win:sysmon 1

Process creation

The process creation event provides extended information about a newly created process.

Log source: Sysmon
Host type: Windows (workstation, member server, domain controller)
How to enable: Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
Tier, host type: Minimum
Techniques: 265
Rules depending on it: Splunk 559, Sigma 1,426, Elastic 241, Microsoft Sentinel 21

Why this tier

ACSC web shell guidance; CISA/ASD; NSA/ASD web shell guidance

By role

Role	Tier	Basis
Windows workstation	Minimum	CISA/ASD
Windows member server	Minimum	CISA/ASD
Windows domain controller	Minimum	CISA/ASD
Windows web server (IIS), internet-facing	Minimum	ACSC web shell guidance; CISA/ASD; NSA/ASD web shell guidance

Techniques it helps detect

Rules that depend on it

400 of 2,247 rules are listed here: the dataset names at most this many per entry. The counts by vendor are complete.

Sigma 138 listed of 1,426

7Zip Compressing Dump Files by Nasreddine Bencherchali (Nextron Systems)
AADInternals PowerShell Cmdlets Execution - ProccessCreation by Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
APT27 - Emissary Panda Activity by Florian Roth (Nextron Systems)
APT29 2018 Phishing Campaign CommandLine Indicators by Florian Roth (Nextron Systems), @41thexplorer
APT31 Judgement Panda Activity by Florian Roth (Nextron Systems)
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl by Julia Fomina, oscd.community
Abuse of Service Permissions to Hide Services Via Set-Service by Nasreddine Bencherchali (Nextron Systems)
Abused Debug Privilege by Arbitrary Parent Processes by Semanur Guneysu @semanurtg, oscd.community
Abusing Print Executable by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative
Active Directory Database Snapshot Via ADExplorer by Nasreddine Bencherchali (Nextron Systems)
Active Directory Structure Export Via Csvde.EXE by Nasreddine Bencherchali (Nextron Systems)
Active Directory Structure Export Via Ldifde.EXE by Nasreddine Bencherchali (Nextron Systems)
Add Insecure Download Source To Winget by Nasreddine Bencherchali (Nextron Systems)
Add New Download Source To Winget by Nasreddine Bencherchali (Nextron Systems)
Add Potential Suspicious New Download Source To Winget by Nasreddine Bencherchali (Nextron Systems)
Add SafeBoot Keys Via Reg Utility by Nasreddine Bencherchali (Nextron Systems)
Add Windows Capability Via PowerShell Cmdlet by Nasreddine Bencherchali (Nextron Systems)
AddinUtil.EXE Execution From Uncommon Directory by Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Adwind RAT / JRAT by Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
AgentExecutor PowerShell Execution by Nasreddine Bencherchali (Nextron Systems), memory-shards
All Backups Deleted Via Wbadmin.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE by Nasreddine Bencherchali (Nextron Systems)
Always Install Elevated MSI Spawned Cmd And Powershell by Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
Always Install Elevated Windows Installer by Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
Application Removed Via Wmic.EXE by frack113
Application Termination Attempt via Wmic.EXE by Nasreddine Bencherchali (Nextron Systems)
Arbitrary Binary Execution Using GUP Utility by Nasreddine Bencherchali (Nextron Systems)
Arbitrary Command Execution Using WSL by oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE by Beyu Denis, oscd.community
Arbitrary File Download Via ConfigSecurityPolicy.EXE by frack113
Arbitrary File Download Via GfxDownloadWrapper.EXE by Victor Sergeev, oscd.community
Arbitrary File Download Via IMEWDBLD.EXE by Swachchhanda Shrawan Poudel
Arbitrary File Download Via MSEDGE_PROXY.EXE by Swachchhanda Shrawan Poudel
Arbitrary File Download Via MSOHTMED.EXE by Nasreddine Bencherchali (Nextron Systems)
Arbitrary File Download Via MSPUB.EXE by Nasreddine Bencherchali (Nextron Systems)
Arbitrary File Download Via PresentationHost.EXE by Nasreddine Bencherchali (Nextron Systems)
Arbitrary File Download Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
Arbitrary MSI Download Via Devinit.EXE by Florian Roth (Nextron Systems)
Arbitrary Shell Command Execution Via Settingcontent-Ms by Sreeman
AspNetCompiler Execution by frack113
Assembly Loading Via CL_LoadAssembly.ps1 by frack113, Nasreddine Bencherchali (Nextron Systems)
Attempts of Kerberos Coercion Via DNS SPN Spoofing by Swachchhanda Shrawan Poudel (Nextron Systems)
Audio Capture via PowerShell by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)
Audio Capture via SoundRecorder by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Audit Policy Tampering Via Auditpol by Janantha Marasinghe (https://github.com/blueteam0ps)
Audit Policy Tampering Via NT Resource Kit Auditpol by Nasreddine Bencherchali (Nextron Systems)
Automated Collection Command Prompt by frack113
Axios NPM Compromise Indicators - Windows by Swachchhanda Shrawan Poudel (Nextron Systems)
Bad Opsec Defaults Sacrificial Processes With Improper Arguments by Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)
Base64 Encoded PowerShell Command Detected by Florian Roth (Nextron Systems)
Base64 MZ Header In CommandLine by Nasreddine Bencherchali (Nextron Systems)
Binary Proxy Execution Via Dotnet-Trace.EXE by Jimmy Bayne (@bohops)
BitLockerTogo.EXE Execution by Josh Nickels, mttaggart
Blue Mockingbird by Trent Liffick (@tliffick)
Boot Configuration Tampering Via Bcdedit.EXE by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Browser Execution In Headless Mode by Nasreddine Bencherchali (Nextron Systems)
Browser Started with Remote Debugging by pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Bypass UAC via CMSTP by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Bypass UAC via Fodhelper.exe by E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community
Bypass UAC via WSReset.exe by E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth
C# IL Code Compilation Via Ilasm.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)
CMD Shell Output Redirect by frack113
CMSTP Execution Process Creation by Nik Seetharaman
CMSTP UAC Bypass via COM Object Access by Nik Seetharaman, Christian Burkard (Nextron Systems)
COLDSTEEL RAT Anonymous User Process Execution by Nasreddine Bencherchali (Nextron Systems)
COLDSTEEL RAT Cleanup Command Execution by Nasreddine Bencherchali (Nextron Systems)
COLDSTEEL RAT Service Persistence Execution by X__Junior (Nextron Systems)
COM Object Execution via Xwizard.EXE by Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) by Andreas Braathen (mnemonic.io)
CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process by Nasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)
CVE-2024-50623 Exploitation Attempt - Cleo by Tanner Filip, Austin Worline, Chad Hudson, Matt Anderson
Cab File Extraction Via Wusa.EXE by Nasreddine Bencherchali (Nextron Systems)
Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths by Nasreddine Bencherchali (Nextron Systems)
Capture Credentials with Rpcping.exe by Julia Fomina, oscd.community
Certificate Exported Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Certificate Exported Via PowerShell by Nasreddine Bencherchali (Nextron Systems)
Change Default File Association To Executable Via Assoc by Nasreddine Bencherchali (Nextron Systems)
Change Default File Association Via Assoc by Timur Zinniatullin, oscd.community
Change PowerShell Policies to an Insecure Level by frack113
Changing Existing Service ImagePath Value Via Reg.EXE by frack113
Chopper Webshell Process Pattern by Florian Roth (Nextron Systems), MSTI (query)
ChromeLoader Malware Execution by @kostastsale
Chromium Browser Headless Execution To Mockbin Like Site by X__Junior (Nextron Systems)
Chromium Browser Instance Executed With Custom Extension by Aedan Russell, frack113, X__Junior (Nextron Systems)
ClickOnce Deployment Execution - Dfsvc.EXE Child Process by Nasreddine Bencherchali (Nextron Systems)
Cloudflared Portable Execution by Nasreddine Bencherchali (Nextron Systems)
Cloudflared Quick Tunnel Execution by Sajid Nawaz Khan
Cloudflared Tunnel Connections Cleanup by Nasreddine Bencherchali (Nextron Systems)
Cloudflared Tunnel Execution by Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
Cmd Launched with Hidden Start Flags to Suspicious Targets by Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)
Cmd.EXE Missing Space Characters Execution Anomaly by Florian Roth (Nextron Systems)
CobaltStrike Load by Rundll32 by Wojciech Lesicki
Code Execution via Pcwutl.dll by Julia Fomina, oscd.community
CodePage Modification Via MODE.COM by Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk
CodePage Modification Via MODE.COM To Russian Language by Joseliyo Sanchez, @Joseliyo_Jstnk
Command Line Execution with Suspicious URL and AppData Strings by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791) by X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788) by Swachchhanda Shrawan Poudel (Nextron Systems)
Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790) by Swachchhanda Shrawan Poudel (Nextron Systems)
Compress Data and Lock With Password for Exfiltration With 7-ZIP by frack113
Compress Data and Lock With Password for Exfiltration With WINZIP by frack113
Compressed File Creation Via Tar.EXE by Nasreddine Bencherchali (Nextron Systems), AdmU3
Compressed File Extraction Via Tar.EXE by AdmU3
Computer Discovery And Export Via Get-ADComputer Cmdlet by Nasreddine Bencherchali (Nextron Systems)
Computer Password Change Via Ksetup.EXE by Nasreddine Bencherchali (Nextron Systems)
Computer System Reconnaissance Via Wmic.EXE by Nasreddine Bencherchali (Nextron Systems)
Conhost Spawned By Uncommon Parent Process by Tim Rauch, Elastic (idea)
Conhost.exe CommandLine Path Traversal by Nasreddine Bencherchali (Nextron Systems)
Console CodePage Lookup Via CHCP by _pete_0, TheDFIRReport
Conti NTDS Exfiltration Command by Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
Conti Volume Shadow Listing by Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
Control Panel Items by Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)
ConvertTo-SecureString Cmdlet Usage Via CommandLine by Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE by Nasreddine Bencherchali (Nextron Systems)
Copy From Or To Admin Share Or Sysvol Folder by Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali
Copy From VolumeShadowCopy Via Cmd.EXE by Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
Copying Sensitive Files with Credential Data by Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
CreateDump Process Dump by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Csc.EXE Execution Form Potentially Suspicious Parent by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Cscript/Wscript Potentially Suspicious Child Process by Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86')
Cscript/Wscript Uncommon Script Extension Execution by Nasreddine Bencherchali (Nextron Systems)
Curl Download And Execute Combination by Sreeman, Nasreddine Bencherchali (Nextron Systems)
Curl File Upload To File Sharing Websites by Swachchhanda Shrawan Poudel (Nextron Systems)
Curl Web Request With Potential Custom User-Agent by Nasreddine Bencherchali (Nextron Systems)
Curl.EXE Execution by Florian Roth (Nextron Systems)
Curl.EXE Execution With Custom UserAgent by frack113
DLL Call by Ordinal Via Rundll32.EXE by Florian Roth (Nextron Systems)
DLL Execution Via Register-cimprovider.exe by Ivan Dyachkov, Yulia Fomina, oscd.community
DLL Execution via Rasautou.exe by Julia Fomina, oscd.community
DLL Loaded via CertOC.EXE by Austin Songer @austinsonger
DLL Sideloading by VMware Xfer Utility by Nasreddine Bencherchali (Nextron Systems)
DNS Exfiltration and Tunneling Tools Execution by Daniil Yugoslavskiy, oscd.community
DNS RCE CVE-2020-1350 by Florian Roth (Nextron Systems)
DSInternals Suspicious PowerShell Cmdlets by Nasreddine Bencherchali (Nextron Systems), Nounou Mbeiri
DarkGate - Autoit3.EXE Execution Parameters by Micah Babinski
DarkGate - User Created Via Net.EXE by X__Junior (Nextron Systems)
DarkSide Ransomware Pattern by Florian Roth (Nextron Systems)
Data Copied To Clipboard Via Clip.EXE by frack113

Elastic 241

Accessing Outlook Data Filesinferred
Account Discovery Command via SYSTEM Accountinferred
Active Directory Discovery using AdExplorerinferred
AdFind Command Activityinferred
Adding Hidden File Attribute via Attribinferred
Alternate Data Stream Creation/Execution at Volume Root Directoryinferred
Attempt to Establish VScode Remote Tunnelinferred
Attempt to Install or Run Kali Linux via WSLinferred
Attempted Private Key Accessinferred
AzCopy or Azure Storage Explorer Usage on Unusual Hostinferred
Azure Run Command Script Child Processinferred
Backup Deletion with Wbadmininferred
Binary Content Copy via Cmd.exeinferred
Bitsadmin Activityinferred
Browser Process Spawned from an Unusual Parentinferred
Bypass UAC via Event Viewerinferred
Clearing Windows Console Historyinferred
Clearing Windows Event Logsinferred
Code Signing Policy Modification Through Built-in toolsinferred
Command Execution via ForFilesinferred
Command Execution via SolarWinds Processinferred
Command Obfuscation via Unicode Modifier Lettersinferred
Command Shell Activity Started via RunDLL32inferred
Command and Scripting Interpreter via Windows Scriptsinferred
Conhost Spawned By Suspicious Parent Processinferred
Control Panel Process with Unusual Argumentsinferred
Credential Access via TruffleHog Executioninferred
Credential Acquisition via Registry Hive Dumpinginferred
Curl or Wget Spawned via Node.jsinferred
Data Encrypted via OpenSSL Utilityinferred
Delete Volume USN Journal with Fsutilinferred
Disable Windows Event and Security Logs Using Built-in Toolsinferred
Disable Windows Firewall Rules via Netshinferred
Disabling Windows Defender Security Settings via PowerShellinferred
Enable Host Network Discovery via Netshinferred
Encrypting Files with WinRar or 7zinferred
Enumerating Domain Trusts via DSQUERY.EXEinferred
Enumerating Domain Trusts via NLTEST.EXEinferred
Enumeration Command Spawned via WMIPrvSEinferred
Execution from Unusual Directory - Command Lineinferred
Execution of COM object via Xwizardinferred
Execution of Persistent Suspicious Programinferred
Execution via GitHub Actions Runnerinferred
Execution via MSSQL xp_cmdshell Stored Procedureinferred
Execution via TSClient Mountpointinferred
Execution via Windows Command Debugging Utilityinferred
Execution via Windows Subsystem for Linuxinferred
Exporting Exchange Mailbox via PowerShellinferred
File with Right-to-Left Override Character (RTLO) Created/Executedinferred
First Time Seen Remote Monitoring and Management Toolinferred
GenAI Process Compiling or Generating Executablesinferred
GenAI Process Performing Encoding/Chunking Prior to Network Activityinferred
GenAI or MCP Server Child Process Executioninferred
Group Policy Discovery via Microsoft GPResult Utilityinferred
High Number of Process and/or Service Terminationsinferred
Host File System Changes via Windows Subsystem for Linuxinferred
IIS HTTP Logging Disabledinferred
ImageLoad via Windows Update Auto Update Clientinferred
Incoming DCOM Lateral Movement via MSHTAinferred
Incoming DCOM Lateral Movement with MMCinferred
Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindowsinferred
Incoming Execution via PowerShell Remotinginferred
Incoming Execution via WinRM Remote Shellinferred
InstallUtil Process Making Network Connectionsinferred
Kubernetes Direct API Request via Curl or Wgetinferred
Local Scheduled Task Creationinferred
Microsoft Build Engine Started an Unusual Processinferred
Microsoft Build Engine Started by a Script Processinferred
Microsoft Build Engine Started by a System Processinferred
Microsoft Build Engine Started by an Office Applicationinferred
Microsoft Build Engine Using an Alternate Nameinferred
Microsoft Exchange Server UM Spawning Suspicious Processesinferred
Microsoft Exchange Worker Spawning Suspicious Processesinferred
Microsoft IIS Connection Strings Decryptioninferred
Microsoft IIS Service Account Password Dumpedinferred
Microsoft Management Console File from Unusual Pathinferred
Modification of Boot Configurationinferred
Mounting Hidden or WebDav Remote Sharesinferred
Mshta Making Network Connectionsinferred
MsiExec Service Child Process With Network Connectioninferred
Multi-Cloud CLI Token and Credential Access Commandsinferred
Multiple Remote Management Tool Vendors on Same Hostinferred
NTDS Dump via Wbadmininferred
NTDS or SAM Database File Copiedinferred
NetSupport Manager Execution from an Unusual Pathinferred
Network Connection via Compiled HTML Fileinferred
Network Connection via MsXslinferred
Network Connection via Registration Utilityinferred
Network Connection via Signed Binaryinferred
New ActiveSyncAllowedDeviceID Added via PowerShellinferred
Newly Seen Commonly Abused Network Scannerinferred
Outbound Scheduled Task Activity via PowerShellinferred
Peripheral Device Discoveryinferred
Persistence via BITS Job Notify Cmdlineinferred
Persistence via TelemetryController Scheduled Task Hijackinferred
Persistence via Update Orchestrator Service Hijackinferred
Persistence via WMI Event Subscriptioninferred
Potential Application Shimming via Sdbinstinferred
Potential CVE-2025-33053 Exploitationinferred
Potential Cookies Theft via Browser Debugginginferred
Potential Credential Access via Trusted Developer Utilityinferred
Potential Credential Access via Windows Utilitiesinferred
Potential DLL Side-Loading via Trusted Microsoft Programsinferred
Potential DNS Tunneling via NsLookupinferred
Potential Data Exfiltration Through Curlinferred
Potential Data Exfiltration via Rcloneinferred
Potential Defense Evasion via CMSTP.exeinferred
Potential EDR-Freeze via WerFaultSecure Abuseinferred
Potential Entra ID PRT Extraction via BrowserCoreinferred
Potential Escalation via Vulnerable MSI Repairinferred
Potential Evasion via Filter Managerinferred
Potential Execution via FileFix Phishing Attackinferred
Potential Exploitation of an Unquoted Service Path Vulnerabilityinferred
Potential Fake CAPTCHA Phishing Attackinferred
Potential File Download via a Headless Browserinferred
Potential File Transfer via Certreqinferred
Potential File Transfer via Curl for Windowsinferred
Potential Foxmail Exploitationinferred
Potential Local NTLM Relay via HTTPinferred
Potential Masquerading as Svchostinferred
Potential Modification of Accessibility Binariesinferred
Potential Notepad Markdown RCE Exploitationinferred
Potential Protocol Tunneling via Cloudflaredinferred
Potential Protocol Tunneling via Yuzeinferred
Potential Remote Desktop Shadowing Activityinferred
Potential Remote Desktop Tunneling Detectedinferred
Potential Remote Install via MsiExecinferred
Potential SSH Reverse Port Forwardinginferred
Potential Secret Scanning via Gitleaksinferred
Potential Traffic Tunneling using QEMUinferred
Potential Tunneling via Tailscaledinferred
Potential Uninstall Entry Concealmentinferred
Potential Veeam Credential Access Commandinferred
Potential WSUS Abuse for Lateral Movementinferred
Potential Windows Error Manager Masqueradinginferred
Privilege Escalation via Named Pipe Impersonationinferred
Process Activity via Compiled HTML Fileinferred
Process Execution from an Unusual Directoryinferred
Program Files Directory Masqueradinginferred
Proxy Execution via Console Window Hostinferred
Proxy Execution via Windows OpenSSHinferred
PsExec Network Connectioninferred
Rare Connection to WebDAV Targetinferred
Remote Desktop Enabled in Windows Firewall by Netshinferred
Remote Desktop File Opened from Suspicious Pathinferred
Remote File Copy to a Hidden Shareinferred
Remote File Download via Desktopimgdownldr Utilityinferred
Remote File Download via MpCmdRuninferred
Remote GitHub Actions Runner Registrationinferred
Remote Management Access Launch After MSI Installinferred
Remotely Started Services via RPCinferred
Renamed Automation Script Interpreterinferred
Renamed Utility Executed with Short Program Nameinferred
Scheduled Task Created by a Windows Scriptinferred
ScreenConnect Server Spawning Suspicious Processesinferred
Script Execution via Microsoft HTML Applicationinferred
Searching for Saved Credentials via VaultCmdinferred
Service Command Lateral Movementinferred
Service DACL Modification via sc.exeinferred
Service Path Modification via sc.exeinferred
Signed Proxy Execution via MS Work Foldersinferred
Suspicious .NET Code Compilationinferred
Suspicious CertUtil Commandsinferred
Suspicious Child Process of PaperCut Server Componentinferred
Suspicious Cmd Execution via WMIinferred
Suspicious Command Prompt Network Connectioninferred
Suspicious DLL Loaded for Persistence or Privilege Escalationinferred
Suspicious Endpoint Security Parent Processinferred
Suspicious Execution from INET Cacheinferred
Suspicious Execution from a Mounted Deviceinferred
Suspicious Execution from a WebDav Shareinferred
Suspicious Execution via Microsoft Office Add-Insinferred
Suspicious Execution via Scheduled Taskinferred
Suspicious Execution via Windows Subsystem for Linuxinferred
Suspicious Execution with NodeJSinferred
Suspicious Explorer Child Processinferred
Suspicious Image Load (taskschd.dll) from MS Officeinferred
Suspicious Instance Metadata Service (IMDS) API Command Line Executioninferred
Suspicious JavaScript Execution via Denoinferred
Suspicious JetBrains TeamCity Child Processinferred
Suspicious MS Office Child Processinferred
Suspicious MS Outlook Child Processinferred
Suspicious Microsoft Antimalware Service Executioninferred
Suspicious Microsoft Diagnostics Wizard Executioninferred
Suspicious Microsoft HTML Application Child Processinferred
Suspicious PDF Reader Child Processinferred
Suspicious Process Creation CallTrace
Suspicious Process Execution via Renamed PsExec Executableinferred
Suspicious RDP ActiveX Client Loadedinferred
Suspicious React Server Child Processinferred
Suspicious ScreenConnect Client Child Processinferred
Suspicious Script Object Executioninferred
Suspicious Shell Execution via Velociraptorinferred
Suspicious WMI Image Load from MS Officeinferred
Suspicious WMIC XSL Script Executioninferred
Suspicious WerFault Child Processinferred
Suspicious Windows Command Shell Argumentsinferred
Suspicious Windows Powershell Argumentsinferred
Suspicious Zoom Child Processinferred
Svchost spawning Cmdinferred
Symbolic Link to Shadow Copy Createdinferred
System File Ownership Changeinferred
System Shells via Servicesinferred
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installerinferred
UAC Bypass Attempt via Windows Directory Masqueradinginferred
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interfaceinferred
UAC Bypass via DiskCleanup Scheduled Task Hijackinferred
UAC Bypass via ICMLuaUtil Elevated COM Interfaceinferred
UAC Bypass via Windows Firewall Snap-In Hijackinferred
Unsigned DLL loaded by DNS Serviceinferred
Unusual Child Process from a System Virtual Processinferred
Unusual Child Process of dns.exeinferred
Unusual Child Processes of RunDLL32inferred
Unusual Execution via Microsoft Common Console Fileinferred
Unusual Network Activity from a Windows System Binaryinferred
Unusual Network Connection via DllHostinferred
Unusual Network Connection via RunDLL32inferred
Unusual Parent Process for cmd.exeinferred
Unusual Parent-Child Relationshipinferred
Unusual Print Spooler Child Processinferred
Unusual Process Execution Path - Alternate Data Streaminferred
Unusual Process Network Connectioninferred
Unusual Service Host Child Process - Childless Serviceinferred
User Account Creationinferred
Volume Shadow Copy Deleted or Resized via VssAdmininferred
Volume Shadow Copy Deletion via PowerShellinferred
Volume Shadow Copy Deletion via WMICinferred
WMI Incoming Lateral Movementinferred
WMIC Remote Commandinferred
WPS Office Exploitation via DLL Hijackinferred
Web Shell Detection: Script Process Child of Common Web Processesinferred
Whoami Process Activityinferred
Windows Defender Exclusions Added via PowerShellinferred
Windows Firewall Disabled via PowerShellinferred
Windows Sandbox with Sensitive Configurationinferred
Windows Script Executing PowerShellinferred
Windows Script Execution from Archiveinferred
Windows Script Interpreter Executing Process via WMIinferred
Windows Server Update Service Spawning Suspicious Processesinferred
Windows Subsystem for Linux Enabled via Dism Utilityinferred
Wireless Credential Dumping using Netsh Commandinferred

Microsoft Sentinel 21

Standards and guidance naming it

Requirement	Relation	Basis
OMB M-26-14: Indicators of compromiseAppendix B item 5(7)	Supports an activity	our analysis: file hashes on process creation
OMB M-26-14: Attack vectors and lateral movementAppendix B item 5(10)	Supports an activity	our analysis: process lineage from initial access
ASD ACSC / CISA et al.: Process creation and command-line auditingBest Practices for Event Logging and Threat Detection (Aug 2024)	Names this event	our analysis: Sysmon 1 satisfies process creation with command line
NSA and ASD: Web shell detection guidanceDetect and Prevent Web Shell Malware (CSI PP-20-0901, April 2020)	Names this event	quoted: Sysmon Event ID 1, web server process spawning children (Appendix F)
ASD ACSC: Web shell guidanceWeb Shells: Threat Awareness and Guidance (2015)	Names this event	quoted: suspicious shell commands by the web server process

EDR events that stand in for it

Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.

Product	Sensor event	Fidelity	Basis
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	ProcessRollup2	Full	pySigma-backend-crowdstrike: Sigma process_creation -> event_simpleName ProcessRollup2, SyntheticProcessRollup2; Sigma taxonomy: process_creation = Sysmon 1
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	SyntheticProcessRollup2	Full	pySigma-backend-crowdstrike: Sigma process_creation -> event_simpleName ProcessRollup2, SyntheticProcessRollup2; Sigma taxonomy: process_creation = Sysmon 1
Microsoft Defender for Endpoint device tables	DeviceProcessEvents	Full	pySigma-backend-kusto: process_creation, Sysmon EventID 1 -> DeviceProcessEvents table (ActionType ProcessCreated)
Elastic Defend endpoint events	process	Full	Elastic Defend process dataset (logs-endpoint.events.process); Elastic rules tag Data Source: Elastic Defend with event.category process