data exfiltration by using DataSvcUtil.exe

Read More
Metasploit Or Impacket Service Installation Via SMB PsExec

Nov 24, 2025 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·
Share on:

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Read More
MMC Spawning Windows Shell

Nov 24, 2025 · attack.lateral-movement attack.t1021.003 ·
Share on:

Detects a Windows command line executable started from MMC

Read More
MSExchange Transport Agent Installation

Nov 24, 2025 · attack.persistence attack.t1505.002 ·
Share on:

Detects the Installation of a Exchange Transport Agent

Read More
MSExchange Transport Agent Installation - Builtin

Nov 24, 2025 · attack.persistence attack.t1505.002 ·
Share on:

Detects the Installation of a Exchange Transport Agent

Read More
New ActiveScriptEventConsumer Created Via Wmic.EXE

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence

Read More
New DLL Added to AppCertDlls Registry Key

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1546.009 ·
Share on:

Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

Read More
New Kind of Network (NKN) Detection

Nov 24, 2025 · attack.command-and-control ·
Share on:

NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>

Read More
Node Process Executions

Nov 24, 2025 · attack.defense-evasion attack.execution attack.t1127 attack.t1059.007 ·
Share on:

Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud

Read More
Office Autorun Keys Modification

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Oracle WebLogic Exploit

Nov 24, 2025 · attack.t1190 attack.initial-access attack.persistence attack.t1505.003 cve.2018-2894 detection.emerging-threats ·
Share on:

Detects access to a webshell dropped into a keystore folder on the WebLogic server

Read More
Oracle WebLogic Exploit CVE-2020-14882

Nov 24, 2025 · attack.t1190 attack.initial-access cve.2020-14882 detection.emerging-threats ·
Share on:

Detects exploitation attempts on WebLogic servers

Read More
Oracle WebLogic Exploit CVE-2021-2109

Nov 24, 2025 · attack.t1190 attack.initial-access cve.2021-2109 detection.emerging-threats ·
Share on:

Detects the exploitation of the WebLogic server vulnerability described in CVE-2021-2109

Read More
OSACompile Run-Only Execution

Nov 24, 2025 · attack.t1059.002 attack.execution ·
Share on:

Detects potential suspicious run-only executions compiled using OSACompile

Read More
Ping Hex IP

Nov 24, 2025 · attack.defense-evasion attack.t1140 attack.t1027 ·
Share on:

Detects a ping command that uses a hex encoded IP address

Read More
Possible CVE-2021-1675 Print Spooler Exploitation

Nov 24, 2025 · attack.execution attack.t1569 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

Read More
Potential CVE-2021-42278 Exploitation Attempt

Nov 24, 2025 · attack.credential-access attack.t1558.003 cve.2021-42278 detection.emerging-threats ·
Share on:

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Read More
Potential CVE-2023-23752 Exploitation Attempt

Nov 24, 2025 · attack.initial-access attack.t1190 cve.2023-23752 detection.emerging-threats ·
Share on:

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Read More
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection

Nov 24, 2025 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion cve.2024-3400 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect. This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.

Read More
Potential Emotet Activity

Nov 24, 2025 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 detection.emerging-threats ·
Share on:

Detects all Emotet like process executions that are not covered by the more generic rules

Read More
Potential File Overwrite Via Sysinternals SDelete

Nov 24, 2025 · attack.impact attack.t1485 ·
Share on:

Detects the use of SDelete to erase a file not the free space

Read More
Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation

Nov 24, 2025 · attack.collection attack.credential-access attack.t1557.003 attack.persistence attack.privilege-escalation ·
Share on:

Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,. where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.

Read More
Potential Maze Ransomware Activity

Nov 24, 2025 · attack.execution attack.t1204.002 attack.t1047 attack.impact attack.t1490 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Maze ransomware word document droppers

Read More
Potential Meterpreter/CobaltStrike Activity

Nov 24, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Read More
Potential PetitPotam Attack Via EFS RPC Calls

Nov 24, 2025 · attack.collection attack.credential-access attack.t1557.001 attack.t1187 ·
Share on:

Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'

Read More
Potential PlugX Activity

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.s0013 attack.defense-evasion attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location

Read More
Potential QBot Activity

Nov 24, 2025 · attack.execution attack.t1059.005 detection.emerging-threats ·
Share on:

Detects potential QBot activity by looking for process executions used previously by QBot

Read More
Potential Remote Desktop Connection to Non-Domain Host

Nov 24, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects logons using NTLM to hosts that are potentially not part of the domain.

Read More
Potential Ryuk Ransomware Activity

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects Ryuk ransomware activity

Read More
PowerShell Base64 Encoded Reflective Assembly Load

Nov 24, 2025 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 attack.t1620 ·
Share on:

Detects base64 encoded .NET reflective loading of Assembly

Read More
Process Access via TrolleyExpress Exclusion

Nov 24, 2025 · attack.defense-evasion attack.t1218.011 attack.credential-access attack.t1003.001 ·
Share on:

Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory

Read More
PUA - Mouse Lock Execution

Nov 24, 2025 · attack.credential-access attack.collection attack.t1056.002 ·
Share on:

In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.

Read More
PUA - NirCmd Execution

Nov 24, 2025 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity

Read More
PUA - NirCmd Execution As LOCAL SYSTEM

Nov 24, 2025 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of NirCmd tool for command execution as SYSTEM user

Read More
PUA - Rclone Execution

Nov 24, 2025 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Read More
PUA - RunXCmd Execution

Nov 24, 2025 · attack.execution attack.t1569.002 attack.s0029 ·
Share on:

Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts

Read More
Pulse Secure Attack CVE-2019-11510

Nov 24, 2025 · attack.initial-access attack.t1190 cve.2019-11510 detection.emerging-threats ·
Share on:

Detects CVE-2019-11510 exploitation attempt - URI contains Guacamole

Read More
PwnDrp Access

Nov 24, 2025 · attack.command-and-control attack.t1071.001 attack.t1102.001 attack.t1102.003 ·
Share on:

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Read More
Rclone Activity via Proxy

Nov 24, 2025 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

Read More
Registry Entries For Azorult Malware

Nov 24, 2025 · attack.defense-evasion attack.persistence attack.execution attack.t1112 ·
Share on:

Detects the presence of a registry key created during Azorult execution

Read More
Registry Modification Via Regini.EXE

Nov 24, 2025 · attack.persistence attack.t1112 attack.defense-evasion ·
Share on:

Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.

Read More
Remote Access Tool - AnyDesk Silent Installation

Nov 24, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.

Read More
Remote PowerShell Session Host Process (WinRM)

Nov 24, 2025 · attack.execution attack.lateral-movement attack.t1059.001 attack.t1021.006 ·
Share on:

Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).

Read More
Renamed Sysinternals Sdelete Execution

Nov 24, 2025 · attack.impact attack.t1485 ·
Share on:

Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)

Read More
Rundll32 Execution Without Parameters

Nov 24, 2025 · attack.lateral-movement attack.t1021.002 attack.t1570 attack.execution attack.t1569.002 ·
Share on:

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

Read More
SAM Registry Hive Handle Request

Nov 24, 2025 · attack.discovery attack.t1012 attack.credential-access attack.t1552.002 ·
Share on:

Detects handles requested to SAM registry hive

Read More
Script Event Consumer Spawning Process

Nov 24, 2025 · attack.execution attack.t1047 ·
Share on:

Detects a suspicious child process of Script Event Consumer (scrcons.exe).

Read More
Session Manager Autorun Keys Modification

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 attack.t1546.009 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Share And Session Enumeration Using Net.EXE

Nov 24, 2025 · attack.discovery attack.t1018 ·
Share on:

Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.

Read More
ShimCache Flush

Nov 24, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects actions that clear the local ShimCache and remove forensic evidence

Read More
Solarwinds SUPERNOVA Webshell Access

Nov 24, 2025 · attack.persistence attack.t1505.003 detection.emerging-threats ·
Share on:

Detects access to SUPERNOVA webshell as described in Guidepoint report

Read More
SonicWall SSL/VPN Jarrewrite Exploitation

Nov 24, 2025 · attack.t1190 attack.initial-access detection.emerging-threats ·
Share on:

Detects exploitation attempts of the SonicWall Jarrewrite Exploit

Read More
Source Code Enumeration Detection by Keyword

Nov 24, 2025 · attack.discovery attack.t1083 ·
Share on:

Detects source code enumeration that use GET requests by keyword searches in URL strings

Read More
Suspect Svchost Activity

Nov 24, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Read More
Suspicious Binary In User Directory Spawned From Office Application

Nov 24, 2025 · attack.execution attack.t1204.002 attack.g0046 car.2013-05-002 ·
Share on:

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Read More
Suspicious Cobalt Strike DNS Beaconing - Sysmon

Nov 24, 2025 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Read More
Suspicious Computer Account Name Change CVE-2021-42287

Nov 24, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1036 attack.t1098 cve.2021-42287 detection.emerging-threats ·
Share on:

Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287

Read More
Suspicious Control Panel DLL Load

Nov 24, 2025 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits

Read More
Suspicious Csi.exe Usage

Nov 24, 2025 · attack.lateral-movement attack.execution attack.t1072 attack.defense-evasion attack.t1218 ·
Share on:

Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'

Read More
Suspicious Desktopimgdownldr Command

Nov 24, 2025 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

Read More
Suspicious Desktopimgdownldr Target File

Nov 24, 2025 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension

Read More
Suspicious Download From Direct IP Via Bitsadmin

Nov 24, 2025 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file using an URL that contains an IP

Read More
Suspicious Driver Install by pnputil.exe

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects when a possible suspicious driver is being installed via pnputil.exe lolbin

Read More
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call

Nov 24, 2025 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1027 ·
Share on:

Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"

Read More
Suspicious Encoded Scripts in a WMI Consumer

Nov 24, 2025 · attack.privilege-escalation attack.execution attack.t1047 attack.persistence attack.t1546.003 ·
Share on:

Detects suspicious encoded payloads in WMI Event Consumers

Read More
Suspicious File Characteristics Due to Missing Fields

Nov 24, 2025 · attack.execution attack.t1059.006 ·
Share on:

Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe

Read More
Suspicious Outlook Child Process

Nov 24, 2025 · attack.execution attack.t1204.002 ·
Share on:

Detects a suspicious process spawning from an Outlook process.

Read More
Suspicious PowerShell Mailbox Export to Share

Nov 24, 2025 · attack.exfiltration ·
Share on:

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Read More
Suspicious PowerShell Mailbox Export to Share - PS

Nov 24, 2025 · attack.exfiltration ·
Share on:

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Read More
Suspicious Program Names

Nov 24, 2025 · attack.execution attack.t1059 ·
Share on:

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

Read More
Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet

Nov 24, 2025 · attack.discovery attack.t1087.001 ·
Share on:

Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet

Read More
Suspicious Recursive Takeown

Nov 24, 2025 · attack.defense-evasion attack.t1222.001 ·
Share on:

Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders

Read More
Suspicious Registry Modification From ADS Via Regini.EXE

Nov 24, 2025 · attack.persistence attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.

Read More
Suspicious Rejected SMB Guest Logon From IP

Nov 24, 2025 · attack.credential-access attack.t1110.001 ·
Share on:

Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service

Read More
Suspicious Rundll32 Setupapi.dll Activity

Nov 24, 2025 · attack.defense-evasion attack.t1218.011 ·
Share on:

setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file.

Read More
Suspicious Runscripthelper.exe

Nov 24, 2025 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of powershell scripts via Runscripthelper.exe

Read More
Suspicious Scripting in a WMI Consumer

Nov 24, 2025 · attack.execution attack.t1059.005 ·
Share on:

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Read More
Suspicious Service Path Modification

Nov 24, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects service path modification via the "sc" binary to a suspicious command or path

Read More
Suspicious Userinit Child Process

Nov 24, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects a suspicious child process of userinit

Read More
Suspicious VBoxDrvInst.exe Parameters

Nov 24, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect VBoxDrvInst.exe run with parameters allowing processing INF file. This allows to create values in the registry and install drivers. For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys

Read More
Suspicious Vsls-Agent Command With AgentExtensionPath Load

Nov 24, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter

Read More
Suspicious Workstation Locking via Rundll32

Nov 24, 2025 · attack.defense-evasion ·
Share on:

Detects a suspicious call to the user32.dll function that locks the user workstation

Read More
SyncAppvPublishingServer Execute Arbitrary PowerShell Code

Nov 24, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.

Read More
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code

Nov 24, 2025 · attack.defense-evasion attack.t1218 attack.t1216 ·
Share on:

Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs

Read More
System Scripts Autorun Keys Modification

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Tasks Folder Evasion

Nov 24, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.execution attack.t1574.001 ·
Share on:

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

Read More
Telegram API Access

Nov 24, 2025 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.t1102.002 ·
Share on:

Detects suspicious requests to Telegram API without the usual Telegram User-Agent

Read More
TerraMaster TOS CVE-2020-28188

Nov 24, 2025 · attack.t1190 attack.initial-access cve.2020-28188 detection.emerging-threats ·
Share on:

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Read More
UAC Bypass Via Wsreset

Nov 24, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.

Read More
Using SettingSyncHost.exe as LOLBin

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.defense-evasion attack.t1574.008 ·
Share on:

Detects using SettingSyncHost.exe to run hijacked binary

Read More
Verclsid.exe Runs COM Object

Nov 24, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects when verclsid.exe is used to run COM object via GUID

Read More
Virtualbox Driver Installation or Starting of VMs

Nov 24, 2025 · attack.defense-evasion attack.t1564.006 attack.t1564 ·
Share on:

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Read More
Vulnerable Netlogon Secure Channel Connection Allowed

Nov 24, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.

Read More
WannaCry Ransomware Activity

Nov 24, 2025 · attack.lateral-movement attack.t1210 attack.discovery attack.t1083 attack.defense-evasion attack.t1222.001 attack.impact attack.t1486 attack.t1490 detection.emerging-threats ·
Share on:

Detects WannaCry ransomware activity

Read More
Webshell ReGeorg Detection Via Web Logs

Nov 24, 2025 · attack.persistence attack.t1505.003 ·
Share on:

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Read More
Win Susp Computer Name Containing Samtheadmin

Nov 24, 2025 · attack.initial-access attack.defense-evasion cve.2021-42278 cve.2021-42287 attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Read More
Windows Defender Definition Files Removed

Nov 24, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files

Read More
Windows Pcap Drivers

Nov 24, 2025 · attack.discovery attack.credential-access attack.t1040 ·
Share on:

Detects Windows Pcap driver installation based on a list of associated .sys files.

Read More
Windows Shell/Scripting Processes Spawning Suspicious Programs

Nov 24, 2025 · attack.execution attack.defense-evasion attack.t1059.005 attack.t1059.001 attack.t1218 ·
Share on:

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

Read More
Windows Webshell Strings

Nov 24, 2025 · attack.persistence attack.t1505.003 ·
Share on:

Detects common commands used in Windows webshells

Read More
WINEKEY Registry Modification

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects potential malicious modification of run keys by winekey or team9 backdoor

Read More
WinSock2 Autorun Keys Modification

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node Classes Autorun Keys Modification

Nov 24, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
WScript or CScript Dropper - File

Nov 24, 2025 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe

Read More
ZxShell Malware

Nov 24, 2025 · attack.execution attack.t1059.003 attack.defense-evasion attack.t1218.011 attack.s0412 attack.g0001 detection.emerging-threats ·
Share on:

Detects a ZxShell start by the called and well-known function name

Read More
Atomic MacOS Stealer - FileGrabber Activity

Nov 24, 2025 · attack.execution attack.t1059.002 detection.emerging-threats ·
Share on:

Detects suspicious activity associated with Atomic MacOS Stealer (Amos) campaigns, including execution of FileGrabber and curl-based POST requests used for data exfiltration. The rule identifies either the execution of FileGrabber targeting /tmp or the use of curl to POST sensitive user data (including files such as /tmp/out.zip) to remote servers, which are key indicators of Amos infostealer activity.

Read More
Atomic MacOS Stealer - Persistence Indicators

Nov 24, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1564.001 attack.t1543.004 detection.emerging-threats ·
Share on:

Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.

Read More
Suspicious Kerberos Ticket Request via CLI

Nov 23, 2025 · attack.credential-access attack.t1558.003 ·
Share on:

Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class. Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse techniques like silver ticket attacks.

Read More
Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock

Nov 23, 2025 · attack.credential-access attack.t1558.003 ·
Share on:

Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is typically seen during a Kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.

Read More
Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Nov 23, 2025 · attack.persistence attack.defense-evasion attack.lateral-movement attack.t1021.001 attack.t1112 ·
Share on:

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Read More
RDP Sensitive Settings Changed

Nov 23, 2025 · attack.defense-evasion attack.persistence attack.t1112 ·
Share on:
Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.

Below is a list of registry keys/values that are monitored by this rule:
- Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.
- DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.
- DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.
- fAllowUnsolicited: Allows unsolicited remote assistance offers.
- fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.
- InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.
- ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.
- SecurityLayer: Specifies the security layer used for RDP connections.
Read More
Windows Default Domain GPO Modification

Nov 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·
Share on:

Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain.

Read More
Windows Default Domain GPO Modification via GPME

Nov 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·
Share on:

Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.

Read More
HackTool - WSASS Execution

Nov 23, 2025 · attack.credential-access attack.t1003.001 ·
Share on:

Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.

Read More
PPL Tampering Via WerFaultSecure

Nov 23, 2025 · attack.defense-evasion attack.t1562.001 attack.credential-access attack.t1003.001 ·
Share on:
Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool:
- WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine
- EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.
Read More
System File Execution Location Anomaly

Nov 23, 2025 · attack.defense-evasion attack.t1036 ·
Share on:

Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.

Read More
DNS Query To Visual Studio Code Tunnels Domain

Nov 21, 2025 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Registry Modification Attempt Via VBScript

Nov 21, 2025 · attack.defense-evasion attack.persistence attack.execution attack.t1112 attack.t1059.005 ·
Share on:

Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common LOLBINs. It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell. Threat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools.

Read More
Registry Modification Attempt Via VBScript - PowerShell

Nov 21, 2025 · attack.defense-evasion attack.persistence attack.execution attack.t1112 attack.t1059.005 ·
Share on:

Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands. Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools. This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.

Read More
Registry Tampering by Potentially Suspicious Processes

Nov 21, 2025 · attack.defense-evasion attack.persistence attack.execution attack.t1112 attack.t1059.005 ·
Share on:

Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.

Read More
RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class

Nov 21, 2025 · attack.lateral-movement attack.t1021.001 attack.execution attack.t1047 ·
Share on:

Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.

Read More
RDP Sensitive Settings Changed to Zero

Nov 21, 2025 · attack.defense-evasion attack.persistence attack.t1112 ·
Share on:

Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.

Read More
Suspicious ClickFix/FileFix Execution Pattern

Nov 21, 2025 · attack.execution attack.t1204.001 attack.t1204.004 ·
Share on:

Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.

Read More
Cisco ASA Exploitation Activity - Proxy

Nov 21, 2025 · attack.initial-access attack.t1190 cve.2025-20333 cve.2025-20362 detection.emerging-threats ·
Share on:

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Read More
Uncommon Svchost Command Line Parameter

Nov 21, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1036.005 attack.t1055 attack.t1055.012 ·
Share on:

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.

Read More
Suspicious Usage of For Loop with Recursive Directory Search in CMD

Nov 21, 2025 · attack.execution attack.t1059.003 attack.defense-evasion attack.t1027.010 ·
Share on:

Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing. This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection. This behavior has been observed in various malicious lnk files.

Read More
Potentially Suspicious NTFS Symlink Behavior Modification

Nov 17, 2025 · attack.execution attack.t1059 attack.defense-evasion attack.t1222.001 ·
Share on:

Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.

Read More
Office Macros Warning Disabled

Nov 13, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.

Read More
Outlook Security Settings Updated - Registry

Nov 13, 2025 · attack.persistence attack.t1137 ·
Share on:

Detects changes to the registry values related to outlook security settings

Read More
Trust Access Disable For VBApplications

Nov 13, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.

Read More
COM Object Hijacking Via Modification Of Default System CLSID Default Value

Nov 13, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects potential COM object hijacking via modification of default system CLSID.

Read More
Common Autorun Keys Modification

Nov 13, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CurrentVersion NT Autorun Keys Modification

Nov 13, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Potential Ursnif Malware Activity - Registry

Nov 13, 2025 · attack.persistence attack.defense-evasion attack.execution attack.t1112 detection.emerging-threats ·
Share on:

Detects registry keys related to Ursnif malware.

Read More
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Nov 13, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Potential Dtrack RAT Activity

Nov 12, 2025 · attack.impact attack.t1490 detection.emerging-threats ·
Share on:

Detects potential Dtrack RAT activity via specific process patterns

Read More
Classes Autorun Keys Modification

Nov 10, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Copy From Or To Admin Share Or Sysvol Folder

Nov 10, 2025 · attack.lateral-movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·
Share on:

Detects a copy command or a copy utility execution to or from an Admin share or remote

Read More
CurrentVersion Autorun Keys Modification

Nov 10, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Modification of IE Registry Settings

Nov 10, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence

Read More
Potential Persistence Via Shim Database Modification

Nov 10, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time

Read More
Potential Product Reconnaissance Via Wmic.EXE

Nov 10, 2025 · attack.execution attack.t1047 ·
Share on:

Detects the execution of WMIC in order to get a list of firewall and antivirus products

Read More
Scheduled Task Creation Via Schtasks.EXE

Nov 10, 2025 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·
Share on:

Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

Read More
Scheduled TaskCache Change by Uncommon Program

Nov 10, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 attack.t1053.005 ·
Share on:

Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious

Read More
WMIC Remote Command Execution

Nov 10, 2025 · attack.execution attack.t1047 ·
Share on:

Detects the execution of WMIC to query information on a remote system

Read More
Capture Credentials with Rpcping.exe

Nov 10, 2025 · attack.credential-access attack.t1003 ·
Share on:

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

Read More
DeviceCredentialDeployment Execution

Nov 10, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of DeviceCredentialDeployment to hide a process from view.

Read More
Explorer Process Tree Break

Nov 10, 2025 · attack.defense-evasion attack.t1036 ·
Share on:

Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"

Read More
MSDT Execution Via Answer File

Nov 10, 2025 · attack.defense-evasion attack.t1218 attack.execution ·
Share on:

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab).

Read More
Office Macro File Download

Nov 10, 2025 · attack.initial-access attack.t1566.001 ·
Share on:

Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.

Read More
Suspicious CustomShellHost Execution

Nov 10, 2025 · attack.defense-evasion attack.t1216 ·
Share on:

Detects the execution of CustomShellHost.exe where the child isn't located in 'C:\Windows\explorer.exe'. CustomShellHost is a known LOLBin that can be abused by attackers for defense evasion techniques.

Read More
Wlrmdr.EXE Uncommon Argument Or Child Process

Nov 10, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries. This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry.

Read More
Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Nov 10, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats cve.2021-34527 cve.2021-1675 ·
Share on:

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

Read More
Apache Spark Shell Command Injection - ProcessCreation

Nov 10, 2025 · attack.initial-access attack.t1190 cve.2022-33891 detection.emerging-threats ·
Share on:

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective

Read More
Atlassian Confluence CVE-2022-26134

Nov 10, 2025 · attack.initial-access attack.execution attack.t1190 attack.t1059 cve.2022-26134 detection.emerging-threats ·
Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

Read More
Blue Mockingbird - Registry

Nov 10, 2025 · attack.defense-evasion attack.execution attack.persistence attack.t1112 attack.t1047 detection.emerging-threats ·
Share on:

Attempts to detect system changes made by Blue Mockingbird

Read More
CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Nov 10, 2025 · attack.execution attack.privilege-escalation attack.resource-development attack.t1587 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

Read More
OMIGOD HTTP No Authentication RCE - CVE-2021-38647

Nov 10, 2025 · attack.privilege-escalation attack.initial-access attack.execution attack.lateral-movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 detection.emerging-threats cve.2021-38647 ·
Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Read More
Pandemic Registry Key

Nov 10, 2025 · attack.command-and-control attack.t1105 detection.emerging-threats ·
Share on:

Detects Pandemic Windows Implant

Read More
Possible PrintNightmare Print Driver Install - CVE-2021-1675

Nov 10, 2025 · attack.execution cve.2021-1678 cve.2021-1675 cve.2021-34527 detection.emerging-threats ·
Share on:

Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675). The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy.

Read More
Potential CVE-2021-42287 Exploitation Attempt

Nov 10, 2025 · attack.credential-access attack.t1558.003 detection.emerging-threats cve.2021-42287 ·
Share on:

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Read More
Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE

Nov 10, 2025 · attack.execution detection.emerging-threats cve.2022-21919 cve.2021-34484 ·
Share on:

Detects potential exploitation attempts of CVE-2022-21919 or CVE-2021-34484 leading to local privilege escalation via the User Profile Service. During exploitation of this vulnerability, two logs (Provider_Name: Microsoft-Windows-User Profiles Service) with EventID 1511 and 1515 are created (EventID 1515 may generate many false positives). Additionally, the directory \Users\TEMP may be created during exploitation. This behavior was observed on Windows Server 2008.

Read More
Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966

Nov 10, 2025 · attack.privilege-escalation detection.emerging-threats cve.2022-37966 ·
Share on:

Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation

Read More
Potential NetWire RAT Activity - Registry

Nov 10, 2025 · attack.persistence attack.defense-evasion attack.t1112 detection.emerging-threats ·
Share on:

Detects registry keys related to NetWire RAT

Read More
Potential Nimbuspwn Exploit CVE-2022-29799 and CVE-2022-27800

Nov 10, 2025 · attack.privilege-escalation attack.t1068 detection.emerging-threats cve.2022-29799 cve.2022-27800 ·
Share on:

Detects potential exploitation attempts of Nimbuspwn vulnerabilities CVE-2022-29799 and CVE-2022-27800 in Linux systems.

Read More
Potential PrintNightmare Exploitation Attempt

Nov 10, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 detection.emerging-threats ·
Share on:

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

Read More
Potential RDP Exploit CVE-2019-0708

Nov 10, 2025 · attack.lateral-movement attack.t1210 car.2013-07-002 cve.2019-0708 detection.emerging-threats ·
Share on:

Detect suspicious error on protocol RDP, potential CVE-2019-0708

Read More
PrinterNightmare Mimikatz Driver Name

Nov 10, 2025 · attack.execution attack.t1204 cve.2021-1675 cve.2021-34527 detection.emerging-threats ·
Share on:

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

Read More
PwnKit Local Privilege Escalation

Nov 10, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.001 detection.emerging-threats cve.2021-4034 ·
Share on:

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

Read More
Scanner PoC for CVE-2019-0708 RDP RCE Vuln

Nov 10, 2025 · attack.lateral-movement attack.t1210 car.2013-07-002 detection.emerging-threats cve.2019-0708 ·
Share on:

Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep

Read More
SSHD Error Message CVE-2018-15473

Nov 10, 2025 · attack.reconnaissance attack.t1589 cve.2018-15473 detection.emerging-threats ·
Share on:

Detects exploitation attempt using public exploit code for CVE-2018-15473

Read More
Sudo Privilege Escalation CVE-2019-14287

Nov 10, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1068 attack.t1548.003 cve.2019-14287 detection.emerging-threats ·
Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Read More
Sudo Privilege Escalation CVE-2019-14287 - Builtin

Nov 10, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1068 attack.t1548.003 cve.2019-14287 detection.emerging-threats ·
Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Read More
Suspicious Cobalt Strike DNS Beaconing - DNS Client

Nov 10, 2025 · attack.t1071.004 attack.command-and-control ·
Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Read More
Windows Spooler Service Suspicious Binary Load

Nov 10, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 detection.emerging-threats ·
Share on:

Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).

Read More
Suspicious CertReq Command to Download

Nov 6, 2025 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download additional payloads or configuration files. Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes.

Read More
Suspicious Space Characters in RunMRU Registry Path - ClickFix

Nov 5, 2025 · attack.execution attack.t1204.004 attack.defense-evasion attack.t1027.010 ·
Share on:

Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.

Read More
Suspicious Space Characters in TypedPaths Registry Path - FileFix

Nov 5, 2025 · attack.execution attack.t1204.004 attack.defense-evasion attack.t1027.010 ·
Share on:

Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.

Read More
Bitbucket Audit Log Configuration Updated

Nov 3, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the bitbucket audit log configuration.

Read More
Bitbucket Full Data Export Triggered

Nov 3, 2025 · attack.collection attack.t1213.003 ·
Share on:

Detects when full data export is attempted.

Read More
Bitbucket Global Permission Changed

Nov 3, 2025 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects global permissions change activity.

Read More
Bitbucket Global Secret Scanning Rule Deleted

Nov 3, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects Bitbucket global secret scanning rule deletion activity.

Read More
Bitbucket Global SSH Settings Changed

Nov 3, 2025 · attack.lateral-movement attack.defense-evasion attack.t1562.001 attack.t1021.004 ·
Share on:

Detects Bitbucket global SSH access configuration changes.

Read More
Bitbucket Project Secret Scanning Allowlist Added

Nov 3, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when a secret scanning allowlist rule is added for projects.

Read More
Bitbucket Secret Scanning Exempt Repository Added

Nov 3, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when a repository is exempted from secret scanning feature.

Read More
Bitbucket Secret Scanning Rule Deleted

Nov 3, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when secret scanning rule is deleted for the project or repository.

Read More
Bitbucket Unauthorized Access To A Resource

Nov 3, 2025 · attack.resource-development attack.t1586 ·
Share on:

Detects unauthorized access attempts to a resource.

Read More
Bitbucket Unauthorized Full Data Export Triggered

Nov 3, 2025 · attack.collection attack.resource-development attack.t1213.003 attack.t1586 ·
Share on:

Detects when full data export is attempted an unauthorized user.

Read More
Bitbucket User Details Export Attempt Detected

Nov 3, 2025 · attack.collection attack.reconnaissance attack.discovery attack.t1213 attack.t1082 attack.t1591.004 ·
Share on:

Detects user data export activity.

Read More
Bitbucket User Login Failure

Nov 3, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

Read More
Bitbucket User Login Failure Via SSH

Nov 3, 2025 · attack.lateral-movement attack.credential-access attack.t1021.004 attack.t1110 ·
Share on:

Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.

Read More
Bitbucket User Permissions Export Attempt

Nov 3, 2025 · attack.reconnaissance attack.collection attack.discovery attack.t1213 attack.t1082 attack.t1591.004 ·
Share on:

Detects user permission data export attempt.

Read More
Cisco Duo Successful MFA Authentication Via Bypass Code

Nov 3, 2025 · attack.credential-access attack.defense-evasion attack.initial-access ·
Share on:

Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

Read More
Github Delete Action Invoked

Nov 3, 2025 · attack.impact attack.collection attack.t1213.003 ·
Share on:

Detects delete action in the Github audit logs for codespaces, environment, project and repo.

Read More
Github Fork Private Repositories Setting Enabled/Cleared

Nov 3, 2025 · attack.persistence attack.exfiltration attack.t1020 attack.t1537 ·
Share on:

Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).

Read More
Github High Risk Configuration Disabled

Nov 3, 2025 · attack.credential-access attack.defense-evasion attack.persistence attack.t1556 ·
Share on:

Detects when a user disables a critical security feature for an organization.

Read More
Github New Secret Created

Nov 3, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1078.004 ·
Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Read More
Github Outside Collaborator Detected

Nov 3, 2025 · attack.privilege-escalation attack.persistence attack.collection attack.t1098.001 attack.t1098.003 attack.t1213.003 ·
Share on:

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

Read More
Github Push Protection Bypass Detected

Nov 3, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when a user bypasses the push protection on a secret detected by secret scanning.

Read More
Github Push Protection Disabled

Nov 3, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.

Read More
GitHub Repository Archive Status Changed

Nov 3, 2025 · attack.persistence attack.defense-evasion attack.impact ·
Share on:

Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.

Read More
GitHub Repository Pages Site Changed to Public

Nov 3, 2025 · attack.collection attack.exfiltration attack.t1567.001 ·
Share on:

Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.

Read More
Github Repository/Organization Transferred

Nov 3, 2025 · attack.persistence attack.exfiltration attack.t1020 attack.t1537 ·
Share on:

Detects when a repository or an organization is being transferred to another location.

Read More
Github Secret Scanning Feature Disabled

Nov 3, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects if the secret scanning feature is disabled for an enterprise or repository.

Read More
Github Self Hosted Runner Changes Detected

Nov 3, 2025 · attack.impact attack.discovery attack.collection attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1526 attack.t1213.003 attack.t1078.004 ·
Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Read More
Github SSH Certificate Configuration Changed

Nov 3, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when changes are made to the SSH certificate configuration of the organization.

Read More
New Github Organization Member Added

Nov 3, 2025 · attack.persistence attack.t1136.003 ·
Share on:

Detects when a new member is added or invited to a github organization.

Read More
New Okta User Created

Nov 3, 2025 · attack.credential-access ·
Share on:

Detects new user account creation

Read More
Okta Admin Functions Access Through Proxy

Nov 3, 2025 · attack.credential-access ·
Share on:

Detects access to Okta admin functions through proxy.

Read More
Okta Admin Role Assigned to an User or Group

Nov 3, 2025 · attack.privilege-escalation attack.persistence attack.t1098.003 ·
Share on:

Detects when an the Administrator role is assigned to an user or group.

Read More
Okta Admin Role Assignment Created

Nov 3, 2025 · attack.persistence ·
Share on:

Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence

Read More
Okta API Token Created

Nov 3, 2025 · attack.persistence ·
Share on:

Detects when a API token is created

Read More
Okta API Token Revoked

Nov 3, 2025 · attack.impact ·
Share on:

Detects when a API Token is revoked.

Read More
Okta Application Modified or Deleted

Nov 3, 2025 · attack.impact ·
Share on:

Detects when an application is modified or deleted.

Read More
Okta Application Sign-On Policy Modified or Deleted

Nov 3, 2025 · attack.impact ·
Share on:

Detects when an application Sign-on Policy is modified or deleted.

Read More
Okta FastPass Phishing Detection

Nov 3, 2025 · attack.initial-access attack.t1566 ·
Share on:

Detects when Okta FastPass prevents a known phishing site.

Read More
Okta Identity Provider Created

Nov 3, 2025 · attack.privilege-escalation attack.persistence attack.t1098.001 ·
Share on:

Detects when a new identity provider is created for Okta.

Read More
Okta MFA Reset or Deactivated

Nov 3, 2025 · attack.persistence attack.credential-access attack.defense-evasion attack.t1556.006 ·
Share on:

Detects when an attempt at deactivating or resetting MFA.

Read More
Okta Network Zone Deactivated or Deleted

Nov 3, 2025 · attack.impact ·
Share on:

Detects when an Network Zone is Deactivated or Deleted.

Read More
Okta New Admin Console Behaviours

Nov 3, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detects when Okta identifies new activity in the Admin Console.

Read More
Okta Policy Modified or Deleted

Nov 3, 2025 · attack.impact ·
Share on:

Detects when an Okta policy is modified or deleted.

Read More
Okta Policy Rule Modified or Deleted

Nov 3, 2025 · attack.impact ·
Share on:

Detects when an Policy Rule is Modified or Deleted.

Read More
Okta Security Threat Detected

Nov 3, 2025 · attack.command-and-control ·
Share on:

Detects when an security threat is detected in Okta.

Read More
Okta Suspicious Activity Reported by End-user

Nov 3, 2025 · attack.resource-development attack.t1586.003 ·
Share on:

Detects when an Okta end-user reports activity by their account as being potentially suspicious.

Read More
Okta Unauthorized Access to App

Nov 3, 2025 · attack.impact ·
Share on:

Detects when unauthorized access to app occurs.

Read More
Okta User Account Locked Out

Nov 3, 2025 · attack.impact attack.t1531 ·
Share on:

Detects when an user account is locked out.

Read More
Okta User Session Start Via An Anonymising Proxy Service

Nov 3, 2025 · attack.defense-evasion attack.t1562.006 ·
Share on:

Detects when an Okta user session starts where the user is behind an anonymising proxy service.

Read More
OneLogin User Account Locked

Nov 3, 2025 · attack.impact ·
Share on:

Detects when an user account is locked or suspended.

Read More
OneLogin User Assumed Another User

Nov 3, 2025 · attack.impact ·
Share on:

Detects when an user assumed another user account.

Read More
Outdated Dependency Or Vulnerability Alert Disabled

Nov 3, 2025 · attack.initial-access attack.t1195.001 ·
Share on:

Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.

Read More
Potential Okta Password in AlternateID Field

Nov 3, 2025 · attack.credential-access attack.t1552 ·
Share on:

Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files.

Read More
Exploitation Activity of CVE-2025-59287 - WSUS Deserialization

Nov 1, 2025 · attack.execution attack.initial-access attack.t1190 attack.t1203 cve.2025-59287 detection.emerging-threats ·
Share on:

Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS.

Read More
Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process

Nov 1, 2025 · attack.execution attack.initial-access attack.t1190 attack.t1203 cve.2025-59287 detection.emerging-threats ·
Share on:

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.

Read More
FortiGate - Firewall Address Object Added

Nov 1, 2025 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.

Read More
FortiGate - New Administrator Account Created

Nov 1, 2025 · attack.persistence attack.t1136.001 ·
Share on:

Detects the creation of an administrator account on a Fortinet FortiGate Firewall.

Read More
FortiGate - New Firewall Policy Added

Nov 1, 2025 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.

Read More
FortiGate - New Local User Created

Nov 1, 2025 · attack.persistence attack.t1136.001 ·
Share on:

Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections.

Read More
FortiGate - New VPN SSL Web Portal Added

Nov 1, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.

Read More
FortiGate - User Group Modified

Nov 1, 2025 · attack.persistence attack.privilege-escalation ·
Share on:

Detects the modification of a user group on a Fortinet FortiGate Firewall. The group could be used to grant VPN access to a network.

Read More
FortiGate - VPN SSL Settings Modified

Nov 1, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.

Read More
Kerberoasting Activity - Initial Query

Oct 29, 2025 · attack.credential-access attack.t1558.003 ·
Share on:

This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert.

Read More
Mint Sandstorm - AsperaFaspex Suspicious Process Execution

Oct 29, 2025 · attack.execution detection.emerging-threats ·
Share on:

Detects suspicious execution from AsperaFaspex as seen used by Mint Sandstorm

Read More
Mint Sandstorm - ManageEngine Suspicious Process Execution

Oct 29, 2025 · attack.execution detection.emerging-threats ·
Share on:

Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm

Read More
Potential Data Exfiltration Activity Via CommandLine Tools

Oct 29, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various CLI utilities exfiltrating data via web requests

Read More
Potential Devil Bait Malware Reconnaissance

Oct 29, 2025 · attack.defense-evasion attack.t1218 detection.emerging-threats ·
Share on:

Detects specific process behavior observed with Devil Bait samples

Read More
Potential Snatch Ransomware Activity

Oct 29, 2025 · attack.execution attack.t1204 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Snatch ransomware word document droppers

Read More
Suspicious Network Command

Oct 29, 2025 · attack.discovery attack.t1016 ·
Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
Suspicious SYSTEM User Process Creation

Oct 29, 2025 · attack.credential-access attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1003 attack.t1027 ·
Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More
Turla Group Commands May 2020

Oct 29, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.g0010 attack.execution attack.t1059.001 attack.t1053.005 attack.t1027 detection.emerging-threats ·
Share on:

Detects commands used by Turla group as reported by ESET in May 2020

Read More
Suspicious Speech Runtime Binary Child Process

Oct 29, 2025 · attack.defense-evasion attack.lateral-movement attack.t1021.003 attack.t1218 ·
Share on:

Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking.

Read More
PUA - AWS TruffleHog Execution

Oct 29, 2025 · attack.credential-access attack.t1555 attack.t1003 ·
Share on:

Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.

Read More
Potential Lateral Movement via Windows Remote Shell

Oct 29, 2025 · attack.lateral-movement attack.t1021.006 ·
Share on:

Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.

Read More
Winrs Local Command Execution

Oct 29, 2025 · attack.lateral-movement attack.defense-evasion attack.t1021.006 attack.t1218 ·
Share on:

Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.

Read More
Syslog Clearing or Removal Via System Utilities

Oct 28, 2025 · attack.defense-evasion attack.t1070.002 ·
Share on:

Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks

Read More
Audit Rules Deleted Via Auditctl

Oct 28, 2025 · attack.defense-evasion attack.t1562.012 ·
Share on:

Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system.

Read More
Python WebServer Execution - Linux

Oct 28, 2025 · attack.exfiltration attack.t1048.003 ·
Share on:

Detects the execution of Python web servers via command line interface (CLI). After gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software. This technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.

Read More
Kaspersky Endpoint Security Stopped Via CommandLine - Linux

Oct 28, 2025 · attack.execution attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.

Read More
AWS KMS Imported Key Material Usage

Oct 28, 2025 · attack.impact attack.t1486 attack.resource-development attack.t1608.003 ·
Share on:

Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.

Read More
File Access Of Signal Desktop Sensitive Data

Oct 28, 2025 · attack.credential-access attack.t1003 ·
Share on:

Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json. The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data. Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials. Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.

Read More
WFP Filter Added via Registry

Oct 27, 2025 · attack.defense-evasion attack.execution attack.t1562 attack.t1569.002 ·
Share on:

Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.

Read More
PUA - Restic Backup Tool Execution

Oct 24, 2025 · attack.exfiltration attack.t1048 attack.t1567.002 ·
Share on:

Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity.

Read More
A Member Was Added to a Security-Enabled Global Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects activity when a member is added to a security-enabled global group

Read More
A Member Was Removed From a Security-Enabled Global Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects activity when a member is removed from a security-enabled global group

Read More
A New Trust Was Created To A Domain

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Addition of domains is seldom and should be verified for legitimacy.

Read More
A Security-Enabled Global Group Was Deleted

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects activity when a security-enabled global group is deleted

Read More
Account Created And Deleted Within A Close Time Frame

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects when an account was created and deleted in a short period of time.

Read More
Account Disabled or Blocked for Sign in Attempts

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detects when an account is disabled or blocked for sign in but tried to log in

Read More
Activate Suppression of Windows Security Center Notifications

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect set Notification_Suppress to 1 to disable the Windows security center notification

Read More
Add DisallowRun Execution to Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect set DisallowRun to 1 to prevent user running specific computer program

Read More
Added Credentials to Existing Application

Oct 23, 2025 · attack.privilege-escalation attack.t1098.001 attack.persistence ·
Share on:

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

Read More
Addition of SID History to Active Directory Object

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1134.005 ·
Share on:

An attacker can use the SID history attribute to gain additional privileges.

Read More
Admin User Remote Logon

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.lateral-movement attack.initial-access attack.t1078.001 attack.t1078.002 attack.t1078.003 car.2016-04-005 ·
Share on:

Detect remote login by Administrator user (depending on internal pattern).

Read More
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

Read More
Always Install Elevated Windows Installer

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

Read More
Anomalous User Activity

Oct 23, 2025 · attack.privilege-escalation attack.t1098 attack.persistence ·
Share on:

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Read More
Application AppID Uri Configuration Changes

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.credential-access attack.privilege-escalation attack.t1552 attack.t1078.004 ·
Share on:

Detects when a configuration change is made to an applications AppID URI.

Read More
Application URI Configuration Changes

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1528 attack.t1078.004 attack.persistence attack.credential-access attack.privilege-escalation ·
Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Read More
APT27 - Emissary Panda Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.g0027 detection.emerging-threats ·
Share on:

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

Read More
APT31 Judgement Panda Activity

Oct 23, 2025 · attack.collection attack.lateral-movement attack.credential-access attack.g0128 attack.t1003.001 attack.t1560.001 detection.emerging-threats ·
Share on:

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

Read More
Aruba Network Service Potential DLL Sideloading

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.persistence attack.t1574.001 ·
Share on:

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Read More
Atbroker Registry Change

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1218 attack.persistence attack.t1547 ·
Share on:

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

Read More
Attempts of Kerberos Coercion Via DNS SPN Spoofing

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·
Share on:

Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the nslookup command.

Read More
Authentications To Important Apps Using Single Factor Authentication

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detect when authentications to important application(s) only required single-factor authentication

Read More
AWS Console GetSigninToken Potential Abuse

Oct 23, 2025 · attack.lateral-movement attack.defense-evasion attack.t1021.007 attack.t1550.001 ·
Share on:

Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.

Read More
AWS IAM S3Browser LoginProfile Creation

Oct 23, 2025 · attack.execution attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

Read More
AWS IAM S3Browser Templated S3 Bucket Policy Creation

Oct 23, 2025 · attack.execution attack.t1059.009 attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

Read More
AWS IAM S3Browser User or AccessKey Creation

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.defense-evasion attack.initial-access attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility creating IAM User or AccessKey.

Read More
AWS Identity Center Identity Provider Change

Oct 23, 2025 · attack.persistence attack.credential-access attack.defense-evasion attack.t1556 ·
Share on:

Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.

Read More
AWS Key Pair Import Activity

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

Read More
AWS Root Credentials

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1078.004 ·
Share on:

Detects AWS root account usage

Read More
AWS Route 53 Domain Transfer Lock Disabled

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.credential-access attack.t1098 ·
Share on:

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

Read More
AWS Route 53 Domain Transferred to Another Account

Oct 23, 2025 · attack.persistence attack.credential-access attack.privilege-escalation attack.t1098 ·
Share on:

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

Read More
AWS SAML Provider Deletion Activity

Oct 23, 2025 · attack.t1078.004 attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1531 attack.impact ·
Share on:

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

Read More
AWS STS AssumeRole Misuse

Oct 23, 2025 · attack.lateral-movement attack.privilege-escalation attack.defense-evasion attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

Read More
AWS STS GetSessionToken Misuse

Oct 23, 2025 · attack.lateral-movement attack.privilege-escalation attack.defense-evasion attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

Read More
AWS Successful Console Login Without MFA

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.

Read More
AWS Suspicious SAML Activity

Oct 23, 2025 · attack.defense-evasion attack.initial-access attack.lateral-movement attack.persistence attack.privilege-escalation attack.t1078 attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Read More
AWS User Login Profile Was Modified

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects activity when someone is changing passwords on behalf of other users. An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.

Read More
Azure AD Only Single Factor Authentication Required

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1556.006 ·
Share on:

Detect when users are authenticating without MFA being required.

Read More
Azure Domain Federation Settings Modified

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Identifies when an user or application modified the federation settings on the domain.

Read More
Azure Kubernetes Admission Controller

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Azure Login Bypassing Conditional Access Policies

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.

Read More
Azure Subscription Permission Elevation Via ActivityLogs

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Read More
Azure Subscription Permission Elevation Via AuditLogs

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Read More
Azure Unusual Authentication Interruption

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when there is a interruption in the authentication process.

Read More
Bitlocker Key Retrieval

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for Bitlocker key retrieval.

Read More
Blackbyte Ransomware Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 detection.emerging-threats ·
Share on:

Detects specific windows registry modifications made by BlackByte ransomware variants. BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption. This rule triggers when any of the following registry keys are set to DWORD 1, however all three should be investigated as part of a larger BlackByte ransomware detection and response effort.

Read More
Blue Mockingbird

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.execution attack.t1112 attack.t1047 detection.emerging-threats ·
Share on:

Attempts to detect system changes made by Blue Mockingbird

Read More
Browser Execution In Headless Mode

Oct 23, 2025 · attack.defense-evasion attack.command-and-control attack.t1105 attack.t1564.003 ·
Share on:

Detects execution of Chromium based browser in headless mode

Read More
Bulk Deletion Changes To Privileged Account Permissions

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects when a user is removed from a privileged role. Bulk changes should be investigated.

Read More
CA Policy Removed by Non Approved Actor

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

Read More
CA Policy Updated by Non Approved Actor

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Read More
Certificate-Based Authentication Enabled

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.persistence attack.privilege-escalation attack.t1556 ·
Share on:

Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

Read More
Change Default File Association To Executable Via Assoc

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.001 ·
Share on:

Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Read More
Change the Fax Dll

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect possible persistence using Fax DLL load when service restart

Read More
Change to Authentication Method

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.t1556 attack.persistence attack.defense-evasion attack.t1098 ·
Share on:

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Read More
Change User Account Associated with the FAX Service

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect change of the user account associated with the FAX service to avoid the escalation problem.

Read More
Changes To PIM Settings

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.privilege-escalation attack.persistence attack.t1078.004 ·
Share on:

Detects when changes are made to PIM roles

Read More
Changing Existing Service ImagePath Value Via Reg.EXE

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.011 ·
Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Read More
ChromeLoader Malware Execution

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 attack.t1176 detection.emerging-threats ·
Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

Read More
ClickOnce Trust Prompt Tampering

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.

Read More
CobaltStrike Service Installations - Security

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
CobaltStrike Service Installations - System

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
Code Injection by ld.so Preload

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.006 ·
Share on:

Detects the ld.so preload persistence file. See man ld.so for more information.

Read More
CodeIntegrity - Blocked Driver Load With Revoked Certificate

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects blocked load attempts of revoked drivers

Read More
CodeIntegrity - Blocked Image/Driver Load For Policy Violation

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Read More
COM Hijack via Sdclt

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1546 attack.t1548 ·
Share on:

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Read More
COM Hijacking via TreatAs

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

Read More
Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.001 detection.emerging-threats cve.2025-57788 ·
Share on:

Detects a qlogin.exe command attempting to authenticate as the internal _+_PublicSharingUser_ using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.

Read More
Control Panel Items

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.defense-evasion attack.t1218.002 attack.persistence attack.t1546 ·
Share on:

Detects the malicious use of a control panel item

Read More
CosmicDuke Service Installation

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1543.003 attack.t1569.002 detection.emerging-threats ·
Share on:

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

Read More
CrashControl CrashDump Disabled

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1564 attack.t1112 ·
Share on:

Detects disabling the CrashDump per registry (as used by HermeticWiper)

Read More
Created Files by Microsoft Sync Center

Oct 23, 2025 · attack.privilege-escalation attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·
Share on:

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

Read More
Creation Exe for Service with Unquoted Path

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

Read More
Credential Dumping Attempt Via Svchost

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects when a process tries to access the memory of svchost to potentially dump credentials.

Read More
CVE-2021-31979 CVE-2021-33771 Exploits

Oct 23, 2025 · attack.initial-access attack.execution attack.credential-access attack.t1566 attack.t1203 cve.2021-33771 cve.2021-31979 detection.emerging-threats ·
Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Read More
CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum

Oct 23, 2025 · attack.initial-access attack.execution attack.credential-access attack.t1566 attack.t1203 cve.2021-33771 cve.2021-31979 detection.emerging-threats ·
Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Read More
CVE-2022-24527 Microsoft Connected Cache LPE

Oct 23, 2025 · attack.execution attack.privilege-escalation attack.t1059.001 cve.2022-24527 detection.emerging-threats ·
Share on:

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

Read More
CVE-2024-50623 Exploitation Attempt - Cleo

Oct 23, 2025 · attack.initial-access attack.execution attack.t1190 cve.2024-50623 detection.emerging-threats ·
Share on:

Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.

Read More
Defrag Deactivation

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.s0111 detection.emerging-threats ·
Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Read More
Defrag Deactivation - Security

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 attack.s0111 detection.emerging-threats ·
Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Read More
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

Read More
Device Registration or Join Without MFA

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for device registration or join events where MFA was not performed.

Read More
DHCP Callout DLL Installation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.t1112 ·
Share on:

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

Read More
DHCP Server Error Failed Loading the CallOut DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

Read More
DHCP Server Loaded the CallOut DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

Read More
Diamond Sleet APT DLL Sideloading Indicators

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 detection.emerging-threats ·
Share on:

Detects DLL sideloading activity seen used by Diamond Sleet APT

Read More
Directory Service Restore Mode(DSRM) Registry Value Tampering

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.persistence attack.t1556 ·
Share on:

Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure. Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory. If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM. If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped. If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.

Read More
Disable Internal Tools or Feature in Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

Read More
Disabled MFA to Bypass Authentication Mechanisms

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.persistence attack.t1556 ·
Share on:

Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.

Read More
DLL Load via LSASS

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1547.008 ·
Share on:

Detects a method to load DLL via LSASS process using an undocumented Registry key

Read More
DLL Names Used By SVR For GraphicalProton Backdoor

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 detection.emerging-threats ·
Share on:

Hunts known SVR-specific DLL names.

Read More
DLL Sideloading by VMware Xfer Utility

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

Read More
Dllhost.EXE Execution Anomaly

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

Read More
DNS Query Request To OneLaunch Update Service

Oct 23, 2025 · attack.credential-access attack.collection attack.t1056 ·
Share on:

Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.

Read More
DNS Server Error Failed Loading the ServerLevelPluginDLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

Read More
DNS-over-HTTPS Enabled by Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1140 attack.t1112 ·
Share on:

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

Read More
DotNet CLR DLL Loaded By Scripting Applications

Oct 23, 2025 · attack.defense-evasion attack.execution attack.privilege-escalation attack.t1055 ·
Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Read More
Dropping Of Password Filter DLL

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.credential-access attack.t1556.002 ·
Share on:

Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

Read More
Enable LM Hash Storage

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Read More
Enable LM Hash Storage - ProcCreation

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Read More
Enabled User Right in AD to Control User Objects

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

Read More
Equation Group C2 Communication

Oct 23, 2025 · attack.exfiltration attack.command-and-control attack.g0020 attack.t1041 detection.emerging-threats ·
Share on:

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

Read More
ESXi Admin Permission Assigned To Account Via ESXCLI

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1059.012 attack.t1098 ·
Share on:

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

Read More
ETW Logging Disabled For rpcrt4.dll

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

Read More
ETW Logging Disabled For SCM

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

Read More
ETW Logging Disabled In .NET Processes - Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
ETW Logging Disabled In .NET Processes - Sysmon Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
Exploiting SetupComplete.cmd CVE-2019-1378

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019-1378 detection.emerging-threats ·
Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Read More
Explorer NOUACCHECK Flag

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

Read More
External Remote RDP Logon from Public IP

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Read More
External Remote SMB Logon from Public IP

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Read More
Failed Authentications From Countries You Do Not Operate Out Of

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detect failed authentications from countries you do not operate out of.

Read More
Failed Logon From Public IP

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1078 attack.t1190 attack.t1133 ·
Share on:

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Read More
Fax Service DLL Search Order Hijack

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

Read More
File Creation In Suspicious Directory By Msdt.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 cve.2022-30190 ·
Share on:

Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities

Read More
FlowCloud Registry Markers

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.t1112 detection.emerging-threats ·
Share on:

Detects FlowCloud malware registry markers from threat group TA410. The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.

Read More
Forest Blizzard APT - Custom Protocol Handler Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.

Read More
Forest Blizzard APT - Custom Protocol Handler DLL Registry Set

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.

Read More
FunkLocker Ransomware File Creation

Oct 23, 2025 · attack.impact attack.t1486 detection.emerging-threats ·
Share on:

Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.

Read More
GCP Break-glass Container Workload Deployed

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548 ·
Share on:

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

Read More
Google Cloud Kubernetes Admission Controller

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Google Workspace Granted Domain API Access

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects when an API access service account is granted domain authority.

Read More
Google Workspace User Granted Admin Privileges

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects when an Google Workspace user is granted admin privileges.

Read More
Granting Of Permissions To An Account

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098.003 ·
Share on:

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Read More
Group Policy Abuse for Privilege Addition

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·
Share on:

Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

Read More
Guest Account Enabled Via Sysadminctl

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 attack.t1078.001 ·
Share on:

Detects attempts to enable the guest account using the sysadminctl utility

Read More
Guest User Invited By Non Approved Inviters

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.persistence attack.defense-evasion attack.t1078.004 ·
Share on:

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

Read More
Guest Users Invited To Tenant By Non Approved Inviters

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects guest users being invited to tenant by non-approved inviters

Read More
HackTool - ADCSPwn Execution

Oct 23, 2025 · attack.collection attack.credential-access attack.t1557.001 ·
Share on:

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

Read More
HackTool - CACTUSTORCH Remote Thread Creation

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·
Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

Read More
HackTool - CrackMapExec Execution Patterns

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·
Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

Read More
HackTool - DInjector PowerShell Cradle Execution

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects the use of the Dinject PowerShell cradle based on the specific flags

Read More
HackTool - HollowReaper Execution

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.012 ·
Share on:

Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.

Read More
HackTool - Impacket Tools Execution

Oct 23, 2025 · attack.collection attack.execution attack.credential-access attack.t1557.001 ·
Share on:

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

Read More
HackTool - Koh Default Named Pipe

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.credential-access attack.t1528 attack.t1134.001 ·
Share on:

Detects creation of default named pipes used by the Koh tool

Read More
HackTool - KrbRelayUp Execution

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.t1558.003 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

Read More
HackTool - LittleCorporal Generated Maldoc Injection

Oct 23, 2025 · attack.defense-evasion attack.execution attack.privilege-escalation attack.t1204.002 attack.t1055.003 ·
Share on:

Detects the process injection of a LittleCorporal generated Maldoc.

Read More
HackTool - NoFilter Execution

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1134.001 ·
Share on:

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

Read More
HackTool - Potential CobaltStrike Process Injection

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.001 ·
Share on:

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

Read More
HackTool - PPID Spoofing SelectMyParent Tool Execution

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1134.004 ·
Share on:

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

Read More
HackTool - Rubeus Execution

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects the execution of the hacktool Rubeus via PE information of command line parameters

Read More
HackTool - Rubeus Execution - ScriptBlock

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects the execution of the hacktool Rubeus using specific command line flags

Read More
HackTool - SharPersist Execution

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 ·
Share on:

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

Read More
HackTool - SharpUp PrivEsc Tool Execution

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.discovery attack.execution attack.t1615 attack.t1569.002 attack.t1574.005 ·
Share on:

Detects the use of SharpUp, a tool for local privilege escalation

Read More
Hacktool Ruler

Oct 23, 2025 · attack.defense-evasion attack.discovery attack.execution attack.collection attack.lateral-movement attack.t1087 attack.t1114 attack.t1059 attack.t1550.002 ·
Share on:

This events that are generated when using the hacktool Ruler by Sensepost

Read More
HAFNIUM Exchange Exploitation Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1546 attack.t1053 attack.g0125 detection.emerging-threats ·
Share on:

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

Read More
Increased Failed Authentications Of Any Type

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects when sign-ins increased by 10% or greater.

Read More
Injected Browser Process Spawning Rundll32 - GuLoader Activity

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 detection.emerging-threats ·
Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Read More
Invalid PIM License

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Read More
ISATAP Router Address Was Set

Oct 23, 2025 · attack.impact attack.credential-access attack.collection attack.initial-access attack.privilege-escalation attack.execution attack.t1557 attack.t1565.002 ·
Share on:

Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.

Read More
Kalambur Backdoor Curl TOR SOCKS Proxy Execution

Oct 23, 2025 · attack.execution attack.command-and-control attack.t1090 attack.t1573 attack.t1071.001 attack.t1059.001 attack.s0183 detection.emerging-threats ·
Share on:

Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.

Read More
Kapeka Backdoor Autorun Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.

Read More
Kapeka Backdoor Persistence Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

Read More
KrbRelayUp Service Installation

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Read More
Kubernetes Admission Controller Modification

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

Read More
Launch Agent/Daemon Execution Via Launchctl

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1569.001 attack.t1543.001 attack.t1543.004 ·
Share on:

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

Read More
Lazarus APT DLL Sideloading Activity

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.persistence attack.t1574.001 attack.g0032 detection.emerging-threats ·
Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Read More
Leviathan Registry Key Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects registry key used by Leviathan APT in Malaysian focused campaign

Read More
Linux Doas Conf File Creation

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects the creation of doas.conf file in linux host platform.

Read More
Linux Doas Tool Execution

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

Read More
Linux Keylogging with Pam.d

Oct 23, 2025 · attack.collection attack.credential-access attack.t1003 attack.t1056.001 ·
Share on:

Detect attempt to enable auditing of TTY input

Read More
Local Privilege Escalation Indicator TabTip

Oct 23, 2025 · attack.collection attack.execution attack.credential-access attack.t1557.001 ·
Share on:

Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode

Read More
Login to Disabled Account

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detect failed attempts to sign in to disabled accounts.

Read More
Logon from a Risky IP Address

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

Read More
Lummac Stealer Activity - Execution Of More.com And Vbc.exe

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 detection.emerging-threats ·
Share on:

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

Read More
Macro Enabled In A Potentially Suspicious Document

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry changes to Office trust records where the path is located in a potentially suspicious location

Read More
Malicious Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known malicious drivers via their hash.

Read More
Malicious Driver Load By Name

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known malicious drivers via the file name of the drivers.

Read More
Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1078 attack.t1078.002 ·
Share on:

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

Read More
ManageEngine Endpoint Central Dctask64.EXE Potential Abuse

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.001 ·
Share on:

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Read More
Measurable Increase Of Successful Authentications

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects when successful sign-ins increased by 10% or greater.

Read More
Meterpreter or Cobalt Strike Getsystem Service Installation - Security

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Read More
Meterpreter or Cobalt Strike Getsystem Service Installation - System

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Read More
Microsoft 365 - Impossible Travel Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

Read More
Microsoft Defender Blocked from Loading Unsigned DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

Read More
Microsoft Sync Center Suspicious Network Connections

Oct 23, 2025 · attack.privilege-escalation attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·
Share on:

Detects suspicious connections from Microsoft Sync Center to non-private IPs.

Read More
MITRE BZAR Indicators for Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1047 attack.t1053.002 attack.t1569.002 ·
Share on:

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

Read More
MITRE BZAR Indicators for Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.004 ·
Share on:

Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.

Read More
Modifying Crontab

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·
Share on:

Detects suspicious modification of crontab file.

Read More
Monitoring For Persistence Via BITS

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1197 ·
Share on:

BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.

Read More
MSSQL Extended Stored Procedure Backdoor Maggie

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546 detection.emerging-threats ·
Share on:

This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

Read More
Multifactor Authentication Denied

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·
Share on:

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Read More
Multifactor Authentication Interrupted

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·
Share on:

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Read More
Narrator's Feedback-Hub Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects abusing Windows 10 Narrator's Feedback-Hub

Read More
NET NGenAssemblyUsageLog Registry Key Tamper

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section). By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.

Read More
NetNTLM Downgrade Attack

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1562.001 attack.t1112 ·
Share on:

Detects NetNTLM downgrade attack

Read More
NetNTLM Downgrade Attack - Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1562.001 attack.t1112 ·
Share on:

Detects NetNTLM downgrade attack

Read More
Network Connection Initiated Via Notepad.EXE

Oct 23, 2025 · attack.privilege-escalation attack.command-and-control attack.execution attack.defense-evasion attack.t1055 ·
Share on:

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

Read More
New BgInfo.EXE Custom DB Path Registry Configuration

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.

Read More
New BgInfo.EXE Custom VBScript Registry Configuration

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe"

Read More
New BgInfo.EXE Custom WMI Query Registry Configuration

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe"

Read More
New CA Policy by Non-approved Actor

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548 ·
Share on:

Monitor and alert on conditional access changes.

Read More
New DLL Added to AppInit_DLLs Registry Key

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.010 ·
Share on:

DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

Read More
New DNS ServerLevelPluginDll Installed

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.t1112 ·
Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Read More
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.t1112 ·
Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Read More
New Netsh Helper DLL Registered From A Suspicious Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.007 ·
Share on:

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Read More
New Outlook Macro Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the creation of a macro file for Outlook.

Read More
New PDQDeploy Service - Client Side

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1

Read More
New PDQDeploy Service - Server Side

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines

Read More
New Root Certificate Authority Added

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.persistence attack.privilege-escalation attack.t1556 ·
Share on:

Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.

Read More
New RUN Key Pointing to Suspicious Folder

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

Read More
Non-privileged Usage of Reg or Powershell

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

Read More
NTLM Logon

Oct 23, 2025 · attack.defense-evasion attack.lateral-movement attack.t1550.002 ·
Share on:

Detects logons using NTLM, which could be caused by a legacy source or attackers

Read More
Number Of Resource Creation Or Deployment Activities

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Number of VM creations or deployment activities occur in Azure via the azureactivity log.

Read More
OceanLotus Registry Activity

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 detection.emerging-threats ·
Share on:

Detects registry keys created in OceanLotus (also known as APT32) attacks

Read More
OilRig APT Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig activity as reported by Nyotron in their March 2018 report

Read More
OilRig APT Registry Persistence

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - Security

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - System

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
OpenCanary - SSH Login Attempt

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·
Share on:

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

Read More
OpenCanary - SSH New Connection Attempt

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·
Share on:

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

Read More
OpenCanary - Telnet Login Attempt

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.command-and-control attack.t1133 attack.t1078 ·
Share on:

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Read More
Operation Wocao Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects activity mentioned in Operation Wocao report

Read More
Operation Wocao Activity - Security

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects activity mentioned in Operation Wocao report

Read More
Outlook EnableUnsafeClientMailRules Setting Enabled - Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Read More
Outlook Macro Execution Without Warning Setting Enabled

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Read More
Pass the Hash Activity 2

Oct 23, 2025 · attack.defense-evasion attack.lateral-movement attack.t1550.002 ·
Share on:

Detects the attack technique pass the hash which is used to move laterally inside the network

Read More
Password Change on Directory Service Restore Mode (DSRM) Account

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password in order to obtain persistence.

Read More
Password Reset By User Account

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.credential-access attack.t1078.004 ·
Share on:

Detect when a user has reset their password in Azure AD

Read More
Password Set to Never Expire via WMI

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1047 attack.t1098 ·
Share on:

Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.

Read More
Persistence and Execution at Scale via GPO Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.lateral-movement attack.t1053.005 ·
Share on:

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Read More
Persistence Via Cron Files

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·
Share on:

Detects creation of cron file or files in Cron directories which could indicates potential persistence.

Read More
Persistence Via Sticky Key Backdoor

Oct 23, 2025 · attack.persistence attack.t1546.008 attack.privilege-escalation ·
Share on:

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

Read More
Persistence Via Sudoers Files

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·
Share on:

Detects creation of sudoers file or files in "sudoers.d" directory which can be used a potential method to persiste privileges for a specific user.

Read More
PIM Alert Setting Changes To Disabled

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects when PIM alerts are set to disabled.

Read More
PIM Approvals And Deny Elevation

Oct 23, 2025 · attack.persistence attack.initial-access attack.defense-evasion attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

Read More
Pingback Backdoor Activity

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
Pingback Backdoor DLL Loading Activity

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
Pingback Backdoor File Indicators

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
PktMon.EXE Execution

Oct 23, 2025 · attack.discovery attack.credential-access attack.t1040 ·
Share on:

Detects execution of PktMon, a tool that captures network packets.

Read More
Possible Shadow Credentials Added

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.credential-access attack.t1556 ·
Share on:

Detects possible addition of shadow credentials to an active directory object.

Read More
Potential ACTINIUM Persistence Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 attack.t1053.005 detection.emerging-threats ·
Share on:

Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

Read More
Potential appverifUI.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "appverifUI.dll"

Read More
Potential AVKkid.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "AVKkid.dll"

Read More
Potential Azure Browser SSO Abuse

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

Read More
Potential BearLPE Exploitation

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1053.005 car.2013-08-001 detection.emerging-threats ·
Share on:

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

Read More
Potential CobaltStrike Service Installations - Registry

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

Read More
Potential Data Stealing Via Chromium Headless Debugging

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.collection attack.t1185 attack.t1564.003 ·
Share on:

Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

Read More
Potential DLL Injection Or Execution Using Tracker.exe

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.001 ·
Share on:

Detects potential DLL injection and execution using "Tracker.exe"

Read More
Potential DLL Sideloading Of DbgModel.DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "DbgModel.dll"

Read More
Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Read More
Potential DLL Sideloading Of MpSvc.DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "MpSvc.dll".

Read More
Potential DLL Sideloading Of MsCorSvc.DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "mscorsvc.dll".

Read More
Potential DLL Sideloading Using Coregen.exe

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1218 attack.t1055 ·
Share on:

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Read More
Potential DLL Sideloading Via DeviceEnroller.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Potential DLL Sideloading Via VMware Xfer

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL

Read More
Potential EACore.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "EACore.dll"

Read More
Potential Edputil.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "edputil.dll"

Read More
Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.execution attack.t1059.001 attack.t1059.003 attack.t1068 attack.t1190 cve.2025-54309 detection.emerging-threats ·
Share on:

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Read More
Potential Exploitation of RCE Vulnerability CVE-2025-33053

Oct 23, 2025 · attack.command-and-control attack.execution attack.defense-evasion attack.t1218 attack.lateral-movement attack.t1105 detection.emerging-threats cve.2025-33053 ·
Share on:

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 which involves unauthorized code execution via WebDAV through external control of file names or paths. The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating their working directories to point to attacker-controlled WebDAV servers, causing them to execute malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries through Process.Start() search order manipulation.

Read More
Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load

Oct 23, 2025 · attack.command-and-control attack.execution attack.defense-evasion attack.t1218 attack.lateral-movement attack.t1105 detection.emerging-threats cve.2025-33053 ·
Share on:

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

Read More
Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access

Oct 23, 2025 · attack.command-and-control attack.execution attack.defense-evasion attack.t1218 attack.lateral-movement attack.t1105 detection.emerging-threats cve.2025-33053 ·
Share on:

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe) accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers instead of legitimate system binaries. The vulnerability allows unauthorized code execution through external control of file names or paths via WebDAV.

Read More
Potential Goopdate.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Read More
Potential Initial Access via DLL Search Order Hijacking

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1566 attack.t1566.001 attack.initial-access attack.t1574 attack.t1574.001 attack.defense-evasion ·
Share on:

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Read More
Potential Iviewers.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Read More
Potential KamiKakaBot Activity - Winlogon Shell Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.

Read More
Potential Linux Process Code Injection Via DD Utility

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.009 ·
Share on:

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

Read More
Potential MFA Bypass Using Legacy Client Authentication

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Read More
Potential Mfdetours.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Read More
Potential Mpclient.DLL Sideloading

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Read More
Potential Mpclient.DLL Sideloading Via Defender Binaries

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Read More
Potential Notepad++ CVE-2025-49144 Exploitation

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.008 cve.2025-49144 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.

Read More
Potential Persistence Attempt Via Existing Service Tampering

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1543.003 attack.t1574.011 ·
Share on:

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

Read More
Potential Persistence Using DebugPath

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects potential persistence using Appx DebugPath

Read More
Potential Persistence Via App Paths Default Property

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.012 ·
Share on:

Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application's executable file name to that file's fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis.

Read More
Potential Persistence Via AppCompat RegisterAppRestart Layer

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.

Read More
Potential Persistence Via Custom Protocol Handler

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.

Read More
Potential Persistence Via Logon Scripts - CommandLine

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1037.001 ·
Share on:

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

Read More
Potential Persistence Via Microsoft Compatibility Appraiser

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.

Read More
Potential Persistence Via Netsh Helper DLL - Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.007 ·
Share on:

Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Read More
Potential Persistence Via Outlook Home Page

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.t1112 ·
Share on:

Detects potential persistence activity via outlook home page. An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.

Read More
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Read More
Potential Persistence Via Outlook Today Page

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.t1112 ·
Share on:

Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".

Read More
Potential Persistence Via PlistBuddy

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.001 attack.t1543.004 ·
Share on:

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

Read More
Potential Persistence Via Powershell Search Order Hijacking - Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Read More
Potential Persistence Via Scrobj.dll COM Hijacking

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

Read More
Potential Persistence Via Shim Database In Uncommon Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Detects the installation of a new shim database where the file is located in a non-default location

Read More
Potential Pikabot Hollowing Activity

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.012 detection.emerging-threats ·
Share on:

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

Read More
Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE

Oct 23, 2025 · attack.defense-evasion attack.command-and-control attack.execution attack.t1059.003 attack.t1105 attack.t1218 detection.emerging-threats ·
Share on:

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads. Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files. In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

Read More
Potential Privilege Escalation via Local Kerberos Relay over LDAP

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.credential-access attack.t1548 ·
Share on:

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

Read More
Potential Privilege Escalation via Service Permissions Weakness

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

Read More
Potential Process Injection Via Msra.EXE

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

Read More
Potential PSFactoryBuffer COM Hijacking

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

Read More
Potential Python DLL SideLoading

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of Python DLL files.

Read More
Potential Qakbot Registry Activity

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects a registry key used by IceID in a campaign that distributes malicious OneNote files

Read More
Potential Raspberry Robin Aclui Dll SideLoading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 detection.emerging-threats ·
Share on:

Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.

Read More
Potential Raspberry Robin Registry Set Internet Settings ZoneMap

Oct 23, 2025 · attack.persistence attack.t1112 attack.defense-evasion detection.emerging-threats ·
Share on:

Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.

Read More
Potential Rcdll.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of rcdll.dll

Read More
Potential Registry Persistence Attempt Via DbgManagedDebugger

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574 ·
Share on:

Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes

Read More
Potential Registry Persistence Attempt Via Windows Telemetry

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.

Read More
Potential RipZip Attack on Startup Folder

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.

Read More
Potential RjvPlatform.DLL Sideloading From Default Location

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Read More
Potential RjvPlatform.DLL Sideloading From Non-Default Location

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

Read More
Potential RoboForm.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Read More
Potential SAP NetWeaver Webshell Creation

Oct 23, 2025 · attack.execution attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·
Share on:

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

Read More
Potential SAP NetWeaver Webshell Creation - Linux

Oct 23, 2025 · attack.execution attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·
Share on:

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

Read More
Potential ShellDispatch.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "ShellDispatch.dll"

Read More
Potential SmadHook.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Read More
Potential SMB Relay Attack Tool Execution

Oct 23, 2025 · attack.collection attack.execution attack.credential-access attack.t1557.001 ·
Share on:

Detects different hacktools used for relay attacks on Windows for privilege escalation

Read More
Potential SolidPDFCreator.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Read More
Potential SSH Tunnel Persistence Install Using A Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 attack.command-and-control ·
Share on:

Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.

Read More
Potential Startup Shortcut Persistence Via PowerShell.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence. Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"

Read More
Potential Suspicious Activity Using SeCEdit

Oct 23, 2025 · attack.collection attack.discovery attack.persistence attack.defense-evasion attack.credential-access attack.privilege-escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Potential Suspicious Child Process Of 3CXDesktopApp

Oct 23, 2025 · attack.command-and-control attack.execution attack.defense-evasion attack.t1218 detection.emerging-threats ·
Share on:

Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

Read More
Potential Suspicious Registry File Imported Via Reg.EXE

Oct 23, 2025 · attack.persistence attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility

Read More
Potential Vivaldi_elf.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "vivaldi_elf.dll"

Read More
Potential Waveedit.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

Read More
Potential WWlib.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "wwlib.dll"

Read More
Potentially Suspicious Child Process of KeyScrambler.exe

Oct 23, 2025 · attack.persistence attack.execution attack.defense-evasion attack.privilege-escalation attack.t1203 attack.t1574.001 ·
Share on:

Detects potentially suspicious child processes of KeyScrambler.exe

Read More
Potentially Suspicious Desktop Background Change Using Reg.EXE

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·
Share on:

Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Read More
Potentially Suspicious Desktop Background Change Via Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·
Share on:

Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Read More
Powershell Create Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

Read More
Powershell Detect Virtualization Environment

Oct 23, 2025 · attack.discovery attack.defense-evasion attack.t1497.001 ·
Share on:

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox

Read More
Powershell Install a DLL in System Directory

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.credential-access attack.t1556.002 ·
Share on:

Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"

Read More
Powershell Keylogging

Oct 23, 2025 · attack.credential-access attack.collection attack.t1056.001 ·
Share on:

Adversaries may log user keystrokes to intercept credentials as the user types them.

Read More
Powershell LocalAccount Manipulation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups

Read More
PowerShell Web Access Feature Enabled Via DISM

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1548.002 ·
Share on:

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

Read More
Powershell WMI Persistence

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Read More
Powerview Add-DomainObjectAcl DCSync AD Extend Right

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer

Read More
Privileged Account Creation

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when a new admin is created.

Read More
Privileged User Has Been Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1136.001 attack.t1098 ·
Share on:

Detects the addition of a new user to a privileged group such as "root" or "sudo"

Read More
ProcessHacker Privilege Elevation

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects a ProcessHacker tool that elevated privileges to a very high level

Read More
PUA - Process Hacker Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation cve.2021-21551 attack.t1543 ·
Share on:

Detects driver load of the Process Hacker tool

Read More
PUA - System Informer Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects driver load of the System Informer tool

Read More
RedMimicry Winnti Playbook Registry Manipulation

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects actions caused by the RedMimicry Winnti playbook

Read More
Reg Add Suspicious Paths

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 attack.t1562.001 ·
Share on:

Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys

Read More
Regedit as Trusted Installer

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe

Read More
Registry Explorer Policy Modification

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)

Read More
Registry Hide Function from User

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)

Read More
Registry Manipulation via WMI Stdregprov

Oct 23, 2025 · attack.persistence attack.execution attack.defense-evasion attack.discovery attack.t1047 attack.t1112 attack.t1012 ·
Share on:

Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class. This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.

Read More
Registry Persistence Mechanisms in Recycle Bin

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects persistence registry keys for Recycle Bin

Read More
Registry Persistence via Explorer Run Key

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder

Read More
Registry-Free Process Scope COR_PROFILER

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.012 ·
Share on:

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR. (Citation: Microsoft Profiling Mar 2017) (Citation: Microsoft COR_PROFILER Feb 2013)

Read More
Regsvr32 DLL Execution With Uncommon Extension

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574 attack.execution ·
Share on:

Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.

Read More
Rejetto HTTP File Server RCE

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1190 attack.t1505.003 cve.2014-6287 detection.emerging-threats ·
Share on:

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

Read More
Remote Access Tool - ScreenConnect Installation Execution

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects ScreenConnect program starts that establish a remote access to a system.

Read More
Remote Access Tool - Team Viewer Session Started On Linux Host

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Read More
Remote Access Tool - Team Viewer Session Started On MacOS Host

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Read More
Remote Access Tool - Team Viewer Session Started On Windows Host

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Read More
Remote Access Tool Services Have Been Installed - Security

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1543.003 attack.t1569.002 ·
Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Read More
Remote Access Tool Services Have Been Installed - System

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1543.003 attack.t1569.002 ·
Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Read More
Remote Registry Lateral Movement

Oct 23, 2025 · attack.defense-evasion attack.lateral-movement attack.t1112 attack.persistence ·
Share on:

Detects remote RPC calls to modify the registry and possible execute code

Read More
Remote Schedule Task Lateral Movement via ATSvc

Oct 23, 2025 · attack.privilege-escalation attack.lateral-movement attack.execution attack.persistence attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task via ATSvc

Read More
Remote Schedule Task Lateral Movement via ITaskSchedulerService

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.lateral-movement attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task

Read More
Remote Schedule Task Lateral Movement via SASec

Oct 23, 2025 · attack.privilege-escalation attack.lateral-movement attack.execution attack.persistence attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task via SASec

Read More
Remote Task Creation via ATSVC Named Pipe

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·
Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Read More
Remote Task Creation via ATSVC Named Pipe - Zeek

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·
Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Read More
Removal of Potential COM Hijacking Registry Keys

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.

Read More
Renamed Vmnat.exe Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

Read More
Renamed ZOHO Dctask64 Execution

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1036 attack.t1055.001 attack.t1202 attack.t1218 ·
Share on:

Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Read More
Restricted Software Access By SRP

Oct 23, 2025 · attack.lateral-movement attack.execution attack.defense-evasion attack.t1072 ·
Share on:

Detects restricted access to applications by the Software Restriction Policies (SRP) policy

Read More
RestrictedAdminMode Registry Value Tampering

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Read More
RestrictedAdminMode Registry Value Tampering - ProcCreation

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Read More
Roles Activated Too Frequently

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when the same privilege role has multiple activations by the same user.

Read More
Roles Activation Doesn't Require MFA

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role can be activated without performing mfa.

Read More
Roles Are Not Being Used

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a user has been assigned a privilege role and are not using that role.

Read More
Roles Assigned Outside PIM

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Read More
Root Account Enable Via Dsenableroot

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial-access attack.persistence ·
Share on:

Detects attempts to enable the root account via "dsenableroot"

Read More
RottenPotato Like Attack Pattern

Oct 23, 2025 · attack.collection attack.privilege-escalation attack.credential-access attack.t1557.001 ·
Share on:

Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

Read More
Run Once Task Configuration in Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup

Read More
Run Once Task Execution as Configured in Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

This rule detects the execution of Run Once task as configured in the registry

Read More
Running Chrome VPN Extensions via the Registry 2 VPN Extension

Oct 23, 2025 · attack.initial-access attack.persistence attack.t1133 ·
Share on:

Running Chrome VPN Extensions via the Registry install 2 vpn extension

Read More
Scheduled Task Creation Masquerading as System Processes

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.defense-evasion attack.t1036.004 attack.t1036.005 ·
Share on:

Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.

Read More
Scheduled Task Creation with Curl and PowerShell Execution Combo

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.

Read More
Scheduled Task Executed From A Suspicious Location

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task

Read More
Scheduled Task Executed Uncommon LOLBIN

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task

Read More
Scheduled Task Executing Encoded Payload from Registry

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
Scheduled Task Executing Payload from Registry

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

Read More
Scheduled Task/Job At

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.002 ·
Share on:

Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code

Read More
Schtasks Creation Or Modification With SYSTEM Privileges

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

Read More
Schtasks From Suspicious Folders

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations that have suspicious action command and folder combinations

Read More
SCM Database Privileged Operation

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects non-system users performing privileged operation os the SCM database

Read More
Sdclt Child Processes

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.

Read More
Security Event Logging Disabled via MiniNt Registry Key - Process

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1562.002 attack.t1112 car.2022-03-001 ·
Share on:

Detects attempts to disable security event logging by adding the MiniNt registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.

Read More
Security Event Logging Disabled via MiniNt Registry Key - Registry Set

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1562.002 attack.t1112 car.2022-03-001 ·
Share on:

Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.

Read More
Security Support Provider (SSP) Added to LSA Configuration

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.005 ·
Share on:

Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.

Read More
Serpent Backdoor Payload Execution Via Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.006 detection.emerging-threats ·
Share on:

Detects post exploitation execution technique of the Serpent backdoor. According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method. It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.

Read More
Service Binary in Suspicious Folder

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect the creation of a service with a service binary located in a suspicious directory

Read More
Service Installed By Unusual Client - Security

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More
Service Installed By Unusual Client - System

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More
Service Registry Permissions Weakness Check

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.011 stp.2a ·
Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Read More
Setuid and Setgid

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1548.001 ·
Share on:

Detects suspicious change of file privileges with chown and chmod commands

Read More
Setup16.EXE Execution With Custom .Lst File

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.005 ·
Share on:

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

Read More
Shell Open Registry Keys Manipulation

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1546.001 ·
Share on:

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

Read More
Sign-in Failure Due to Conditional Access Requirements Not Met

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1110 attack.t1078.004 ·
Share on:

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Read More
Sign-ins by Unknown Devices

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.

Read More
Sign-ins from Non-Compliant Devices

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for sign-ins where the device was non-compliant.

Read More
Sliver C2 Default Service Installation

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

Read More
Small Sieve Malware CommandLine Indicator

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

Read More
Stale Accounts In A Privileged Role

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an account hasn't signed in during the past n number of days.

Read More
Startup/Logon Script Added to Group Policy Object

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1484.001 attack.t1547 ·
Share on:

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Read More
StoneDrill Service Install

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.g0064 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky

Read More
Successful Authentications From Countries You Do Not Operate Out Of

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detect successful authentications from countries you do not operate out of.

Read More
Successful Overpass the Hash Attempt

Oct 23, 2025 · attack.defense-evasion attack.lateral-movement attack.s0002 attack.t1550.002 ·
Share on:

Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.

Read More
Suspicious Autorun Registry Modified via WMI

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1547.001 attack.t1047 ·
Share on:

Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.

Read More
Suspicious Child Process Created as System

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134.002 ·
Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

Read More
Suspicious Child Process of SAP NetWeaver

Oct 23, 2025 · attack.execution attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·
Share on:

Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

Read More
Suspicious Child Process of SAP NetWeaver - Linux

Oct 23, 2025 · attack.execution attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·
Share on:

Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

Read More
Suspicious Command Patterns In Scheduled Task Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

Read More
Suspicious Computer Machine Password by PowerShell

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.

Read More
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·
Share on:

Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

Read More
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·
Share on:

Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

Read More
Suspicious Get-Variable.exe Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546 attack.defense-evasion attack.t1027 ·
Share on:

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

Read More
Suspicious GrpConv Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors

Read More
Suspicious GUP Usage

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

Read More
Suspicious Modification Of Scheduled Tasks

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

Read More
Suspicious Network Communication With IPFS

Oct 23, 2025 · attack.collection attack.credential-access attack.t1056 ·
Share on:

Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.

Read More
Suspicious Outlook Macro Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the creation of a macro file for Outlook.

Read More
Suspicious PowerShell In Registry Run Keys

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects potential PowerShell commands or code within registry run keys

Read More
Suspicious Printer Driver Empty Manufacturer

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 ·
Share on:

Detects a suspicious printer driver installation with an empty Manufacturer value

Read More
Suspicious Process Spawned by CentreStack Portal AppPool

Oct 23, 2025 · attack.persistence attack.execution attack.t1059.003 attack.t1505.003 cve.2025-30406 detection.emerging-threats ·
Share on:

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

Read More
Suspicious RazerInstaller Explorer Subprocess

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1553 detection.emerging-threats ·
Share on:

Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

Read More
Suspicious Remote Logon with Explicit Credentials

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 attack.lateral-movement ·
Share on:

Detects suspicious processes logging on with explicit credentials

Read More
Suspicious Run Key from Download

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories

Read More
Suspicious Rundll32 Invoking Inline VBScript

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452

Read More
Suspicious Scheduled Task Creation Involving Temp Folder

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation of scheduled tasks that involves a temporary folder and runs only once

Read More
Suspicious Scheduled Task Creation via Masqueraded XML File

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.defense-evasion attack.persistence attack.t1036.005 attack.t1053.005 ·
Share on:

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Read More
Suspicious Scheduled Task Name As GUID

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects creation of a scheduled task with a GUID like name

Read More
Suspicious Scheduled Task Write to System32 Tasks

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053 ·
Share on:

Detects the creation of tasks from processes executed from suspicious locations

Read More
Suspicious Schtasks Execution AppData Folder

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

Read More
Suspicious Schtasks Schedule Type With High Privileges

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type

Read More
Suspicious Schtasks Schedule Types

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification on a suspicious schedule type

Read More
Suspicious ScreenSave Change by Reg.exe

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1546.002 ·
Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Read More
Suspicious Screensaver Binary File Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.002 ·
Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Read More
Suspicious Service DACL Modification Via Set-Service Cmdlet

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable

Read More
Suspicious Shim Database Patching Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

Read More
Suspicious SignIns From A Non Registered Device

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects risky authentication from a non AD registered device without MFA being required.

Read More
Suspicious Startup Folder Persistence

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.t1204.002 attack.persistence attack.t1547.001 ·
Share on:

Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.

Read More
Suspicious Unsigned Thor Scanner Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects loading and execution of an unsigned thor scanner binary.

Read More
Suspicious VBScript UN2452 Pattern

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects suspicious inline VBScript keywords as used by UNC2452

Read More
Suspicious Velociraptor Child Process

Oct 23, 2025 · attack.command-and-control attack.persistence attack.defense-evasion attack.t1219 ·
Share on:

Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.

Read More
Sysinternals PsService Execution

Oct 23, 2025 · attack.privilege-escalation attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering

Read More
Sysinternals PsSuspend Execution

Oct 23, 2025 · attack.privilege-escalation attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

Read More
Sysmon Channel Reference Deletion

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Potential threat actor tampering with Sysmon manifest and eventually disabling it

Read More
TAIDOOR RAT DLL Load

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1055.001 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Chinese TAIDOOR RAT malware load

Read More
Temporary Access Pass Added To An Account

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078.004 ·
Share on:

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

Read More
Terminal Server Client Connection History Cleared - Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1070 attack.t1112 ·
Share on:

Detects the deletion of registry keys containing the MSTSC connection history

Read More
Too Many Global Admins

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Read More
Triple Cross eBPF Rootkit Default Persistence

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.defense-evasion attack.t1053.003 ·
Share on:

Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

Read More
Trusted Path Bypass via Windows Directory Spoofing

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.007 attack.t1548.002 ·
Share on:

Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.

Read More
TrustedPath UAC Bypass Pattern

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects indicators of a UAC bypass method by mocking directories

Read More
Turla PNG Dropper Service

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.g0010 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018

Read More
Turla Service Install

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.g0010 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET

Read More
UAC Bypass via Windows Firewall Snap-In Hijack

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

Read More
Uncommon Microsoft Office Trusted Location Added

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.

Read More
Uncommon Outbound Kerberos Connection

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.t1558 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Read More
Uncommon Userinit Child Process

Oct 23, 2025 · attack.privilege-escalation attack.t1037.001 attack.persistence ·
Share on:

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Read More
Unsigned Binary Loaded From Suspicious Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations

Read More
Unsigned Mfdetours.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Read More
Unsigned Module Loaded by ClickOnce Application

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 ·
Share on:

Detects unsigned module load by ClickOnce application.

Read More
Unusual Child Process of dns.exe

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Read More
Unusual File Deletion by Dns.exe

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Read More
Unusual File Modification by dns.exe

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Read More
Use of Legacy Authentication Protocols

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Alert on when legacy authentication has been used on an account

Read More
User Access Blocked by Azure Conditional Access

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.credential-access attack.initial-access attack.t1110 attack.t1078.004 ·
Share on:

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

Read More
User Added To Admin Group Via Dscl

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and add an account to the admin group via "dscl"

Read More
User Added To Admin Group Via DseditGroup

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

Read More
User Added To Admin Group Via Sysadminctl

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and add an account to the admin group via "sysadminctl"

Read More
User Added to an Administrator's Azure AD Role

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1098.003 attack.t1078 ·
Share on:

User Added to an Administrator's Azure AD Role

Read More
User Added To Group With CA Policy Modification Access

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership additions of groups that have CA policy modification access

Read More
User Added To Highly Privileged Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".

Read More
User Added to Local Administrator Group

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.privilege-escalation attack.t1078 attack.persistence attack.t1098 ·
Share on:

Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity

Read More
User Added to Local Administrators Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".

Read More
User Added To Privilege Role

Oct 23, 2025 · attack.persistence attack.initial-access attack.privilege-escalation attack.defense-evasion attack.t1078.004 ·
Share on:

Detects when a user is added to a privileged role.

Read More
User Added to Remote Desktop Users Group

Oct 23, 2025 · attack.initial-access attack.persistence attack.lateral-movement attack.t1133 attack.t1136.001 attack.t1021.001 ·
Share on:

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

Read More
User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'

Oct 23, 2025 · attack.credential-access attack.lateral-movement attack.privilege-escalation attack.t1558.003 ·
Share on:

The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.

Read More
User Removed From Group With CA Policy Modification Access

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership removal of groups that have CA policy modification access

Read More
User State Changed From Guest To Member

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078.004 ·
Share on:

Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

Read More
Users Added to Global or Device Admin Roles

Oct 23, 2025 · attack.persistence attack.initial-access attack.defense-evasion attack.privilege-escalation attack.t1078.004 ·
Share on:

Monitor and alert for users added to device admin roles.

Read More
Users Authenticating To Other Azure AD Tenants

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.

Read More
VBScript Payload Stored in Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects VBScript content stored into registry keys as seen being used by UNC2452 group

Read More
Vulnerable Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known vulnerable drivers via their hash.

Read More
Vulnerable Driver Load By Name

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects the load of known vulnerable drivers via the file name of the drivers.

Read More
Vulnerable HackSys Extreme Vulnerable Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

Read More
Vulnerable WinRing0 Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

Read More
Wdigest CredGuard Registry Modification

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials.

Read More
Wdigest Enable UseLogonCredential

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials

Read More
WinDivert Driver Load

Oct 23, 2025 · attack.credential-access attack.collection attack.defense-evasion attack.t1599.001 attack.t1557.001 ·
Share on:

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

Read More
Windows Event Log Access Tampering Via Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1547.001 attack.t1112 ·
Share on:

Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Read More
Windows Network Access Suspicious desktop.ini Action

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Read More
Windows Terminal Profile Settings Modification By Uncommon Process

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.015 ·
Share on:

Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon process.

Read More
Winlogon Helper DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.004 ·
Share on:

Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables.

Read More
Winlogon Notify Key Logon Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.004 ·
Share on:

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.

Read More
Winnti Malware HK University Campaign

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.g0044 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities

Read More
Winnti Pipemon Characteristics

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.g0044 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Winnti Pipemon malware reported by ESET

Read More
WinRAR Creating Files in Startup Locations

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088.

Read More
WMI Backdoor Exchange Transport Agent

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

Read More
WMI Event Subscription

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects creation of WMI event subscription persistence method

Read More
WMI Persistence - Command Line Event Consumer

Oct 23, 2025 · attack.privilege-escalation attack.t1546.003 attack.persistence ·
Share on:

Detects WMI command line event consumers

Read More
WMI Persistence - Script Event Consumer File Write

Oct 23, 2025 · attack.privilege-escalation attack.t1546.003 attack.persistence ·
Share on:

Detects file writes of WMI script event consumer

Read More
Writing Local Admin Share

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.lateral-movement attack.t1546.002 ·
Share on:

Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks.

Read More
Xwizard.EXE Execution From Non-Default Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

Read More
Installation of WSL Kali-Linux

Oct 23, 2025 · attack.execution attack.t1059 ·
Share on:

Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.

Read More
WSL Kali-Linux Usage

Oct 23, 2025 · attack.defense-evasion attack.t1202 ·
Share on:

Detects the use of Kali Linux through Windows Subsystem for Linux

Read More
AWS STS GetCallerIdentity Enumeration Via TruffleHog

Oct 23, 2025 · attack.discovery attack.t1087.004 ·
Share on:

Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.

Read More
Unsigned or Unencrypted SMB Connection to Share Established

Oct 23, 2025 · attack.lateral-movement attack.t1021.002 ·
Share on:

Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral movement activity using unsecured SMB shares.

Read More
HackTool - Windows Credential Editor (WCE) Execution

Oct 23, 2025 · attack.credential-access attack.t1003.001 attack.s0005 ·
Share on:

Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks.

Read More
Potential PowerShell Obfuscation Using Alias Cmdlets

Oct 23, 2025 · attack.defense-evasion attack.execution attack.t1027 attack.t1059.001 ·
Share on:

Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts

Read More
Suspicious Non PowerShell WSMAN COM Provider

Oct 23, 2025 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

Read More
RunMRU Registry Key Deletion

Oct 22, 2025 · attack.defense-evasion attack.t1070.003 ·
Share on:

Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands.

Read More
AWS Bucket Deleted

Oct 22, 2025 · attack.defense-evasion ·
Share on:

Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.

Read More
AWS ConsoleLogin Failed Authentication

Oct 22, 2025 · attack.credential-access attack.t1110 ·
Share on:

Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.

Read More
AWS EnableRegion Command Monitoring

Oct 22, 2025 · attack.persistence ·
Share on:

Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately. There may be situations where security monitoring does not cover some new AWS regions. Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.

Read More
AWS VPC Flow Logs Deleted

Oct 22, 2025 · attack.defense-evasion ·
Share on:

Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.

Read More
Hacktool - EDR-Freeze Execution

Oct 21, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.

Read More
PUA - TruffleHog Execution

Oct 21, 2025 · attack.discovery attack.credential-access attack.t1083 attack.t1552.001 ·
Share on:

Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

Read More
PUA - TruffleHog Execution - Linux

Oct 21, 2025 · attack.discovery attack.credential-access attack.t1083 attack.t1552.001 ·
Share on:

Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

Read More
Potentially Suspicious JWT Token Search Via CLI

Oct 21, 2025 · attack.credential-access attack.t1528 attack.t1552.001 ·
Share on:

Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others. Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.

Read More
Potential LSASS Process Dump Via Procdump

Oct 20, 2025 · attack.defense-evasion attack.t1036 attack.credential-access attack.t1003.001 car.2013-05-009 ·
Share on:

Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers. LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory. Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.

Read More
Local Accounts Discovery

Oct 20, 2025 · attack.discovery attack.t1033 attack.t1087.001 ·
Share on:

Local accounts, System Owner/User discovery using operating systems utilities

Read More
PowerShell Download Pattern

Oct 20, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects a Powershell process that contains download commands in its command line string

Read More
System Disk And Volume Reconnaissance Via Wmic.EXE

Oct 20, 2025 · attack.execution attack.discovery attack.t1047 attack.t1082 ·
Share on:

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the 'wmic' command-line utility and has been observed being used by threat actors such as Volt Typhoon.

Read More
Usage Of Web Request Commands And Cmdlets

Oct 20, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine

Read More
Usage Of Web Request Commands And Cmdlets - ScriptBlock

Oct 20, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs

Read More
Use Short Name Path in Image

Oct 20, 2025 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection

Read More
Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)

Oct 20, 2025 · attack.initial-access attack.t1190 detection.emerging-threats cve.2025-57791 ·
Share on:

Detects the use of argument injection in the Commvault qlogin command - potential exploitation for CVE-2025-57791. An attacker can inject the -localadmin parameter via the password field to bypass authentication and gain a privileged token.

Read More
Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)

Oct 20, 2025 · attack.persistence attack.t1505.003 detection.emerging-threats cve.2025-57790 ·
Share on:

Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. This is a post-authentication step corresponding to CVE-2025-57790.

Read More
Suspicious File Write to Webapps Root Directory

Oct 20, 2025 · attack.persistence attack.t1505.003 attack.initial-access attack.t1190 ·
Share on:

Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers. This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.

Read More
Mask System Power Settings Via Systemctl

Oct 20, 2025 · attack.persistence attack.impact attack.t1653 ·
Share on:

Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted. This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.

Read More
Potential Exploitation of GoAnywhere MFT Vulnerability

Oct 20, 2025 · attack.initial-access attack.t1190 attack.execution attack.t1059.001 attack.persistence attack.t1133 detection.emerging-threats cve.2025-10035 ·
Share on:

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

Read More
Shai-Hulud Malicious GitHub Workflow Creation

Oct 19, 2025 · attack.persistence attack.credential-access attack.t1552.001 attack.collection attack.t1119 detection.emerging-threats ·
Share on:

Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets

Read More
Shai-Hulud NPM Attack GitHub Activity

Oct 19, 2025 · attack.persistence attack.impact detection.emerging-threats ·
Share on:

Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch, inject a malicious workflow file to exfiltrate secrets, and make private repositories public.

Read More
Shai-Hulud NPM Package Malicious Exfiltration via Curl

Oct 19, 2025 · attack.exfiltration attack.t1041 attack.collection attack.t1005 detection.emerging-threats ·
Share on:

Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.

Read More
Linux Sudo Chroot Execution

Oct 19, 2025 · attack.privilege-escalation attack.t1068 ·
Share on:

Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution. Attackers may use this technique to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.

Read More
Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation

Oct 19, 2025 · attack.privilege-escalation attack.t1068 cve.2025-32463 detection.emerging-threats ·
Share on:

Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.

Read More
Potential CVE-2023-23397 Exploitation Attempt - SMB

Oct 18, 2025 · attack.exfiltration cve.2023-23397 detection.emerging-threats ·
Share on:

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

Read More
BaaUpdate.exe Suspicious DLL Load

Oct 18, 2025 · attack.defense-evasion attack.t1218 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking. This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94) which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user's context without needing to steal credentials or use additional techniques to compromise the account.

Read More
Firewall Configuration Discovery Via Netsh.EXE

Oct 18, 2025 · attack.discovery attack.t1016 ·
Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
Suspicious BitLocker Access Agent Update Utility Execution

Oct 18, 2025 · attack.defense-evasion attack.t1218 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes. Suspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking.

Read More
Suspicious C2 Activities

Oct 18, 2025 · attack.command-and-control ·
Share on:

Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)

Read More
PowerShell Download and Execution Cradles

Oct 17, 2025 · attack.execution attack.t1059 ·
Share on:

Detects PowerShell download and execution cradles.

Read More
WinRAR Execution in Non-Standard Folder

Oct 17, 2025 · attack.collection attack.t1560.001 ·
Share on:

Detects a suspicious WinRAR execution in a folder which is not the default installation folder

Read More
Account Tampering - Suspicious Failed Logon Reasons

Oct 17, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078 ·
Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Read More
Alternate PowerShell Hosts - PowerShell Module

Oct 17, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Read More
SMB Create Remote File Admin Share

Oct 17, 2025 · attack.lateral-movement attack.t1021.002 ·
Share on:

Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

Read More
File With Uncommon Extension Created By An Office Application

Oct 17, 2025 · attack.t1204.002 attack.execution ·
Share on:

Detects the creation of files with an executable or script extension by an Office application.

Read More
Office Application Initiated Network Connection Over Uncommon Ports

Oct 17, 2025 · attack.defense-evasion attack.command-and-control ·
Share on:

Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.

Read More
Office Application Initiated Network Connection To Non-Local IP

Oct 17, 2025 · attack.execution attack.t1203 ·
Share on:

Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule will require an initial baseline and tuning that is specific to your organization.

Read More
Suspicious Access to Sensitive File Extensions

Oct 17, 2025 · attack.collection attack.t1039 ·
Share on:

Detects known sensitive file extensions accessed on a network share

Read More
Suspicious Access to Sensitive File Extensions - Zeek

Oct 17, 2025 · attack.collection ·
Share on:

Detects known sensitive file extensions via Zeek

Read More
Suspicious Volume Shadow Copy Vssapi.dll Load

Oct 17, 2025 · attack.defense-evasion attack.impact attack.t1490 ·
Share on:

Detects the image load of VSS DLL by uncommon executables

Read More
Suspicious WSMAN Provider Image Loads

Oct 17, 2025 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·
Share on:

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

Read More
Program Executed Using Proxy/Local Command Via SSH.EXE

Oct 16, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detect usage of the "ssh.exe" binary as a proxy to launch other programs.

Read More
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE

Oct 16, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.

Read More
Alternate PowerShell Hosts Pipe

Oct 9, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Read More
Amsi.DLL Loaded Via LOLBIN Process

Oct 9, 2025 · attack.defense-evasion ·
Share on:

Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack

Read More
Change PowerShell Policies to an Insecure Level

Oct 9, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.

Read More
Delete Defender Scan ShellEx Context Menu Registry Key

Oct 9, 2025 · attack.defense-evasion ·
Share on:

Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.

Read More
Filter Driver Unloaded Via Fltmc.EXE

Oct 9, 2025 · attack.defense-evasion attack.t1070 attack.t1562 attack.t1562.002 ·
Share on:

Detect filter driver unloading activity via fltmc.exe

Read More
Firewall Rule Deleted Via Netsh.EXE

Oct 9, 2025 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects the removal of a port or application rule in the Windows Firewall configuration using netsh

Read More
HackTool - LaZagne Execution

Oct 9, 2025 · attack.credential-access ·
Share on:

Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged multiple times by threat actors in order to dump credentials.

Read More
Internet Explorer DisableFirstRunCustomize Enabled

Oct 9, 2025 · attack.defense-evasion ·
Share on:

Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.

Read More
New Kernel Driver Via SC.EXE

Oct 9, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects creation of a new service (kernel driver) with the type "kernel"

Read More
Potential Antivirus Software DLL Sideloading

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Read More
Potential AutoLogger Sessions Tampering

Oct 9, 2025 · attack.defense-evasion ·
Share on:

Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging

Read More
Potential DLL Sideloading Of DBGCORE.DLL

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of "dbgcore.dll"

Read More
Potential DLL Sideloading Of DBGHELP.DLL

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "dbghelp.dll"

Read More
Potential JLI.dll Side-Loading

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes.

Read More
Potential PendingFileRenameOperations Tampering

Oct 9, 2025 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.

Read More
Potential Persistence Via Visual Studio Tools for Office

Oct 9, 2025 · attack.t1137.006 attack.persistence ·
Share on:

Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.

Read More
Potential Privileged System Service Operation - SeLoadDriverPrivilege

Oct 9, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers. This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.

Read More
Potential Suspicious Browser Launch From Document Reader Process

Oct 9, 2025 · attack.execution attack.t1204.002 ·
Share on:

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.

Read More
Potentially Suspicious Windows App Activity

Oct 9, 2025 · attack.defense-evasion ·
Share on:

Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution

Read More
PowerShell Core DLL Loaded By Non PowerShell Process

Oct 9, 2025 · attack.t1059.001 attack.execution ·
Share on:

Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter's "load powershell" extension.

Read More
PowerShell Deleted Mounted Share

Oct 9, 2025 · attack.defense-evasion attack.t1070.005 ·
Share on:

Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

Read More
PowerShell Module File Created By Non-PowerShell Process

Oct 9, 2025 · attack.persistence ·
Share on:

Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process

Read More
Process Creation Using Sysnative Folder

Oct 9, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)

Read More
Process Proxy Execution Via Squirrel.EXE

Oct 9, 2025 · attack.defense-evasion attack.execution attack.t1218 ·
Share on:

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Read More
PSScriptPolicyTest Creation By Uncommon Process

Oct 9, 2025 · attack.defense-evasion ·
Share on:

Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.

Read More
Python Inline Command Execution

Oct 9, 2025 · attack.execution attack.t1059 ·
Share on:

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

Read More
Suspicious Eventlog Clear

Oct 9, 2025 · attack.defense-evasion attack.t1070.001 ·
Share on:

Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs

Read More
Suspicious Msiexec Quiet Install From Remote Location

Oct 9, 2025 · attack.defense-evasion attack.t1218.007 ·
Share on:

Detects usage of Msiexec.exe to install packages hosted remotely quietly

Read More
Uncommon New Firewall Rule Added In Windows Firewall Exception List

Oct 9, 2025 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects when a rule has been added to the Windows Firewall exception list

Read More
Unsigned DLL Loaded by Windows Utility

Oct 9, 2025 · attack.t1218.011 attack.t1218.010 attack.defense-evasion ·
Share on:

Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code.

Read More
Windows Binaries Write Suspicious Extensions

Oct 9, 2025 · attack.defense-evasion attack.t1036 ·
Share on:

Detects Windows executables that write files with suspicious extensions

Read More
IIS WebServer Access Logs Deleted

Oct 7, 2025 · attack.defense-evasion attack.t1070 ·
Share on:

Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence

Read More
IIS WebServer Log Deletion via CommandLine Utilities

Oct 7, 2025 · attack.defense-evasion attack.t1070 ·
Share on:

Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.

Read More
MMC Executing Files with Reversed Extensions Using RTLO Abuse

Oct 1, 2025 · attack.execution attack.t1204.002 attack.defense-evasion attack.t1218.014 attack.t1036.002 ·
Share on:

Detects malicious behavior where the MMC utility (mmc.exe) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.

Read More
MMC Loading Script Engines DLLs

Oct 1, 2025 · attack.execution attack.defense-evasion attack.t1059.005 attack.t1218.014 ·
Share on:

Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.

Read More
Potential Defense Evasion Via Right-to-Left Override

Oct 1, 2025 · attack.defense-evasion attack.t1036.002 ·
Share on:

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used as an obfuscation and masquerading techniques.

Read More
Potential File Extension Spoofing Using Right-to-Left Override

Oct 1, 2025 · attack.execution attack.defense-evasion attack.t1036.002 ·
Share on:

Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.

Read More
Potentially Suspicious Child Processes Spawned by ConHost

Oct 1, 2025 · attack.t1202 attack.defense-evasion attack.t1218 ·
Share on:

Detects suspicious child processes related to Windows Shell utilities spawned by conhost.exe, which could indicate malicious activity using trusted system components.

Read More
Uncommon Child Process Of Conhost.EXE

Oct 1, 2025 · attack.defense-evasion attack.t1202 ·
Share on:

Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.

Read More
NodeJS Execution of JavaScript File

Oct 1, 2025 · attack.execution attack.t1059.007 ·
Share on:

Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development. Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems. Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.

Read More
Potentially Suspicious Inline JavaScript Execution via NodeJS Binary

Oct 1, 2025 · attack.execution attack.t1059.007 ·
Share on:

Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.

Read More
Potential Hello-World Scraper Botnet Activity

Oct 1, 2025 · attack.reconnaissance attack.t1595 ·
Share on:

Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.

Read More
Suspicious Get Local Groups Information

Oct 1, 2025 · attack.discovery attack.t1069.001 ·
Share on:

Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.

Read More
Suspicious Get Local Groups Information - PowerShell

Oct 1, 2025 · attack.discovery attack.t1069.001 ·
Share on:

Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.

Read More
Python Image Load By Non-Python Process

Oct 1, 2025 · attack.defense-evasion attack.t1027.002 ·
Share on:

Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code. Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables. Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures.

Read More
UNC4841 - Barracuda ESG Exploitation Indicators

Oct 1, 2025 · attack.execution attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Read More
Suspicious Uninstall of Windows Defender Feature via PowerShell

Oct 1, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.

Read More
HackTool - CoercedPotato Execution

Oct 1, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

Read More
Suspicious ShellExec_RunDLL Call Via Ordinal

Oct 1, 2025 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.

Read More
DNS Query Tor .Onion Address - Sysmon

Oct 1, 2025 · attack.command-and-control attack.t1090.003 ·
Share on:

Detects DNS queries to an ".onion" address related to Tor routing networks

Read More
Query Tor Onion Address - DNS Client

Oct 1, 2025 · attack.command-and-control attack.t1090.003 ·
Share on:

Detects DNS resolution of an .onion address related to Tor routing networks

Read More
Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit

Sep 22, 2025 · detection.emerging-threats attack.credential-access attack.t1187 cve.2025-24054 ·
Share on:

Detects creation of '.library-ms' files, which may indicate exploitation of CVE-2025-24054. This vulnerability allows an attacker to trigger an automatic outbound SMB or WebDAV authentication request to a remote server upon archive extraction. If the system is unpatched, no user interaction is required beyond extracting a malicious archive—potentially exposing the user's NTLMv2-SSP hash to the attacker.

Read More
Potential PowerShell Console History Access Attempt via History File

Sep 22, 2025 · attack.credential-access attack.t1552.001 ·
Share on:

Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt). This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.

Read More
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server

Sep 22, 2025 · attack.command-and-control attack.t1219 attack.t1105 ·
Share on:

Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line. These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID. This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.

Read More
Regsvr32 DLL Execution With Suspicious File Extension

Sep 22, 2025 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects the execution of REGSVR32.exe with DLL files masquerading as other files

Read More
Suspicious Windows Service Tampering

Sep 22, 2025 · attack.defense-evasion attack.impact attack.t1489 attack.t1562.001 ·
Share on:

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Read More
Renamed Visual Studio Code Tunnel Execution

Sep 22, 2025 · attack.command-and-control attack.t1071.001 attack.t1219 ·
Share on:

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Read More
Visual Studio Code Tunnel Execution

Sep 22, 2025 · attack.command-and-control attack.t1071.001 attack.t1219 ·
Share on:

Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Read More
Certificate Use With No Strong Mapping

Sep 22, 2025 · attack.privilege-escalation ·
Share on:

Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.

Read More
No Suitable Encryption Key Found For Generating Kerberos Ticket

Sep 22, 2025 · attack.credential-access attack.t1558.003 ·
Share on:

Detects errors when a target server doesn't have suitable keys for generating kerberos tickets. This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.

Read More
New Service Creation Using Sc.EXE

Sep 22, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the creation of a new service using the "sc.exe" utility.

Read More
Potential Persistence Via Notepad++ Plugins

Sep 22, 2025 · attack.persistence ·
Share on:

Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence

Read More
Potential PsExec Remote Execution

Sep 22, 2025 · attack.resource-development attack.t1587.001 ·
Share on:

Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility

Read More
BITS Transfer Job Download From File Sharing Domains

Sep 22, 2025 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects BITS transfer job downloading files from a file sharing domain.

Read More
ETW Logging/Processing Option Disabled On IIS Server

Sep 22, 2025 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

Read More
HTTP Logging Disabled On IIS Server

Sep 22, 2025 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

Read More
New Module Module Added To IIS Server

Sep 22, 2025 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects the addition of a new module to an IIS server.

Read More
Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE

Sep 22, 2025 · attack.execution ·
Share on:

Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe

Read More
Previously Installed IIS Module Was Removed

Sep 22, 2025 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects the removal of a previously installed IIS module.

Read More
Suspicious File Download From File Sharing Domain Via Curl.EXE

Sep 22, 2025 · attack.execution ·
Share on:

Detects potentially suspicious file download from file sharing domains using curl.exe

Read More
Suspicious File Download From File Sharing Domain Via Wget.EXE

Sep 22, 2025 · attack.execution ·
Share on:

Detects potentially suspicious file downloads from file sharing domains using wget.exe

Read More
Suspicious File Download From File Sharing Websites - File Stream

Sep 22, 2025 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Read More
Unusual File Download From File Sharing Websites - File Stream

Sep 22, 2025 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Read More
Potentially Suspicious Execution From Tmp Folder

Aug 29, 2025 · attack.defense-evasion attack.t1036 ·
Share on:

Detects a potentially suspicious execution of a process located in the '/tmp/' folder

Read More
Capabilities Discovery - Linux

Aug 28, 2025 · attack.discovery attack.t1083 ·
Share on:

Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

Read More
Copying Sensitive Files with Credential Data

Aug 28, 2025 · attack.credential-access attack.t1003.002 attack.t1003.003 car.2013-07-001 attack.s0404 ·
Share on:

Files with well-known filenames (sensitive files with credential data) copying

Read More
Curl Download And Execute Combination

Aug 28, 2025 · attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Read More
Diskshadow Script Mode - Execution From Potential Suspicious Location

Aug 28, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

Read More
Diskshadow Script Mode - Uncommon Script Extension Execution

Aug 28, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.

Read More
DllUnregisterServer Function Call Via Msiexec.EXE

Aug 28, 2025 · attack.defense-evasion attack.t1218.007 ·
Share on:

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

Read More
Enumerate All Information With Whoami.EXE

Aug 28, 2025 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of "whoami.exe" with the "/all" flag

Read More
Esentutl Steals Browser Information

Aug 28, 2025 · attack.collection attack.t1005 ·
Share on:

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

Read More
File Deletion Via Del

Aug 28, 2025 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Read More
Forfiles Command Execution

Aug 28, 2025 · attack.execution attack.t1059 ·
Share on:

Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting.

Read More
IIS Native-Code Module Command Line Installation

Aug 28, 2025 · attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious IIS native-code module installations via command line

Read More
Insensitive Subfolder Search Via Findstr.EXE

Aug 28, 2025 · attack.defense-evasion attack.credential-access attack.command-and-control attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Read More
Kernel Memory Dump Via LiveKD

Aug 28, 2025 · attack.defense-evasion ·
Share on:

Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory

Read More
Loaded Module Enumeration Via Tasklist.EXE

Aug 28, 2025 · attack.t1003 attack.credential-access ·
Share on:

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

Read More
Lolbin Unregmp2.exe Use As Proxy

Aug 28, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"

Read More
Msiexec Quiet Installation

Aug 28, 2025 · attack.defense-evasion attack.t1218.007 ·
Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Read More
New Remote Desktop Connection Initiated Via Mstsc.EXE

Aug 28, 2025 · attack.lateral-movement attack.t1021.001 ·
Share on:

Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Read More
Port Forwarding Activity Via SSH.EXE

Aug 28, 2025 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·
Share on:

Detects port forwarding activity via SSH.exe

Read More
Potential Arbitrary Command Execution Using Msdt.EXE

Aug 28, 2025 · attack.defense-evasion attack.t1202 ·
Share on:

Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability

Read More
Potential Arbitrary Command Execution Via FTP.EXE

Aug 28, 2025 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Read More
Potential Execution of Sysinternals Tools

Aug 28, 2025 · attack.resource-development attack.t1588.002 ·
Share on:

Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools

Read More
Potential Privilege Escalation To LOCAL SYSTEM

Aug 28, 2025 · attack.resource-development attack.t1587.001 ·
Share on:

Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges

Read More
Potential Regsvr32 Commandline Flag Anomaly

Aug 28, 2025 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon.

Read More
Potentially Suspicious Cabinet File Expansion

Aug 28, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks

Read More
Potentially Suspicious Ping/Copy Command Combination

Aug 28, 2025 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.

Read More
Process Memory Dump via RdrLeakDiag.EXE

Aug 28, 2025 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory

Read More
PsExec/PAExec Escalation to LOCAL SYSTEM

Aug 28, 2025 · attack.resource-development attack.t1587.001 ·
Share on:

Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights

Read More
Qakbot Regsvr32 Calc Pattern

Aug 28, 2025 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot

Read More
Raspberry Robin Initial Execution From External Drive

Aug 28, 2025 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".

Read More
Raspberry Robin Subsequent Execution of Commands

Aug 28, 2025 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects raspberry robin subsequent execution of commands.

Read More
Rebuild Performance Counter Values Via Lodctr.EXE

Aug 28, 2025 · attack.execution ·
Share on:

Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions.

Read More
Remote File Download Via Findstr.EXE

Aug 28, 2025 · attack.defense-evasion attack.credential-access attack.command-and-control attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

Read More
Renamed ProcDump Execution

Aug 28, 2025 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defensive mechanisms.

Read More
Replace.exe Usage

Aug 28, 2025 · attack.command-and-control attack.t1105 ·
Share on:

Detects the use of Replace.exe which can be used to replace file with another file

Read More
Response File Execution Via Odbcconf.EXE

Aug 28, 2025 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.

Read More
Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location

Aug 28, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations. This behavior has been observed in-the-wild by different threat actors.

Read More
Suspicious Cabinet File Execution Via Msdt.EXE

Aug 28, 2025 · attack.defense-evasion attack.t1202 ·
Share on:

Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190

Read More
Suspicious DLL Loaded via CertOC.EXE

Aug 28, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects when a user installs certificates by using CertOC.exe to load the target DLL file.

Read More
Suspicious Msiexec Execute Arbitrary DLL

Aug 28, 2025 · attack.defense-evasion attack.t1218.007 ·
Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Read More
Suspicious Ping/Del Command Combination

Aug 28, 2025 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example

Read More
Suspicious Response File Execution Via Odbcconf.EXE

Aug 28, 2025 · attack.defense-evasion attack.t1218.008 ·
Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.

Read More
Suspicious Service Installation Script

Aug 28, 2025 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects suspicious service installation scripts

Read More
Suspicious Use of PsLogList

Aug 28, 2025 · attack.discovery attack.t1087 attack.t1087.001 attack.t1087.002 ·
Share on:

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Read More
Sysmon Configuration Update

Aug 28, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely

Read More
Uninstall Sysinternals Sysmon

Aug 28, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the removal of Sysmon, which could be a potential attempt at defense evasion

Read More
Windows Recovery Environment Disabled Via Reagentc

Aug 28, 2025 · attack.impact attack.t1490 ·
Share on:

Detects attempts to disable windows recovery environment using Reagentc. ReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE). It allows users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues.

Read More
XSL Script Execution Via WMIC.EXE

Aug 28, 2025 · attack.defense-evasion attack.t1220 ·
Share on:

Detects the execution of WMIC with the "format" flag to potentially load XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Read More
Active Directory Database Snapshot Via ADExplorer

Aug 14, 2025 · attack.discovery attack.t1087.002 attack.t1069.002 attack.t1482 ·
Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Read More
ADExplorer Writing Complete AD Snapshot Into .dat File

Aug 14, 2025 · attack.discovery attack.t1087.002 attack.t1069.002 attack.t1482 ·
Share on:

Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Read More
Create Volume Shadow Copy with Powershell

Aug 14, 2025 · attack.credential-access attack.t1003.003 attack.ds0005 ·
Share on:

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information

Read More
Potential WerFault ReflectDebugger Registry Value Abuse

Aug 14, 2025 · attack.defense-evasion attack.t1036.003 ·
Share on:

Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.

Read More
Suspicious Active Directory Database Snapshot Via ADExplorer

Aug 14, 2025 · attack.discovery attack.t1087.002 attack.t1069.002 attack.t1482 ·
Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Read More
Suspicious Windows Defender Registry Key Tampering Via Reg.EXE

Aug 14, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection

Read More
AWS CloudTrail Important Change

Aug 14, 2025 · attack.defense-evasion attack.t1562.008 ·
Share on:

Detects disabling, deleting and updating of a Trail

Read More
AWS Config Disabling Channel/Recorder

Aug 14, 2025 · attack.defense-evasion attack.t1562.008 ·
Share on:

Detects AWS Config Service disabling

Read More
Cloudflared Tunnels Related DNS Requests

Aug 14, 2025 · attack.command-and-control attack.t1071.001 attack.t1572 ·
Share on:

Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Disabling Multi Factor Authentication

Aug 14, 2025 · attack.persistence attack.defense-evasion attack.credential-access attack.t1556.006 ·
Share on:

Detects disabling of Multi Factor Authentication.

Read More
DNS Query To Devtunnels Domain

Aug 14, 2025 · attack.command-and-control attack.t1071.001 attack.t1572 ·
Share on:

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
New Federated Domain Added

Aug 14, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1484.002 ·
Share on:

Detects the addition of a new Federated Domain.

Read More
New Network ACL Entry Added

Aug 14, 2025 · attack.defense-evasion attack.t1562.007 ·
Share on:

Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.

Read More
New Network Route Added

Aug 14, 2025 · attack.defense-evasion attack.t1562.007 ·
Share on:

Detects the addition of a new network route to a route table in AWS.

Read More
Potential Bucket Enumeration on AWS

Aug 14, 2025 · attack.discovery attack.t1580 attack.t1619 ·
Share on:

Looks for potential enumeration of AWS buckets via ListBuckets.

Read More
Suspicious Inbox Forwarding Identity Protection

Aug 14, 2025 · attack.t1114.003 attack.collection ·
Share on:

Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address

Read More
Network Connection Initiated To BTunnels Domains

Aug 14, 2025 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1572 ·
Share on:

Detects network connections to BTunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Remote Access Tool - MeshAgent Command Execution via MeshCentral

Aug 14, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

Read More
Network Connection Initiated To Mega.nz

Jul 30, 2025 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.

Read More
Suspicious Dropbox API Usage

Jul 30, 2025 · attack.command-and-control attack.exfiltration attack.t1105 attack.t1567.002 ·
Share on:

Detects an executable that isn't dropbox but communicates with the Dropbox API

Read More
Network Connection Initiated To Visual Studio Code Tunnels Domain

Jul 30, 2025 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1572 ·
Share on:

Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Network Connection Initiated To Cloudflared Tunnels Domains

Jul 30, 2025 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1572 ·
Share on:

Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Process Initiated Network Connection To Ngrok Domain

Jul 30, 2025 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1572 attack.t1102 ·
Share on:

Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Read More
Network Connection Initiated To DevTunnels Domain

Jul 30, 2025 · attack.exfiltration attack.command-and-control attack.t1567.001 attack.t1572 ·
Share on:

Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read More
Suspicious Non-Browser Network Communication With Telegram API

Jul 30, 2025 · attack.command-and-control attack.exfiltration attack.t1102 attack.t1567 attack.t1105 ·
Share on:

Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

Read More
Suspicious Double Extension Files

Jul 29, 2025 · attack.defense-evasion attack.t1036.007 ·
Share on:

Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.

Read More
Suspicious File Created in Outlook Temporary Directory

Jul 29, 2025 · attack.initial-access attack.t1566.001 ·
Share on:

Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.

Read More
Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create

Jul 28, 2025 · attack.initial-access attack.t1190 cve.2025-53770 detection.emerging-threats ·
Share on:

Detects the creation of file such as spinstall0.aspx which may indicate successful exploitation of CVE-2025-53770. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

Read More
Suspicious File Write to SharePoint Layouts Directory

Jul 28, 2025 · attack.initial-access attack.t1190 attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.

Read More
Change User Agents with WebRequest

Jul 28, 2025 · attack.command-and-control attack.t1071.001 ·
Share on:

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Read More
Obfuscated IP Download Activity

Jul 28, 2025 · attack.discovery ·
Share on:

Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command

Read More
Potential DLL File Download Via PowerShell Invoke-WebRequest

Jul 28, 2025 · attack.command-and-control attack.execution attack.t1059.001 attack.t1105 ·
Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

Read More
PowerShell Script With File Upload Capabilities

Jul 28, 2025 · attack.exfiltration attack.t1020 ·
Share on:

Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.

Read More
Suspicious Invoke-WebRequest Execution

Jul 28, 2025 · attack.command-and-control attack.t1105 ·
Share on:

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

Read More
Suspicious Invoke-WebRequest Execution With DirectIP

Jul 28, 2025 · attack.command-and-control attack.t1105 ·
Share on:

Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

Read More
Disabling Windows Defender WMI Autologger Session via Reg.exe

Jul 28, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.

Read More
PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'

Jul 28, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9'). This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level. An attacker might use this technique via the command line to bypass defenses before executing payloads.

Read More
Windows Defender Context Menu Removed

Jul 28, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects the use of reg.exe or PowerShell to delete the Windows Defender context menu handler registry keys. This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives. Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.

Read More
Windows Defender Threat Severity Default Action Modified

Jul 28, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.

Read More
Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators

Jul 21, 2025 · attack.initial-access attack.t1190 cve.2025-53770 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2025-53770 by identifying indicators such as suspicious command lines discovered in Post-Exploitation activities. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

Read More
SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS

Jul 21, 2025 · attack.initial-access attack.t1190 cve.2025-53770 detection.emerging-threats ·
Share on:

Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

Read More
Suspicious Volume Shadow Copy VSS_PS.dll Load

Jul 14, 2025 · attack.defense-evasion attack.impact attack.t1490 ·
Share on:

Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.

Read More
Transferring Files with Credential Data via Network Shares

Jul 14, 2025 · attack.credential-access attack.t1003.002 attack.t1003.001 attack.t1003.003 ·
Share on:

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Read More
ADS Zone.Identifier Deleted By Uncommon Application

Jul 8, 2025 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Read More
Potential Active Directory Reconnaissance/Enumeration Via LDAP

Jul 8, 2025 · attack.discovery attack.t1069.002 attack.t1087.002 attack.t1482 ·
Share on:

Detects potential Active Directory enumeration via LDAP

Read More
Potential Binary Or Script Dropper Via PowerShell

Jul 8, 2025 · attack.persistence ·
Share on:

Detects PowerShell creating a binary executable or a script file.

Read More
Remote Thread Creation By Uncommon Source Image

Jul 8, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects uncommon processes creating remote threads.

Read More
Remote Thread Creation In Uncommon Target Image

Jul 8, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055.003 ·
Share on:

Detects uncommon target processes for remote thread creation

Read More
Suspicious Sysmon as Execution Parent

Jul 8, 2025 · attack.privilege-escalation attack.t1068 cve.2022-41120 detection.emerging-threats ·
Share on:

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

Read More
Malicious PowerShell Commandlets - PoshModule

Jul 7, 2025 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Malicious PowerShell Commandlets - ProcessCreation

Jul 7, 2025 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Malicious PowerShell Commandlets - ScriptBlock

Jul 7, 2025 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·
Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Read More
Malicious PowerShell Scripts - FileCreation

Jul 7, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects the creation of known offensive powershell scripts used for exploitation

Read More
Malicious PowerShell Scripts - PoshModule

Jul 7, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance

Read More
Potential AS-REP Roasting via Kerberos TGT Requests

Jul 7, 2025 ·
Share on:

Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encryption Type (0x17) i.e, RC4-HMAC. This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords.

Read More
Proxy Execution via Vshadow

Jul 3, 2025 · attack.defense-evasion attack.t1202 ·
Share on:

Detects the invocation of vshadow.exe with the -exec parameter that executes a specified script or command after the shadow copies are created but before the VShadow tool exits. VShadow is a command-line tool that you can use to create and manage volume shadow copies. While legitimate backup or administrative scripts may use this flag, attackers can leverage this parameter to proxy the execution of malware.

Read More
HackTool - Doppelanger LSASS Dumper Execution

Jul 3, 2025 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods

Read More
Antivirus Filter Driver Disallowed On Dev Drive - Registry

Jul 1, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".

Read More
Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Jul 1, 2025 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

Read More
Capsh Shell Invocation - Linux

Jul 1, 2025 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "capsh" utility to invoke a shell.

Read More
Data Export From MSSQL Table Via BCP.EXE

Jul 1, 2025 · attack.execution attack.exfiltration attack.t1048 ·
Share on:

Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.

Read More
Disk Image Creation Via Hdiutil - MacOS

Jul 1, 2025 · attack.exfiltration ·
Share on:

Detects the execution of the hdiutil utility in order to create a disk image.

Read More
Disk Image Mounting Via Hdiutil - MacOS

Jul 1, 2025 · attack.initial-access attack.collection attack.t1566.001 attack.t1560.001 ·
Share on:

Detects the execution of the hdiutil utility in order to mount disk images.

Read More
DNS Query To Put.io - DNS Client

Jul 1, 2025 · attack.command-and-control ·
Share on:

Detects DNS queries for subdomains related to "Put.io" sharing website.

Read More
Driver Added To Disallowed Images In HVCI - Registry

Jul 1, 2025 · attack.defense-evasion ·
Share on:

Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading.

Read More
Emotet Loader Execution Via .LNK File

Jul 1, 2025 · attack.execution attack.t1059.006 detection.emerging-threats ·
Share on:

Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022. The ".lnk" file was delivered via phishing campaign.

Read More
FakeUpdates/SocGholish Activity

Jul 1, 2025 · attack.execution attack.t1059.001 detection.emerging-threats ·
Share on:

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

Read More
HackTool - SharpWSUS/WSUSpendu Execution

Jul 1, 2025 · attack.execution attack.lateral-movement attack.t1210 ·
Share on:

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

Read More
Hidden Flag Set On File/Directory Via Chflags - MacOS

Jul 1, 2025 · attack.defense-evasion attack.credential-access attack.command-and-control attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·
Share on:

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

Read More
Inline Python Execution - Spawn Shell Via OS System Library

Jul 1, 2025 · attack.execution attack.t1059 ·
Share on:

Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.

Read More
Multi Factor Authentication Disabled For User Account

Jul 1, 2025 · attack.credential-access attack.persistence ·
Share on:

Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.

Read More
Potentially Suspicious Rundll32.EXE Execution of UDL File

Jul 1, 2025 · attack.defense-evasion attack.execution attack.command-and-control attack.t1218.011 attack.t1071 ·
Share on:

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.

Read More
Process Deletion of Its Own Executable

Jul 1, 2025 · attack.defense-evasion ·
Share on:

Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.

Read More
Shell Execution GCC - Linux

Jul 1, 2025 · attack.discovery attack.t1083 ·
Share on:

Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Shell Execution via Find - Linux

Jul 1, 2025 · attack.discovery attack.t1083 ·
Share on:

Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.

Read More
Shell Execution via Flock - Linux

Jul 1, 2025 · attack.discovery attack.t1083 ·
Share on:

Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Shell Execution via Git - Linux

Jul 1, 2025 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Shell Execution via Nice - Linux

Jul 1, 2025 · attack.discovery attack.t1083 ·
Share on:

Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Shell Invocation via Env Command - Linux

Jul 1, 2025 · attack.execution attack.t1059 ·
Share on:

Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

Read More
Shell Invocation Via Ssh - Linux

Jul 1, 2025 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Suspicious Child Process Of Wermgr.EXE

Jul 1, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.t1036 ·
Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Read More
Suspicious Download From File-Sharing Website Via Bitsadmin

Jul 1, 2025 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file from a suspicious domain

Read More
Suspicious Invocation of Shell via AWK - Linux

Jul 1, 2025 · attack.execution attack.t1059 ·
Share on:

Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Read More
Suspicious Process Masquerading As SvcHost.EXE

Jul 1, 2025 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.

Read More
Suspicious Remote AppX Package Locations

Jul 1, 2025 · attack.defense-evasion ·
Share on:

Detects an appx package added to the pipeline of the "to be processed" packages which was downloaded from a suspicious domain.

Read More
User Risk and MFA Registration Policy Updated

Jul 1, 2025 · attack.persistence ·
Share on:

Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.

Read More
Wusa.EXE Executed By Parent Process Located In Suspicious Location

Jul 1, 2025 · attack.execution ·
Share on:

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.

Read More
Suspicious Download and Execute Pattern via Curl/Wget

Jun 25, 2025 · attack.execution attack.t1059.004 attack.t1203 ·
Share on:

Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.

Read More
PowerShell MSI Install via WindowsInstaller COM From Remote Location

Jun 25, 2025 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (WindowsInstaller.Installer) hosted remotely. This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.

Read More
Remote Access Tool - Potential MeshAgent Execution - MacOS

Jun 24, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.

Read More
Remote Access Tool - Potential MeshAgent Execution - Windows

Jun 24, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.

Read More
Remote Access Tool - Renamed MeshAgent Execution - MacOS

Jun 24, 2025 · attack.command-and-control attack.defense-evasion attack.t1219.002 attack.t1036.003 ·
Share on:

Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.

Read More
Remote Access Tool - Renamed MeshAgent Execution - Windows

Jun 24, 2025 · attack.command-and-control attack.defense-evasion attack.t1219.002 attack.t1036.003 ·
Share on:

Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.

Read More
Antivirus Exploitation Framework Detection

Jun 13, 2025 · attack.execution attack.t1203 attack.command-and-control attack.t1219.002 ·
Share on:

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Atera Agent Installation

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators

Read More
DNS Query To AzureWebsites.NET By Non-Browser Process

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

Read More
DNS Query To Remote Access Software Domain From Non-Browser App

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
GoToAssist Temporary Installation Artefact

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
HackTool - Inveigh Execution Artefacts

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects the presence and execution of Inveigh via dropped artefacts

Read More
HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects the creation of file with specific names used by RemoteKrbRelay SMB Relay attack module.

Read More
Hijack Legit RDP Session to Move Laterally

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

Read More
Installation of TeamViewer Desktop

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

TeamViewer_Desktop.exe is create during install

Read More
Mesh Agent Service Installation

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

Read More
Mstsc.EXE Execution With Local RDP File

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file

Read More
Potential Amazon SSM Agent Hijacking

Jun 13, 2025 · attack.command-and-control attack.persistence attack.t1219.002 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Potential CSharp Streamer RAT Loading .NET Executable Image

Jun 13, 2025 · attack.command-and-control attack.t1219.002 detection.emerging-threats ·
Share on:

Detects potential CSharp Streamer RAT loading .NET executable image by using the default file name and path associated with the tool.

Read More
Potential Linux Amazon SSM Agent Hijacking

Jun 13, 2025 · attack.command-and-control attack.persistence attack.t1219.002 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Potential SocGholish Second Stage C2 DNS Query

Jun 13, 2025 · attack.command-and-control attack.t1219.002 detection.emerging-threats ·
Share on:

Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic

Read More
QuickAssist Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.

Read More
Remote Access Tool - AnyDesk Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - Anydesk Execution From Suspicious Folder

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - AnyDesk Incoming Connection

Jun 13, 2025 · attack.persistence attack.command-and-control attack.t1219.002 ·
Share on:

Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.

Read More
Remote Access Tool - AnyDesk Piped Password Via CLI

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.

Read More
Remote Access Tool - GoToAssist Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - LogMeIn Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - NetSupport Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - ScreenConnect Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects potentially suspicious child processes launched via the ScreenConnect client service.

Read More
Remote Access Tool - Simple Help Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Remote Access Tool - UltraViewer Execution

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
ScreenConnect Temporary Installation Artefact

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Read More
Suspicious Binary Writes Via AnyDesk

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)

Read More
Suspicious Mstsc.EXE Execution With Local RDP File

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Read More
Suspicious TSCON Start as SYSTEM

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects a tscon.exe start as LOCAL SYSTEM

Read More
TacticalRMM Service Installation

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.

Read More
TeamViewer Domain Query By Non-TeamViewer Application

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)

Read More
TeamViewer Remote Session

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

Detects the creation of log files during a TeamViewer remote session

Read More
Use of UltraVNC Remote Access Software

Jun 13, 2025 · attack.command-and-control attack.t1219.002 ·
Share on:

An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks

Read More
HKTL - SharpSuccessor Privilege Escalation Tool Execution

Jun 12, 2025 · attack.privilege-escalation attack.t1068 ·
Share on:

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments. Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.

Read More
DNS Query To Common Malware Hosting and Shortener Services

Jun 12, 2025 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners. These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS activity can indicate potential delivery or command-and-control communication attempts.

Read More
APT40 Dropbox Tool User Agent

Jun 12, 2025 · attack.command-and-control attack.t1071.001 attack.exfiltration attack.t1567.002 detection.emerging-threats ·
Share on:

Detects suspicious user agent string of APT40 Dropbox tool

Read More
Chafer Malware URL Pattern

Jun 12, 2025 · attack.command-and-control attack.t1071.001 detection.emerging-threats ·
Share on:

Detects HTTP request used by Chafer malware to receive data from its C2.

Read More
ComRAT Network Communication

Jun 12, 2025 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.g0010 detection.emerging-threats ·
Share on:

Detects Turla ComRAT network communication.

Read More
CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry

Jun 12, 2025 · attack.persistence attack.execution attack.defense-evasion attack.t1112 cve.2020-1048 detection.emerging-threats ·
Share on:

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.

Read More
Ursnif Malware C2 URL Pattern

Jun 12, 2025 · attack.initial-access attack.t1566.001 attack.execution attack.t1204.002 attack.command-and-control attack.t1071.001 detection.emerging-threats ·
Share on:

Detects Ursnif C2 traffic.

Read More
Ursnif Malware Download URL Pattern

Jun 12, 2025 · attack.command-and-control attack.t1071.001 detection.emerging-threats ·
Share on:

Detects download of Ursnif malware done by dropper documents.

Read More
MSHTA Execution with Suspicious File Extensions

Jun 11, 2025 · attack.defense-evasion attack.t1140 attack.t1218.005 attack.execution attack.t1059.007 cve.2020-1599 ·
Share on:

Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.

Read More
Potential Java WebShell Upload in SAP NetViewer Server

Jun 11, 2025 · attack.persistence attack.t1505.003 detection.emerging-threats cve.2025-31324 ·
Share on:

Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.

Read More
Potential SAP NetViewer Webshell Command Execution

Jun 11, 2025 · attack.persistence attack.t1505.003 attack.initial-access attack.t1190 detection.emerging-threats cve.2025-31324 ·
Share on:

Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter. This rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.

Read More
RegAsm.EXE Execution Without CommandLine Flags or Files

Jun 11, 2025 · attack.defense-evasion attack.t1218.009 ·
Share on:

Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injection activity. Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag.

Read More
MSSQL Destructive Query

Jun 11, 2025 · attack.exfiltration attack.impact attack.t1485 ·
Share on:

Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".

Read More
Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image

Jun 5, 2025 · attack.defense-evasion attack.t1027 ·
Share on:

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Read More
Suspicious Double Extension File Execution

Jun 5, 2025 · attack.initial-access attack.t1566.001 ·
Share on:

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns

Read More
Local Groups Discovery - Linux

Jun 5, 2025 · attack.discovery attack.t1069.001 ·
Share on:

Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings

Read More
Access of Sudoers File Content

Jun 5, 2025 · attack.reconnaissance attack.t1592.004 ·
Share on:

Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.

Read More
AddinUtil.EXE Execution From Uncommon Directory

Jun 4, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.

Read More
AspNetCompiler Execution

Jun 4, 2025 · attack.defense-evasion attack.t1127 ·
Share on:

Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.

Read More
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler

Jun 4, 2025 · attack.defense-evasion attack.t1127 ·
Share on:

Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.

Read More
Potential PowerShell Obfuscation Via WCHAR/CHAR

Jun 4, 2025 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 ·
Share on:

Detects suspicious encoded character syntax often used for defense evasion

Read More
Antivirus Ransomware Detection

Jun 4, 2025 · attack.t1486 attack.impact ·
Share on:

Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Base64 Encoded PowerShell Command Detected

Jun 4, 2025 · attack.t1027 attack.defense-evasion attack.execution attack.t1140 attack.t1059.001 ·
Share on:

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

Read More
Container With A hostPath Mount Created

Jun 4, 2025 · attack.t1611 attack.privilege-escalation ·
Share on:

Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.

Read More
Deployment Deleted From Kubernetes Cluster

Jun 4, 2025 · attack.t1498 attack.impact ·
Share on:

Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.

Read More
DNS Query Request By QuickAssist.EXE

Jun 4, 2025 · attack.command-and-control attack.initial-access attack.lateral-movement attack.t1071.001 attack.t1210 ·
Share on:

Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.

Read More
DPAPI Backup Keys And Certificate Export Activity IOC

Jun 4, 2025 · attack.credential-access attack.t1555 attack.t1552.004 ·
Share on:

Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.

Read More
F5 BIG-IP iControl Rest API Command Execution - Webserver

Jun 4, 2025 · attack.execution attack.t1190 attack.initial-access ·
Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

Read More
Hacktool Execution - Imphash

Jun 4, 2025 · attack.credential-access attack.resource-development attack.t1588.002 attack.t1003 ·
Share on:

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Read More
Interesting Service Enumeration Via Sc.EXE

Jun 4, 2025 · attack.t1003 attack.credential-access ·
Share on:

Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.

Read More
Kubernetes Secrets Enumeration

Jun 4, 2025 · attack.t1552.007 attack.credential-access ·
Share on:

Detects enumeration of Kubernetes secrets.

Read More
Live Memory Dump Using Powershell

Jun 4, 2025 · attack.credential-access attack.t1003 ·
Share on:

Detects usage of a PowerShell command to dump the live memory of a Windows machine

Read More
MMC20 Lateral Movement

Jun 4, 2025 · attack.execution attack.lateral-movement attack.t1021.003 ·
Share on:

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

Read More
Octopus Scanner Malware

Jun 4, 2025 · attack.initial-access attack.t1195 attack.t1195.001 ·
Share on:

Detects Octopus Scanner Malware.

Read More
OpenCanary - FTP Login Attempt

Jun 4, 2025 · attack.initial-access attack.exfiltration attack.lateral-movement attack.t1190 attack.t1021 ·
Share on:

Detects instances where an FTP service on an OpenCanary node has had a login attempt.

Read More
Potential Remote Command Execution In Pod Container

Jun 4, 2025 · attack.t1609 attack.execution ·
Share on:

Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.

Read More
Potential Sidecar Injection Into Running Deployment

Jun 4, 2025 · attack.t1609 attack.execution ·
Share on:

Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.

Read More
Potentially Suspicious ODBC Driver Registered

Jun 4, 2025 · attack.credential-access attack.persistence attack.t1003 ·
Share on:

Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location

Read More
PowerShell Web Access Installation - PsScript

Jun 4, 2025 · attack.persistence attack.execution attack.t1059.001 ·
Share on:

Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse

Read More
Privileged Container Deployed

Jun 4, 2025 · attack.t1611 attack.privilege-escalation ·
Share on:

Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks. A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host. Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields

Read More
Psexec Execution

Jun 4, 2025 · attack.execution attack.lateral-movement attack.t1569 attack.t1021 ·
Share on:

Detects user accept agreement execution in psexec commandline

Read More
PUA - Advanced IP/Port Scanner Update Check

Jun 4, 2025 · attack.discovery attack.reconnaissance attack.t1590 ·
Share on:

Detect the update check performed by Advanced IP/Port Scanner utilities.

Read More
PUA - Crassus Execution

Jun 4, 2025 · attack.discovery attack.reconnaissance attack.t1590.001 ·
Share on:

Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.

Read More
Rare Subscription-level Operations In Azure

Jun 4, 2025 · attack.t1003 attack.credential-access ·
Share on:

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Read More
RBAC Permission Enumeration Attempt

Jun 4, 2025 · attack.t1069.003 attack.t1087.004 attack.discovery ·
Share on:

Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment. In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command. This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.

Read More
Remote DCOM/WMI Lateral Movement

Jun 4, 2025 · attack.lateral-movement attack.execution attack.t1021.003 attack.t1047 ·
Share on:

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

Read More
Remote Server Service Abuse for Lateral Movement

Jun 4, 2025 · attack.lateral-movement attack.execution attack.t1569.002 ·
Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Read More
Renamed Powershell Under Powershell Channel

Jun 4, 2025 · attack.execution attack.defense-evasion attack.t1059.001 attack.t1036.003 ·
Share on:

Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.

Read More
Rundll32 UNC Path Execution

Jun 4, 2025 · attack.defense-evasion attack.execution attack.lateral-movement attack.t1021.002 attack.t1218.011 ·
Share on:

Detects rundll32 execution where the DLL is located on a remote location (share)

Read More
Suspicious Download from Office Domain

Jun 4, 2025 · attack.command-and-control attack.resource-development attack.t1105 attack.t1608 ·
Share on:

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Read More
Suspicious External WebDAV Execution

Jun 4, 2025 · attack.initial-access attack.resource-development attack.t1584 attack.t1566 ·
Share on:

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

Read More
Suspicious Process By Web Server Process

Jun 4, 2025 · attack.persistence attack.initial-access attack.t1505.003 attack.t1190 ·
Share on:

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Read More
Wmiexec Default Output File

Jun 4, 2025 · attack.lateral-movement attack.execution attack.t1047 ·
Share on:

Detects the creation of the default output filename used by the wmiexec tool

Read More
Writing Of Malicious Files To The Fonts Folder

Jun 4, 2025 · attack.t1211 attack.t1059 attack.defense-evasion attack.persistence attack.execution ·
Share on:

Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.

Read More
Obfuscated PowerShell MSI Install via WindowsInstaller COM

Jun 4, 2025 · attack.defense-evasion attack.t1027.010 attack.t1218.007 attack.execution attack.t1059.001 ·
Share on:

Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (WindowsInstaller.Installer). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of InstallProduct and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.

Read More
Arcadyan Router Exploitations

Jun 4, 2025 · attack.initial-access attack.t1190 cve.2021-20090 cve.2021-20091 detection.emerging-threats ·
Share on:

Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.

Read More
Azure Container Registry Created or Deleted

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Detects when a Container Registry is created or deleted.

Read More
Azure Kubernetes Cluster Created or Deleted

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Detects when a Azure Kubernetes Cluster is created or deleted.

Read More
Azure Kubernetes Network Policy Change

Jun 4, 2025 · attack.impact attack.credential-access attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when a Azure Kubernetes network policy is modified or deleted.

Read More
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted

Jun 4, 2025 · attack.impact attack.credential-access attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Read More
Azure Kubernetes Secret or Config Object Access

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Read More
Azure Kubernetes Sensitive Role Access

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when ClusterRoles/Roles are being modified or deleted.

Read More
Azure Kubernetes Service Account Modified or Deleted

Jun 4, 2025 · attack.impact attack.t1531 attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when a service account is modified or deleted.

Read More
Buffer Overflow Attempts

Jun 4, 2025 · attack.t1068 attack.privilege-escalation ·
Share on:

Detects buffer overflow attempts in Unix system log files

Read More
Connection Proxy

Jun 4, 2025 · attack.defense-evasion attack.command-and-control attack.t1090 ·
Share on:

Detects setting proxy configuration

Read More
Cscript/Wscript Potentially Suspicious Child Process

Jun 4, 2025 · attack.execution ·
Share on:

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

Read More
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump

Jun 4, 2025 · attack.credential-access attack.t1003 ·
Share on:

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

Read More
HackTool - SharpView Execution

Jun 4, 2025 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·
Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
HackTool - SysmonEnte Execution

Jun 4, 2025 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon

Read More
HackTool - TruffleSnout Execution

Jun 4, 2025 · attack.discovery attack.t1482 ·
Share on:

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

Read More
Important Windows Event Auditing Disabled

Jun 4, 2025 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.

Read More
MSI Installation From Web

Jun 4, 2025 · attack.defense-evasion attack.t1218 attack.t1218.007 ·
Share on:

Detects installation of a remote msi file from web.

Read More
MSMQ Corrupted Packet Encountered

Jun 4, 2025 · attack.execution detection.emerging-threats ·
Share on:

Detects corrupted packets sent to the MSMQ service. Could potentially be a sign of CVE-2023-21554 exploitation

Read More
Mstsc.EXE Execution From Uncommon Parent

Jun 4, 2025 · attack.lateral-movement ·
Share on:

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Read More
PaperCut MF/NG Potential Exploitation

Jun 4, 2025 · attack.execution detection.emerging-threats ·
Share on:

Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut

Read More
PetitPotam Suspicious Kerberos TGT Request

Jun 4, 2025 · attack.credential-access attack.t1187 ·
Share on:

Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.

Read More
Portable Gpg.EXE Execution

Jun 4, 2025 · attack.impact attack.t1486 ·
Share on:

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Read More
Possible DCSync Attack

Jun 4, 2025 · attack.t1033 attack.discovery ·
Share on:

Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.

Read More
Possible Exploitation of Exchange RCE CVE-2021-42321

Jun 4, 2025 · attack.lateral-movement attack.t1210 detection.emerging-threats ·
Share on:

Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321

Read More
Publicly Accessible RDP Service

Jun 4, 2025 · attack.lateral-movement attack.t1021.001 ·
Share on:

Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.

Read More
Recon Activity via SASec

Jun 4, 2025 · attack.discovery ·
Share on:

Detects remote RPC calls to read information about scheduled tasks via SASec

Read More
Remote Encrypting File System Abuse

Jun 4, 2025 · attack.lateral-movement ·
Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Read More
Remote Event Log Recon

Jun 4, 2025 · attack.discovery ·
Share on:

Detects remote RPC calls to get event log information via EVEN or EVEN6

Read More
Remote File Copy

Jun 4, 2025 · attack.command-and-control attack.lateral-movement attack.t1105 ·
Share on:

Detects the use of tools that copy files from or to remote systems

Read More
Remote Printing Abuse for Lateral Movement

Jun 4, 2025 · attack.lateral-movement ·
Share on:

Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR

Read More
Remote Registry Recon

Jun 4, 2025 · attack.discovery ·
Share on:

Detects remote RPC calls to collect information

Read More
Remote Schedule Task Recon via AtScv

Jun 4, 2025 · attack.discovery ·
Share on:

Detects remote RPC calls to read information about scheduled tasks via AtScv

Read More
Remote Schedule Task Recon via ITaskSchedulerService

Jun 4, 2025 · attack.discovery ·
Share on:

Detects remote RPC calls to read information about scheduled tasks

Read More
Remote Server Service Abuse

Jun 4, 2025 · attack.lateral-movement ·
Share on:

Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS

Read More
SharpHound Recon Account Discovery

Jun 4, 2025 · attack.t1087 attack.discovery ·
Share on:

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Read More
SharpHound Recon Sessions

Jun 4, 2025 · attack.discovery attack.t1033 ·
Share on:

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Read More
Start of NT Virtual DOS Machine

Jun 4, 2025 · attack.defense-evasion ·
Share on:

Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications

Read More
Suspicious Log Entries

Jun 4, 2025 · attack.impact ·
Share on:

Detects suspicious log entries in Linux log files

Read More
Suspicious Microsoft Office Child Process

Jun 4, 2025 · attack.defense-evasion attack.execution attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Read More
Turla Group Named Pipes

Jun 4, 2025 · attack.g0010 attack.execution attack.t1106 detection.emerging-threats ·
Share on:

Detects a named pipe used by Turla group samples

Read More
Uncommon Connection to Active Directory Web Services

Jun 4, 2025 · attack.discovery attack.t1087 ·
Share on:

Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.

Read More
Access To Crypto Currency Wallets By Uncommon Applications

Jun 2, 2025 · attack.t1003 attack.credential-access ·
Share on:

Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing.

Read More
Access To Potentially Sensitive Sysvol Files By Uncommon Applications

Jun 2, 2025 · attack.credential-access attack.t1552.006 ·
Share on:

Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.

Read More
Access To Windows Credential History File By Uncommon Applications

Jun 2, 2025 · attack.credential-access attack.t1555.004 ·
Share on:

Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function

Read More
Access To Windows DPAPI Master Keys By Uncommon Applications

Jun 2, 2025 · attack.credential-access attack.t1555.004 ·
Share on:

Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function

Read More
BitLockerTogo.EXE Execution

Jun 2, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing.

Read More
Credential Manager Access By Uncommon Applications

Jun 2, 2025 · attack.t1003 attack.credential-access ·
Share on:

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Read More
Forest Blizzard APT - File Creation Activity

Jun 2, 2025 · attack.defense-evasion attack.t1562.002 detection.emerging-threats ·
Share on:

Detects the creation of specific files inside of ProgramData directory. These files were seen being created by Forest Blizzard as described by MSFT.

Read More
Kubernetes CronJob/Job Modification

Jun 2, 2025 · attack.persistence attack.privilege-escalation attack.execution ·
Share on:

Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.

Read More
Kubernetes Rolebinding Modification

Jun 2, 2025 · attack.privilege-escalation ·
Share on:

Detects when a Kubernetes Rolebinding is created or modified.

Read More
Kubernetes Secrets Modified or Deleted

Jun 2, 2025 · attack.credential-access ·
Share on:

Detects when Kubernetes Secrets are Modified or Deleted.

Read More
Microsoft Teams Sensitive File Access By Uncommon Applications

Jun 2, 2025 · attack.credential-access attack.t1528 ·
Share on:

Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.

Read More
Network Connection Initiated To AzureWebsites.NET By Non-Browser Process

Jun 2, 2025 · attack.command-and-control attack.t1102 attack.t1102.001 ·
Share on:

Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

Read More
PDF File Created By RegEdit.EXE

Jun 2, 2025 · attack.defense-evasion ·
Share on:

Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses.

Read More
Potential APT FIN7 Exploitation Activity

Jun 2, 2025 · attack.execution attack.t1059.001 attack.t1059.003 detection.emerging-threats ·
Share on:

Detects potential APT FIN7 exploitation activity as reported by Google. In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.

Read More
Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group

Jun 2, 2025 · attack.execution cve.2024-37085 detection.emerging-threats ·
Share on:

Detects execution of the "net.exe" command in order to add a group named "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

Read More
Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity

Jun 2, 2025 · attack.execution cve.2024-37085 detection.emerging-threats ·
Share on:

Detects any creation or modification to a windows domain group with the name "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

Read More
Process Launched Without Image Name

Jun 2, 2025 · attack.defense-evasion ·
Share on:

Detect the use of processes with no name (".exe"), which can be used to evade Image-based detections.

Read More
Renamed BOINC Client Execution

Jun 2, 2025 · attack.defense-evasion attack.t1553 ·
Share on:

Detects the execution of a renamed BOINC binary.

Read More
Renamed Microsoft Teams Execution

Jun 2, 2025 · attack.defense-evasion ·
Share on:

Detects the execution of a renamed Microsoft Teams binary.

Read More
MSSQL Server Failed Logon From External Network

May 31, 2025 · attack.credential-access attack.t1110 ·
Share on:

Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.

Read More
Suspicious Deno File Written from Remote Source

May 27, 2025 · attack.execution attack.t1204 attack.t1059.007 attack.command-and-control attack.t1105 ·
Share on:

Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.

Read More
HackTool - Impacket File Indicators

May 27, 2025 · attack.credential-access attack.t1003.001 ·
Share on:

Detects file creation events with filename patterns used by Impacket.

Read More
DNS Query To Katz Stealer Domains

May 26, 2025 · attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

Read More
DNS Query To Katz Stealer Domains - Network

May 26, 2025 · attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

Read More
Enumeration for 3rd Party Creds From CLI

May 26, 2025 · attack.credential-access attack.t1552.002 ·
Share on:

Detects processes that query known 3rd party registry keys that holds credentials via commandline

Read More
Katz Stealer DLL Loaded

May 26, 2025 · attack.execution attack.t1129 detection.emerging-threats ·
Share on:

Detects loading of DLLs associated with Katz Stealer malware 2025 variants. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. The process that loads these DLLs are very likely to be malicious.

Read More
Katz Stealer Suspicious User-Agent

May 26, 2025 · attack.command-and-control attack.t1071.001 detection.emerging-threats ·
Share on:

Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity.

Read More
Registry Export of Third-Party Credentials

May 26, 2025 · attack.credential-access attack.t1552.002 ·
Share on:

Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry.

Read More
Suspicious File Access to Browser Credential Storage

May 26, 2025 · attack.credential-access attack.t1555.003 attack.discovery attack.t1217 ·
Share on:

Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware.

Read More
Crash Dump Created By Operating System

May 21, 2025 · attack.credential-access attack.collection attack.t1003.002 attack.t1005 ·
Share on:

Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.

Read More
ESXi Account Creation Via ESXCLI

May 21, 2025 · attack.persistence attack.execution attack.t1136 attack.t1059.012 ·
Share on:

Detects user account creation on ESXi system via esxcli

Read More
ESXi Network Configuration Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·
Share on:

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

Read More
ESXi Storage Information Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·
Share on:

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

Read More
ESXi Syslog Configuration Change Via ESXCLI

May 21, 2025 · attack.defense-evasion attack.execution attack.t1562.001 attack.t1562.003 attack.t1059.012 ·
Share on:

Detects changes to the ESXi syslog configuration via "esxcli"

Read More
ESXi System Information Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·
Share on:

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

Read More
ESXi VM Kill Via ESXCLI

May 21, 2025 · attack.execution attack.impact attack.t1059.012 attack.t1529 ·
Share on:

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

Read More
ESXi VM List Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·
Share on:

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

Read More
ESXi VSAN Information Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·
Share on:

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

Read More
Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script

May 20, 2025 · attack.impact attack.t1490 ·
Share on:

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Read More
Active Directory Certificate Services Denied Certificate Enrollment Request

May 20, 2025 · attack.credential-access attack.defense-evasion attack.t1553.004 ·
Share on:

Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with permissions on the certificate template or invalid signatures.

Read More
Creation Of Pod In System Namespace

May 20, 2025 · attack.defense-evasion attack.t1036.005 ·
Share on:

Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names. Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection. Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.

Read More
Kubernetes Events Deleted

May 20, 2025 · attack.defense-evasion attack.t1070 ·
Share on:

Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.

Read More
Mount Execution With Hidepid Parameter

May 20, 2025 · attack.credential-access attack.defense-evasion attack.t1564 ·
Share on:

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

Read More
Outlook EnableUnsafeClientMailRules Setting Enabled

May 20, 2025 · attack.execution attack.defense-evasion attack.t1059 attack.t1202 ·
Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Read More
Renamed BrowserCore.EXE Execution

May 20, 2025 · attack.credential-access attack.defense-evasion attack.t1528 attack.t1036.003 ·
Share on:

Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)

Read More
Silenttrinity Stager Msbuild Activity

May 20, 2025 · attack.execution attack.defense-evasion attack.t1127.001 ·
Share on:

Detects a possible remote connections to Silenttrinity c2

Read More
Suspicious Remote Child Process From Outlook

May 20, 2025 · attack.execution attack.defense-evasion attack.t1059 attack.t1202 ·
Share on:

Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

Read More
Suspicious Use of CSharp Interactive Console

May 20, 2025 · attack.execution attack.defense-evasion attack.t1127 ·
Share on:

Detects the execution of CSharp interactive console by PowerShell

Read More
Browser Started with Remote Debugging

May 20, 2025 · attack.credential-access attack.collection attack.t1185 ·
Share on:

Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks

Read More
OpenCanary - HTTPPROXY Login Attempt

May 20, 2025 · attack.initial-access attack.defense-evasion attack.command-and-control attack.t1090 ·
Share on:

Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.

Read More
Outbound Network Connection Initiated By Microsoft Dialer

May 20, 2025 · attack.execution attack.command-and-control attack.t1071.001 ·
Share on:

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

Read More
Suspicious Curl File Upload - Linux

May 20, 2025 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1105 ·
Share on:

Detects a suspicious curl process start the adds a file to a web request

Read More
Hacktool Execution - PE Metadata

May 20, 2025 · attack.credential-access attack.resource-development attack.t1588.002 attack.t1003 ·
Share on:

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Read More
New Kubernetes Service Account Created

May 20, 2025 · attack.persistence attack.t1136 ·
Share on:

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

Read More
Possible DC Shadow Attack

May 20, 2025 · attack.credential-access attack.defense-evasion attack.t1207 ·
Share on:

Detects DCShadow via create new SPN

Read More
Potential Discovery Activity Via Dnscmd.EXE

May 20, 2025 · attack.discovery attack.execution ·
Share on:

Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.

Read More
Potential Windows Defender Tampering Via Wmic.EXE

May 20, 2025 · attack.defense-evasion attack.execution attack.t1047 attack.t1562 ·
Share on:

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

Read More
Suspicious SQL Query

May 20, 2025 · attack.exfiltration attack.initial-access attack.privilege-escalation attack.persistence attack.t1190 attack.t1505.001 ·
Share on:

Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields

Read More
Uncommon Outbound Kerberos Connection - Security

May 20, 2025 · attack.lateral-movement attack.credential-access attack.t1558.003 ·
Share on:

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Read More
Windows LAPS Credential Dump From Entra ID

May 20, 2025 · attack.privilege-escalation attack.persistence attack.t1098.005 ·
Share on:

Detects when an account dumps the LAPS password from Entra ID.

Read More
Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE

May 20, 2025 · attack.initial-access attack.t1190 attack.execution attack.t1203 cve.2025-4427 cve.2025-4428 detection.emerging-threats ·
Share on:

Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.

Read More
Communication To LocaltoNet Tunneling Service Initiated

May 20, 2025 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·
Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Read More
Communication To LocaltoNet Tunneling Service Initiated - Linux

May 20, 2025 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·
Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Read More
CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21

May 20, 2025 · attack.initial-access attack.t1190 cve.2023-1389 detection.emerging-threats ·
Share on:

Detects potential exploitation attempt of CVE-2023-1389 an Unauthenticated Command Injection in TP-Link Archer AX21.

Read More
DSInternals Suspicious PowerShell Cmdlets

May 20, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Read More
DSInternals Suspicious PowerShell Cmdlets - ScriptBlock

May 20, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Read More
HackTool - CrackMapExec File Indicators

May 20, 2025 · attack.credential-access attack.t1003.001 ·
Share on:

Detects file creation events with filename patterns used by CrackMapExec.

Read More
HackTool - RemoteKrbRelay Execution

May 20, 2025 · attack.credential-access attack.t1558.003 ·
Share on:

Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.

Read More
HackTool - SharpDPAPI Execution

May 20, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

Read More
Hypervisor Enforced Paging Translation Disabled

May 20, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.

Read More
Kapeka Backdoor Configuration Persistence

May 20, 2025 · attack.persistence attack.defense-evasion attack.t1553.003 detection.emerging-threats ·
Share on:

Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.

Read More
Kapeka Backdoor Execution Via RunDLL32.EXE

May 20, 2025 · attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.

Read More
Kapeka Backdoor Loaded Via Rundll32.EXE

May 20, 2025 · attack.execution attack.t1204.002 attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.

Read More
Kapeka Backdoor Scheduled Task Creation

May 20, 2025 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

Read More
MSSQL Server Failed Logon

May 20, 2025 · attack.credential-access attack.t1110 ·
Share on:

Detects failed logon attempts from clients to MSSQL server.

Read More
Periodic Backup For System Registry Hives Enabled

May 20, 2025 · attack.collection attack.t1113 ·
Share on:

Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups. Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".

Read More
Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process

May 20, 2025 · attack.execution cve.2024-3094 detection.emerging-threats ·
Share on:

Detects potentially suspicious child process of SSH process (sshd) with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.

Read More
Potential Kapeka Decrypted Backdoor Indicator

May 20, 2025 · attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the presence of a file that is decrypted backdoor binary dropped by the Kapeka Dropper, which disguises itself as a hidden file under a folder named "Microsoft" within "CSIDL_COMMON_APPDATA" or "CSIDL_LOCAL_APPDATA", depending on the process privileges. The file, typically 5-6 characters long with a random combination of consonants and vowels followed by a ".wll" extension to pose as a legitimate file to evade detection.

Read More
DLL Search Order Hijackig Via Additional Space in Path

May 15, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·
Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

Read More
DLL Sideloading Of ShellChromeAPI.DLL

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Malicious DLL File Dropped in the Teams or OneDrive Folder

May 15, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·
Share on:

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded

Read More
Microsoft Office DLL Sideload

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Read More
Potential 7za.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "7za.dll"

Read More
Potential CCleanerDU.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Read More
Potential CCleanerReactivator.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Read More
Potential Chrome Frame Helper DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Read More
Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Read More
Potential DLL Sideloading Of Non-Existent DLLs From System Folders

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories). Usually this technique is used to achieve UAC bypass or privilege escalation.

Read More
Potential DLL Sideloading Via ClassicExplorer32.dll

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Read More
Potential DLL Sideloading Via comctl32.dll

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Read More
Potential DLL Sideloading Via JsSchHlp

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Read More
Potential Libvlc.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

Read More
Potential Wazuh Security Platform DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Read More
Third Party Software DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Read More
UAC Bypass With Fake DLL

May 15, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1574.001 ·
Share on:

Attempts to load dismcore.dll after dropping it

Read More
VMGuestLib DLL Sideload

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

Read More
VMMap Signed Dbghelp.DLL Potential Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

Read More
VMMap Unsigned Dbghelp.DLL Potential Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Read More
Suspicious PowerShell Invocations - Specific

May 12, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
Suspicious PowerShell Invocations - Specific - PowerShell Module

May 12, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects suspicious PowerShell invocation command parameters

Read More
CreateDump Process Dump

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·
Share on:

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

Read More
DumpMinitool Execution

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·
Share on:

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

Read More
HackTool - HandleKatz Duplicating LSASS Handle

Apr 25, 2025 · attack.execution attack.t1106 attack.defense-evasion attack.t1003.001 attack.credential-access ·
Share on:

Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles

Read More
HackTool - XORDump Execution

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·
Share on:

Detects suspicious use of XORDump process memory dumping utility

Read More
Potential SysInternals ProcDump Evasion

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·
Share on:

Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name

Read More
Procdump Execution

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·
Share on:

Detects usage of the SysInternals Procdump utility

Read More
Renamed CreateDump Utility Execution

Apr 25, 2025 · attack.defense-evasion attack.t1036 attack.t1003.001 attack.credential-access ·
Share on:

Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory

Read More
Suspicious DumpMinitool Execution

Apr 25, 2025 · attack.defense-evasion attack.credential-access attack.t1036 attack.t1003.001 ·
Share on:

Detects suspicious ways to use the "DumpMinitool.exe" binary

Read More
Chopper Webshell Process Pattern

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Read More
HackTool - winPEAS Execution

Apr 25, 2025 · attack.privilege-escalation attack.discovery attack.t1082 attack.t1087 attack.t1046 ·
Share on:

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Read More
Webshell Detection With Command Line Keywords

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Read More
Webshell Hacking Activity Patterns

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Read More
Suspicious CrushFTP Child Process

Apr 17, 2025 · attack.initial-access attack.execution attack.t1059.001 attack.t1059.003 attack.t1190 cve.2025-31161 detection.emerging-threats ·
Share on:

Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.

Read More
Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC

Apr 17, 2025 · attack.execution attack.lateral-movement attack.t1210 cve.2020-1472 detection.emerging-threats ·
Share on:

Detects the execution of the commonly used ZeroLogon PoC executable.

Read More
Obfuscated PowerShell OneLiner Execution

Apr 17, 2025 · attack.defense-evasion attack.execution attack.t1059.001 attack.t1562.001 ·
Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1

Apr 17, 2025 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2

Apr 17, 2025 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Apr 17, 2025 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4

Apr 17, 2025 · attack.defense-evasion ·
Share on:

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Read More
Suspicious Eventlog Clearing or Configuration Change Activity

Apr 16, 2025 · attack.defense-evasion attack.t1070.001 attack.t1562.002 car.2016-04-002 ·
Share on:

Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses.

Read More
Potential Product Class Reconnaissance Via Wmic.EXE

Apr 16, 2025 · attack.execution attack.t1047 attack.discovery attack.t1082 ·
Share on:

Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products. Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms. This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.

Read More
Potential Browser Data Stealing

Apr 16, 2025 · attack.credential-access attack.t1555.003 ·
Share on:

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Read More
Suspicious LNK Command-Line Padding with Whitespace Characters

Apr 16, 2025 · attack.initial-access attack.execution attack.t1204.002 ·
Share on:

Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks.

Read More
DarkGate - Drop DarkGate Loader In C:\Temp Directory

Apr 16, 2025 · attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.

Read More
File Download Via Nscurl - MacOS

Apr 16, 2025 · attack.defense-evasion attack.command-and-control attack.t1105 ·
Share on:

Detects the execution of the nscurl utility in order to download files.

Read More
File Recovery From Backup Via Wbadmin.EXE

Apr 16, 2025 · attack.impact attack.t1490 ·
Share on:

Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.

Read More
Network Communication Initiated To Portmap.IO Domain

Apr 16, 2025 · attack.t1041 attack.command-and-control attack.t1090.002 attack.exfiltration ·
Share on:

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

Read More
New File Exclusion Added To Time Machine Via Tmutil - MacOS

Apr 16, 2025 · attack.impact attack.t1490 ·
Share on:

Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.

Read More
New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application

Apr 16, 2025 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.

Read More
New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE

Apr 16, 2025 · attack.defense-evasion attack.t1562.004 ·
Share on:

Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".

Read More
Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock

Apr 16, 2025 · attack.credential-access attack.discovery attack.t1040 ·
Share on:

Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.

Read More
Potentially Suspicious Malware Callback Communication - Linux

Apr 16, 2025 · attack.persistence attack.command-and-control attack.t1571 ·
Share on:

Detects programs that connect to known malware callback ports based on threat intelligence reports.

Read More
Potentially Suspicious Usage Of Qemu

Apr 16, 2025 · attack.command-and-control attack.t1090 attack.t1572 ·
Share on:

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

Read More
Sensitive File Dump Via Wbadmin.EXE

Apr 16, 2025 · attack.credential-access attack.t1003.003 ·
Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Read More
Sensitive File Recovery From Backup Via Wbadmin.EXE

Apr 16, 2025 · attack.credential-access attack.t1003.003 ·
Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Read More
System Information Discovery Via Sysctl - MacOS

Apr 16, 2025 · attack.defense-evasion attack.t1497.001 attack.discovery attack.t1082 ·
Share on:

Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.

Read More
Time Machine Backup Deletion Attempt Via Tmutil - MacOS

Apr 16, 2025 · attack.impact attack.t1490 ·
Share on:

Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.

Read More
Time Machine Backup Disabled Via Tmutil - MacOS

Apr 16, 2025 · attack.impact attack.t1490 ·
Share on:

Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring.

Read More
UAC Notification Disabled

Apr 16, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users. When "UACDisableNotify" is set to 1, UAC prompts are suppressed.

Read More
UAC Secure Desktop Prompt Disabled

Apr 16, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.

Read More
Uncommon File Creation By Mysql Daemon Process

Apr 16, 2025 · attack.defense-evasion ·
Share on:

Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "User Defined Functions" abuse to download malware.

Read More
Uncommon Process Access Rights For Target Image

Apr 16, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055.011 ·
Share on:

Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.

Read More
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted

Apr 16, 2025 · attack.collection attack.t1113 ·
Share on:

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

Read More
Windows Recall Feature Enabled - Registry

Apr 16, 2025 · attack.collection attack.t1113 ·
Share on:

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0". Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

Read More
Windows Recall Feature Enabled Via Reg.EXE

Apr 16, 2025 · attack.collection attack.t1113 ·
Share on:

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

Read More
Potential Adplus.EXE Abuse

Apr 16, 2025 · attack.defense-evasion attack.execution attack.credential-access attack.t1003.001 ·
Share on:

Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

Read More
Potential Binary Impersonating Sysinternals Tools

Apr 16, 2025 · attack.execution attack.defense-evasion attack.t1218 attack.t1202 attack.t1036.005 ·
Share on:

Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the execution of binaries that are named similarly to Sysinternals tools. Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.

Read More
AWS New Lambda Layer Attached

Apr 7, 2025 · attack.privilege-escalation ·
Share on:

Detects when a user attached a Lambda layer to an existing Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role. This would give an adversary access to resources that the function has access to.

Read More
Conhost Spawned By Uncommon Parent Process

Apr 7, 2025 · attack.execution attack.t1059 ·
Share on:

Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.

Read More
Elevated System Shell Spawned From Uncommon Parent Location

Apr 7, 2025 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Read More
Potential WinAPI Calls Via CommandLine

Apr 7, 2025 · attack.execution attack.t1106 ·
Share on:

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Read More
Python Initiated Connection

Apr 7, 2025 · attack.discovery attack.t1046 ·
Share on:

Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.

Read More
Whoami.EXE Execution Anomaly

Apr 7, 2025 · attack.discovery attack.t1033 car.2016-03-001 ·
Share on:

Detects the execution of whoami.exe with suspicious parent processes.

Read More
Windows Processes Suspicious Parent Directory

Apr 7, 2025 · attack.defense-evasion attack.t1036.003 attack.t1036.005 ·
Share on:

Detect suspicious parent processes of well-known Windows processes

Read More
Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock

Apr 7, 2025 · attack.reconnaissance attack.discovery attack.credential-access attack.t1018 attack.t1558 attack.t1589.002 ·
Share on:

Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.

Read More
Notepad Password Files Discovery

Mar 4, 2025 · attack.discovery attack.t1083 ·
Share on:

Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.

Read More
Forest Blizzard APT - JavaScript Constrained File Creation

Mar 4, 2025 · attack.defense-evasion attack.t1562.002 detection.emerging-threats ·
Share on:

Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.

Read More
Kubernetes Unauthorized or Unauthenticated Access

Mar 4, 2025 · attack.privilege-escalation ·
Share on:

Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained.

Read More
Pnscan Binary Data Transmission Activity

Mar 4, 2025 · attack.discovery attack.t1046 ·
Share on:

Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT

Read More
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation

Mar 4, 2025 · attack.execution cve.2024-3400 detection.emerging-threats ·
Share on:

Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled. As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.

Read More
PUA - SoftPerfect Netscan Execution

Mar 4, 2025 · attack.discovery attack.t1046 ·
Share on:

Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.

Read More
RegAsm.EXE Initiating Network Connection To Public IP

Mar 4, 2025 · attack.defense-evasion attack.t1218.009 ·
Share on:

Detects "RegAsm.exe" initiating a network connection to public IP adresses

Read More
Anydesk Remote Access Software Service Installation

Mar 4, 2025 · attack.persistence ·
Share on:

Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the software isn't already used.

Read More
Nslookup PowerShell Download Cradle

Mar 4, 2025 · attack.execution attack.t1059.001 ·
Share on:

Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

Read More
HTTP Request to Low Reputation TLD or Suspicious File Extension

Mar 4, 2025 · attack.initial-access attack.command-and-control ·
Share on:

Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity.

Read More
Backup Files Deleted

Feb 28, 2025 · attack.impact attack.t1490 ·
Share on:

Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Read More
File Deleted Via Sysinternals SDelete

Feb 28, 2025 · attack.defense-evasion attack.t1070.004 ·
Share on:

Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.

Read More
Potential Obfuscated Ordinal Call Via Rundll32

Feb 25, 2025 · attack.defense-evasion attack.t1027.010 ·
Share on:

Detects execution of "rundll32" with potential obfuscated ordinal calls

Read More
Process Memory Dump Via Comsvcs.DLL

Feb 25, 2025 · attack.defense-evasion attack.credential-access attack.t1036 attack.t1003.001 car.2013-05-009 ·
Share on:

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

Read More
Potential CVE-2024-35250 Exploitation Activity

Feb 24, 2025 · attack.privilege-escalation attack.t1068 cve.2024-35250 detection.emerging-threats ·
Share on:

Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.

Read More
Clfs.SYS Loaded By Process Located In a Potential Suspicious Location

Feb 22, 2025 · attack.execution attack.t1059 ·
Share on:

Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.

Read More
Suspicious Non-Browser Network Communication With Google API

Feb 22, 2025 · attack.command-and-control attack.t1102 ·
Share on:

Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)

Read More
AADInternals PowerShell Cmdlets Execution - ProccessCreation

Feb 17, 2025 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
AADInternals PowerShell Cmdlets Execution - PsScript

Feb 17, 2025 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
PUA - NimScan Execution

Feb 17, 2025 · attack.discovery attack.t1046 ·
Share on:

Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment. This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.

Read More
Change Winevt Channel Access Permission Via Registry

Feb 3, 2025 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.

Read More
CVE-2024-1212 Exploitation - Progress Kemp LoadMaster Unauthenticated Command Injection

Feb 3, 2025 · attack.initial-access cve.2024-1212 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2024-1709 an unauthenticated command injection in Progress Kemp LoadMaster. It looks for GET requests to '/access/set' API with the parameters 'param=enableapi' and 'value=1' as well as an "Authorization" header with a base64 encoded value with an uncommon character.

Read More
Disable Windows Event Logging Via Registry

Feb 3, 2025 · attack.defense-evasion attack.t1562.002 ·
Share on:

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Read More
Displaying Hidden Files Feature Disabled

Feb 3, 2025 · attack.defense-evasion attack.t1564.001 ·
Share on:

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

Read More
MaxMpxCt Registry Value Changed

Feb 3, 2025 · attack.defense-evasion attack.t1070.005 ·
Share on:

Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate. Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic.

Read More
New TimeProviders Registered With Uncommon DLL Name

Feb 3, 2025 · attack.persistence attack.privilege-escalation attack.t1547.003 ·
Share on:

Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

Read More
OpenCanary - GIT Clone Request

Feb 3, 2025 · attack.collection attack.t1213 ·
Share on:

Detects instances where a GIT service on an OpenCanary node has had Git Clone request.

Read More
OpenCanary - HTTP GET Request

Feb 3, 2025 · attack.initial-access attack.t1190 ·
Share on:

Detects instances where an HTTP service on an OpenCanary node has received a GET request.

Read More
OpenCanary - HTTP POST Login Attempt

Feb 3, 2025 · attack.initial-access attack.t1190 ·
Share on:

Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.

Read More
OpenCanary - MSSQL Login Attempt Via SQLAuth

Feb 3, 2025 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·
Share on:

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.

Read More
OpenCanary - MSSQL Login Attempt Via Windows Authentication

Feb 3, 2025 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·
Share on:

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.

Read More
OpenCanary - MySQL Login Attempt

Feb 3, 2025 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·
Share on:

Detects instances where a MySQL service on an OpenCanary node has had a login attempt.

Read More
OpenCanary - NTP Monlist Request

Feb 3, 2025 · attack.impact attack.t1498 ·
Share on:

Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.

Read More
OpenCanary - REDIS Action Command Attempt

Feb 3, 2025 · attack.credential-access attack.collection attack.t1003 attack.t1213 ·
Share on:

Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.

Read More
OpenCanary - SIP Request

Feb 3, 2025 · attack.collection attack.t1123 ·
Share on:

Detects instances where an SIP service on an OpenCanary node has had a SIP request.

Read More
OpenCanary - SMB File Open Request

Feb 3, 2025 · attack.lateral-movement attack.collection attack.t1021 attack.t1005 ·
Share on:

Detects instances where an SMB service on an OpenCanary node has had a file open request.

Read More
OpenCanary - SNMP OID Request

Feb 3, 2025 · attack.discovery attack.lateral-movement attack.t1016 attack.t1021 ·
Share on:

Detects instances where an SNMP service on an OpenCanary node has had an OID request.

Read More
OpenCanary - TFTP Request

Feb 3, 2025 · attack.exfiltration attack.t1041 ·
Share on:

Detects instances where a TFTP service on an OpenCanary node has had a request.

Read More
OpenCanary - VNC Connection Attempt

Feb 3, 2025 · attack.lateral-movement attack.t1021 ·
Share on:

Detects instances where a VNC service on an OpenCanary node has had a connection attempt.

Read More
Potential KamiKakaBot Activity - Lure Document Execution

Feb 3, 2025 · attack.execution attack.t1059 detection.emerging-threats ·
Share on:

Detects the execution of a Word document via the WinWord Start Menu shortcut. This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.

Read More
Potential KamiKakaBot Activity - Shutdown Schedule Task Creation

Feb 3, 2025 · attack.persistence detection.emerging-threats ·
Share on:

Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command. This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.

Read More
Potentially Suspicious CMD Shell Output Redirect

Feb 3, 2025 · attack.defense-evasion attack.t1218 ·
Share on:

Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

Read More
Register New IFiltre For Persistence

Feb 3, 2025 · attack.persistence ·
Share on:

Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.

Read More
Renamed NirCmd.EXE Execution

Feb 3, 2025 · attack.execution attack.t1059 attack.defense-evasion attack.t1202 ·
Share on:

Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.

Read More
Rundll32 Execution With Uncommon DLL Extension

Feb 3, 2025 · attack.defense-evasion attack.t1218.011 ·
Share on:

Detects the execution of rundll32 with a command line that doesn't contain a common extension

Read More
ServiceDll Hijack

Feb 3, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.

Read More
Suspicious Network Connection to IP Lookup Service APIs

Feb 3, 2025 · attack.discovery attack.t1016 ·
Share on:

Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.

Read More
Sysmon Driver Altitude Change

Feb 3, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects changes in Sysmon driver altitude value. If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.

Read More
Windows Defender Service Disabled - Registry

Feb 3, 2025 · attack.defense-evasion attack.t1562.001 ·
Share on:

Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry

Read More
WCE wceaux.dll Access

Jan 31, 2025 · attack.credential-access attack.t1003 attack.s0005 ·
Share on:

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

Read More
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)

Jan 30, 2025 · attack.execution attack.t1059 attack.initial-access attack.t1190 cve.2023-22518 detection.emerging-threats ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

Jan 30, 2025 · attack.execution attack.t1059 attack.initial-access attack.t1190 cve.2023-22518 detection.emerging-threats ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-22518 detection.emerging-threats ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-22518 detection.emerging-threats ·
Share on:

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Read More
CVE-2023-46747 Exploitation Activity - Proxy

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-46747 detection.emerging-threats ·
Share on:

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

Read More
CVE-2023-46747 Exploitation Activity - Webserver

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-46747 detection.emerging-threats ·
Share on:

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

Read More
CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-4966 detection.emerging-threats ·
Share on:

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs by looking for a very long host header string.

Read More
CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-4966 detection.emerging-threats ·
Share on:

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs by looking for a very long host header string.

Read More
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-4966 detection.emerging-threats ·
Share on:

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs.

Read More
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-4966 detection.emerging-threats ·
Share on:

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs.

Read More
CVE-2024-1708 - ScreenConnect Path Traversal Exploitation

Jan 30, 2025 · attack.persistence cve.2024-1708 detection.emerging-threats ·
Share on:

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708.

Read More
CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security

Jan 30, 2025 · attack.initial-access attack.persistence cve.2024-1708 detection.emerging-threats ·
Share on:

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

Read More
CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation

Jan 30, 2025 · attack.initial-access attack.persistence cve.2024-1709 detection.emerging-threats ·
Share on:

Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709.

Read More
Exploitation Attempt Of CVE-2023-46214 Using Public POC Code

Jan 30, 2025 · attack.lateral-movement attack.t1210 cve.2023-46214 detection.emerging-threats ·
Share on:

Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code

Read More
File Creation Related To RAT Clients

Jan 30, 2025 · attack.execution detection.emerging-threats ·
Share on:

File .conf created related to VenomRAT, AsyncRAT and Lummac samples observed in the wild.

Read More
Forest Blizzard APT - Process Creation Activity

Jan 30, 2025 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.

Read More
MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request

Jan 30, 2025 · attack.persistence attack.t1505.003 cve.2023-34362 detection.emerging-threats ·
Share on:

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Read More
OWASSRF Exploitation Attempt Using Public POC - Proxy

Jan 30, 2025 · attack.initial-access attack.t1190 detection.emerging-threats ·
Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

Read More
Pikabot Fake DLL Extension Execution Via Rundll32.EXE

Jan 30, 2025 · attack.defense-evasion attack.execution detection.emerging-threats ·
Share on:

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

Read More
Potential BlackByte Ransomware Activity

Jan 30, 2025 · attack.execution attack.defense-evasion attack.impact attack.t1485 attack.t1498 attack.t1059.001 attack.t1140 detection.emerging-threats ·
Share on:

Detects command line patterns used by BlackByte ransomware in different operations

Read More
Potential CVE-2023-27997 Exploitation Indicators

Jan 30, 2025 · attack.initial-access attack.t1190 cve.2023-27997 detection.emerging-threats ·
Share on:

Detects indicators of potential exploitation of CVE-2023-27997 in Frotigate weblogs. To avoid false positives it is best to look for successive requests to the endpoints mentioned as well as weird values of the "enc" parameter

Read More
Potential Exploitation Attempt Of Undocumented WindowsServer RCE

Jan 30, 2025 · attack.initial-access attack.t1190 detection.emerging-threats ·
Share on:

Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)

Read More
Potential OWASSRF Exploitation Attempt - Proxy

Jan 30, 2025 · attack.initial-access attack.t1190 detection.emerging-threats ·
Share on:

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Read More
Potential Raspberry Robin CPL Execution Activity

Jan 30, 2025 · attack.defense-evasion attack.execution attack.t1218.011 detection.emerging-threats ·
Share on:

Detects the execution of a ".CPL" file located in the user temp directory via the Shell32 DLL "Control_RunDLL" export function. This behavior was observed in multiple Raspberry-Robin variants.

Read More
Qakbot Uninstaller Execution

Jan 30, 2025 · attack.execution detection.emerging-threats ·
Share on:

Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet

Read More
Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor

Jan 30, 2025 · attack.persistence detection.emerging-threats ·
Share on:

Hunts for known SVR-specific scheduled task names

Read More
Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler

Jan 30, 2025 · attack.persistence detection.emerging-threats ·
Share on:

Hunts for known SVR-specific scheduled task names

Read More
ScreenConnect - SlashAndGrab Exploitation Indicators

Jan 30, 2025 · attack.defense-evasion detection.emerging-threats ·
Share on:

Detects indicators of exploitation by threat actors during exploitation of the "SlashAndGrab" vulnerability related to ScreenConnect as reported Team Huntress

Read More
ScreenConnect User Database Modification

Jan 30, 2025 · attack.persistence cve.2024-1709 detection.emerging-threats ·
Share on:

Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.

Read More
ScreenConnect User Database Modification - Security

Jan 30, 2025 · attack.defense-evasion cve.2024-1709 detection.emerging-threats ·
Share on:

This detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

Read More
Suspicious Set Value of MSDT in Registry (CVE-2022-30190)

Jan 30, 2025 · attack.defense-evasion attack.t1221 detection.emerging-threats ·
Share on:

Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.

Read More
Failed Code Integrity Checks

Jan 30, 2025 · attack.defense-evasion attack.t1027.001 ·
Share on:

Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.

Read More
Using explorer.exe to open a file explorer folder via command prompt

Jan 29, 2025 · attack.Discovery attack.T1135 ·
Share on:

Detects the initial execution of cmd.exe which spawns explorer.exe with the appropriate command line arguments for opening the My Computer folder.

Read More
HackTool - Dumpert Process Dumper Execution

Jan 22, 2025 · attack.credential-access attack.t1003.001 ·
Share on:

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

Read More
Shell Execution via Rsync - Linux

Jan 19, 2025 · attack.execution attack.t1059 ·
Share on:

Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More
Suspicious Invocation of Shell via Rsync

Jan 19, 2025 · attack.execution attack.t1059 attack.t1203 ·
Share on:

Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Read More
Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation

Jan 15, 2025 · attack.execution cve.2023-36874 detection.emerging-threats ·
Share on:

Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

Read More
CVE-2024-49113 Exploitation Attempt - LDAP Nightmare

Jan 8, 2025 · attack.impact attack.t1499 cve.2024-49113 detection.emerging-threats ·
Share on:

Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".

Read More
DPRK Threat Actor - C2 Communication DNS Indicators

Jan 6, 2025 · attack.command-and-control detection.emerging-threats ·
Share on:

Detects DNS queries for C2 domains used by DPRK Threat actors.

Read More
Exploitation Indicator Of CVE-2022-42475

Jan 6, 2025 · attack.initial-access cve.2022-42475 detection.emerging-threats ·
Share on:

Detects exploitation indicators of CVE-2022-42475 a heap-based buffer overflow in sslvpnd.

Read More
HackTool - Evil-WinRm Execution - PowerShell Module

Jan 6, 2025 · attack.lateral-movement ·
Share on:

Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.

Read More
Potential Credential Dumping Activity Via LSASS

Jan 6, 2025 · attack.credential-access attack.t1003.001 attack.s0002 ·
Share on:

Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.

Read More
Potential SentinelOne Shell Context Menu Scan Command Tampering

Jan 6, 2025 · attack.persistence ·
Share on:

Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.

Read More
Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate

Jan 6, 2025 · attack.execution attack.initial-access ·
Share on:

Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.

Read More
Remote Access Tool - ScreenConnect Remote Command Execution

Jan 6, 2025 · attack.execution attack.t1059.003 ·
Share on:

Detects the execution of a system command via the ScreenConnect RMM service.

Read More
Remote Access Tool - ScreenConnect Server Web Shell Execution

Jan 6, 2025 · attack.initial-access attack.t1190 ·
Share on:

Detects potential web shell execution from the ScreenConnect server process.

Read More
Suspicious File Download From IP Via Wget.EXE - Paths

Jan 6, 2025 · attack.execution ·
Share on:

Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe

Read More
BITS Transfer Job With Uncommon Or Suspicious Remote TLD

Dec 27, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Read More
CodeIntegrity - Unmet Signing Level Requirements By File Under Validation

Dec 27, 2024 · attack.execution ·
Share on:

Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.

Read More
Relevant Anti-Virus Signature Keywords In Application Log

Dec 27, 2024 · attack.resource-development attack.t1588 ·
Share on:

Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.

Read More
New AWS Lambda Function URL Configuration Created

Dec 19, 2024 · attack.initial-access attack.privilege-escalation ·
Share on:

Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls. This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

Read More
Register new Logon Process by Rubeus

Dec 19, 2024 · attack.lateral-movement attack.privilege-escalation attack.credential-access attack.t1558.003 ·
Share on:

Detects potential use of Rubeus via registered new trusted logon process

Read More
Potential Secure Deletion with SDelete

Dec 14, 2024 · attack.impact attack.defense-evasion attack.t1070.004 attack.t1027.005 attack.t1485 attack.t1553.002 attack.s0195 ·
Share on:

Detects files that have extensions commonly seen while SDelete is used to wipe files.

Read More
Local System Accounts Discovery - Linux

Dec 14, 2024 · attack.discovery attack.t1087.001 ·
Share on:

Detects enumeration of local systeam accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Read More
Modification or Deletion of an AWS RDS Cluster

Dec 6, 2024 · attack.exfiltration attack.t1020 ·
Share on:

Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.

Read More
CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Read More
Exploiting CVE-2019-1388

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2019-1388 detection.emerging-threats ·
Share on:

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Read More
Permission Check Via Accesschk.EXE

Dec 1, 2024 · attack.discovery attack.t1069.001 ·
Share on:

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges

Read More
Possible Privilege Escalation via Weak Service Permissions

Dec 1, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Read More
Potential CVE-2021-41379 Exploitation Attempt

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2021-41379 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

Read More
Potential RDP Session Hijacking Activity

Dec 1, 2024 · attack.execution ·
Share on:

Detects potential RDP Session Hijacking activity on Windows systems

Read More
Potential UAC Bypass Via Sdclt.EXE

Dec 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Read More
Suspicious High IntegrityLevel Conhost Legacy Option

Dec 1, 2024 · attack.defense-evasion attack.t1202 ·
Share on:

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

Read More
UAC Bypass Abusing Winsat Path Parsing - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Tools Using ComputerDefaults

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

Read More
UAC Bypass Using ChangePK and SLUI

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

Read More
UAC Bypass Using Consent and Comctl32 - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

Read More
UAC Bypass Using Disk Cleanup

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

Read More
UAC Bypass Using DismHost

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

Read More
UAC Bypass Using IDiagnostic Profile

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

Read More
UAC Bypass Using IEInstal - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

Read More
UAC Bypass Using MSConfig Token Modification - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

Read More
UAC Bypass Using NTFS Reparse Point - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on: