win:sysmon
Sysmon
Channel: Microsoft-Windows-Sysmon/Operational
- Host type
- Windows (workstation, member server, domain controller)
- Cost class
- Free tool
- Techniques
- 424
- Rules listed
- 600 of 3,579
- Events
- 31
Licensing
- License or service
- Sysinternals Sysmon
- What is free
- Download and use
- What costs
- Nothing
- Notes
- Free Sysinternals tool; Linux port MIT-licensed
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Identity used | Supports an activity | our analysis: Sysmon 1 carries the user for every process |
| OMB M-26-14: Anomalous activity | Supports an activity | our analysis: unusual process lineage and network behavior |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted: administrative workstations; user computers (our analysis: Sysmon is the usual way to capture process detail there) |
Techniques
- T1001.001 Junk Data
- T1001.002 Steganography
- T1001.003 Protocol or Service Impersonation
- T1003 OS Credential Dumping
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1003.004 LSA Secrets
- T1003.005 Cached Domain Credentials
- T1005 Data from Local System
- T1006 Direct Volume Access
- T1008 Fallback Channels
- T1010 Application Window Discovery
- T1011 Exfiltration Over Other Network Medium
- T1011.001 Exfiltration Over Bluetooth
- T1012 Query Registry
- T1014 Rootkit
- T1016 System Network Configuration Discovery
- T1016.001 Internet Connection Discovery
- T1016.002 Wi-Fi Discovery
- T1018 Remote System Discovery
- T1020 Automated Exfiltration
- T1021 Remote Services
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1021.003 Distributed Component Object Model
- T1021.005 VNC
- T1021.006 Windows Remote Management
- T1021.008 Direct Cloud VM Connections
- T1025 Data from Removable Media
- T1027 Obfuscated Files or Information
- T1027.001 Binary Padding
- T1027.002 Software Packing
- T1027.003 Steganography
- T1027.004 Compile After Delivery
- T1027.005 Indicator Removal from Tools
- T1027.006 HTML Smuggling
- T1027.007 Dynamic API Resolution
- T1027.008 Stripped Payloads
- T1027.009 Embedded Payloads
- T1027.012 LNK Icon Smuggling
- T1027.013 Encrypted/Encoded File
- T1027.014 Polymorphic Code
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1027.017 SVG Smuggling
- T1027.018 Invisible Unicode
- T1029 Scheduled Transfer
- T1030 Data Transfer Size Limits
- T1033 System Owner/User Discovery
- T1036 Masquerading
- T1036.001 Invalid Code Signature
- T1036.002 Right-to-Left Override
- T1036.003 Rename Legitimate Utilities
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1036.007 Double File Extension
- T1036.008 Masquerade File Type
- T1036.012 Browser Fingerprint
- T1039 Data from Network Shared Drive
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1048 Exfiltration Over Alternative Protocol
- T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1049 System Network Connections Discovery
- T1052 Exfiltration Over Physical Medium
- T1052.001 Exfiltration over USB
- T1053 Scheduled Task/Job
- T1053.002 At
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1055.001 Dynamic-link Library Injection
- T1055.002 Portable Executable Injection
- T1055.003 Thread Execution Hijacking
- T1055.004 Asynchronous Procedure Call
- T1055.005 Thread Local Storage
- T1055.011 Extra Window Memory Injection
- T1055.012 Process Hollowing
- T1055.013 Process Doppelgänging
- T1055.015 ListPlanting
- T1056 Input Capture
- T1056.001 Keylogging
- T1056.002 GUI Input Capture
- T1056.003 Web Portal Capture
- T1056.004 Credential API Hooking
- T1057 Process Discovery
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1059.010 AutoHotKey & AutoIT
- T1059.011 Lua
- T1068 Exploitation for Privilege Escalation
- T1070 Indicator Removal
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.005 Network Share Connection Removal
- T1070.006 Timestomp
- T1070.007 Clear Network Connection History and Configurations
- T1070.008 Clear Mailbox Data
- T1070.009 Clear Persistence
- T1070.010 Relocate Malware
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1071.003 Mail Protocols
- T1071.004 DNS
- T1071.005 Publish/Subscribe Protocols
- T1074 Data Staged
- T1074.001 Local Data Staging
- T1074.002 Remote Data Staging
- T1078 Valid Accounts
- T1078.002 Domain Accounts
- T1080 Taint Shared Content
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1087.003 Email Account
- T1090 Proxy
- T1090.001 Internal Proxy
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1090.004 Domain Fronting
- T1091 Replication Through Removable Media
- T1092 Communication Through Removable Media
- T1095 Non-Application Layer Protocol
- T1098 Account Manipulation
- T1102 Web Service
- T1102.001 Dead Drop Resolver
- T1102.002 Bidirectional Communication
- T1102.003 One-Way Communication
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1110.002 Password Cracking
- T1111 Multi-Factor Authentication Interception
- T1112 Modify Registry
- T1113 Screen Capture
- T1114 Email Collection
- T1114.001 Local Email Collection
- T1114.002 Remote Email Collection
- T1115 Clipboard Data
- T1119 Automated Collection
- T1120 Peripheral Device Discovery
- T1123 Audio Capture
- T1124 System Time Discovery
- T1125 Video Capture
- T1127 Trusted Developer Utilities Proxy Execution
- T1127.001 MSBuild
- T1127.002 ClickOnce
- T1127.003 JamPlus
- T1129 Shared Modules
- T1132 Data Encoding
- T1132.001 Standard Encoding
- T1132.002 Non-Standard Encoding
- T1133 External Remote Services
- T1134 Access Token Manipulation
- T1134.001 Token Impersonation/Theft
- T1134.002 Create Process with Token
- T1135 Network Share Discovery
- T1136 Create Account
- T1136.001 Local Account
- T1136.002 Domain Account
- T1137 Office Application Startup
- T1137.001 Office Template Macros
- T1137.002 Office Test
- T1137.003 Outlook Forms
- T1137.004 Outlook Home Page
- T1137.005 Outlook Rules
- T1137.006 Add-ins
- T1140 Deobfuscate/Decode Files or Information
- T1176 Software Extensions
- T1176.001 Browser Extensions
- T1176.002 IDE Extensions
- T1185 Browser Session Hijacking
- T1187 Forced Authentication
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1195.003 Compromise Hardware Supply Chain
- T1197 BITS Jobs
- T1199 Trusted Relationship
- T1200 Hardware Additions
- T1201 Password Policy Discovery
- T1202 Indirect Command Execution
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1204.003 Malicious Image
- T1204.004 Malicious Copy and Paste
- T1204.005 Malicious Library
- T1205 Traffic Signaling
- T1205.001 Port Knocking
- T1205.002 Socket Filters
- T1210 Exploitation of Remote Services
- T1211 Exploitation for Stealth
- T1212 Exploitation for Credential Access
- T1213.006 Databases
- T1216 System Script Proxy Execution
- T1216.001 PubPrn
- T1216.002 SyncAppvPublishingServer
- T1217 Browser Information Discovery
- T1218 System Binary Proxy Execution
- T1218.001 Compiled HTML File
- T1218.002 Control Panel
- T1218.003 CMSTP
- T1218.004 InstallUtil
- T1218.005 Mshta
- T1218.007 Msiexec
- T1218.008 Odbcconf
- T1218.009 Regsvcs/Regasm
- T1218.010 Regsvr32
- T1218.011 Rundll32
- T1218.012 Verclsid
- T1218.013 Mavinject
- T1218.014 MMC
- T1218.015 Electron Applications
- T1219 Remote Access Tools
- T1219.001 IDE Tunneling
- T1219.002 Remote Desktop Software
- T1220 XSL Script Processing
- T1221 Template Injection
- T1222 File and Directory Permissions Modification
- T1222.001 Windows Permissions
- T1480 Execution Guardrails
- T1480.001 Environmental Keying
- T1480.002 Mutual Exclusion
- T1482 Domain Trust Discovery
- T1484 Domain or Tenant Policy Modification
- T1484.001 Group Policy Modification
- T1484.002 Trust Modification
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1491 Defacement
- T1491.001 Internal Defacement
- T1491.002 External Defacement
- T1495 Firmware Corruption
- T1496 Resource Hijacking
- T1496.001 Compute Hijacking
- T1496.002 Bandwidth Hijacking
- T1497 Virtualization/Sandbox Evasion
- T1497.001 System Checks
- T1497.002 User Activity Based Checks
- T1497.003 Time Based Checks
- T1498 Network Denial of Service
- T1498.001 Direct Network Flood
- T1498.002 Reflection Amplification
- T1499 Endpoint Denial of Service
- T1499.001 OS Exhaustion Flood
- T1499.002 Service Exhaustion Flood
- T1499.003 Application Exhaustion Flood
- T1499.004 Application or System Exploitation
- T1505 Server Software Component
- T1505.001 SQL Stored Procedures
- T1505.002 Transport Agent
- T1505.003 Web Shell
- T1505.004 IIS Components
- T1505.005 Terminal Services DLL
- T1518.001 Security Software Discovery
- T1518.002 Backup Software Discovery
- T1529 System Shutdown/Reboot
- T1531 Account Access Removal
- T1534 Internal Spearphishing
- T1539 Steal Web Session Cookie
- T1542 Pre-OS Boot
- T1542.001 System Firmware
- T1542.002 Component Firmware
- T1542.003 Bootkit
- T1543 Create or Modify System Process
- T1543.003 Windows Service
- T1546 Event Triggered Execution
- T1546.001 Change Default File Association
- T1546.002 Screensaver
- T1546.003 Windows Management Instrumentation Event Subscription
- T1546.007 Netsh Helper DLL
- T1546.008 Accessibility Features
- T1546.009 AppCert DLLs
- T1546.010 AppInit DLLs
- T1546.011 Application Shimming
- T1546.012 Image File Execution Options Injection
- T1546.013 PowerShell Profile
- T1546.015 Component Object Model Hijacking
- T1546.016 Installer Packages
- T1547 Boot or Logon Autostart Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1547.002 Authentication Package
- T1547.003 Time Providers
- T1547.004 Winlogon Helper DLL
- T1547.005 Security Support Provider
- T1547.008 LSASS Driver
- T1547.009 Shortcut Modification
- T1547.010 Port Monitors
- T1547.012 Print Processors
- T1547.014 Active Setup
- T1548 Abuse Elevation Control Mechanism
- T1548.002 Bypass User Account Control
- T1550 Use Alternate Authentication Material
- T1550.002 Pass the Hash
- T1550.003 Pass the Ticket
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1552.002 Credentials in Registry
- T1552.004 Private Keys
- T1552.006 Group Policy Preferences
- T1553 Subvert Trust Controls
- T1553.002 Code Signing
- T1553.003 SIP and Trust Provider Hijacking
- T1553.004 Install Root Certificate
- T1553.005 Mark-of-the-Web Bypass
- T1554 Compromise Host Software Binary
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1555.004 Windows Credential Manager
- T1555.005 Password Managers
- T1556 Modify Authentication Process
- T1556.001 Domain Controller Authentication
- T1556.002 Password Filter DLL
- T1556.005 Reversible Encryption
- T1556.007 Hybrid Identity
- T1556.008 Network Provider DLL
- T1557 Adversary-in-the-Middle
- T1557.002 ARP Cache Poisoning
- T1558 Steal or Forge Kerberos Tickets
- T1558.001 Golden Ticket
- T1558.002 Silver Ticket
- T1558.003 Kerberoasting
- T1558.004 AS-REP Roasting
- T1559 Inter-Process Communication
- T1559.001 Component Object Model
- T1559.002 Dynamic Data Exchange
- T1560 Archive Collected Data
- T1560.001 Archive via Utility
- T1560.002 Archive via Library
- T1560.003 Archive via Custom Method
- T1561 Disk Wipe
- T1561.001 Disk Content Wipe
- T1561.002 Disk Structure Wipe
- T1563 Remote Service Session Hijacking
- T1563.002 RDP Hijacking
- T1564 Hide Artifacts
- T1564.001 Hidden Files and Directories
- T1564.002 Hidden Users
- T1564.003 Hidden Window
- T1564.004 NTFS File Attributes
- T1564.005 Hidden File System
- T1564.006 Run Virtual Instance
- T1564.007 VBA Stomping
- T1564.010 Process Argument Spoofing
- T1564.011 Ignore Process Interrupts
- T1564.012 File/Path Exclusions
- T1565 Data Manipulation
- T1565.001 Stored Data Manipulation
- T1565.002 Transmitted Data Manipulation
- T1565.003 Runtime Data Manipulation
- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1567 Exfiltration Over Web Service
- T1567.001 Exfiltration to Code Repository
- T1567.002 Exfiltration to Cloud Storage
- T1567.003 Exfiltration to Text Storage Sites
- T1567.004 Exfiltration Over Webhook
- T1568 Dynamic Resolution
- T1568.001 Fast Flux DNS
- T1568.002 Domain Generation Algorithms
- T1568.003 DNS Calculation
- T1569 System Services
- T1569.002 Service Execution
- T1570 Lateral Tool Transfer
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
- T1573 Encrypted Channel
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography
- T1574 Hijack Execution Flow
- T1574.001 DLL
- T1574.005 Executable Installer File Permissions Weakness
- T1574.007 Path Interception by PATH Environment Variable
- T1574.008 Path Interception by Search Order Hijacking
- T1574.009 Path Interception by Unquoted Path
- T1574.010 Services File Permissions Weakness
- T1574.011 Services Registry Permissions Weakness
- T1574.012 COR_PROFILER
- T1574.013 KernelCallbackTable
- T1574.014 AppDomainManager
- T1606 Forge Web Credentials
- T1606.001 Web Cookies
- T1611 Escape to Host
- T1614.001 System Language Discovery
- T1615 Group Policy Discovery
- T1620 Reflective Code Loading
- T1622 Debugger Evasion
- T1652 Device Driver Discovery
- T1657 Financial Theft
- T1659 Content Injection
- T1667 Email Bombing
- T1668 Exclusive Control
- T1678 Delay Execution
- T1680 Local Storage Discovery
- T1684 Social Engineering
- T1685 Disable or Modify Tools
- T1685.001 Disable or Modify Windows Event Log
- T1685.003 Modify or Spoof Tool UI
- T1685.005 Clear Windows Event Logs
- T1686 Disable or Modify System Firewall
- T1686.003 Windows Host Firewall
- T1687 Exploitation for Defense Impairment
- T1688 Safe Mode Boot
- T1689 Downgrade Attack
- T1690 Prevent Command History Logging
- T1700 AI-Enabled Exfiltration
Rules
600 of 3,579 rules are listed here: the dataset names at most this many per entry. The counts by vendor are complete.
Sigma 217
- .RDP File Created By Uncommon Application by Nasreddine Bencherchali (Nextron Systems)
- 7Zip Compressing Dump Files by Nasreddine Bencherchali (Nextron Systems)
- AADInternals PowerShell Cmdlets Execution - ProccessCreation by Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
- ADExplorer Writing Complete AD Snapshot Into .dat File by Arnim Rupp (Nextron Systems), Thomas Patzke
- ADFS Database Named Pipe Connection By Uncommon Tool by Roberto Rodriguez @Cyb3rWard0g
- ADS Zone.Identifier Deleted by frack113
- ADS Zone.Identifier Deleted By Uncommon Application by Nasreddine Bencherchali (Nextron Systems)
- ADSI-Cache File Creation By Uncommon Tool by xknow @xknow_infosec, Tim Shelton
- AMSI Disabled via Registry Modification by Swachchhanda Shrawan Poudel (Nextron Systems)
- APT PRIVATELOG Image Load Pattern by Florian Roth (Nextron Systems)
- APT27 - Emissary Panda Activity by Florian Roth (Nextron Systems)
- APT29 2018 Phishing Campaign CommandLine Indicators by Florian Roth (Nextron Systems), @41thexplorer
- APT29 2018 Phishing Campaign File Indicators by @41thexplorer
- APT31 Judgement Panda Activity by Florian Roth (Nextron Systems)
- AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl by Julia Fomina, oscd.community
- AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File by Julia Fomina, oscd.community
- Abusable DLL Potential Sideloading From Suspicious Location by X__Junior (Nextron Systems)
- Abuse of Service Permissions to Hide Services Via Set-Service by Nasreddine Bencherchali (Nextron Systems)
- Abused Debug Privilege by Arbitrary Parent Processes by Semanur Guneysu @semanurtg, oscd.community
- Abusing Print Executable by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative
- Activate Suppression of Windows Security Center Notifications by frack113
- Active Directory Database Snapshot Via ADExplorer by Nasreddine Bencherchali (Nextron Systems)
- Active Directory Structure Export Via Csvde.EXE by Nasreddine Bencherchali (Nextron Systems)
- Active Directory Structure Export Via Ldifde.EXE by Nasreddine Bencherchali (Nextron Systems)
- Add Authorized Applications to Microsoft Defender Firewall via Registry by frack113
- Add Debugger Entry To AeDebug For Persistence by Nasreddine Bencherchali (Nextron Systems)
- Add Debugger Entry To Hangs Key For Persistence by Nasreddine Bencherchali (Nextron Systems)
- Add DisallowRun Execution to Registry by frack113
- Add Insecure Download Source To Winget by Nasreddine Bencherchali (Nextron Systems)
- Add New Download Source To Winget by Nasreddine Bencherchali (Nextron Systems)
- Add Port Monitor Persistence in Registry by frack113
- Add Potential Suspicious New Download Source To Winget by Nasreddine Bencherchali (Nextron Systems)
- Add SafeBoot Keys Via Reg Utility by Nasreddine Bencherchali (Nextron Systems)
- Add Windows Capability Via PowerShell Cmdlet by Nasreddine Bencherchali (Nextron Systems)
- AddinUtil.EXE Execution From Uncommon Directory by Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
- Advanced IP Scanner - File Event by @ROxPinTeddy
- Adwind RAT / JRAT by Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
- Adwind RAT / JRAT File Artifact by Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
- AgentExecutor PowerShell Execution by Nasreddine Bencherchali (Nextron Systems), memory-shards
- All Backups Deleted Via Wbadmin.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)
- Allow Exceptions in Microsoft Defender Firewall via Registry by frack113
- Allow RDP Remote Assistance Feature by frack113
- Allow Service Access Using Security Descriptor Tampering Via Sc.EXE by Nasreddine Bencherchali (Nextron Systems)
- Alternate PowerShell Hosts Pipe by Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
- Always Install Elevated MSI Spawned Cmd And Powershell by Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
- Always Install Elevated Windows Installer by Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
- Amsi.DLL Load By Uncommon Process by frack113
- Amsi.DLL Loaded Via LOLBIN Process by Nasreddine Bencherchali (Nextron Systems)
- Antivirus Filter Driver Disallowed On Dev Drive - Registry by @kostastsale, Nasreddine Bencherchali (Nextron Systems)
- Anydesk Temporary Artefact by frack113
- AppX Package Installation Attempts Via AppInstaller.EXE by frack113
- Application Removed Via Wmic.EXE by frack113
- Application Termination Attempt via Wmic.EXE by Nasreddine Bencherchali (Nextron Systems)
- Arbitrary Binary Execution Using GUP Utility by Nasreddine Bencherchali (Nextron Systems)
- Arbitrary Command Execution Using WSL by oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)
- Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE by Beyu Denis, oscd.community
- Arbitrary File Download Via ConfigSecurityPolicy.EXE by frack113
- Arbitrary File Download Via GfxDownloadWrapper.EXE by Victor Sergeev, oscd.community
- Arbitrary File Download Via IMEWDBLD.EXE by Swachchhanda Shrawan Poudel
- Arbitrary File Download Via MSEDGE_PROXY.EXE by Swachchhanda Shrawan Poudel
- Arbitrary File Download Via MSOHTMED.EXE by Nasreddine Bencherchali (Nextron Systems)
- Arbitrary File Download Via MSPUB.EXE by Nasreddine Bencherchali (Nextron Systems)
- Arbitrary File Download Via PresentationHost.EXE by Nasreddine Bencherchali (Nextron Systems)
- Arbitrary File Download Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
- Arbitrary MSI Download Via Devinit.EXE by Florian Roth (Nextron Systems)
- Arbitrary Shell Command Execution Via Settingcontent-Ms by Sreeman
- Aruba Network Service Potential DLL Sideloading by Nasreddine Bencherchali (Nextron Systems)
- AspNetCompiler Execution by frack113
- Assembly DLL Creation Via AspNetCompiler by Nasreddine Bencherchali (Nextron Systems)
- Assembly Loading Via CL_LoadAssembly.ps1 by frack113, Nasreddine Bencherchali (Nextron Systems)
- Atbroker Registry Change by Mateusz Wydra, oscd.community
- Attempts of Kerberos Coercion Via DNS SPN Spoofing by Swachchhanda Shrawan Poudel (Nextron Systems)
- Audio Capture via PowerShell by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)
- Audio Capture via SoundRecorder by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
- Audit Policy Tampering Via Auditpol by Janantha Marasinghe (https://github.com/blueteam0ps)
- Audit Policy Tampering Via NT Resource Kit Auditpol by Nasreddine Bencherchali (Nextron Systems)
- Automated Collection Command Prompt by frack113
- Axios NPM Compromise File Creation Indicators - Windows by Swachchhanda Shrawan Poudel (Nextron Systems)
- Axios NPM Compromise Indicators - Windows by Swachchhanda Shrawan Poudel (Nextron Systems)
- BITS Client BitsProxy DLL Loaded By Uncommon Process by UnicornOfHunt
- BaaUpdate.exe Suspicious DLL Load by Swachchhanda Shrawan Poudel (Nextron Systems)
- Backup Files Deleted by frack113
- Bad Opsec Defaults Sacrificial Processes With Improper Arguments by Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)
- Base64 Encoded PowerShell Command Detected by Florian Roth (Nextron Systems)
- Base64 MZ Header In CommandLine by Nasreddine Bencherchali (Nextron Systems)
- Binary Proxy Execution Via Dotnet-Trace.EXE by Jimmy Bayne (@bohops)
- BitLockerTogo.EXE Execution by Josh Nickels, mttaggart
- Blackbyte Ransomware Registry by frack113
- BloodHound Collection Files by C.J. May
- Blue Mockingbird by Trent Liffick (@tliffick)
- Blue Mockingbird - Registry by Trent Liffick (@tliffick)
- Boot Configuration Tampering Via Bcdedit.EXE by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
- Browser Execution In Headless Mode by Nasreddine Bencherchali (Nextron Systems)
- Browser Started with Remote Debugging by pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- Bypass UAC Using DelegateExecute by frack113
- Bypass UAC Using Event Viewer by frack113
- Bypass UAC Using SilentCleanup Task by frack113, Nextron Systems
- Bypass UAC via CMSTP by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
- Bypass UAC via Fodhelper.exe by E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community
- Bypass UAC via WSReset.exe by E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth
- C# IL Code Compilation Via Ilasm.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)
- CLR DLL Loaded Via Office Applications by Antonlovesdnb
- CMD Shell Output Redirect by frack113
- CMSTP App Paths Registry Key Modification by Nik Seetharaman
- CMSTP Execution Process Access by Nik Seetharaman
- CMSTP Execution Process Creation by Nik Seetharaman
- CMSTP UAC Bypass via COM Object Access by Nik Seetharaman, Christian Burkard (Nextron Systems)
- COLDSTEEL RAT Anonymous User Process Execution by Nasreddine Bencherchali (Nextron Systems)
- COLDSTEEL RAT Cleanup Command Execution by Nasreddine Bencherchali (Nextron Systems)
- COLDSTEEL RAT Service Persistence Execution by X__Junior (Nextron Systems)
- COM Hijack via Sdclt by Omkar Gudhate
- COM Hijacking via TreatAs by frack113
- COM Object Execution via Xwizard.EXE by Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
- COM Object Hijacking Via Modification Of Default System CLSID Default Value by Nasreddine Bencherchali (Nextron Systems)
- CSExec Service File Creation by Nasreddine Bencherchali (Nextron Systems)
- CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry by EagleEye Team, Florian Roth (Nextron Systems), NVISO
- CVE-2021-1675 Print Spooler Exploitation Filename Pattern by Florian Roth (Nextron Systems)
- CVE-2021-26858 Exchange Exploitation by Bhabesh Raj
- CVE-2021-31979 CVE-2021-33771 Exploits by Sittikorn S, frack113
- CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum by Sittikorn S
- CVE-2021-44077 POC Default Dropped File by Nasreddine Bencherchali (Nextron Systems)
- CVE-2022-24527 Microsoft Connected Cache LPE by Florian Roth (Nextron Systems)
- CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) by Andreas Braathen (mnemonic.io)
- CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File by Nasreddine Bencherchali (Nextron Systems)
- CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process by Nasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)
- CVE-2023-40477 Potential Exploitation - .REV File Creation by Nasreddine Bencherchali (Nextron Systems)
- CVE-2024-1708 - ScreenConnect Path Traversal Exploitation by Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress
- CVE-2024-50623 Exploitation Attempt - Cleo by Tanner Filip, Austin Worline, Chad Hudson, Matt Anderson
- Cab File Extraction Via Wusa.EXE by Nasreddine Bencherchali (Nextron Systems)
- Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths by Nasreddine Bencherchali (Nextron Systems)
- Capture Credentials with Rpcping.exe by Julia Fomina, oscd.community
- Certificate Exported Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
- Certificate Exported Via PowerShell by Nasreddine Bencherchali (Nextron Systems)
- Change Default File Association To Executable Via Assoc by Nasreddine Bencherchali (Nextron Systems)
- Change Default File Association Via Assoc by Timur Zinniatullin, oscd.community
- Change PowerShell Policies to an Insecure Level by frack113
- Change User Account Associated with the FAX Service by frack113
- Change Winevt Channel Access Permission Via Registry by frack113
- Change the Fax Dll by frack113
- Changing Existing Service ImagePath Value Via Reg.EXE by frack113
- Chopper Webshell Process Pattern by Florian Roth (Nextron Systems), MSTI (query)
- ChromeLoader Malware Execution by @kostastsale
- Chromium Browser Headless Execution To Mockbin Like Site by X__Junior (Nextron Systems)
- Chromium Browser Instance Executed With Custom Extension by Aedan Russell, frack113, X__Junior (Nextron Systems)
- Classes Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- Clfs.SYS Loaded By Process Located In a Potential Suspicious Location by X__Junior
- ClickOnce Deployment Execution - Dfsvc.EXE Child Process by Nasreddine Bencherchali (Nextron Systems)
- ClickOnce Trust Prompt Tampering by @SerkinValery, Nasreddine Bencherchali (Nextron Systems)
- Cloudflared Portable Execution by Nasreddine Bencherchali (Nextron Systems)
- Cloudflared Quick Tunnel Execution by Sajid Nawaz Khan
- Cloudflared Tunnel Connections Cleanup by Nasreddine Bencherchali (Nextron Systems)
- Cloudflared Tunnel Execution by Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
- Cloudflared Tunnels Related DNS Requests by Nasreddine Bencherchali (Nextron Systems)
- Cmd Launched with Hidden Start Flags to Suspicious Targets by Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)
- Cmd.EXE Missing Space Characters Execution Anomaly by Florian Roth (Nextron Systems)
- CobaltStrike Load by Rundll32 by Wojciech Lesicki
- CobaltStrike Named Pipe by Florian Roth (Nextron Systems), Wojciech Lesicki
- CobaltStrike Named Pipe Pattern Regex by Florian Roth (Nextron Systems)
- CobaltStrike Named Pipe Patterns by Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)
- Code Execution via Pcwutl.dll by Julia Fomina, oscd.community
- CodePage Modification Via MODE.COM by Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk
- CodePage Modification Via MODE.COM To Russian Language by Joseliyo Sanchez, @Joseliyo_Jstnk
- Command Executed Via Run Dialog Box - Registry by Ahmed Farouk, Nasreddine Bencherchali
- Command Line Execution with Suspicious URL and AppData Strings by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
- Common Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)
- Communication To LocaltoNet Tunneling Service Initiated by Andreas Braathen (mnemonic.io)
- Communication To Ngrok Tunneling Service Initiated by Florian Roth (Nextron Systems)
- Communication To Uncommon Destination Ports by Florian Roth (Nextron Systems)
- Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791) by X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
- Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788) by Swachchhanda Shrawan Poudel (Nextron Systems)
- Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790) by Swachchhanda Shrawan Poudel (Nextron Systems)
- Compress Data and Lock With Password for Exfiltration With 7-ZIP by frack113
- Compress Data and Lock With Password for Exfiltration With WINZIP by frack113
- Compressed File Creation Via Tar.EXE by Nasreddine Bencherchali (Nextron Systems), AdmU3
- Compressed File Extraction Via Tar.EXE by AdmU3
- Computer Discovery And Export Via Get-ADComputer Cmdlet by Nasreddine Bencherchali (Nextron Systems)
- Computer Password Change Via Ksetup.EXE by Nasreddine Bencherchali (Nextron Systems)
- Computer System Reconnaissance Via Wmic.EXE by Nasreddine Bencherchali (Nextron Systems)
- Conhost Spawned By Uncommon Parent Process by Tim Rauch, Elastic (idea)
- Conhost.exe CommandLine Path Traversal by Nasreddine Bencherchali (Nextron Systems)
- Console CodePage Lookup Via CHCP by _pete_0, TheDFIRReport
- Conti NTDS Exfiltration Command by Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
- Conti Volume Shadow Listing by Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
- Control Panel Items by Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)
- ConvertTo-SecureString Cmdlet Usage Via CommandLine by Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
- Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE by Nasreddine Bencherchali (Nextron Systems)
- Copy From Or To Admin Share Or Sysvol Folder by Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali
- Copy From VolumeShadowCopy Via Cmd.EXE by Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
- Copying Sensitive Files with Credential Data by Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
- CrashControl CrashDump Disabled by Tobias Michalski (Nextron Systems)
- CreateDump Process Dump by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- CreateRemoteThread API and LoadLibrary by Roberto Rodriguez @Cyb3rWard0g
- Created Files by Microsoft Sync Center by elhoim
- Creation Exe for Service with Unquoted Path by frack113
- Creation Of Non-Existent System DLL by Nasreddine Bencherchali (Nextron Systems), fornotes
- Creation Of a Suspicious ADS File Outside a Browser Download by frack113
- Creation of WerFault.exe/Wer.dll in Unusual Folder by frack113
- Creation of a Diagcab by frack113
- Creation of a Local Hidden User Account by Registry by Christian Burkard (Nextron Systems)
- Creation of an Executable by an Executable by frack113
- Cred Dump Tools Dropped Files by Teymur Kheirkhabarov, oscd.community
- CredUI.DLL Loaded By Uncommon Process by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Credential Dumping Activity By Python Based Tool by Bhabesh Raj, Jonhnathan Ribeiro
- Credential Dumping Attempt Via Svchost by Florent Labouyrie
- Credential Dumping Attempt Via WerFault by Florian Roth (Nextron Systems)
- Csc.EXE Execution Form Potentially Suspicious Parent by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
- Cscript/Wscript Potentially Suspicious Child Process by Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86')
- Cscript/Wscript Uncommon Script Extension Execution by Nasreddine Bencherchali (Nextron Systems)
- Curl Download And Execute Combination by Sreeman, Nasreddine Bencherchali (Nextron Systems)
- Curl File Upload To File Sharing Websites by Swachchhanda Shrawan Poudel (Nextron Systems)
- Curl Web Request With Potential Custom User-Agent by Nasreddine Bencherchali (Nextron Systems)
- Curl.EXE Execution by Florian Roth (Nextron Systems)
- Curl.EXE Execution With Custom UserAgent by frack113
- CurrentControlSet Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- CurrentVersion NT Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- Custom File Open Handler Executes PowerShell by CD_R0M_
Elastic 349
- Accessing Outlook Data Files
- Account Discovery Command via SYSTEM Account
- Active Directory Discovery using AdExplorer
- AdFind Command Activity
- Adding Hidden File Attribute via Attrib
- Alternate Data Stream Creation/Execution at Volume Root Directory
- Attempt to Establish VScode Remote Tunnel
- Attempt to Install or Run Kali Linux via WSL
- Attempted Private Key Access
- AzCopy or Azure Storage Explorer Usage on Unusual Host
- Azure Run Command Script Child Process
- Backup Deletion with Wbadmin
- Binary Content Copy via Cmd.exe
- Bitsadmin Activity
- Browser Extension Install
- Browser Process Spawned from an Unusual Parent
- Bypass UAC via Event Viewer
- Clearing Windows Console History
- Clearing Windows Event Logs
- Code Signing Policy Modification Through Built-in tools
- Code Signing Policy Modification Through Registry
- Command Execution via ForFiles
- Command Execution via SolarWinds Process
- Command Obfuscation via Unicode Modifier Letters
- Command Shell Activity Started via RunDLL32
- Command and Scripting Interpreter via Windows Scripts
- Conhost Spawned By Suspicious Parent Process
- Connection to Common Large Language Model Endpoints
- Connection to Commonly Abused Free SSL Certificate Providers
- Control Panel Process with Unusual Arguments
- Creation of SettingContent-ms Files
- Creation of a Hidden Local User Account
- Creation or Modification of Domain Backup DPAPI private key
- Creation or Modification of Root Certificate
- Creation or Modification of a new GPO Scheduled Task or Service
- Credential Access via TruffleHog Execution
- Credential Acquisition via Registry Hive Dumping
- Curl or Wget Spawned via Node.js
- DNS Global Query Block List Modified or Disabled
- DNS-over-HTTPS Enabled via Registry
- Data Encrypted via OpenSSL Utility
- Delete Volume USN Journal with Fsutil
- Disable Windows Event and Security Logs Using Built-in Tools
- Disable Windows Firewall Rules via Netsh
- Disabling Lsa Protection via Registry Modification
- Disabling User Account Control via Registry Modification
- Disabling Windows Defender Security Settings via PowerShell
- Enable Host Network Discovery via Netsh
- Encrypting Files with WinRar or 7z
- Enumerating Domain Trusts via DSQUERY.EXE
- Enumerating Domain Trusts via NLTEST.EXE
- Enumeration Command Spawned via WMIPrvSE
- Executable File Creation with Multiple Extensions
- Execution from Unusual Directory - Command Line
- Execution of COM object via Xwizard
- Execution of Persistent Suspicious Program
- Execution via GitHub Actions Runner
- Execution via MSSQL xp_cmdshell Stored Procedure
- Execution via TSClient Mountpoint
- Execution via Windows Command Debugging Utility
- Execution via Windows Subsystem for Linux
- Execution via local SxS Shared Module
- Exporting Exchange Mailbox via PowerShell
- File Staged in Root Folder of Recycle Bin
- File with Right-to-Left Override Character (RTLO) Created/Executed
- First Time Seen DNS Query to RMM Domain
- First Time Seen Remote Monitoring and Management Tool
- First Time Seen Removable Device
- Full User-Mode Dumps Enabled System-Wide
- GenAI Process Compiling or Generating Executables
- GenAI Process Connection to Suspicious Top Level Domain
- GenAI Process Performing Encoding/Chunking Prior to Network Activity
- GenAI or MCP Server Child Process Execution
- Group Policy Discovery via Microsoft GPResult Utility
- High Command Line Entropy Detected for Privileged Commands
- High Number of Process and/or Service Terminations
- Host File System Changes via Windows Subsystem for Linux
- IIS HTTP Logging Disabled
- Image File Execution Options Injection
- ImageLoad via Windows Update Auto Update Client
- Incoming DCOM Lateral Movement via MSHTA
- Incoming DCOM Lateral Movement with MMC
- Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows
- Incoming Execution via PowerShell Remoting
- Incoming Execution via WinRM Remote Shell
- InstallUtil Process Making Network Connections
- Installation of Custom Shim Databases
- Installation of Security Support Provider
- Kirbi File Creation
- Kubernetes Direct API Request via Curl or Wget
- LSASS Memory Dump Creation
- Lateral Movement via Startup Folder
- Local Account TokenFilter Policy Disabled
- Local Scheduled Task Creation
- MS Office Macro Security Registry Modifications
- Microsoft Build Engine Started an Unusual Process
- Microsoft Build Engine Started by a Script Process
- Microsoft Build Engine Started by a System Process
- Microsoft Build Engine Started by an Office Application
- Microsoft Build Engine Using an Alternate Name
- Microsoft Exchange Server UM Spawning Suspicious Processes
- Microsoft Exchange Server UM Writing Suspicious Files
- Microsoft Exchange Worker Spawning Suspicious Processes
- Microsoft IIS Connection Strings Decryption
- Microsoft IIS Service Account Password Dumped
- Microsoft Management Console File from Unusual Path
- Microsoft Windows Defender Tampering
- Mimikatz Memssp Log File Detected
- Modification of AmsiEnable Registry Key
- Modification of Boot Configuration
- Modification of WDigest Security Provider
- Mounting Hidden or WebDav Remote Shares
- Mshta Making Network Connections
- MsiExec Service Child Process With Network Connection
- Multi-Cloud CLI Token and Credential Access Commands
- Multiple Remote Management Tool Vendors on Same Host
- NTDS Dump via Wbadmin
- NTDS or SAM Database File Copied
- NetSupport Manager Execution from an Unusual Path
- Netsh Helper DLL
- Network Activity to a Suspicious Top Level Domain
- Network Connection via Certutil
- Network Connection via Compiled HTML File
- Network Connection via MsXsl
- Network Connection via Registration Utility
- Network Connection via Signed Binary
- Network Logon Provider Registry Modification
- Network-Level Authentication (NLA) Disabled
- New ActiveSyncAllowedDeviceID Added via PowerShell
- Newly Seen Commonly Abused Network Scanner
- NullSessionPipe Registry Modification
- Office Test Registry Persistence
- Outbound Scheduled Task Activity via PowerShell
- Outlook Home Page Registry Modification
- Peripheral Device Discovery
- Persistence via BITS Job Notify Cmdline
- Persistence via Hidden Run Key Detected
- Persistence via Microsoft Office AddIns
- Persistence via Microsoft Outlook VBA
- Persistence via PowerShell profile
- Persistence via Scheduled Job Creation
- Persistence via TelemetryController Scheduled Task Hijack
- Persistence via Update Orchestrator Service Hijack
- Persistence via WMI Event Subscription
- Persistent Scripts in the Startup Directory
- Port Forwarding Rule Addition
- Potential Application Shimming via Sdbinst
- Potential CVE-2025-33053 Exploitation
- Potential ClickFix Command via Windows Run Dialog
- Potential Cookies Theft via Browser Debugging
- Potential Credential Access via DuplicateHandle in LSASS
- Potential Credential Access via LSASS Memory Dump
- Potential Credential Access via Renamed COM+ Services DLL
- Potential Credential Access via Trusted Developer Utility
- Potential Credential Access via Windows Utilities
- Potential DLL Side-Loading via Trusted Microsoft Programs
- Potential DNS Exfiltration via Excessive Chunked Queries
- Potential DNS Tunneling via NsLookup
- Potential Data Exfiltration Through Curl
- Potential Data Exfiltration via Rclone
- Potential Defense Evasion via CMSTP.exe
- Potential EDR-Freeze via WerFaultSecure Abuse
- Potential Entra ID PRT Extraction via BrowserCore
- Potential Escalation via Vulnerable MSI Repair
- Potential Evasion via Filter Manager
- Potential Execution via FileFix Phishing Attack
- Potential Exploitation of an Unquoted Service Path Vulnerability
- Potential Fake CAPTCHA Phishing Attack
- Potential File Download via a Headless Browser
- Potential File Transfer via Certreq
- Potential File Transfer via Curl for Windows
- Potential FileFix Command via Windows Explorer Address Bar
- Potential Foxmail Exploitation
- Potential IIS Web Shell File Creation
- Potential Kerberos SPN Spoofing via Suspicious DNS Query
- Potential LSASS Memory Dump via PssCaptureSnapShot
- Potential Local NTLM Relay via HTTP
- Potential Masquerading as Svchost
- Potential Modification of Accessibility Binaries
- Potential NetNTLMv1 Downgrade Attack
- Potential Notepad Markdown RCE Exploitation
- Potential Persistence via Time Provider Modification
- Potential Privilege Escalation via Service ImagePath Modification
- Potential Protocol Tunneling via Cloudflared
- Potential Protocol Tunneling via Yuze
- Potential REMCOS Trojan Execution
- Potential Remote Desktop Shadowing Activity
- Potential Remote Desktop Tunneling Detected
- Potential Remote Install via MsiExec
- Potential RemoteMonologue Attack
- Potential SSH Reverse Port Forwarding
- Potential Secret Scanning via Gitleaks
- Potential Secure File Deletion via SDelete Utility
- Potential System Tampering via File Modification
- Potential Timestomp in Executable Files
- Potential Traffic Tunneling using QEMU
- Potential Tunneling via Tailscaled
- Potential Uninstall Entry Concealment
- Potential Veeam Credential Access Command
- Potential WSUS Abuse for Lateral Movement
- Potential Windows Error Manager Masquerading
- Potential privilege escalation via CVE-2022-38028
- PowerShell Script Block Logging Disabled
- Privilege Escalation via Named Pipe Impersonation
- Privilege Escalation via Rogue Named Pipe Impersonation
- Privilege Escalation via Windir Environment Variable
- Process Activity via Compiled HTML File
- Process Execution from an Unusual Directory
- Process Injection by the Microsoft Build Engine
- Program Files Directory Masquerading
- Proxy Execution via Console Window Host
- Proxy Execution via Windows OpenSSH
- PsExec Network Connection
- RDP Enabled via Registry
- Rare Connection to WebDAV Target
- Rare SMB Connection to the Internet
- Registry Persistence via AppCert DLL
- Registry Persistence via AppInit DLL
- Remote Desktop Enabled in Windows Firewall by Netsh
- Remote Desktop File Opened from Suspicious Path
- Remote File Copy to a Hidden Share
- Remote File Download via Desktopimgdownldr Utility
- Remote File Download via MpCmdRun
- Remote File Download via Script Interpreter
- Remote GitHub Actions Runner Registration
- Remote Management Access Launch After MSI Install
- Remote Scheduled Task Creation
- Remotely Started Services via RPC
- Renamed Automation Script Interpreter
- Renamed Utility Executed with Short Program Name
- SIP Provider Modification
- Scheduled Task Created by a Windows Script
- Scheduled Tasks AT Command Enabled
- ScreenConnect Server Spawning Suspicious Processes
- Script Execution via Microsoft HTML Application
- Searching for Saved Credentials via VaultCmd
- Service Command Lateral Movement
- Service DACL Modification via sc.exe
- Service Path Modification
- Service Path Modification via sc.exe
- Signed Proxy Execution via MS Work Folders
- SolarWinds Process Disabling Services via Registry
- Spike in Privileged Command Execution by a User
- Startup Persistence by a Suspicious Process
- Suspicious .NET Code Compilation
- Suspicious Antimalware Scan Interface DLL
- Suspicious CertUtil Commands
- Suspicious Child Process of PaperCut Server Component
- Suspicious Cmd Execution via WMI
- Suspicious Command Prompt Network Connection
- Suspicious DLL Loaded for Persistence or Privilege Escalation
- Suspicious Endpoint Security Parent Process
- Suspicious Execution from INET Cache
- Suspicious Execution from a Mounted Device
- Suspicious Execution from a WebDav Share
- Suspicious Execution via Microsoft Office Add-Ins
- Suspicious Execution via Scheduled Task
- Suspicious Execution via Windows Subsystem for Linux
- Suspicious Execution with NodeJS
- Suspicious Explorer Child Process
- Suspicious Image Load (taskschd.dll) from MS Office
- Suspicious ImagePath Service Creation
- Suspicious Instance Metadata Service (IMDS) API Command Line Execution
- Suspicious JavaScript Execution via Deno
- Suspicious JetBrains TeamCity Child Process
- Suspicious Kerberos Authentication Ticket Request
- Suspicious LSASS Access via MalSecLogon
- Suspicious Lsass Process Access
- Suspicious MS Office Child Process
- Suspicious MS Outlook Child Process
- Suspicious Managed Code Hosting Process
- Suspicious Microsoft Antimalware Service Execution
- Suspicious Microsoft Diagnostics Wizard Execution
- Suspicious Microsoft HTML Application Child Process
- Suspicious PDF Reader Child Process
- Suspicious Print Spooler File Deletion
- Suspicious Print Spooler Point and Print DLL
- Suspicious Process Access via Direct System Call
- Suspicious Process Creation CallTrace
- Suspicious Process Execution via Renamed PsExec Executable
- Suspicious RDP ActiveX Client Loaded
- Suspicious React Server Child Process
- Suspicious ScreenConnect Client Child Process
- Suspicious Script Object Execution
- Suspicious Shell Execution via Velociraptor
- Suspicious Startup Shell Folder Modification
- Suspicious WMI Event Subscription Created
- Suspicious WMI Image Load from MS Office
- Suspicious WMIC XSL Script Execution
- Suspicious WerFault Child Process
- Suspicious Windows Command Shell Arguments
- Suspicious Windows Powershell Arguments
- Suspicious Zoom Child Process
- Svchost spawning Cmd
- Symbolic Link to Shadow Copy Created
- System File Ownership Change
- System Public IP Discovery via DNS Query
- System Shells via Services
- UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
- UAC Bypass Attempt via Privileged IFileOperation COM Interface
- UAC Bypass Attempt via Windows Directory Masquerading
- UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
- UAC Bypass via DiskCleanup Scheduled Task Hijack
- UAC Bypass via ICMLuaUtil Elevated COM Interface
- UAC Bypass via Windows Firewall Snap-In Hijack
- Uncommon Registry Persistence Change
- Unsigned DLL loaded by DNS Service
- Untrusted DLL Loaded by Azure AD Connect Authentication Agent
- Unusual Child Process from a System Virtual Process
- Unusual Child Process of dns.exe
- Unusual Child Processes of RunDLL32
- Unusual Executable File Creation by a System Critical Process
- Unusual Execution via Microsoft Common Console File
- Unusual File Creation - Alternate Data Stream
- Unusual File Operation by dns.exe
- Unusual Network Activity from a Windows System Binary
- Unusual Network Connection via DllHost
- Unusual Network Connection via RunDLL32
- Unusual Parent Process for cmd.exe
- Unusual Parent-Child Relationship
- Unusual Persistence via Services Registry
- Unusual Print Spooler Child Process
- Unusual Process Detected for Privileged Commands by a User
- Unusual Process Execution Path - Alternate Data Stream
- Unusual Process Network Connection
- Unusual Service Host Child Process - Childless Service
- User Account Creation
- Volume Shadow Copy Deleted or Resized via VssAdmin
- Volume Shadow Copy Deletion via PowerShell
- Volume Shadow Copy Deletion via WMIC
- WDAC Policy File by an Unusual Process
- WMI Incoming Lateral Movement
- WMIC Remote Command
- WPS Office Exploitation via DLL Hijack
- Web Shell Detection: Script Process Child of Common Web Processes
- WebServer Access Logs Deleted
- Werfault ReflectDebugger Persistence
- Whoami Process Activity
- Windows Defender Disabled via Registry Modification
- Windows Defender Exclusions Added via PowerShell
- Windows Firewall Disabled via PowerShell
- Windows Sandbox with Sensitive Configuration
- Windows Script Executing PowerShell
- Windows Script Execution from Archive
- Windows Script Interpreter Executing Process via WMI
- Windows Server Update Service Spawning Suspicious Processes
- Windows Subsystem for Linux Distribution Installed
- Windows Subsystem for Linux Enabled via Dism Utility
- Wireless Credential Dumping using Netsh Command
Microsoft Sentinel 34
- AD FS Remote HTTP Network Connection
- ADFS Database Named Pipe Connection
- Audit policy manipulation using auditpol utility
- Base64 encoded Windows process command-lines (Normalized Process Events)
- COM Event System Loading New DLL
- Chia_Crypto_Mining IOC - June 2021
- Credential Dumping Tools - File Artifacts
- DSRM Account Abuse
- Detecting Macro Invoking ShellBrowserWindow COM Objects
- Dumping LSASS Process Into a File
- Email access via active sync
- Europium - Hash and IP IOCs - September 2022
- Gain Code Execution on ADFS Server via Remote WMI Execution
- Lateral Movement via DCOM
- Log4j vulnerability exploit aka Log4Shell IP IOC
- Malware in the recycle bin (Normalized Process Events)
- Mercury - Domain, Hash and IP IOCs - August 2022
- Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events)
- Modification of Accessibility Features
- Potential Fodhelper UAC Bypass (ASIM Version)
- Potential re-named sdelete usage (ASIM Version)
- Prestige ransomware IOCs Oct 2022
- Probable AdFind Recon Tool Usage (Normalized Process Events)
- Registry Persistence via AppCert DLL Modification
- Registry Persistence via AppInit DLLs Modification
- SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events)
- SUNBURST suspicious SolarWinds child processes (Normalized Process Events)
- Sdelete deployed via GPO and run recursively (ASIM Version)
- Solorigate Named Pipe
- Suspicious access of BEC related documents
- WDigest downgrade attack
- Windows Binaries Lolbins Renamed
- Zinc Actor IOCs files - October 2022
- [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022
Events
Minimum (14)
- 1Process creation
- 10ProcessAccess
- 11FileCreate
- 12RegistryEvent (Object create and delete)
- 13RegistryEvent (Value Set)
- 14RegistryEvent (Key and Value Rename)
- 15FileCreateStreamHash
- 17PipeEvent (Pipe Created)
- 22DNSEvent (DNS query)
- 23FileDelete (File Delete archived)
- 3Network connection
- 6Driver loaded
- 7Image loaded
- 8CreateRemoteThread
Recommended (6)
Listed (11)
- 16ServiceConfigurationChange
- 19WmiEvent (WmiEventFilter activity detected)
- 20WmiEvent (WmiEventConsumer activity detected)
- 21WmiEvent (WmiEventConsumerToFilter activity detected)
- 24ClipboardChange (New content in the clipboard)
- 255Error
- 26FileDeleteDetected (File Delete logged)
- 27FileBlockExecutable
- 28FileBlockShredding
- 29FileExecutableDetected
- 4688