edr:crowdstrike
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)
Raw sensor events via Falcon Data Replicator; detections via the Event Stream API
- Host type
- EDR sensors (product telemetry, cross-platform)
- Tier, as a whole
- Recommended
- Cost class
- Paid service
- Techniques
- 0
- Rules listed
- 600 of 811
- Events
- 47
Licensing
- License or service
- CrowdStrike Falcon Insight; Falcon Data Replicator
- What is free
- Detections and the console with the subscription
- What costs
- Raw sensor telemetry export requires FDR, which typically requires a specific license (AWS documentation of the FDR integration); delivered to a CrowdStrike-managed S3 bucket with SQS notifications; customer storage and SIEM ingest are extra
- Notes
- event_simpleName values from the FDR feed
- Vendor page
- https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/crowdstrike-source-setup.html
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Techniques
No ATT&CK analytic names this source.
Rules
600 of 811 rules are listed here: the dataset names at most this many per entry. The counts by vendor are complete.
Splunk 268
- 7zip CommandLine To SMB Share Path
- Add or Set Windows Defender Exclusion
- Advanced IP or Port Scanner Execution
- Allow File And Printing Sharing In Firewall
- Allow Network Discovery In Firewall
- Anomalous usage of 7zip
- Attacker Tools On Endpoint
- BCDEdit Failure Recovery Modification
- BITS Job Persistence
- BITSAdmin Download File
- Bcdedit Command Back To Normal Mode Boot
- CMD Carry Out String Command Parameter
- CMD Echo Pipe - Escalation
- CSC Net On The Fly Compilation
- CertUtil With Decode Argument
- Certutil exe certificate extraction
- Change To Safe Mode With Network Config
- Check Elevated CMD using whoami
- Clear Unallocated Sector Using Cipher App
- Clop Common Exec Parameter
- Conti Common Exec parameter
- Control Loading from World Writable Directory
- Create or delete windows shares using net exe
- Creation of Shadow Copy
- Creation of Shadow Copy with wmic and powershell
- Credential Dumping via Copy Command from Shadow Copy
- Credential Dumping via Symlink to Shadow Copy
- CrowdStrike Falcon Stream Alerts
- Curl Execution with Percent Encoded URL
- DNS Exfiltration Using Nslookup App
- DSQuery Domain Discovery
- Deleting Shadow Copies
- Detect AzureHound Command-Line Arguments
- Detect Certify Command Line Arguments
- Detect HTML Help Spawn Child Process
- Detect HTML Help URL in Command Line
- Detect HTML Help Using InfoTech Storage Handlers
- Detect MSHTA Url in Command Line
- Detect Path Interception By Creation Of program exe
- Detect Prohibited Applications Spawning cmd exe
- Detect PsExec With accepteula Flag
- Detect RClone Command-Line Usage
- Detect RTLO In Process
- Detect Rare Executables
- Detect Regasm Spawning a Process
- Detect Regasm with no Command Line Arguments
- Detect Regsvcs Spawning a Process
- Detect Regsvcs with No Command Line Arguments
- Detect Regsvr32 Application Control Bypass
- Detect Remote Access Software Usage Process
- Detect Rundll32 Inline HTA Execution
- Detect SharpHound Command-Line Arguments
- Detect SharpHound Usage
- Detect Use of cmd exe to Launch Script Interpreters
- Detect mshta inline hta execution
- Disable Logs Using WevtUtil
- Disable Schedule Task
- Disabling Firewall with Netsh
- Domain Account Discovery with Dsquery
- Domain Account Discovery with Wmic
- Domain Controller Discovery with Nltest
- Domain Controller Discovery with Wmic
- Domain Group Discovery With Dsquery
- Domain Group Discovery With Wmic
- Dump LSASS via comsvcs DLL
- Dump LSASS via procdump
- Elevated Group Discovery With Wmic
- Esentutl SAM Copy
- Excessive Attempt To Disable Services
- Excessive Usage Of Cacls App
- Excessive Usage Of Taskkill
- Excessive Usage of NSLOOKUP App
- Excessive distinct processes from Windows Temp
- Excessive number of service control start as disabled
- Excessive number of taskhost processes
- Execute Javascript With Jscript COM CLSID
- Execution of File with Multiple Extensions
- File Download or Read to Pipe Execution
- Firewall Allowed Program Enable
- First Time Seen Child Process of Zoom
- FodHelper UAC Bypass
- Fsutil Zeroing File
- Get ADDefaultDomainPasswordPolicy with Powershell
- Get ADUser with PowerShell
- Get ADUserResultantPasswordPolicy with Powershell
- Get DomainPolicy with Powershell
- Get DomainUser with PowerShell
- Get WMIObject Group Discovery
- Get-DomainTrust with PowerShell
- Get-ForestTrust with PowerShell
- GetAdComputer with PowerShell
- GetAdGroup with PowerShell
- GetCurrent User with PowerShell
- GetDomainComputer with PowerShell
- GetDomainController with PowerShell
- GetDomainGroup with PowerShell
- GetLocalUser with PowerShell
- GetNetTcpconnection with PowerShell
- GetWmiObject DS User with PowerShell
- GetWmiObject Ds Computer with PowerShell
- GetWmiObject Ds Group with PowerShell
- GetWmiObject User Account with PowerShell
- Headless Browser Mockbin or Mocky Request
- Headless Browser Usage
- Hiding Files And Directories With Attrib exe
- Hunting 3CXDesktopApp Software
- ICACLS Grant Command
- Icacls Deny Command
- Impacket Lateral Movement Commandline Parameters
- Impacket Lateral Movement WMIExec Commandline Parameters
- Impacket Lateral Movement smbexec CommandLine Parameters
- Inline PHP Code Execution
- Local Account Discovery With Wmic
- MSBuild Suspicious Spawned By Script Process
- Malicious PowerShell Process - Encoded Command
- Malicious PowerShell Process - Execution Policy Bypass
- Mimikatz PassTheTicket CommandLine Parameters
- Mmc LOLBAS Execution Process Spawn
- Modify ACL permission To Files Or Folder
- Mshta spawning Rundll32 OR Regsvr32 Process
- NLTest Domain Trust Discovery
- Network Connection Discovery With Arp
- Network Connection Discovery With Netstat
- Network Discovery Using Route Windows App
- Nishang PowershellTCPOneLine
- Notepad with no Command Line Arguments
- Ntdsutil Export NTDS
- Permission Modification using Takeown App
- Potential System Network Configuration Discovery Activity
- Potential Telegram API Request Via CommandLine
- PowerShell Get LocalGroup Discovery
- PowerShell Start-BitsTransfer
- Powershell Defender Threat Actions Set to Allow
- Powershell Disable Security Monitoring
- Prevent Automatic Repair Mode using Bcdedit
- Process Execution via WMI
- Process Kill Base On File Path
- Recursive Delete of Directory In Batch CMD
- Reg exe Manipulating Windows Services Registry Keys
- Regsvr32 Silent and Install Param Dll Loading
- Remote Desktop Process Running On System
- Remote Process Instantiation via DCOM and PowerShell
- Remote Process Instantiation via WMI
- Remote Process Instantiation via WMI and PowerShell
- Remote Process Instantiation via WinRM and PowerShell
- Remote Process Instantiation via WinRM and Winrs
- Remote System Discovery with Dsquery
- Remote System Discovery with Wmic
- Remote WMI Command Attempt
- Resize ShadowStorage volume
- Revil Common Exec Parameter
- Rubeus Command Line Parameters
- RunDLL Loading DLL By Ordinal
- Runas Execution in CommandLine
- Rundll32 Control RunDLL Hunt
- Rundll32 Control RunDLL World Writable Directory
- Rundll32 LockWorkStation
- Rundll32 Shimcache Flush
- Ryuk Wake on LAN Command
- SLUI RunAs Elevated
- SLUI Spawning a Process
- Scheduled Task Creation on Remote Endpoint using At
- Scheduled Task Deleted Or Created via CMD
- Scheduled Task Initiation on Remote Endpoint
- Schtasks Run Task On Demand
- Schtasks scheduling job on remote system
- Schtasks used for forcing a reboot
- Script Execution via WMI
- Sdelete Application Execution
- SecretDumps Offline NTDS Dumping Tool
- ServicePrincipalNames Discovery with SetSPN
- Services Escalate Exe
- Services LOLBAS Execution Process Spawn
- Shim Database Installation With Suspicious Parameters
- Single Letter Process On Endpoint
- Spoolsv Spawning Rundll32
- Suspicious Copy on System32
- Suspicious Curl Network Connection
- Suspicious DLLHost no Command Line Arguments
- Suspicious GPUpdate no Command Line Arguments
- Suspicious IcedID Rundll32 Cmdline
- Suspicious MSBuild Spawn
- Suspicious PlistBuddy Usage
- Suspicious Process Executed From Container File
- Suspicious Reg exe Process
- Suspicious Regsvr32 Register Suspicious Path
- Suspicious Rundll32 PluginInit
- Suspicious Rundll32 StartW
- Suspicious Rundll32 dllregisterserver
- Suspicious Rundll32 no Command Line Arguments
- Suspicious SQLite3 LSQuarantine Behavior
- Suspicious Scheduled Task from Public Directory
- Suspicious SearchProtocolHost no Command Line Arguments
- Suspicious microsoft workflow compiler usage
- Suspicious msbuild path
- Suspicious mshta child process
- Suspicious mshta spawn
- Suspicious wevtutil Usage
- System Info Gathering Using Dxdiag Application
- System Information Discovery Detection
- System Processes Run From Unexpected Locations
- System User Discovery With Query
- System User Discovery With Whoami
- USN Journal Deletion
- Uninstall App Using MsiExec
- Unload Sysmon Filter Driver
- Unusually Long Command Line
- User Discovery With Env Vars PowerShell
- Verclsid CLSID Execution
- WBAdmin Delete System Backups
- WMIC XSL Execution via URL
- Wermgr Process Spawned CMD Or Powershell Process
- WinRAR Spawning Shell Application
- WinRM Spawning a Process
- Windows AdFind Exe
- Windows Advanced Installer MSIX with AI_STUBS Execution
- Windows Apache Benchmark Binary
- Windows AppCertDLL Modification Via Command Line
- Windows Application Whitelisting Bypass Attempt via Rundll32
- Windows Archive Collected Data via Rar
- Windows Attempt To Stop Security Service
- Windows Audit Policy Auditing Option Disabled via Auditpol
- Windows Audit Policy Cleared via Auditpol
- Windows Audit Policy Disabled via Auditpol
- Windows Audit Policy Disabled via Legacy Auditpol
- Windows Audit Policy Excluded Category via Auditpol
- Windows Audit Policy Restored via Auditpol
- Windows Audit Policy Security Descriptor Tampering via Auditpol
- Windows AutoIt3 Execution
- Windows Azure Storage Utility Execution Via CLI
- Windows Binary Execution from an Archive
- Windows Binary Proxy Execution Mavinject DLL Injection
- Windows BitLocker Suspicious Command Usage
- Windows Bypass UAC via Pkgmgr Tool
- Windows COM Hijacking InprocServer32 Modification
- Windows Cabinet File Extraction Via Expand
- Windows Cached Domain Credentials Reg Query
- Windows Certutil Root Certificate Addition
- Windows Change File Association Command To Notepad
- Windows Chrome Enable Extension Loading via Command-Line
- Windows Chromium Browser Launched with Small Window Size
- Windows Chromium Browser No Security Sandbox Process
- Windows Chromium Browser with Custom User Data Directory
- Windows Chromium Process Launched with Logging Disabled
- Windows Chromium Process Loaded Extension via Command-Line
- Windows Chromium Process with Disabled Extensions
- Windows Chromium process Launched with Disable Popup Blocking
- Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc
- Windows Cisco Secure Endpoint Unblock File Via Sfc
- Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc
- Windows Cmdline Tool Execution From Non-Shell Process
- Windows Command Obfuscation with Environment Variable Substrings
- Windows Command and Scripting Interpreter Hunting Path Traversal
- Windows Command and Scripting Interpreter Path Traversal Exec
- Windows Compatibility Telemetry Suspicious Child Process
- Windows ConHost with Headless Argument
- Windows Create Local Administrator Account Via Net
- Windows Credential Dumping LSASS Memory Createdump
- Windows Credentials from Password Stores Creation
- Windows Credentials from Password Stores Deletion
- Windows Credentials from Password Stores Query
- Windows Credentials in Registry Reg Query
- Windows Crowdstrike RTR Script Execution
- Windows Curl Download to Suspicious Path
- Windows Curl Upload to Remote Destination
- Windows DISM Remove Defender
- Windows DLL Search Order Hijacking with iscsicpl
- Windows DLL Side-Loading Process Child Of Calc
Elastic 331
- AWS CLI Command with Custom Endpoint URL
- AWS SSM Agent Registered via Hybrid Activation
- AWS SSM Session Manager Child Process Execution
- Access Control List Modification via setfacl
- Active Directory Discovery using AdExplorer
- AdFind Command Activity
- Adding Hidden File Attribute via Attrib
- AppArmor Profile Compilation via apparmor_parser
- Attempt to Clear Kernel Ring Buffer
- Attempt to Clear Logs via Journalctl
- Attempt to Disable Auditd Service
- Attempt to Disable Syslog Service
- Attempt to Establish VScode Remote Tunnel
- Attempt to Install or Run Kali Linux via WSL
- AzCopy or Azure Storage Explorer Usage on Unusual Host
- BPF Program Tampering via bpftool
- BPF Program or Map Load via bpftool
- BPF filter applied using TC
- Backup Deletion with Wbadmin
- Base16 or Base32 Encoding/Decoding Activity
- Base64 Decoded Payload Piped to Interpreter
- Bypass UAC via Event Viewer
- Clearing Windows Console History
- Clearing Windows Event Logs
- Code Signing Policy Modification Through Built-in tools
- Code Signing Policy Modification Through Registry
- Command Execution via ForFiles
- Command Execution via SolarWinds Process
- Command Obfuscation via Unicode Modifier Letters
- Command and Scripting Interpreter via Windows Scripts
- Control Panel Process with Unusual Arguments
- Creation of a Hidden Local User Account
- Creation or Modification of Domain Backup DPAPI private key
- Credential Access via TruffleHog Execution
- Credential Acquisition via Registry Hive Dumping
- CrowdStrike External Alerts
- Cupsd or Foomatic-rip Shell Execution
- Curl or Wget Spawned via Node.js
- DNS Global Query Block List Modified or Disabled
- DNS-over-HTTPS Enabled via Registry
- Data Encrypted via OpenSSL Utility
- Delete Volume USN Journal with Fsutil
- Directory Creation in /bin directory
- Disable Windows Event and Security Logs Using Built-in Tools
- Disable Windows Firewall Rules via Netsh
- Disabling Lsa Protection via Registry Modification
- Disabling User Account Control via Registry Modification
- Disabling Windows Defender Security Settings via PowerShell
- Discovery of Domain Groups
- Docker Socket Enumeration
- ESXI Discovery via Find
- ESXI Discovery via Grep
- ESXI Timestomping using Touch Command
- Enable Host Network Discovery via Netsh
- Enumerating Domain Trusts via DSQUERY.EXE
- Enumerating Domain Trusts via NLTEST.EXE
- Enumeration Command Spawned via WMIPrvSE
- Enumeration of Administrator Accounts
- Executable File Creation with Multiple Extensions
- Executable Masquerading as Kernel Process
- Execution of COM object via Xwizard
- Execution via GitHub Actions Runner
- Execution via MSSQL xp_cmdshell Stored Procedure
- Execution via TSClient Mountpoint
- Execution via Windows Command Debugging Utility
- Execution via Windows Subsystem for Linux
- Execution via local SxS Shared Module
- Exporting Exchange Mailbox via PowerShell
- File Deletion via Shred
- File Transfer or Listener Established via Netcat
- File made Immutable by Chattr
- GRUB Configuration Generation through Built-in Utilities
- Git Hook Child Process
- Git Hook Command Execution
- GitHub Authentication Token Access via Node.js
- Group Policy Discovery via Microsoft GPResult Utility
- High Number of Process Terminations
- Hping Process Activity
- IIS HTTP Logging Disabled
- IPv4/IPv6 Forwarding Activity
- Image File Execution Options Injection
- ImageLoad via Windows Update Auto Update Client
- Initramfs Extraction via CPIO
- Initramfs Unpacking via unmkinitramfs
- Installation of Custom Shim Databases
- Installation of Security Support Provider
- Interactive Terminal Spawned via Perl
- Kernel Instrumentation Discovery via kprobes and tracefs
- Kernel Load or Unload via Kexec Detected
- Kernel Module Removal
- Kirbi File Creation
- Kubectl Apply Pod from URL
- Kubectl Configuration Discovery
- Kubectl Network Configuration Modification
- Kubectl Permission Discovery
- Kubectl Secrets Enumeration Across All Namespaces
- Kubectl Workload and Cluster Discovery
- Kubernetes Direct API Request via Curl or Wget
- Linux Firewall Rule Creation or Modification
- Linux Process Hooking via GDB
- Linux SSH X11 Forwarding
- Linux Telegram API Request
- Linux User Added to Privileged Group
- Linux init (PID 1) Secret Dump via GDB
- Local Account TokenFilter Policy Disabled
- MS Office Macro Security Registry Modifications
- Manual Dracut Execution
- Manual Memory Dumping via Proc Filesystem
- Manual Mount Discovery via /etc/exports or /etc/fstab
- Memory Swap Modification
- Microsoft Build Engine Started by a System Process
- Microsoft Build Engine Started by an Office Application
- Microsoft Build Engine Using an Alternate Name
- Microsoft Exchange Server UM Spawning Suspicious Processes
- Microsoft IIS Connection Strings Decryption
- Microsoft IIS Service Account Password Dumped
- Microsoft Management Console File from Unusual Path
- Microsoft Windows Defender Tampering
- Mimikatz Memssp Log File Detected
- Modification of AmsiEnable Registry Key
- Modification of Boot Configuration
- Mofcomp Activity
- Mounting Hidden or WebDav Remote Shares
- Multiple Remote Management Tool Vendors on Same Host
- NTDS Dump via Wbadmin
- NTDS or SAM Database File Copied
- NetSupport Manager Execution from an Unusual Path
- Netcat Listener Established via rlwrap
- Netsh Helper DLL
- Network Activity to a Suspicious Top Level Domain
- Network-Level Authentication (NLA) Disabled
- New ActiveSyncAllowedDeviceID Added via PowerShell
- Newly Seen Commonly Abused Network Scanner
- Node.js Pre or Post-Install Script Execution
- Nping Process Activity
- NullSessionPipe Registry Modification
- Office Test Registry Persistence
- OpenSSL Password Hash Generation
- Outlook Home Page Registry Modification
- Passwordless Sudo Probing
- Peripheral Device Discovery
- Persistence via Hidden Run Key Detected
- Persistence via Microsoft Office AddIns
- Persistence via Microsoft Outlook VBA
- Persistence via PowerShell profile
- Persistence via TelemetryController Scheduled Task Hijack
- Persistence via WMI Event Subscription
- Pluggable Authentication Module (PAM) Source Download
- Pluggable Authentication Module (PAM) Version Discovery
- Pod or Container Creation with Suspicious Command-Line
- Polkit Version Discovery
- Port Forwarding Rule Addition
- Potential Application Shimming via Sdbinst
- Potential CVE-2025-32463 Nsswitch File Creation
- Potential CVE-2025-32463 Sudo Chroot Execution Attempt
- Potential Chroot Container Escape via Mount
- Potential ClickFix Command via Windows Run Dialog
- Potential Container Escape via Kernel core_pattern Modification
- Potential DLL Side-Loading via Trusted Microsoft Programs
- Potential DNS Exfiltration via Excessive Chunked Queries
- Potential DNS Tunneling via NsLookup
- Potential Data Exfiltration Through Curl
- Potential Data Exfiltration Through Wget
- Potential Data Exfiltration via Rclone
- Potential Data Splitting Detected
- Potential Database Dumping Activity
- Potential Defense Evasion via PRoot
- Potential Disabling of AppArmor
- Potential Disabling of SELinux
- Potential Entra ID PRT Extraction via BrowserCore
- Potential Exploitation of an Unquoted Service Path Vulnerability
- Potential Fake CAPTCHA Phishing Attack
- Potential File Download via a Headless Browser
- Potential File Transfer via Certreq
- Potential File Transfer via Curl for Windows
- Potential FileFix Command via Windows Explorer Address Bar
- Potential Fileless Execution via O_TMPFILE
- Potential Foxmail Exploitation
- Potential Git CVE-2025-48384 Exploitation
- Potential Hex Payload Execution via Command-Line
- Potential Hex Payload Execution via Common Utility
- Potential IIS Web Shell File Creation
- Potential Kerberos SPN Spoofing via Suspicious DNS Query
- Potential Kubectl Masquerading via Unexpected Process
- Potential Linux Backdoor User Account Creation
- Potential Linux Credential Dumping via Unshadow
- Potential Linux Hack Tool Launched
- Potential Linux Tunneling and/or Port Forwarding
- Potential Linux Tunneling and/or Port Forwarding via Command Line
- Potential Linux Tunneling and/or Port Forwarding via SSH Option
- Potential Local NTLM Relay via HTTP
- Potential NetNTLMv1 Downgrade Attack
- Potential Network Scan Executed From Host
- Potential Persistence via Time Provider Modification
- Potential Privilege Escalation through Writable Docker Socket
- Potential Privilege Escalation via Service ImagePath Modification
- Potential Protocol Tunneling via Cloudflared
- Potential Protocol Tunneling via EarthWorm
- Potential Protocol Tunneling via Yuze
- Potential Proxy Execution via Systemd-run
- Potential Remote Desktop Tunneling Detected
- Potential Remote Install via MsiExec
- Potential Reverse Shell via Background Process
- Potential SSH Reverse Port Forwarding
- Potential Secret Scanning via Gitleaks
- Potential Secure File Deletion via SDelete Utility
- Potential Shell via Wildcard Injection Detected
- Potential Sudo Privilege Escalation via CVE-2019-14287
- Potential THC Tool Downloaded
- Potential Telnet Authentication Bypass (CVE-2026-24061)
- Potential Traffic Tunneling using QEMU
- Potential Tunneling via Tailscaled
- Potential Unauthorized Access via Wildcard Injection Detected
- Potential Upgrade of Non-interactive Shell
- Potential Veeam Credential Access Command
- Potential WSUS Abuse for Lateral Movement
- Potential privilege escalation via CVE-2022-38028
- Potentially Suspicious Process Started via tmux or screen
- PowerShell Script Block Logging Disabled
- Printer User (lp) Shell Execution
- Private Key Searching Activity
- Privilege Escalation via Named Pipe Impersonation
- Privilege Escalation via Windir Environment Variable
- Privileged Container Creation with Host Directory Mount
- Process Activity via Compiled HTML File
- Process Backgrounded by Unusual Parent
- Process Capability Enumeration
- Process Started from Process ID (PID) File
- Program Files Directory Masquerading
- Proxy Execution via Console Window Host
- Proxy Execution via Windows OpenSSH
- ProxyChains Activity
- RDP Enabled via Registry
- Rare Connection to WebDAV Target
- Registry Persistence via AppCert DLL
- Registry Persistence via AppInit DLL
- Remote Desktop Enabled in Windows Firewall by Netsh
- Remote Desktop File Opened from Suspicious Path
- Remote File Copy to a Hidden Share
- Remote File Download via Desktopimgdownldr Utility
- Remote File Download via MpCmdRun
- Remote GitHub Actions Runner Registration
- Remote Management Access Launch After MSI Install
- Renamed Automation Script Interpreter
- Renamed Utility Executed with Short Program Name
- SIP Provider Modification
- Scheduled Tasks AT Command Enabled
- ScreenConnect Server Spawning Suspicious Processes
- Script Execution via Microsoft HTML Application
- Searching for Saved Credentials via VaultCmd
- Security File Access via Common Utilities
- Service Control Spawned via Script Interpreter
- Service DACL Modification via sc.exe
- Setcap setuid/setgid Capability Set
- Shared Object Load via LoLBin
- Signed Proxy Execution via MS Work Folders
- Simple HTTP Web Server Creation
- SolarWinds Process Disabling Services via Registry
- Sudo Command Enumeration Detected
- Suspicious .NET Code Compilation
- Suspicious /proc/maps Discovery
- Suspicious APT Package Manager Execution
- Suspicious Antimalware Scan Interface DLL
- Suspicious CertUtil Commands
- Suspicious Child Process of PaperCut Server Component
- Suspicious Cmd Execution via WMI
- Suspicious Content Extracted or Decompressed via Funzip
- Suspicious Dynamic Linker Discovery via od
- Suspicious Execution from Foomatic-rip or Cupsd Parent
- Suspicious Execution from INET Cache
- Suspicious Execution from a WebDav Share
- Suspicious Execution with NodeJS
- Suspicious ImagePath Service Creation
- Suspicious Instance Metadata Service (IMDS) API Command Line Execution
- Suspicious JavaScript Execution via Deno
- Suspicious Kernel Feature Activity
- Suspicious MS Office Child Process
- Suspicious MS Outlook Child Process
- Suspicious Managed Code Hosting Process
- Suspicious Memory grep Activity
- Suspicious Microsoft Antimalware Service Execution
- Suspicious Microsoft Diagnostics Wizard Execution
- Suspicious Microsoft HTML Application Child Process
- Suspicious Mining Process Creation Event
- Suspicious Named Pipe Creation
- Suspicious PDF Reader Child Process
- Suspicious Process Execution via Renamed PsExec Executable
- Suspicious Reading of procfs Syscall File
- Suspicious ScreenConnect Client Child Process
- Suspicious Shell Execution via Velociraptor
- Suspicious Startup Shell Folder Modification
- Suspicious Termination of ESXI Process
- Suspicious Utility Launched via ProxyChains
- Suspicious Windows Command Shell Arguments
- Suspicious Windows Powershell Arguments
- Suspicious Write Attempt to AppArmor Policy Management Files
- Suspicious Zoom Child Process
- Symbolic Link to Shadow Copy Created
- System File Ownership Change
- System Public IP Discovery via DNS Query
- System Shells via Services
- UAC Bypass Attempt via Windows Directory Masquerading
- UAC Bypass via DiskCleanup Scheduled Task Hijack
- Unix Socket Connection
- Unusual Child Process of dns.exe
- Unusual Child Processes of RunDLL32
- Unusual Executable File Creation by a System Critical Process
- Unusual Execution from Kernel Thread (kthreadd) Parent
- Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments
- Unusual Parent-Child Relationship
- Unusual Print Spooler Child Process
- Unusual Process Execution Path - Alternate Data Stream
- Unusual SSHD Child Process
- User Account Creation
- Virtual Machine Fingerprinting
- Volume Shadow Copy Deleted or Resized via VssAdmin
- Volume Shadow Copy Deletion via PowerShell
- Volume Shadow Copy Deletion via WMIC
- WDAC Policy File by an Unusual Process
- Web Server Spawned via Python
- Web Shell Detection: Script Process Child of Common Web Processes
- Werfault ReflectDebugger Persistence
- Windows Defender Exclusions Added via PowerShell
- Windows Firewall Disabled via PowerShell
- Windows Sandbox with Sensitive Configuration
- Windows Script Execution from Archive
- Windows Subsystem for Linux Distribution Installed
- Windows Subsystem for Linux Enabled via Dism Utility
- Wireless Credential Dumping using Netsh Command
- XDG-Open Command Execution
- Yum/DNF Plugin Status Discovery
Microsoft Sentinel 1
Events
Minimum (1)
- ProcessRollup2ProcessRollup2
Recommended (21)
- AsepKeyUpdateAsepKeyUpdate
- AsepValueUpdateAsepValueUpdate
- DnsRequestDnsRequest
- DriverLoadDriverLoad
- NetworkConnectIP4NetworkConnectIP4
- NetworkConnectIP6NetworkConnectIP6
- NetworkReceiveAcceptIP4NetworkReceiveAcceptIP4
- NetworkReceiveAcceptIP6NetworkReceiveAcceptIP6
- RegBinaryValueUpdateRegBinaryValueUpdate
- RegDwordValueUpdateRegDwordValueUpdate
- RegGenericValueUpdateRegGenericValueUpdate
- RegistryOperationDetectInfoRegistryOperationDetectInfo
- RegKeyCreatedRegKeyCreated
- RegKeyDeletedRegKeyDeleted
- RegLinkValueUpdateRegLinkValueUpdate
- RegMultiStringValueUpdateRegMultiStringValueUpdate
- RegQwordValueUpdateRegQwordValueUpdate
- RegStringValueUpdateRegStringValueUpdate
- RegSystemConfigValueUpdateRegSystemConfigValueUpdate
- RegValueDeletedRegValueDeleted
- SyntheticProcessRollup2SyntheticProcessRollup2
Listed (25)
- ClassifiedModuleLoadClassifiedModuleLoad
- CommandHistoryCommandHistory
- HtmlFileWrittenHtmlFileWritten
- IsoFileWrittenIsoFileWritten
- JarFileWrittenJarFileWritten
- JavaScriptFileWrittenJavaScriptFileWritten
- LnkFileWrittenLnkFileWritten
- MachOFileWrittenMachOFileWritten
- MsiFileWrittenMsiFileWritten
- NewExecutableRenamedNewExecutableRenamed
- NewExecutableWrittenNewExecutableWritten
- OfficeFileWrittenOfficeFileWritten
- OleFileWrittenOleFileWritten
- PdfFileWrittenPdfFileWritten
- PEFileWrittenPEFileWritten
- PNGFileWrittenPNGFileWritten
- RtfFileWrittenRtfFileWritten
- ScheduledTaskRegisteredScheduledTaskRegistered
- ScriptControlScanTelemetryScriptControlScanTelemetry
- ScriptFileWrittenScriptFileWritten
- ServiceStartedServiceStarted
- SettingsContentFileWrittenSettingsContentFileWritten
- UserLogonUserLogon
- UserLogonFailed2UserLogonFailed2
- ZipFileWrittenZipFileWritten