Low-severity Sigma rules

Detects activity when a member is added to a security-enabled global group

windows

Detects activity when a member is removed from a security-enabled global group

windows

Detects activity when a security-enabled global group is deleted

windows

Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.

windows · file_access

Detects access to ADMIN$ network share

windows

Detects file access requests to browser credential stores by uncommon processes. Could indicate potential attempt of credential stealing. Requires heavy baselining before usage

windows · file_access

Detects file access requests to browser credential stores by uncommon processes. Could indicate potential attempt of credential stealing This rule requires heavy baselining before usage.

windows

Detects file access requests to chromium based browser sensitive files by uncommon processes. Could indicate potential attempt of stealing sensitive information.

windows · file_access

Detects file access requests to Windows Outlook Mail by uncommon processes. Could indicate potential attempt of credential stealing. Requires heavy baselining before usage

windows · file_access

Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with permissions on the certificate template or invalid signatures.

windows

Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

windows · ps_script

Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory

windows · ps_script

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

windows · ps_module

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

windows · ps_script

Detects certificate creation with template allowing risk permission subject

windows

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

windows

Detect remote login by Administrator user (depending on internal pattern).

windows

Detects the deletion of the "Zone.Identifier" ADS. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

windows · file_delete

Detects loading of Amsi.dll by uncommon processes

windows · image_load

An application has been removed. Check if it is critical.

windows

Detects attempts to record audio using the arecord and ecasound utilities.

linux

Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

windows · ps_script

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

aws

Identifies when an EKS cluster is created or deleted.

aws

Detects when an ElastiCache security group has been created.

aws

Identifies when an ElastiCache security group has been modified or deleted.

aws

Detects possible suspicious glue development endpoint activity.

aws

Detects when a user attached a Lambda layer to an existing Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role. This would give an adversary access to resources that the function has access to.

aws

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

aws

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

aws

Detects when a user tampers with S3 data management in Amazon Web Services.

aws

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

aws

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

aws

Detect when users are authenticating without MFA being required.

azure

Detects when a Container Registry is created or deleted.

azure

Detects when a Azure Kubernetes Cluster is created or deleted.

azure

Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios", indicating potential use of automated credential harvesting or AiTM phishing infrastructure. Axios is a Node.js HTTP client abused to intercept and replay stolen credentials and MFA tokens. When triaging results, analysts should: - Check the sign-in risk level, MFA status, and conditional access results for signs of bypass. - Look for sign-ins from unusual locations or IPs, especially if the same IP targets multiple accounts. - Prioritize successful sign-ins over failed ones, as they may indicate a completed credential replay or AiTM attack.

azure

Detects execution of the bash shell with the interactive flag "-i".

linux · process_creation

Detects when a secret scanning allowlist rule is added for projects.

bitbucket

Detects when secret scanning rule is deleted for the project or repository.

bitbucket

Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing.

windows · process_creation

Detects an uncommon process loading the "BitsProxy.dll". This DLL is used when the BITS COM instance or API is used. This detection can be used to hunt for uncommon processes loading this DLL in your environment. Which may indicate potential suspicious activity occurring.

windows · image_load

Detects execution of Chromium based browser in headless mode

windows · process_creation

Detects powershell execution with that make use of to the bxor (Bitwise XOR). Attackers might use as an alternative obfuscation method to Base64 encoded commands. Investigate the CommandLine and process tree to determine if the activity is malicious.

windows · ps_classic_start

Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

linux · process_creation

Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

windows · process_creation

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

cisco

Collect pertinent data from the configuration files

cisco

Find information about network devices that is not stored in config files

cisco

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

cisco

Various protocols maybe used to put data on the device for exfil or infil

cisco

Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.

firewall

Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.

Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

linux

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

linux · process_creation

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

linux

Detects the use of the redirection character ">" to redirect information on the command line. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

windows · process_creation

Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.

windows

Detects a CodePage modification using the "mode.com" utility. This behavior has been used by threat actors behind Dharma ransomware.

windows · process_creation

Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.

windows · registry_set

Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

windows · ps_script

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

windows · process_creation

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.

windows · process_creation

Detects setting proxy configuration

linux · process_creation

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

linux · process_creation

Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.

kubernetes · application

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

macos · process_creation

Detects the creation of an executable by another executable.

windows · file_event

Detects usage of crontab to list the tasks of the user

linux · process_creation

Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

linux · process_creation

Detects a curl process start on Windows, which could indicates a file download from a remote location or a simple web request to a remote server

windows · process_creation

Detects the creation of ".rev" files by WinRAR. Could be indicative of potential exploitation of CVE-2023-40477. Look for a suspicious execution shortly after creation or a WinRAR application crash.

windows · file_event

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

linux

Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.

windows · process_creation

Detects potential overwriting and deletion of a file using DD.

linux · process_creation

Detects usage of base64 utility to decode arbitrary base64-encoded text

linux · process_creation

Detects usage of base64 utility to decode arbitrary base64-encoded text

macos · process_creation

Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.

kubernetes · application

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

windows · process_creation

Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

windows · process_creation

Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.

windows · process_creation

Detects the creation of a file with the ".dmp"/".hdmp" extension. Often created by software during a crash. Memory dumps can sometimes contain sensitive information such as credentials. It's best to determine the source of the crash.

windows · file_event

Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.

windows · ps_script

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

zeek

Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.

windows · dns_query

Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.

windows · dns_query

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

windows · dns_query

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

windows

Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.

windows · dns_query

Detects DNS server discovery via LDAP query requests from uncommon applications

windows · dns_query

Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery

linux · process_creation

Detects download of certain file types from hosts in suspicious TLDs

proxy

Detects executable downloads from suspicious remote systems

proxy

When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution

windows · file_event

Detects when an end user consents to an application

azure

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

windows · registry_set

Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

windows · registry_set

Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.

proxy

Detects the export of the target Registry key to a file.

windows · process_creation

Detects external disk drives or plugged-in USB devices.

windows

Detect failed authentications from countries you do not operate out of.

azure

Detects usage of the "dir" command part of Windows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories.

windows · process_creation

Detects when the file creation time is changed to a year before 2020. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity. In order to use this rule in production, it is recommended first baseline normal behavior in your environment and then tune the rule accordingly. Hunting Recommendation: Focus on files with creation times set to years significantly before the current date, especially those in user-writable directories. Correlate with process execution logs to identify the source of the modification and investigate any unsigned or suspicious binaries involved.

windows · file_change

Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

windows · process_creation

Detects file and folder permission changes.

linux

Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

windows · process_creation

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

windows · process_creation

Detects when a rule has been modified in the Windows firewall exception list

windows

Attackers may leverage fsutil to enumerated connected drives.

windows · process_creation

Detects macOS Gatekeeper bypass via xattr utility

macos · process_creation

Detects when a user creates action secret for the organization, environment, codespaces or repository.

github

Detects when a user bypasses the push protection on a secret detected by secret scanning.

github

Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.

github

Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.

github

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

github

Detects when storage bucket is enumerated in Google Cloud.

gcp

Detects attempts to enable the guest account using the sysadminctl utility

macos · process_creation

Detects attempts to use system dialog prompts to capture user credentials

macos · process_creation

Detects the execution of "hh.exe" to open ".chm" files.

windows · process_creation

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

linux

Host Without Firewall. Alert means not complied. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.

qualys

Detects web browser process opening an HTML file from a user's Downloads folder. This behavior is could be associated with phishing attacks where threat actors send HTML attachments to users. When a user opens such an attachment, it can lead to the execution of malicious scripts or the download of malware. During investigation, analyze the HTML file for embedded scripts or links, check for any subsequent downloads or process executions, and investigate the source of the email or message containing the attachment.

windows · process_creation

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

huawei

Detects usage of the "Import-Module" cmdlet in order to add new Cmdlets to the current PowerShell session

windows · process_creation

Detect indirect command execution via Program Compatibility Assistant pcwrun.exe

windows · process_creation

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

windows · process_creation

Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s

linux · process_creation

Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.

windows · process_creation

Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.

macos · process_creation

Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.

windows · process_creation

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

juniper

Detects enumeration of Kubernetes secrets.

kubernetes · application

Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained.

kubernetes

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

linux

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

linux · process_creation

Detects enumeration of local or remote network services.

linux

Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.

linux · process_creation

Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".

linux · process_creation

Detects the enumeration of other remote systems.

linux · process_creation

Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.

linux · process_creation

Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.

linux · process_creation

Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution. Attackers may use this technique to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.

linux · process_creation

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

windows · image_load

Local accounts, System Owner/User discovery using operating systems utilities

windows · process_creation

Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.

windows · ps_module

Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings

linux · process_creation

Detects the execution of "wmic" with the "group" flag. Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

windows · process_creation

Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

linux · process_creation

Detects enumeration of local system accounts on MacOS systems. This can be used by attackers to identify accounts for lateral movement or privilege escalation.

macos · process_creation

Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

windows

Detects enumeration of local or remote network services.

macos · process_creation

Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe

windows · process_creation

Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate. Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic.

windows · registry_set

Detects Microsoft Excel loading an Add-In (.xll) file

windows · image_load

Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.

windows · image_load

Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence

windows · registry_set

Detects a network connection initiated by an "Msiexec.exe" process over port 80 or 443. Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages. Use this rule to hunt for potentially anomalous or suspicious communications.

windows · network_connection

Detects failed logon attempts from clients to MSSQL server.

windows

Detects potential RDP connection via Mstsc using a local ".rdp" file

windows · process_creation

Detects the creation of a new named pipe using the "mkfifo" utility

linux · process_creation

Detects execution of "Net.EXE".

windows · process_creation

Detects a network connection that was initiated from a PowerShell process. Often times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs. Use this rule as a basis for hunting for anomalies.

windows · network_connection

Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.

windows · network_connection

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

linux

Detects the creation of a new bits job by Bitsadmin

windows

Detects the creation of a new bits job by PowerShell

windows

Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker. Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files. This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job. Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes. Additionally, it is recommended to review the contents of the newly created cron files to assess their intent. Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.

linux · file_event

NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>

zeek

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

kubernetes · application

Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.

aws

Detects the registration of a new ODBC driver.

windows · registry_set

Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC

windows · process_creation

Detects the creation of a new service using powershell.

windows · process_creation

Detects the creation of a new service using the "sc.exe" utility.

windows · process_creation

Detects calls to the "New-NetFirewallRule" cmdlet from PowerShell in order to add a new firewall rule with an "Allow" action.

windows · process_creation

Detects when a powershell script contains calls to the "New-NetFirewallRule" cmdlet in order to add a new firewall rule with an "Allow" action.

windows · ps_script

Detects nltest commands that can be used for information discovery

windows · process_creation

Detects errors when a target server doesn't have suitable keys for generating kerberos tickets. This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.

windows

Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development. Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems. Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.

windows · process_creation

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

windows · process_creation

Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.

windows · process_creation

Detects creation of a file named "ntds.dit" (Active Directory Database)

windows · file_event

Detects logons using NTLM, which could be caused by a legacy source or attackers

windows

Detects the creation of a new office macro files on the systems

windows · file_event

Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.

windows · file_event

Detects all activities against the endpoint "/reports/password-health/*" which should only be accessed via OKTA Admin Console UI. Use this rule to hunt for potential suspicious requests. Correlate this event with "admin console" login and alert on requests without any corresponding admin console login

okta

Detects when an Okta policy is modified or deleted.

okta

Detects when an user account is locked or suspended.

onelogin

Detects when an user assumed another user account.

onelogin

Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"

linux · process_creation

Detects logon events that specify new credentials

windows

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

windows · registry_set

Detects overwriting (effectively wiping/deleting) of a file.

linux

Detects password policy discovery commands

linux

Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.

windows · ps_script

Detects usage of 7zip utilities (7z.exe, 7za.exe and 7zr.exe) to extract password protected zip files.

windows · process_creation

Detects the creation of PFX files (Personal Information Exchange format). PFX files contain private keys and certificates bundled together, making them valuable targets for attackers seeking to: - Exfiltrate digital certificates for impersonation or signing malicious code - Establish persistent access through certificate-based authentication - Bypass security controls that rely on certificate validation Analysts should investigate PFX file creation events by examining which process created the PFX file and its parent process chain, as well as unusual locations outside standard certificate stores or development environments.

windows · file_event

Detects potential DLL sideloading of "7za.dll"

windows · image_load

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

windows · image_load

Looks for potential enumeration of AWS buckets via ListBuckets.

aws

Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.

linux · process_creation

Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts

windows · raw_access_thread

Detects specific combinations of encoding methods in PowerShell via the commandline

windows · process_creation

Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion. Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries. Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.

windows · process_creation

Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools

windows · process_creation

Detects potential exploitation attempts of CVE-2022-21919 or CVE-2021-34484 leading to local privilege escalation via the User Profile Service. During exploitation of this vulnerability, two logs (Provider_Name: Microsoft-Windows-User Profiles Service) with EventID 1511 and 1515 are created (EventID 1515 may generate many false positives). Additionally, the directory \Users\TEMP may be created during exploitation. This behavior was observed on Windows Server 2008.

windows

Detects the use of the "SET" internal command of Cmd.EXE with the /p flag followed directly by an "=" sign. Attackers used this technique along with an append redirection operator ">>" in order to update the content of a file indirectly. Ex: cmd /c >> example.txt set /p="test data". This will append "test data" to contents of "example.txt". The typical use case of the "set /p=" command is to prompt the user for input.

windows · process_creation

Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts

windows · ps_script

Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation

windows · ps_script

Detects the creation of a child "explorer.exe" process from a shell like process such as "cmd.exe" or "powershell.exe". Attackers can use "explorer.exe" for evading defense mechanisms by proxying the execution through the latter. While this is often a legitimate action, this rule can be use to hunt for anomalies. Muddy Waters threat actor was seeing using this technique.

windows · process_creation

Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.

windows · registry_set

Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks. Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.

windows · process_creation

Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting. Adjust the threshold of filename length as needed based on your environment.

linux · file_event

Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"

windows · network_connection

Detects the creation of shell scripts under the "profile.d" path.

linux · file_event

Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.

windows · process_creation

Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads.

windows · ps_classic_start

Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.

windows · file_event

Detects PowerShell scripts set ACL to of a file or a folder

windows · ps_script

Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.

windows · file_event

Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.

windows · registry_set

Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.

windows · ps_script

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

windows · ps_script

Detects the removal of a previously installed IIS module.

windows

Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks. A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host. Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields

kubernetes · application

Detects process discovery commands. Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network

linux · process_creation

Detects execution of processes with image paths starting with WebDAV shares (\\), which might indicate malicious file execution from remote web shares. Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application. Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.

windows · process_creation

Detects execution of "taskkill.exe" in order to stop a service or a process. Look for suspicious parents executing this command in order to hunt for potential malicious activity. Attackers might leverage this in order to conduct data destruction or data encrypted for impact on the data stores of services like Exchange and SQL Server.

windows · process_creation

Detects PsExec service default pipe creation

windows · pipe_created

Detects default PsExec service filename which indicates PsExec service installation and execution

windows · file_event

This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed, Usee to Query/modify DNS records for Active Directory integrated DNS via LDAP

windows · process_creation

Detects the execution of a Sysinternals Tool via the creation of the "accepteula" registry key

windows · registry_set

Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code. Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables. Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures.

windows · image_load

Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.

windows · process_creation

Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment. In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command. This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.

kubernetes · application

Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injection activity. Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag.

windows · process_creation

Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.

windows · process_creation

Detects command execution via ScreenConnect RMM

windows

Detects file being transferred via ScreenConnect RMM

windows

Detects the execution of a system command via the ScreenConnect RMM service.

windows · process_creation

Detects the creation of files in a specific location by ScreenConnect RMM. ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.

windows · file_event

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

linux · process_creation

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

macos · process_creation

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

windows · process_creation

Detects the use of tools that copy files from or to remote systems

linux

Detects remote PowerShell sessions

windows · ps_classic_start

Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.

windows · ps_classic_start

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper

windows · ps_script

This rule detects the execution of Run Once task as configured in the registry

windows · process_creation

Detects execution of "sc.exe" to query information about registered services on the system

windows · process_creation

Detects the creation of a scheduled task via file creation.

windows · file_event

Detects the creation of a scheduled task via Registry keys.

windows · registry_event

Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

windows · process_creation

Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME

windows

Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code

linux · process_creation

Detects attempts to use screencapture to collect macOS screenshots

macos · process_creation

Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed.

linux

Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations

linux

Detects usage of system utilities (only grep and egrep for now) to discover security software discovery

linux · process_creation

Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

windows

Detects the start, reload or restart of a service.

linux

Detects the execution of "attrib" with the "+s" flag to mark files as system files

windows · process_creation

Detects suspicious change of file privileges with chown and chmod commands

linux · process_creation

Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.

windows · process_creation

Detects changes to shell context menu commands. Use this rule to hunt for potential anomalies and suspicious shell commands.

windows · registry_set

Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.

azure

Detects the loading of a digitally signed DLL whose PE version-info resource is entirely missing. Legitimate signed DLLs from reputable vendors often carry populated metadata fields (Description, Company, Product, OriginalFileName, FileVersion). An attacker who signs a purpose-built or hollowed DLL with a stolen, mis-issued, or cheaply purchased code-signing certificate will often omit these fields, producing a valid signature with no accompanying version info. This pattern is observed in DLL side-loading, search-order hijacking, and certificate-abuse campaigns where signing is used purely to satisfy security-product trust checks. Hunting Hypothesis: - Investigate the signing certificate (issuer, subject, validity window, thumbprint) for disposable or recently issued CAs and cross-reference against known threat-actor certificates. - Examine the DLL's on-disk path relative to the loading process — paths outside standard system directories or inside application folders susceptible to search-order hijacking are high-priority leads. - Correlate with the parent process context; DLLs loaded into high-value targets such as lsass.exe, svchost.exe, or browser processes warrant immediate escalation. Note: The "selection_metadata_null" selection matches fields with a null value. Some backends may interpret null field conditions as "field does not exist" rather than "field has a null value", which would change the detection semantics. If your backend does not support or support null-value matching in different ways than expected, you may need to adjust the rule logic accordingly or remove the "selection_metadata_null" condition.

windows · image_load

Detects filename indicators associated with the SNAKE malware as reported by CISA in their report

windows · file_event

Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.

macos · process_creation

Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors.

linux

Detection use of the command "split" to split files into parts and possible transfer.

macos · process_creation

Detection use of the command "split" to split files into parts and possible transfer.

linux

Detects the usage of the "net.exe" command to start a service using the "start" flag

windows · process_creation

Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.

macos · file_event

Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

linux

Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

linux

Detects appending of zip file to image

linux

Detects extracting of zip file from image file

linux

Detects the stopping of a Windows service via the "net" utility.

windows · process_creation

Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"

windows · process_creation

Detects the stopping of a Windows service via the "sc.exe" utility

windows · process_creation

Detects successful logon attempts performed with WMI

windows

Detects successful MSIX/AppX package installations on Windows systems by monitoring EventID 854 in the Microsoft-Windows-AppXDeployment-Server/Operational log. While most installations are legitimate, this can help identify unauthorized or suspicious package installations. It is crucial to monitor such events as threat actors may exploit MSIX/AppX packages to deliver and execute malicious payloads.

windows

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism

windows · ps_script

Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.

windows · file_event

Use of hostname to get information

windows · process_creation

Detects usage of the "systeminfo" command to retrieve information

windows · process_creation

Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware.

windows · file_access

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

windows · ps_script

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

windows · ps_module

Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.

windows · ps_module

Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.

windows · ps_script

Detect use of Get-GPO to get one GPO or all the GPOs in a domain.

windows · ps_script

Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.

m365

Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.

windows · ps_script

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

windows · process_creation

Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.

proxy

Detects the use of PowerShell to identify the current logged user.

windows · ps_script

Get the processes that are running on the local computer.

windows · ps_script

Use of reg to get MachineGuid information

windows · process_creation

Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

windows · ps_script

Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

windows · process_creation

Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get access to tools such as psexec and procdump to avoid detection based on System paths.

windows

Detects processes loading "System.Drawing.ni.dll". This could be an indicator of potential Screen Capture.

windows · image_load

Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.

linux

Detects System Information Discovery commands

linux

Detects attempts to query system information directly from the Windows Registry.

windows · process_creation

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS, and GPU driver products/versions.

windows · process_creation

Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.

macos · process_creation

Detects usage of system utilities to discover system network connections

linux · process_creation

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

windows · process_creation

Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

linux

Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.

windows

Detects the loading of the "taskschd.dll" module from a process that located in a potentially suspicious or uncommon directory. The loading of this DLL might indicate that the application have the capability to create a scheduled task via the "Schedule.Service" COM object. Investigation of the loading application and its behavior is required to determining if its malicious.

windows · image_load

Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detects activity when The Windows Defender Firewall service failed to load Group Policy

windows

Detects attempts to access the "unattend.xml" file, where credentials might be stored. This file is used during the unattended windows install process.

windows · file_access

Detect scenarios where a potentially unauthorized application or user is modifying the system time.

windows

Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.

windows · process_access

Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

windows · process_creation

Detects unusually long PowerShell command lines with a length of 1000 characters or more

windows · process_creation

Detects plugged/unplugged USB devices

windows

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

windows · ps_classic_start

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

windows · ps_module

Detects calls to hidden files or files located in hidden directories in NIX systems.

linux

PowerShell Remove-Item with -Path to delete a file or a folder with "-Recurse"

windows · ps_script

Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.

windows

Detects suspicious enumeration of the domain the user is associated with.

windows · process_creation

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

windows · process_creation

Detects volume shadow copy mount via Windows event log

windows

Detects the load of known vulnerable drivers via the file name of the drivers.

windows · driver_load

A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.

zeek

Detects activity when Windows Defender Firewall has been reset to its default configuration

windows

Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.

windows

Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. Also, it is recommended to turn off "Local Group Policy Object Processing" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as "gpedit.msc". Please note, that disabling "Local Group Policy Object Processing" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways.

windows

Detects activity when the settings of the Windows firewall have been changed

windows

Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'. This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.

windows · process_creation

Detect suspicious parent processes of well-known Windows processes

windows · process_creation

Detects Windows services that got terminated for whatever reason

windows

Detects when a share is mounted using the "net.exe" utility

windows · process_creation

Detects changes to the AppInstaller (winget) admin settings. Such as enabling local manifest installations or disabling installer hash checks

windows · registry_set

Detects WMI modules being loaded by an uncommon process

windows · image_load