attack.persistence | Detection.FYI

GitHub Repository Archive Status Changed

Oct 28, 2025 · attack.persistence attack.defense-evasion attack.impact ·
Share on:

Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.

Read More
A Member Was Added to a Security-Enabled Global Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects activity when a member is added to a security-enabled global group

Read More
A Member Was Removed From a Security-Enabled Global Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects activity when a member is removed from a security-enabled global group

Read More
A New Trust Was Created To A Domain

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Addition of domains is seldom and should be verified for legitimacy.

Read More
A Security-Enabled Global Group Was Deleted

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects activity when a security-enabled global group is deleted

Read More
Account Created And Deleted Within A Close Time Frame

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects when an account was created and deleted in a short period of time.

Read More
Account Disabled or Blocked for Sign in Attempts

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detects when an account is disabled or blocked for sign in but tried to log in

Read More
Activate Suppression of Windows Security Center Notifications

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect set Notification_Suppress to 1 to disable the Windows security center notification

Read More
Add DisallowRun Execution to Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect set DisallowRun to 1 to prevent user running specific computer program

Read More
Add Port Monitor Persistence in Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.010 ·
Share on:

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Read More
Added Credentials to Existing Application

Oct 23, 2025 · attack.privilege-escalation attack.t1098.001 attack.persistence ·
Share on:

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

Read More
Addition of SID History to Active Directory Object

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1134.005 ·
Share on:

An attacker can use the SID history attribute to gain additional privileges.

Read More
Admin User Remote Logon

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.lateral-movement attack.initial-access attack.t1078.001 attack.t1078.002 attack.t1078.003 car.2016-04-005 ·
Share on:

Detect remote login by Administrator user (depending on internal pattern).

Read More
Allow RDP Remote Assistance Feature

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

Read More
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

Read More
Anomalous User Activity

Oct 23, 2025 · attack.privilege-escalation attack.t1098 attack.persistence ·
Share on:

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Read More
Application AppID Uri Configuration Changes

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.credential-access attack.privilege-escalation attack.t1552 attack.t1078.004 ·
Share on:

Detects when a configuration change is made to an applications AppID URI.

Read More
Application URI Configuration Changes

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1528 attack.t1078.004 attack.persistence attack.credential-access attack.privilege-escalation ·
Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Read More
APT27 - Emissary Panda Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.g0027 detection.emerging-threats ·
Share on:

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

Read More
Aruba Network Service Potential DLL Sideloading

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.persistence attack.t1574.001 ·
Share on:

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Read More
Atbroker Registry Change

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1218 attack.persistence attack.t1547 ·
Share on:

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

Read More
Attempts of Kerberos Coercion Via DNS SPN Spoofing

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·
Share on:

Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the nslookup command.

Read More
Authentications To Important Apps Using Single Factor Authentication

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detect when authentications to important application(s) only required single-factor authentication

Read More
AWS IAM Backdoor Users Keys

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

Read More
AWS IAM S3Browser LoginProfile Creation

Oct 23, 2025 · attack.execution attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

Read More
AWS IAM S3Browser Templated S3 Bucket Policy Creation

Oct 23, 2025 · attack.execution attack.t1059.009 attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

Read More
AWS IAM S3Browser User or AccessKey Creation

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.defense-evasion attack.initial-access attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility creating IAM User or AccessKey.

Read More
AWS Identity Center Identity Provider Change

Oct 23, 2025 · attack.persistence attack.credential-access attack.defense-evasion attack.t1556 ·
Share on:

Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.

Read More
AWS Key Pair Import Activity

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

Read More
AWS Root Credentials

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1078.004 ·
Share on:

Detects AWS root account usage

Read More
AWS Route 53 Domain Transfer Lock Disabled

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.credential-access attack.t1098 ·
Share on:

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

Read More
AWS Route 53 Domain Transferred to Another Account

Oct 23, 2025 · attack.persistence attack.credential-access attack.privilege-escalation attack.t1098 ·
Share on:

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

Read More
AWS SAML Provider Deletion Activity

Oct 23, 2025 · attack.t1078.004 attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1531 attack.impact ·
Share on:

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

Read More
AWS Successful Console Login Without MFA

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.

Read More
AWS Suspicious SAML Activity

Oct 23, 2025 · attack.defense-evasion attack.initial-access attack.lateral-movement attack.persistence attack.privilege-escalation attack.t1078 attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Read More
AWS User Login Profile Was Modified

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects activity when someone is changing passwords on behalf of other users. An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.

Read More
Azure AD Only Single Factor Authentication Required

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1556.006 ·
Share on:

Detect when users are authenticating without MFA being required.

Read More
Azure Domain Federation Settings Modified

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Identifies when an user or application modified the federation settings on the domain.

Read More
Azure Kubernetes Admission Controller

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Azure Login Bypassing Conditional Access Policies

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.

Read More
Azure Subscription Permission Elevation Via ActivityLogs

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Read More
Azure Subscription Permission Elevation Via AuditLogs

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Read More
Azure Unusual Authentication Interruption

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when there is a interruption in the authentication process.

Read More
Bitbucket User Login Failure

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

Read More
Bitlocker Key Retrieval

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for Bitlocker key retrieval.

Read More
Blackbyte Ransomware Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 detection.emerging-threats ·
Share on:

Detects specific windows registry modifications made by BlackByte ransomware variants. BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption. This rule triggers when any of the following registry keys are set to DWORD 1, however all three should be investigated as part of a larger BlackByte ransomware detection and response effort.

Read More
Blue Mockingbird

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.execution attack.t1112 attack.t1047 detection.emerging-threats ·
Share on:

Attempts to detect system changes made by Blue Mockingbird

Read More
Blue Mockingbird - Registry

Oct 23, 2025 · attack.defense-evasion attack.execution attack.persistence attack.t1112 attack.t1047 ·
Share on:

Attempts to detect system changes made by Blue Mockingbird

Read More
Bulk Deletion Changes To Privileged Account Permissions

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects when a user is removed from a privileged role. Bulk changes should be investigated.

Read More
Bypass UAC Using Event Viewer

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.010 ·
Share on:

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

Read More
CA Policy Removed by Non Approved Actor

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

Read More
CA Policy Updated by Non Approved Actor

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Read More
Certificate-Based Authentication Enabled

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.persistence attack.privilege-escalation attack.t1556 ·
Share on:

Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

Read More
Change Default File Association To Executable Via Assoc

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.001 ·
Share on:

Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Read More
Change Default File Association Via Assoc

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.001 ·
Share on:

Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Read More
Change the Fax Dll

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect possible persistence using Fax DLL load when service restart

Read More
Change to Authentication Method

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.t1556 attack.persistence attack.defense-evasion attack.t1098 ·
Share on:

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Read More
Change User Account Associated with the FAX Service

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect change of the user account associated with the FAX service to avoid the escalation problem.

Read More
Changes To PIM Settings

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.privilege-escalation attack.persistence attack.t1078.004 ·
Share on:

Detects when changes are made to PIM roles

Read More
Changing Existing Service ImagePath Value Via Reg.EXE

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.011 ·
Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Read More
ChromeLoader Malware Execution

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 attack.t1176 detection.emerging-threats ·
Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

Read More
Cisco Local Accounts

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1136.001 attack.t1098 ·
Share on:

Find local accounts being created or modified as well as remote authentication configurations

Read More
Cisco Modify Configuration

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.impact attack.t1490 attack.t1505 attack.t1565.002 attack.t1053 ·
Share on:

Modifications to a config that will serve an adversary's impacts or persistence

Read More
Classes Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
ClickOnce Trust Prompt Tampering

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.

Read More
CobaltStrike Service Installations - Security

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
CobaltStrike Service Installations - System

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
Code Injection by ld.so Preload

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.006 ·
Share on:

Detects the ld.so preload persistence file. See man ld.so for more information.

Read More
CodeIntegrity - Blocked Driver Load With Revoked Certificate

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects blocked load attempts of revoked drivers

Read More
CodeIntegrity - Blocked Image/Driver Load For Policy Violation

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Read More
COM Hijack via Sdclt

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1546 attack.t1548 ·
Share on:

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Read More
COM Hijacking via TreatAs

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

Read More
COM Object Hijacking Via Modification Of Default System CLSID Default Value

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects potential COM object hijacking via modification of default system CLSID.

Read More
Common Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.001 detection.emerging-threats cve.2025-57788 ·
Share on:

Detects a qlogin.exe command attempting to authenticate as the internal _+_PublicSharingUser_ using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.

Read More
Control Panel Items

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.defense-evasion attack.t1218.002 attack.persistence attack.t1546 ·
Share on:

Detects the malicious use of a control panel item

Read More
CosmicDuke Service Installation

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1543.003 attack.t1569.002 detection.emerging-threats ·
Share on:

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

Read More
CrashControl CrashDump Disabled

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1564 attack.t1112 ·
Share on:

Detects disabling the CrashDump per registry (as used by HermeticWiper)

Read More
Creation Exe for Service with Unquoted Path

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

Read More
Creation of WerFault.exe/Wer.dll in Unusual Folder

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

Read More
CurrentControlSet Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CurrentVersion Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CurrentVersion NT Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Default RDP Port Changed to Non Standard Port

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.010 ·
Share on:

Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Read More
Defrag Deactivation

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.s0111 detection.emerging-threats ·
Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Read More
Defrag Deactivation - Security

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 attack.s0111 detection.emerging-threats ·
Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Read More
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

Read More
Device Registration or Join Without MFA

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for device registration or join events where MFA was not performed.

Read More
DHCP Callout DLL Installation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.t1112 ·
Share on:

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

Read More
DHCP Server Error Failed Loading the CallOut DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

Read More
DHCP Server Loaded the CallOut DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

Read More
Diamond Sleet APT DLL Sideloading Indicators

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 detection.emerging-threats ·
Share on:

Detects DLL sideloading activity seen used by Diamond Sleet APT

Read More
Direct Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

Read More
Directory Service Restore Mode(DSRM) Registry Value Tampering

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.persistence attack.t1556 ·
Share on:

Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure. Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory. If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM. If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped. If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.

Read More
Disable Internal Tools or Feature in Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

Read More
Disable Security Events Logging Adding Reg Key MiniNt

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1562.002 attack.t1112 car.2022-03-001 ·
Share on:

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.

Read More
Disable Windows Security Center Notifications

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect set UseActionCenterExperience to 0 to disable the Windows security center notification

Read More
Disabled MFA to Bypass Authentication Mechanisms

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.persistence attack.t1556 ·
Share on:

Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.

Read More
DLL Execution Via Register-cimprovider.exe

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574 ·
Share on:

Detects using register-cimprovider.exe to execute arbitrary dll file.

Read More
DLL Load via LSASS

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1547.008 ·
Share on:

Detects a method to load DLL via LSASS process using an undocumented Registry key

Read More
DLL Names Used By SVR For GraphicalProton Backdoor

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 detection.emerging-threats ·
Share on:

Hunts known SVR-specific DLL names.

Read More
DLL Sideloading by VMware Xfer Utility

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

Read More
DNS Server Error Failed Loading the ServerLevelPluginDLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

Read More
DNS-over-HTTPS Enabled by Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1140 attack.t1112 ·
Share on:

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

Read More
Dropping Of Password Filter DLL

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.credential-access attack.t1556.002 ·
Share on:

Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

Read More
Enable LM Hash Storage

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Read More
Enable LM Hash Storage - ProcCreation

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

Read More
Enabled User Right in AD to Control User Objects

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

Read More
ESXi Admin Permission Assigned To Account Via ESXCLI

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1059.012 attack.t1098 ·
Share on:

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

Read More
ETW Logging Disabled For rpcrt4.dll

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

Read More
ETW Logging Disabled For SCM

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

Read More
ETW Logging Disabled In .NET Processes - Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
ETW Logging Disabled In .NET Processes - Sysmon Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 attack.t1562 ·
Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
Exploiting SetupComplete.cmd CVE-2019-1378

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019-1378 detection.emerging-threats ·
Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Read More
External Remote RDP Logon from Public IP

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Read More
External Remote SMB Logon from Public IP

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Read More
Failed Authentications From Countries You Do Not Operate Out Of

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detect failed authentications from countries you do not operate out of.

Read More
Failed Logon From Public IP

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1078 attack.t1190 attack.t1133 ·
Share on:

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Read More
Fax Service DLL Search Order Hijack

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

Read More
File Creation In Suspicious Directory By Msdt.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 cve.2022-30190 ·
Share on:

Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities

Read More
FlowCloud Registry Markers

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.t1112 detection.emerging-threats ·
Share on:

Detects FlowCloud malware registry markers from threat group TA410. The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.

Read More
Forest Blizzard APT - Custom Protocol Handler Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.

Read More
Forest Blizzard APT - Custom Protocol Handler DLL Registry Set

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.

Read More
Github Outside Collaborator Detected

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.collection attack.t1098.001 attack.t1098.003 attack.t1213.003 ·
Share on:

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

Read More
Github SSH Certificate Configuration Changed

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when changes are made to the SSH certificate configuration of the organization.

Read More
Google Cloud Kubernetes Admission Controller

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Google Workspace Granted Domain API Access

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects when an API access service account is granted domain authority.

Read More
Google Workspace User Granted Admin Privileges

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects when an Google Workspace user is granted admin privileges.

Read More
Granting Of Permissions To An Account

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098.003 ·
Share on:

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Read More
Guest Account Enabled Via Sysadminctl

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 attack.t1078.001 ·
Share on:

Detects attempts to enable the guest account using the sysadminctl utility

Read More
Guest User Invited By Non Approved Inviters

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.persistence attack.defense-evasion attack.t1078.004 ·
Share on:

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

Read More
Guest Users Invited To Tenant By Non Approved Inviters

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects guest users being invited to tenant by non-approved inviters

Read More
HackTool - CrackMapExec Execution Patterns

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·
Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

Read More
HackTool - SharPersist Execution

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 ·
Share on:

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

Read More
HackTool - SharpUp PrivEsc Tool Execution

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.discovery attack.execution attack.t1615 attack.t1569.002 attack.t1574.005 ·
Share on:

Detects the use of SharpUp, a tool for local privilege escalation

Read More
HAFNIUM Exchange Exploitation Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1546 attack.t1053 attack.g0125 detection.emerging-threats ·
Share on:

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

Read More
Imports Registry Key From a File

Oct 23, 2025 · attack.persistence attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of the specified file to the registry with regedit.exe.

Read More
Imports Registry Key From an ADS

Oct 23, 2025 · attack.persistence attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of a alternate datastream to the registry with regedit.exe.

Read More
Increased Failed Authentications Of Any Type

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects when sign-ins increased by 10% or greater.

Read More
Interactive AT Job

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1053.002 ·
Share on:

Detects an interactive AT job, which may be used as a form of privilege escalation.

Read More
Internet Explorer Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Invalid PIM License

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Read More
Kapeka Backdoor Autorun Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.

Read More
Kapeka Backdoor Persistence Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

Read More
KrbRelayUp Service Installation

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Read More
Kubernetes Admission Controller Modification

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

Read More
Launch Agent/Daemon Execution Via Launchctl

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1569.001 attack.t1543.001 attack.t1543.004 ·
Share on:

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

Read More
Lazarus APT DLL Sideloading Activity

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.persistence attack.t1574.001 attack.g0032 detection.emerging-threats ·
Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Read More
Leviathan Registry Key Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects registry key used by Leviathan APT in Malaysian focused campaign

Read More
Login to Disabled Account

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detect failed attempts to sign in to disabled accounts.

Read More
Logon from a Risky IP Address

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

Read More
Macro Enabled In A Potentially Suspicious Document

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry changes to Office trust records where the path is located in a potentially suspicious location

Read More
Malicious Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known malicious drivers via their hash.

Read More
Malicious Driver Load By Name

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known malicious drivers via the file name of the drivers.

Read More
Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1078 attack.t1078.002 ·
Share on:

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

Read More
Measurable Increase Of Successful Authentications

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects when successful sign-ins increased by 10% or greater.

Read More
Microsoft 365 - Impossible Travel Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

Read More
Microsoft Defender Blocked from Loading Unsigned DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

Read More
MITRE BZAR Indicators for Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1047 attack.t1053.002 attack.t1569.002 ·
Share on:

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

Read More
MITRE BZAR Indicators for Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.004 ·
Share on:

Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.

Read More
Modification of IE Registry Settings

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence

Read More
Modification of ld.so.preload

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.006 ·
Share on:

Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.

Read More
Modifying Crontab

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·
Share on:

Detects suspicious modification of crontab file.

Read More
Monitoring For Persistence Via BITS

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1197 ·
Share on:

BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.

Read More
MSSQL Extended Stored Procedure Backdoor Maggie

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546 detection.emerging-threats ·
Share on:

This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

Read More
Multifactor Authentication Denied

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·
Share on:

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Read More
Multifactor Authentication Interrupted

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·
Share on:

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Read More
Narrator's Feedback-Hub Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects abusing Windows 10 Narrator's Feedback-Hub

Read More
NET NGenAssemblyUsageLog Registry Key Tamper

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section). By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.

Read More
NetNTLM Downgrade Attack

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1562.001 attack.t1112 ·
Share on:

Detects NetNTLM downgrade attack

Read More
NetNTLM Downgrade Attack - Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1562.001 attack.t1112 ·
Share on:

Detects NetNTLM downgrade attack

Read More
New ActiveScriptEventConsumer Created Via Wmic.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence

Read More
New BgInfo.EXE Custom DB Path Registry Configuration

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.

Read More
New BgInfo.EXE Custom VBScript Registry Configuration

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe"

Read More
New BgInfo.EXE Custom WMI Query Registry Configuration

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe"

Read More
New Custom Shim Database Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

Read More
New DLL Added to AppCertDlls Registry Key

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.009 ·
Share on:

Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

Read More
New DLL Added to AppInit_DLLs Registry Key

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.010 ·
Share on:

DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

Read More
New DNS ServerLevelPluginDll Installed

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.t1112 ·
Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Read More
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.t1112 ·
Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Read More
New Netsh Helper DLL Registered From A Suspicious Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.007 ·
Share on:

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Read More
New Outlook Macro Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the creation of a macro file for Outlook.

Read More
New PDQDeploy Service - Client Side

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1

Read More
New PDQDeploy Service - Server Side

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines

Read More
New Root Certificate Authority Added

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.persistence attack.privilege-escalation attack.t1556 ·
Share on:

Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.

Read More
New RUN Key Pointing to Suspicious Folder

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

Read More
Non-privileged Usage of Reg or Powershell

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

Read More
Number Of Resource Creation Or Deployment Activities

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Number of VM creations or deployment activities occur in Azure via the azureactivity log.

Read More
OceanLotus Registry Activity

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 detection.emerging-threats ·
Share on:

Detects registry keys created in OceanLotus (also known as APT32) attacks

Read More
Office Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Office Macros Warning Disabled

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.

Read More
OilRig APT Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig activity as reported by Nyotron in their March 2018 report

Read More
OilRig APT Registry Persistence

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - Security

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - System

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
Okta Admin Role Assigned to an User or Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098.003 ·
Share on:

Detects when an the Administrator role is assigned to an user or group.

Read More
Okta Identity Provider Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098.001 ·
Share on:

Detects when a new identity provider is created for Okta.

Read More
Okta New Admin Console Behaviours

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detects when Okta identifies new activity in the Admin Console.

Read More
OpenCanary - SSH Login Attempt

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·
Share on:

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

Read More
OpenCanary - SSH New Connection Attempt

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·
Share on:

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

Read More
OpenCanary - Telnet Login Attempt

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.command-and-control attack.t1133 attack.t1078 ·
Share on:

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Read More
Operation Wocao Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects activity mentioned in Operation Wocao report

Read More
Operation Wocao Activity - Security

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects activity mentioned in Operation Wocao report

Read More
Outlook EnableUnsafeClientMailRules Setting Enabled - Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Read More
Outlook Macro Execution Without Warning Setting Enabled

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Read More
Password Change on Directory Service Restore Mode (DSRM) Account

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password in order to obtain persistence.

Read More
Password Reset By User Account

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.credential-access attack.t1078.004 ·
Share on:

Detect when a user has reset their password in Azure AD

Read More
Password Set to Never Expire via WMI

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1047 attack.t1098 ·
Share on:

Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.

Read More
Persistence and Execution at Scale via GPO Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.lateral-movement attack.t1053.005 ·
Share on:

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Read More
Persistence Via Cron Files

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·
Share on:

Detects creation of cron file or files in Cron directories which could indicates potential persistence.

Read More
Persistence Via Sticky Key Backdoor

Oct 23, 2025 · attack.persistence attack.t1546.008 attack.privilege-escalation ·
Share on:

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

Read More
Persistence Via Sudoers Files

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·
Share on:

Detects creation of sudoers file or files in "sudoers.d" directory which can be used a potential method to persiste privileges for a specific user.

Read More
PIM Alert Setting Changes To Disabled

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects when PIM alerts are set to disabled.

Read More
PIM Approvals And Deny Elevation

Oct 23, 2025 · attack.persistence attack.initial-access attack.defense-evasion attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

Read More
Pingback Backdoor Activity

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
Pingback Backdoor DLL Loading Activity

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
Pingback Backdoor File Indicators

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
Possible Shadow Credentials Added

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.credential-access attack.t1556 ·
Share on:

Detects possible addition of shadow credentials to an active directory object.

Read More
Potential ACTINIUM Persistence Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 attack.t1053.005 detection.emerging-threats ·
Share on:

Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

Read More
Potential appverifUI.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "appverifUI.dll"

Read More
Potential AVKkid.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "AVKkid.dll"

Read More
Potential Azure Browser SSO Abuse

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

Read More
Potential BearLPE Exploitation

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1053.005 car.2013-08-001 detection.emerging-threats ·
Share on:

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

Read More
Potential CobaltStrike Service Installations - Registry

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

Read More
Potential COM Object Hijacking Via TreatAs Subkey - Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects COM object hijacking via TreatAs subkey

Read More
Potential DLL Sideloading Of DbgModel.DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "DbgModel.dll"

Read More
Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Read More
Potential DLL Sideloading Of MpSvc.DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "MpSvc.dll".

Read More
Potential DLL Sideloading Of MsCorSvc.DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "mscorsvc.dll".

Read More
Potential DLL Sideloading Via DeviceEnroller.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Potential DLL Sideloading Via VMware Xfer

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL

Read More
Potential EACore.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "EACore.dll"

Read More
Potential Edputil.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "edputil.dll"

Read More
Potential Goopdate.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Read More
Potential Initial Access via DLL Search Order Hijacking

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1566 attack.t1566.001 attack.initial-access attack.t1574 attack.t1574.001 attack.defense-evasion ·
Share on:

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Read More
Potential Iviewers.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Read More
Potential KamiKakaBot Activity - Winlogon Shell Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.

Read More
Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation

Oct 23, 2025 · attack.collection attack.credential-access attack.t1557.003 attack.persistence attack.privilege-escalation ·
Share on:

Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,. where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.

Read More
Potential MFA Bypass Using Legacy Client Authentication

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Read More
Potential Mfdetours.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Read More
Potential Mpclient.DLL Sideloading

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Read More
Potential Mpclient.DLL Sideloading Via Defender Binaries

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Read More
Potential NetWire RAT Activity - Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry keys related to NetWire RAT

Read More
Potential Notepad++ CVE-2025-49144 Exploitation

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.008 cve.2025-49144 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.

Read More
Potential Persistence Attempt Via Existing Service Tampering

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1543.003 attack.t1574.011 ·
Share on:

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

Read More
Potential Persistence Attempt Via Run Keys Using Reg.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects suspicious command line reg.exe tool adding key to RUN key in Registry

Read More
Potential Persistence Using DebugPath

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects potential persistence using Appx DebugPath

Read More
Potential Persistence Via App Paths Default Property

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.012 ·
Share on:

Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application's executable file name to that file's fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis.

Read More
Potential Persistence Via AppCompat RegisterAppRestart Layer

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.

Read More
Potential Persistence Via Custom Protocol Handler

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.

Read More
Potential Persistence Via Logon Scripts - CommandLine

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1037.001 ·
Share on:

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

Read More
Potential Persistence Via Logon Scripts - Registry

Oct 23, 2025 · attack.privilege-escalation attack.t1037.001 attack.persistence attack.lateral-movement ·
Share on:

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

Read More
Potential Persistence Via Microsoft Compatibility Appraiser

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.

Read More
Potential Persistence Via Netsh Helper DLL - Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.007 ·
Share on:

Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Read More
Potential Persistence Via Outlook Home Page

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.t1112 ·
Share on:

Detects potential persistence activity via outlook home page. An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.

Read More
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Read More
Potential Persistence Via Outlook Today Page

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.t1112 ·
Share on:

Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".

Read More
Potential Persistence Via PlistBuddy

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.001 attack.t1543.004 ·
Share on:

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

Read More
Potential Persistence Via Powershell Search Order Hijacking - Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Read More
Potential Persistence Via Scrobj.dll COM Hijacking

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

Read More
Potential Persistence Via Shim Database In Uncommon Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Detects the installation of a new shim database where the file is located in a non-default location

Read More
Potential Persistence Via Shim Database Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time

Read More
Potential PlugX Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.s0013 attack.defense-evasion attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location

Read More
Potential Privilege Escalation via Service Permissions Weakness

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

Read More
Potential PSFactoryBuffer COM Hijacking

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

Read More
Potential Python DLL SideLoading

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of Python DLL files.

Read More
Potential Qakbot Registry Activity

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects a registry key used by IceID in a campaign that distributes malicious OneNote files

Read More
Potential Raspberry Robin Aclui Dll SideLoading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 detection.emerging-threats ·
Share on:

Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.

Read More
Potential Raspberry Robin Registry Set Internet Settings ZoneMap

Oct 23, 2025 · attack.persistence attack.t1112 attack.defense-evasion detection.emerging-threats ·
Share on:

Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.

Read More
Potential Rcdll.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of rcdll.dll

Read More
Potential Registry Persistence Attempt Via DbgManagedDebugger

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574 ·
Share on:

Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes

Read More
Potential Registry Persistence Attempt Via Windows Telemetry

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.

Read More
Potential RipZip Attack on Startup Folder

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.

Read More
Potential RjvPlatform.DLL Sideloading From Default Location

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Read More
Potential RjvPlatform.DLL Sideloading From Non-Default Location

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

Read More
Potential RoboForm.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Read More
Potential Ryuk Ransomware Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects Ryuk ransomware activity

Read More
Potential SAP NetWeaver Webshell Creation

Oct 23, 2025 · attack.execution attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·
Share on:

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

Read More
Potential SAP NetWeaver Webshell Creation - Linux

Oct 23, 2025 · attack.execution attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·
Share on:

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

Read More
Potential ShellDispatch.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "ShellDispatch.dll"

Read More
Potential SmadHook.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Read More
Potential SolidPDFCreator.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Read More
Potential SSH Tunnel Persistence Install Using A Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 attack.command-and-control ·
Share on:

Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.

Read More
Potential Startup Shortcut Persistence Via PowerShell.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence. Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"

Read More
Potential Suspicious Activity Using SeCEdit

Oct 23, 2025 · attack.collection attack.discovery attack.persistence attack.defense-evasion attack.credential-access attack.privilege-escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Potential Suspicious Registry File Imported Via Reg.EXE

Oct 23, 2025 · attack.persistence attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility

Read More
Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.lateral-movement attack.t1021.001 attack.t1112 ·
Share on:

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Read More
Potential Ursnif Malware Activity - Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.execution attack.t1112 detection.emerging-threats ·
Share on:

Detects registry keys related to Ursnif malware.

Read More
Potential Vivaldi_elf.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "vivaldi_elf.dll"

Read More
Potential Waveedit.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

Read More
Potential WWlib.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "wwlib.dll"

Read More
Potentially Suspicious Child Process of KeyScrambler.exe

Oct 23, 2025 · attack.persistence attack.execution attack.defense-evasion attack.privilege-escalation attack.t1203 attack.t1574.001 ·
Share on:

Detects potentially suspicious child processes of KeyScrambler.exe

Read More
Potentially Suspicious Desktop Background Change Using Reg.EXE

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·
Share on:

Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Read More
Potentially Suspicious Desktop Background Change Via Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.impact attack.t1112 attack.t1491.001 ·
Share on:

Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Read More
Powershell Create Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

Read More
Powershell Install a DLL in System Directory

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.credential-access attack.t1556.002 ·
Share on:

Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"

Read More
Powershell LocalAccount Manipulation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups

Read More
PowerShell Web Access Feature Enabled Via DISM

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1548.002 ·
Share on:

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

Read More
Powershell WMI Persistence

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Read More
Powerview Add-DomainObjectAcl DCSync AD Extend Right

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer

Read More
Privileged Account Creation

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when a new admin is created.

Read More
Privileged User Has Been Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1136.001 attack.t1098 ·
Share on:

Detects the addition of a new user to a privileged group such as "root" or "sudo"

Read More
ProcessHacker Privilege Elevation

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects a ProcessHacker tool that elevated privileges to a very high level

Read More
PUA - Process Hacker Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation cve.2021-21551 attack.t1543 ·
Share on:

Detects driver load of the Process Hacker tool

Read More
PUA - System Informer Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects driver load of the System Informer tool

Read More
RedMimicry Winnti Playbook Registry Manipulation

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects actions caused by the RedMimicry Winnti playbook

Read More
Reg Add Suspicious Paths

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 attack.t1562.001 ·
Share on:

Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys

Read More
Registry Entries For Azorult Malware

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.execution attack.t1112 ·
Share on:

Detects the presence of a registry key created during Azorult execution

Read More
Registry Explorer Policy Modification

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)

Read More
Registry Hide Function from User

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)

Read More
Registry Manipulation via WMI Stdregprov

Oct 23, 2025 · attack.persistence attack.execution attack.defense-evasion attack.discovery attack.t1047 attack.t1112 attack.t1012 ·
Share on:

Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class. This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.

Read More
Registry Modification Via Regini.EXE

Oct 23, 2025 · attack.persistence attack.t1112 attack.defense-evasion ·
Share on:

Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.

Read More
Registry Persistence Mechanisms in Recycle Bin

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects persistence registry keys for Recycle Bin

Read More
Registry Persistence via Explorer Run Key

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder

Read More
Registry-Free Process Scope COR_PROFILER

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.012 ·
Share on:

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR. (Citation: Microsoft Profiling Mar 2017) (Citation: Microsoft COR_PROFILER Feb 2013)

Read More
Regsvr32 DLL Execution With Uncommon Extension

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574 attack.execution ·
Share on:

Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.

Read More
Rejetto HTTP File Server RCE

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1190 attack.t1505.003 cve.2014-6287 detection.emerging-threats ·
Share on:

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

Read More
Remote Access Tool - ScreenConnect Installation Execution

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects ScreenConnect program starts that establish a remote access to a system.

Read More
Remote Access Tool - Team Viewer Session Started On Linux Host

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Read More
Remote Access Tool - Team Viewer Session Started On MacOS Host

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Read More
Remote Access Tool - Team Viewer Session Started On Windows Host

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Read More
Remote Access Tool Services Have Been Installed - Security

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1543.003 attack.t1569.002 ·
Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Read More
Remote Access Tool Services Have Been Installed - System

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1543.003 attack.t1569.002 ·
Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Read More
Remote Registry Lateral Movement

Oct 23, 2025 · attack.defense-evasion attack.lateral-movement attack.t1112 attack.persistence ·
Share on:

Detects remote RPC calls to modify the registry and possible execute code

Read More
Remote Schedule Task Lateral Movement via ATSvc

Oct 23, 2025 · attack.privilege-escalation attack.lateral-movement attack.execution attack.persistence attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task via ATSvc

Read More
Remote Schedule Task Lateral Movement via ITaskSchedulerService

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.lateral-movement attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task

Read More
Remote Schedule Task Lateral Movement via SASec

Oct 23, 2025 · attack.privilege-escalation attack.lateral-movement attack.execution attack.persistence attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task via SASec

Read More
Remote Task Creation via ATSVC Named Pipe

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·
Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Read More
Remote Task Creation via ATSVC Named Pipe - Zeek

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·
Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Read More
Removal of Potential COM Hijacking Registry Keys

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.

Read More
Renamed Vmnat.exe Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

Read More
RestrictedAdminMode Registry Value Tampering

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Read More
RestrictedAdminMode Registry Value Tampering - ProcCreation

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Read More
Roles Activated Too Frequently

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when the same privilege role has multiple activations by the same user.

Read More
Roles Activation Doesn't Require MFA

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role can be activated without performing mfa.

Read More
Roles Are Not Being Used

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a user has been assigned a privilege role and are not using that role.

Read More
Roles Assigned Outside PIM

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Read More
Root Account Enable Via Dsenableroot

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial-access attack.persistence ·
Share on:

Detects attempts to enable the root account via "dsenableroot"

Read More
Run Once Task Configuration in Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup

Read More
Run Once Task Execution as Configured in Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

This rule detects the execution of Run Once task as configured in the registry

Read More
Running Chrome VPN Extensions via the Registry 2 VPN Extension

Oct 23, 2025 · attack.initial-access attack.persistence attack.t1133 ·
Share on:

Running Chrome VPN Extensions via the Registry install 2 vpn extension

Read More
Scheduled Task Creation Masquerading as System Processes

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.defense-evasion attack.t1036.004 attack.t1036.005 ·
Share on:

Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.

Read More
Scheduled Task Creation with Curl and PowerShell Execution Combo

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.

Read More
Scheduled Task Executed From A Suspicious Location

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task

Read More
Scheduled Task Executed Uncommon LOLBIN

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task

Read More
Scheduled Task Executing Encoded Payload from Registry

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
Scheduled Task Executing Payload from Registry

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

Read More
Scheduled Task/Job At

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.002 ·
Share on:

Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code

Read More
Scheduled TaskCache Change by Uncommon Program

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 attack.t1053.005 ·
Share on:

Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious

Read More
Schtasks Creation Or Modification With SYSTEM Privileges

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

Read More
Schtasks From Suspicious Folders

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations that have suspicious action command and folder combinations

Read More
Security Event Logging Disabled via MiniNt Registry Key - Process

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1562.002 attack.t1112 car.2022-03-001 ·
Share on:

Detects attempts to disable security event logging by adding the MiniNt registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.

Read More
Security Event Logging Disabled via MiniNt Registry Key - Registry Set

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1562.002 attack.t1112 car.2022-03-001 ·
Share on:

Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.

Read More
Security Support Provider (SSP) Added to LSA Configuration

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.005 ·
Share on:

Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.

Read More
Serpent Backdoor Payload Execution Via Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.006 detection.emerging-threats ·
Share on:

Detects post exploitation execution technique of the Serpent backdoor. According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method. It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.

Read More
Service Binary in Suspicious Folder

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect the creation of a service with a service binary located in a suspicious directory

Read More
Service Installed By Unusual Client - Security

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More
Service Installed By Unusual Client - System

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More
Service Registry Permissions Weakness Check

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.011 stp.2a ·
Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Read More
Service Reload or Start - Linux

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.002 ·
Share on:

Detects the start, reload or restart of a service.

Read More
Session Manager Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 attack.t1546.009 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Setuid and Setgid

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1548.001 ·
Share on:

Detects suspicious change of file privileges with chown and chmod commands

Read More
Setup16.EXE Execution With Custom .Lst File

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.005 ·
Share on:

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

Read More
Shell Open Registry Keys Manipulation

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1546.001 ·
Share on:

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

Read More
ShimCache Flush

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects actions that clear the local ShimCache and remove forensic evidence

Read More
Sign-in Failure Due to Conditional Access Requirements Not Met

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1110 attack.t1078.004 ·
Share on:

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Read More
Sign-ins by Unknown Devices

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.

Read More
Sign-ins from Non-Compliant Devices

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for sign-ins where the device was non-compliant.

Read More
Sliver C2 Default Service Installation

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

Read More
Small Sieve Malware CommandLine Indicator

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

Read More
Special File Creation via Mknod Syscall

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects usage of the mknod syscall to create special files (e.g., character or block devices). Attackers or malware might use mknod to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of mknod is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors.

Read More
Stale Accounts In A Privileged Role

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an account hasn't signed in during the past n number of days.

Read More
Startup Folder File Write

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.

Read More
Startup/Logon Script Added to Group Policy Object

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1484.001 attack.t1547 ·
Share on:

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Read More
StoneDrill Service Install

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.g0064 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky

Read More
Successful Authentications From Countries You Do Not Operate Out Of

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detect successful authentications from countries you do not operate out of.

Read More
Suspicious Autorun Registry Modified via WMI

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1547.001 attack.t1047 ·
Share on:

Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.

Read More
Suspicious Child Process of SAP NetWeaver

Oct 23, 2025 · attack.execution attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·
Share on:

Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

Read More
Suspicious Child Process of SAP NetWeaver - Linux

Oct 23, 2025 · attack.execution attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·
Share on:

Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

Read More
Suspicious Command Patterns In Scheduled Task Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

Read More
Suspicious Computer Account Name Change CVE-2021-42287

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1036 attack.t1098 cve.2021-42287 detection.emerging-threats ·
Share on:

Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287

Read More
Suspicious Computer Machine Password by PowerShell

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.

Read More
Suspicious desktop.ini Action

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Read More
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·
Share on:

Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

Read More
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·
Share on:

Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

Read More
Suspicious Driver Install by pnputil.exe

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects when a possible suspicious driver is being installed via pnputil.exe lolbin

Read More
Suspicious Encoded Scripts in a WMI Consumer

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.t1047 attack.persistence attack.t1546.003 ·
Share on:

Detects suspicious encoded payloads in WMI Event Consumers

Read More
Suspicious Get-Variable.exe Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546 attack.defense-evasion attack.t1027 ·
Share on:

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

Read More
Suspicious GrpConv Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors

Read More
Suspicious GUP Usage

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

Read More
Suspicious Modification Of Scheduled Tasks

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

Read More
Suspicious Outlook Macro Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the creation of a macro file for Outlook.

Read More
Suspicious PowerShell In Registry Run Keys

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects potential PowerShell commands or code within registry run keys

Read More
Suspicious Printer Driver Empty Manufacturer

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 ·
Share on:

Detects a suspicious printer driver installation with an empty Manufacturer value

Read More
Suspicious Process Spawned by CentreStack Portal AppPool

Oct 23, 2025 · attack.persistence attack.execution attack.t1059.003 attack.t1505.003 cve.2025-30406 detection.emerging-threats ·
Share on:

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

Read More
Suspicious Registry Modification From ADS Via Regini.EXE

Oct 23, 2025 · attack.persistence attack.t1112 attack.defense-evasion ·
Share on:

Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.

Read More
Suspicious Remote Logon with Explicit Credentials

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 attack.lateral-movement ·
Share on:

Detects suspicious processes logging on with explicit credentials

Read More
Suspicious Run Key from Download

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories

Read More
Suspicious Scheduled Task Creation Involving Temp Folder

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation of scheduled tasks that involves a temporary folder and runs only once

Read More
Suspicious Scheduled Task Creation via Masqueraded XML File

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.defense-evasion attack.persistence attack.t1036.005 attack.t1053.005 ·
Share on:

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Read More
Suspicious Scheduled Task Name As GUID

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects creation of a scheduled task with a GUID like name

Read More
Suspicious Scheduled Task Write to System32 Tasks

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053 ·
Share on:

Detects the creation of tasks from processes executed from suspicious locations

Read More
Suspicious Schtasks Execution AppData Folder

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

Read More
Suspicious Schtasks Schedule Type With High Privileges

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type

Read More
Suspicious Schtasks Schedule Types

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification on a suspicious schedule type

Read More
Suspicious ScreenSave Change by Reg.exe

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1546.002 ·
Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Read More
Suspicious Screensaver Binary File Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.002 ·
Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Read More
Suspicious Service DACL Modification Via Set-Service Cmdlet

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable

Read More
Suspicious Shim Database Patching Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

Read More
Suspicious SignIns From A Non Registered Device

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects risky authentication from a non AD registered device without MFA being required.

Read More
Suspicious Startup Folder Persistence

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.t1204.002 attack.persistence attack.t1547.001 ·
Share on:

Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.

Read More
Suspicious Unsigned Thor Scanner Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects loading and execution of an unsigned thor scanner binary.

Read More
Suspicious VBoxDrvInst.exe Parameters

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detect VBoxDrvInst.exe run with parameters allowing processing INF file. This allows to create values in the registry and install drivers. For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys

Read More
Suspicious VBScript UN2452 Pattern

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects suspicious inline VBScript keywords as used by UNC2452

Read More
Suspicious Velociraptor Child Process

Oct 23, 2025 · attack.command-and-control attack.persistence attack.defense-evasion attack.t1219 ·
Share on:

Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.

Read More
Sysinternals PsService Execution

Oct 23, 2025 · attack.privilege-escalation attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering

Read More
Sysinternals PsSuspend Execution

Oct 23, 2025 · attack.privilege-escalation attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

Read More
Sysmon Channel Reference Deletion

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Potential threat actor tampering with Sysmon manifest and eventually disabling it

Read More
System Scripts Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Systemd Service Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.002 ·
Share on:

Detects a creation of systemd services which could be used by adversaries to execute malicious code.

Read More
Tasks Folder Evasion

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.execution attack.t1574.001 ·
Share on:

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

Read More
Temporary Access Pass Added To An Account

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078.004 ·
Share on:

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

Read More
Terminal Server Client Connection History Cleared - Registry

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1070 attack.t1112 ·
Share on:

Detects the deletion of registry keys containing the MSTSC connection history

Read More
Too Many Global Admins

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Read More
Triple Cross eBPF Rootkit Default Persistence

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.defense-evasion attack.t1053.003 ·
Share on:

Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

Read More
Trust Access Disable For VBApplications

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.

Read More
Trusted Path Bypass via Windows Directory Spoofing

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.007 attack.t1548.002 ·
Share on:

Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.

Read More
Turla Group Commands May 2020

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.g0010 attack.execution attack.t1059.001 attack.t1053.005 attack.t1027 detection.emerging-threats ·
Share on:

Detects commands used by Turla group as reported by ESET in May 2020

Read More
Turla PNG Dropper Service

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.g0010 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018

Read More
Turla Service Install

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.g0010 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET

Read More
Uncommon Microsoft Office Trusted Location Added

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.

Read More
Uncommon Userinit Child Process

Oct 23, 2025 · attack.privilege-escalation attack.t1037.001 attack.persistence ·
Share on:

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Read More
Unix Shell Configuration Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.004 ·
Share on:

Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.

Read More
Unsigned Binary Loaded From Suspicious Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations

Read More
Unsigned Mfdetours.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Read More
Unsigned Module Loaded by ClickOnce Application

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 ·
Share on:

Detects unsigned module load by ClickOnce application.

Read More
Unusual Child Process of dns.exe

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Read More
Unusual File Deletion by Dns.exe

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Read More
Unusual File Modification by dns.exe

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Read More
Use Of Hidden Paths Or Files

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects calls to hidden files or files located in hidden directories in NIX systems.

Read More
Use of Legacy Authentication Protocols

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Alert on when legacy authentication has been used on an account

Read More
User Access Blocked by Azure Conditional Access

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.credential-access attack.initial-access attack.t1110 attack.t1078.004 ·
Share on:

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

Read More
User Added To Admin Group Via Dscl

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and add an account to the admin group via "dscl"

Read More
User Added To Admin Group Via DseditGroup

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

Read More
User Added To Admin Group Via Sysadminctl

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and add an account to the admin group via "sysadminctl"

Read More
User Added to an Administrator's Azure AD Role

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1098.003 attack.t1078 ·
Share on:

User Added to an Administrator's Azure AD Role

Read More
User Added To Group With CA Policy Modification Access

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership additions of groups that have CA policy modification access

Read More
User Added To Highly Privileged Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".

Read More
User Added to Local Administrator Group

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.privilege-escalation attack.t1078 attack.persistence attack.t1098 ·
Share on:

Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity

Read More
User Added to Local Administrators Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".

Read More
User Added To Privilege Role

Oct 23, 2025 · attack.persistence attack.initial-access attack.privilege-escalation attack.defense-evasion attack.t1078.004 ·
Share on:

Detects when a user is added to a privileged role.

Read More
User Added to Remote Desktop Users Group

Oct 23, 2025 · attack.initial-access attack.persistence attack.lateral-movement attack.t1133 attack.t1136.001 attack.t1021.001 ·
Share on:

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

Read More
User Removed From Group With CA Policy Modification Access

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership removal of groups that have CA policy modification access

Read More
User State Changed From Guest To Member

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078.004 ·
Share on:

Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

Read More
Users Added to Global or Device Admin Roles

Oct 23, 2025 · attack.persistence attack.initial-access attack.defense-evasion attack.privilege-escalation attack.t1078.004 ·
Share on:

Monitor and alert for users added to device admin roles.

Read More
Users Authenticating To Other Azure AD Tenants

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.

Read More
Using SettingSyncHost.exe as LOLBin

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.defense-evasion attack.t1574.008 ·
Share on:

Detects using SettingSyncHost.exe to run hijacked binary

Read More
VBScript Payload Stored in Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects VBScript content stored into registry keys as seen being used by UNC2452 group

Read More
Vulnerable Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known vulnerable drivers via their hash.

Read More
Vulnerable Driver Load By Name

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects the load of known vulnerable drivers via the file name of the drivers.

Read More
Vulnerable HackSys Extreme Vulnerable Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

Read More
Vulnerable WinRing0 Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

Read More
Wdigest CredGuard Registry Modification

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials.

Read More
Wdigest Enable UseLogonCredential

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials

Read More
Win Susp Computer Name Containing Samtheadmin

Oct 23, 2025 · attack.initial-access attack.defense-evasion cve.2021-42278 cve.2021-42287 attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Read More
Windows Event Log Access Tampering Via Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1547.001 attack.t1112 ·
Share on:

Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Read More
Windows Network Access Suspicious desktop.ini Action

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Read More
Windows Terminal Profile Settings Modification By Uncommon Process

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.015 ·
Share on:

Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon process.

Read More
WINEKEY Registry Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects potential malicious modification of run keys by winekey or team9 backdoor

Read More
Winlogon Helper DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.004 ·
Share on:

Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables.

Read More
Winlogon Notify Key Logon Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.004 ·
Share on:

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.

Read More
Winnti Malware HK University Campaign

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.g0044 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities

Read More
Winnti Pipemon Characteristics

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.g0044 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Winnti Pipemon malware reported by ESET

Read More
WinRAR Creating Files in Startup Locations

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088.

Read More
WinSock2 Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
WMI Backdoor Exchange Transport Agent

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

Read More
WMI Event Subscription

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects creation of WMI event subscription persistence method

Read More
WMI Persistence - Command Line Event Consumer

Oct 23, 2025 · attack.privilege-escalation attack.t1546.003 attack.persistence ·
Share on:

Detects WMI command line event consumers

Read More
WMI Persistence - Script Event Consumer File Write

Oct 23, 2025 · attack.privilege-escalation attack.t1546.003 attack.persistence ·
Share on:

Detects file writes of WMI script event consumer

Read More
Wow6432Node Classes Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node CurrentVersion Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Writing Local Admin Share

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.lateral-movement attack.t1546.002 ·
Share on:

Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks.

Read More
Xwizard.EXE Execution From Non-Default Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

Read More
AWS EnableRegion Command Monitoring

Oct 22, 2025 · attack.persistence ·
Share on:

Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately. There may be situations where security monitoring does not cover some new AWS regions. Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.

Read More
Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)

Oct 20, 2025 · attack.persistence attack.t1505.003 detection.emerging-threats cve.2025-57790 ·
Share on:

Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. This is a post-authentication step corresponding to CVE-2025-57790.

Read More
Suspicious File Write to Webapps Root Directory

Oct 20, 2025 · attack.persistence attack.t1505.003 attack.initial-access attack.t1190 ·
Share on:

Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers. This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.

Read More
Mask System Power Settings Via Systemctl

Oct 20, 2025 · attack.persistence attack.impact attack.t1653 ·
Share on:

Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted. This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.

Read More
Potential Exploitation of GoAnywhere MFT Vulnerability

Oct 20, 2025 · attack.initial-access attack.t1190 attack.execution attack.t1059.001 attack.persistence attack.t1133 detection.emerging-threats cve.2025-10035 ·
Share on:

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

Read More
Shai-Hulud Malicious GitHub Workflow Creation

Oct 19, 2025 · attack.persistence attack.credential-access attack.t1552.001 attack.collection attack.t1119 detection.emerging-threats ·
Share on:

Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets

Read More
Shai-Hulud NPM Attack GitHub Activity

Oct 19, 2025 · attack.persistence attack.impact detection.emerging-threats ·
Share on:

Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch, inject a malicious workflow file to exfiltrate secrets, and make private repositories public.

Read More
Account Tampering - Suspicious Failed Logon Reasons

Oct 17, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078 ·
Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Read More
New Kernel Driver Via SC.EXE

Oct 9, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects creation of a new service (kernel driver) with the type "kernel"

Read More
Potential Antivirus Software DLL Sideloading

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Read More
Potential DLL Sideloading Of DBGCORE.DLL

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of "dbgcore.dll"

Read More
Potential DLL Sideloading Of DBGHELP.DLL

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "dbghelp.dll"

Read More
Potential JLI.dll Side-Loading

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes.

Read More
Potential Persistence Via Visual Studio Tools for Office

Oct 9, 2025 · attack.t1137.006 attack.persistence ·
Share on:

Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.

Read More
PowerShell Module File Created By Non-PowerShell Process

Oct 9, 2025 · attack.persistence ·
Share on:

Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process

Read More
UNC4841 - Barracuda ESG Exploitation Indicators

Oct 1, 2025 · attack.execution attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Read More
New Service Creation Using Sc.EXE

Sep 22, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the creation of a new service using the "sc.exe" utility.

Read More
Potential Persistence Via Notepad++ Plugins

Sep 22, 2025 · attack.persistence ·
Share on:

Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence

Read More
BITS Transfer Job Download From File Sharing Domains

Sep 22, 2025 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects BITS transfer job downloading files from a file sharing domain.

Read More
ETW Logging/Processing Option Disabled On IIS Server

Sep 22, 2025 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

Read More
HTTP Logging Disabled On IIS Server

Sep 22, 2025 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

Read More
New Module Module Added To IIS Server

Sep 22, 2025 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects the addition of a new module to an IIS server.

Read More
Previously Installed IIS Module Was Removed

Sep 22, 2025 · attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004 ·
Share on:

Detects the removal of a previously installed IIS module.

Read More
IIS Native-Code Module Command Line Installation

Aug 28, 2025 · attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious IIS native-code module installations via command line

Read More
Suspicious Service Installation Script

Aug 28, 2025 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects suspicious service installation scripts

Read More
Chromium Browser Instance Executed With Custom Extension

Aug 14, 2025 · attack.persistence attack.t1176.001 ·
Share on:

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

Read More
Disabling Multi Factor Authentication

Aug 14, 2025 · attack.persistence attack.defense-evasion attack.credential-access attack.t1556.006 ·
Share on:

Detects disabling of Multi Factor Authentication.

Read More
Suspicious Chromium Browser Instance Executed With Custom Extension

Aug 14, 2025 · attack.persistence attack.t1176.001 ·
Share on:

Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension

Read More
Suspicious File Write to SharePoint Layouts Directory

Jul 28, 2025 · attack.initial-access attack.t1190 attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.

Read More
Potential Binary Or Script Dropper Via PowerShell

Jul 8, 2025 · attack.persistence ·
Share on:

Detects PowerShell creating a binary executable or a script file.

Read More
Multi Factor Authentication Disabled For User Account

Jul 1, 2025 · attack.credential-access attack.persistence ·
Share on:

Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.

Read More
Suspicious Download From File-Sharing Website Via Bitsadmin

Jul 1, 2025 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file from a suspicious domain

Read More
User Risk and MFA Registration Policy Updated

Jul 1, 2025 · attack.persistence ·
Share on:

Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.

Read More
Potential Amazon SSM Agent Hijacking

Jun 13, 2025 · attack.command-and-control attack.persistence attack.t1219.002 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Potential Linux Amazon SSM Agent Hijacking

Jun 13, 2025 · attack.command-and-control attack.persistence attack.t1219.002 ·
Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Read More
Remote Access Tool - AnyDesk Incoming Connection

Jun 13, 2025 · attack.persistence attack.command-and-control attack.t1219.002 ·
Share on:

Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.

Read More
CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry

Jun 12, 2025 · attack.persistence attack.execution attack.defense-evasion attack.t1112 cve.2020-1048 detection.emerging-threats ·
Share on:

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.

Read More
Potential Java WebShell Upload in SAP NetViewer Server

Jun 11, 2025 · attack.persistence attack.t1505.003 detection.emerging-threats cve.2025-31324 ·
Share on:

Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.

Read More
Potential SAP NetViewer Webshell Command Execution

Jun 11, 2025 · attack.persistence attack.t1505.003 attack.initial-access attack.t1190 detection.emerging-threats cve.2025-31324 ·
Share on:

Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter. This rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.

Read More
Webshell Remote Command Execution

Jun 5, 2025 · attack.persistence attack.t1505.003 ·
Share on:

Detects possible command execution by web application/web shell

Read More
Potential System DLL Sideloading From Non System Locations

Jun 4, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

Read More
Github Fork Private Repositories Setting Enabled/Cleared

Jun 4, 2025 · attack.persistence attack.exfiltration attack.t1020 attack.t1537 ·
Share on:

Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).

Read More
Github Repository/Organization Transferred

Jun 4, 2025 · attack.persistence attack.exfiltration attack.t1020 attack.t1537 ·
Share on:

Detects when a repository or an organization is being transferred to another location.

Read More
Potentially Suspicious ODBC Driver Registered

Jun 4, 2025 · attack.credential-access attack.persistence attack.t1003 ·
Share on:

Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location

Read More
PowerShell Web Access Installation - PsScript

Jun 4, 2025 · attack.persistence attack.execution attack.t1059.001 ·
Share on:

Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse

Read More
Suspicious Process By Web Server Process

Jun 4, 2025 · attack.persistence attack.initial-access attack.t1505.003 attack.t1190 ·
Share on:

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Read More
Writing Of Malicious Files To The Fonts Folder

Jun 4, 2025 · attack.t1211 attack.t1059 attack.defense-evasion attack.persistence attack.execution ·
Share on:

Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.

Read More
Kubernetes CronJob/Job Modification

Jun 2, 2025 · attack.persistence attack.privilege-escalation attack.execution ·
Share on:

Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.

Read More
ESXi Account Creation Via ESXCLI

May 21, 2025 · attack.persistence attack.execution attack.t1136 attack.t1059.012 ·
Share on:

Detects user account creation on ESXi system via esxcli

Read More
New Kubernetes Service Account Created

May 20, 2025 · attack.persistence attack.t1136 ·
Share on:

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

Read More
Suspicious SQL Query

May 20, 2025 · attack.exfiltration attack.initial-access attack.privilege-escalation attack.persistence attack.t1190 attack.t1505.001 ·
Share on:

Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields

Read More
Windows LAPS Credential Dump From Entra ID

May 20, 2025 · attack.privilege-escalation attack.persistence attack.t1098.005 ·
Share on:

Detects when an account dumps the LAPS password from Entra ID.

Read More
Kapeka Backdoor Configuration Persistence

May 20, 2025 · attack.persistence attack.defense-evasion attack.t1553.003 detection.emerging-threats ·
Share on:

Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.

Read More
Kapeka Backdoor Scheduled Task Creation

May 20, 2025 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

Read More
Creation Of Non-Existent System DLL

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). Usually this technique is used to achieve DLL hijacking.

Read More
DLL Search Order Hijackig Via Additional Space in Path

May 15, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·
Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

Read More
DLL Sideloading Of ShellChromeAPI.DLL

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Malicious DLL File Dropped in the Teams or OneDrive Folder

May 15, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·
Share on:

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded

Read More
Microsoft Office DLL Sideload

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Read More
Potential 7za.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "7za.dll"

Read More
Potential CCleanerDU.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Read More
Potential CCleanerReactivator.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Read More
Potential Chrome Frame Helper DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Read More
Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Read More
Potential DLL Sideloading Of Non-Existent DLLs From System Folders

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories). Usually this technique is used to achieve UAC bypass or privilege escalation.

Read More
Potential DLL Sideloading Via ClassicExplorer32.dll

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Read More
Potential DLL Sideloading Via comctl32.dll

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Read More
Potential DLL Sideloading Via JsSchHlp

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Read More
Potential Libvlc.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

Read More
Potential Wazuh Security Platform DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Read More
Third Party Software DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Read More
UAC Bypass With Fake DLL

May 15, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1574.001 ·
Share on:

Attempts to load dismcore.dll after dropping it

Read More
VMGuestLib DLL Sideload

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

Read More
VMMap Signed Dbghelp.DLL Potential Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

Read More
VMMap Unsigned Dbghelp.DLL Potential Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Read More
Chopper Webshell Process Pattern

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Read More
Webshell Detection With Command Line Keywords

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Read More
Webshell Hacking Activity Patterns

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·
Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Read More
Potentially Suspicious Malware Callback Communication - Linux

Apr 16, 2025 · attack.persistence attack.command-and-control attack.t1571 ·
Share on:

Detects programs that connect to known malware callback ports based on threat intelligence reports.

Read More
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection

Mar 4, 2025 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion cve.2024-3400 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect. This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.

Read More
Anydesk Remote Access Software Service Installation

Mar 4, 2025 · attack.persistence ·
Share on:

Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the software isn't already used.

Read More
New TimeProviders Registered With Uncommon DLL Name

Feb 3, 2025 · attack.persistence attack.privilege-escalation attack.t1547.003 ·
Share on:

Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

Read More
Potential KamiKakaBot Activity - Shutdown Schedule Task Creation

Feb 3, 2025 · attack.persistence detection.emerging-threats ·
Share on:

Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command. This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.

Read More
Register New IFiltre For Persistence

Feb 3, 2025 · attack.persistence ·
Share on:

Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.

Read More
ServiceDll Hijack

Feb 3, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.

Read More
CVE-2024-1708 - ScreenConnect Path Traversal Exploitation

Jan 30, 2025 · attack.persistence cve.2024-1708 detection.emerging-threats ·
Share on:

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708.

Read More
CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security

Jan 30, 2025 · attack.initial-access attack.persistence cve.2024-1708 detection.emerging-threats ·
Share on:

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

Read More
CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation

Jan 30, 2025 · attack.initial-access attack.persistence cve.2024-1709 detection.emerging-threats ·
Share on:

Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709.

Read More
MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request

Jan 30, 2025 · attack.persistence attack.t1505.003 cve.2023-34362 detection.emerging-threats ·
Share on:

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Read More
Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor

Jan 30, 2025 · attack.persistence detection.emerging-threats ·
Share on:

Hunts for known SVR-specific scheduled task names

Read More
Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler

Jan 30, 2025 · attack.persistence detection.emerging-threats ·
Share on:

Hunts for known SVR-specific scheduled task names

Read More
ScreenConnect User Database Modification

Jan 30, 2025 · attack.persistence cve.2024-1709 detection.emerging-threats ·
Share on:

Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.

Read More
Bitbucket Global Permission Changed

Jan 6, 2025 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects global permissions change activity.

Read More
Potential SentinelOne Shell Context Menu Scan Command Tampering

Jan 6, 2025 · attack.persistence ·
Share on:

Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.

Read More
BITS Transfer Job With Uncommon Or Suspicious Remote TLD

Dec 27, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Read More
Possible Privilege Escalation via Weak Service Permissions

Dec 1, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Read More
GCP Access Policy Deleted

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.

Read More
Google Workspace Application Access Level Modified

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.

Read More
Potential Persistence Via MyComputer Registry Keys

Dec 1, 2024 · attack.persistence ·
Share on:

Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)

Read More
Suspicious Processes Spawned by Java.EXE

Dec 1, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

Read More
PUA - Process Hacker Execution

Nov 25, 2024 · attack.defense-evasion attack.discovery attack.persistence attack.privilege-escalation attack.t1622 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

Read More
PUA - System Informer Execution

Nov 25, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Read More
App Assigned To Azure RBAC/Microsoft Entra Role

Nov 20, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

Read More
Antivirus Web Shell Detection

Nov 4, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More
Suspicious File Creation Activity From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware

Read More
Suspicious Process Execution From Fake Recycle.Bin Folder

Nov 1, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Read More
Potential PrintNightmare Exploitation Attempt

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 ·
Share on:

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

Read More
Windows Spooler Service Suspicious Binary Load

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 ·
Share on:

Detect DLL Load from Spooler Service backup folder

Read More
DarkGate - User Created Via Net.EXE

Sep 2, 2024 · attack.persistence attack.t1136.001 detection.emerging-threats ·
Share on:

Detects creation of local users via the net.exe command with the name of "DarkGate"

Read More
Diamond Sleet APT Scheduled Task Creation

Sep 2, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Read More
Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader

Sep 2, 2024 · attack.persistence attack.t1505.001 cve.2023-27363 detection.emerging-threats ·
Share on:

Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.

Read More
Abuse of Service Permissions to Hide Services Via Set-Service

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Abuse of Service Permissions to Hide Services Via Set-Service - PS

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Activity From Anonymous IP Address

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Read More
Add Debugger Entry To AeDebug For Persistence

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes

Read More
Add Debugger Entry To Hangs Key For Persistence

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes

Read More
App Granted Privileged Delegated Or App Permissions

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

Read More
Application Using Device Code Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Read More
Applications That Are Using ROPC Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Read More
Atypical Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Read More
AWS ECS Task Definition That Queries The Credential Endpoint

Aug 12, 2024 · attack.persistence attack.t1525 ·
Share on:

Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.

Read More
AWS ElastiCache Security Group Created

Aug 12, 2024 · attack.persistence attack.t1136 attack.t1136.003 ·
Share on:

Detects when an ElastiCache security group has been created.

Read More
Azure AD Threat Intelligence

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Read More
Azure Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.t1053.003 attack.privilege-escalation attack.execution ·
Share on:

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
BITS Transfer Job Download From Direct IP

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects a BITS transfer job downloading file(s) from a direct IP address.

Read More
BITS Transfer Job Download To Potential Suspicious Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

Read More
BITS Transfer Job Downloading File Potential Suspicious Extension

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects new BITS transfer job saving local files with potential suspicious extensions

Read More
Bitsadmin to Uncommon IP Server Address

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Read More
Bitsadmin to Uncommon TLD

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

Read More
Certificate Request Export to Exchange Webserver

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell

Read More
Cisco BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Read More
Cisco LDP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Read More
Code Executed Via Office Add-in XLL File

Aug 12, 2024 · attack.persistence attack.t1137.006 ·
Share on:

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs

Read More
COLDSTEEL Persistence Service Creation

Aug 12, 2024 · attack.defense-evasion attack.persistence detection.emerging-threats ·
Share on:

Detects the creation of new services potentially related to COLDSTEEL RAT

Read More
COLDSTEEL RAT Anonymous User Process Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

Read More
COLDSTEEL RAT Cleanup Command Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

Read More
COLDSTEEL RAT Service Persistence Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

Read More
Communication To Uncommon Destination Ports

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·
Share on:

Detects programs that connect to uncommon destination ports

Read More
Creation of a Local Hidden User Account by Registry

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Sysmon registry detection of a local hidden user account.

Read More
Creation Of A Local User Account

Aug 12, 2024 · attack.t1136.001 attack.persistence ·
Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Read More
Creation Of An User Account

Aug 12, 2024 · attack.t1136.001 attack.persistence ·
Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Read More
CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit

Aug 12, 2024 · attack.initial-access attack.t1190 attack.persistence attack.t1505.003 cve.2021-40539 detection.emerging-threats ·
Share on:

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

Read More
DEWMODE Webshell Access

Aug 12, 2024 · attack.persistence attack.t1505.003 detection.emerging-threats ·
Share on:

Detects access to DEWMODE webshell as described in FIREEYE report

Read More
DNS HybridConnectionManager Service Bus

Aug 12, 2024 · attack.persistence attack.t1554 ·
Share on:

Detects Azure Hybrid Connection Manager services querying the Azure service bus service

Read More
Driver Load From A Temporary Directory

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects a driver load from a temporary directory

Read More
Enable Local Manifest Installation With Winget

Aug 12, 2024 · attack.defense-evasion attack.persistence ·
Share on:

Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests.

Read More
Enabling COR Profiler Environment Variables

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.012 ·
Share on:

Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.

Read More
Exchange Set OabVirtualDirectory ExternalUrl Property

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

Read More
Failed MSExchange Transport Agent Installation

Aug 12, 2024 · attack.persistence attack.t1505.002 ·
Share on:

Detects a failed installation of a Exchange Transport Agent

Read More
File Download Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file

Read More
File Download Via Bitsadmin To A Suspicious Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file to a suspicious target folder

Read More
File Download Via Bitsadmin To An Uncommon Target Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file to uncommon target folder

Read More
File With Suspicious Extension Downloaded Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file with a suspicious extension

Read More
Github High Risk Configuration Disabled

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.persistence attack.t1556 ·
Share on:

Detects when a user disables a critical security feature for an organization.

Read More
Github New Secret Created

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1078.004 ·
Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Read More
Github Self Hosted Runner Changes Detected

Aug 12, 2024 · attack.impact attack.discovery attack.collection attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1526 attack.t1213.003 attack.t1078.004 ·
Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Read More
Goofy Guineapig Backdoor Service Creation

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects service creation persistence used by the Goofy Guineapig backdoor

Read More
Google Cloud Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.execution ·
Share on:

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
HackTool - CrackMapExec Execution

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.credential-access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·
Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Read More
HackTool - Default PowerSploit/Empire Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.s0111 attack.g0022 attack.g0060 car.2013-08-001 attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

Read More
HackTool - Powerup Write Hijack DLL

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·
Share on:

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

Read More
Hidden Local User Creation

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Detects the creation of a local hidden user account which should not happen for event ID 4720.

Read More
Huawei BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Read More
HybridConnectionManager Service Installation

Aug 12, 2024 · attack.persistence attack.t1554 ·
Share on:

Rule to detect the Hybrid Connection Manager service installation.

Read More
HybridConnectionManager Service Running

Aug 12, 2024 · attack.persistence attack.t1554 ·
Share on:

Rule to detect the Hybrid Connection Manager service running on an endpoint.

Read More
IE Change Domain Zone

Aug 12, 2024 · attack.persistence attack.t1137 ·
Share on:

Hides the file extension through modification of the registry

Read More
Important Scheduled Task Deleted/Disabled

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

Read More
Impossible Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Read More
Juniper BGP Missing MD5

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Read More
Linux Webshell Indicators

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious sub processes of web server processes

Read More
Loading of Kernel Module via Insmod

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.006 ·
Share on:

Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

Read More
Local User Creation

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

Read More
MacOS Emond Launch Daemon

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.014 ·
Share on:

Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.

Read More
Mailbox Export to Exchange Webserver

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Read More
Manipulation of User Computer or Group Security Principals Across AD

Aug 12, 2024 · attack.persistence attack.t1136.002 ·
Share on:

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..

Read More
Modify User Shell Folders Startup Value

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.001 ·
Share on:

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

Read More
Moriya Rootkit - System

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

Read More
Moriya Rootkit File Created

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 detection.emerging-threats ·
Share on:

Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

Read More
MSExchange Transport Agent Installation

Aug 12, 2024 · attack.persistence attack.t1505.002 ·
Share on:

Detects the Installation of a Exchange Transport Agent

Read More
MSExchange Transport Agent Installation - Builtin

Aug 12, 2024 · attack.persistence attack.t1505.002 ·
Share on:

Detects the Installation of a Exchange Transport Agent

Read More
MSSQL Add Account To Sysadmin Role

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role

Read More
MSSQL SPProcoption Set

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started

Read More
NetSupport Manager Service Install

Aug 12, 2024 · attack.persistence ·
Share on:

Detects NetSupport Manager service installation on the target system.

Read More
New BITS Job Created Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects the creation of a new bits job by Bitsadmin

Read More
New BITS Job Created Via PowerShell

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects the creation of a new bits job by PowerShell

Read More
New Country

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Read More
New Federated Domain Added - Exchange

Aug 12, 2024 · attack.persistence attack.t1136.003 ·
Share on:

Detects the addition of a new Federated Domain.

Read More
New Github Organization Member Added

Aug 12, 2024 · attack.persistence attack.t1136.003 ·
Share on:

Detects when a new member is added or invited to a github organization.

Read More
New ODBC Driver Registered

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the registration of a new ODBC driver.

Read More
New Service Creation Using PowerShell

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the creation of a new service using powershell.

Read More
New User Created Via Net.EXE

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Identifies the creation of local users via the net.exe command.

Read More
New User Created Via Net.EXE With Never Expire Option

Aug 12, 2024 · attack.persistence attack.t1136.001 ·
Share on:

Detects creation of local users via the net.exe command with the option "never expire"

Read More
Office Application Startup - Office Test

Aug 12, 2024 · attack.persistence attack.t1137.002 ·
Share on:

Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started

Read More
Okta Admin Role Assignment Created

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence

Read More
Okta API Token Created

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when a API token is created

Read More
Okta MFA Reset or Deactivated

Aug 12, 2024 · attack.persistence attack.credential-access attack.defense-evasion attack.t1556.006 ·
Share on:

Detects when an attempt at deactivating or resetting MFA.

Read More
Oracle WebLogic Exploit

Aug 12, 2024 · attack.t1190 attack.initial-access attack.persistence attack.t1505.003 cve.2018-2894 detection.emerging-threats ·
Share on:

Detects access to a webshell dropped into a keystore folder on the WebLogic server

Read More
Outlook Security Settings Updated - Registry

Aug 12, 2024 · attack.persistence attack.t1137 ·
Share on:

Detects changes to the registry values related to outlook security settings

Read More
Outlook Task/Note Reminder Received

Aug 12, 2024 · attack.persistence attack.t1137 cve.2023-23397 detection.emerging-threats ·
Share on:

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Read More
Password Provided In Command Line Of Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.initial-access attack.persistence attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1078 ·
Share on:

Detects a when net.exe is called with a password in the command line

Read More
Path To Screensaver Binary Modified

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.002 ·
Share on:

Detects value modification of registry key containing path to binary used as screensaver.

Read More
Persistence Via Disk Cleanup Handler - Autorun

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

Read More
Persistence Via Hhctrl.ocx

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary

Read More
Persistence Via New SIP Provider

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1553.003 ·
Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Read More
Persistence Via TypedPaths - CommandLine

Aug 12, 2024 · attack.persistence ·
Share on:

Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt

Read More
Potential COLDSTEEL Persistence Service DLL Creation

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT

Read More
Potential COLDSTEEL Persistence Service DLL Load

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism

Read More
Potential COLDSTEEL RAT File Indicators

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects the creation of a file named "dllhost.exe" in the "C:\users\public\Documents" directory. Seen being used by the COLDSTEEL RAT in some of its variants.

Read More
Potential COLDSTEEL RAT Windows User Creation

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.

Read More
Potential CVE-2023-36884 Exploitation Dropped File

Aug 12, 2024 · attack.persistence attack.defense-evasion cve.2023-36884 detection.emerging-threats ·
Share on:

Detects a specific file being created in the recent folder of Office. These files have been seen being dropped during potential exploitations of CVE-2023-36884

Read More
Potential Encrypted Registry Blob Related To SNAKE Malware

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA

Read More
Potential Persistence Attempt Via ErrorHandler.Cmd

Aug 12, 2024 · attack.persistence ·
Share on:

Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts" directory which could be used as a method of persistence The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason.

Read More
Potential Persistence Via AutodialDLL

Aug 12, 2024 · attack.persistence ·
Share on:

Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library

Read More
Potential Persistence Via CHM Helper DLL

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence

Read More
Potential Persistence Via Disk Cleanup Handler - Registry

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

Read More
Potential Persistence Via DLLPathOverride

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process

Read More
Potential Persistence Via Event Viewer Events.asp

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects potential registry persistence technique using the Event Viewer "Events.asp" technique

Read More
Potential Persistence Via Excel Add-in - Registry

Aug 12, 2024 · attack.persistence attack.t1137.006 ·
Share on:

Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.

Read More
Potential Persistence Via GlobalFlags

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1546.012 car.2013-01-002 ·
Share on:

Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys

Read More
Potential Persistence Via LSA Extensions

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.

Read More
Potential Persistence Via Microsoft Office Add-In

Aug 12, 2024 · attack.persistence attack.t1137.006 ·
Share on:

Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).

Read More
Potential Persistence Via Microsoft Office Startup Folder

Aug 12, 2024 · attack.persistence attack.t1137 ·
Share on:

Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.

Read More
Potential Persistence Via Mpnotify

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Read More
Potential Persistence Via Netsh Helper DLL

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.007 attack.s0108 ·
Share on:

Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.

Read More
Potential Persistence Via New AMSI Providers - Registry

Aug 12, 2024 · attack.persistence ·
Share on:

Detects when an attacker registers a new AMSI provider in order to achieve persistence

Read More
Potential Persistence Via Outlook Form

Aug 12, 2024 · attack.persistence attack.t1137.003 ·
Share on:

Detects the creation of a new Outlook form which can contain malicious code

Read More
Potential Persistence Via PowerShell User Profile Using Add-Content

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence

Read More
Potential Persistence Via Security Descriptors - ScriptBlock

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.

Read More
Potential Persistence Via TypedPaths

Aug 12, 2024 · attack.persistence ·
Share on:

Detects modification addition to the 'TypedPaths' key in the user or admin registry from a non standard application. Which might indicate persistence attempt

Read More
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state

Read More
Potential Privilege Escalation Attempt Via .Exe.Local Technique

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation ·
Share on:

Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"

Read More
Potential Privilege Escalation Using Symlink Between Osk and Cmd

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 ·
Share on:

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

Read More
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.persistence attack.t1542.003 ·
Share on:

Detects potential malicious and unauthorized usage of bcdedit.exe

Read More
Potential Shim Database Persistence via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·
Share on:

Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Potential Suspicious BPF Activity - Linux

Aug 12, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of suspicious eBPF activity on the system.

Read More
Potential Suspicious PowerShell Module File Created

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShell\Modules\malware\malware.psm1". This is somewhat an uncommon practice as legitimate modules often includes a version folder.

Read More
Potential Suspicious Winget Package Installation

Aug 12, 2024 · attack.defense-evasion attack.persistence ·
Share on:

Detects potential suspicious winget package installation from a suspicious source.

Read More
Potential Webshell Creation On Static Website

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Read More
Potentially Suspicious Malware Callback Communication

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1571 ·
Share on:

Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases

Read More
Potentially Suspicious Shell Script Creation in Profile Folder

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the creation of shell scripts under the "profile.d" path.

Read More
PowerShell Create Local User

Aug 12, 2024 · attack.execution attack.t1059.001 attack.persistence attack.t1136.001 ·
Share on:

Detects creation of a local user via PowerShell

Read More
PowerShell Module File Created

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.

Read More
PowerShell Profile Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Read More
PowerShell Script Dropped Via PowerShell.EXE

Aug 12, 2024 · attack.persistence ·
Share on:

Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.

Read More
Process Explorer Driver Creation By Non-Sysinternals Binary

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1068 ·
Share on:

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

Read More
Process Monitor Driver Creation By Non-Sysinternals Binary

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1068 ·
Share on:

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

Read More
PSEXEC Remote Execution File Artefact

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.execution attack.persistence attack.t1136.002 attack.t1543.003 attack.t1570 attack.s0029 ·
Share on:

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Read More
RDP Sensitive Settings Changed

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1112 ·
Share on:

Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc

Read More
RDP Sensitive Settings Changed to Zero

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1112 ·
Share on:

Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.

Read More
Registry Modification to Hidden File Extension

Aug 12, 2024 · attack.persistence attack.t1137 ·
Share on:

Hides the file extension through modification of the registry

Read More
Remote Service Activity via SVCCTL Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.persistence attack.t1021.002 ·
Share on:

Detects remote service activity via remote access to the svcctl named pipe

Read More
Remote Utilities Host Service Install

Aug 12, 2024 · attack.persistence ·
Share on:

Detects Remote Utilities Host service installation on the target system.

Read More
RTCore Suspicious Service Installation

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver abuse

Read More
Rundll32 Registered COM Objects

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

load malicious registered COM objects

Read More
Scheduled Cron Task/Job - Linux

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·
Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Read More
Scheduled Cron Task/Job - MacOs

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·
Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Read More
Scheduled Task Creation Via Schtasks.EXE

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·
Share on:

Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

Read More
Serv-U Exploitation CVE-2021-35211 by DEV-0322

Aug 12, 2024 · attack.persistence attack.t1136.001 cve.2021-35211 detection.emerging-threats ·
Share on:

Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322

Read More
Service DACL Abuse To Hide Services Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.

Read More
Service Installation in Suspicious Folder

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects service installation in suspicious folder appdata

Read More
Service Installation with Suspicious Folder Pattern

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects service installation with suspicious folder patterns

Read More
Service Registry Key Read Access Request

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

Read More
Service Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility adding a new service with special permission which hides that service.

Read More
Shell Process Spawned by Java.EXE

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)

Read More
Shellshock Expression

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects shellshock expressions in log files

Read More
Small Sieve Malware Registry Persistence

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects registry value with specific intentional typo and strings seen used by the Small Sieve malware

Read More
SNAKE Malware Covert Store Registry Key

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA

Read More
SNAKE Malware Service Persistence

Aug 12, 2024 · attack.persistence detection.emerging-threats ·
Share on:

Detects the creation of a service named "WerFaultSvc" which seems to be used by the SNAKE malware as a persistence mechanism as described by CISA in their report

Read More
Solarwinds SUPERNOVA Webshell Access

Aug 12, 2024 · attack.persistence attack.t1505.003 detection.emerging-threats ·
Share on:

Detects access to SUPERNOVA webshell as described in Guidepoint report

Read More
SOURGUM Actor Behaviours

Aug 12, 2024 · attack.t1546 attack.t1546.015 attack.persistence attack.privilege-escalation detection.emerging-threats ·
Share on:

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Read More
Startup Item File Created - MacOS

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1037.005 ·
Share on:

Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.

Read More
Sticky Key Like Backdoor Execution

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·
Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Read More
Sticky Key Like Backdoor Usage - Registry

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·
Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Read More
Suspicious ASPX File Drop by Exchange

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder

Read More
Suspicious Browser Activity

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Read More
Suspicious Child Process Of SQL Server

Aug 12, 2024 · attack.t1505.003 attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Read More
Suspicious Child Process Of Veeam Dabatase

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

Read More
Suspicious Debugger Registration Cmdline

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.008 ·
Share on:

Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).

Read More
Suspicious Download From Direct IP Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003 ·
Share on:

Detects usage of bitsadmin downloading a file using an URL that contains an IP

Read More
Suspicious Environment Variable Has Been Registered

Aug 12, 2024 · attack.defense-evasion attack.persistence ·
Share on:

Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings

Read More
Suspicious Execution via macOS Script Editor

Aug 12, 2024 · attack.t1566 attack.t1566.002 attack.initial-access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense-evasion ·
Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Read More
Suspicious File Drop by Exchange

Aug 12, 2024 · attack.persistence attack.t1190 attack.initial-access attack.t1505.003 ·
Share on:

Detects suspicious file type dropped by an Exchange component in IIS

Read More
Suspicious GetTypeFromCLSID ShellExecute

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects suspicious Powershell code that execute COM Objects

Read More
Suspicious IIS Module Registration

Aug 12, 2024 · attack.persistence attack.t1505.004 ·
Share on:

Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors

Read More
Suspicious Microsoft Office Child Process - MacOS

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.002 attack.t1137.002 attack.t1204.002 ·
Share on:

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Read More
Suspicious MSExchangeMailboxReplication ASPX Write

Aug 12, 2024 · attack.initial-access attack.t1190 attack.persistence attack.t1505.003 ·
Share on:

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

Read More
Suspicious New Service Creation

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

Read More
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Read More
Suspicious PrinterPorts Creation (CVE-2020-1048)

Aug 12, 2024 · attack.persistence attack.execution attack.t1059.001 cve.2020-1048 detection.emerging-threats ·
Share on:

Detects new commands that add new printer port which point to suspicious file

Read More
Suspicious Processes Spawned by WinRM

Aug 12, 2024 · attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious processes including shells spawnd from WinRM host process

Read More
Suspicious Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Read More
Suspicious Scheduled Task Update

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects update to a scheduled task event that contain suspicious keywords.

Read More
Suspicious Service DACL Modification Via Set-Service Cmdlet - PS

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Suspicious Service Installation

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects suspicious service installation commands

Read More
Suspicious Service Path Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects service path modification via the "sc" binary to a suspicious command or path

Read More
Suspicious Shells Spawn by Java Utility Keytool

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

Read More
Suspicious Windows ANONYMOUS LOGON Local Account Created

Aug 12, 2024 · attack.persistence attack.t1136.001 attack.t1136.002 ·
Share on:

Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.

Read More
Suspicious Windows Strings In URI

Aug 12, 2024 · attack.persistence attack.exfiltration attack.t1505.003 ·
Share on:

Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication

Read More
Suspicious WindowsTerminal Child Processes

Aug 12, 2024 · attack.execution attack.persistence ·
Share on:

Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section)

Read More
UEFI Persistence Via Wpbbin - FileCreation

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1542.001 ·
Share on:

Detects creation of a file named "wpbbin" in the "%systemroot%\system32" directory. Which could be indicative of UEFI based persistence method

Read More
UEFI Persistence Via Wpbbin - ProcessCreation

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1542.001 ·
Share on:

Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section

Read More
UNC4841 - Email Exfiltration File Pattern

Aug 12, 2024 · attack.execution attack.persistence attack.defense-evasion detection.emerging-threats ·
Share on:

Detects filename pattern of email related data used by UNC4841 for staging and exfiltration

Read More
Uncommon Extension Shim Database Installation Via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·
Share on:

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Uncommon One Time Only Scheduled Task At 00:00

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 ·
Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

Read More
Uncommon Service Installation Image Path

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.

Read More
Unfamiliar Sign-In Properties

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Read More
Unsigned AppX Installation Attempt Using Add-AppxPackage

Aug 12, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

Read More
Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript

Aug 12, 2024 · attack.persistence attack.defense-evasion ·
Share on:

Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

Read More
User Added To Root/Sudoers Group Using Usermod

Aug 12, 2024 · attack.privilege-escalation attack.persistence ·
Share on:

Detects usage of the "usermod" binary to add users add users to the root or suoders groups

Read More
VMToolsd Suspicious Child Process

Aug 12, 2024 · attack.execution attack.persistence attack.t1059 ·
Share on:

Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

Read More
VsCode Powershell Profile Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Read More
Webshell ReGeorg Detection Via Web Logs

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Read More
Webshell Tool Reconnaissance Activity

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands

Read More
Windows Webshell Strings

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects common commands used in Windows webshells

Read More
Winget Admin Settings Modification

Aug 12, 2024 · attack.defense-evasion attack.persistence ·
Share on:

Detects changes to the AppInstaller (winget) admin settings. Such as enabling local manifest installations or disabling installer hash checks

Read More
Winlogon AllowMultipleTSSessions Enable

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1112 ·
Share on:

Detects when the 'AllowMultipleTSSessions' value is enabled. Which allows for multiple Remote Desktop connection sessions to be opened at once. This is often used by attacker as a way to connect to an RDP session without disconnecting the other users

Read More
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Read More
WMI Persistence

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Read More
WMI Persistence - Script Event Consumer

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects WMI script event consumers

Read More
WMI Persistence - Security

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Read More
ChromeLoader Malware Detection

Aug 10, 2024 · attack.execution attack.T1059.001 attack.persistence attack.T1176 attack.T1053.005 ·
Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

Read More
Detecting Ammy Admin RMM Agent Execution

Aug 10, 2024 · attack.execution attack.persistence ·
Share on:

Detects the execution of the Ammy Admin RMM agent for remote management.

Read More
Detection of CMD Execution via AnyViewer RMM

Aug 10, 2024 · attack.execution attack.persistence ·
Share on:

Detects cmd shell execution via AnyViewer RMM agent on remote management sessions.

Read More
Detection of Suspicious triggering of ErrorHandler.cmd Execution

Aug 10, 2024 · attack.execution attack.persistence ·
Share on:

Detects the persistence mechanism of triggering ErrorHandler.cmd execution upon the execution of specific binaries inside the oobe directory.

Read More
Scheduled task executing powershell encoded payload from registry

Aug 10, 2024 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
AppInit DLL Installation

Mar 26, 2024 · attack.privilege_escalation attack.persistence attack.t1546 attack.t1546.010 ·
Share on:

One persistence mechanism used by some variations of SmashJacker was an AppInit DLL. It would use a reg.exe command to create appropriate Windows Registry keys for persistence. Part of the RedCanary 2024 Threat Detection Report.

Read More
ChromeLoader NW.js Runtime App Installation Paths

Mar 26, 2024 · attack.persistence attack.t1176 ·
Share on:

Red Canary has had success detecting ChromeLoader by looking for instances of NW.js applications that are unsigned and running from %AppData/Roaming%. This behavior is not unique to ChromeLoader, and some tuning may be required to avoid detecting legitimate applications. A partial list of common ChromeLoader NW.js runtime app installation paths is included below to help distinguish the signal from the noise. Part of the RedCanary 2024 Threat Detection Report.

Read More
Non-depmod Process Modifying modules.dep

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·
Share on:

Detects unusual process modifying the modules.dep file. The modules.dep and modules.dep.bin files should only be modified by the depmod utility. Part of the RedCanary 2024 Threat Detection Report.

Read More
Non-Microsoft App Package Installation Process

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1546 attack.t1546.016 ·
Share on:

Detects app package installation processes where the app is not a Microsoft app based on the publisher ID. Part of the RedCanary 2024 Threat Detection Report.

Read More
Package Support Framework (PSF) Advanced Installer Processes

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1546 attack.t1546.016 ·
Share on:

Detects app package installation processes where legitimate software is included in an MSIX package, but a malicious PowerShell script may execute beforehand by employing the Package Support Framework (PSF). In these cases, the MSIX package includes the malicious script, which is executed as specified in an included config.json file. Part of the RedCanary 2024 Threat Detection Report.

Read More
PowerShell Startup Folder Persistence

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.001 ·
Share on:

Yellow Cockatoo Windows Startup folder for persistence. Not unique to Yellow Cockatoo, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL. Part of the RedCanary 2024 Threat Detection Report.

Read More
Shells Modifying Files in Known Linux Kernel Modules Directories

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·
Share on:

Detects configuration files being written to specific directories that are searched when looking for loadable Linux Kernel Modules (LKM). Part of the RedCanary 2024 Threat Detection Report.

Read More
Systemd Loading a Linux Kernel Module Using insmod

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·
Share on:

Detects the systemd process running commands that would load a Linux Kernel Modules. Part of the RedCanary 2024 Threat Detection Report.

Read More
Systemd Loading a Linux Kernel Module Using modprobe

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·
Share on:

Detects the systemd process loading a Linux Kernel Modules using modprobe. Part of the RedCanary 2024 Threat Detection Report.

Read More
Web Browser Loading Extension

Mar 26, 2024 · attack.persistence attack.t1176 ·
Share on:

During execution, SmashJacker forced Google Chrome or Microsoft Edge to open with the command line argument --load-extension so a browser extension can install without user interaction. This analytic will likely uncover additional adware in an environment and may need tuning to take account for acceptable software installation. Part of the RedCanary 2024 Threat Detection Report.

Read More
Shrpubw Execution from Unexpected File Path

Sep 1, 2023 · attack.persistence attack.t1574 attack.t1574.001 ·
Share on:

Looks for the execution of svchost without the normal -k parameter. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·
Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Read More
AdSearch Reg Runkey Persistence Execution (RedCanary Threat Detection Report)

May 10, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects registry modifications to CurrentVersion\Run key, associated with AdSearch. Part of the RedCanary 2023 Threat Detection Report.

Read More
AdSearch Startup Folder Persistence File Creation (RedCanary Threat Detection Report)

May 10, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects file creations by cscript in the startup folder, associated with AdSearch. Part of the RedCanary 2023 Threat Detection Report.

Read More
Failed Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·
Share on:

Detects suspicious failed logins with different user accounts from a single source system

Read More
Failed NTLM Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·
Share on:

Detects suspicious failed logins with different user accounts from a single source system

Read More
Files Dropped to Program Files by Non-Priviledged Process

Apr 21, 2023 · attack.persistence attack.defense_evasion attack.t1574 attack.t1574.010 ·
Share on:

Search for dropping of files to Windows/Program Files fodlers by non-priviledged processes

Read More
Malicious Service Installations

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1003 attack.t1035 attack.t1050 car.2013-09-005 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.

Read More
Remote Service Creation

Apr 21, 2023 · attack.lateral_movement attack.persistence attack.execution attack.t1543.003 ·
Share on:

Detects remote execution via service creation on the destination host

Read More
Suspicious Fsutil Execution Allowing Remote Connections

Dec 6, 2022 · attack.persistence attack.t1547 ·
Share on:

Detects the use of fsutil to permit additional types of symbolic links on a computer. These can be used to enable ransomware to follow shortcusts to find all files it wants to encrypt.

Read More
Suspicious Schtasks Child Process

Nov 19, 2022 · attack.persistence attack.t1053 attack.t1053.005 ·
Share on:

Detects schtasks being run as a child process of explorer.exe to create a schedule task.

Read More
Suspicious Calc DLL Load

Nov 19, 2022 · attack.persistence attack.t1574 ·
Share on:

Detects Windows 7 calc.exe loading DLLs from suspicious or abnormal file paths.

Read More
Chrome Spawned by Powershell with Load-Extension in Command Line

Nov 9, 2022 · attack.persistence attack.t1176 ·
Share on:

Detects instances of the Chrome browser executable spawning from PowerShell with a corresponding command line that includes appdata\local as a parameter.

Read More
Command Shell Unusual or Suspicious Process Ancestry

Nov 9, 2022 · attack.persistence attack.t1505 attack.execution attack.t1059.003 ·
Share on:

Looks for suspicious process interactions between the Windows IIS worker process (w3wp.exe) and the command shell. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Windows Scheduled Task Behaving Improperly or Suspiciously

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·
Share on:

Detects scheduled tasks created with the /create flag and a reference to commonly-abused Windows utilities. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Windows Scheduled Task Create Shell

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·
Share on:

Detects creation of scheduled tasks which may establish persistence using the command shell. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Windows Scheduled Task Making Suspicious Network Connection

Nov 9, 2022 · attack.persistence attack.execution attack.t1053 attack.t1053.005 ·
Share on:

Detects scheduled tasks created to reach out to external domains and download arbitrary binaries on a set or recurring schedule. Inspired by the 2022 Red Canary Threat Detection report.

Read More