windows Sigma detection rules

Detects WRITE_DAC access to a domain object

windows · security

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

windows · process_creation

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

windows · process_creation

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

windows · file_event

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

windows · process_creation

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

windows · application

focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.

windows · ps_module

Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell

windows · msexchange-management

Detects the creation of a named pipe as used by CobaltStrike

windows · pipe_created

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

windows · pipe_created

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

windows · system

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

windows · process_creation

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

windows · process_creation

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

windows · security

Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675

windows · printservice-operational

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

windows · file_event

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

windows · security

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

windows · registry_set

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

windows · file_event

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

windows · security

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

windows · security

Detects DarkSide Ransomware and helpers

windows · process_creation

Detects a Domain Controller machine account authenticating from a source IP that is not a known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during replication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and indicates one of the following: - Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without requesting a TGT - Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from a non-DC host - Overpass-the-Hash: attacker converted a stolen DC machine account hash into a Kerberos ticket and is authenticating from a non-DC host - Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost): attacker obtained a DC certificate via ADCS CDC-chase abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync

windows · security

Detects the default "UserName" used by the DiagTrackEoP POC

windows · security

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

windows · security

Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process

windows · process_creation

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

windows · process_creation

Detects the use of the filename DumpStack.log to evade Microsoft Defender

windows · process_creation

Detects Elise backdoor activity used by APT32

windows · process_creation

Detects a specific export function name used by one of EquationGroup tools

windows · process_creation

Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report

windows · process_creation

Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641

windows · process_creation

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

windows · process_creation

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

windows · process_creation

Detects FlowCloud malware registry markers from threat group TA410. The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.

windows · registry_event

Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll

windows · image_load

Detects service creation persistence used by the Goofy Guineapig backdoor

windows · system

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

windows · process_creation

Detects process execution patterns related to Griffon malware as reported by Kaspersky

windows · process_creation

Detects well-known credential dumping tools execution via specific named pipe creation

windows · pipe_created

Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

windows · pipe_created

Detects the use of the Dinject PowerShell cradle based on the specific flags

windows · process_creation

Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory

windows · file_event

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

windows · process_creation

Detects some Empire PowerShell UAC bypass methods

windows · process_creation

F-Secure C3 produces DLLs with a default exported StartNodeRelay function.

windows · process_creation

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

windows · process_creation

Detects the presence and execution of Inveigh via dropped artefacts

windows · file_event

Detects creation of default named pipes used by the Koh tool

windows · pipe_created

Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

windows · file_event

Detects the execution of the PurpleSharp adversary simulation tool

windows · process_creation

Detects a dump file written by QuarksPwDump password dumper

windows · file_event

Detects the execution of the hacktool Rubeus via PE information of command line parameters

windows · process_creation

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

windows · process_creation

Detects the execution of SecurityXploded Tools

windows · process_creation

Detects the use of SharpUp, a tool for local privilege escalation

windows · process_creation

Detects process activity patterns as seen being used by Sliver C2 framework implants

windows · process_creation

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

windows · process_creation

Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks.

windows · process_creation

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

windows · process_creation

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

windows · process_creation

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

windows · file_event

Detects different process execution behaviors as described in various threat reports on Lazarus group activity

windows · process_creation

Detects registry key used by Leviathan APT in Malaysian focused campaign

windows · registry_event

Detects LockerGoga ransomware activity via specific command line.

windows · process_creation

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

windows · msexchange-management

Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

windows · image_load

Detects the creation of a named pipe seen used by known APTs or malware.

windows · pipe_created

Detects suspicious execution from AsperaFaspex as seen used by Mint Sandstorm

windows · process_creation

Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm

windows · process_creation

Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

windows · system

Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

windows · file_event

Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

windows · process_creation

Detects registry keys created in OceanLotus (also known as APT32) attacks

windows · registry_event

Detects OilRig activity as reported by Nyotron in their March 2018 report

windows · process_creation

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

windows · registry_event

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

windows · security

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

windows · system

Detects Pandemic Windows Implant

windows · registry_event

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

windows · process_creation

Detects a specific command used by the Conti ransomware group

windows · process_creation

Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity

windows · process_creation

Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process

windows · registry_event

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

windows · process_creation

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network

windows · file_event

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class

windows · image_load

Detects potential Dridex acitvity via specific process patterns

windows · process_creation

Detects potential Dtrack RAT activity via specific process patterns

windows · process_creation

Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL

windows · process_creation

Detects specific process characteristics of Maze ransomware word document droppers

windows · process_creation

Detects potential QBot activity by looking for process executions used previously by QBot

windows · process_creation

Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike

windows · process_creation

Detects the creation of file such as spinstall0.aspx which may indicate successful exploitation of CVE-2025-53770. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

windows · file_event

Detects different hacktools used for relay attacks on Windows for privilege escalation

windows · process_creation

Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM

windows · process_creation

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

windows · registry_event

Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory

windows · msexchange-management

Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.

windows · process_creation

Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.

windows · process_creation

Detects the creation of a named pipe with the hardcoded name "REDSUN". The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain. RedSun creates the pipe as \\??\pipe\REDSUN. The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM. Presence of this pipe name indicates active or recent RedSun execution.

windows · pipe_created

Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.exe dropped in a characteristic RS-{GUID} temporary directory, or the RedSun.exe process itself being present. This covers the staging pattern used by RedSun, a Cloud Files API and opportunistic lock (oplock) based AV bypass/privilege escalation tool. RedSun works as follows: 1. Registers a Cloud Files sync root and creates a Cloud Files placeholder for TieringEngineService.exe under %TEMP%\RS-{GUID}\ 2. The placeholder file carries EICAR test file content (Virus:DOS/EICAR_Test_File) to reliably trigger a Defender scan and remediation attempt 3. Requests a batch oplock (FSCTL_REQUEST_BATCH_OPLOCK) on the placeholder file 4. When Defender attempts to scan/quarantine the file, the oplock triggers - holding the file open 5. During the oplock break window, RedSun swaps the mount point (junction) to redirect \\?\C:\Windows\System32 to the attacker-controlled temp path 6. This races the AV/OS into executing the malicious TieringEngineService.exe with elevated privileges

windows · windefend

Detects the creation of a file named TieringEngineService.exe inside a directory whose path contains the RS- prefix characteristic of RedSun's staging directory (e.g. %TEMP%\RS-{GUID}\TieringEngineService.exe). RedSun registers a Cloud Files sync root under this RS-prefixed path and drops a masqueraded placeholder there as part of its oplock-based AV bypass and privilege escalation chain. The RS-{GUID} directory name is generated by RedSun itself and has no legitimate system usage, making the combination of this path prefix and the TieringEngineService.exe filename a highly specific indicator of RedSun activity.

windows · file_event

Detects the presence of a registry key created during Azorult execution

windows · registry_event

Detects the execution of whoami that has been renamed to a different name to avoid detection

windows · process_creation

Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)

windows · process_creation

Detects Rorschach ransomware execution activity

windows · process_creation

Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322

windows · process_creation

Detects Silence EmpireDNSAgent as described in the Group-IP report

windows · ps_script

Detects SNAKE malware kernel driver file indicator

windows · file_event

Detects the creation of a service named "WerFaultSvc" which seems to be used by the SNAKE malware as a persistence mechanism as described by CISA in their report

windows · system

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

windows · process_creation

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

windows · registry_event

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

windows · process_creation

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

windows · dns-client

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

windows · dns_query

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

windows · process_creation

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

windows · ps_script

Detects indicators of a UAC bypass method by mocking directories

windows · process_creation

Detects commands used by Turla group as reported by ESET in May 2020

windows · process_creation

Detects automated lateral movement by Turla group

windows · process_creation

Detects a named pipe used by Turla group samples

windows · pipe_created

This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018

windows · system

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

windows · process_creation

Detects WannaCry ransomware activity

windows · process_creation

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

windows · security

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

windows · security

Detects the use of Windows Credential Editor (WCE)

windows · registry_event

Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities

windows · process_creation

Detects specific process characteristics of Winnti Pipemon malware reported by ESET

windows · process_creation

Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

windows · process_creation

Detects the creation of the default output filename used by the wmiexec tool

windows · file_event

Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.

windows · file_event

This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.

windows · system

Detects a ZxShell start by the called and well-known function name

windows · process_creation

Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.

windows · file_event

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

windows · process_creation

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

windows · ps_script

Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

windows · image_load

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

windows · process_creation

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

windows · ps_script

Detection of unusual child processes by different system processes

windows · process_creation

Detects scenarios where one can control another users or computers account without having to use their credentials.

windows · security

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

windows · security

Detects Active Directory Certificate Services (ADCS) certificate requests that include the 'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller. 'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest scenarios where a client in a child domain tells the CA which DC to contact for identity lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames or IPs that resolve to a real Domain Controller computer object in AD with the SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set. In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC identity which the pre-patch CA accepts without validation. A malicious event looks like: Requester: DOMAIN\GHOST<random>$ Attributes: cdc:<attacker_ip> rmd:<target_dc_fqdn> SubjectAlternativeName: DNS Name=<target_dc_fqdn> CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added _ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate DC object in Active Directory before following the chase.

windows · security

Detects successful issuance of an ADCS certificate where the request attributes include 'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the CA's chase fallback path was taken against an attacker-controlled target. 'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that returns a forged DC identity. A successfully issued certificate at this stage means the attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling PKINIT authentication as that DC followed by DCSync replication.

windows · security

Detects the creation of a machine account whose name starts with 'GHOST', which is the naming convention used by the CVE-2026-54121 (Certighost) exploit tooling. The public proof-of-concept for Certighost creates a temporary machine account with a name of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase path. The attacker-controlled machine account is used as the requester identity in the certificate request; the cdc attribute then redirects the CA to a rogue host that returns a forged Domain Controller identity. The resulting certificate carries the DC's SID and DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync. A machine account creation event (4741) where TargetUserName starts with 'GHOST' and ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate environments very rarely provision machine accounts with this prefix.

windows · security

Detects certificate creation with template allowing risk permission subject and risky EKU

windows · security

Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes

windows · registry_set

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

windows · process_creation

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

windows · process_creation

Detects javaw.exe in AppData folder as used by Adwind / JRAT

windows · process_creation

Detects javaw.exe in AppData folder as used by Adwind / JRAT

windows · file_event

Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

windows · process_creation

Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

windows · firewall-as

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

windows · process_creation

Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts

windows · ps_script

Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content. Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned.

windows · registry_set

Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".

windows · registry_set

Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known folder often used as a staging directory.

windows · appxdeployment-server

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

windows · image_load

Detects usage of "IMEWDBLD.exe" to download arbitrary files

windows · process_creation

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

windows · image_load

Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators

windows · application

Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the `nslookup` command.

windows · process_creation

Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

windows · process_creation

Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

windows · process_creation

Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

windows · file_event

Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

windows · process_creation

Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking. This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94) which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user's context without needing to steal credentials or use additional techniques to compromise the account.

windows · image_load

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

windows · process_creation

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

windows · process_creation

Detects encoded base64 MZ header in the commandline

windows · process_creation

Detects a BITS transfer job downloading file(s) from a direct IP address.

windows · bits-client

Detects BITS transfer job downloading files from a file sharing domain.

windows · bits-client

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

windows · bits-client

Detects specific windows registry modifications made by BlackByte ransomware variants. BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption. This rule triggers when any of the following registry keys are set to DWORD 1, however all three should be investigated as part of a larger BlackByte ransomware detection and response effort.

windows · registry_set

Detects default file names outputted by the BloodHound collection tool SharpHound

windows · file_event

Attempts to detect system changes made by Blue Mockingbird

windows · process_creation

Attempts to detect system changes made by Blue Mockingbird

windows · registry_set

Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.

windows · security

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

windows · process_creation

Bypasses User Account Control using a fileless method

windows · registry_set

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

windows · registry_set

Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.

windows · registry_set

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

windows · process_creation

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

windows · process_creation

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

windows · process_creation

Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.

windows · process_creation

Detects the Windows Certificate Services process (certsrv.exe) initiating an outbound network connection on port 445 (SMB) or 389 (LDAP) to a non-DC host. This behaviour is inherently suspicious: under normal operation the CA resolves subject identities via local RPC against the domain and never initiates outbound SMB or LDAP connections to arbitrary hosts. Any such connection indicates the CA is being coerced into performing a remote identity lookup against an attacker-controlled host. The most direct known trigger is the CA chase fallback (EDITF_ENABLECHASECLIENTDC) where a requester-supplied 'cdc' attribute causes the CA to open SMB and LDAP to a specified address. CVE-2026-54121 (Certighost) exploits this path to redirect the CA to rogue LSA and LDAP services that return a DC's identity, resulting in a forged DC certificate. This rule is not limited to Certighost — any future vulnerability or misconfiguration that causes certsrv.exe to make outbound SMB or LDAP connections is covered.

windows · network_connection

Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

windows · process_creation

Detect possible persistence using Fax DLL load when service restart

windows · registry_set

Detect change of the user account associated with the FAX service to avoid the escalation problem.

windows · registry_set

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.

windows · registry_set

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

windows · process_creation

Detects execution of ChromeLoader malware via a registered scheduled task

windows · process_creation

Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).

windows · process_creation

Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

windows · ps_script

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

windows · process_creation

Detects various indicators of Microsoft Connection Manager Profile Installer execution

windows · process_access

Detects various indicators of Microsoft Connection Manager Profile Installer execution

windows · process_creation

Detects various indicators of Microsoft Connection Manager Profile Installer execution

windows · registry_event

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

windows · process_creation

Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

windows · process_creation

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

windows · pipe_created

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

windows · security

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs

windows · ps_script

Detects blocked load attempts of revoked drivers

windows · codeintegrity-operational

Detects blocked image load events with revoked certificates by code integrity.

windows · codeintegrity-operational

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

windows · codeintegrity-operational

Detects block events for files that are disallowed by code integrity for protected processes

windows · codeintegrity-operational

Detects image load events with revoked certificates by code integrity.

windows · codeintegrity-operational

Detects the load of a revoked kernel driver

windows · codeintegrity-operational

Detects loaded kernel modules that did not meet the WHQL signing requirements.

windows · codeintegrity-operational

Detects loaded unsigned image on the system

windows · codeintegrity-operational

Detects the presence of a loaded unsigned kernel module on the system.

windows · codeintegrity-operational

Detects the creation of new services potentially related to COLDSTEEL RAT

windows · system

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

windows · process_creation

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

windows · registry_set

Detects potential COM object hijacking via modification of default system CLSID.

windows · registry_set

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

windows · network_connection

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

windows · network_connection

Detects the use of argument injection in the Commvault qlogin command - potential exploitation for CVE-2025-57791. An attacker can inject the `-localadmin` parameter via the password field to bypass authentication and gain a privileged token.

windows · process_creation

Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. This is a post-authentication step corresponding to CVE-2025-57790.

windows · process_creation

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

windows · process_creation

Detects a command used by conti to exfiltrate NTDS

windows · process_creation

Detects a command used by conti to find volume shadow backups

windows · process_creation

Detects the malicious use of a control panel item

windows · process_creation

Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share

windows · process_creation

Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)

windows · process_creation

Files with well-known filenames (sensitive files with credential data) copying

windows · process_creation

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information

windows · ps_script

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

windows · process_creation

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

windows · file_event

Sysmon registry detection of a local hidden user account.

windows · registry_event

Files with well-known filenames (parts of credential dump software or files produced by them) creation

windows · file_event

Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.

windows · process_access

Detects when a process tries to access the memory of svchost to potentially dump credentials.

windows · process_access

Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.

windows · process_access

Detects well-known credential dumping tools execution via service execution events

windows · security

Detects well-known credential dumping tools execution via service execution events

windows · system

Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.

windows · system

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

windows · process_creation

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

windows · process_creation

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

windows · process_creation

Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.

windows · process_creation

Detects the abuse of custom file open handler, executing powershell

windows · registry_set

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

windows · application

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.

windows · registry_set

Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

windows · file_event

Detects the creation of "msiexec.exe" in the "bin" directory of the ManageEngine SupportCenter Plus (Related to CVE-2021-44077) and public POC available (See references section)

windows · file_event

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

windows · file_event

Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

windows · file_event

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

windows · process_creation

Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".

windows · application

Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.

windows · process_creation

Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

windows · process_creation

Detects creation of local users via the net.exe command with the name of "DarkGate"

windows · process_creation

Detects a Kerberos service ticket request (Event 4769) targeting a Domain Controller machine account's service (e.g. DRSUAPI) originating from an IP address that is not a known Domain Controller. Service tickets for DC machine accounts should only be requested by other DCs during legitimate replication operations. An attacker with a valid TGT (obtained via PKINIT, overpass-the-hash, or stolen TGT) targeting a DC machine account's service from a workstation IP indicates preparation for DCSync or impersonation of a DC. Unlike Silver Ticket attacks (which forge the TGS and bypass this event), this rule catches attacks that go through the KDC legitimately. This rule requires %dc_machine_accounts% and %dc_ip_addresses% to be populated with all known DC machine account names and DC IP addresses respectively.

windows · security

Detects a Kerberos TGT request (Event 4768) for a known Domain Controller machine account originating from an IP address that is not a known Domain Controller. DC machine accounts should only request TGTs from their own IP. Any TGT request for a DC account from a workstation or non-DC host is anomalous and indicates one of the following: - PKINIT abuse (CVE-2026-54121 / Certighost): attacker authenticating as a DC via a forged certificate from their workstation - Overpass-the-Hash: attacker converting a stolen DC machine account NTLM hash into a Kerberos TGT - Pass-the-Hash (RC4): attacker using the DC machine account hash directly with Kerberos

windows · security

Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

windows · security

Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

windows · registry_set

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

windows · process_creation

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

windows · process_creation

Shadow Copies deletion using operating systems utilities via PowerShell

windows · ps_classic_start

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

windows · process_creation

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

windows · ps_script

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

windows · process_creation

Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device. This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.

windows · process_creation

The Devtoolslauncher.exe executes other binary

windows · process_creation

Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.

windows · network_connection

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

windows · registry_set

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

windows · system

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

windows · system

Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library

windows · image_load

Detects DLL sideloading activity seen used by Diamond Sleet APT

windows · image_load

Detects DNS queries related to Diamond Sleet APT activity

windows · dns_query

Detects file creation activity that is related to Diamond Sleet APT activity

windows · file_event

Detects process creation activity indicators related to Diamond Sleet APT

windows · process_creation

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

windows · registry_event

Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure. Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory. If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM. If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped. If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.

windows · registry_set

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

windows · process_creation

Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros

windows · registry_set

Detects usage of powershell cmdlets to disable or remove ETW trace sessions

windows · ps_script

Detects scripts or commands that disabled the Powershell command history by removing psreadline module

windows · ps_script

Detects disabling Windows Defender PUA protection

windows · registry_set

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.

windows · registry_event

Detects attackers attempting to disable Windows Defender using Powershell

windows · process_creation

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry

windows · registry_set

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

windows · registry_set

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

windows · process_creation

Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

windows · ps_script

Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features

windows · process_creation

Detects commands that temporarily turn off Volume Snapshots

windows · process_creation

Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections

windows · registry_set

Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.

windows · process_creation

Detects a method to load DLL via LSASS process using an undocumented Registry key

windows · registry_event

Detects cmstp loading "dll" or "ocx" files from suspicious locations

windows · image_load

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

windows · file_event

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

windows · process_creation

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

windows · image_load

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

windows · process_creation

Well-known DNS Exfiltration tools execution

windows · process_creation

Detects Azure Hybrid Connection Manager services querying the Azure service bus service

windows · dns_query

Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.

windows · dns_query

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

windows · dns-client

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

windows · dns_query

Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

windows · dns_query

Detects DNS queries to an ".onion" address related to Tor routing networks

windows · dns_query

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

windows · dns-server

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

windows · image_load

Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.

windows · file_event

Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers

windows · security

Detects DNS queries for C2 domains used by DPRK Threat actors.

windows · dns_query

Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading.

windows · registry_set

Detects a driver load from a temporary directory

windows · driver_load

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

windows · process_creation

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

windows · ps_script

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

windows · process_creation

Detects email exfiltration via powershell cmdlets

windows · process_creation

Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022. The ".lnk" file was delivered via phishing campaign.

windows · process_creation

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

windows · registry_set

Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.

windows · process_creation

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

windows · security

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.

windows · registry_event

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

windows · security

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

windows · registry_set

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

windows · process_creation

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

windows · process_creation

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

windows · process_creation

Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

windows · msexchange-management

Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability

windows · process_creation

This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.

windows · registry_set

Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no longer exists on disk at the time of logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.

windows · process_creation

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

windows · process_creation

Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe

windows · process_creation

Detects using WorkFolders.exe to execute an arbitrary control.exe

windows · process_creation

Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS.

windows · application

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.

windows · process_creation

Detects the execution of the commonly used ZeroLogon PoC executable.

windows · process_creation

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

windows · process_creation

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

windows · process_creation

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

windows · process_creation

Detects the export of a crital Registry key to a file.

windows · process_creation

Exports the target Registry key and hides it in the specified alternate data stream.

windows · create_stream_hash

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

windows · security

Detects a failed installation of a Exchange Transport Agent

windows · msexchange-management

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

windows · process_creation

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

windows · image_load

Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities

windows · file_event

File .conf created related to VenomRAT, AsyncRAT and Lummac samples observed in the wild.

windows · file_event

Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

windows · process_creation

Detects execution of the IEExec utility to download and execute files

windows · process_creation

Detects when a user downloads a file from an IP based URL using CertOC.exe

windows · process_creation

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

windows · process_creation

Detects usage of bitsadmin downloading a file to a suspicious target folder

windows · process_creation

Detects the use of Windows Defender MpCmdRun.EXE to download files

windows · process_creation

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

windows · process_creation

Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

windows · process_creation

Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.

windows · process_creation

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

windows · process_creation

Detects usage of bitsadmin downloading a file with a suspicious extension

windows · process_creation

Detects the creation of files with an executable or script extension by an Office application.

windows · file_event

Detects commonly-used chained commands and strings in the most recent 'url' value of the 'TypedPaths' key, which could be indicative of a user being targeted by the FileFix technique.

windows · registry_set

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

windows · process_creation

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

windows · process_creation

Detects Archer malware invocation via rundll32

windows · process_creation

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

windows · security

Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder

windows · registry_delete

Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.

windows · registry_set

Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.

windows · registry_set

Detects the creation of specific files inside of ProgramData directory. These files were seen being created by Forest Blizzard as described by MSFT.

windows · file_event

Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.

windows · process_creation

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.

windows · process_creation

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

windows · process_creation

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

windows · process_creation

Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.

windows · file_event

Detects any GAC DLL being loaded by an Office Product

windows · image_load

Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

windows · dns-server-analytic

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

windows · process_creation

Detects malicious indicators seen used by the Goofy Guineapig malware

windows · file_event

Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations. This tool is used by the Play ransomware group for network enumeration, data gathering, and event log clearing.

windows · process_creation

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

windows · process_creation

Detects command line parameters used by Bloodhound and Sharphound hack tools

windows · process_creation

Detects remote thread creation from CACTUSTORCH as described in references.

windows · create_remote_thread

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

windows · process_creation

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

windows · process_creation

Detects a typical pattern of a CobaltStrike BOF which inject into other processes

windows · process_access

Detects the use of CoercedPotato, a tool for privilege escalation

windows · process_creation

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

windows · pipe_created

Detects suspicious command lines used in Covenant luanchers

windows · process_creation

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

windows · process_creation

Detects various execution patterns of the CrackMapExec pentesting framework

windows · process_creation

Detects file creation events with filename patterns used by CrackMapExec.

windows · file_event

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

windows · process_creation

Detects suspicious process patterns found in logs when CrackMapExec is used

windows · process_creation

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

windows · process_creation

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

windows · process_creation

Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods

windows · process_creation

Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.

windows · process_creation

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

windows · process_creation

Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.

windows · security

Detects the pattern of a pipe name as used by the hack tool EfsPotato

windows · pipe_created

Detects suspicious powershell command line parameters used in Empire

windows · process_creation

Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.

windows · ps_module

Detects process access requests from hacktool processes based on their default image name

windows · process_access

Detects the execution GMER tool based on image and hash fields.

windows · process_creation

Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles

windows · process_access

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

windows · process_creation

Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

windows · process_creation

Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.

windows · process_creation

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

windows · process_creation

Detects command line parameters used by Hydra password guessing hack tool

windows · process_creation

Detects file creation events with filename patterns used by Impacket.

windows · file_event

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

windows · process_creation

Detects command line parameters used by Koadic hack tool

windows · process_creation

Detects the use of KrbRelay, a Kerberos relaying tool

windows · process_creation

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

windows · process_creation

Detects the process injection of a LittleCorporal generated Maldoc.

windows · process_access

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

windows · process_creation

Detection well-known mimikatz command line arguments

windows · process_creation

Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.

windows · process_creation

Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that extraction path are unique to NetExec and serve as reliable on-disk indicators of execution. NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for Active Directory enumeration, credential harvesting, and remote code execution.

windows · file_event

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

windows · security

Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file

windows · file_event

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

windows · process_creation

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

windows · create_remote_thread

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

windows · process_creation

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

windows · file_event

Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files

windows · process_creation

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

windows · file_event

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

windows · process_creation

Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

windows · process_creation

Detects usage of the Quarks PwDump tool via commandline arguments

windows · process_creation

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

windows · process_creation

Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.

windows · process_creation

Detects the creation of file with specific names used by RemoteKrbRelay SMB Relay attack module.

windows · file_event

Detects the execution of the hacktool Rubeus using specific command line flags

windows · ps_script

Detects default lsass dump filename generated by SafetyKatz.

windows · file_event

Detects usage of the Sharp Chisel via the commandline arguments

windows · process_creation

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

windows · process_creation

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

windows · process_creation

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

windows · image_load

Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

windows · process_creation

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

windows · process_creation

Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

windows · process_creation

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

windows · process_creation

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

windows · process_creation

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

windows · process_creation

Detects SILENTTRINITY stager dll loading activity

windows · image_load

Detects SILENTTRINITY stager use via PE metadata

windows · process_creation

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

windows · process_creation

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

windows · process_creation

Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon

windows · process_access

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

windows · process_creation

Detects files written by the different tools that exploit HiveNightmare

windows · file_event

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

windows · process_creation

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

windows · process_creation

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

windows · process_creation

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

windows · ps_script

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

windows · process_creation

Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.

windows · process_creation

Detects suspicious use of XORDump process memory dumping utility

windows · process_creation

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

windows · process_creation

Detects the creation of a named file stream with the imphash of a well-known hack tool

windows · create_stream_hash

This events that are generated when using the hacktool Ruler by Sensepost

windows · security

Detects installation or execution of services

windows · system

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

windows · process_creation

Detects the creation of a local hidden user account which should not happen for event ID 4720.

windows · security

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)

windows · registry_set

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

windows · registry_set

Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

windows · file_event

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments. Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.

windows · process_creation

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

windows · process_creation

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

windows · iis-configuration

Rule to detect the Hybrid Connection Manager service installation.

windows · security

Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.

windows · registry_event

Rule to detect the Hybrid Connection Manager service running on an endpoint.

windows · microsoft-servicebus-client

Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.

windows · registry_set

Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe. HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode. Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.

windows · process_creation

Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID

windows · process_creation

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

windows · registry_set

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

windows · process_creation

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

windows · process_creation

Detects execution of Impacket's psexec.py.

windows · security

Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

windows · taskscheduler

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

windows · security

Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.

windows · security

Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution

windows · system

Detects important or interesting Windows services that got terminated unexpectedly.

windows · system

Detects important or interesting Windows services that got terminated for whatever reason

windows · system

Detects the import of a alternate datastream to the registry with regedit.exe.

windows · process_creation

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

windows · process_creation

Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.

windows · process_creation

Detects an interactive AT job, which may be used as a form of privilege escalation.

windows · process_creation

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · process_creation

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · ps_script

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · ps_module

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · security

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · system

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

windows · process_creation

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

windows · ps_script

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

windows · ps_module

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

windows · security

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

windows · system

Detects Obfuscated use of stdin to execute PowerShell

windows · process_creation

Detects Obfuscated use of stdin to execute PowerShell

windows · ps_script

Detects Obfuscated use of stdin to execute PowerShell

windows · ps_module

Detects Obfuscated use of stdin to execute PowerShell

windows · security

Detects Obfuscated use of stdin to execute PowerShell

windows · system

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · process_creation

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · ps_script

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · ps_module

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · security

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · system

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · process_creation

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · ps_script

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · ps_module

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · security

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · system

Detects Obfuscated Powershell via Stdin in Scripts

windows · process_creation

Detects Obfuscated Powershell via Stdin in Scripts

windows · ps_script

Detects Obfuscated Powershell via Stdin in Scripts

windows · ps_module

Detects Obfuscated Powershell via Stdin in Scripts

windows · security

Detects Obfuscated Powershell via Stdin in Scripts

windows · system

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · process_creation

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · ps_script

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · ps_module

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · security

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · system

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · process_creation

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · ps_script

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · ps_module

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · security

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · system

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows · ps_script

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows · ps_module

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows · security

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows · system

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

windows · file_event

Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.

windows · process_creation

Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.

windows · registry_set

Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.

windows · process_creation

Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.

windows · image_load

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

windows · process_creation

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

windows · security

Detects loading of DLLs associated with Katz Stealer malware 2025 variants. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. The process that loads these DLLs are very likely to be malicious.

windows · image_load

Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.

windows · process_creation

Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.

windows · security

Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory

windows · process_creation

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

windows · system

Detects specific command line execution used by Lace Tempest to download Cobalt Strike as reported by SysAid Team

windows · process_creation

Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7

windows · file_event

Detects execution of a specific binary based on filename and hash used by Lace Tempest to load additional malware as reported by SysAid Team

windows · process_creation

Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team

windows · ps_script

Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team

windows · ps_script

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

windows · image_load

Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location

windows · process_creation

Detects programs on a Windows system that should not write an archive to disk

windows · file_event

Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery.

windows · file_event

Detects LOLBINs and applications that should not legitimately drop script files to disk. This may indicate malware staging or abuse of a trusted binary for script-based code execution.

windows · file_event

Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution. Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.

windows · file_event

Detects usage of a PowerShell command to dump the live memory of a Windows machine

windows · ps_script

Detects the creation of the LiveKD driver by a process image other than "livekd.exe".

windows · file_event

Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.

windows · file_event

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

windows · image_load

Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability

windows · diagnosis-scripted

Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode

windows · system

Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.

windows · process_creation

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

windows · registry_set

Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379

windows · application

Detects Access to LSASS Process

windows · windefend

Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference

windows · process_access

Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409). This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability, which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service, leading to a stack-based buffer overflow and subsequent crash of the LSASS process.

windows · application

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

windows · process_creation

Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.

windows · registry_set

Detects LSASS process access requests from a source process with the "dump" keyword in its image name.

windows · process_access

Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.

windows · process_access

Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service). This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.

windows · application

Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.

windows · file_event

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.

windows · file_event

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

windows · file_event

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

windows · process_creation

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

windows · process_creation

Detects registry changes to Office trust records where the path is located in a potentially suspicious location

windows · registry_set

Detects base64 encoded strings used in hidden malicious PowerShell command lines

windows · process_creation

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded

windows · file_event

Detects loading of known malicious drivers via their hash.

windows · driver_load

Detects Commandlet names and arguments from the Nishang exploitation framework

windows · ps_script

Detects Commandlet names from well-known PowerShell exploitation frameworks

windows · ps_module

Detects Commandlet names from well-known PowerShell exploitation frameworks

windows · process_creation

Detects Commandlet names from well-known PowerShell exploitation frameworks

windows · ps_script

Detects the creation of known offensive powershell scripts used for exploitation

windows · file_event

Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance

windows · ps_module

Detects Commandlet names from ShellIntel exploitation scripts.

windows · ps_script

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

windows · process_access

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

windows · process_creation

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

windows · process_creation

Detects suspicious command line patterns seen being used by MERCURY APT

windows · process_creation

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

windows · security

Alerts on Metasploit host's authentications on the domain.

windows · security

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

windows · security

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

windows · system

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

windows · security-mitigations

Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"

windows · windefend

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

windows · process_creation

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

windows · process_creation

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

windows · application

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

windows · application

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

windows · image_load

Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.

windows · registry_set

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

windows

Detects Log4J Wstomcat process execution as seen in Mint Sandstorm activity

windows · process_creation

Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.

windows · process_creation

Detects a Windows command line executable started from MMC

windows · process_creation

Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

windows · process_creation

Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts. Attackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically.

windows · registry_set

Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

windows · process_creation

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab).

windows · process_creation

Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.

windows · process_creation

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)

windows · process_creation

Detects corrupted packets sent to the MSMQ service. Could potentially be a sign of CVE-2023-21554 exploitation

windows · application

Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role

windows · application

Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server

windows · application

This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

windows · application

Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started

windows · application

Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.

windows · application

Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands

windows · application

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

windows · process_creation

Detects specific process parameters as used by Mustang Panda droppers

windows · process_creation

Detects abusing Windows 10 Narrator's Feedback-Hub

windows · registry_event

Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section). By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.

windows · registry_set

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

windows · process_creation

Detects NetNTLM downgrade attack

windows · security

Detects NetNTLM downgrade attack

windows · registry_event

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

windows · network_connection

Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.

windows · network_connection

Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.

windows · network_connection

Detects network connections from the Equation Editor process "eqnedt32.exe".

windows · network_connection

Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.

windows · network_connection

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.

windows · network_connection

Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such network connections can also help identify potential malicious infrastructure used by threat actors

windows · network_connection

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

windows · network_connection

Detects a set of suspicious network related commands often used in recon stages

windows · process_creation

Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.

windows · network_connection

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

windows · registry_set

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

windows · process_creation

Detects the abuse of the exefile handler in new file association. Used for bypass of security products.

windows · registry_set

Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.

windows · firewall-as

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

windows · registry_set

Detects an RDP connection originating from a domain controller.

windows · network_connection

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

windows · registry_set

Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

windows · registry_set

Detects creation of local users via the net.exe command with the option "never expire"

windows · process_creation

Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.

windows · process_creation

Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour

windows · terminalservices-localsessionmanager

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

windows · process_creation

Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe

windows · process_creation

Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.

windows · file_event

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

windows · file_event

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory

windows · file_event

Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.

windows · ps_script

This the exploitation of a NTFS vulnerability as reported without many details via Twitter

windows · system

Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an attacker-controlled server, enabling offline cracking or relay attacks. When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials stored in LSASS — without requiring a plaintext password. This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.

windows · process_creation

Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.

windows · process_creation

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

windows · process_creation

Detects Octopus Scanner Malware.

windows · file_event

Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.

windows · process_creation

Detects the creation of a office macro file from a a suspicious process

windows · file_event

Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.

windows · registry_set

Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.

windows · process_creation

Detects file creation activity that is related to Onyx Sleet APT activity

windows · file_event

The OpenWith.exe executes other binary

windows · process_creation

Detects activity mentioned in Operation Wocao report

windows · process_creation

Detects activity mentioned in Operation Wocao report

windows · security

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

windows · process_creation

Detects Cobalt Strike module/commands accidentally entered in CMD shell

windows · process_creation

Detects a network connection initiated by Cmstp.EXE Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.

windows · network_connection

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

windows · network_connection

Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.

windows · network_connection

Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.

windows · network_connection

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

windows · process_creation

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

windows · registry_set

Detects the modification of Outlook security setting to allow unprompted execution of macros.

windows · registry_set

Detects exploitation indicators related to PaperCut MF/NG Exploitation

windows · process_creation

Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut

windows · process_creation

Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password in order to obtain persistence.

windows · security

Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN

windows · security

Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.

windows · create_remote_thread

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

windows · security

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

windows · security

Detects processes loading modules related to PCRE.NET package

windows · image_load

Detects processes creating temp files related to PCRE.NET package

windows · file_event

Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses.

windows · file_event

Detects process creation activity related to Peach Sandstorm APT

windows · process_creation

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

windows · security

Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary

windows · registry_set

Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.

windows · security

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

windows · process_creation

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

windows · process_creation

Detects a ping command that uses a hex encoded IP address

windows · process_creation

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

windows · process_creation

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

windows · image_load

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

windows · file_event

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

windows · printservice-admin

Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321

windows · msexchange-management

Detect AD credential dumping using impacket secretdump HKTL

windows · security

Detect PetitPotam coerced authentication activity.

windows · security

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

windows · process_creation

Detects possible addition of shadow credentials to an active directory object.

windows · security

Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

windows · process_creation

Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

windows · process_creation

Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning

windows · process_creation

Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless

windows · registry_set

Detects potential DLL sideloading of "appverifUI.dll"

windows · image_load

Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs

windows · ps_script

Detects specific command line execution used by FIN7 as reported by WithSecureLabs for reconnaissance and POWERTRASH execution

windows · process_creation

Detects PowerShell script file creation with specific name or suffix which was seen being used often by FIN7 PowerShell scripts

windows · file_event

Detects specific command line execution used by Mustang Panda in a targeted attack against the Australian government as reported by Lab52

windows · process_creation

Detects potential process and execution activity related to APT10 Cloud Hopper operation

windows · process_creation

Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc

windows · process_creation

Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability

windows · process_creation

Detects potential arbitrary file download using a Microsoft Office application

windows · process_creation

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

windows · process_creation

Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)

windows · registry_set

Detects tampering with attachment manager settings policies attachments (See reference for more information)

windows · registry_set

Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. The AutoLogger event tracing session records events up that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in, and also used by security solutions as telemetry source. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.

windows · registry_set

Detects activity that could be related to Baby Shark malware

windows · process_creation

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

windows · process_creation

Detects command line patterns used by BlackByte ransomware in different operations

windows · process_creation

Detects remote thread injection events based on action seen used by bumblebee

windows · create_remote_thread

Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links. ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages. Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content, such as one-liners that execute remotely hosted malicious files or scripts.

windows · registry_set

Detects potential process patterns related to Cobalt Strike beacon activity

windows · process_creation

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

windows · registry_set

Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT

windows · file_event

Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism

windows · image_load

Detects the creation of a file named "dllhost.exe" in the "C:\users\public\Documents\" directory. Seen being used by the COLDSTEEL RAT in some of its variants.

windows · file_event

Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.

windows · registry_set

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

windows · process_creation

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

windows · process_creation

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

windows · dns_query

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

windows · network_connection

Detects execution of known compromised version of 3CXDesktopApp

windows · process_creation

Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software

windows · process_creation

Detects a command used by conti to dump database

windows · process_creation

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

windows · process_creation

Detects remote thread creation by PowerShell processes into "lsass.exe"

windows · create_remote_thread

Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass

windows · process_creation

Detects command line parameters or strings often used by crypto miners

windows · process_creation

Detects potential CSharp Streamer RAT loading .NET executable image by using the default file name and path associated with the tool.

windows · image_load

Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's Unified Messaging service

windows · process_creation

Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations

windows · process_creation

Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable versions of Log4j.

windows · process_creation

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

windows · process_creation

Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. 7-Zip version 21.07 and earlier on Windows allows privilege escalation (CVE-2022-29072) and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process.

windows · process_creation

Detects potential exploitation of CVE-2023-21554 (dubbed QueueJumper)

windows · process_creation

Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.

windows · file_event

Detects the execution of a renamed "cmd", "powershell" or "powershell_ise" binary. Attackers were seen using these binaries in a renamed form as "wermgr.exe" in exploitation of CVE-2023-36874

windows · process_creation

Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

windows · file_event

Detects access to a file share with a naming schema seen being used during exploitation of CVE-2023-36884

windows · security

Detects potential exploitation of CVE-2026-33829, a vulnerability in the Windows Snipping Tool URI handler (ms-screensketch:). An attacker can abuse the 'filePath' parameter to supply a UNC path or HTTP URL, causing SnippingTool.exe to initiate a connection to a remote resource. When a UNC path is used (e.g. \\attacker.com\share), this triggers an outbound NTLM authentication attempt, allowing the attacker to capture or relay the victim's Net-NTLMv2 hash. HTTP-based paths may result in remote file loading or server-side request forgery (SSRF)-style access. The URI can be delivered via a malicious hyperlink, phishing email, or web page.

windows · process_creation

Detects the use of various CLI utilities exfiltrating data via web requests

windows · process_creation

Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

windows · process_creation

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows · process_creation

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows · process_creation

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows · process_creation

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

windows · process_creation

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

windows · process_creation

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.

windows · process_creation

Detects specific process behavior observed with Devil Bait samples

windows · process_creation

Detects the creation of ".xml" and ".txt" files in folders of the "\AppData\Roaming\Microsoft" directory by uncommon processes. This behavior was seen common across different Devil Bait samples and stages as described by the NCSC

windows · file_event

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

windows · image_load

Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.

windows · image_load

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

windows · image_load

Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL

windows · image_load

Detects potential DLL sideloading of "EACore.dll"

windows · image_load

Detects potential DLL sideloading of "edputil.dll"

windows · image_load

Detects all Emotet like process executions that are not covered by the more generic rules

windows · process_creation

Detects potential EmpireMonkey APT activity

windows · process_creation

Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting

windows · registry_set

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

windows · process_creation

Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)

windows · process_creation

Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)

windows · process_creation

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

windows · process_creation

Detects execution of the "net.exe" command in order to add a group named "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

windows · process_creation

Detects any creation or modification to a windows domain group with the name "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

windows · security

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

windows · process_creation

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 which involves unauthorized code execution via WebDAV through external control of file names or paths. The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating their working directories to point to attacker-controlled WebDAV servers, causing them to execute malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries through Process.Start() search order manipulation.

windows · process_creation

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

windows · image_load

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe) accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers instead of legitimate system binaries. The vulnerability allows unauthorized code execution through external control of file names or paths via WebDAV.

windows · process_access

Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.

windows · file_event

Detects the use of SDelete to erase a file not the free space

windows · process_creation

Detects a specific broken command that was used by Goofy-Guineapig as described by the NCSC report.

windows · process_creation

Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location as seen used by the Goofy Guineapig backdoor

windows · process_creation

Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.

windows · ps_script