win:other
Other Windows event channels
Channel named in the event key
- Host type
- Windows (workstation, member server, domain controller)
- Techniques
- 18
- Rules listed
- 225
- Events
- 63
Techniques
- T1003.003 NTDS
- T1021.006 Windows Remote Management
- T1036.010 Masquerade Account Name
- T1125 Video Capture
- T1127.002 ClickOnce
- T1137.001 Office Template Macros
- T1137.002 Office Test
- T1137.006 Add-ins
- T1218.014 MMC
- T1490 Inhibit System Recovery
- T1496 Resource Hijacking
- T1498.002 Reflection Amplification
- T1499.002 Service Exhaustion Flood
- T1499.003 Application Exhaustion Flood
- T1547.001 Registry Run Keys / Startup Folder
- T1547.004 Winlogon Helper DLL
- T1606.002 SAML Tokens
- T1669 Wi-Fi Networks
Rules
Splunk 1
Sigma 21
- Certificate Exported From Local Certificate Store by Zach Mathis
- Certificate Request Export to Exchange Webserver by Max Altgelt (Nextron Systems)
- Exchange Set OabVirtualDirectory ExternalUrl Property by Jose Rodriguez @Cyb3rPandaH
- Failed MSExchange Transport Agent Installation by Tobias Michalski (Nextron Systems)
- HybridConnectionManager Service Running by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Loading Diagcab Package From Remote Path by Nasreddine Bencherchali (Nextron Systems)
- MSExchange Transport Agent Installation - Builtin by Tobias Michalski (Nextron Systems)
- Mailbox Export to Exchange Webserver by Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems)
- Microsoft Defender Blocked from Loading Unsigned DLL by Bhabesh Raj
- Mimikatz Use by Florian Roth (Nextron Systems), David ANDRE (additional keywords)
- OpenSSH Server Listening On Socket by mdecrevoisier
- Possible Exploitation of Exchange RCE CVE-2021-42321 by Florian Roth (Nextron Systems), @testanull
- Potential Active Directory Reconnaissance/Enumeration Via LDAP by Adeem Mawani
- ProxyLogon MSExchange OabVirtualDirectory by Florian Roth (Nextron Systems)
- Remove Exported Mailbox from Exchange Webserver by Christian Burkard (Nextron Systems)
- Standard User In High Privileged Group by frack113
- Suspicious Application Installed by Nasreddine Bencherchali (Nextron Systems)
- Sysinternals Tools AppX Versions Execution by Nasreddine Bencherchali (Nextron Systems)
- USB Device Plugged by Florian Roth (Nextron Systems)
- Unsigned Binary Loaded From Suspicious Location by Nasreddine Bencherchali (Nextron Systems)
- Unsigned or Unencrypted SMB Connection to Share Established by Mohamed Abdelghani
Elastic 197
- A scheduled task was created
- Access to a Sensitive LDAP Attribute
- Account Configured with Never-Expiring Password
- Account Password Reset Remotely
- Active Directory Discovery using AdExplorer
- Active Directory Group Modification by SYSTEM
- AdFind Command Activity
- Adding Hidden File Attribute via Attrib
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Attempt to Install or Run Kali Linux via WSL
- Backup Deletion with Wbadmin
- Browser Process Spawned from an Unusual Parent
- Bypass UAC via Event Viewer
- Clearing Windows Console History
- Clearing Windows Event Logs
- Code Signing Policy Modification Through Built-in tools
- Command Execution via ForFiles
- Command Execution via SolarWinds Process
- Command Obfuscation via Unicode Modifier Letters
- Command and Scripting Interpreter via Windows Scripts
- Control Panel Process with Unusual Arguments
- Creation of a DNS-Named Record
- Credential Access via TruffleHog Execution
- Credential Acquisition via Registry Hive Dumping
- Curl or Wget Spawned via Node.js
- Data Encrypted via OpenSSL Utility
- Delegated Managed Service Account Modification by an Unusual User
- Delete Volume USN Journal with Fsutil
- Disable Windows Event and Security Logs Using Built-in Tools
- Disable Windows Firewall Rules via Netsh
- Disabling Windows Defender Security Settings via PowerShell
- Enable Host Network Discovery via Netsh
- Enumerating Domain Trusts via DSQUERY.EXE
- Enumerating Domain Trusts via NLTEST.EXE
- Enumeration Command Spawned via WMIPrvSE
- Enumeration of Administrator Accounts
- Enumeration of Privileged Local Groups Membership
- Execution from Unusual Directory - Command Line
- Execution of COM object via Xwizard
- Execution via GitHub Actions Runner
- Execution via MSSQL xp_cmdshell Stored Procedure
- Execution via TSClient Mountpoint
- Execution via Windows Subsystem for Linux
- Exporting Exchange Mailbox via PowerShell
- First Time Seen Account Performing DCSync
- First Time Seen NewCredentials Logon Process
- First Time Seen Remote Monitoring and Management Tool
- Group Policy Abuse for Privilege Addition
- Group Policy Discovery via Microsoft GPResult Utility
- High Number of Process and/or Service Terminations
- IIS HTTP Logging Disabled
- ImageLoad via Windows Update Auto Update Client
- Interactive Logon by an Unusual Process
- KRBTGT Delegation Backdoor
- Kerberos Pre-authentication Disabled for User
- Kubernetes Direct API Request via Curl or Wget
- LSASS Memory Dump Handle Access
- Microsoft Build Engine Started an Unusual Process
- Microsoft Build Engine Started by a System Process
- Microsoft Build Engine Started by an Office Application
- Microsoft Exchange Server UM Spawning Suspicious Processes
- Microsoft IIS Connection Strings Decryption
- Microsoft IIS Service Account Password Dumped
- Microsoft Management Console File from Unusual Path
- Modification of Boot Configuration
- Modification of the msPKIAccountCredentials
- Mounting Hidden or WebDav Remote Shares
- Multiple Logon Failure Followed by Logon Success
- Multiple Logon Failure from the same Source Address
- Multiple Remote Management Tool Vendors on Same Host
- Multiple Vault Web Credentials Read
- NTDS Dump via Wbadmin
- NTDS or SAM Database File Copied
- New ActiveSyncAllowedDeviceID Added via PowerShell
- Newly Observed RC4 Kerberos Service Ticket Request
- Newly Seen Commonly Abused Network Scanner
- PKINIT Followed by Same-Principal U2U Service Ticket
- Peripheral Device Discovery
- Persistence via TelemetryController Scheduled Task Hijack
- Persistence via Update Orchestrator Service Hijack
- Persistence via WMI Event Subscription
- Potential ADIDNS Poisoning via Wildcard Record Creation
- Potential Account Takeover - Logon from New Source IP
- Potential Account Takeover - Mixed Logon Types
- Potential Active Directory Replication Account Backdoor
- Potential Application Shimming via Sdbinst
- Potential Computer Account NTLM Relay Activity
- Potential Cookies Theft via Browser Debugging
- Potential Credential Access via DCSync
- Potential Credential Access via Windows Utilities
- Potential DNS Tunneling via NsLookup
- Potential Data Exfiltration Through Curl
- Potential Evasion via Filter Manager
- Potential Evasion via Windows Filtering Platform
- Potential Fake CAPTCHA Phishing Attack
- Potential File Download via a Headless Browser
- Potential File Transfer via Certreq
- Potential File Transfer via Curl for Windows
- Potential Foxmail Exploitation
- Potential Kerberos Coercion via DNS-Based SPN Spoofing
- Potential Kerberos Relay Attack against a Computer Account
- Potential LSASS Clone Creation via PssCaptureSnapShot
- Potential Local NTLM Relay via HTTP
- Potential Machine Account Relay Attack via SMB
- Potential NTLM Relay Attack against a Computer Account
- Potential Pass-the-Hash (PtH) Attempt
- Potential Privileged Escalation via SamAccountName Spoofing
- Potential Remote Desktop Tunneling Detected
- Potential Remote Install via MsiExec
- Potential SQL Injection Against Microsoft SQL Server
- Potential SSH Reverse Port Forwarding
- Potential Secret Scanning via Gitleaks
- Potential Shadow Credentials added to AD Object
- Potential Veeam Credential Access Command
- Potential WPAD Spoofing via DNS Record Creation
- Privilege Escalation via Named Pipe Impersonation
- Privileged Accounts Brute Force
- Process Activity via Compiled HTML File
- Process Creation via Secondary Logon
- Process Execution from an Unusual Directory
- Program Files Directory Masquerading
- Protected Storage Service Access via SMB
- Proxy Execution via Console Window Host
- Proxy Execution via Windows OpenSSH
- Quick Assist Full Control Sharing Mode Enabled
- Remote Computer Account DnsHostName Update
- Remote Desktop Enabled in Windows Firewall by Netsh
- Remote Desktop File Opened from Suspicious Path
- Remote File Copy to a Hidden Share
- Remote File Download via Desktopimgdownldr Utility
- Remote File Download via MpCmdRun
- Remote GitHub Actions Runner Registration
- Remote Scheduled Task Creation via RPC
- Remote Windows Service Installed
- Scheduled Task Execution at Scale via GPO
- ScreenConnect Server Spawning Suspicious Processes
- Script Execution via Microsoft HTML Application
- SeDebugPrivilege Enabled by a Suspicious Process
- Searching for Saved Credentials via VaultCmd
- Sensitive Audit Policy Sub-Category Disabled
- Sensitive Privilege SeEnableDelegationPrivilege assigned to a Principal
- Service Control Spawned via Script Interpreter
- Service Creation via Local Kerberos Authentication
- Signed Proxy Execution via MS Work Folders
- Startup/Logon Script added to Group Policy Object
- Suspicious .NET Code Compilation
- Suspicious Access to LDAP Attributes
- Suspicious CertUtil Commands
- Suspicious Child Process of PaperCut Server Component
- Suspicious Cmd Execution via WMI
- Suspicious Endpoint Security Parent Process
- Suspicious Execution from INET Cache
- Suspicious Execution from a WebDav Share
- Suspicious Execution with NodeJS
- Suspicious Instance Metadata Service (IMDS) API Command Line Execution
- Suspicious JetBrains TeamCity Child Process
- Suspicious Kerberos Authentication Ticket Request
- Suspicious MS Office Child Process
- Suspicious MS Outlook Child Process
- Suspicious Microsoft HTML Application Child Process
- Suspicious PDF Reader Child Process
- Suspicious Remote Registry Access via SeBackupPrivilege
- Suspicious SeIncreaseBasePriorityPrivilege Use
- Suspicious Service was Installed in the System
- Suspicious Windows Command Shell Arguments
- Suspicious Windows Powershell Arguments
- Suspicious Zoom Child Process
- Svchost spawning Cmd
- Symbolic Link to Shadow Copy Created
- System File Ownership Change
- System Public IP Discovery via DNS Query
- System Shells via Services
- Temporarily Scheduled Task Creation
- UAC Bypass Attempt via Windows Directory Masquerading
- UAC Bypass via DiskCleanup Scheduled Task Hijack
- Unusual Child Process from a System Virtual Process
- Unusual Child Process of dns.exe
- Unusual Parent-Child Relationship
- Unusual Print Spooler Child Process
- Unusual Scheduled Task Update
- User Account Creation
- User Added to Privileged Group in Active Directory
- User account exposed to Kerberoasting
- Volume Shadow Copy Deleted or Resized via VssAdmin
- Volume Shadow Copy Deletion via PowerShell
- Volume Shadow Copy Deletion via WMIC
- Whoami Process Activity
- Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)
- Windows Defender Exclusions Added via PowerShell
- Windows Event Logs Cleared
- Windows Firewall Disabled via PowerShell
- Windows Script Execution from Archive
- Windows Service Installed via an Unusual Client
- Windows Subsystem for Linux Enabled via Dism Utility
- Wireless Credential Dumping using Netsh Command
- dMSA Account Creation by an Unusual User
Events
Recommended (44)
- 6
- 8001
- 8002
- 8003
- Microsoft-Windows-Application-Experience/Program-Inventory:800Summary of Software Activities
- Microsoft-Windows-Application-Experience/Program-Inventory:903New Application Installation
- Microsoft-Windows-Application-Experience/Program-Inventory:904New Application Installation
- Microsoft-Windows-Application-Experience/Program-Inventory:905Updated Application
- Microsoft-Windows-Application-Experience/Program-Inventory:906Updated Application
- Microsoft-Windows-Application-Experience/Program-Inventory:907Removed Application
- Microsoft-Windows-Application-Experience/Program-Inventory:908Removed Application
- Microsoft-Windows-CertificationAuthority:90CA Permissions Corrupted or Missing
- Microsoft-Windows-Kernel-PnP/Device Configuration:400New Mass Storage Installation
- Microsoft-Windows-Kernel-PnP/Device Configuration:410New Mass Storage Installation
- Microsoft-Windows-LSA/Operational:300Group Assigned to new Session
- Microsoft-Windows-NetworkProfile/Operational:10000Network Connection and Disconnection Status (Wired and Wireless)
- Microsoft-Windows-NetworkProfile/Operational:10001Network Connection and Disconnection Status (Wired and Wireless)
- Microsoft-Windows-USB-USBHUB3-Analytic:43New Device Information
- Microsoft-Windows-WindowsUpdateClient/Operational:20Windows Update Failed
- Microsoft-Windows-WindowsUpdateClient/Operational:24Windows Update Failed
- Microsoft-Windows-WindowsUpdateClient/Operational:25Windows Update Failed
- Microsoft-Windows-WindowsUpdateClient/Operational:31Windows Update Failed
- Microsoft-Windows-WindowsUpdateClient/Operational:34Windows Update Failed
- Microsoft-Windows-WindowsUpdateClient/Operational:35Windows Update Failed
- Microsoft-Windows-WLAN-AutoConfig/Operational:11000Wireless Association Status
- Microsoft-Windows-WLAN-AutoConfig/Operational:11001Wireless Association Status
- Microsoft-Windows-WLAN-AutoConfig/Operational:11002Wireless Association Status
- Microsoft-Windows-WLAN-AutoConfig/Operational:11004Wireless Security Started, Stopped, Successful, or Failed
- Microsoft-Windows-WLAN-AutoConfig/Operational:11005Wireless Security Started, Stopped, Successful, or Failed
- Microsoft-Windows-WLAN-AutoConfig/Operational:11006Wireless Security Started, Stopped, Successful, or Failed
- Microsoft-Windows-WLAN-AutoConfig/Operational:11010Wireless Security Started, Stopped, Successful, or Failed
- Microsoft-Windows-WLAN-AutoConfig/Operational:12011Wireless Authentication Started and Failed
- Microsoft-Windows-WLAN-AutoConfig/Operational:12012Wireless Authentication Started and Failed
- Microsoft-Windows-WLAN-AutoConfig/Operational:12013Wireless Authentication Started and Failed
- Microsoft-Windows-WLAN-AutoConfig/Operational:8000Starting a Wireless connection
- Microsoft-Windows-WLAN-AutoConfig/Operational:8001Successfully connected to a Wireless connection
- Microsoft-Windows-WLAN-AutoConfig/Operational:8002Wireless Connection Failed
- Microsoft-Windows-WLAN-AutoConfig/Operational:8003Disconnect from Wireless connection
- Microsoft-Windows-WLAN-AutoConfig/Operational:8011Starting a Wireless connection
- RemoteAccess:20250RADIUS User assigned IP
- RemoteAccess:20274RADIUS User Authenticated
- RemoteAccess:20275RADIUS User Disconnected
- Setup:1009Hotpatching Failed
- Setup:2Update Packages Installed