Medium-severity Sigma rules

Detects requests to URI ending with the ".class" extension in proxy logs. This could rules can be used to hunt for potential downloads of Java classes as seen for example in Log4shell exploitation attacks against Log4j.

proxy

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

windows · process_creation

Addition of domains is seldom and should be verified for legitimacy.

windows

Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

windows

Attackers can use print.exe for remote file copy

windows · process_creation

Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.

linux · process_creation

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

windows · ps_script

Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing.

windows · file_access

Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.

windows · file_access

Detects file access requests to the Windows Sysvol Policies Share by uncommon processes

windows · file_access

Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function

windows · file_access

Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function

windows · file_access

Detects accounts that are created or deleted by non-approved users.

azure

Detects when an account is disabled or blocked for sign in but tried to log in

azure

Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

azure

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

windows

Detect set Notification_Suppress to 1 to disable the Windows security center notification

windows · registry_set

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

windows · process_creation

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

windows

Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.

windows · process_creation

Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.

windows · process_creation

Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.

m365

Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.

m365

Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.

m365

Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.

m365

Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes

windows · registry_set

Detect set DisallowRun to 1 to prevent user running specific computer program

windows · registry_set

Detects usage of winget to add new additional download sources

windows · process_creation

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

windows · registry_set

Detects usage of winget to add new potentially suspicious download sources

windows · process_creation

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

windows · process_creation

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

windows · ps_script

Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.

azure

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.

windows · process_creation

An attacker can use the SID history attribute to gain additional privileges.

windows

Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

windows · file_event

Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.

windows · pipe_created

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

windows · file_delete

Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.

windows · file_event

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

windows · file_event

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

windows · process_creation

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

windows · registry_set

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

windows · ps_module

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

windows · pipe_created

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

windows · process_creation

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

windows · process_creation

Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack

windows · image_load

Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the software isn't already used.

windows

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

windows · file_event

Detects an issue in apache logs that reports threading related errors

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

azure

Detects the removal or uninstallation of an application via "Wmic.EXE".

windows · process_creation

Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may use wmic to terminate security products or other applications on the compromised host. This event is triggered on on attempt and process creation can be either successful or unsuccessful.

windows · process_creation

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

azure

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

azure

Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.

windows

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

windows

Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon locations.

windows

Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn't meet the signing requirements.

windows

Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL

windows · dns_query

Detects execution of the Notepad++ updater (gup) to launch other commands or executables

windows · process_creation

Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.

windows · process_creation

Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.

windows · process_creation

Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.

windows · process_creation

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

windows · process_creation

Detects usage of "msedge_proxy.exe" to download arbitrary files

windows · process_creation

Detects usage of "MSOHTMED" to download arbitrary files

windows · process_creation

Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

windows · process_creation

Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

windows · process_creation

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

windows · process_creation

Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system

windows · process_creation

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

windows · process_creation

Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.

windows · process_creation

Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider.

windows · file_event

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

windows · process_creation

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

windows · registry_event

Detects audio capture via PowerShell Cmdlet.

windows · process_creation

Detect attacker collecting audio via SoundRecorder application.

windows · process_creation

Detect when authentications to important application(s) only required single-factor authentication

azure

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

windows · ps_script

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

windows · process_creation

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

windows · process_creation

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

windows · file_event

Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow unsafe or unauthorized model responses.

aws

Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses.

aws

Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.

aws

Detects disabling, deleting and updating of a Trail

aws

Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.

aws

Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization. This alert can help identify potential unauthorized access attempts from unusual locations, which may indicate compromised credentials or malicious activity.

aws

Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.

aws

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

aws

Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.

aws

Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.

aws

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

aws

Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately. There may be situations where security monitoring does not cover some new AWS regions. Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.

aws

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

aws

Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

aws

Detects the change of database master password. It may be a part of data exfiltration.

aws

Detects AWS root account usage

aws

Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.

aws

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

aws

Detects the modification of an EC2 snapshot's permissions to enable access from another account

aws

Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.

aws

Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.

aws

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

aws

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

azure

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

azure

This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.

windows

This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation). This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent. Make sure you set the SACL to propagate to its sub-keys.

windows

Identifies when a application is deleted in Azure.

azure

Identifies when a application gateway is modified or deleted.

azure

Identifies when a application security group is modified or deleted.

azure

Identifies when a device in azure is no longer managed or compliant

azure

Identifies when a device or device configuration in azure is modified or deleted.

azure

Identifies when DNS zone is modified or deleted.

azure

Identifies when an user or application modified the federation settings on the domain.

azure

Identifies when a firewall is created, modified, or deleted.

azure

Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

azure

Identifies when a Firewall Rule Configuration is Modified or Deleted.

azure

Identifies when a key vault is modified or deleted.

azure

Identifies when a Keyvault Key is modified or deleted in Azure.

azure

Identifies when secrets are modified or deleted in Azure.

azure

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

azure

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

azure

Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

azure

Identifies when a Azure Kubernetes network policy is modified or deleted.

azure

Identifies the deletion of Azure Kubernetes Pods.

azure

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

azure

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

azure

Identifies when ClusterRoles/Roles are being modified or deleted.

azure

Identifies when a service account is modified or deleted.

azure

Identifies when a Firewall Policy is Modified or Deleted.

azure

Identifies when a network security configuration is modified or deleted.

azure

Identifies when a new cloudshell is created inside of Azure portal.

azure

Identifies when a owner is was removed from a application or service principal in Azure.

azure

Identifies when a Point-to-site VPN is Modified or Deleted.

azure

Identifies when a service principal is created in Azure.

azure

Identifies when a service principal was removed in Azure.

azure

Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.

azure

Detects when there is a interruption in the authentication process.

azure

Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.

azure

Identifies when a Virtual Network is modified or deleted in Azure.

azure

Identifies when a VPN connection is modified or deleted.

azure

Detects backup catalog deletions

windows

Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

windows · file_delete

Detects commandline arguments for executing a child process via dotnet-trace.exe

windows · process_creation

Detects changes to the bitbucket audit log configuration.

bitbucket

Detects global permissions change activity.

bitbucket

Detects Bitbucket global secret scanning rule deletion activity.

bitbucket

Detects Bitbucket global SSH access configuration changes.

bitbucket

Detects user data export activity.

bitbucket

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

bitbucket

Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.

bitbucket

Detects user permission data export attempt.

bitbucket

Monitor and alert for Bitlocker key retrieval.

azure

Detects new BITS transfer job saving local files with potential suspicious extensions

windows

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

windows

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

linux

Detects the usage of the unsafe bpftrace option

linux · process_creation

Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks

windows · process_creation

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

windows · process_creation

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

azure

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

azure

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract cab using the "/extract" argument that is no longer supported.

windows · process_creation

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

windows · process_creation

Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.

windows

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

windows · process_creation

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

windows · process_creation

Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

windows · ps_script

Detects when an application acquires a certificate private key

windows

Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.

windows

Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

azure

Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.

windows · process_creation

Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.

windows · ps_script

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

azure

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

windows · ps_script

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

windows · process_creation

Detects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.

linux · process_creation

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

windows · process_creation

Detect a system being shutdown or put into different boot mode

cisco

Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network. This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.

cisco

Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

cisco

See what files are being deleted from flash file systems

cisco

Modifications to a config that will serve an adversary's impacts or persistence

cisco

See what commands are being input into the device by other people, full credentials can be in the history

cisco

Show when a monitor or a span/rspan is setup or modified

cisco

Detects modification of Windows Registry Classes keys used for persistence. Adversaries modify these autostart extensibility points (ASEP) to execute malicious code when file types are opened or actions are performed. Various legitimate software also uses these keys. Currently, this rule only filters out known legitimate software paths, thus it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.

windows · registry_set

Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.

linux

Detects keywords that could indicate clearing PowerShell history

windows · ps_script

Detects keywords that could indicate clearing PowerShell history

windows · ps_module

Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.

windows · image_load

Detects child processes of "dfsvc" which indicates a ClickOnce deployment execution.

windows · process_creation

Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.

windows · registry_set

Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts

macos · process_creation

Detects execution of the "pbpaste" utility, which retrieves the contents of the clipboard (a.k.a. pasteboard) and writes them to the standard output (stdout). The utility is often used for creating new files with the clipboard content or for piping clipboard contents to other commands. It can also be used in shell scripts that may require clipboard content as input. Attackers can abuse this utility in order to collect data from the user clipboard, which may contain passwords or sensitive information. Use this rule to hunt for potential abuse of the utility by looking at the parent process and any potentially suspicious command line content.

macos · process_creation

Detects the execution of the "cloudflared" binary from a non standard location.

windows · process_creation

Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB. The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com. The tool has been observed in use by threat groups including Akira ransomware.

windows · process_creation

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

windows · process_creation

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

windows · process_creation

Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · dns_query

Detects CLR DLL being loaded by an Office Product

windows · image_load

Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories. This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.

windows · process_creation

Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.

windows · process_creation

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.

windows · process_creation

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

windows · registry_set

Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry.

windows · process_creation

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

windows · process_creation

Detects modification of autostart extensibility point (ASEP) in registry.

windows · registry_set

Detects programs that connect to uncommon destination ports

windows · network_connection

Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.

windows · process_creation

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

windows · process_creation

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

windows · process_creation

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

windows · process_creation

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

windows · ps_script

Detects password change for the computer's domain account or host principal via "ksetup.exe"

windows · process_creation

Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.

windows · process_creation

Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.

windows · process_creation

Detects use of chcp to look up the system locale value as part of host discovery

windows · process_creation

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

windows · process_creation

Detects a copy command or a copy utility execution to or from an Admin share or remote

windows · process_creation

Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.

windows

Detects disabling the CrashDump per registry (as used by HermeticWiper)

windows · registry_set

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

windows · file_event

Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process

windows · create_remote_thread

Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)

windows · file_event

Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers

windows · create_stream_hash

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

linux

Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs. Thus, the creation of such DLLs may indicate preparation for phantom DLL hijacking attacks.

windows · file_event

Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names. Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection. Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.

kubernetes · application

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

windows · file_event

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

windows · file_access

Detects passwords dumps from Keychain

macos · process_creation

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

windows · image_load

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

windows · process_creation

Detects default CSExec service filename which indicates CSExec service installation and execution

windows · file_event

Detects CSExec service installation and execution events

windows

Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings

windows · process_creation

Detects execution of curl.exe with custom useragent options

windows · process_creation

Detects modification of autostart extensibility point (ASEP) in registry.

windows · registry_set

Detects modification of autostart extensibility point (ASEP) in registry.

windows · registry_set

Detects modification of autostart extensibility point (ASEP) in registry.

windows · registry_set

Detects possible exploitation of VMware Workspace ONE Access Admin Remote Code Execution vulnerability as described in CVE-2022-31659

webserver

Detects potential exploitation attempt of CVE-2023-1389 an Unauthenticated Command Injection in TP-Link Archer AX21.

proxy

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

windows · process_creation

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

proxy

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

webserver

Detects a crash of "WinRAR.exe" where the version is lower than 6.23. This could indicate potential exploitation of CVE-2023-40477

windows

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs.

proxy

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs.

webserver

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708.

windows · file_event

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

windows · file_event

Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.

windows · file_event

Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.

m365

Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.

linux

Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.

windows · process_creation

Detects the load of dbghelp/dbgcore DLL by a potentially uncommon or potentially suspicious process. The Dbghelp and Dbgcore DLLs export functions that allow for the dump of process memory. Tools like ProcessHacker, Task Manager and some attacker tradecraft use the MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine. Keep in mind that many legitimate Windows processes and services might load the aforementioned DLLs for debugging or other related purposes. Investigate the CommandLine and the Image location of the process loading the DLL.

windows · image_load

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

windows

Before deploying any new asset, change all default passwords to have values consistent with administrative level accounts. Sigma detects default credentials usage. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.

qualys

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

windows · process_creation

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

windows

Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.

windows · registry_delete

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

windows · process_creation

This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.

windows

Detects an appx package deployment that was blocked by AppLocker policy.

windows

Detects an appx package deployment that was blocked by the local computer policy. The following events indicate that an AppX package deployment was blocked by a policy: - Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy - Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy." - Event ID 453: Package blocked by a platform policy. - Event ID 454: Package blocked by a platform policy.

windows

Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

windows · file_event

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

windows · process_creation

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

windows · ps_script

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

windows · process_creation

Detects an installation of a device that is forbidden by the system policy

windows

Monitor and alert for device registration or join events where MFA was not performed.

azure

Detects the execution of DeviceCredentialDeployment to hide a process from view.

windows · process_creation

Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs

windows · network_connection

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

windows · process_creation

Enumerates Active Directory to determine computers that are joined to the domain

windows · ps_script

Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system

windows · registry_set

Detects disabling Windows Defender Exploit Guard Network Protection

windows · registry_set

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

windows · registry_set

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage

windows · registry_set

Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems. Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.

linux · process_creation

Detects registry modifications that disable Privacy Settings Experience

windows · registry_set

Detects disabling security tools

macos · process_creation

Detects disabling Windows Defender Tamper Protection

windows · registry_set

Detect set EnableFirewall to 0 to disable the Windows firewall

windows · registry_set

Detect set UseActionCenterExperience to 0 to disable the Windows security center notification

windows · registry_set

Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.

azure

Detects disabling security tools

linux · process_creation

Detects disabling security tools

linux

Detects the execution of the hdiutil utility in order to create a disk image.

macos · process_creation

Detects the execution of the hdiutil utility in order to mount disk images.

macos · process_creation

Detects any child process spawning from "Diskshadow.exe". This could be due to executing Diskshadow in interpreter mode or script mode and using the "exec" flag to launch other applications.

windows · process_creation

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

windows · process_creation

Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.

windows · process_creation

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that deleted the shadow copies on the systems. Investigate the content of the scripts and its location.

windows · process_creation

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

windows · process_creation

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

windows · registry_set

Detects suspicious Django web application framework exceptions that could indicate exploitation attempts

django · application

Detects calls of DLLs exports by ordinal numbers via rundll32.dll.

windows · process_creation

Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.

windows · process_creation

Detects using register-cimprovider.exe to execute arbitrary dll file.

windows · process_creation

Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"

windows · image_load

Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.

windows · process_creation

Hunts known SVR-specific DLL names.

windows · image_load

Detects Dllhost.EXE initiating a network connection to a non-local IP address. Aside from Microsoft own IP range that needs to be excluded. Network communication from Dllhost will depend entirely on the hosted DLL. An initial baseline is recommended before deployment.

windows · network_connection

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

windows · process_creation

Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs. The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious. It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions, it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.

windows · ps_script

Detects DNS queries initiated by "Regsvr32.exe"

windows · dns_query

Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

windows · dns_query

Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners. These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS activity can indicate potential delivery or command-and-control communication attempts.

windows · dns_query

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · dns_query

Detects DNS queries for subdomains related to MEGA sharing website

windows · dns_query

Detects DNS queries for subdomains related to MEGA sharing website

windows

Detects DNS queries for subdomains related to "Put.io" sharing website.

windows

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

windows · dns_query

Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · dns_query

Identifies IPs performing DNS lookups associated with common Tor proxies.

zeek

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

windows · registry_set

Detects execution of "dsquery.exe" for domain trust discovery

windows · process_creation

Detects any assembly DLL being loaded by an Office Product

windows · image_load

Detects the use of wget to download content to a suspicious directory

linux · process_creation

Detects download of certain file types from hosts with dynamic DNS names (selected list)

proxy

Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.

windows

Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.

windows · process_creation

Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers

windows · process_creation

Detects the creation of suspcious binary files inside the "\windows\system32\spool\drivers\color\" as seen in the blog referenced below

windows · file_event

Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

windows · process_creation

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

windows · ps_script

Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location

windows

Detects process dump via legitimate sqldumper.exe binary

windows · process_creation

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

windows · process_creation

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

windows · process_creation

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

windows · process_creation

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.

windows · process_creation

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

windows · process_creation

Detects common command used to enable bpf kprobes tracing

linux · process_creation

Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests.

windows · registry_set

Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.

windows · registry_set

Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.

windows · registry_set

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

windows · ps_script

Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.

windows · registry_set

Detects when end user consent is blocked due to risk-based consent.

azure

Detects the execution of "whoami.exe" with the "/all" flag

windows · process_creation

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

windows · ps_script

Detects processes that query known 3rd party registry keys that holds credentials via commandline

windows · process_creation

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services

windows · process_creation

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

windows · process_creation

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

windows · process_creation

Detects user account creation on ESXi system via esxcli

linux · process_creation

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

linux · process_creation

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

linux · process_creation

Detects changes to the ESXi syslog configuration via "esxcli"

linux · process_creation

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

linux · process_creation

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

linux · process_creation

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

linux · process_creation

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

linux · process_creation

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

windows

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

windows

Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detect attempts to query the contents of the event log using command line utilities. Attackers use this technique in order to look for sensitive information in the logs such as passwords, usernames, IPs, etc.

windows · process_creation

Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting.

windows · file_event

Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/

zeek

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

windows · process_creation

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

windows · process_creation

Detects file execution using the msdeploy.exe lolbin

windows · process_creation

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

windows · process_creation

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

windows · ps_script

Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors

windows · process_creation

Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc.

linux · process_creation

Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process. This rule might require some initial baselining to align with some third party tooling in the user environment.

windows · process_creation

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

windows · process_creation

Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"

windows · process_creation

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

windows

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

windows · ps_script

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

proxy

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

webserver

Detects when a DNS zone transfer failed.

windows

Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method. Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated when the WMI operation encounters an error (e.g. access denied, provider failure). It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues. Successful clearing operations will NOT produce this event; for those, correlate with Security event 1102 or System event 104.

windows

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

windows

Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json. The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data. Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials. Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.

windows

Detects usage of Gpg4win to decrypt files

windows · process_creation

Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.

windows · file_delete

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

windows · process_creation

Detects file downloads directly from IP address URL using curl.exe

windows · process_creation

Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)

windows · process_creation

Detects usage of bitsadmin downloading a file

windows · process_creation

Detects when a user downloads a file by using CertOC.exe

windows · process_creation

Detects file download using curl.exe

windows · process_creation

Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\"

windows · process_creation

Detects the execution of the nscurl utility in order to download files.

macos · process_creation

Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration

windows · process_creation

Detects usage of Gpg4win to encrypt files

windows · process_creation

Detects a file or folder's permissions being modified or tampered with.

windows · process_creation

Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.

windows · process_creation

Detect file time attribute change to hide new or changes to existing files

macos · process_creation

Detect file time attribute change to hide new or changes to existing files.

linux

Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.). It is highly recommended to perform an initial baseline before using this rule in production.

windows · file_event

Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial baseline before using this rule in production.

windows · file_event

Detect filter driver unloading activity via fltmc.exe

windows · process_creation

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

windows · process_creation

Detects netsh commands that turns off the Windows firewall

windows · process_creation

Detects the removal of a port or application rule in the Windows Firewall configuration using netsh

windows · process_creation

Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule

windows · process_creation

Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic

linux · process_creation

Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

windows · process_creation

Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.

windows · file_event

Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting.

windows · process_creation

Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.

fortigate

Detects the creation of an administrator account on a Fortinet FortiGate Firewall.

fortigate

Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.

fortigate

Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections.

fortigate

Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.

fortigate

Detects the modification of a user group on a Fortinet FortiGate Firewall. The group could be used to grant VPN access to a network.

fortigate

Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.

fortigate

Detects the execution of Winscp with the "-command" and the "open" flags in order to open an FTP connection. Akira ransomware was seen using this technique in order to exfiltrate data.

windows · process_creation

Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.

windows · process_access

Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs".

windows · file_event

Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.

gcp

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

gcp

Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.

windows · ps_script

Detects delete action in the Github audit logs for codespaces, environment, project and repo.

github

Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).

github

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

github

Detects when a repository or an organization is being transferred to another location.

github

Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. Shai-Hulud is an npm supply chain worm targeting CI/CD environments. It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.

windows · process_creation

Detects when changes are made to the SSH certificate configuration of the organization.

github

Identifies when a DNS Zone is modified or deleted in Google Cloud.

gcp

Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).

gcp

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

gcp

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

gcp

Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.

gcp

Identifies when the Secrets are Modified or Deleted.

gcp

Identifies when sensitive information is re-identified in google Cloud.

gcp

Identifies when a service account is disabled or deleted in Google Cloud.

gcp

Identifies when a service account is modified in Google Cloud.

gcp

Detect when a Cloud SQL DB has been modified or deleted.

gcp

Detects when storage bucket is modified or deleted in Google Cloud.

gcp

Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.

gcp

Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.

gcp

Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.

gcp

Detects when an an application is removed from Google Workspace.

gcp

Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor

gcp

Detects when an API access service account is granted domain authority.

gcp

Detects when multi-factor authentication (MFA) is disabled.

gcp

Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.

gcp

Detects when an a role is modified or deleted in Google Workspace.

gcp

Detects when an a role privilege is deleted in Google Workspace.

gcp

Detects when an Google Workspace user is granted admin privileges.

gcp

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

windows · file_event

Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information

windows · process_creation

Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy

windows · process_creation

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

azure

Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

windows · process_creation

Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks

linux · process_creation

Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.

windows · process_creation

Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

windows

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

azure

Detects guest users being invited to tenant by non-approved inviters

azure

Detects attempts of decoding encoded Gzip archives via PowerShell.

windows · process_creation

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

windows · process_creation

Detects the use of Jlaive to execute assemblies in a copied PowerShell

windows · process_creation

Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged multiple times by threat actors in order to dump credentials.

windows · process_creation

Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.

windows · process_creation

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

windows · process_creation

Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

windows · process_creation

Detect the harvesting of wifi credentials using netsh.exe

windows · process_creation

Detects the launch of a child process via "conhost.exe" with the "--headless" flag. The "--headless" flag hides the windows from the user upon execution.

windows · process_creation

Detects a network connection initiated by the "hh.exe" process to HTTP destination ports, which could indicate the execution/download of remotely hosted .chm files.

windows · network_connection

Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash

windows · create_stream_hash

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

macos · process_creation

Detects events that appear when a user click on a link file with a powershell command in it

windows · process_creation

Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

macos · process_creation

Detects usage of attrib.exe to hide files from users.

windows · process_creation

Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

windows · process_creation

Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity.

zeek

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

proxy

Hides the file extension through modification of the registry

windows · registry_set

Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories

windows · process_creation

Detects suspicious IIS native-code module installations via command line

windows · process_creation

Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.

windows · process_creation

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

windows · process_creation

Detects powershell scripts that import modules from suspicious directories

windows · ps_script

Detects powershell scripts that import modules from suspicious directories

windows · process_creation

Detects the import of the specified file to the registry with regedit.exe.

windows · process_creation

Detects inbox rule creation or update via O365 Audit logs, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails. The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails. Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.

m365

Detects inbox rule creation or update via ExchangePowerShell cmdlet, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails. The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails. Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.

windows · ps_script

Detects deletion of local audit logs

macos · process_creation

Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

windows · process_creation

Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter. Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.

windows · process_creation

Detects execution of Microsoft bash launcher with the "-c" flag. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.

windows · process_creation

Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.

windows · process_creation

Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.

aws

Detects execution of "curl.exe" with the "insecure" flag over proxy or DOH.

windows · process_creation

Detects execution of "curl.exe" with the "--insecure" flag.

windows · process_creation

Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later.

windows · process_creation

TeamViewer_Desktop.exe is create during install

windows · file_event

Detects suspicious interactive bash as a parent to rather uncommon child processes

linux · process_creation

Detects interactive console logons to Server Systems

windows

Detects modification of autostart extensibility point (ASEP) in registry.

windows · registry_set

Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.

windows · registry_set

Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)

windows · process_creation

Detects the invocation of PowerShell commands with references to classes from the "System.Security.Cryptography" namespace. The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption. These can be used for example in decrypting malicious payload for defense evasion.

windows · process_creation

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows · process_creation

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows · ps_script

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows · ps_module

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows · ps_script

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows · ps_module

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows

Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.

windows

Detects the mount of an ISO image on an endpoint

windows

Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.

windows · file_event

Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent.

macos · process_creation

Detects a JAVA process running with remote debugging allowing more than just localhost to connect

windows · process_creation

Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers\" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.

windows · registry_set

This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert.

windows

Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting

zeek

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

kubernetes

Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.

kubernetes

Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.

kubernetes · application

Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests. Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.

kubernetes

Detects when a Kubernetes Rolebinding is created or modified.

kubernetes

Detects when Kubernetes Secrets are Modified or Deleted.

kubernetes

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

macos · process_creation

Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.

windows · process_creation

Detects suspicious process command line that uses base64 encoded input for execution with a shell

linux · process_creation

Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded

linux · process_creation

Detects the creation of doas.conf file in linux host platform.

linux · file_event

Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories. Adversaries often try to clear logs to cover their tracks after performing malicious activities.

linux · process_creation

Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell

linux · process_creation

Detects the creation of the LiveKD driver, which is used for live kernel debugging

windows · file_event

Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.

aws

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

windows · process_creation

Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.

windows · process_creation

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

windows · network_connection

Detects password change for the logged-on user's via "ksetup.exe"

windows · process_creation

Detect failed attempts to sign in to disabled accounts.

azure

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

m365

Detects when a user performs data exfiltration by using DataSvcUtil.exe

windows · process_creation

Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.

windows · process_creation

Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs

windows · process_creation

Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"

windows · process_creation

Detects DNS queries to domains within known low reputation eTLDs. This rule uses AlphaSOC's threat intelligence data and is updated on a monthly basis.

dns

Detects modification of LSA PPL protection settings via CommandLine. It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.

windows · process_creation

Detects potential mimikatz-like tools accessing LSASS from non system account

windows

Detects process access to LSASS memory with suspicious access flags and from a potentially suspicious folder

windows · process_access

Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.

macos · file_event

Detects execution of AppleScript of the macOS scripting language AppleScript.

macos · process_creation

Detects email forwarding or redirecting activity in O365 Audit logs.

m365

Detects email forwarding or redirecting activity via ExchangePowerShell Cmdlet

windows · ps_script

Detects loading of known malicious drivers via the file name of the drivers.

windows · driver_load

There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package.

windows · process_creation

Detects keywords from well-known PowerShell exploitation frameworks

windows · ps_script

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..

windows · ps_script

This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries. From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios. 1. Compressed file opened using 7zip. 2. Compressed file opened using WinRar. 3. Compressed file opened using native windows File Explorer capabilities. When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."

windows · process_creation

Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.

linux

Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

windows

Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

m365

Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

m365

Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.

m365

Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.

m365

Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location

windows · image_load

Detects changes to the registry keys related to "Trusted Location" of Microsoft Office. Attackers might add additional trusted locations to avoid macro security restrictions.

windows · registry_set

Detects suspicious connections from Microsoft Sync Center to non-private IPs.

windows · network_connection

Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.

windows · file_access

Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process

windows · image_load

Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.

windows · process_creation

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

zeek

Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.

zeek

Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.

windows · image_load

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

windows · process_creation

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

windows · ps_script

Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this.

linux

Detects suspicious modification of crontab file.

linux

BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.

windows · process_creation

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

linux · process_creation

Detects modifications to the msDS-ManagedAccountPrecededByLink attribute, which may indicate an attempted or successful abuse of the BaD-Successor msDS-DelegatedManagedServiceAccount (DMSA) vulnerability. The DMSA is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups. Changes to this attribute by suspicious accounts or outside of normal administrative workflows are a strong signal of an attempted or successful abuse. If it is indeed modified by an account that is not typically responsible for such changes, it could indicate an attempt to exploit the BaD-Successor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.

windows

Detects the Installation of a Exchange Transport Agent

windows · process_creation

Detects the Installation of a Exchange Transport Agent

windows

Detects MSI package installation from suspicious locations

windows

Detects installation of a remote msi file from web.

windows

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

windows · process_creation

Detects suspicious msiexec process starts with web addresses as parameter

windows · process_creation

Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".

windows

Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.

windows

Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.

windows · process_creation

Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.

azure

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

azure

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

azure

Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

windows · ps_classic_start

Adversaries may modify system firewalls in order to bypass controls limiting network usage

windows · process_creation

Detects NetSupport Manager service installation on the target system.

windows

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

windows · network_connection

Detects a network connection initiated by "Regsvr32.exe"

windows · network_connection

Detects a network connection initiated from a process located in the "C:\Users\Public" folder. Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone. Use this rule to hunt for potential suspicious or uncommon activity in your environement.

windows · network_connection

Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.

windows · network_connection

Detects network connections to BTunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · network_connection

Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · network_connection

Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · network_connection

Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · network_connection

Detects the attempt to install new skills for AI agents using the "npx skills" command. Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user. The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others). Analysts should review any installed skills to verify their legitimacy. Note: Tune this rule based on whether AI agent tooling is allowed in your environment. In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly. In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.

windows · process_creation

Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls. This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

aws

Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.

windows · registry_set

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe"

windows · registry_set

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe"

windows · registry_set

Monitor and alert on conditional access changes.

azure

Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.

windows · process_creation

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

windows · file_event

Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

windows · registry_event

DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

windows · registry_event

Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.

windows · process_creation

Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs. The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious. It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions, it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.

windows · process_creation

Detects the addition of a new Federated Domain.

m365

Detects the addition of a new Federated Domain.

m365

Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.

macos · process_creation

Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".

windows

Detects the addition of a new rule to the Windows firewall via netsh

windows · process_creation

Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP session via command line interface.

windows · process_creation

Detects creation of a new service (kernel driver) with the type "kernel"

windows · process_creation

Detects the addition of a new module to an IIS server.

windows

Detects the creation of new msDS-DelegatedManagedServiceAccount objects, which could indicate potential abuse of privilege escalation vulnerabilities in Windows Server 2025. The msDS-DelegatedManagedServiceAccount (DMSA) is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups. Attackers may exploit this feature to create unauthorized service accounts with elevated privileges, leading to privilege escalation within the Active Directory environment. It is highly suspicious if an msDS-DelegatedManagedServiceAccount object is created without proper authorization or in an unexpected context, such as by a non-administrative user or outside of normal administrative workflows. So, it's a good idea to look out for accounts that are not typically responsible for service account creation to detect potential abuse of this feature.

windows

Detects the addition of a new network route to a route table in AWS.

aws

Detects the execution of netsh with the "trace" flag in order to start a network capture

windows · process_creation

Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.

windows

Detects the creation of a macro file for Outlook.

windows · file_event

Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1

windows

Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines

windows

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

windows · process_creation

Detects the modification of the PortProxy registry key which is used for port forwarding.

windows · registry_event

Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

windows · process_creation

Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.

azure

Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

windows · process_creation

Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

windows · process_creation

Detects the addition of new root, CA or AuthRoot certificates to the Windows registry

windows · registry_set

Detects the "iexpress.exe" utility creating self-extracting packages. Attackers where seen leveraging "iexpress" to compile packages on the fly via ".sed" files. Investigate the command line options provided to "iexpress" and in case of a ".sed" file, check the contents and legitimacy of it.

windows · process_creation

Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using either the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".

windows · ps_script

Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".

windows · process_creation

Identifies the creation of local users via the net.exe command.

windows · process_creation

Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card.

windows · process_creation

Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud

windows · process_creation

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

linux · process_creation

Detects rename operations of files with non-DLL extensions to files with a DLL extension. This is often performed by malware in order to avoid initial detections based on extensions.

windows · file_rename

Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure. This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.

windows · dns_query

Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

windows · ps_classic_start

Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records

windows · process_creation

Detects potential abuse of ntdsutil to dump ntds.dit database

windows

Detects common NTLM brute force device names

windows

Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware.

windows

Number of VM creations or deployment activities occur in Azure via the azureactivity log.

azure

Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command

windows · process_creation

Detects usage of an encoded/obfuscated version of an IP address (hex, octal, etc.) via command line

windows · process_creation

Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.

windows · network_connection

Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule will require an initial baseline and tuning that is specific to your organization.

windows · network_connection

Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started

windows · registry_event

Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened. There are various legitimate add-ins that also use these keys and this filter list might not be exhaustive. Thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.

windows · registry_set

Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach. This rule can be enhanced by filtering out known and legitimate username used in your environnement.

okta

Detects access to Okta admin functions through proxy.

okta

Detects when an the Administrator role is assigned to an user or group.

okta

Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence

okta

Detects when a API token is created

okta

Detects when a API Token is revoked.

okta

Detects when an application is modified or deleted.

okta

Detects when an application Sign-on Policy is modified or deleted.

okta

Detects when a new identity provider is created for Okta.

okta

Detects when an attempt at deactivating or resetting MFA.

okta

Detects when an Network Zone is Deactivated or Deleted.

okta

Detects when an Policy Rule is Modified or Deleted.

okta

Detects when an security threat is detected in Okta.

okta

Detects Okta session impersonation grant event where a user is granted the ability to impersonate another user's session. This event type "user.session.impersonation.grant" signifies that someone has been given temporary access to act on behalf of another user account. Threat actors may abuse this functionality to escalate privileges, access sensitive resources, or perform unauthorized actions while appearing to be the impersonated user. Legitimate use cases are typically limited to Okta support scenarios or authorized administrative troubleshooting.

okta

Detects when unauthorized access to app occurs.

okta

Detects when an user account is locked out.

okta

Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key.

windows · registry_set

Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments

windows · file_event

Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities. This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool. Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.

windows · process_creation

Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.

windows

Detects potential suspicious applet or osascript executing "osacompile".

macos · process_creation

Detects a "winlogon.exe" process that initiate network communications with public IP addresses

windows · network_connection

Detects changes to the registry values related to outlook security settings

windows · registry_set

Detects PAExec service installation

windows

Detects the attack technique pass the hash which is used to move laterally inside the network

windows

Detects when the password policy is enumerated.

windows

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

windows

Detects a when net.exe is called with a password in the command line

windows · process_creation

Detect when a user has reset their password in Azure AD

azure

Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.

windows · process_creation

Detects value modification of registry key containing path to binary used as screensaver.

windows · registry_event

Detects path traversal exploitation attempts

webserver

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

macos · process_creation

Detect use of PDQ Deploy remote admin tool

windows · process_creation

Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups. Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".

windows · registry_set

Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.

windows · process_creation

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges

windows · process_creation

Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.

windows · process_creation

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

windows · registry_set

Detects when an attacker register a new SIP provider for persistence and defense evasion

windows · registry_set

Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions. Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.

linux · file_event

Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt

windows · process_creation

Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.

windows · process_creation

Detects execution of PktMon, a tool that captures network packets.

windows · process_creation

Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT

linux · process_creation

Detects port forwarding activity via SSH.exe

windows · process_creation

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

windows · process_creation

Detects DCShadow via create new SPN

windows

Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675). The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy.

zeek

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

linux

Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".

windows

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

windows · process_creation

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

windows · ps_module

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

windows · ps_script

Detects potential Active Directory enumeration via LDAP

windows

Detects read access to a domain user from a non-machine account

windows

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

windows · process_creation

Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities

windows · ps_script

Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities

windows · process_creation

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

windows · image_load

Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in order to bypass application whitelisting.

windows · process_creation

Detects potential APT FIN7 exploitation activity as reported by Google. In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.

windows · process_creation

Detects potential BlueMushroom DLL loading activity via regsvr32 from AppData Local

windows · process_creation

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

windows · process_creation

Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.

windows · process_creation

Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbitrary files via a configuration file. Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.

windows · process_creation

Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encryption Type (0x17) i.e, RC4-HMAC. This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords.

windows

Detects potential DLL sideloading of "AVKkid.dll"

windows · image_load

Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.

proxy

Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the execution of binaries that are named similarly to Sysinternals tools. Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.

windows · process_creation

Detects PowerShell creating a binary executable or a script file.

windows · file_event

Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file

windows · process_creation

Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.

windows · process_creation

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

windows · process_creation

Detects potential DLL sideloading of "CCleanerDU.dll"

windows · image_load

Detects potential DLL sideloading of "CCleanerReactivator.dll"

windows · image_load

Detects potential DLL sideloading of "chrome_frame_helper.dll"

windows · image_load

Detects COM object hijacking via TreatAs subkey

windows · registry_set

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

windows · process_creation

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

windows · ps_script

Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline

windows · process_creation

Detects potential commandline obfuscation using known escape characters

windows · process_creation

Detects potential CommandLine obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

windows · process_creation

Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.

windows · process_creation

Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.

windows · process_creation

Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.

windows · process_access

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

windows · registry_set

Detects a PowerShell process requesting access to "lsass.exe", which can be indicative of potential credential dumping attempts

windows · process_access

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

webserver

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

windows

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

windows

Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.

windows · process_creation

Detects potential exploitation attempt of CVE-2023-2283 an authentication bypass in libSSH. The exploitation method causes an error message stating that keys for curve25519 could not be generated. It is an error message that is a sign of an exploitation attempt. It is not a sign of a successful exploitation.

linux

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

windows

Detects indicators of potential exploitation of CVE-2023-27997 in Frotigate weblogs. To avoid false positives it is best to look for successive requests to the endpoints mentioned as well as weird values of the "enc" parameter

webserver

Detects the creation of a "Report.wer" file in an uncommon folder structure. This could be a sign of potential exploitation of CVE-2023-36874.

windows · file_event

Detects files seen being requested by RomCom while potentially exploiting CVE-2023-36884

proxy

Detects a specific file being created in the recent folder of Office. These files have been seen being dropped during potential exploitations of CVE-2023-36884

windows · file_event

Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing

webserver

Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled. As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.

paloalto · file_event

Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.

windows · image_load

Detects the execution of a PowerShell script with a call to the "Send-MailMessage" cmdlet along with the "-Attachments" flag. This could be a potential sign of data exfiltration via Email. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

windows · ps_script

Detects potential exfiltration attempt via audio file using PowerShell

windows · ps_script

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

windows · process_creation

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

windows · process_creation

Detects potential calls to NtOpenProcess directly from NTDLL.

windows · process_access

Detects usage of "find" binary in a suspicious manner to perform discovery

linux · process_creation

Detects usage of "find" binary in a suspicious manner to perform discovery

macos · process_creation

Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.

windows · process_creation

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

windows · process_creation

Detects potential DLL injection and execution using "Tracker.exe"

windows · process_creation

Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application's UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility.

windows · process_creation

Detects the execution of "Extexport.exe".A utility that is part of the Internet Explorer browser and is used to export and import various settings and data, particularly when switching between Internet Explorer and other web browsers like Firefox. It allows users to transfer bookmarks, browsing history, and other preferences from Internet Explorer to Firefox or vice versa. It can be abused as a tool to side load any DLL. If a folder is provided in the command line it'll load any DLL with one of the following names "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll". Arbitrary DLLs can also be loaded if a specific number of flags was provided.

windows · process_creation

Detects DLL sideloading of "dbgcore.dll"

windows · image_load

Detects potential DLL sideloading of "dbghelp.dll"

windows · image_load

Detects potential DLL sideloading of "DbgModel.dll"

windows · image_load

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

windows · image_load

Detects potential DLL sideloading of "MpSvc.dll".

windows · image_load

Detects potential DLL sideloading of "mscorsvc.dll".

windows · image_load

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

windows · image_load

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

windows · image_load

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

windows · process_creation

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

windows · image_load

Detects possible payload obfuscation via the commandline

windows · process_creation

Detects usage of the "type" command to download/upload data from WebDAV server

windows · process_creation

Detects wscript/cscript/mshta executions of scripts located in user directories

windows · process_creation

Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA

windows · registry_set

Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2. Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges. These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets. CVE-2025-5054: Information leak via core dumps from SUID binaries using apport. CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.

linux · process_creation

HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe

windows · process_creation

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>"

windows · process_creation

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

windows · image_load

Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.

proxy

Detects the creation of hidden file/folder with the "::$index_allocation" stream. Which can be used as a technique to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"

windows · file_event

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"

windows · process_creation

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

windows · process_creation

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

windows · file_event

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

macos · process_creation

Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory

windows · ps_script

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

windows · file_event

Detects the execution of a Word document via the WinWord Start Menu shortcut. This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.

windows · process_creation

Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command. This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.

windows · process_creation

Detects PowerShell scripts that contains reference to keystroke capturing functions

windows · ps_script

Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.

windows · process_creation

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

windows · image_load

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

linux · process_creation

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

linux · process_creation

Detects potential installation or installation attempts of known malicious appx packages

windows

Detects execution of LiveKD based on PE metadata or image name

windows · process_creation

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

windows · image_load

Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.

windows · process_creation

Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files. MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\Windows\\Microsoft\.NET\\Framework64\\v4\.0\.30319\\Temporary ASP\.NET Files\\root\\([a-z0-9]{5,12})\\([a-z0-9]{5,12})\\App_Web_[a-z0-9]{5,12}\.dll. Hunting Opportunity Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.

windows · process_creation

Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory. The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.

windows · process_creation

Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

windows · process_creation

Detects execution of "rundll32" with potential obfuscated ordinal calls

windows · process_creation

Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.

windows · ps_script

Detects the attack technique pass the hash which is used to move laterally inside the network

windows

Detects command line usage of "findstr" to search for the "passwords" keyword in a variety of different languages

windows · process_creation

Detects possible password spraying attempts using Dsacls

windows · process_creation

Detects potential C2 communication activity related to Peach Sandstorm APT

proxy

Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.

windows · registry_set

Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as a method of persistence The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason.

windows · file_event

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

windows · process_creation

Detects suspicious command line reg.exe tool adding key to RUN key in Registry

windows · process_creation

Detects potential persistence using Appx DebugPath

windows · registry_set

Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.

windows · registry_set

Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.

windows · registry_set

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

windows · registry_add

Detects potential registry persistence technique using the Event Viewer "Events.asp" technique

windows · registry_set

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

windows · registry_set

Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.

windows · process_creation

Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.

windows · process_creation

Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

windows · registry_set

Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections. Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content. This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.

windows · registry_set

Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence

windows · file_event

Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence

windows · ps_script

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

windows · registry_set

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time

windows · registry_set

Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.

windows · registry_set

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state

windows · process_creation

Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'

zeek

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads. Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files. In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

windows · process_creation

Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt). This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.

windows · process_creation

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

windows · process_creation

Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution

windows · registry_set

Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers. This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.

windows

Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"

windows · process_creation

Detects when a memory process image does not match the disk image, indicative of process hollowing.

windows · process_tampering

Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.

windows · process_creation

Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products. Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms. This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.

windows · process_creation

Detects the execution of WMIC in order to get a list of firewall and antivirus products

windows · process_creation

Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

windows · process_creation

Detects potential DLL sideloading of Python DLL files.

windows · image_load

Detects potential malicious and unauthorized usage of bcdedit.exe

windows · process_creation

Detect suspicious error on protocol RDP, potential CVE-2019-0708

windows

Detects potential RDP Session Hijacking activity on Windows systems

windows · process_creation

Detects nltest commands that can be used for information discovery

windows · process_creation

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

windows · process_creation

Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow