process_creation log source Sigma rules

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

windows

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

windows

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

windows

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

windows

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

windows

Detects DarkSide Ransomware and helpers

windows

Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process

windows

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

windows

Detects the use of the filename DumpStack.log to evade Microsoft Defender

windows

Detects Elise backdoor activity used by APT32

windows

Detects a specific export function name used by one of EquationGroup tools

windows

Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report

windows

Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641

windows

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

windows

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

windows

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

windows

Detects process execution patterns related to Griffon malware as reported by Kaspersky

windows

Detects the use of the Dinject PowerShell cradle based on the specific flags

windows

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

windows

Detects some Empire PowerShell UAC bypass methods

windows

F-Secure C3 produces DLLs with a default exported StartNodeRelay function.

windows

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

windows

Detects the execution of the PurpleSharp adversary simulation tool

windows

Detects the execution of the hacktool Rubeus via PE information of command line parameters

windows

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

windows

Detects the execution of SecurityXploded Tools

windows

Detects the use of SharpUp, a tool for local privilege escalation

windows

Detects process activity patterns as seen being used by Sliver C2 framework implants

windows

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

windows

Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks.

windows

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

windows

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

windows

Detects different process execution behaviors as described in various threat reports on Lazarus group activity

windows

Detects LockerGoga ransomware activity via specific command line.

windows

Detects suspicious execution from AsperaFaspex as seen used by Mint Sandstorm

windows

Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm

windows

Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

windows

Detects OilRig activity as reported by Nyotron in their March 2018 report

windows

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

windows

Detects a specific command used by the Conti ransomware group

windows

Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity

windows

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

windows

Detects potential Dridex acitvity via specific process patterns

windows

Detects potential Dtrack RAT activity via specific process patterns

windows

Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL

windows

Detects specific process characteristics of Maze ransomware word document droppers

windows

Detects potential QBot activity by looking for process executions used previously by QBot

windows

Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike

windows

Detects different hacktools used for relay attacks on Windows for privilege escalation

windows

Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM

windows

Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.

windows

Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.

windows

Detects the execution of whoami that has been renamed to a different name to avoid detection

windows

Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)

windows

Detects Rorschach ransomware execution activity

windows

Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322

windows

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

windows

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

windows

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

windows

Detects indicators of a UAC bypass method by mocking directories

windows

Detects commands used by Turla group as reported by ESET in May 2020

windows

Detects automated lateral movement by Turla group

windows

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

windows

Detects execution of specific named binaries which were used by UNC4841 to deploy their SEASPY backdoor

linux

Detects WannaCry ransomware activity

windows

Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities

windows

Detects specific process characteristics of Winnti Pipemon malware reported by ESET

windows

Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

windows

Detects a ZxShell start by the called and well-known function name

windows

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

windows

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

windows

Detection of unusual child processes by different system processes

windows

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

windows

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

windows

Detects javaw.exe in AppData folder as used by Adwind / JRAT

windows

Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

windows

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

windows

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective

linux

Detects usage of "IMEWDBLD.exe" to download arbitrary files

windows

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

linux

Detects suspicious activity associated with Atomic MacOS Stealer (Amos) campaigns, including execution of FileGrabber and curl-based POST requests used for data exfiltration. The rule identifies either the execution of FileGrabber targeting /tmp or the use of curl to POST sensitive user data (including files such as /tmp/out.zip) to remote servers, which are key indicators of Amos infostealer activity.

macos

Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the `nslookup` command.

windows

Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

windows

Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

windows

Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system.

linux

Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher (e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation, where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path, corrupting the page cache of SUID binaries for local privilege escalation. On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod) with 'modprobe' appearing in the command line.

linux

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

linux

Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.

macos

Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

windows

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

windows

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

windows

Detects encoded base64 MZ header in the commandline

windows

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

macos

Attempts to detect system changes made by Blue Mockingbird

windows

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

windows

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

windows

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

windows

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

windows

Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.

windows

Detects the use of the "capsh" utility to invoke a shell.

linux

Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

windows

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

windows

Detects execution of ChromeLoader malware via a registered scheduled task

windows

Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).

windows

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

windows

Detects various indicators of Microsoft Connection Manager Profile Installer execution

windows

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

windows

Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

windows

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

windows

Detects the use of argument injection in the Commvault qlogin command - potential exploitation for CVE-2025-57791. An attacker can inject the `-localadmin` parameter via the password field to bypass authentication and gain a privileged token.

windows

Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. This is a post-authentication step corresponding to CVE-2025-57790.

windows

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

windows

Detects a command used by conti to exfiltrate NTDS

windows

Detects a command used by conti to find volume shadow backups

windows

Detects the malicious use of a control panel item

windows

Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share

windows

Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)

windows

Detects when the file "passwd" or "shadow" is copied from tmp path

linux

Files with well-known filenames (sensitive files with credential data) copying

windows

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

windows

Detecting attempts to extract passwords with grep and laZagne

macos

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

windows

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

windows

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

windows

Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.

windows

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

linux

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

windows

Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.

windows

Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

windows

Detects creation of local users via the net.exe command with the name of "DarkGate"

windows

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

windows

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

windows

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

windows

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

windows

Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device. This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.

windows

The Devtoolslauncher.exe executes other binary

windows

Detects process creation activity indicators related to Diamond Sleet APT

windows

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

windows

Detects attackers attempting to disable Windows Defender using Powershell

windows

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

windows

Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features

windows

Detects commands that temporarily turn off Volume Snapshots

windows

Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.

windows

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

windows

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

windows

Well-known DNS Exfiltration tools execution

windows

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

windows

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

windows

Detects email exfiltration via powershell cmdlets

windows

Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022. The ".lnk" file was delivered via phishing campaign.

windows

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

windows

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

linux

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

windows

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

windows

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

windows

Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability

windows

Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no longer exists on disk at the time of logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.

windows

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

windows

Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe

windows

Detects using WorkFolders.exe to execute an arbitrary control.exe

windows

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.

windows

Detects the execution of the commonly used ZeroLogon PoC executable.

windows

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

windows

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

windows

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

windows

Detects the export of a crital Registry key to a file.

windows

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

windows

Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

windows

Detects execution of the IEExec utility to download and execute files

windows

Detects when a user downloads a file from an IP based URL using CertOC.exe

windows

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

windows

Detects usage of bitsadmin downloading a file to a suspicious target folder

windows

Detects the use of Windows Defender MpCmdRun.EXE to download files

windows

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

windows

Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

windows

Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.

windows

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

windows

Detects usage of bitsadmin downloading a file with a suspicious extension

windows

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

windows

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

windows

Detects Archer malware invocation via rundll32

windows

Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.

windows

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.

windows

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

windows

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

windows

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

windows

Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations. This tool is used by the Play ransomware group for network enumeration, data gathering, and event log clearing.

windows

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

windows

Detects command line parameters used by Bloodhound and Sharphound hack tools

windows

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

windows

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

windows

Detects the use of CoercedPotato, a tool for privilege escalation

windows

Detects suspicious command lines used in Covenant luanchers

windows

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

windows

Detects various execution patterns of the CrackMapExec pentesting framework

windows

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

windows

Detects suspicious process patterns found in logs when CrackMapExec is used

windows

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

windows

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

windows

Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods

windows

Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.

windows

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

windows

Detects suspicious powershell command line parameters used in Empire

windows

Detects the execution GMER tool based on image and hash fields.

windows

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

windows

Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

windows

Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.

windows

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

windows

Detects command line parameters used by Hydra password guessing hack tool

windows

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

windows

Detects command line parameters used by Koadic hack tool

windows

Detects the use of KrbRelay, a Kerberos relaying tool

windows

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

windows

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

windows

Detection well-known mimikatz command line arguments

windows

Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.

windows

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

windows

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

windows

Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files

windows

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

windows

Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

windows

Detects usage of the Quarks PwDump tool via commandline arguments

windows

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

windows

Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.

windows

Detects usage of the Sharp Chisel via the commandline arguments

windows

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

windows

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

windows

Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

windows

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

windows

Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

windows

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

windows

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

windows

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

windows

Detects SILENTTRINITY stager use via PE metadata

windows

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

windows

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

windows

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

windows

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

windows

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

windows

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

windows

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

windows

Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.

windows

Detects suspicious use of XORDump process memory dumping utility

windows

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

windows

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

windows

Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity

linux

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments. Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.

windows

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

windows

Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe. HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode. Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.

windows

Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID

windows

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

windows

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

windows

Detects the import of a alternate datastream to the registry with regedit.exe.

windows

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

windows

Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.

linux

Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.

windows

Detects an interactive AT job, which may be used as a form of privilege escalation.

windows

Detects Obfuscated use of Clip.exe to execute PowerShell

windows

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

windows

Detects Obfuscated use of stdin to execute PowerShell

windows

Detects Obfuscated use of Environment Variables to execute PowerShell

windows

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows

Detects Obfuscated Powershell via Stdin in Scripts

windows

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows

Detects Obfuscated Powershell via use MSHTA in Scripts

windows

Detects possible malicious execution of JXA in-memory via OSAScript

macos

Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.

windows

Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.

windows

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

windows

Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.

linux

Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.

windows

Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory

windows

Detects specific command line execution used by Lace Tempest to download Cobalt Strike as reported by SysAid Team

windows

Detects execution of a specific binary based on filename and hash used by Lace Tempest to load additional malware as reported by SysAid Team

windows

Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location

windows

Detects command line parameters or strings often used by crypto miners

linux

Detects known hacktool execution based on image name.

linux

Detects events with patterns found in commands used for reconnaissance on linux systems

linux

Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell). This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands. When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>). For other methods, the Image field will show the spawned process directly.

linux

Detects suspicious sub processes of web server processes

linux

Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8). In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.

linux

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

windows

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

windows

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

windows

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

windows

Detects base64 encoded strings used in hidden malicious PowerShell command lines

windows

Detects Commandlet names from well-known PowerShell exploitation frameworks

windows

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

windows

Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted. This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.

linux

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

windows

Detects suspicious command line patterns seen being used by MERCURY APT

windows

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

windows

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

windows

Detects Log4J Wstomcat process execution as seen in Mint Sandstorm activity

windows

Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.

windows

Detects a Windows command line executable started from MMC

windows

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

windows

Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

windows

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab).

windows

Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.

windows

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)

windows

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

windows

Detects specific process parameters as used by Mustang Panda droppers

windows

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

windows

Detects a set of suspicious network related commands often used in recon stages

windows

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

windows

Detects creation of local users via the net.exe command with the option "never expire"

windows

Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.

windows

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

windows

Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe

windows

Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an attacker-controlled server, enabling offline cracking or relay attacks. When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials stored in LSASS — without requiring a plaintext password. This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.

windows

Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.

windows

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

windows

Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.

windows

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

linux

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

linux

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.

windows

The OpenWith.exe executes other binary

windows

Detects activity mentioned in Operation Wocao report

windows

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

windows

Detects Cobalt Strike module/commands accidentally entered in CMD shell

windows

Detects potential suspicious run-only executions compiled using OSACompile

macos

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

windows

Detects exploitation indicators related to PaperCut MF/NG Exploitation

windows

Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut

windows

Detects process creation activity related to Peach Sandstorm APT

windows

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

windows

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

windows

Detects a ping command that uses a hex encoded IP address

windows

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

windows

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

windows

Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

windows

Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

windows

Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning

windows

Detects specific command line execution used by FIN7 as reported by WithSecureLabs for reconnaissance and POWERTRASH execution

windows

Detects specific command line execution used by Mustang Panda in a targeted attack against the Australian government as reported by Lab52

windows

Detects potential process and execution activity related to APT10 Cloud Hopper operation

windows

Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc

windows

Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability

windows

Detects potential arbitrary file download using a Microsoft Office application

windows

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

windows

Detects activity that could be related to Baby Shark malware

windows

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

macos

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

windows

Detects command line patterns used by BlackByte ransomware in different operations

windows

Detects potential process patterns related to Cobalt Strike beacon activity

windows

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

windows

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

windows

Detects execution of known compromised version of 3CXDesktopApp

windows

Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software

windows

Detects a command used by conti to dump database

windows

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

windows

Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass

windows

Detects command line parameters or strings often used by crypto miners

windows

Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's Unified Messaging service

windows

Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations

windows

Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable versions of Log4j.

windows

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

windows

Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. 7-Zip version 21.07 and earlier on Windows allows privilege escalation (CVE-2022-29072) and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process.

windows

Detects potential exploitation of CVE-2023-21554 (dubbed QueueJumper)

windows

Detects the execution of a renamed "cmd", "powershell" or "powershell_ise" binary. Attackers were seen using these binaries in a renamed form as "wermgr.exe" in exploitation of CVE-2023-36874

windows

Detects potential exploitation of CVE-2026-33829, a vulnerability in the Windows Snipping Tool URI handler (ms-screensketch:). An attacker can abuse the 'filePath' parameter to supply a UNC path or HTTP URL, causing SnippingTool.exe to initiate a connection to a remote resource. When a UNC path is used (e.g. \\attacker.com\share), this triggers an outbound NTLM authentication attempt, allowing the attacker to capture or relay the victim's Net-NTLMv2 hash. HTTP-based paths may result in remote file loading or server-side request forgery (SSRF)-style access. The URI can be delivered via a malicious hyperlink, phishing email, or web page.

windows

Detects the use of various CLI utilities exfiltrating data via web requests

windows

Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

windows

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

windows

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.

windows

Detects specific process behavior observed with Devil Bait samples

windows

Detects all Emotet like process executions that are not covered by the more generic rules

windows

Detects potential EmpireMonkey APT activity

windows

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

windows

Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)

windows

Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)

windows

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

windows

Detects potentially suspicious child process of SSH process (sshd) with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.

linux

Detects execution of the "net.exe" command in order to add a group named "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

windows

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

windows

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 which involves unauthorized code execution via WebDAV through external control of file names or paths. The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating their working directories to point to attacker-controlled WebDAV servers, causing them to execute malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries through Process.Start() search order manipulation.

windows

Detects the use of SDelete to erase a file not the free space

windows

Detects the use of grep to discover specific files created by the GobRAT malware

linux

Detects a specific broken command that was used by Goofy-Guineapig as described by the NCSC report.

windows

Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location as seen used by the Goofy Guineapig backdoor

windows

Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020

windows

Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process

windows

Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers. LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory. Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.

windows

Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution

windows

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

windows

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

windows

Detects the execution of msiexec.exe from an uncommon directory

windows

Detects RDP session hijacking by using MSTSC shadowing

windows

Detects potential Muddywater APT activity

windows

Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.

linux

Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.

windows

Detects possible NTLM coercion via certutil using the 'syncwithWU' flag

windows

Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity

linux

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

windows

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

macos

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

windows

Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets. Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.

linux

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

windows

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

windows

Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location

windows

Detects the PowerShell command lines with special characters

windows

Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine

windows

Detects potential PowerShell execution from a DLL instead of the usual PowerShell process as seen used in PowerShdll. This detection assumes that PowerShell commands are passed via the CommandLine.

windows

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

windows

Detects suspicious encoded character syntax often used for defense evasion

windows

Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.

windows

Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges

windows

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

windows

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

windows

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

windows

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

windows

Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility

windows

Detects specific process tree behavior of a "rundll32" execution often linked with potential Qakbot activity.

windows

Detects the execution of a ".CPL" file located in the user temp directory via the Shell32 DLL "Control_RunDLL" export function. This behavior was observed in multiple Raspberry-Robin variants.

windows

Detects commandline containing reference to files ending with a "." This scheme has been seen used by raspberry-robin

windows

Execution of plink to perform data exfiltration and tunneling

windows

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

windows

Detect usage of the "driverquery" utility to perform reconnaissance on installed drivers

windows

Detects usage of cmdkey to look for cached credentials on the system

windows

Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.

windows

Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection

windows

Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).

windows

Detects Ryuk ransomware activity

windows

Detects potential exploitation of CVE-2025-53770 by identifying indicators such as suspicious command lines discovered in Post-Exploitation activities. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

windows

Detects when a user enable developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

windows

Detects a specific binary name seen used by SNAKE malware during its installation as described by CISA in their report

windows

Detects a specific command line arguments sequence seen used by SNAKE malware during its installation as described by CISA in their report

windows

Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" as a service. This could be indicative of potential SNAKE malware activity as reported by CISA.

windows

Detects specific process characteristics of Snatch ransomware word document droppers

windows

Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.

windows

Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

windows

Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name

windows

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

windows

Detects uninstallation or termination of security products using the WMIC utility

windows

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

windows

Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.

windows

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

windows

Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.

macos

Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.

windows

Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script

windows

Detects potentially suspicious child processes of "regsvr32.exe".

windows

Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components.

windows

Detects execution of "odbcconf" with the "REGSVR" action where the DLL in question doesn't contain a ".dll" extension. Which is often used as a method to evade defenses.

windows

Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt

windows

Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.

windows

Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe

windows

Detects potentially suspicious child processes of "GoogleUpdate.exe"

windows

Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts

windows

Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

windows

Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.

windows

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

windows

Detects usage of a base64 encoded "IEX" cmdlet in a process command line

windows

Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls

windows

Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV

windows

Detects base64 encoded .NET reflective loading of Assembly

windows

Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.

windows

Detects requests to disable Microsoft Defender features using PowerShell commands

windows

Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9'). This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level. An attacker might use this technique via the command line to bypass defenses before executing payloads.

windows

Detects PowerShell download and execution cradles.

windows

Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.

windows

Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity

windows

Detects suspicious PowerShell scripts accessing SAM hives

windows

Detects PowerShell execution to set the ACL of a file or a folder

windows

Detects PowerShell scripts to set the ACL to a file in the Windows folder

windows

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

windows

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

windows

Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.

windows

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

windows

Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

windows

Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory

windows

Detects a potentially suspicious execution from an uncommon folder.

windows

Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.

linux

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

windows

Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory

windows

Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.

windows

Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report

windows

Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)

windows

Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights

windows

Detects the use of 3proxy, a tiny free proxy server

windows

Detects AdFind execution with common flags seen used during attacks

windows

Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

windows

Detects usage of the Chisel tunneling tool via the commandline arguments

windows

Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.

windows

Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.

windows

Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative

windows

Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.

windows

Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.

windows

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

windows

Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel. Potentially allowing for privilege escalation, persistence, or evasion of security controls.

windows

Detects execution of MemProcFS a memory forensics tool with the '-device' parameter. MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures. Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials. MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.

windows

Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

windows

Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.

windows

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

windows

Detects the use of NirCmd tool for command execution as SYSTEM user

windows

Detects the use of NPS, a port forwarding and intranet penetration proxy server

windows

Detects the use of NSudo tool for command execution

windows

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.

windows

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

windows

Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity.

windows

Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts

windows

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

windows

Detects active directory enumeration activity using known AdFind CLI flags

windows

Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)

windows

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

windows

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

windows

Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

windows

Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

linux

Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell.

linux

Detects python spawning a pretty tty

windows

Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot

windows

Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet

windows

Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.

windows

Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.

windows

Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".

windows

Detects raspberry robin subsequent execution of commands.

windows

Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware

windows

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

windows

Detects two stages of the RedSun post-exploitation process chain that deliver a SYSTEM-level shell to the attacker's interactive session. Observed process chain services.exe → TieringEngineService.exe → conhost.exe (SYSTEM, CommandLine: bare path, no arguments) → cmd.exe / shell (SYSTEM, TerminalSessionId = attacker's session) Stage 1 — TieringEngineService.exe spawns argument-less conhost.exe: After winning the oplock + Cloud Files mount point race, the malicious TieringEngineService.exe (RedSun.exe copied to System32, started via CoCreateInstance / services.exe) detects it is NT AUTHORITY\SYSTEM and calls LaunchConsoleInSessionId(). This opens \\.\pipe\REDSUN, reads the attacker's session ID, duplicates the SYSTEM token, re-stamps it with that session ID via SetTokenInformation(TokenSessionId), then calls CreateProcessAsUser to spawn conhost.exe with no arguments. Stage 2 — Shell spawned from rogue conhost.exe (EDR sources with GrandParentImage): The rogue SYSTEM conhost.exe spawns a shell (cmd.exe, PowerShell, etc.) as SYSTEM in the attacker's interactive session. On EDR sources that expose GrandParentImage, the full three-level chain (TieringEngineService.exe → conhost.exe → shell) can be matched directly. The legitimate TieringEngineService.exe is a headless COM server that is unlikely to spawn conhost.exe under normal conditions.

windows

Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys

windows

Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe

windows

Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry.

windows

Detects the execution of REGSVR32.exe with DLL files masquerading as other files

windows

Detects execution of regsvr32 where the DLL is located in a highly suspicious locations

windows

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

windows

Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.

windows

Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.

macos

Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.

windows

Detects potential web shell execution from the ScreenConnect server process.

windows

Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

windows

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

windows

Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking.

windows

Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file

windows

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

windows

Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.

windows

Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)

windows

Detects the execution of a renamed "cloudflared" binary.

windows

Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory

windows

Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.

windows

Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group

windows

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

windows

Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti.

windows

Detects the execution of a renamed "Msdt.exe" binary

windows

Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings

windows

Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.

windows

Detects the execution of a renamed office binary

windows

Detects execution of renamed version of PAExec. Often used by attackers

windows

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

windows

Detects the execution of a renamed version of the Plink binary

windows

Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defensive mechanisms.

windows

Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators

windows

Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks. One of the very common persistence techniques is schedule malicious tasks using schtasks.exe. Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.

windows

Detects suspicious renamed SysInternals DebugView execution

windows

Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)

windows

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

windows

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

windows

Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

windows

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

windows

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

windows

Detects PowerShell script execution from Alternate Data Stream (ADS)

windows

Detects PowerShell script execution via input stream redirect

windows

Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity

windows

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

windows

load malicious registered COM objects

windows

Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way

windows

Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.exe binary to execute remote DLLs from a UNC pathh.

windows

Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands.

windows

Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products

windows

Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.

windows

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

windows

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

windows

Detects scheduled task creations that have suspicious action command and folder combinations

windows

Detects a suspicious child process of Script Event Consumer (scrcons.exe).

windows

Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.

windows

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

linux

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

windows

Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)

windows

Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.

windows

Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

windows

Detects execution of "reg.exe" to disable security services such as Windows Defender.

windows

Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations. This behavior has been observed in-the-wild by different threat actors.

windows

Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)

windows

Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.

windows

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

windows

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

windows

Detects post exploitation execution technique of the Serpent backdoor. According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method. It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.

windows

Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.

windows

Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services

windows

Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs

windows

Shadow Copies deletion using operating systems utilities

windows

Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.

windows

Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.

linux

Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.

windows

Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.

linux

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

linux

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

windows

Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.

linux

Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux

Detects execution of shells from a parent process located in a temporary (/tmp) directory

linux

Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.

linux

Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux

Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux

Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux

Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux

Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

linux

Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux

Detects shell32.dll executing a DLL in a suspicious directory

windows

Detects actions that clear the local ShimCache and remove forensic evidence

windows

Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

windows

Detects Trojan loader activity as used by APT28

windows

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

windows

Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.

windows

Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.

windows

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

linux

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

windows

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

windows

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.

windows

Detects execution of "rundll32" calling "advpack.dll" with potential obfuscated ordinal calls in order to leverage the "RegisterOCX" function

windows

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

windows

Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding service endpoint and remotely execute code from the ArcSOC.exe process.

windows

Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.

windows

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

windows

Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes. Suspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking.

windows

Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.

windows

Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download additional payloads or configuration files. Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes.

windows

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

windows

Detects potentially suspicious child processes of "aspnet_compiler.exe".

windows

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

windows

Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service

windows

Detects suspicious child process creation by the Notepad++ updater process (gup.exe). This could indicate potential exploitation of the updater component to deliver unwanted malware.

windows

Detects suspicious child processes spawned by SolarWinds WebHelpDesk (WHD) application, which may indicate exploitation activity leveraging RCE vulnerabilities such as CVE-2025-40551, CVE-2025-40536, or CVE-2025-26399

windows

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

windows

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

windows

Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension

windows

Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.

windows

Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

windows

Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits

windows

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

windows

Detects the execution of CustomShellHost.exe where the child isn't located in 'C:\Windows\explorer.exe'. CustomShellHost is a known LOLBin that can be abused by attackers for defense evasion techniques.

windows

Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).

windows

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

windows

Detects when a user installs certificates by using CertOC.exe to load the target DLL file.

windows

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns

windows

Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.

linux

Detects usage of bitsadmin downloading a file using an URL that contains an IP

windows

Detects usage of bitsadmin downloading a file from a suspicious domain

windows

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

windows

Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method.

windows

Detects suspicious ways to use the "DumpMinitool.exe" binary

windows

Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"

windows

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

windows

Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses.

windows

Detects a suspicious program execution in Outlook temp folder

windows

Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.

windows

Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection. ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar. The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.

windows

Detects potentially suspicious file download from file sharing domains using curl.exe

windows

Detects potentially suspicious file downloads from file sharing domains using wget.exe

windows

Detects potentially suspicious file downloads directly from IP addresses using curl.exe

windows

Detects potentially suspicious file downloads directly from IP addresses using Wget.exe

windows

Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe

windows

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

windows

Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

windows

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious

windows

Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files

windows

Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation. This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms, which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content. The clipboard content usually contains commands that download and execute malware, such as information stealing tools.

windows

Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

windows

Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors

windows

Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

windows

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

windows

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

windows

Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors

windows

Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

linux

Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

linux

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

windows

Detects java process spawning suspicious children

linux

Detects execution of javascript code using "mshta.exe".

windows

Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class. Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse techniques like silver ticket attacks.

windows

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

windows

Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)

windows

Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks.

windows

Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc

windows

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

windows

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

macos

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

windows

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

windows

Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation

windows

Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution

windows

Detects suspicious mshta process execution patterns

windows

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

windows

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

windows

Detects execution of binaries located in potentially suspicious locations via "nohup"

linux

Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service

windows

Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines

windows

Detects a suspicious process spawning from an Outlook process.

windows

Detect execution of suspicious double extension files in ParentCommandLine

windows

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

windows

Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example

windows

Detects suspicious Plink tunnel port forwarding to a local port

windows

Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)

windows

Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains

windows

Detects suspicious ways to run Invoke-Execution using IEX alias

windows

Detects suspicious PowerShell invocation with a parameter substring

windows

Detects a suspicious or uncommon parent processes of PowerShell

windows

Detects new commands that add new printer port which point to suspicious file

windows

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

windows

Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.

windows

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

windows

Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.

windows

Detects suspicious parent processes that should not have any children or should only have a single possible child program

windows

Detects suspicious process patterns used in NTDS.DIT exfiltration

windows

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

windows

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

windows

Detects suspicious processes including shells spawnd from WinRM host process

windows

Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall

windows

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

windows

Detects suspicious child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

windows

Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

windows

Detects a suspicious RDP session redirect using tscon.exe

windows

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

windows

Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers

windows

Detects suspicious addition to BitLocker related registry keys via the reg.exe utility

windows

Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.

windows

Detects REGSVR32.exe to execute DLL hosted on remote shares

windows

Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

windows

Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.

windows

Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452

windows

Detects the execution of Rundll32.exe with DLL files masquerading as image files

windows

Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452

windows

Detects the creation of scheduled tasks that involves a temporary folder and runs only once

windows

Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local

windows

Detects scheduled task creations or modification on a suspicious schedule type

windows

Detects a suspicious process pattern which could be a sign of an exploited Serv-U service

windows

Detects a service binary running in a suspicious directory

windows

Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable

windows

Detects service path modification via the "sc" binary to a suspicious command or path

windows

Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.

windows

Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

windows

Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking.

windows

Detects suspicious Splwow64.exe process without any command line parameters

windows

Detects suspicious print spool service (spoolsv.exe) child processes.

windows

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

windows

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

windows

Detects a tscon.exe start as LOCAL SYSTEM

windows

Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)

windows

Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.

windows

Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack

windows

Detects the execution of CSharp interactive console by PowerShell

windows

Detects suspicious inline VBScript keywords as used by UNC2452

windows

Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.

windows

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397

windows

Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection

windows

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

windows

Detects the execution of "logman" utility in order to disable or delete Windows trace sessions

windows

Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags

windows

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

windows

Detects suspicious and uncommon child processes of WmiPrvSE

windows

Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses

windows

Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks

linux

Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).

windows

Detects possible Sysmon filter driver unloaded via fltmc.exe

windows

Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.

windows

Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer.

windows

Detects specific process characteristics of Chinese TAIDOOR RAT malware load

windows

Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet

windows

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.

linux

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath reported on early May 2026.

windows

Detects one of the possible scenarios for disabling Symantec Endpoint Protection. Symantec Endpoint Protection antivirus software services incorrectly implement the protected service mechanism. As a result, the NT AUTHORITY/SYSTEM user can execute the taskkill /im command several times ccSvcHst.exe /f, thereby killing the process belonging to the service, and thus shutting down the service.

windows

Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM

windows

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

windows

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

windows

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

windows

Detects the use of Tor or Tor-Browser to connect to onion routing networks

windows

Detects Trickbot malware process tree pattern in which "rundll32.exe" is a parent of "wermgr.exe"

windows

Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges

linux

Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script

linux

Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia

windows

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

windows

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

windows

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

windows

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

windows

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

windows

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

windows

Detects the pattern of UAC Bypass using Event Viewer RecentViews

windows

Detects the "IDiagnosticProfileUAC" UAC bypass technique

windows

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

windows

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

windows

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

windows

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

windows

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

windows

Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface

windows

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

windows

Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section

windows

Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries

windows

Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

linux

Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

linux

Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.

linux

Detects uncommon child process of Setres.EXE. Setres.EXE is a Windows server only process and tool that can be used to set the screen resolution. It can potentially be abused in order to launch any arbitrary file with a name containing the word "choice" from the current execution path.

windows

Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.

windows

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

windows

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.

windows

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

windows

Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon

windows

Detects the removal of Sysmon, which could be a potential attempt at defense evasion

windows

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

windows

Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.

windows

When configured with suitable command line arguments, w32tm can act as a delay mechanism

windows

Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".

windows

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

windows

Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts. Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.

windows

Detects using SettingSyncHost.exe to run hijacked binary

windows

Detects dump of credentials in VeeamBackup dbo

windows

Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux

Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.

windows

Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

windows

Shadow Copies storage symbolic link creation using operating systems utilities

windows

Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE. The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers. Disabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response

windows

Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity

windows

Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity

windows

Detects certain command line parameters often used during reconnaissance activity via web shells

windows

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

windows

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands

windows

Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)

windows

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

windows

Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe or PowerShell. AMSI provides a generic interface for applications and services to integrate with antimalware products. Adversaries may disable AMSI to evade detection of malicious scripts and code execution.

windows

Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. The rule matches suspicious command lines that target DeviceGuard or LSA registry paths and manipulate keys like EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, or LsaCfgFlags. Such activity may indicate an attempt to disable or tamper with Credential Guard, potentially exposing sensitive credentials for misuse.

windows

Detects the use of reg.exe or PowerShell to delete the Windows Defender context menu handler registry keys. This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives. Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.

windows

Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files

windows

Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender. SystemSettingsAdminFlows.exe is a legitimate Windows component used for administrative configuration tasks. However, attackers may abuse it to disable Windows Defender as part of their attack chain, especially in the context of ransomware or other malware campaigns.

windows

Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing session records events that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.

windows

Detects when an internet hosted webdav share is mounted using the "net.exe" utility

windows

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

windows

Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell). Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync(). If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked. For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.

windows

Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.

windows

Detects the use of Kali Linux through Windows Subsystem for Linux

windows

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.

windows

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

windows

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

windows

Attackers can use print.exe for remote file copy

windows

Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.

linux

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

windows

Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.

windows

Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.

windows

Detects usage of winget to add new additional download sources

windows

Detects usage of winget to add new potentially suspicious download sources

windows

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

windows

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.

windows

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

windows

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

windows

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

windows

Detects the removal or uninstallation of an application via "Wmic.EXE".

windows

Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may use wmic to terminate security products or other applications on the compromised host. This event is triggered on on attempt and process creation can be either successful or unsuccessful.

windows

Detects execution of the Notepad++ updater (gup) to launch other commands or executables

windows

Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.

windows

Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.

windows

Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.

windows

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

windows

Detects usage of "msedge_proxy.exe" to download arbitrary files

windows

Detects usage of "MSOHTMED" to download arbitrary files

windows

Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

windows

Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

windows

Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

windows

Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system

windows

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

windows

Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.

windows

Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

windows

Detects audio capture via PowerShell Cmdlet.

windows

Detect attacker collecting audio via SoundRecorder application.

windows

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

windows

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

windows

Detects commandline arguments for executing a child process via dotnet-trace.exe

windows

Detects the usage of the unsafe bpftrace option

linux

Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks

windows

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

windows

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract cab using the "/extract" argument that is no longer supported.

windows

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

windows

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

windows

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

windows

Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.

windows

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

windows

Detects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.

linux

Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

windows

Detects child processes of "dfsvc" which indicates a ClickOnce deployment execution.

windows

Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts

macos

Detects execution of the "pbpaste" utility, which retrieves the contents of the clipboard (a.k.a. pasteboard) and writes them to the standard output (stdout). The utility is often used for creating new files with the clipboard content or for piping clipboard contents to other commands. It can also be used in shell scripts that may require clipboard content as input. Attackers can abuse this utility in order to collect data from the user clipboard, which may contain passwords or sensitive information. Use this rule to hunt for potential abuse of the utility by looking at the parent process and any potentially suspicious command line content.

macos

Detects the execution of the "cloudflared" binary from a non standard location.

windows

Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB. The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com. The tool has been observed in use by threat groups including Akira ransomware.

windows

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

windows

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

windows

Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories. This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.

windows

Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.

windows

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.

windows

Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry.

windows

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

windows

Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.

windows

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

windows

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

windows

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

windows

Detects password change for the computer's domain account or host principal via "ksetup.exe"

windows

Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.

windows

Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.

windows

Detects use of chcp to look up the system locale value as part of host discovery

windows

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

windows

Detects a copy command or a copy utility execution to or from an Admin share or remote

windows

Detects passwords dumps from Keychain

macos

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

windows

Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings

windows

Detects execution of curl.exe with custom useragent options

windows

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

windows

Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.

windows

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

windows

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

windows

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

windows

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

windows

Detects the execution of DeviceCredentialDeployment to hide a process from view.

windows

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

windows

Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems. Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.

linux

Detects disabling security tools

macos

Detects disabling security tools

linux

Detects the execution of the hdiutil utility in order to create a disk image.

macos

Detects the execution of the hdiutil utility in order to mount disk images.

macos

Detects any child process spawning from "Diskshadow.exe". This could be due to executing Diskshadow in interpreter mode or script mode and using the "exec" flag to launch other applications.

windows

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

windows

Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.

windows

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that deleted the shadow copies on the systems. Investigate the content of the scripts and its location.

windows

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

windows

Detects calls of DLLs exports by ordinal numbers via rundll32.dll.

windows

Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.

windows

Detects using register-cimprovider.exe to execute arbitrary dll file.

windows

Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.

windows

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

windows

Detects execution of "dsquery.exe" for domain trust discovery

windows

Detects the use of wget to download content to a suspicious directory

linux

Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.

windows

Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers

windows

Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

windows

Detects process dump via legitimate sqldumper.exe binary

windows

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

windows

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

windows

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

windows

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.

windows

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

windows

Detects common command used to enable bpf kprobes tracing

linux

Detects the execution of "whoami.exe" with the "/all" flag

windows

Detects processes that query known 3rd party registry keys that holds credentials via commandline

windows

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services

windows

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

windows

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

windows

Detects user account creation on ESXi system via esxcli

linux

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

linux

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

linux

Detects changes to the ESXi syslog configuration via "esxcli"

linux

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

linux

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

linux

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

linux

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

linux

Detect attempts to query the contents of the event log using command line utilities. Attackers use this technique in order to look for sensitive information in the logs such as passwords, usernames, IPs, etc.

windows

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

windows

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

windows

Detects file execution using the msdeploy.exe lolbin

windows

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

windows

Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors

windows

Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc.

linux

Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process. This rule might require some initial baselining to align with some third party tooling in the user environment.

windows

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

windows

Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"

windows

Detects usage of Gpg4win to decrypt files

windows

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

windows

Detects file downloads directly from IP address URL using curl.exe

windows

Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)

windows

Detects usage of bitsadmin downloading a file

windows

Detects when a user downloads a file by using CertOC.exe

windows

Detects file download using curl.exe

windows

Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\"

windows

Detects the execution of the nscurl utility in order to download files.

macos

Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration

windows

Detects usage of Gpg4win to encrypt files

windows

Detects a file or folder's permissions being modified or tampered with.

windows

Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.

windows

Detect file time attribute change to hide new or changes to existing files

macos

Detect filter driver unloading activity via fltmc.exe

windows

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

windows

Detects netsh commands that turns off the Windows firewall

windows

Detects the removal of a port or application rule in the Windows Firewall configuration using netsh

windows

Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule

windows

Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic

linux

Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

windows

Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting.

windows

Detects the execution of Winscp with the "-command" and the "open" flags in order to open an FTP connection. Akira ransomware was seen using this technique in order to exfiltrate data.

windows

Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. Shai-Hulud is an npm supply chain worm targeting CI/CD environments. It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.

windows

Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information

windows

Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy

windows