High-severity Sigma rules

Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.

windows · file_event

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

windows · process_creation

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

windows · ps_script

Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

windows · image_load

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

windows · process_creation

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

windows · ps_script

Detection of unusual child processes by different system processes

windows · process_creation

Detects when an account was created and deleted in a short period of time.

azure

Detects scenarios where one can control another users or computers account without having to use their credentials.

windows

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

azure

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

windows

Detects Active Directory Certificate Services (ADCS) certificate requests that include the 'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller. 'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest scenarios where a client in a child domain tells the CA which DC to contact for identity lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames or IPs that resolve to a real Domain Controller computer object in AD with the SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set. In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC identity which the pre-patch CA accepts without validation. A malicious event looks like: Requester: DOMAIN\GHOST<random>$ Attributes: cdc:<attacker_ip> rmd:<target_dc_fqdn> SubjectAlternativeName: DNS Name=<target_dc_fqdn> CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added _ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate DC object in Active Directory before following the chase.

windows

Detects successful issuance of an ADCS certificate where the request attributes include 'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the CA's chase fallback path was taken against an attacker-controlled target. 'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that returns a forged DC identity. A successfully issued certificate at this stage means the attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling PKINIT authentication as that DC followed by DCSync replication.

windows

Detects the creation of a machine account whose name starts with 'GHOST', which is the naming convention used by the CVE-2026-54121 (Certighost) exploit tooling. The public proof-of-concept for Certighost creates a temporary machine account with a name of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase path. The attacker-controlled machine account is used as the requester identity in the certificate request; the cdc attribute then redirects the CA to a rogue host that returns a forged Domain Controller identity. The resulting certificate carries the DC's SID and DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync. A machine account creation event (4741) where TargetUserName starts with 'GHOST' and ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate environments very rarely provision machine accounts with this prefix.

windows

Detects certificate creation with template allowing risk permission subject and risky EKU

windows

Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes

windows · registry_set

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

windows · process_creation

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

windows · process_creation

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

azure

Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539

webserver

Detects javaw.exe in AppData folder as used by Adwind / JRAT

windows · process_creation

Detects javaw.exe in AppData folder as used by Adwind / JRAT

windows · file_event

Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

windows · process_creation

Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

windows

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

windows · process_creation

Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts

windows · ps_script

Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content. Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned.

windows · registry_set

Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

azure

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

azure

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

azure

Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

antivirus

Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

antivirus

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

antivirus

Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".

windows · registry_set

Detects a segmentation fault error message caused by a crashing apache worker process

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective

linux · process_creation

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective

webserver

Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

azure

Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

azure

Detects when a configuration change is made to an applications AppID URI.

azure

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

azure

Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known folder often used as a staging directory.

windows

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

windows · image_load

Detects suspicious user agent strings used in APT malware in proxy logs

proxy

Detects suspicious user agent string of APT40 Dropbox tool

proxy

Detects usage of "IMEWDBLD.exe" to download arbitrary files

windows · process_creation

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

windows · image_load

Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000) - Modification of the /proc/sys/kernel/randomize_va_space file - Execution of the `sysctl` command to set `kernel.randomize_va_space=0` Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms. A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.

linux

Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators

windows

Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804

webserver

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

linux · process_creation

Detects suspicious activity associated with Atomic MacOS Stealer (Amos) campaigns, including execution of FileGrabber and curl-based POST requests used for data exfiltration. The rule identifies either the execution of FileGrabber targeting /tmp or the use of curl to POST sensitive user data (including files such as /tmp/out.zip) to remote servers, which are key indicators of Amos infostealer activity.

macos · process_creation

Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.

macos · file_event

Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the `nslookup` command.

windows · process_creation

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

azure

Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

windows · process_creation

Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

windows · process_creation

Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system.

linux · process_creation

Detect changes in auditd configuration files

linux

Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher (e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation, where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path, corrupting the page cache of SUID binaries for local privilege escalation. On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod) with 'modprobe' appearing in the command line.

linux · process_creation

Detects AWS Config Service disabling

aws

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

aws

Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. Verify with the user identity that this activity is legitimate.

aws

Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.

aws

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

aws

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".

aws

Detects S3 Browser utility creating IAM User or AccessKey.

aws

Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.

aws

Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.

aws

Detects the modification of the findings on SecurityHub.

aws

Detects activity when someone is changing passwords on behalf of other users. An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.

aws

Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.

aws

Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.

linux · file_event

Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.

macos · file_event

Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

windows · file_event

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

linux · process_creation

Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.

macos · process_creation

Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

windows · process_creation

Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.

dns

Indicates that the user's valid credentials have been leaked.

azure

Indicates user activity that is unusual for the user or consistent with known attack patterns.

azure

Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.

m365

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

azure

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

azure

Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking. This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94) which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user's context without needing to steal credentials or use additional techniques to compromise the account.

windows · image_load

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

windows · process_creation

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

windows · process_creation

Detects encoded base64 MZ header in the commandline

windows · process_creation

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

linux

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

macos · process_creation

Detects when full data export is attempted.

bitbucket

Detects when a repository is exempted from secret scanning feature.

bitbucket

Detects a BITS transfer job downloading file(s) from a direct IP address.

windows

Detects BITS transfer job downloading files from a file sharing domain.

windows

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

windows

Detects Bitsadmin connections to IP addresses instead of FQDN names

proxy

Detects Bitsadmin connections to domains with uncommon TLDs

proxy

Detects specific windows registry modifications made by BlackByte ransomware variants. BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption. This rule triggers when any of the following registry keys are set to DWORD 1, however all three should be investigated as part of a larger BlackByte ransomware detection and response effort.

windows · registry_set

Detects default file names outputted by the BloodHound collection tool SharpHound

windows · file_event

Attempts to detect system changes made by Blue Mockingbird

windows · process_creation

Attempts to detect system changes made by Blue Mockingbird

windows · registry_set

Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.

windows

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

windows · process_creation

detects BPFDoor .lock and .pid files access in temporary file storage facility

linux

Detects buffer overflow attempts in Unix system log files

linux

Detects when a user is removed from a privileged role. Bulk changes should be investigated.

azure

Bypasses User Account Control using a fileless method

windows · registry_set

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

windows · registry_set

Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.

windows · registry_set

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

windows · process_creation

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

windows · process_creation

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

windows · process_creation

Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.

windows · process_creation

Detects the use of the "capsh" utility to invoke a shell.

linux · process_creation

Detects the Windows Certificate Services process (certsrv.exe) initiating an outbound network connection on port 445 (SMB) or 389 (LDAP) to a non-DC host. This behaviour is inherently suspicious: under normal operation the CA resolves subject identities via local RPC against the domain and never initiates outbound SMB or LDAP connections to arbitrary hosts. Any such connection indicates the CA is being coerced into performing a remote identity lookup against an attacker-controlled host. The most direct known trigger is the CA chase fallback (EDITF_ENABLECHASECLIENTDC) where a requester-supplied 'cdc' attribute causes the CA to open SMB and LDAP to a specified address. CVE-2026-54121 (Certighost) exploits this path to redirect the CA to rogue LSA and LDAP services that return a DC's identity, resulting in a forged DC certificate. This rule is not limited to Certighost — any future vulnerability or misconfiguration that causes certsrv.exe to make outbound SMB or LDAP connections is covered.

windows · network_connection

Detects HTTP request used by Chafer malware to receive data from its C2.

proxy

Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

windows · process_creation

Detect possible persistence using Fax DLL load when service restart

windows · registry_set

Detect change of the user account associated with the FAX service to avoid the escalation problem.

windows · registry_set

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.

windows · registry_set

Monitor and alert for changes to the device registration policy.

azure

Detects when changes are made to PIM roles

azure

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

windows · process_creation

Detects execution of ChromeLoader malware via a registered scheduled task

windows · process_creation

Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).

windows · process_creation

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

proxy

Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code of 200 (sccessful exploitation)

webserver

Clear command history in network OS which is used for defense evasion

cisco

Show when private keys are being exported from the device, or when new certificates are installed

cisco

Turn off logging locally or remote

cisco

Find local accounts being created or modified as well as remote authentication configurations

cisco

Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

windows · ps_script

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

windows · process_creation

Detects various indicators of Microsoft Connection Manager Profile Installer execution

windows · process_access

Detects various indicators of Microsoft Connection Manager Profile Installer execution

windows · process_creation

Detects various indicators of Microsoft Connection Manager Profile Installer execution

windows · registry_event

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

windows · process_creation

Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

windows · process_creation

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

windows · pipe_created

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

windows

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs

windows · ps_script

Detects the ld.so preload persistence file. See `man ld.so` for more information.

linux

Detects blocked load attempts of revoked drivers

windows

Detects blocked image load events with revoked certificates by code integrity.

windows

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

windows

Detects block events for files that are disallowed by code integrity for protected processes

windows

Detects image load events with revoked certificates by code integrity.

windows

Detects the load of a revoked kernel driver

windows

Detects loaded kernel modules that did not meet the WHQL signing requirements.

windows

Detects loaded unsigned image on the system

windows

Detects the presence of a loaded unsigned kernel module on the system.

windows

Detects the creation of new services potentially related to COLDSTEEL RAT

windows

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

windows · process_creation

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

windows · registry_set

Detects potential COM object hijacking via modification of default system CLSID.

windows · registry_set

Detects specific commands commonly used to remove or empty the syslog

linux

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

windows · network_connection

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

linux · network_connection

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

linux · network_connection

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

windows · network_connection

Detects the use of argument injection in the Commvault qlogin command - potential exploitation for CVE-2025-57791. An attacker can inject the `-localadmin` parameter via the password field to bypass authentication and gain a privileged token.

windows · process_creation

Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. This is a post-authentication step corresponding to CVE-2025-57790.

windows · process_creation

Detects Turla ComRAT network communication.

proxy

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

windows · process_creation

Detects a command used by conti to exfiltrate NTDS

windows · process_creation

Detects a command used by conti to find volume shadow backups

windows · process_creation

Detects the malicious use of a control panel item

windows · process_creation

Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share

windows · process_creation

Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)

windows · process_creation

Detects when the file "passwd" or "shadow" is copied from tmp path

linux · process_creation

Files with well-known filenames (sensitive files with credential data) copying

windows · process_creation

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information

windows · ps_script

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

windows · process_creation

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

windows · file_event

Sysmon registry detection of a local hidden user account.

windows · registry_event

Files with well-known filenames (parts of credential dump software or files produced by them) creation

windows · file_event

Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.

windows · process_access

Detects when a process tries to access the memory of svchost to potentially dump credentials.

windows · process_access

Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.

windows · process_access

Detects well-known credential dumping tools execution via service execution events

windows

Detects well-known credential dumping tools execution via service execution events

windows

Detecting attempts to extract passwords with grep and laZagne

macos · process_creation

Detecting attempts to extract passwords with grep

linux

Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.

windows

Detects XSS attempts injected via GET requests in access logs

webserver

Detects suspicious user agent strings used by crypto miners in proxy logs

proxy

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

windows · process_creation

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

windows · process_creation

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

windows · process_creation

Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.

windows · process_creation

Detects the abuse of custom file open handler, executing powershell

windows · registry_set

Detects CVE-2020-0688 Exploitation attempts

webserver

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

windows

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.

windows · registry_set

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

webserver

Detects the exploitation of the VMware View Planner vulnerability described in CVE-2021-21978

webserver

Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

windows · file_event

Detects exploitation of flaw in path normalization in Apache HTTP server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.

webserver

Detects the creation of "msiexec.exe" in the "bin" directory of the ManageEngine SupportCenter Plus (Related to CVE-2021-44077) and public POC available (See references section)

windows · file_event

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

windows · file_event

Detects the exploitation of VMware Workspace ONE Access Authentication Bypass vulnerability as described in CVE-2022-31656 VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.

webserver

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

linux · process_creation

Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

windows · file_event

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

windows · process_creation

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

proxy

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

webserver

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs by looking for a very long host header string.

proxy

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs by looking for a very long host header string.

webserver

Detects potential exploitation of CVE-2024-1709 an unauthenticated command injection in Progress Kemp LoadMaster. It looks for GET requests to '/access/set' API with the parameters 'param=enableapi' and 'value=1' as well as an "Authorization" header with a base64 encoded value with an uncommon character.

webserver

Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".

windows

Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.

windows · process_creation

Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

windows · process_creation

Detects creation of local users via the net.exe command with the name of "DarkGate"

windows · process_creation

Detects a Kerberos service ticket request (Event 4769) targeting a Domain Controller machine account's service (e.g. DRSUAPI) originating from an IP address that is not a known Domain Controller. Service tickets for DC machine accounts should only be requested by other DCs during legitimate replication operations. An attacker with a valid TGT (obtained via PKINIT, overpass-the-hash, or stolen TGT) targeting a DC machine account's service from a workstation IP indicates preparation for DCSync or impersonation of a DC. Unlike Silver Ticket attacks (which forge the TGS and bypass this event), this rule catches attacks that go through the KDC legitimately. This rule requires %dc_machine_accounts% and %dc_ip_addresses% to be populated with all known DC machine account names and DC IP addresses respectively.

windows

Detects a Kerberos TGT request (Event 4768) for a known Domain Controller machine account originating from an IP address that is not a known Domain Controller. DC machine accounts should only request TGTs from their own IP. Any TGT request for a DC account from a workstation or non-DC host is anomalous and indicates one of the following: - PKINIT abuse (CVE-2026-54121 / Certighost): attacker authenticating as a DC via a forged certificate from their workstation - Overpass-the-Hash: attacker converting a stolen DC machine account NTLM hash into a Kerberos TGT - Pass-the-Hash (RC4): attacker using the DC machine account hash directly with Kerberos

windows

Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

windows

Detects the presence of default Cobalt Strike certificate in the HTTPS traffic

zeek

Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

windows · registry_set

Detects when highly privileged delegated permissions are granted on behalf of all users

azure

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

windows · process_creation

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

windows · process_creation

Shadow Copies deletion using operating systems utilities via PowerShell

windows · ps_classic_start

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

windows · process_creation

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

windows · ps_script

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

windows · process_creation

Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device. This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.

windows · process_creation

Detects potential C2 communication related to Devil Bait malware

proxy

The Devtoolslauncher.exe executes other binary

windows · process_creation

Detects access to DEWMODE webshell as described in FIREEYE report

webserver

Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.

windows · network_connection

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

windows · registry_set

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

windows

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

windows

Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library

windows · image_load

Detects DLL sideloading activity seen used by Diamond Sleet APT

windows · image_load

Detects DNS queries related to Diamond Sleet APT activity

windows · dns_query

Detects file creation activity that is related to Diamond Sleet APT activity

windows · file_event

Detects process creation activity indicators related to Diamond Sleet APT

windows · process_creation

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

windows · registry_event

Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure. Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory. If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM. If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped. If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.

windows · registry_set

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

windows · process_creation

Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros

windows · registry_set

Detects usage of powershell cmdlets to disable or remove ETW trace sessions

windows · ps_script

Detects scripts or commands that disabled the Powershell command history by removing psreadline module

windows · ps_script

Detects disabling Windows Defender PUA protection

windows · registry_set

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.

windows · registry_event

Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.

linux

Detects attackers attempting to disable Windows Defender using Powershell

windows · process_creation

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry

windows · registry_set

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

windows · registry_set

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

windows · process_creation

Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

windows · ps_script

Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features

windows · process_creation

Detects commands that temporarily turn off Volume Snapshots

windows · process_creation

Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections

windows · registry_set

Detects disabling of Multi Factor Authentication.

m365

Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.

windows · process_creation

Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.

azure

Detects a method to load DLL via LSASS process using an undocumented Registry key

windows · registry_event

Detects cmstp loading "dll" or "ocx" files from suspicious locations

windows · image_load

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

windows · file_event

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

windows · process_creation

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

windows · image_load

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

windows · process_creation

Well-known DNS Exfiltration tools execution

windows · process_creation

Detects Azure Hybrid Connection Manager services querying the Azure service bus service

windows · dns_query

Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.

windows · dns_query

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

windows

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

windows · dns_query

Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security researchers and attackers alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and Log4Shell-style injections, where the exploit payload triggers an external DNS lookup to a controlled domain. A detection indicates that a host on your network resolved one of these domains, which may mean: (1) an attacker is actively probing or exploiting a vulnerable service and using the callback to confirm code execution or data exfiltration, (2) a security scanner (e.g. Nuclei, Gobies) is running against internal targets. Investigate the source host, the full DNS query string (the unique subdomain prefix encodes the callback session), and any concurrent outbound connections or process activity to determine intent.

dns

Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

windows · dns_query

Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

dns

Detects DNS queries to an ".onion" address related to Tor routing networks

windows · dns_query

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

windows

Detects strings used in command execution in DNS TXT Answer

dns

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

windows · image_load

Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.

windows · file_event

Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers

windows

Detects DNS queries for C2 domains used by DPRK Threat actors.

windows · dns_query

Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading.

windows · registry_set

Detects a driver load from a temporary directory

windows · driver_load

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

windows · process_creation

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

windows · ps_script

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

windows · process_creation

Detects email exfiltration via powershell cmdlets

windows · process_creation

Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022. The ".lnk" file was delivered via phishing campaign.

windows · process_creation

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

windows · registry_set

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

windows · process_creation

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

windows

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

firewall

Detects suspicious shell commands used in various Equation Group scripts and tools

linux

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.

windows · registry_event

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

linux · process_creation

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

windows

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

windows · registry_set

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

windows · process_creation

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

windows · process_creation

Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity

webserver

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

windows · process_creation

Detects URL patterns that could be found in ProxyShell exploitation attempts against Exchange servers (failed and successful)

webserver

Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

windows

Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability

windows · process_creation

This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.

windows · registry_set

Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no longer exists on disk at the time of logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.

windows · process_creation

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

windows · process_creation

Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe

windows · process_creation

Detects using WorkFolders.exe to execute an arbitrary control.exe

windows · process_creation

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

proxy

Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS.

windows

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.

windows · process_creation

Detects the execution of the commonly used ZeroLogon PoC executable.

windows · process_creation

Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code

webserver

Detects exploitation indicators of CVE-2022-42475 a heap-based buffer overflow in sslvpnd.

fortios

Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.

cisco

Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814

webserver

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

windows · process_creation

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

windows · process_creation

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

windows · process_creation

Detects the export of a crital Registry key to a file.

windows · process_creation

Exports the target Registry key and hides it in the specified alternate data stream.

windows · create_stream_hash

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

windows

Detects a failed installation of a Exchange Transport Agent

windows

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

windows · process_creation

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

windows · image_load

Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities

windows · file_event

File .conf created related to VenomRAT, AsyncRAT and Lummac samples observed in the wild.

windows · file_event

Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

windows · process_creation

Detects execution of the IEExec utility to download and execute files

windows · process_creation

Detects when a user downloads a file from an IP based URL using CertOC.exe

windows · process_creation

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

windows · process_creation

Detects usage of bitsadmin downloading a file to a suspicious target folder

windows · process_creation

Detects the use of Windows Defender MpCmdRun.EXE to download files

windows · process_creation

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

windows · process_creation

Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

windows · process_creation

Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.

windows · process_creation

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

windows · process_creation

Detects usage of bitsadmin downloading a file with a suspicious extension

windows · process_creation

Detects the creation of files with an executable or script extension by an Office application.

windows · file_event

Detects commonly-used chained commands and strings in the most recent 'url' value of the 'TypedPaths' key, which could be indicative of a user being targeted by the FileFix technique.

windows · registry_set

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

windows · process_creation

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

windows · process_creation

Detects Archer malware invocation via rundll32

windows · process_creation

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

windows

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

zeek

Detects a flashplayer update from an unofficial location

proxy

Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder

windows · registry_delete

Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.

windows · registry_set

Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.

windows · registry_set

Detects the creation of specific files inside of ProgramData directory. These files were seen being created by Forest Blizzard as described by MSFT.

windows · file_event

Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.

windows · process_creation

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.

windows · process_creation

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

windows · process_creation

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

windows · process_creation

Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.

windows · file_event

Detects any GAC DLL being loaded by an Office Product

windows · image_load

Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

windows

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

windows · process_creation

Detects when a user disables a critical security feature for an organization.

github

Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.

github

Detects if the secret scanning feature is disabled for an enterprise or repository.

github

Detects malicious indicators seen used by the Goofy Guineapig malware

windows · file_event

Detects potential C2 communication related to Goofy Guineapig backdoor

proxy

Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations. This tool is used by the Play ransomware group for network enumeration, data gathering, and event log clearing.

windows · process_creation

Detects suspicious session with two users present

linux

Detects suspicious user agent strings user by hack tools in proxy logs

proxy

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

windows · process_creation

Detects command line parameters used by Bloodhound and Sharphound hack tools

windows · process_creation

Detects remote thread creation from CACTUSTORCH as described in references.

windows · create_remote_thread

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

windows · process_creation

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

windows · process_creation

Detects a typical pattern of a CobaltStrike BOF which inject into other processes

windows · process_access

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

proxy

Detects the use of CoercedPotato, a tool for privilege escalation

windows · process_creation

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

windows · pipe_created

Detects suspicious command lines used in Covenant luanchers

windows · process_creation

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

windows · process_creation

Detects various execution patterns of the CrackMapExec pentesting framework

windows · process_creation

Detects file creation events with filename patterns used by CrackMapExec.

windows · file_event

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

windows · process_creation

Detects suspicious process patterns found in logs when CrackMapExec is used

windows · process_creation

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

windows · process_creation

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

windows · process_creation

Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods

windows · process_creation

Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.

windows · process_creation

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

windows · process_creation

Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.

windows

Detects the pattern of a pipe name as used by the hack tool EfsPotato

windows · pipe_created

Detects suspicious powershell command line parameters used in Empire

windows · process_creation

Detects user agent and URI paths used by empire agents

proxy

Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.

windows · ps_module

Detects process access requests from hacktool processes based on their default image name

windows · process_access

Detects the execution GMER tool based on image and hash fields.

windows · process_creation

Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles

windows · process_access

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

windows · process_creation

Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

windows · process_creation

Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.

windows · process_creation

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

windows · process_creation

Detects command line parameters used by Hydra password guessing hack tool

windows · process_creation

Detects file creation events with filename patterns used by Impacket.

windows · file_event

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

windows · process_creation

Detects command line parameters used by Koadic hack tool

windows · process_creation

Detects the use of KrbRelay, a Kerberos relaying tool

windows · process_creation

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

windows · process_creation

Detects the process injection of a LittleCorporal generated Maldoc.

windows · process_access

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

windows · process_creation

Detection well-known mimikatz command line arguments

windows · process_creation

Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.

windows · process_creation

Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that extraction path are unique to NetExec and serve as reliable on-disk indicators of execution. NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for Active Directory enumeration, credential harvesting, and remote code execution.

windows · file_event

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

windows

Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file

windows · file_event

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

windows · process_creation

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

windows · create_remote_thread

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

windows · process_creation

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

windows · file_event

Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files

windows · process_creation

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

windows · file_event

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

windows · process_creation

Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

windows · process_creation

Detects usage of the Quarks PwDump tool via commandline arguments

windows · process_creation

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

windows · process_creation

Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.

windows · process_creation

Detects the creation of file with specific names used by RemoteKrbRelay SMB Relay attack module.

windows · file_event

Detects the execution of the hacktool Rubeus using specific command line flags

windows · ps_script

Detects default lsass dump filename generated by SafetyKatz.

windows · file_event

Detects usage of the Sharp Chisel via the commandline arguments

windows · process_creation

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

windows · process_creation

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

windows · process_creation

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

windows · image_load

Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

windows · process_creation

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

windows · process_creation

Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

windows · process_creation

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

windows · process_creation

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

windows · process_creation

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

windows · process_creation

Detects SILENTTRINITY stager dll loading activity

windows · image_load

Detects SILENTTRINITY stager use via PE metadata

windows · process_creation

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

windows · process_creation

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

windows · process_creation

Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon

windows · process_access

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

windows · process_creation

Detects files written by the different tools that exploit HiveNightmare

windows · file_event

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

windows · process_creation

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

windows · process_creation

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

windows · process_creation

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

windows · ps_script

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

windows · process_creation

Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.

windows · process_creation

Detects suspicious use of XORDump process memory dumping utility

windows · process_creation

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

windows · process_creation

Detects the creation of a named file stream with the imphash of a well-known hack tool

windows · create_stream_hash

This events that are generated when using the hacktool Ruler by Sensepost

windows

Detects installation or execution of services

windows

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

windows · process_creation

Detects the creation of a local hidden user account which should not happen for event ID 4720.

windows

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)

windows · registry_set

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

windows · registry_set

Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

windows · file_event

Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity

linux · process_creation

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments. Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.

windows · process_creation

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

windows · process_creation

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

windows

Rule to detect the Hybrid Connection Manager service installation.

windows

Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.

windows · registry_event

Rule to detect the Hybrid Connection Manager service running on an endpoint.

windows

Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.

windows · registry_set

Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe. HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode. Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.

windows · process_creation

Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID

windows · process_creation

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

windows · registry_set

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

windows · process_creation

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

windows · process_creation

Detects execution of Impacket's psexec.py.

windows

Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

windows

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

windows

Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.

windows

Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution

windows

Detects important or interesting Windows services that got terminated unexpectedly.

windows

Detects important or interesting Windows services that got terminated for whatever reason

windows

Detects the import of a alternate datastream to the registry with regedit.exe.

windows · process_creation

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

azure

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

windows · process_creation

Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.

linux · process_creation

Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.

windows · process_creation

Detects an interactive AT job, which may be used as a form of privilege escalation.

windows · process_creation

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

azure

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · process_creation

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · ps_script

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · ps_module

Detects Obfuscated use of Clip.exe to execute PowerShell

windows

Detects Obfuscated use of Clip.exe to execute PowerShell

windows

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

windows · process_creation

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

windows · ps_script

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

windows · ps_module

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

windows

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

windows

Detects Obfuscated use of stdin to execute PowerShell

windows · process_creation

Detects Obfuscated use of stdin to execute PowerShell

windows · ps_script

Detects Obfuscated use of stdin to execute PowerShell

windows · ps_module

Detects Obfuscated use of stdin to execute PowerShell

windows

Detects Obfuscated use of stdin to execute PowerShell

windows

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · process_creation

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · ps_script

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · ps_module

Detects Obfuscated use of Environment Variables to execute PowerShell

windows

Detects Obfuscated use of Environment Variables to execute PowerShell

windows

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · process_creation

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · ps_script

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · ps_module

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows

Detects Obfuscated Powershell via Stdin in Scripts

windows · process_creation

Detects Obfuscated Powershell via Stdin in Scripts

windows · ps_script

Detects Obfuscated Powershell via Stdin in Scripts

windows · ps_module

Detects Obfuscated Powershell via Stdin in Scripts

windows

Detects Obfuscated Powershell via Stdin in Scripts

windows

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · process_creation

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · ps_script

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · ps_module

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · process_creation

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · ps_script

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · ps_module

Detects Obfuscated Powershell via use MSHTA in Scripts

windows

Detects Obfuscated Powershell via use MSHTA in Scripts

windows

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows · ps_script

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows · ps_module

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

windows · file_event

Detects possible Java payloads in web access logs

webserver

Detects suspicious command sequence that JexBoss

linux

Detects exploitation attempt using the JNDI-Exploit-Kit

webserver

Detects possible malicious execution of JXA in-memory via OSAScript

macos · process_creation

Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.

windows · process_creation

Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.

windows · registry_set

Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.

windows · process_creation

Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.

windows · image_load

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

windows · process_creation

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

windows

Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.

linux · process_creation

Detects loading of DLLs associated with Katz Stealer malware 2025 variants. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. The process that loads these DLLs are very likely to be malicious.

windows · image_load

Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity.

zeek

Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.

windows · process_creation

Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.

windows

Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory

windows · process_creation

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

windows

Detects specific command line execution used by Lace Tempest to download Cobalt Strike as reported by SysAid Team

windows · process_creation

Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7

windows · file_event

Detects execution of a specific binary based on filename and hash used by Lace Tempest to load additional malware as reported by SysAid Team

windows · process_creation

Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team

windows · ps_script

Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team

windows · ps_script

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

windows · image_load

Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location

windows · process_creation

Detects programs on a Windows system that should not write an archive to disk

windows · file_event

Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery.

windows · file_event

Detects LOLBINs and applications that should not legitimately drop script files to disk. This may indicate malware staging or abuse of a trusted binary for script-based code execution.

windows · file_event

Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution. Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.

windows · file_event

Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall. AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431 to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD splice path that corrupts the page cache of SUID binaries. Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN daemons using non-default kernel offload configurations.

linux

Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".

linux

Detects command line parameters or strings often used by crypto miners

linux · process_creation

Detects process connections to a Monero crypto mining pool

linux · network_connection

Detects known hacktool execution based on image name.

linux · process_creation

Detect attempt to enable auditing of TTY input

linux

Detects events with patterns found in commands used for reconnaissance on linux systems

linux · process_creation

Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell). This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands. When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>). For other methods, the Image field will show the spawned process directly.

linux · process_creation

Detects suspicious sub processes of web server processes

linux · process_creation

Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8). In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.

linux · process_creation

Detects usage of a PowerShell command to dump the live memory of a Windows machine

windows · ps_script

Detects the creation of the LiveKD driver by a process image other than "livekd.exe".

windows · file_event

Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.

windows · file_event

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

windows · image_load

Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability

windows

Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

linux

Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode

windows

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)

webserver

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)

webserver

Detect changes of syslog daemons configuration files

linux

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

windows · process_creation

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

windows · registry_set

Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379

windows

Detects Access to LSASS Process

windows

Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference

windows · process_access

Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409). This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability, which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service, leading to a stack-based buffer overflow and subsequent crash of the LSASS process.

windows

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

windows · process_creation

Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.

windows · registry_set

Detects LSASS process access requests from a source process with the "dump" keyword in its image name.

windows · process_access

Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.

windows · process_access

Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service). This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.

windows

Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.

windows · file_event

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.

windows · file_event

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

windows · file_event

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

windows · process_creation

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

windows · process_creation

Detects registry changes to Office trust records where the path is located in a potentially suspicious location

windows · registry_set

Detects base64 encoded strings used in hidden malicious PowerShell command lines

windows · process_creation

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded

windows · file_event

Detects loading of known malicious drivers via their hash.

windows · driver_load

Indicates sign-in from a malicious IP address based on high failure rates.

azure

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

azure

Detects Commandlet names and arguments from the Nishang exploitation framework

windows · ps_script

Detects Commandlet names from well-known PowerShell exploitation frameworks

windows · ps_module

Detects Commandlet names from well-known PowerShell exploitation frameworks

windows · process_creation

Detects Commandlet names from well-known PowerShell exploitation frameworks

windows · ps_script

Detects the creation of known offensive powershell scripts used for exploitation

windows · file_event

Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance

windows · ps_module

Detects Commandlet names from ShellIntel exploitation scripts.

windows · ps_script

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

aws

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

windows · process_access

Detects suspicious user agent strings used by malware in proxy logs

proxy

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

windows · process_creation

Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted. This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.

linux · process_creation

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

windows · process_creation

Detects suspicious command line patterns seen being used by MERCURY APT

windows · process_creation

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

windows

Alerts on Metasploit host's authentications on the domain.

windows

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

windows

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

windows

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

windows

Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"

windows

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

windows · process_creation

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

windows · process_creation

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

windows

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

windows

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

windows · image_load

Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.

windows · registry_set

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

windows

Detects Log4J Wstomcat process execution as seen in Mint Sandstorm activity

windows · process_creation

Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.

windows · process_creation

Detects a Windows command line executable started from MMC

windows · process_creation

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

windows · process_creation

Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.

linux

Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.

aws

Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts. Attackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically.

windows · registry_set

Detects suspicious DNS queries to Monero mining pools

dns

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

webserver

Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

windows · process_creation

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab).

windows · process_creation

Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.

windows · process_creation

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)

windows · process_creation

Detects corrupted packets sent to the MSMQ service. Could potentially be a sign of CVE-2023-21554 exploitation

windows

Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role

windows

Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server

windows

This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

windows

Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started

windows

Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.

windows

Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands

windows

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

windows · process_creation

Detects specific process parameters as used by Mustang Panda droppers

windows · process_creation

Detects abusing Windows 10 Narrator's Feedback-Hub

windows · registry_event

Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section). By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.

windows · registry_set

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

windows · process_creation

Detects NetNTLM downgrade attack

windows

Detects NetNTLM downgrade attack

windows · registry_event

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

windows · network_connection

Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.

windows · network_connection

Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.

windows · network_connection

Detects network connections from the Equation Editor process "eqnedt32.exe".

windows · network_connection

Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.

windows · network_connection

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.

windows · network_connection

Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such network connections can also help identify potential malicious infrastructure used by threat actors

windows · network_connection

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

windows · network_connection

Detects a set of suspicious network related commands often used in recon stages

windows · process_creation

Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.

windows · network_connection

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

azure

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

windows · registry_set

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

windows · process_creation

Detects the abuse of the exefile handler in new file association. Used for bypass of security products.

windows · registry_set

Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.

windows

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

windows · registry_set

Detects an RDP connection originating from a domain controller.

windows · network_connection

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

windows · registry_set

Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

windows · registry_set

Detects creation of local users via the net.exe command with the option "never expire"

windows · process_creation

Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.

windows · process_creation

Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.

Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour

windows

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

windows · process_creation

Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.

linux · file_event

Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe

windows · process_creation

Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.

windows · file_event

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

windows · file_event

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory

windows · file_event

Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.

windows · ps_script

This the exploitation of a NTFS vulnerability as reported without many details via Twitter

windows

Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an attacker-controlled server, enabling offline cracking or relay attacks. When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials stored in LSASS — without requiring a plaintext password. This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.

windows · process_creation

Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.

windows · process_creation

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

windows · process_creation

Detects Octopus Scanner Malware.

windows · file_event

Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.

windows · process_creation

Detects the creation of a office macro file from a a suspicious process

windows · file_event

Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.

windows · registry_set

Detects when Okta FastPass prevents a known phishing site.

okta

Detects when Okta identifies new activity in the Admin Console.

okta

Detects when an Okta end-user reports activity by their account as being potentially suspicious.

okta

Detects when an Okta user session starts where the user is behind an anonymising proxy service.

okta

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

zeek

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

linux · process_creation

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

linux · process_creation

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.

windows · process_creation

Detects file creation activity that is related to Onyx Sleet APT activity

windows · file_event

Detects instances where an FTP service on an OpenCanary node has had a login attempt.

opencanary · application

Detects instances where a GIT service on an OpenCanary node has had Git Clone request.

opencanary · application

Detects instances where an OpenCanary node has been targeted by a SYN port scan.

opencanary · application

Detects instances where an HTTP service on an OpenCanary node has received a GET request.

opencanary · application

Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.

opencanary · application

Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.

opencanary · application

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.

opencanary · application

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.

opencanary · application

Detects instances where a MySQL service on an OpenCanary node has had a login attempt.

opencanary · application

Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan

opencanary · application

Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan

opencanary · application

Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan

opencanary · application

Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan

opencanary · application

Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.

opencanary · application

Detects instances where an RDP service on an OpenCanary node has had a connection attempt.

opencanary · application

Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.

opencanary · application

Detects instances where an SIP service on an OpenCanary node has had a SIP request.

opencanary · application

Detects instances where an SMB service on an OpenCanary node has had a file open request.

opencanary · application

Detects instances where an SNMP service on an OpenCanary node has had an OID request.

opencanary · application

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

opencanary · application

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

opencanary · application

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

opencanary · application

Detects instances where a TFTP service on an OpenCanary node has had a request.

opencanary · application

Detects instances where a VNC service on an OpenCanary node has had a connection attempt.

opencanary · application

The OpenWith.exe executes other binary

windows · process_creation

Detects activity mentioned in Operation Wocao report

windows · process_creation

Detects activity mentioned in Operation Wocao report

windows

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

windows · process_creation

Detects Cobalt Strike module/commands accidentally entered in CMD shell

windows · process_creation

Detects exploitation attempts on WebLogic servers

webserver

Detects potential suspicious run-only executions compiled using OSACompile

macos · process_creation

Detects a network connection initiated by Cmstp.EXE Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.

windows · network_connection

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

windows · network_connection

Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.

windows · network_connection

Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.

windows · network_connection

Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.

github

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

windows · process_creation

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

windows · registry_set

Detects the modification of Outlook security setting to allow unprompted execution of macros.

windows · registry_set

Detects exploitation indicators related to PaperCut MF/NG Exploitation

windows · process_creation

Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut

windows · process_creation

Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password in order to obtain persistence.

windows

Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN

windows

Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.

windows · create_remote_thread

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

windows

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

windows

Indicates that a password spray attack has been successfully performed.

azure

Detects processes loading modules related to PCRE.NET package

windows · image_load

Detects processes creating temp files related to PCRE.NET package

windows · file_event

Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses.

windows · file_event

Detects process creation activity related to Peach Sandstorm APT

windows · process_creation

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

windows

Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary

windows · registry_set

Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.

windows

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

windows · process_creation

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

windows · process_creation

Detects when PIM alerts are set to disabled.

azure

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

azure

Detects a ping command that uses a hex encoded IP address

windows · process_creation

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

windows · process_creation

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

windows · image_load

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

windows · file_event

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

windows

Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.

rpc_firewall · application

Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321

windows

Detect AD credential dumping using impacket secretdump HKTL

windows

Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

zeek

Detect PetitPotam coerced authentication activity.

windows

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

windows · process_creation

Detects possible addition of shadow credentials to an active directory object.

windows

Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

windows · process_creation

Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

windows · process_creation

Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning

windows · process_creation

Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless

windows · registry_set

Detects potential DLL sideloading of "appverifUI.dll"

windows · image_load

Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs

windows · ps_script

Detects specific command line execution used by FIN7 as reported by WithSecureLabs for reconnaissance and POWERTRASH execution

windows · process_creation

Detects PowerShell script file creation with specific name or suffix which was seen being used often by FIN7 PowerShell scripts

windows · file_event

Detects specific command line execution used by Mustang Panda in a targeted attack against the Australian government as reported by Lab52

windows · process_creation

Detects potential process and execution activity related to APT10 Cloud Hopper operation

windows · process_creation

Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc

windows · process_creation

Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability

windows · process_creation

Detects potential arbitrary file download using a Microsoft Office application

windows · process_creation

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

windows · process_creation

Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)

windows · registry_set

Detects tampering with attachment manager settings policies attachments (See reference for more information)

windows · registry_set

Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. The AutoLogger event tracing session records events up that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in, and also used by security solutions as telemetry source. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.

windows · registry_set

Detects activity that could be related to Baby Shark malware

windows · process_creation

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

macos · process_creation

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

windows · process_creation

Detects command line patterns used by BlackByte ransomware in different operations

windows · process_creation

Detects remote thread injection events based on action seen used by bumblebee

windows · create_remote_thread

Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877

webserver

Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links. ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages. Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content, such as one-liners that execute remotely hosted malicious files or scripts.

windows · registry_set

Detects potential process patterns related to Cobalt Strike beacon activity

windows · process_creation

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

windows · registry_set

Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT

windows · file_event

Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism

windows · image_load

Detects the creation of a file named "dllhost.exe" in the "C:\users\public\Documents\" directory. Seen being used by the COLDSTEEL RAT in some of its variants.

windows · file_event

Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.

windows · registry_set

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

windows · process_creation

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

windows · process_creation

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

windows · dns_query

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

windows · network_connection

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

proxy

Detects execution of known compromised version of 3CXDesktopApp

windows · process_creation

Detects potential malicious .ICO files download from a compromised 3CXDesktopApp via web requests to the the malicious Github repository

proxy

Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software

windows · process_creation

Detects a command used by conti to dump database

windows · process_creation

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

windows · process_creation

Detects remote thread creation by PowerShell processes into "lsass.exe"

windows · create_remote_thread

Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass

windows · process_creation

Detects command line parameters or strings often used by crypto miners

windows · process_creation

Detects potential CSharp Streamer RAT loading .NET executable image by using the default file name and path associated with the tool.

windows · image_load

Detects potential exploitation of CVE-2021-260841 a Confluence RCE using OGNL injection

webserver

Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's Unified Messaging service

windows · process_creation

Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations

windows · process_creation

Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable versions of Log4j.

windows · process_creation

Detects potential exploitation attempts of CVE-2022-21587 an arbitrary file upload vulnerability impacting Oracle E-Business Suite (EBS). CVE-2022-21587 can lead to unauthenticated remote code execution.

webserver

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

windows · process_creation

Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. 7-Zip version 21.07 and earlier on Windows allows privilege escalation (CVE-2022-29072) and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process.

windows · process_creation

Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169

webserver

Detects potential exploitation of CVE-2023-21554 (dubbed QueueJumper)

windows · process_creation

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

webserver

Detects a potential exploitation attempt of CVE-2023-25157 a SQL injection in GeoServer

webserver

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

webserver

Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.

windows · file_event

Detects the execution of a renamed "cmd", "powershell" or "powershell_ise" binary. Attackers were seen using these binaries in a renamed form as "wermgr.exe" in exploitation of CVE-2023-36874

windows · process_creation

Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

windows · file_event

Detects access to a file share with a naming schema seen being used during exploitation of CVE-2023-36884

windows

Detects a unique URL marker seen being used by RomCom potentially exploiting CVE-2023-36884

proxy

Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884

proxy

Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect. This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.

paloalto · appliance

Detects potential exploitation of CVE-2026-33829, a vulnerability in the Windows Snipping Tool URI handler (ms-screensketch:). An attacker can abuse the 'filePath' parameter to supply a UNC path or HTTP URL, causing SnippingTool.exe to initiate a connection to a remote resource. When a UNC path is used (e.g. \\attacker.com\share), this triggers an outbound NTLM authentication attempt, allowing the attacker to capture or relay the victim's Net-NTLMv2 hash. HTTP-based paths may result in remote file loading or server-side request forgery (SSRF)-style access. The URI can be delivered via a malicious hyperlink, phishing email, or web page.

windows · process_creation

Detects the use of various CLI utilities exfiltrating data via web requests

windows · process_creation

Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

windows · process_creation

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows · process_creation

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows · process_creation

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows · process_creation

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows · process_creation

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

windows · process_creation

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.

windows · process_creation

Detects specific process behavior observed with Devil Bait samples

windows · process_creation

Detects the creation of ".xml" and ".txt" files in folders of the "\AppData\Roaming\Microsoft" directory by uncommon processes. This behavior was seen common across different Devil Bait samples and stages as described by the NCSC

windows · file_event

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

windows · image_load

Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.

windows · image_load

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

windows · image_load