Will Any of This Fire?

Palo Alto Unit 42 Threat Research: Tracking TamperedChef Clusters via Certificate and Code Reuse

Your manager forwards a threat report and wants to find out whether any detections would catch this campaign. You've found some that you think might fire and you're curious if there are community rules that could help. This post walks through answering these questions with the site search and assumes you've read the report.

The report describes financially motivated clusters distributing trojanized productivity apps through malvertising. Every first-stage binary carries an OV/EV code-signing certificate bought through shell companies. The apps install as 7-Zip self-extracting archives, profile the host, persist through scheduled tasks or registry Run keys, sleep for weeks, then fetch payloads from campaign domains.

The method

Decompose the report into discrete behaviors, then run each behavior up the ladder. Each step answers a different question.

technique:T1053.005 asks what rules exist for Windows scheduled tasks.
technique:T1053.005 indicator:= shows which indicators those rules check.
The structural and telemetry pivots uses:, excludes:, with:, correlation:, and has: ask whether those rules would fire given this campaign and your telemetry.

The technique tag flatters you

Step one.

technique:T1053.005 returns 110 rules with all query languages represented. Scheduled task persistence coverage looks good.

technique:T1053.005136 results, showing first 3 |

RULEchronicle/MITRE ATT&CK T1053.005 Windows Creation Of Scheduled Task

T1053.005 Scheduled Task/Job: Scheduled Task

Creation of scheduled task using command line

RULEelastic/A scheduled task was created

T1053.005 Scheduled Task/Job: Scheduled Task

Indicates the creation of a scheduled task using Windows event logs. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges.

RULEelastic/At.exe Command Lateral Movement

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies use of at.exe to interact with the task scheduler on remote hosts. Remote task creations, modifications or execution could be indicative of adversary lateral movement.

See all 136 results in live search

Step two.

technique:T1053.005 indicator:*=* shows where those rules anchor. The top indicator is Image ends_with \schtasks.exe with 26 Sigma rules. Other variants use OriginalFileName=schtasks.exe and process_name=schtasks.exe. Many rules rely on schtasks.exe execution or the command line. That would work for some malware clusters. The Trend Micro post cited by Unit 42 captures a literal cmd.exe /c schtasks /Create command.

technique:T1053.005 indicator:*=*200+ results, showing first 10 |

INDICATORImageends_with\schtasks.exe·25 rules (sigma)

sigma Defrag Deactivation sigma HackTool - Default PowerSploit/Empire Scheduled Task Creation sigma Kapeka Backdoor Persistence Activity sigma Potential BearLPE Exploitation sigma Potential Persistence Via Microsoft Compatibility Appraiser

INDICATOROriginalFileNameeqschtasks.exe·22 rules (elastic, sigma, splunk)

elastic Local Scheduled Task Creation elastic Scheduled Task Creation from Suspicious Parent elastic Scheduled Task Creation via Unsigned Parent elastic Suspicious Scheduled Task Creation elastic Suspicious Scheduled Task Creation via Masqueraded XML File

INDICATORprocess_nameeqschtasks.exe·12 rules (elastic, splunk)

elastic Local Scheduled Task Creation elastic Scheduled Task Creation from Suspicious Parent elastic Scheduled Task Creation via Unsigned Parent elastic Suspicious ScreenConnect Client Child Process splunk Scheduled Task Deleted Or Created via CMD

INDICATOREventTypeeqstart·10 rules (elastic)

elastic Potential UAC Bypass via IElevatedFactoryServer elastic Scheduled Task by a Low Reputation Process elastic Scheduled Task Creation by an Unusual Process elastic Scheduled Task Creation from Suspicious Parent elastic Scheduled Task Creation via Unsigned Parent

INDICATORevent.typeeqstart·6 rules (elastic)

elastic At.exe Command Lateral Movement elastic Local Scheduled Task Creation elastic Persistence via TelemetryController Scheduled Task Hijack elastic Suspicious Execution via Scheduled Task elastic Suspicious ScreenConnect Client Child Process

INDICATORprocess_nameeqpowershell.exe·6 rules (elastic)

elastic Local Scheduled Task Creation elastic Outbound Scheduled Task Activity via PowerShell elastic Scheduled Task Created by a Windows Script elastic Scheduled Task Creation by an Unusual Process elastic Scheduled Task Creation via Unsigned Parent

INDICATOREventTypeeqcreation·5 rules (elastic)

elastic Persistence via a Windows Installer elastic Scheduled Task by a Low Reputation Process elastic Scheduled Task Creation by an Unusual Process elastic Scheduled Task from a Browser or Compression Utility Descendant elastic Scheduled Task from a Removable or Mounted ISO Device

INDICATORprocess_nameeqsvchost.exe·5 rules (elastic)

elastic Remote Scheduled Task Creation elastic Scheduled Task by a Low Reputation Process elastic Scheduled Task Creation by an Unusual Process elastic Scheduled Task from a Browser or Compression Utility Descendant elastic Scheduled Task from a Removable or Mounted ISO Device

INDICATORevent.categoryeqprocess·4 rules (elastic)

elastic Outbound Scheduled Task Activity via PowerShell elastic Potential PowerShell HackTool Script by Function Names elastic Scheduled Task Created by a Windows Script elastic Suspicious Image Load (taskschd.dll) from MS Office

INDICATORprocess_nameeqcmd.exe·4 rules (elastic, splunk)

elastic Local Scheduled Task Creation elastic Scheduled Task Creation via Unsigned Parent elastic Suspicious ScreenConnect Client Child Process splunk Possible Lateral Movement PowerShell Spawn

See all 200+ results in live search

Other ways to register a scheduled task do not involve schtasks.exe or its command line. The PowerShell function Register-ScheduledTask invokes CIM/WMI, COM, RPC, and the Task Scheduler service. value:Register-ScheduledTask matches two rules that use it. A G DATA analysis of the AppSuite PDF Editor shows another approach using the Task Scheduler COM API.

value:Register-ScheduledTask2 results |

RULEsigma/Powershell Create Scheduled Task

T1053.005 Scheduled Task/Job: Scheduled Task

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

ScriptBlockText match Register-ScheduledTask

RULEsplunk/Windows PowerShell ScheduleTask

T1053.005 Scheduled Task/Job: Scheduled TaskT1059.001 Command and Scripting Interpreter: PowerShell

The following analytic detects potential malicious activities involving PowerShell's task scheduling cmdlets. It leverages PowerShell Script Block Logging (EventCode 4104) to identify unusual or suspicious use of cmdlets like 'New-ScheduledTask' and 'Set-ScheduledTask'. This activity is significant as attackers often use these cmdlets for persistence and remote execution of malicious code. If confirmed malicious, this could allow attackers to maintain access, deliver additional payloads, or exec...

ScriptBlockText in "*Register-ScheduledTask*"

Step three.

uses:TaskContent matches 10 rules that inspect the task XML in Event ID 4698: A scheduled task was created. This event fires regardless of registration method.

uses:TaskContent10 results, showing first 3 |

RULEsigma/Diamond Sleet APT Scheduled Task Creation

T1053.005 Scheduled Task/Job: Scheduled Task

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

uses: taskcontent

RULEsigma/Kapeka Backdoor Scheduled Task Creation

T1053.005 Scheduled Task/Job: Scheduled Task

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

uses: taskcontent

RULEsigma/Suspicious Scheduled Task Creation

T1053.005 Scheduled Task/Job: Scheduled Task

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

uses: taskcontent

See all 10 results in live search

The lesson is to decompose a technique by the predicates that rules match on.

Telemetry decides whether anything fires

At install time, TamperedChef collects system version, hostname, active browsers, and in some intrusions patch levels, user and domain details, geolocation, and screen size.

technique:T1082,T1016,T1033,T1518 (System Information Discovery, System Network Configuration Discovery, System Owner/User Discovery, Software Discovery) returns 155 rules across all query languages.

technique:T1082,T1016,T1033,T1518200+ results, showing first 3 |

RULEchronicle/Hacktool - WinPEAS Execution Patterns

T1082 System Information Discovery

This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. WinPEAS chec...

RULEchronicle/Local Accounts Discovery

T1033 System Owner/User Discovery

Local accounts, System Owner/User discovery using operating systems utilities

RULEchronicle/MITRE ATT&CK T1033 Recon Successful Logon Enumeration Powershell CISA Report

T1033 System Owner/User Discovery

Detects the use of powershell to enumerate successful logins on a specific host

See all 200+ results in live search

The indicators behind those rules rely on spawned discovery processes, including Image=\systeminfo.exe, process_name=tasklist.exe, CommandLine substrings, and PowerShell cmdlets. value:systeminfo alone returns 41 rules and 10 indicators.

value:systeminfo60 results, showing first 10 |

INDICATORImageends_with\systeminfo.exe·11 rules (sigma)

sigma Execution via stordiag.exe sigma Exploited CVE-2020-10189 Zoho ManageEngine sigma Suspicious Child Process Of Manage Engine ServiceDesk sigma Suspicious Child Process Of SQL Server sigma Suspicious Child Process Of Wermgr.EXE

INDICATORprocess_nameeqsysteminfo.exe·9 rules (elastic)

elastic Binary Masquerading via Untrusted Path elastic Enumeration Command Spawned via WMIPrvSE elastic Potential Masquerading as System32 Executable elastic Suspicious Child Process via Azure VM CustomScript Extension elastic Suspicious JetBrains TeamCity Child Process

INDICATORCommandLinecontainssysteminfo·6 rules (sigma, splunk, kusto)

kusto Detect Suspicious Commands Initiated by Webserver Processes sigma Potential Data Exfiltration Activity Via CommandLine Tools sigma Potential Devil Bait Malware Reconnaissance sigma Potential Exploitation of GoAnywhere MFT Vulnerability sigma Windows Suspicious Child Process from Node.js - React2Shell

INDICATORUrlOriginalcontainssysteminfo·4 rules (kusto)

kusto ApexOne - Commands in Url kusto NGINX - Command in URI kusto Oracle - Command in URI kusto Tomcat - Commands in URI

splunk System Information Discovery - Windows (PowerShell)splunk System Information Discovery - Windows (Sysmon)splunk System Information Discovery - Windows (Windows Event Log)

INDICATORprocess_nameinsysteminfo.exe·3 rules (splunk)

splunk Windows Cmdline Tool Execution From Non-Shell Process splunk Windows MSIExec Spawn Discovery Command splunk Windows Suspicious Child Process Spawned From WebServer

splunk Common Reconnaissance Commands (PowerShell)splunk Common Reconnaissance Commands (Sysmon)

INDICATORCommandLineregex_match

(?i)whoami|systeminfo|ipconfig|arp|nltest|dclist|domain_trusts|tasklist|quser|tasklist|netstat|netsh|driverquery|cmdkey|tracert|net1?(\.exe)?\s+(group|use)($|\s|\.exe)

·2 rules (splunk)

splunk Common Recon Commands in Short Burst (Sysmon)splunk Common Recon Commands in Short Burst (Windows Event Log)

splunk Common Recon Commands in Short Burst (Sysmon)splunk Common Recon Commands in Short Burst (Windows Event Log)

INDICATORprocess_nameregex_match

(?i)\x5c(bash|bitsadmin|cmd|net|netstat|nltest|mshta|ping|powershell|pwsh|regsvr32|rundll32|sh|systeminfo|tasklist|ps|at|schtasks|wsl)\.exe

·2 rules (splunk)

splunk Microsoft SQL Server Suspicious Child Process - Windows (Sysmon)splunk Microsoft SQL Server Suspicious Child Process - Windows (Windows Event Log)

See all 60 results in live search

Whether any of it fires depends on how the malware performs discovery and this isn't covered in the Unit 42 post. However, the G DATA post shows in-process collection through the app's bundled native module (get_sid(), GetPsList()) that probably doesn't use LOLBINs like tasklist.exe. This is a telemetry boundary rather than a detection gap. The Trend Micro post covers a cluster that shells out to powershell.exe running Get-WmiObject Win32_Process to find browser processes and inspects the registry for security products' uninstall strings.

value:Get-WmiObject returns 20 rules and 3 indicators anchored on ScriptBlockText and CommandLine, while the registry recon isn't covered in any rules (value:UninstallString, value:KasperskyLabSetup, etc).

value:Get-WmiObject24 results, showing first 3 |

INDICATORScriptBlockTextcontainsget-wmiobject·7 rules (sigma, splunk)

sigma Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script sigma Powershell Detect Virtualization Environment splunk Get WMIObject Group Discovery with Script Block Logging splunk GetWmiObject Ds Computer with PowerShell Script Block splunk GetWmiObject Ds Group with PowerShell Script Block

INDICATORCommandLinecontainsget-wmiobject·6 rules (sigma, splunk)

sigma Deletion of Volume Shadow Copies via WMI with PowerShell splunk Get WMIObject Group Discovery splunk GetWmiObject Ds Computer with PowerShell splunk GetWmiObject Ds Group with PowerShell splunk GetWmiObject DS User with PowerShell

INDICATORScriptBlockTextcontainsget-wmiobject␣·2 rules (sigma)

sigma Suspicious Get Local Groups Information - PowerShell sigma WMIC Unquoted Services Path Lookup - PowerShell

See all 24 results in live search

value:UninstallStringNo results found |

Run this query in live search

Structural operators can refine your query. technique:T1053.005 uses:CommandLine returns 55 of the 110 scheduled-task rules. technique:T1053.005 -uses:CommandLine returns the other 55. Without command-line auditing, a shop loses half that surface. technique:T1053.005 uses:ParentImage shows only nine rules survive without Sysmon parent attribution. Use uses: and -uses: to audit telemetry dependencies by technique.

technique:T1053.005 uses:CommandLine65 results, showing first 5 |

RULEchronicle/MITRE ATT&CK T1053.005 Windows Creation Of Scheduled Task

T1053.005 Scheduled Task/Job: Scheduled Task

Creation of scheduled task using command line

uses: parentcommandline

RULEelastic/Local Scheduled Task Creation

T1053.005 Scheduled Task/Job: Scheduled Task

Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges.

uses: commandline

RULEelastic/Scheduled Task Creation by an Unusual Process

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies the creation of a scheduled task by an unusual process such as script interpreters or recently dropped unsigned executables. This behavior is consistent with an adversary attempting to establish persistence.

uses: commandline, parentcommandline

RULEelastic/Scheduled Task Creation from Suspicious Parent

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies the creation of a scheduled task from a suspicious parent process. This behavior is consistent with an adversary attempting to establish persistence.

uses: commandline

RULEelastic/Suspicious Execution via Scheduled Task

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage.

uses: commandline

See all 65 results in live search

technique:T1053.005 -uses:CommandLine71 results, showing first 5 |

RULEelastic/A scheduled task was created

T1053.005 Scheduled Task/Job: Scheduled Task

Indicates the creation of a scheduled task using Windows event logs. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges.

RULEelastic/At.exe Command Lateral Movement

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies use of at.exe to interact with the task scheduler on remote hosts. Remote task creations, modifications or execution could be indicative of adversary lateral movement.

RULEelastic/Creation or Modification of a new GPO Scheduled Task or Service

T1053.005 Scheduled Task/Job: Scheduled Task

Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a malicious payload remotely on all or a subset of the domain joined machines.

RULEelastic/Dual Persistence via Startup and Scheduled Task

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies the creation of two persistence items via startup followed by scheduled task by an unsigned executable. Adversaries may use this technique to maintain multiple methods of persistence on an endpoint.

RULEelastic/Outbound Scheduled Task Activity via PowerShell

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks.

See all 71 results in live search

technique:T1053.005 uses:ParentImage13 results, showing first 5 |

RULEelastic/Local Scheduled Task Creation

T1053.005 Scheduled Task/Job: Scheduled Task

Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges.

uses: parentimage

RULEelastic/Scheduled Task Creation by an Unusual Process

T1053.005 Scheduled Task/Job: Scheduled Task

uses: parentimage

RULEelastic/Scheduled Task from a Removable or Mounted ISO Device

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies a process running from a mounted ISO or USB device or its descendants creating a new scheduled task for persistence. Adversaries may use this technique to maintain persistence on an endpoint.

uses: parentimage

RULEelastic/Suspicious Scheduled Task Creation via Masqueraded XML File

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies the creation of a scheduled task using an XML file that does not have a .xml file extension. This behavior is consistent with an adversary attempting to establish persistence in a stealthy manner to evade detection.

uses: parentimage

RULEkusto/Powershell Empire Cmdlets Executed in Command Line

T1053.005 Scheduled Task/Job: Scheduled Task

This query identifies use of PowerShell Empire's cmdlets within the command line data of the PowerShell process, indicating potential use of the post-exploitation tool.

uses: parentimage

See all 13 results in live search

Run keys and browser hijack

There's mention of registry Run key persistence.

technique:T1547.001 (Boot or Logon Autostart Execution) has 84 results

technique:T1547.001121 results, showing first 10 |

RULEchronicle/CurrentControlSet Autorun Keys Modification

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects modification of autostart extensibility point (ASEP) in registry

RULEchronicle/CurrentVersion Autorun Keys Modification

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects modification of autostart extensibility point (ASEP) in registry

RULEchronicle/Direct Autorun Keys Modification

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe

RULEchronicle/Modify User Shell Folders Startup Value

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

RULEchronicle/New RUN Key Pointing to Suspicious Folder

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

RULEchronicle/Potential Suspicious Activity Using SeCEdit

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

RULEchronicle/Session Manager Autorun Keys Modification

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects modification of autostart extensibility point (ASEP) in registry

RULEchronicle/Suspicious Powershell In Registry Run Keys

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects potential PowerShell commands or code within registry run keys

RULEelastic/Dual Persistence via Startup and Scheduled Task

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

RULEelastic/Execution of Persistent Suspicious Program

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage.

See all 121 results in live search

value:CurrentVersion\Run shows 24 rules and 11 indicators

value:CurrentVersion\Run68 results, showing first 10 |

INDICATORTargetObjectwildcardh*\software\microsoft\windows\currentversion\run\*·12 rules (elastic)

elastic Dual Persistence via Startup and Scheduled Task elastic Persistence via a Process from a Removable or Mounted ISO Device elastic Persistence via a Windows Installer elastic Registry or File Modification from Suspicious Memory elastic Startup Persistence by a Low Reputation Process

INDICATORTargetObjectwildcardh*\software\wow6432node\microsoft\windows\currentversion\run\*·11 rules (elastic)

INDICATORTargetObjectwildcardhkey_users\*\software\microsoft\windows\currentversion\run\*·5 rules (elastic)

elastic Persistence via WMI Standard Registry Provider elastic Registry Modification via Microsoft Office elastic Registry Persistence via Microsoft Office Descendant Process elastic Startup or Run Key Registry Modification elastic Suspicious Registry Modification via WMI

INDICATORTargetObjectcontains\software\microsoft\windows\currentversion\run·4 rules (sigma)

sigma Kapeka Backdoor Autorun Persistence sigma New RUN Key Pointing to Suspicious Folder sigma Suspicious PowerShell In Registry Run Keys sigma Suspicious Run Key from Download

INDICATORTargetObjectwildcardhkey_users\*\software\microsoft\windows\currentversion\runonce\*·4 rules (elastic)

elastic Persistence via WMI Standard Registry Provider elastic Registry Modification via Microsoft Office elastic Startup or Run Key Registry Modification elastic Suspicious Registry Modification via WMI

INDICATORTargetObjectwildcardhkey_users\*\software\microsoft\windows\currentversion\runonceex\*·4 rules (elastic)

INDICATORCommandLinecontains\software\microsoft\windows\currentversion\run·3 rules (sigma)

sigma Direct Autorun Keys Modification sigma Kapeka Backdoor Persistence Activity sigma Suspicious Autorun Registry Modified via WMI

INDICATORCommandLinecontains\software\wow6432node\microsoft\windows\currentversion\run·3 rules (sigma)

sigma Direct Autorun Keys Modification sigma Potential Persistence Attempt Via Run Keys Using Reg.EXE sigma Suspicious Autorun Registry Modified via WMI

INDICATORTargetObjectcontains\software\microsoft\windows\currentversion\run\·3 rules (elastic)

elastic Registry Run Key Modified by Unusual Process elastic Registry Run Key Prefixed with Asterisk elastic Script Interpreter Process Writing to Commonly Abused Persistence Locations

INDICATORTargetObjectcontains\software\wow6432node\microsoft\windows\currentversion\run·3 rules (sigma)

sigma New RUN Key Pointing to Suspicious Folder sigma Suspicious PowerShell In Registry Run Keys sigma Suspicious Run Key from Download

See all 68 results in live search

I'm not sure if there are other community rules that would be useful for this threat report. G Data's analysis shows browser hijacking by sending Chromium's Preferences and Secure Preferences files over C2, obtaining modified versions and writing them back - value:*Secure*Preferences* doesn't have any results.

value:*Secure*Preferences*1 result |

RULEelastic/Suspicious Browser Preferences File Modification

T1176.001 Software Extensions: Browser Extensions

Identifies the modification of commonly used browsers settings via Preferences change. Adversaries may install a rogue browser extension or disable certain browser hardening settings to maintain persistence or evade restrictions.

file.name wildcard Secure Preferencesfile.path wildcard ?:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Secure Preferencesfile.path wildcard ?:\users\*\appdata\local\microsoft\edge\user data\default\Secure Preferences

Closing thoughts

Advanced search helps detection engineers, SOC analysts, incident responders, and red teams understand community rules and coverage gaps. If you found it helpful, contribute a new detection to a public rule repository.

I built the event and rule catalogs because the existing sources of documentation were very fragmented and limited. There are maybe 300 events documented on Microsoft Learn in significant detail, with several hundred more documented on Ultimate Windows Security. There are as many as 965 events are recommended for collection by various sources and many of them are only documented in blog posts. I struggled to evaluate their importance for detections, and the large number of public rules and their distribution across different query languages made it harder. I hope this work helps make threat detection more tractable for practitioners.

The site is part of a larger effort to share public information and build community collaboration. It also includes free KQL labs with adversary emulation logs. The labs make this material freely available and encourage people to share useful logs for detection work.

Threat actors are armed with modern tools and moving faster than ever after gaining initial access. My ultimate goal is to convince folks to publish logs with their threat research posts like they do with file hashes. This will help defenders write, validate, and deploy detections in hours instead of days to weeks. I need your help to do this. If you agree its important, talk to decision makers in your org. This will engender goodwill among customers, prospective customers, and prospective talent.

My next major project will involve analysis of modern tools and publication of execution logs (and packet captures when relevant). It is inspired by the JPCERT/CC Tool Analysis Result Sheet and will include new telemetry sources.

Thanks for reading.

References

Palo Alto Unit 42 - Tracking TamperedChef Clusters via Certificate and Code Reuse
Trend Micro - EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks
G DATA - AppSuite PDF Editor Backdoor: A Detailed Technical Analysis
Jonathan Johnson - WMI Internals Part 2