Search field:"CommandLine" for all 3658 flagged values with their contributing rules.
Indicator catalog
Two or more production detection rules across Sigma, Elastic, Splunk, Kusto (Sentinel + Defender XDR), and Chronicle (SecOps) flag these 14833 value patterns: process names, file paths, registry keys, and other tokens that rule authors treat as suspicious. Rules from at least two vendors flag 1217 of them; the community-validated IOCs appear below. The catalog unifies field names across vendors ( Values flagged by detection rules from two or more vendors: the highest-confidence IOCs to detect on. The 100 strongest by rule count appear below, grouped by field.Image covers process.executable, NewProcessName, etc.); the eq: / match: / ends_with: prefix shows the operator a rule uses to check a value. Each field below expands to its most-flagged values; for exhaustive lookup, the site search supports field: / value: / kind: operators.Corroborated indicators 100 of 1217
Field Kind Value Vendors Rules aws::errorCodeis_null 3 vendors 50 rules aws::errorMessageis_null 2 vendors 30 rules aws::eventSourceeq iam.amazonaws.com2 vendors 22 rules CommandLinecontains *http*3 vendors 45 rules CommandLinecontains *add*2 vendors 30 rules CommandLinecontains *delete*3 vendors 30 rules CommandLinecontains *create*3 vendors 29 rules CommandLinecontains *\AppData\Local\Temp\*2 vendors 28 rules CommandLinecontains *sudo*3 vendors 24 rules CommandLinecontains *:\Users\Public\*2 vendors 20 rules CommandLinecontains *http://*3 vendors 20 rules CommandLinecontains *https://*3 vendors 20 rules CommandLineis_not_null 3 vendors 23 rules cs-methodeq POST2 vendors 54 rules cs-methodeq GET2 vendors 49 rules Detailseq 0x000000012 vendors 61 rules Detailseq 0x000000002 vendors 41 rules Detailsis_not_null 3 vendors 89 rules EventIDeq 46882 vendors 284 rules EventIDeq 51362 vendors 25 rules EventIDeq 51362 vendors 20 rules EventIDeq 51452 vendors 19 rules EventIDeq 70452 vendors 19 rules EventTypeeq exec2 vendors 37 rules Hashesis_not_null 2 vendors 22 rules Imageends_with *\powershell.exe2 vendors 181 rules Imageends_with *\cmd.exe2 vendors 132 rules Imageends_with *\mshta.exe2 vendors 67 rules Imagestarts_with /tmp/2 vendors 28 rules Imagestarts_with /var/tmp/2 vendors 27 rules Imagestarts_with /dev/shm/2 vendors 25 rules IntegrityLeveleq S-1-16-163844 vendors 31 rules LogonTypeeq 33 vendors 30 rules OriginalFileNameeq PowerShell.EXE3 vendors 134 rules OriginalFileNameeq pwsh.dll3 vendors 115 rules OriginalFileNameeq Cmd.EXE3 vendors 75 rules OriginalFileNameeq WMIC.exe3 vendors 74 rules OriginalFileNameeq RUNDLL32.EXE3 vendors 72 rules OriginalFileNameeq PowerShell_ISE.EXE3 vendors 52 rules OriginalFileNameeq reg.exe3 vendors 41 rules OriginalFileNameeq MSHTA.EXE3 vendors 40 rules OriginalFileNameeq net1.exe3 vendors 39 rules OriginalFileNameeq REGSVR32.EXE3 vendors 37 rules OriginalFileNameeq wscript.exe2 vendors 37 rules OriginalFileNameeq cscript.exe2 vendors 32 rules OriginalFileNameeq schtasks.exe3 vendors 29 rules OriginalFileNameeq sc.exe3 vendors 28 rules OriginalFileNameeq CertUtil.exe3 vendors 26 rules OriginalFileNameeq net.exe3 vendors 25 rules OriginalFileNameeq Curl.exe3 vendors 22 rules OriginalFileNameeq netsh.exe2 vendors 21 rules OriginalFileNameeq InstallUtil.exe3 vendors 19 rules OriginalFileNameeq bitsadmin.exe3 vendors 19 rules parent_process_basenameeq Cmd.exe3 vendors 37 rules parent_process_basenameeq powershell.exe3 vendors 37 rules parent_process_basenameeq EXCEL.EXE2 vendors 28 rules parent_process_basenameeq WmiPrvSE.exe2 vendors 24 rules parent_process_basenameeq mshta.exe2 vendors 24 rules parent_process_basenameeq wscript.exe2 vendors 24 rules process_basenameeq PowerShell.EXE3 vendors 187 rules process_basenameeq RUNDLL32.EXE2 vendors 123 rules process_basenameeq CMD.EXE2 vendors 122 rules process_basenameeq MSHTA.EXE2 vendors 84 rules process_basenameeq WScript.exe3 vendors 84 rules process_basenameeq pwsh.exe2 vendors 78 rules process_basenameeq REGSVR32.EXE2 vendors 74 rules process_basenameeq cscript.exe2 vendors 68 rules process_basenameeq WMIC.exe2 vendors 66 rules process_basenameeq powershell_ise.exe2 vendors 53 rules process_basenameeq CertUtil.exe2 vendors 45 rules process_basenameeq msiexec.exe2 vendors 45 rules process_basenameeq net1.exe2 vendors 40 rules process_basenameeq MSBuild.exe2 vendors 39 rules process_basenameeq InstallUtil.exe2 vendors 36 rules process_basenameeq curl.exe2 vendors 34 rules process_basenameeq sc.exe2 vendors 32 rules process_basenameeq net.exe3 vendors 30 rules process_basenameeq schtasks.exe2 vendors 30 rules process_basenameeq reg.exe3 vendors 28 rules process_basenameeq RegAsm.exe2 vendors 25 rules process_basenameeq bitsadmin.exe3 vendors 25 rules process_basenameeq RegSvcs.exe2 vendors 22 rules process_basenameeq EXPLORER.EXE2 vendors 21 rules process_basenameeq netsh.exe2 vendors 21 rules process_basenameeq svchost.exe2 vendors 21 rules process_basenamein powershell.exe3 vendors 31 rules process_basenamein wscript.exe2 vendors 28 rules process_basenamein Mshta.exe2 vendors 27 rules process_basenamein cmd.exe3 vendors 24 rules process_basenamein cscript.exe2 vendors 24 rules process_basenamein pwsh.exe2 vendors 22 rules process_basenamein bash2 vendors 21 rules process_basenamein dash2 vendors 20 rules src_ipis_not_null 3 vendors 70 rules statuseq Success2 vendors 21 rules TargetFilenameends_with *.exe2 vendors 21 rules typeeq EXECVE2 vendors 37 rules typeeq SYSCALL2 vendors 27 rules useris_not_null 3 vendors 25 rules verbeq create3 vendors 23 rules
979 fields
CommandLine 3658 values
process_basename 1397 values
Search field:"process_basename" for all 1397 flagged values with their contributing rules.
process.args 988 values
Search field:"process.args" for all 988 flagged values with their contributing rules.
Image 732 values
Search field:"Image" for all 732 flagged values with their contributing rules.
TargetFilename 472 values
Search field:"TargetFilename" for all 472 flagged values with their contributing rules.
parent_process_basename 374 values
Search field:"parent_process_basename" for all 374 flagged values with their contributing rules.
QueryName 316 values
Search field:"QueryName" for all 316 flagged values with their contributing rules.
OriginalFileName 268 values
Search field:"OriginalFileName" for all 268 flagged values with their contributing rules.
EventType 221 values
Search field:"EventType" for all 221 flagged values with their contributing rules.
subject.subject 215 values
Search field:"subject.subject" for all 215 flagged values with their contributing rules.
TargetObject 199 values
Search field:"TargetObject" for all 199 flagged values with their contributing rules.
ParentImage 180 values
Search field:"ParentImage" for all 180 flagged values with their contributing rules.
EventID 172 values
Search field:"EventID" for all 172 flagged values with their contributing rules.
file.extension 165 values
Search field:"file.extension" for all 165 flagged values with their contributing rules.
Hashes 150 values
Search field:"Hashes" for all 150 flagged values with their contributing rules.
ImageLoaded 147 values
Search field:"ImageLoaded" for all 147 flagged values with their contributing rules.
ScriptBlockText 143 values
Search field:"ScriptBlockText" for all 143 flagged values with their contributing rules.
Details 117 values
Search field:"Details" for all 117 flagged values with their contributing rules.
ParentCommandLine 116 values
Search field:"ParentCommandLine" for all 116 flagged values with their contributing rules.
DestinationHostname 115 values
Search field:"DestinationHostname" for all 115 flagged values with their contributing rules.
HttpUserAgentOriginal 112 values
Search field:"HttpUserAgentOriginal" for all 112 flagged values with their contributing rules.
Signature 108 values
Search field:"Signature" for all 108 flagged values with their contributing rules.
body.current_thread.text 106 values
Search field:"body.current_thread.text" for all 106 flagged values with their contributing rules.
process_name 105 values
Search field:"process_name" for all 105 flagged values with their contributing rules.
process.parent.args 95 values
Search field:"process.parent.args" for all 95 flagged values with their contributing rules.
aws::eventName 88 values
Search field:"aws::eventName" for all 88 flagged values with their contributing rules.
sender.display_name 84 values
Search field:"sender.display_name" for all 84 flagged values with their contributing rules.
dll.name 81 values
Search field:"dll.name" for all 81 flagged values with their contributing rules.
process.thread.Ext.call_stack_summary 72 values
Search field:"process.thread.Ext.call_stack_summary" for all 72 flagged values with their contributing rules.
Name 71 values
Search field:"Name" for all 71 flagged values with their contributing rules.
client_ip 66 values
Search field:"client_ip" for all 66 flagged values with their contributing rules.
file.name 64 values
Search field:"file.name" for all 64 flagged values with their contributing rules.
data_stream.dataset 63 values
Search field:"data_stream.dataset" for all 63 flagged values with their contributing rules.
Provider_Name 57 values
Search field:"Provider_Name" for all 57 flagged values with their contributing rules.
body.html.raw 56 values
Search field:"body.html.raw" for all 56 flagged values with their contributing rules.
sourcetype 54 values
Search field:"sourcetype" for all 54 flagged values with their contributing rules.
AlertName 53 values
Search field:"AlertName" for all 53 flagged values with their contributing rules.
UrlOriginal 49 values
Search field:"UrlOriginal" for all 49 flagged values with their contributing rules.
EventData 47 values
Search field:"EventData" for all 47 flagged values with their contributing rules.
DestinationPort 47 values
Search field:"DestinationPort" for all 47 flagged values with their contributing rules.
parent_process_name 40 values
Search field:"parent_process_name" for all 40 flagged values with their contributing rules.
src_ip 39 values
Search field:"src_ip" for all 39 flagged values with their contributing rules.
azure_ad::app_id 39 values
Search field:"azure_ad::app_id" for all 39 flagged values with their contributing rules.
OperationName 38 values
Search field:"OperationName" for all 38 flagged values with their contributing rules.
Contents 37 values
Search field:"Contents" for all 37 flagged values with their contributing rules.
user 35 values
Search field:"user" for all 35 flagged values with their contributing rules.
action 35 values
Search field:"action" for all 35 flagged values with their contributing rules.
signature_id 35 values
Search field:"signature_id" for all 35 flagged values with their contributing rules.
event.category 34 values
Search field:"event.category" for all 34 flagged values with their contributing rules.
process.Ext.api.name 34 values
Search field:"process.Ext.api.name" for all 34 flagged values with their contributing rules.
GrantedAccess 34 values
Search field:"GrantedAccess" for all 34 flagged values with their contributing rules.
Operation 32 values
Search field:"Operation" for all 32 flagged values with their contributing rules.
ServiceName 30 values
Search field:"ServiceName" for all 30 flagged values with their contributing rules.
registry_value_name 29 values
Search field:"registry_value_name" for all 29 flagged values with their contributing rules.
dest_hostname 28 values
Search field:"dest_hostname" for all 28 flagged values with their contributing rules.
aws::eventSource 27 values
Search field:"aws::eventSource" for all 27 flagged values with their contributing rules.
TargetImage 26 values
Search field:"TargetImage" for all 26 flagged values with their contributing rules.
file_name 26 values
Search field:"file_name" for all 26 flagged values with their contributing rules.
TaskName 26 values
Search field:"TaskName" for all 26 flagged values with their contributing rules.
CurrentDirectory 24 values
Search field:"CurrentDirectory" for all 24 flagged values with their contributing rules.
UrlCategory 23 values
Search field:"UrlCategory" for all 23 flagged values with their contributing rules.
event.type 21 values
Search field:"event.type" for all 21 flagged values with their contributing rules.
azure_ad::result_type 21 values
Search field:"azure_ad::result_type" for all 21 flagged values with their contributing rules.
query_text 21 values
Search field:"query_text" for all 21 flagged values with their contributing rules.
process.Ext.api.behaviors 20 values
Search field:"process.Ext.api.behaviors" for all 20 flagged values with their contributing rules.
kubernetes.audit.objectRef.resource 20 values
Search field:"kubernetes.audit.objectRef.resource" for all 20 flagged values with their contributing rules.
type 19 values
Search field:"type" for all 19 flagged values with their contributing rules.
user.id 19 values
Search field:"user.id" for all 19 flagged values with their contributing rules.
aws::userAgent 19 values
Search field:"aws::userAgent" for all 19 flagged values with their contributing rules.
aceAccessRights 19 values
Search field:"aceAccessRights" for all 19 flagged values with their contributing rules.
sender.email.domain.root_domain 18 values
Search field:"sender.email.domain.root_domain" for all 18 flagged values with their contributing rules.
Status 18 values
Search field:"Status" for all 18 flagged values with their contributing rules.
length 18 values
Search field:"length" for all 18 flagged values with their contributing rules.
Properties 18 values
Search field:"Properties" for all 18 flagged values with their contributing rules.
dest_ip 17 values
Search field:"dest_ip" for all 17 flagged values with their contributing rules.
c-uri-extension 17 values
Search field:"c-uri-extension" for all 17 flagged values with their contributing rules.
network.http.user_agent 17 values
Search field:"network.http.user_agent" for all 17 flagged values with their contributing rules.
process.args_count 16 values
Search field:"process.args_count" for all 16 flagged values with their contributing rules.
Category 16 values
Search field:"Category" for all 16 flagged values with their contributing rules.
ImagePath 16 values
Search field:"ImagePath" for all 16 flagged values with their contributing rules.
file.Ext.header_bytes 15 values
Search field:"file.Ext.header_bytes" for all 15 flagged values with their contributing rules.
verb 15 values
Search field:"verb" for all 15 flagged values with their contributing rules.
Payload 15 values
Search field:"Payload" for all 15 flagged values with their contributing rules.
sender.email.email 14 values
Search field:"sender.email.email" for all 14 flagged values with their contributing rules.
operationName 14 values
Search field:"operationName" for all 14 flagged values with their contributing rules.
Severity 13 values
Search field:"Severity" for all 13 flagged values with their contributing rules.
kubernetes.audit.verb 13 values
Search field:"kubernetes.audit.verb" for all 13 flagged values with their contributing rules.
cs-uri-query 13 values
Search field:"cs-uri-query" for all 13 flagged values with their contributing rules.
process.parent.thread.Ext.call_stack_summary 13 values
Search field:"process.parent.thread.Ext.call_stack_summary" for all 13 flagged values with their contributing rules.
registry_path 13 values
Search field:"registry_path" for all 13 flagged values with their contributing rules.
event.parameters{}.multiValue{} 13 values
Search field:"event.parameters{}.multiValue{}" for all 13 flagged values with their contributing rules.
process.Ext.effective_parent.name 13 values
Search field:"process.Ext.effective_parent.name" for all 13 flagged values with their contributing rules.
body.links 12 values
Search field:"body.links" for all 12 flagged values with their contributing rules.
data.type 12 values
Search field:"data.type" for all 12 flagged values with their contributing rules.
actionName 12 values
Search field:"actionName" for all 12 flagged values with their contributing rules.
file.Ext.original.name 12 values
Search field:"file.Ext.original.name" for all 12 flagged values with their contributing rules.
Action 12 values
Search field:"Action" for all 12 flagged values with their contributing rules.
regex.icontains 12 values
Search field:"regex.icontains" for all 12 flagged values with their contributing rules.
attachments 11 values
Search field:"attachments" for all 11 flagged values with their contributing rules.
event.dataset 11 values
Search field:"event.dataset" for all 11 flagged values with their contributing rules.
eventType 11 values
Search field:"eventType" for all 11 flagged values with their contributing rules.
RelativeTargetName 11 values
Search field:"RelativeTargetName" for all 11 flagged values with their contributing rules.
ServiceFileName 11 values
Search field:"ServiceFileName" for all 11 flagged values with their contributing rules.
AttributeValue 11 values
Search field:"AttributeValue" for all 11 flagged values with their contributing rules.
BodyContainsWords 11 values
Search field:"BodyContainsWords" for all 11 flagged values with their contributing rules.
SubjectContainsWords 11 values
Search field:"SubjectContainsWords" for all 11 flagged values with their contributing rules.
SubjectOrBodyContainsWords 11 values
Search field:"SubjectOrBodyContainsWords" for all 11 flagged values with their contributing rules.
aws::errorCode 10 values
Search field:"aws::errorCode" for all 10 flagged values with their contributing rules.
process.Ext.token.integrity_level_name 10 values
Search field:"process.Ext.token.integrity_level_name" for all 10 flagged values with their contributing rules.
count 10 values
Search field:"count" for all 10 flagged values with their contributing rules.
ObjectType 10 values
Search field:"ObjectType" for all 10 flagged values with their contributing rules.
message 10 values
Search field:"message" for all 10 flagged values with their contributing rules.
SyslogMessage 10 values
Search field:"SyslogMessage" for all 10 flagged values with their contributing rules.
m365::Target.Type 10 values
Search field:"m365::Target.Type" for all 10 flagged values with their contributing rules.
gcp.audit.request.rules.resources 10 values
Search field:"gcp.audit.request.rules.resources" for all 10 flagged values with their contributing rules.
process.thread.Ext.call_stack_final_user_module.name 9 values
Search field:"process.thread.Ext.call_stack_final_user_module.name" for all 9 flagged values with their contributing rules.
aws::userIdentity.type 9 values
Search field:"aws::userIdentity.type" for all 9 flagged values with their contributing rules.
Roles 9 values
Search field:"Roles" for all 9 flagged values with their contributing rules.
ObjectName 9 values
Search field:"ObjectName" for all 9 flagged values with their contributing rules.
Product 9 values
Search field:"Product" for all 9 flagged values with their contributing rules.
Description 9 values
Search field:"Description" for all 9 flagged values with their contributing rules.
SourceImage 9 values
Search field:"SourceImage" for all 9 flagged values with their contributing rules.
ActivityType 9 values
Search field:"ActivityType" for all 9 flagged values with their contributing rules.
ClientRequestURI 9 values
Search field:"ClientRequestURI" for all 9 flagged values with their contributing rules.
Data 9 values
Search field:"Data" for all 9 flagged values with their contributing rules.
command 9 values
Search field:"command" for all 9 flagged values with their contributing rules.
gcp.audit.request.rules.verbs 9 values
Search field:"gcp.audit.request.rules.verbs" for all 9 flagged values with their contributing rules.
profile.by_sender 8 values
Search field:"profile.by_sender" for all 8 flagged values with their contributing rules.
IntegrityLevel 8 values
Search field:"IntegrityLevel" for all 8 flagged values with their contributing rules.
process.Ext.api.parameters.protection 8 values
Search field:"process.Ext.api.parameters.protection" for all 8 flagged values with their contributing rules.
DeviceVendor 8 values
Search field:"DeviceVendor" for all 8 flagged values with their contributing rules.
c-useragent 8 values
Search field:"c-useragent" for all 8 flagged values with their contributing rules.
DstPortNumber 8 values
Search field:"DstPortNumber" for all 8 flagged values with their contributing rules.
subject 8 values
Search field:"subject" for all 8 flagged values with their contributing rules.
Initiated 7 values
Search field:"Initiated" for all 7 flagged values with their contributing rules.
sender.email.domain.domain 7 values
Search field:"sender.email.domain.domain" for all 7 flagged values with their contributing rules.
AttributeLDAPDisplayName 7 values
Search field:"AttributeLDAPDisplayName" for all 7 flagged values with their contributing rules.
AADOperationType 7 values
Search field:"AADOperationType" for all 7 flagged values with their contributing rules.
Message 7 values
Search field:"Message" for all 7 flagged values with their contributing rules.
okta::eventType 7 values
Search field:"okta::eventType" for all 7 flagged values with their contributing rules.
ActionType 7 values
Search field:"ActionType" for all 7 flagged values with their contributing rules.
DeviceEventClassID 7 values
Search field:"DeviceEventClassID" for all 7 flagged values with their contributing rules.
event_type 7 values
Search field:"event_type" for all 7 flagged values with their contributing rules.
process.thread.Ext.call_stack_final_user_module.protection_provenance 7 values
Search field:"process.thread.Ext.call_stack_final_user_module.protection_provenance" for all 7 flagged values with their contributing rules.
aws::requestParameters 7 values
Search field:"aws::requestParameters" for all 7 flagged values with their contributing rules.
action_id 7 values
Search field:"action_id" for all 7 flagged values with their contributing rules.
endgame.event_subtype_full 7 values
Search field:"endgame.event_subtype_full" for all 7 flagged values with their contributing rules.
LogonType 6 values
Search field:"LogonType" for all 6 flagged values with their contributing rules.
process.Ext.relative_file_creation_time 6 values
Search field:"process.Ext.relative_file_creation_time" for all 6 flagged values with their contributing rules.
sc-status 6 values
Search field:"sc-status" for all 6 flagged values with their contributing rules.
severity 6 values
Search field:"severity" for all 6 flagged values with their contributing rules.
event.module 6 values
Search field:"event.module" for all 6 flagged values with their contributing rules.
TargetUserName 6 values
Search field:"TargetUserName" for all 6 flagged values with their contributing rules.
AccessList 6 values
Search field:"AccessList" for all 6 flagged values with their contributing rules.
event_action 6 values
Search field:"event_action" for all 6 flagged values with their contributing rules.
NetworkDirection 6 values
Search field:"NetworkDirection" for all 6 flagged values with their contributing rules.
id.applicationName 6 values
Search field:"id.applicationName" for all 6 flagged values with their contributing rules.
process.Ext.ptrace.request 6 values
Search field:"process.Ext.ptrace.request" for all 6 flagged values with their contributing rules.
process.parent.args_count 6 values
Search field:"process.parent.args_count" for all 6 flagged values with their contributing rules.
azure_ad::resource_id 6 values
Search field:"azure_ad::resource_id" for all 6 flagged values with their contributing rules.
azure_ad::operation_name_value 6 values
Search field:"azure_ad::operation_name_value" for all 6 flagged values with their contributing rules.
Codename 6 values
Search field:"Codename" for all 6 flagged values with their contributing rules.
Effective_process.name 6 values
Search field:"Effective_process.name" for all 6 flagged values with their contributing rules.
HttpStatusCode 6 values
Search field:"HttpStatusCode" for all 6 flagged values with their contributing rules.
ProductName 6 values
Search field:"ProductName" for all 6 flagged values with their contributing rules.
azure.platformlogs.properties.log.verb 6 values
Search field:"azure.platformlogs.properties.log.verb" for all 6 flagged values with their contributing rules.
m365::Parameters 6 values
Search field:"m365::Parameters" for all 6 flagged values with their contributing rules.
protoPayload.methodName 6 values
Search field:"protoPayload.methodName" for all 6 flagged values with their contributing rules.
sender.email.local_part 6 values
Search field:"sender.email.local_part" for all 6 flagged values with their contributing rules.
subject.base 6 values
Search field:"subject.base" for all 6 flagged values with their contributing rules.
ClientIPClass 6 values
Search field:"ClientIPClass" for all 6 flagged values with their contributing rules.
SourceIP 6 values
Search field:"SourceIP" for all 6 flagged values with their contributing rules.
auditType.category 6 values
Search field:"auditType.category" for all 6 flagged values with their contributing rules.
md5 6 values
Search field:"md5" for all 6 flagged values with their contributing rules.
event.outcome 5 values
eq: Success 306 rules
Disable or Modify Tools
T1562, Account Manipulation T1098, Valid Accounts T1078, Cloud Accounts T1078.004, Disable or Modify Tools T1562.001, Disable or Modify Cloud Log T1562.008Sample rules (showing 8 of 306):
- Authentication via Unusual PAM Grantor
- AWS Account Closed
- AWS Account Discovery By Rare User
- AWS API Activity from Uncommon S3 Client by Rare User
- AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN
- AWS Backup Recovery Point Deleted
- AWS Backup Resource Enumeration via Long-Term Access Key
- AWS Backup Vault Deleted or Vault Lock Removed
eq: success 82 rules
Account Manipulation
T1098, Valid Accounts T1078, Cloud Accounts T1078.004, Modify Cloud Compute Infrastructure T1578, Transfer Data to Cloud Account T1537, Steal Application Access Token T1528Sample rules (showing 8 of 82):
- Access to Browser Credentials from Suspicious Memory
- Account Password Reset Remotely
- AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key
- AWS Bedrock High-Frequency Single-Model Inference API Probing
- AWS EC2 EBS Snapshot Access Removed
- AWS EC2 EBS Snapshot Shared or Made Public
- AWS EC2 Instance Console Login via Assumed Role
- AWS EC2 Stop, Start, and User Data Modification Correlation
eq: failure 14 rules
Brute Force
T1110, Password Guessing T1110.001, Password Spraying T1110.003, Account Manipulation T1098, Permission Groups Discovery T1069, Cloud Groups T1069.003Sample rules (showing 8 of 14):
- AWS Bedrock Unauthorized Foundation Model Access Attempt
- AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt
- AWS IAM Principal Enumeration via UpdateAssumeRolePolicy
- AWS Management Console Brute Force of Root User Identity
- AWS Root Console Login Password Spraying
- Behavior - Detected - Elastic Defend
- Entra ID Excessive Account Lockouts Detected
- GKE Forbidden Creation Request
eq: failure 10 rules
Brute Force
T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004Sample rules (showing 8 of 10):
- Access Attempt to Non Existing Cryptocurrency Wallet
- Entra ID Sign-in Brute Force Attempted (Microsoft 365)
- Entra ID User Sign-in Brute Force Attempted
- Failed Access Attempt to Web Browser Files
- Failed Attempts to Access Sensitive Files
- GKE API Request Failure Burst by User
- Potential External Linux SSH Brute Force Detected
- Potential Internal Linux SSH Brute Force Detected
recipients.to 5 values
length_compare: 1 70 rules
Sample rules (showing 8 of 70):
- Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure
- Attachment: EML with QR code redirecting to Cloudflare challenges
- Attachment: Encrypted PDF with credential theft body
- Attachment: Encrypted PDF with credential theft language in EML
- Attachment: PDF with credential theft language and invalid reply-to domain
- Attachment: PDF with localhost IP in EXIF title metadata
- Attachment: PDF with recipient email in link
- Attachment: QR code with recipient targeting and special characters
length_compare: 0 39 rules
Sample rules (showing 8 of 39):
- Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
- Attachment: Adobe image lure in body or attachment with suspicious link
- Attachment: Callback phishing solicitation via image file
- Attachment: Encrypted PDF with credential theft body
- Attachment: Encrypted PDF with credential theft language in EML
- BEC/Fraud: Job scam fake thread or plaintext pivot to freemail
- Brand impersonation: Google Drive fake file share
- Brand impersonation: Hulu
length_compare: 0 3 rules
length_compare: 1 3 rules
length_compare: 10 2 rules
cs-method 5 values
eq: POST 54 rules, 2 vendors
Sample rules (showing 8 of 54):
- Confluence Exploitation CVE-2019-3398
- CVE-2021-21972 VSphere Exploitation
- CVE-2021-21978 Exploitation Attempt
- CVE-2021-33766 Exchange ProxyToken Exploitation
- CVE-2022-31659 VMware Workspace ONE Access RCE
- CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21
- CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)
- CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)
eq: GET 49 rules, 2 vendors
Sample rules (showing 8 of 49):
- Cisco ASA Exploitation Activity - Proxy
- Cross Site Scripting Strings
- CVE-2020-0688 Exchange Exploitation via Web Log
- CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21
- CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy
- CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver
- CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy
- CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver
in: GET 3 rules
in: POST 3 rules
eq: HEAD 2 rules
event.kind 5 values
eq: alert 35 rules
Sample rules (showing 8 of 35):
- Adversary Behavior - Detected - Elastic Endgame
- Behavior - Detected - Elastic Defend
- Behavior - Prevented - Elastic Defend
- Container Workload Protection
- Credential Dumping - Detected - Elastic Endgame
- Credential Dumping - Prevented - Elastic Endgame
- Credential Manipulation - Detected - Elastic Endgame
- Credential Manipulation - Prevented - Elastic Endgame
eq: signal 6 rules
Sample rules:
- AWS IAM Long-Term Access Key Correlated with Elevated Detection Alerts
- First Seen Network Flow Exporter Followed by Suspicious Source Activity
- FortiGate SSL VPN Login Followed by SIEM Alert by User
- LLM-Based Attack Chain Triage by Host
- LLM-Based Compromised User Triage by User
- Newly Observed High Severity Suricata Alert
eq: alert 3 rules, 2 vendors
eq: signal 3 rules
eq: event 2 rules
Sample rules:
Workload 5 values
eq: AzureActiveDirectory 30 rules
Account Manipulation
T1098, Create Account T1136, Cloud Account T1136.003, Additional Cloud Roles T1098.003, Brute Force T1110, Steal Application Access Token T1528Sample rules (showing 8 of 30):
- High Number of Login Failures from a single source
- O365 Add App Role Assignment Grant User
- O365 Added Service Principal
- O365 Admin Consent Bypassed by Service Principal
- O365 Application Available To Other Tenants
- O365 Application Registration Owner Added
- O365 Block User Consent For Risky Apps Disabled
- O365 Concurrent Sessions From Different Ips
eq: Exchange 20 rules
Email Collection
T1114, Indicator Removal T1070, Clear Mailbox Data T1070.008, Data Destruction T1485, Account Manipulation T1098, Additional Email Delegate Permissions T1098.002Sample rules (showing 8 of 20):
- O365 ApplicationImpersonation Role Assigned
- O365 BEC Email Hiding Rule Created
- O365 Elevated Mailbox Permission Assigned
- O365 Email Hard Delete Excessive Volume
- O365 Email New Inbox Rule Created
- O365 Email Password and Payroll Compromise Behavior
- O365 Email Receive and Hard Delete Takeover Behavior
- O365 Email Security Feature Changed
eq: SecurityComplianceCenter 8 rules
Email Collection
T1114, Remote Email Collection T1114.002, Phishing T1566, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002, Email Forwarding Rule T1114.003Sample rules:
- O365 Compliance Content Search Exported
- O365 Compliance Content Search Started
- O365 Email Access By Security Administrator
- O365 Email Reported By Admin Found Malicious
- O365 Email Reported By User Found Malicious
- O365 Email Suspicious Behavior Alert
- O365 Security And Compliance Alert Triggered
- O365 ZAP Activity Detection
eq: ThreatIntelligence 3 rules, 2 vendors
profile.by_sender_email 5 values
func_call: profile.by_sender_email().any_messages_malicious_or_spam 23 rules
Sample rules (showing 8 of 23):
- Attachment: Adobe image lure in body or attachment with suspicious link
- Attachment: Compensation review lure with QR code
- Attachment: EML file with HTML attachment (unsolicited)
- Attachment: Encrypted PDF with credential theft body
- Attachment: Encrypted PDF with credential theft language in EML
- Attachment: QR code with credential phishing indicators
- Brand impersonation: DocuSign branded attachment lure with no DocuSign links
- Brand impersonation: Spotify
func_call: profile.by_sender_email().prevalence in ("new", "outlier") 14 rules
Sample rules (showing 8 of 14):
- Attachment: EML file with HTML attachment (unsolicited)
- Attachment: Encrypted PDF with credential theft body
- Attachment: Encrypted PDF with credential theft language in EML
- Attachment: QR code with credential phishing indicators
- Brand impersonation: Spotify
- Credential phishing content and link (untrusted sender)
- Fake message thread - Untrusted sender with a mismatched freemail reply-to address
- HTML smuggling containing recipient email address
func_call: profile.by_sender_email().prevalence == "new" 13 rules
Sample rules (showing 8 of 13):
- Attachment: Adobe image lure in body or attachment with suspicious link
- Brand impersonation: DocuSign branded attachment lure with no DocuSign links
- Brand impersonation: Google Drive fake file share
- Brand impersonation: Sharepoint fake file share
- Credential phishing: Generic document sharing
- Credential phishing: Suspicious e-sign agreement document notification
- Headers: Invalid recipient domain with mismatched reply-to from new sender
- Link abuse: Self-service creation platform link with suspicious recipient behavior
func_call: profile.by_sender_email().days_since.last_contact > 30 2 rules
func_call: profile.by_sender_email().prevalence != "common" 2 rules
graph.metadata.entity_type 5 values
eq: FILE 17 rules
eq: DOMAIN_NAME 10 rules
Sample rules (showing 8 of 10):
eq: IP_ADDRESS 10 rules
Sample rules (showing 8 of 10):
process.Ext.device.product_id 5 values
eq: Virtual DVD-ROM 13 rules
Windows Management Instrumentation
T1047, Command and Scripting Interpreter T1059, PowerShell T1059.001, Windows Command Shell T1059.003, Trusted Developer Utilities Proxy Execution T1127, MSBuild T1127.001Sample rules (showing 8 of 13):
- DNS Query to Suspicious Top Level Domain
- GetAsyncKeyState API Call from Suspicious Process
- Potential Crypto Mining Activity
- Potential DLL SideLoad via a Renamed Signed Binary
- Scheduled Task Creation by an Unusual Process
- Suspicious Communication via Mail Protocol
- Suspicious DNS Query from Mounted Virtual Disk
- Suspicious Execution from a Mounted Device
eq: Virtual Disk 13 rules
Windows Management Instrumentation
T1047, Command and Scripting Interpreter T1059, PowerShell T1059.001, Windows Command Shell T1059.003, Trusted Developer Utilities Proxy Execution T1127, MSBuild T1127.001Sample rules (showing 8 of 13):
- DNS Query to Suspicious Top Level Domain
- GetAsyncKeyState API Call from Suspicious Process
- Potential Crypto Mining Activity
- Potential DLL SideLoad via a Renamed Signed Binary
- Scheduled Task Creation by an Unusual Process
- Suspicious Communication via Mail Protocol
- Suspicious DNS Query from Mounted Virtual Disk
- Suspicious Execution from a Mounted Device
wildcard: Virtual DVD-ROM 7 rules
Sample rules:
- Command and Scripting Interpreter from Suspicious Parent
- Persistence via a Process from a Removable or Mounted ISO Device
- Process Creation from Backed RWX Memory
- Process from Archive or Removable Media via Unbacked Code
- Scheduled Task Creation from Suspicious Parent
- Scheduled Task from a Removable or Mounted ISO Device
- Suspicious Vault Files Access via RPC
wildcard: Virtual Disk 7 rules
Sample rules:
- Command and Scripting Interpreter from Suspicious Parent
- Persistence via a Process from a Removable or Mounted ISO Device
- Process Creation from Backed RWX Memory
- Process from Archive or Removable Media via Unbacked Code
- Scheduled Task Creation from Suspicious Parent
- Scheduled Task from a Removable or Mounted ISO Device
- Suspicious Vault Files Access via RPC
wildcard: USB * 6 rules
Sample rules:
- Command and Scripting Interpreter from Suspicious Parent
- Persistence via a Process from a Removable or Mounted ISO Device
- Process Creation from Backed RWX Memory
- Process from Archive or Removable Media via Unbacked Code
- Scheduled Task Creation from Suspicious Parent
- Scheduled Task from a Removable or Mounted ISO Device
dll.Ext.relative_file_creation_time 5 values
le: 500 11 rules
Sample rules (showing 8 of 11):
- DLL Side Loading via a Copied Microsoft Executable
- Image Loaded with Invalid Signature
- Known Desktop Application DLL Search Order Hijack
- Self Injection via AppDomain Manager Assembly
- Suspicious AppDomain Manager Configuration File
- Suspicious Control Panel DLL Loaded by Explorer
- Suspicious Image Load via Windows Scripts
- Unsigned DLL from Suspicious Directory
le: 900 9 rules
Sample rules (showing 8 of 9):
- Potential DLL Hijacking via Environment Paths
- Potential Microsoft Outlook Remote Code Execution
- Potential Privilege Escalation via SetWindowsHook DLL Injection
- Service Communication via Mail Protocol
- Suspicious Activity from a Control Panel Applet
- Suspicious API from an Unsigned Service DLL
- Unsigned DLL loaded by DNS Service
- Unsigned DLL loaded by Rundll32 via COM
le: 300 7 rules
lt: 5000 6 rules
process.Ext.api.parameters.size 5 values
ge: 10000 11 rules
Sample rules (showing 8 of 11):
- Cross Process API Activity with Truncated Stack
- Evasion via Multiple Memory Section Mapping
- Image Hollow from Unusual Stack
- Network Activity from a Stomped Module
- Potential Injection via NSIS Installer
- Potential Shellcode Injection by a Browser Process
- Self Injection via AppDomain Manager Assembly
- Shellcode Injection via PowerShell
ge: 100000 6 rules
gt: 4096 5 rules
eq: 0 3 rules
azure_ad::activity_display_name 5 values
contains: Add eligible member to role 9 rules
Sample rules (showing 8 of 9):
- [Entra ID] Mass Privileged Role Change Activity Detected
- [Entra ID] Privileged Role Assigned to a New User
- [Entra ID] Privileged Role Assigned to User
- Bulk Changes to Privileged Account Permissions
- Multiple admin membership removals from newly created admin.
- New User Assigned to Privileged Role
- Threat Essentials - Multiple admin membership removals from newly created admin.
- Threat Essentials - User Assigned Privileged Role
contains: Add member to role 9 rules
Sample rules (showing 8 of 9):
- [Entra ID] Mass Privileged Role Change Activity Detected
- [Entra ID] Privileged Role Assigned to a New User
- [Entra ID] Privileged Role Assigned to User
- Bulk Changes to Privileged Account Permissions
- Multiple admin membership removals from newly created admin.
- New User Assigned to Privileged Role
- Threat Essentials - Multiple admin membership removals from newly created admin.
- Threat Essentials - User Assigned Privileged Role
eq: Add member to role request denied (PIM activation) 3 rules
eq: User has elevated their access to User Access Administrator for their Azure Resources 2 rules, 2 vendors
eq: Register device 2 rules
dll.Ext.relative_file_name_modify_time 5 values
le: 500 9 rules
Sample rules (showing 8 of 9):
- DLL Side Loading via a Copied Microsoft Executable
- Image Loaded with Invalid Signature
- Known Desktop Application DLL Search Order Hijack
- Potential Windows Session Hijacking via CcmExec
- Self Injection via AppDomain Manager Assembly
- Suspicious AppDomain Manager Configuration File
- Suspicious Control Panel DLL Loaded by Explorer
- Unsigned DLL Loaded by a Trusted Process
le: 900 6 rules
lt: 5000 6 rules
le: 3600 3 rules
le: 300 2 rules
ResultType 5 values
eq: 0 8 rules
Valid Accounts
T1078, Cloud Accounts T1078.004, Application Layer Protocol T1071, Brute Force T1110, Unsecured Credentials T1552, Trusted Relationship T1199Sample rules:
- Anomalous Single Factor Signin
- Azure Portal sign in from another Azure Tenant
- F&O - Unusual sign-in activity using single factor authentication
- GitLab - SSO - Sign-Ins Burst
- Possible AiTM Phishing Attempt Against Microsoft Entra ID
- Possible SignIn from Azure Backdoor
- PRODAFT USTA - Compromised credential used in successful sign-in
- Risky user signin observed in non-Microsoft network device
eq: 0 2 rules
eq: 50057 2 rules
eq: 53003 2 rules
SourceSystem 5 values
eq: Lumen 8 rules
eq: GreyNoise 5 rules
starts_with: ThreatConnect- 5 rules
eq: HANADB 4 rules
starts_with: HoneyLabs 4 rules
graph.metadata.product_name 5 values
eq: GCTI Feed 8 rules
Sample rules:
- AWS Successful API From Tor Exit Node
- GCP Successful API Call From Tor Exit Node
- GCTI Benign Binaries Contacts Tor Exit Node
- GCTI Remote Access Tools
- GCTI Tor Exit Nodes
- GitHub Personal Access Token Created from Tor IP Address
- Google Safebrowsing File Contacts Tor Exit Node
- VT Relationships File Contacts Tor IP
eq: MISP 6 rules
eq: VirusTotal Relationships 6 rules
eq: Google Safe Browsing 4 rules
eq: WHOISXMLAPI Simple Whois 4 rules
m365::Workload 5 values
eq: Exchange 6 rules
eq: MicrosoftTeams 3 rules
contains: OneDrive 2 rules
contains: SharePoint 2 rules
eq: Exchange 2 rules
userAgent 5 values
ne: console.amazonaws.com 6 rules
ne: *.amazonaws.com 5 rules
contains: S3 Browser 3 rules
contains: TruffleHog 2 rules
contains: azurehound 2 rules
CallTrace 5 values
contains: *UNKNOWN* 5 rules, 2 vendors
contains: *dbgcore.dll* 3 rules, 2 vendors
contains: *dbghelp.dll* 3 rules, 2 vendors
contains: *seclogon.dll* 2 rules, 2 vendors
contains: |UNKNOWN( 2 rules
SubjectUserName 5 values
ends_with: $ 5 rules, 2 vendors
eq: ANONYMOUS LOGON 3 rules, 2 vendors
eq: anonymous 3 rules
regex_match: \/i-.*$ 2 rules
regex_match: ^urn:spo:anon# 2 rules
dll.Ext.device.product_id 5 values
eq: Virtual DVD-ROM 5 rules
eq: Virtual Disk 5 rules
wildcard: USB * 3 rules
wildcard: Virtual DVD-ROM 3 rules
wildcard: Virtual Disk 3 rules
DestinationPortName 5 values
eq: dns 4 rules
eq: http 3 rules
ne: dns 3 rules
in: http 2 rules
in: tls 2 rules
Target.type 5 values
eq: TAILNET 4 rules
in: API_KEY 3 rules
in: OAUTH_CLIENT 3 rules
eq: POSTURE_INTEGRATION 2 rules
starts_with: POSTURE 2 rules
object_type 5 values
eq: uva 4 rules
eq: account 2 rules
eq: gm 2 rules
eq: user 2 rules
eq: vault 2 rules
target.url 5 values
eq: https://graph.microsoft.com/v1.0/groups 4 rules
eq: https://graph.microsoft.com/beta/roleManagement/directory/estimateAccess 3 rules
eq: https://graph.microsoft.com/v1.0/applications 2 rules
eq: https://graph.microsoft.com/v1.0/users 2 rules
regex_match: ^https://graph\.microsoft\.com/v1\.0/drives/.*/content$ 2 rules
user.effective.id 5 values
starts_with: S-1-12-* 4 rules
starts_with: S-1-5-21* 4 rules
is_not_null:
eq: 0 2 rules
AuditPolicyChanges 5 values
contains: %%8448 3 rules
contains: %%8450 3 rules
in: %%8448 2 rules
in: %%8448, %%8450 2 rules
in: %%8450 2 rules
a1 5 values
ends_with: .jpg 3 rules
ends_with: .png 3 rules
eq: -sel 2 rules
eq: -selection 2 rules
data.description 5 values
eq: Create or update the anomaly detection captcha 3 rules
eq: Update Brute-force settings 3 rules
eq: Update Suspicious IP Throttling settings 3 rules
eq: Set the Multi-factor Authentication policies 2 rules
Sample rules:
eq: Updates risk assessment configs 2 rules
event 5 values
eq: session.command 3 rules
eq: user.login 3 rules
eq: CWS_EVENT 2 rules
in: group.feature_flags.edit 2 rules
in: org.request_access_settings.edit 2 rules
event_count 5 values
gt: 0 3 rules
gt: 2 3 rules
lt: 5 3 rules
gt: 100 2 rules
informationType_s 5 values
eq: Business Information 3 rules
eq: Financial Information 3 rules
eq: HR Information 3 rules
eq: Legal Information 3 rules
eq: Governance Information 2 rules
process.Ext.ptrace.addr 5 values
in: 128 3 rules
in: 48 3 rules
ge: 4096 2 rules
in: 152 2 rules
in: 60 2 rules
InterfaceUuid 5 values
eq: 1ff70682-0a51-30e8-076d-740be8cee98b 2 rules
eq: 338cd001-2244-31f1-aaaa-900038001003 2 rules
eq: 378e52b0-c0a9-11cf-822d-00aa0051e40f 2 rules
eq: 4b324fc8-1670-01d3-1278-5a47bf6ee188 2 rules
eq: 86d35949-83c9-4044-b424-db363231fd0c 2 rules
a0 5 values
eq: cp 2 rules
eq: hostname 2 rules
eq: steghide 2 rules
eq: uname 2 rules
eq: xclip 2 rules
o365.audit.Actor.Type 5 values
in: 0 2 rules
in: 10 2 rules
in: 2 2 rules
in: 3 2 rules
process.env_vars 5 values
eq: HISTCONTROL=ignorespace 2 rules
eq: HISTFILE=/dev/null 2 rules
eq: HISTFILESIZE=0 2 rules
eq: HISTSIZE=0 2 rules
process_id 4 values
ne: 4 44 rules
Use Alternate Authentication Material
T1550, Pass the Ticket T1550.003, Steal or Forge Kerberos Tickets T1558, Kerberoasting T1558.003, AS-REP Roasting T1558.004, Remote Services T1021Sample rules (showing 8 of 44):
- Access Attempt to Non Existing Cryptocurrency Wallet
- Access to Browser Credentials from Suspicious Memory
- Asynchronous Procedure Call from Unusual Module
- BLF File Creation by an Unusual Process
- Delayed Common Language Runtime Load
- DLL Injection via MavInject Utility
- Execution of a File Dropped from Kernel Mode
- Failed Access Attempt to Web Browser Files
eq: 4 17 rules
Remote Services
T1021, SMB/Windows Admin Shares T1021.002, Masquerading T1036, Invalid Code Signature T1036.001, Lateral Tool Transfer T1570, OS Credential Dumping T1003Sample rules (showing 8 of 17):
- Driver Dropped by Untrusted Executable
- Execution of a File Dropped from Kernel Mode
- Execution of a File Dropped from SMB
- Execution of a File Dropped from SMB via Services
- Expired or Revoked Driver Loaded
- ImageLoad of a File dropped via SMB
- Incoming Execution via WinRM Remote Shell
- Lateral Movement via Startup Folder
eq: 0 2 rules
metadata.log_type 4 values
eq: GCP_CLOUDAUDIT 22 rules
Disable or Modify Tools
T1562, Account Manipulation T1098, Data Destruction T1485, Exfiltration Over Web Service T1567, Transfer Data to Cloud Account T1537, Account Access Removal T1531Sample rules (showing 8 of 22):
- GCP Admin Privileged Roles Added To Service Accounts
- GCP BigQuery Datasets Opened To Public
- GCP BigQuery Results Downloaded From Multiple Tables
- GCP Cloud Audit Logging Removed From All Services
- GCP Excessive Permission Denied Events
- GCP Exempt Principals From Audit Log
- GCP Firewall Rule Opened To The World
- GCP Free Gmail Domains Added To IAM Policy
eq: SAP_SECURITY_AUDIT 18 rules
eq: SAP_CHANGE_DOCUMENT 8 rules
Sample rules:
- sap change documents sensitive profile assignment
- sap change documents sensitive profile assignment data table
- sap change documents sensitive role assignment
- sap critial role assigned to new user
- sap critical authorization value changed
- sap critical role assigned to new user
- sap sensitive role assignment correlation
- sap sensitive role authorization modification
eq: SAP_HANA_AUDIT 2 rules
status 4 values
eq: Success 21 rules, 2 vendors
Valid Accounts
T1078, Encrypted Channel T1573, Account Manipulation T1098, Disable or Modify System Firewall T1686, Cloud Firewall T1686.001, Cloud Accounts T1078.004Sample rules (showing 8 of 21):
eq: SUCCESS 16 rules
eq: Failure 3 rules
eq: 200 2 rules
process.Ext.relative_file_name_modify_time 4 values
le: 500 21 rules
Email Collection
T1114, Local Email Collection T1114.001, Inter-Process Communication T1559, Component Object Model T1559.001, Application Layer Protocol T1071, Ingress Tool Transfer T1105Sample rules (showing 8 of 21):
- Driver Dropped by Untrusted Executable
- Execution of a DNGUard Protected Program
- Firewall Policy Changed by a Suspicious Process
- Ingress Tool Transfer via PowerShell
- Java Drop followed by network activity
- Java Dropped and Executed With DNS Lookup
- Kernel Driver Registered via NtLoadDriver
- Keystrokes Input Capture from a Managed Application
le: 300 9 rules
Sample rules (showing 8 of 9):
- Connection to WebService by an Unsigned Binary
- DNS Query to Suspicious Top Level Domain
- External IP Address Discovery via a Trusted Program
- External IP Address Discovery via Untrusted Program
- Scheduled Task Creation by an Unusual Process
- Suspicious PHP Script Execution
- Suspicious Python Script Interpreter
- Suspicious Shell Extension Handler Registry Modification
le: 1800 6 rules
Sample rules:
- Component Object Model Registry Modification by a Low Reputation Process
- Malicious Reputation of Executable Download
- Scheduled Task by a Low Reputation Process
- Scheduled Task from a Browser or Compression Utility Descendant
- Startup Persistence by a Low Reputation Process
- Startup Persistence from a Browser or Compression Utility Descendant
body.previous_threads 4 values
length_compare: 0 20 rules
Sample rules (showing 8 of 20):
- Brand impersonation: Internal Revenue Service
- Brand impersonation: Meta and subsidiaries
- Brand Impersonation: PayPal
- Credential phishing: Blue button styled link with file-sharing template artifacts
- Fake Zoom meeting invite with suspicious link
- Fraudulent order confirmation/shipping notification from Chinese sender domain
- Headers: Fake in-reply-to with wildcard sender and missing thread context
- Impersonation: Legal firm with copyright infringement notice
length_compare: 1 5 rules
Sample rules:
- Attachment: Identity Confirmation With Document Unlock Code
- BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread
- Link: Self-sender with sender org in subject and credential theft indicator
- VIP impersonation: Fake thread with VIPs missing email metadata
- VIP Impersonation: VIP handoff with fake forwarded invoice thread
length_compare: 0 4 rules
length_compare: 1 2 rules
EventLog 4 values
eq: RPCFW 17 rules
eq: Microsoft-Windows-Sysmon/Operational 7 rules
eq: Microsoft-Windows-Sysmon/Operational 3 rules
eq: Application 2 rules
SourcePort 4 values
ge: 49152 16 rules
Remote Services
T1021, Use Alternate Authentication Material T1550, Pass the Ticket T1550.003, Steal or Forge Kerberos Tickets T1558, Kerberoasting T1558.003, Remote System Discovery T1018Sample rules (showing 8 of 16):
- Incoming DCOM Lateral Movement with MMC
- Kerberos Traffic from Unusual Process
- LDAP Search followed by Kerberos Connection
- Potential Command and Control via Windows Scripts
- Potential Enumeration via Active Directory Web Service
- Potential Privilege Escalation via Rogue WinRM
- Potential Ransomware Note File via SMB
- Potential Remote Execution via IMsiServer
eq: 3389 3 rules
gt: 49151 2 rules
regex_match: (?i)3389|rdp 2 rules
esf.event_type 4 values
eq: 9 15 rules
eq: 17 3 rules
eq: 27 3 rules
serviceName 4 values
eq: accounts 13 rules
eq: ssoConfigBackend 3 rules
eq: workspace 3 rules
eq: deltaSharingAccess 2 rules
body.current_thread.links 4 values
length_compare: 0 11 rules
Sample rules (showing 8 of 11):
- Brand impersonation: Bids & Tenders
- Cloud storage impersonation with credential theft indicators
- Link: BEC with newly registered domains and financial keywords
- Link: Credential phishing with obfuscated JavaScript redirect
- Link: Document sharing invitation template
- Link: Gmail phishkit with suspicious recipient
- Link: Multiple HTTP protocols in single URL
- Link: Self-sender with IP geolocation check and suspicious link behavior
length_compare: 10 11 rules
Sample rules (showing 8 of 11):
- Brand impersonation: Bids & Tenders
- Cloud storage impersonation with credential theft indicators
- Job scam with specific salary pattern
- Link abuse: Self-service creation platform link with suspicious recipient behavior
- Link: Credential phishing with obfuscated JavaScript redirect
- Link: Gmail phishkit with suspicious recipient
- Link: Multiple HTTP protocols in single URL
- Link: Self-sender with IP geolocation check and suspicious link behavior
length_compare: 0 2 rules
length_compare: 1 2 rules
objectRef.resource 4 values
eq: pods 8 rules, 2 vendors
User Execution
T1204, Escape to Host T1611, Container Administration Command T1609, Masquerading T1036, Match Legitimate Resource Name or Location T1036.005, Cloud Service Discovery T1526Sample rules:
- Container With A hostPath Mount Created
- Creation Of Pod In System Namespace
- Potential Remote Command Execution In Pod Container
- Privileged Container Deployed
- Amazon EKS Kubernetes Pod scan detection
- Kubernetes Create or Update Privileged Pod
- Kubernetes Pod Created in Default Namespace
- Kubernetes Pod With Host Network Attachment
eq: secrets 6 rules, 2 vendors
eq: cronjobs 2 rules, 2 vendors
DeviceProduct 4 values
eq: iSID 8 rules
Sample rules:
eq: X Series 7 rules
contains: Admin Console 4 rules
eq: Awake Security 3 rules
Esql.event_count 4 values
ge: 10 8 rules
Cloud Infrastructure Discovery
T1580, Cloud Service Discovery T1526, Automated Exfiltration T1020, Data Destruction T1485, Data Manipulation T1565, Stored Data Manipulation T1565.001Sample rules:
- AWS EC2 Multi-Region DescribeInstances API Calls
- AWS Service Quotas Multi-Region GetServiceQuota Requests
- Azure Key Vault Excessive Secret or Key Retrieved
- Azure OpenAI Insecure Output Handling
- High Number of Protected Branch Force Pushes by User
- M365 Identity User Account Lockouts
- Potential Denial of Azure OpenAI ML Service
- Potential Linux Local Account Brute Force Detected
lt: 5 3 rules
ge: 100 2 rules
gt: 50 2 rules
client.user.email 4 values
is_not_null:
Account Manipulation
T1098, Additional Container Cluster Roles T1098.006, Unsecured Credentials T1552, Container API T1552.007, Container and Resource Discovery T1613, Cloud Service Discovery T1526Sample rules:
- GCP Secret Manager ListSecrets Across Multiple Projects
- GKE Certificate Signing Request Self-Approved
- GKE Endpoint Permission Enumeration
- GKE Multi-Resource Discovery
- GKE Rapid Secret GET Activity Against Multiple Objects
- GKE Secret Access via Unusual User Agent
- GKE Sensitive RBAC Change Followed by Workload Modification
- GKE Unusual Sensitive Workload Modification
starts_with: system:serviceaccount:* 3 rules
eq: system:anonymous 2 rules
eq: system:unauthenticated 2 rules
ObjectServer 4 values
eq: Security Account Manager 7 rules
eq: Security 5 rules
facility 4 values
in: HA_EM 7 rules
Sample rules:
- Cisco IOS XE Guestshell Activation and Destroy
- Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal
- Cisco IOS XE Reconnaissance Command Activity
- Cisco IOS XE Remote Access Probe Burst
- Cisco IOS XE Request Platform Package Describe Shell Pattern
- Cisco IOS XE Tunnel Interface Configuration
- Cisco IOS XE VTY Access Class Tampering
in: AAA 5 rules
in: PARSER 3 rules
eq: PM 2 rules
Sample rules:
gcp::service_name 4 values
eq: admin.googleapis.com 7 rules
eq: storage.googleapis.com 4 rules
eq: login.googleapis.com 3 rules
eq: cloudkms.googleapis.com 2 rules
mnemonic 4 values
in: LOG 7 rules
Sample rules:
- Cisco IOS XE Guestshell Activation and Destroy
- Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal
- Cisco IOS XE Reconnaissance Command Activity
- Cisco IOS XE Remote Access Probe Burst
- Cisco IOS XE Request Platform Package Describe Shell Pattern
- Cisco IOS XE Tunnel Interface Configuration
- Cisco IOS XE VTY Access Class Tampering
in: AAA_ACCOUNTING_MESSAGE 5 rules
in: CFGLOG_LOGGEDCMD 3 rules
eq: ERR_DISABLE 2 rules
Sample rules:
ObjectClass 4 values
eq: groupPolicyContainer 6 rules, 2 vendors
eq: user 5 rules, 3 vendors
eq: domainDNS 4 rules
SignatureStatus 4 values
eq: trusted 6 rules
eq: Unavailable 2 rules, 2 vendors
eq: errorBadDigest 2 rules
TargetSid 4 values
starts_with: S-1-5-21- 5 rules, 2 vendors
ends_with: -520 2 rules
eq: S-1-5-32-544 2 rules
starts_with: S-1-5-32 2 rules
kubernetes.audit.stage 4 values
eq: ResponseComplete 5 rules
in: ResponseComplete 5 rules
in: ResponseStarted 5 rules
eq: ResponseComplete 3 rules
network.whois 4 values
func_call: network.whois(sender.email.domain).days_old < 30 5 rules
Sample rules:
- BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns
- BEC: Financial fraud from newly registered sender domain
- Link: Fake video link from newly registered domain
- Spam: Link to blob.core.windows.net from new domain (<30d)
- Suspicious newly registered reply-to domain with engaging financial or urgent language
func_call: network.whois(sender.email.domain).days_old <= 30 5 rules
func_call: network.whois(sender.email.domain).days_old < 365 3 rules
func_call: network.whois(sender.email.domain).days_old <= 90 3 rules
dc_process 4 values
gt: 3 4 rules
lt: 10 4 rules
ge: 1 2 rules
name 4 values
eq: CHANGE_APPLICATION_SETTING 4 rules
eq: es_process_events 3 rules
eq: /etc/issue 2 rules
eq: /etc/pam.d/system-auth 2 rules
AccessMask 4 values
eq: 0x100 3 rules, 2 vendors
eq: 0x40000 2 rules, 2 vendors
eq: 0x2 2 rules
Computer 4 values
eq: %domain_controllers% 3 rules
contains: <YOUR CA MACHINE NAME> 2 rules
ne: unknown 2 rules
starts_with: DESKTOP-* 2 rules
Esql.alerts_count 4 values
le: 5 3 rules
le: 10 2 rules
le: 20 2 rules
le: 50 2 rules
OpNum 4 values
eq: 1 3 rules
eq: 0 2 rules
eq: 12 2 rules
ResourceType 4 values
eq: AZUREFIREWALLS 3 rules
eq: Login 2 rules
eq: PUBLICIPADDRESSES 2 rules
eq: VAULTS 2 rules
c-uri 4 values
contains: */mgmt/tm/util/bash* 2 rules, 2 vendors
contains: /MSHTML_C7/ 2 rules
contains: /powershell 2 rules
ends_with: .exe 2 rules
EventResult 4 values
eq: Blocked 2 rules
eq: Failed 2 rules
eq: Failure 2 rules
eq: file 2 rules
azure_ad::signin_category 4 values
eq: NonInteractiveUserSignInLogs 2 rules
eq: ServicePrincipalSignInLogs 2 rules
in: NonInteractiveUserSignInLogs 2 rules
dll.code_signature.status 4 values
eq: errorBadDigest 2 rules
eq: errorExpired 2 rules
eq: errorRevoked 2 rules
eq: errorUntrustedRoot 2 rules
kubernetes.audit.level 4 values
eq: RequestResponse 2 rules
in: Request 2 rules
in: RequestResponse 2 rules
in: ResponseComplete 2 rules
kubernetes.audit.user.username 4 values
in: system:anonymous 2 rules
in: system:unauthenticated 2 rules
is_null:
starts_with: system:serviceaccount:* 2 rules
m365::UserType 4 values
in: 0 2 rules
in: 10 2 rules
in: 2 2 rules
process.Ext.effective_parent.executable 4 values
eq: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer 2 rules
eq: /usr/sbin/installer 2 rules
starts_with: /Applications/* 2 rules
starts_with: /Volumes/* 2 rules
process.executable.name 4 values
in: bash 2 rules
in: csh 2 rules
in: sh 2 rules
in: tcsh 2 rules
process.code_signature.trusted 3 values
eq: false 114 rules
Command and Scripting Interpreter
T1059, Unix Shell T1059.004, Credentials from Password Stores T1555, Event Triggered Execution T1546, Application Layer Protocol T1071, Masquerading T1036Sample rules (showing 8 of 114):
- Access to Windows Passwords Vault by Unusual Process
- BLF File Creation by an Unusual Process
- Browser Native Messaging Registry Modification
- Clipboard accessed by Unsigned or Untrusted Binary
- Code Editor Untrusted or Unsigned Child Process Execution
- Component Object Model Registry Modification by a Low Reputation Process
- Connection to Common Large Language Model Endpoints
- Crypto Wallet File Access by Unsigned or Untrusted Binary
eq: true 14 rules
Sample rules (showing 8 of 14):
- .NET COM object created in non-standard Windows Script Interpreter
- Browser Debugging from Unusual Parent
- DLL Side Loading of a file dropped by Microsoft Office
- DLL Side Loading via a Copied Microsoft Executable
- Ingress Tool Transfer via INET Cache
- Oversized DLL Creation followed by SideLoad
- Potential DLL Search Order Hijacking of an Existing Program
- Potential DLL SideLoad via a Renamed Signed Binary
ne: true 8 rules
Sample rules:
- Connection to a Suspicious URL
- File Compressed or Archived into Common Format by Unsigned Process
- Persistence via BITS SetNotifyCmdLine Method
- Potential Decoy Document via User Execution
- Remcos RAT ExePath Registry Modification
- Suspicious Access to Web Browser Credential Stores
- Suspicious Execution from MSSQL Service
- Suspicious Windows Defender Exclusions Added via PowerShell
security_result.action 3 values
eq: ALLOW 102 rules
eq: BLOCK 17 rules
Brute Force
T1110, Valid Accounts T1078, Password Guessing T1110.001, Password Spraying T1110.003, Phishing T1566, Multi-Factor Authentication Request Generation T1621Sample rules (showing 8 of 17):
- AWS High Number Of Unknown User Authentication Attempts
- AWS IAM Access Denied Discovery Events
- AWS Successful Login After Multiple Failed Attempts
- AWS Unusual Number Of Failed Authentication Attempts From The Same IP
- GCP Excessive Permission Denied Events
- Hunt for Expired Tokens Attempting to sign-in to Entra ID
- Hunt for Office 365 group creation failures
- MITRE ATT&CK T1110.001 Windows Repeated Authentication Failures Before Successful One
headers.auth_summary.dmarc.pass 3 values
eq: true 39 rules
Sample rules (showing 8 of 39):
- Brand impersonation: Adobe with suspicious language and link
- Brand impersonation: Booking.com
- Brand impersonation: QuickBooks notification from Intuit themed company name
- Callback phishing via Adobe Sign comment
- Callback phishing via DocuSign comment
- Callback phishing via e-signature service
- Callback phishing via Intuit service abuse
- Callback Phishing via Signable E-Signature Request
is_null:
Sample rules:
- BEC with unusual reply-to or return-path mismatch
- Brand impersonation: Adobe with suspicious language and link
- Brand impersonation: Microsoft with embedded logo and credential theft language
- Display Name Emoji with Financial Symbols
- Extortion / sextortion (untrusted sender)
- Impersonation: Human Resources with link or attachment and engaging language
is_not_null:
recipients.cc 3 values
length_compare: 0 25 rules
Sample rules (showing 8 of 25):
- Attachment: Callback phishing solicitation via image file
- BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread
- Body: HTML whitespace stuffing with short initial message
- Brand impersonation: Norton
- Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited)
- Callback phishing: AOL senders with suspicious HTML template or PDF attachment
- Credential phishing: Generic document sharing
- Credential Phishing: Suspicious language, link, recipients and other indicators
length_compare: 0 7 rules
Sample rules:
- Link: Free file hosting with undisclosed recipients
- Reconnaissance: All recipients cc/bcc'd or undisclosed
- Reconnaissance: Short generic greeting message
- Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern
- VIP / Executive impersonation (strict match, untrusted)
- VIP / Executive impersonation in subject (untrusted)
- VIP local_part impersonation from unsolicited sender
length_compare: 1 4 rules
kubernetes.audit.annotations.authorization_k8s_io/decision 3 values
eq: allow 21 rules
Deploy Container
T1610, Escape to Host T1611, Account Manipulation T1098, Additional Container Cluster Roles T1098.006, Container Administration Command T1609, Permission Groups Discovery T1069Sample rules (showing 8 of 21):
- EKS Authentication Configuration Modified
- Kubernetes Admission Webhook Created or Modified
- Kubernetes Anonymous Request Authorized by Unusual User Agent
- Kubernetes API Request Impersonating Privileged Identity
- Kubernetes Client Certificate Signing Request Created or Approved
- Kubernetes Cluster-Admin Role Binding Created
- Kubernetes Container Created with Excessive Linux Capabilities
- Kubernetes CoreDNS or Kube-DNS Configuration Modified
eq: allow 4 rules
eq: forbid 2 rules
graph.metadata.source_type 3 values
eq: GLOBAL_CONTEXT 20 rules
Sample rules (showing 8 of 20):
- AWS Successful API From Tor Exit Node
- GCP Successful API Call From Tor Exit Node
- GCTI Benign Binaries Contacts Tor Exit Node
- GCTI Remote Access Tools
- GCTI Tor Exit Nodes
- GitHub Personal Access Token Created from Tor IP Address
- Google Safebrowsing File Contacts Tor Exit Node
- Google Safebrowsing File Process Creation
eq: ENTITY_CONTEXT 10 rules
eq: DERIVED_CONTEXT 9 rules
ConfidenceScore 3 values
ge: 50 18 rules
Sample rules (showing 8 of 18):
- CYFIRMA - Medium severity Command & Control Network Indicators with Block Recommendation Rule
- CYFIRMA - Medium severity Command & Control Network Indicators with Monitor Recommendation Rule
- CYFIRMA - Medium severity File Hash Indicators with Block Action and Malware
- CYFIRMA - Medium severity File Hash Indicators with Block Action Rule
- CYFIRMA - Medium severity File Hash Indicators with Monitor Action and Malware
- CYFIRMA - Medium severity File Hash Indicators with Monitor Action Rule
- CYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Block Recommended Rule
- CYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Monitor Recommended Rule
ge: 80 18 rules
Sample rules (showing 8 of 18):
- CYFIRMA - High severity Command & Control Network Indicators with Block Recommendation Rule
- CYFIRMA - High severity Command & Control Network Indicators with Monitor Recommendation Rule
- CYFIRMA - High severity File Hash Indicators with Block Action and Malware
- CYFIRMA - High severity File Hash Indicators with Block Action Rule
- CYFIRMA - High severity File Hash Indicators with Monitor Action and Malware
- CYFIRMA - High severity File Hash Indicators with Monitor Action Rule
- CYFIRMA - High severity Malicious Network Indicators Associated with Malware - Block Recommended Rule
- CYFIRMA - High severity Malicious Network Indicators Associated with Malware - Monitor Recommended Rule
lt: 80 18 rules
Sample rules (showing 8 of 18):
- CYFIRMA - Medium severity Command & Control Network Indicators with Block Recommendation Rule
- CYFIRMA - Medium severity Command & Control Network Indicators with Monitor Recommendation Rule
- CYFIRMA - Medium severity File Hash Indicators with Block Action and Malware
- CYFIRMA - Medium severity File Hash Indicators with Block Action Rule
- CYFIRMA - Medium severity File Hash Indicators with Monitor Action and Malware
- CYFIRMA - Medium severity File Hash Indicators with Monitor Action Rule
- CYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Block Recommended Rule
- CYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Monitor Recommended Rule
Protocol 3 values
eq: tcp 16 rules
Remote Services
T1021, Distributed Component Object Model T1021.003, Inter-Process Communication T1559, Component Object Model T1559.001, System Binary Proxy Execution T1218, Remote System Discovery T1018Sample rules (showing 8 of 16):
- Halfbaked Command and Control Beacon
- Incoming DCOM Lateral Movement via MSHTA
- Incoming DCOM Lateral Movement with MMC
- Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows
- LDAP Search followed by Kerberos Connection
- Possible FIN7 DGA Command and Control Behavior
- Potential Command and Control via Windows Scripts
- Potential Enumeration via Active Directory Web Service
eq: tcp 11 rules, 2 vendors
Sample rules (showing 8 of 11):
- Deprecated TLS Version or Weak Cipher Negotiated Externally
- Rare SMB Connection to the Internet
- RDP (Remote Desktop Protocol) from the Internet
- RPC (Remote Procedure Call) from the Internet
- RPC (Remote Procedure Call) to the Internet
- SMB (Windows File Sharing) Activity from the Internet
- SMB (Windows File Sharing) Activity to the Internet
- SMTP to the Internet on Port 26/TCP
HttpRequestMethod 3 values
eq: GET 12 rules
Sample rules (showing 8 of 12):
- Apache - Apache 2.4.49 flaw CVE-2021-41773
- Cloudflare - Multiple error requests from single source
- Cloudflare - Multiple error requests from single source
- Cloudflare - Unexpected client request
- Cloudflare - Unexpected client request
- Cloudflare - Unexpected URI
- Cloudflare - Unexpected URI
- Detect potential file enumeration activity (ASIM Web Session)
in: POST 12 rules
Sample rules (showing 8 of 12):
- Apache - Put suspicious file
- Cisco WSA - Unexpected uploads
- Cloudflare - Unexpected POST requests
- Cloudflare - Unexpected POST requests
- Cloudflare - XSS probing pattern in request
- Cloudflare - XSS probing pattern in request
- Detect potential presence of a malicious file with a double extension (ASIM Web Session)
- Imperva - Forbidden HTTP request method in request
in: PUT 12 rules
Sample rules (showing 8 of 12):
- Apache - Put suspicious file
- Cisco WSA - Unexpected uploads
- Cloudflare - Unexpected POST requests
- Cloudflare - Unexpected POST requests
- Cloudflare - XSS probing pattern in request
- Cloudflare - XSS probing pattern in request
- Detect potential presence of a malicious file with a double extension (ASIM Web Session)
- Imperva - Forbidden HTTP request method in request
category 3 values
eq: SignInLogs 12 rules
Compromise Accounts
T1586, Cloud Accounts T1586.003, Valid Accounts T1078, Brute Force T1110, Cloud Accounts T1078.004, Password Spraying T1110.003Sample rules (showing 8 of 12):
- Azure AD Authentication Failed During MFA Challenge
- Azure AD Device Code Authentication
- Azure AD High Number Of Failed Authentications For User
- Azure AD High Number Of Failed Authentications From Ip
- Azure AD Multiple AppIDs and UserAgents Authentication Spike
- Azure AD Multiple Denied MFA Requests For User
- Azure AD Multiple Failed MFA Requests For User
- Azure AD Multiple Users Failing To Authenticate From Ip
All_Changes.action 3 values
eq: created 11 rules
Valid Accounts
T1078, Default Accounts T1078.001, Account Manipulation T1098, Device Registration T1098.005Sample rules (showing 8 of 11):
- Cloud Compute Instance Created By Previously Unseen User
- Cloud Compute Instance Created In Previously Unused Region
- Cloud Compute Instance Created With Previously Unseen Image
- Cloud Compute Instance Created With Previously Unseen Instance Type
- Cloud Provisioning Activity From Previously Unseen City
- Cloud Provisioning Activity From Previously Unseen Country
- Cloud Provisioning Activity From Previously Unseen IP Address
- Cloud Provisioning Activity From Previously Unseen Region
eq: started 4 rules
kibana.alert.risk_score 3 values
gt: 21 10 rules
Sample rules (showing 8 of 10):
- Alerts From Multiple Integrations by Destination Address
- Alerts From Multiple Integrations by Source Address
- Alerts From Multiple Integrations by User Name
- Alerts in Different ATT&CK Tactics by Host
- LLM-Based Attack Chain Triage by Host
- LLM-Based Compromised User Triage by User
- Multiple Alerts in Same ATT&CK Tactic by Host
- Multiple Alerts Involving a User
ge: 47 2 rules
ge: 73 2 rules
beta.profile.by_reply_to 3 values
func_call: beta.profile.by_reply_to().prevalence == "new" 8 rules
Sample rules:
- HR impersonation via e-sign agreement comment
- Link: Multistage landing - Abused Google Drive
- Link: Secure SharePoint file share from new or unusual sender
- Service abuse: Adobe Sign notification from an unsolicited reply-to address
- Service abuse: DocuSign notification with suspicious sender or document name
- Service abuse: Dropbox share from an unsolicited reply-to address
- Service abuse: Google Drive share from an unsolicited reply-to address
- Service Abuse: Zoom with freemail reply-to and recipient address in greeting
func_call: beta.profile.by_reply_to().any_messages_malicious_or_spam 3 rules
func_call: beta.profile.by_reply_to().solicited == false 2 rules
process.Ext.api.metadata.target_address_name 3 values
eq: Unbacked 8 rules
Sample rules:
- Memory Allocation from a High Entropy Module
- Potential Shellcode Fluctuation v1
- Potential Shellcode Injection via a WebShell
- Shellcode API behavior from a signed module
- Shellcode behavior from suspicious RWX provenance
- Shellcode Behavior via .NET Core
- Suspicious File Memory Mapping via Managed .NET
- Suspicious Memory Protection Change via VirtualProtect
eq: mswsock.dll 2 rules
starts_with: ?* 2 rules
process.parent.user.id 3 values
ne: 0 8 rules
Sample rules:
- Potential Local Privilege Escalation via Unshare
- Potential Privilege Escalation via a Known SUID/SGID Binary
- Potential Privilege Escalation via a Parent Process Sequence
- Potential Privilege Escalation via a Parent/Child Process Sequence
- Potential Privilege Escalation via a SUID/SGID Binary
- Potential Privilege Escalation via a Suspicious UID Change
- Potential Privilege Escalation via Busctl System Call
- Potential Privilege Escalation via Python Exploit
ne: 0 5 rules
ge: 1000 2 rules
AuthenticationPackageName 3 values
eq: NTLM 7 rules, 3 vendors
Remote Services
T1021, SMB/Windows Admin Shares T1021.002, Adversary-in-the-Middle T1557, Name Resolution Poisoning and SMB Relay T1557.001, Account Manipulation T1098, Access Token Manipulation T1134Sample rules:
- Potential NTLM Relay Attack against a Computer Account
- Anonymous login (RottenPotatoNG)
- Exchange server impersonation via PrivExchange relay attack
- Metasploit SMB Authentication
- Suspicious anonymous login (domain specified)
- User password change without previous password known - SetNTLM (Mimikatz)
- Potential EternalBlue via Metasploit (Windows Event Log)
eq: Kerberos 5 rules, 3 vendors
okta::outcome.result 3 values
eq: SUCCESS 7 rules, 2 vendors
Valid Accounts
T1078, Cloud Accounts T1078.004, Multi-Factor Authentication Request Generation T1621, Modify Authentication Process T1556, Account Manipulation T1098, Brute Force T1110Sample rules:
- MFA Deactivation with no Re-Activation for Okta User Account
- Okta Successful Login After Credential Attack
- Potential Okta MFA Bombing via Push Notifications
- Potentially Successful Okta MFA Bombing via Push Notifications
- Device Registration from Malicious IP
- New Device/Location sign-in along with critical operation
- User Session Impersonation(Okta)
eq: SUCCESS 3 rules, 2 vendors
execve_command 3 values
in: *find* 7 rules
File and Directory Discovery
T1083, Credentials from Password Stores T1555, Password Managers T1555.005, Unsecured Credentials T1552, Private Keys T1552.004Sample rules:
- Linux Auditd Database File And Directory Discovery
- Linux Auditd File And Directory Discovery
- Linux Auditd Find Credentials From Password Managers
- Linux Auditd Find Credentials From Password Stores
- Linux Auditd Find Ssh Private Keys
- Linux Auditd Private Keys and Certificate Enumeration
- Linux Auditd Virtual Disk File And Directory Discovery
in: *grep* 7 rules
File and Directory Discovery
T1083, Credentials from Password Stores T1555, Password Managers T1555.005, Unsecured Credentials T1552, Private Keys T1552.004Sample rules:
- Linux Auditd Database File And Directory Discovery
- Linux Auditd File And Directory Discovery
- Linux Auditd Find Credentials From Password Managers
- Linux Auditd Find Credentials From Password Stores
- Linux Auditd Find Ssh Private Keys
- Linux Auditd Private Keys and Certificate Enumeration
- Linux Auditd Virtual Disk File And Directory Discovery
in: *.key* 2 rules
okta::outcome.reason 3 values
in: INVALID_CREDENTIALS 6 rules, 2 vendors
in: LOCKED_OUT 5 rules
EventCategory 3 values
eq: firewall 6 rules
in: DKIMConfiguration 2 rules
in: SPFConfiguration 2 rules
azure.platformlogs.category 3 values
in: kube-audit 6 rules
Adversary-in-the-Middle
T1557, Steal or Forge Authentication Certificates T1649, Steal Application Access Token T1528, Indicator Removal T1070, Permission Groups Discovery T1069, Cloud Groups T1069.003Sample rules:
- Azure AKS Certificate Signing Request Created or Approved
- Azure AKS CoreDNS or Kube-DNS Configuration Modified
- Azure AKS Ephemeral Container Added to Pod
- Azure AKS Kubernetes Events Deleted
- Azure AKS Service Account Token Created via TokenRequest API
- Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity
in: kube-audit-admin 6 rules
Adversary-in-the-Middle
T1557, Steal or Forge Authentication Certificates T1649, Steal Application Access Token T1528, Indicator Removal T1070, Permission Groups Discovery T1069, Cloud Groups T1069.003Sample rules:
- Azure AKS Certificate Signing Request Created or Approved
- Azure AKS CoreDNS or Kube-DNS Configuration Modified
- Azure AKS Ephemeral Container Added to Pod
- Azure AKS Kubernetes Events Deleted
- Azure AKS Service Account Token Created via TokenRequest API
- Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity
c_process 3 values
graph.metadata.vendor_name 3 values
eq: VirusTotal 6 rules
eq: WHOIS 5 rules
eq: Google Cloud Threat Intelligence 4 rules
process.parent.group.id 3 values
ne: 0 6 rules
Sample rules:
- Potential Privilege Escalation via a Known SUID/SGID Binary
- Potential Privilege Escalation via a Parent Process Sequence
- Potential Privilege Escalation via a Parent/Child Process Sequence
- Potential Privilege Escalation via a SUID/SGID Binary
- Potential Privilege Escalation via a Suspicious UID Change
- Potential Privilege Escalation via Python Exploit
ne: 0 5 rules
ge: 1000 2 rules
LogonProcessName 3 values
eq: seclogo 5 rules, 2 vendors
eq: NtLmSsp 2 rules
starts_with: Advapi* 2 rules
SubjectUserSid 3 values
starts_with: S-1-5-21- 5 rules
eq: S-1-5-18 4 rules, 3 vendors
starts_with: S-1-5-21 2 rules, 2 vendors
additional.fields["msg_1"] 3 values
regex_match: ^AU1$|^AU5$ 5 rules
eq: AU7 3 rules
aws::userIdentity.accessKeyId 3 values
starts_with: AKIA* 5 rules
is_not_null:
file.size 3 values
ge: 30000 5 rules
gt: 0 3 rules
ge: 100000000 2 rules
http.request.method 3 values
eq: GET 5 rules
eq: POST 4 rules
source_count 3 values
ge: 4 5 rules
ge: 2 3 rules
NetworkApplicationProtocol 3 values
eq: SMTP 4 rules
in: HTTP 2 rules
in: HTTPs 2 rules
appDisplayName 3 values
contains: *Copilot* 4 rules
eq: M365ChatClient 4 rules
eq: OfficeAIAppChatCopilot 3 rules
body.plain.raw 3 values
regex_match: [\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}] 4 rules
is_null:
regex_match: ^\s*$ 2 rules
response.statusCode 3 values
in: 401 4 rules
in: 403 4 rules
eq: 200 2 rules
TicketOptions 3 values
eq: 0x40810000 3 rules, 2 vendors
eq: 0x40800000 2 rules
responseStatus.code 3 values
eq: 403 3 rules, 2 vendors
eq: 401 2 rules, 2 vendors
Company 3 values
eq: AnyDesk Software GmbH 3 rules
eq: Microsoft Corporation 2 rules, 2 vendors
eq: LogMeIn, Inc. 2 rules
EventMessage 3 values
eq: Login 3 rules
contains: Behavior Monitoring 2 rules
eq: User's password changed 2 rules
TargetUserSid 3 values
eq: S-1-5-7 3 rules
starts_with: S-1-5-21- 3 rules
headers.auth_summary.spf.details.designator 3 values
ends_with: .dropbox.com 3 rules
contains: +SRS= 2 rules
ends_with: .intuit.com 2 rules
process.Ext.api.parameters.buffer 3 values
contains: *http* 3 rules
contains: *while (* 2 rules
contains: *while(* 2 rules
responseElements.ConsoleLogin 3 values
eq: Failure 3 rules
eq: Failure 2 rules
Sample rules:
eq: Success 2 rules
subsystem 3 values
eq: com.apple.TCC 3 rules
eq: com.apple.sudo 3 rules
eq: com.apple.securityd 2 rules
AccessMask_ 3 values
eq: 1 2 rules
eq: 2 2 rules
Attributes 3 values
contains: *CertificateTemplate:* 2 rules
contains: cdc: 2 rules
Changes 3 values
in: Failure removed 2 rules
in: Success removed 2 rules
in: Success removed, Failure removed 2 rules
EventCategoryType 3 values
in: exchange 2 rules
in: exchangeserver 2 rules
in: gmail 2 rules
EventResultDetails 3 values
in: NXDOMAIN 2 rules
in: REFUSED 2 rules
in: SERVFAIL 2 rules
PipeName 3 values
eq: \PSEXESVC 2 rules
eq: \sdlrpc 2 rules
starts_with: \PSHost 2 rules
SrcGeoCountry 3 values
in: cn 2 rules
in: hk 2 rules
auditd.data.syscall 3 values
eq: socket 2 rules
in: finit_module 2 rules
in: init_module 2 rules
azure.activitylogs.operation_name 3 values
eq: MICROSOFT.COMPUTE/SNAPSHOTS/DELETE 2 rules
eq: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/LISTCLUSTERUSERCREDENTIAL/ACTION 2 rules
eq: MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE 2 rules
cs-uri-stem 3 values
contains: .jsp 2 rules
contains: /irj/ 2 rules
contains: /oauth/idp/.well-known/openid-configuration 2 rules
destination.address 3 values
eq: 169.254.169.254 2 rules
wildcard: 127.* 2 rules
wildcard: ::1 2 rules
dll.Ext.defense_evasions 3 values
eq: Process Tampering: Code integrity violation 2 rules
eq: Process Tampering: Image has been accessed before mapping 2 rules
eq: Process Tampering: Image is writable 2 rules
headers.return_path.domain.root_domain 3 values
eq: salesforce.com 2 rules
macro: headers.return_path.domain.root_domain in free_email_providers 2 rules
ne: bestdeals.today 2 rules
kibana.alert.severity 3 values
in: critical 2 rules
in: high 2 rules
okta::severity 3 values
eq: High 2 rules
Sample rules:
in: critical 2 rules
in: high 2 rules
operation 3 values
eq: RpcAddPrintProcessor 2 rules
eq: RpcAsyncAddPrintProcessor 2 rules
wildcard: REST.*.OBJECT 2 rules
Sample rules:
process.name.caseless 3 values
in: powershell.exe 2 rules
in: powershell_ise.exe 2 rules
in: pwsh.exe 2 rules
security_result.category_details 3 values
eq: APPLICATION_SETTINGS 2 rules
eq: DELEGATED_ADMIN_SETTINGS 2 rules
eq: USER_SETTINGS 2 rules
target.application 3 values
eq: cloudresourcemanager.googleapis.com 2 rules
eq: iam.amazonaws.com 2 rules
eq: storage.googleapis.com 2 rules
{}.RequiredAppPermissions{}.EntitlementId 3 values
eq: 06b708a9-e830-4db3-a914-8e69da51d44f 2 rules
eq: 9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8 2 rules
eq: dc890d15-9560-4a4c-9b7f-a736ec74ec40 2 rules
process.code_signature.exists 2 values
eq: false 118 rules
Command and Scripting Interpreter
T1059, Unix Shell T1059.004, Credentials from Password Stores T1555, Event Triggered Execution T1546, Application Layer Protocol T1071, Unsecured Credentials T1552Sample rules (showing 8 of 118):
- Access to Windows Passwords Vault by Unusual Process
- BLF File Creation by an Unusual Process
- Browser Native Messaging Registry Modification
- Clipboard accessed by Unsigned or Untrusted Binary
- Code Editor Untrusted or Unsigned Child Process Execution
- Common Language Runtime Loaded via an Unsigned Module
- Component Object Model Registry Modification by a Low Reputation Process
- Connection to Common Large Language Model Endpoints
resultType 2 values
in: Succeeded 51 rules
in: Success 51 rules
headers.in_reply_to 2 values
is_null:
Sample rules (showing 8 of 45):
- Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
- Attachment with auto-executing macro (unsolicited)
- Attachment: Adobe image lure in body or attachment with suspicious link
- Attachment: Callback phishing solicitation via pdf file
- Attachment: EML file contains HTML attachment with login portal indicators
- Attachment: Legal themed message or PDF with suspicious indicators
- Attachment: Microsoft 365 credential phishing
- BEC/Fraud: Job scam fake thread or plaintext pivot to freemail
headers.references 2 values
length_compare: 0 44 rules
Sample rules (showing 8 of 44):
- Attachment with auto-executing macro (unsolicited)
- Attachment: Adobe image lure in body or attachment with suspicious link
- Attachment: Callback phishing solicitation via pdf file
- Attachment: EML file contains HTML attachment with login portal indicators
- Attachment: Legal themed message or PDF with suspicious indicators
- Attachment: Microsoft 365 credential phishing
- BEC/Fraud: Job scam fake thread or plaintext pivot to freemail
- BEC/Fraud: Penpal scam
length_compare: 0 12 rules
Sample rules (showing 8 of 12):
- Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
- Attachment: Adobe image lure in body or attachment with suspicious link
- Attachment: Callback phishing solicitation via pdf file
- Attachment: Microsoft 365 credential phishing
- Brand impersonation: Adobe with suspicious language and link
- Brand impersonation: DHL
- Brand impersonation: Robinhood
- Business Email Compromise (BEC) with request for mobile number
aws::errorMessage 2 values
is_null:
Account Manipulation
T1098, Additional Cloud Roles T1098.003, Transfer Data to Cloud Account T1537, Disable or Modify Tools T1562, File and Directory Discovery T1083, Disable or Modify Tools T1562.001Sample rules (showing 8 of 30):
- AWSCloudTrail - Amazon ECR image scanning disabled
- AWSCloudTrail - AWS GuardDuty detector disabled or suspended
- AWSCloudTrail - ECR image scan findings high or critical
- AWSCloudTrail - Network ACL with all the open ports to a specified CIDR
- AWSCloudTrail - Policy version set to default
- AWSCloudTrail - Privilege escalation via CloudFormation policy
- AWSCloudTrail - Privilege escalation via CRUD DynamoDB policy
- AWSCloudTrail - Privilege escalation via CRUD IAM policy
eq: Failed authentication 4 rules, 2 vendors
process.thread.Ext.call_stack_final_user_module.hash.sha256 2 values
is_not_null:
Sample rules (showing 8 of 30):
- Asynchronous Procedure Call from Unusual Module
- Direct Syscall from Unsigned Module
- Image Hollow from Unusual Stack
- Keystroke Input Capture via RegisterRawInputDevices
- Keystroke Messages Hooking via SetWindowsHookEx
- Keystrokes Input Capture from Suspicious CallStack
- LSASS Memory Read via PPL Bypass
- Memory Allocation from a High Entropy Module
starts_with: ?* 3 rules
container.id 2 values
wildcard: * 26 rules
Command and Scripting Interpreter
T1059, Unix Shell T1059.004, Permission Groups Discovery T1069, Account Discovery T1087, Container Administration Command T1609, Deploy Container T1610Sample rules (showing 8 of 26):
- Cloud Credential Search Detected via Defend for Containers
- Container Management Utility Execution Detected via Defend for Containers
- DebugFS Execution Detected via Defend for Containers
- Direct Interactive Kubernetes API Request by Common Utilities
- Direct Interactive Kubernetes API Request by Unusual Utilities
- Direct Kubernetes API Request Detected via Defend for Containers
- DNS Enumeration Detected via Defend for Containers
- Dynamic Linker Modification Detected via Defend for Containers
starts_with: ?* 22 rules
Sample rules (showing 8 of 22):
- Chroot Execution Detected via Defend for Containers
- Curl SOCKS Proxy Detected via Defend for Containers
- Decoded Payload Piped to Interpreter Detected via Defend for Containers
- Encoded Payload Detected via Defend for Containers
- File Creation and Execution Detected via Defend for Containers
- File Download Detected via Defend for Containers
- File Execution Permission Modification Detected via Defend for Containers
- Modification of Persistence Relevant Files Detected via Defend for Containers
Web.status 2 values
eq: 200 25 rules
Sample rules (showing 8 of 25):
- Adobe ColdFusion Access Control Bypass
- Adobe ColdFusion Unauthenticated Arbitrary File Read
- Cisco IOS XE Implant Access
- Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure
- Citrix ADC and Gateway Unauthorized Data Disclosure
- Confluence CVE-2023-22515 Trigger Vulnerability
- Confluence Data Center and Server Privilege Escalation
- ConnectWise ScreenConnect Authentication Bypass
in: 200 2 rules
Result 2 values
eq: Success 23 rules
Valid Accounts
T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Create Account T1136Sample rules (showing 8 of 23):
- Account created or deleted by non-approved user
- Account Elevated to New Role
- Application Redirect URL Update
- Cisco Duo - Authentication device new location
- Cisco Duo - New access device
- Cisco Duo - Unexpected authentication factor
- Conditional Access Policy Modified by New User
- Credential added after admin consented to Application
MessageType 2 values
eq: 2 21 rules
dll.code_signature.trusted 2 values
eq: false 21 rules
Sample rules (showing 8 of 21):
- DLL Loaded from a Macro Enabled Document
- DLL Side Loading of a file dropped by Microsoft Office
- Evasion via LdrpKernel32 Overwrite
- Execution of a File Downloaded via Windows OpenSSH
- Known Desktop Application DLL Search Order Hijack
- Library Loaded via a CallBack Function
- Library Loaded via Thread Fiber CallBack
- Microsoft Office AddIn Loaded
RecommendedActions 2 values
contains: Block 18 rules
Sample rules (showing 8 of 18):
- CYFIRMA - High severity Command & Control Network Indicators with Block Recommendation Rule
- CYFIRMA - High severity File Hash Indicators with Block Action and Malware
- CYFIRMA - High severity File Hash Indicators with Block Action Rule
- CYFIRMA - High severity Malicious Network Indicators Associated with Malware - Block Recommended Rule
- CYFIRMA - High severity Malicious Network Indicators with Block Action Rule
- CYFIRMA - High severity Malicious Phishing Network Indicators - Block Recommended Rule
- CYFIRMA - High severity TOR Node Network Indicators - Block Recommended Rule
- CYFIRMA - High severity Trojan File Hash Indicators with Block Action Rule
contains: Monitor 18 rules
Sample rules (showing 8 of 18):
- CYFIRMA - High severity Command & Control Network Indicators with Monitor Recommendation Rule
- CYFIRMA - High severity File Hash Indicators with Monitor Action and Malware
- CYFIRMA - High severity File Hash Indicators with Monitor Action Rule
- CYFIRMA - High severity Malicious Network Indicators Associated with Malware - Monitor Recommended Rule
- CYFIRMA - High severity Malicious Network Indicators with Monitor Action Rule
- CYFIRMA - High severity Malicious Phishing Network Indicators - Monitor Recommended Rule
- CYFIRMA - High severity TOR Node Network Indicators - Monitor Recommended Rule
- CYFIRMA - High severity Trojan File Hash Indicators with Monitor Action Rule
recipients.bcc 2 values
length_compare: 0 18 rules
Sample rules (showing 8 of 18):
- Attachment: Callback phishing solicitation via image file
- Body: HTML whitespace stuffing with short initial message
- Brand impersonation: Norton
- Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited)
- Callback phishing: AOL senders with suspicious HTML template or PDF attachment
- Credential Phishing: Suspicious language, link, recipients and other indicators
- Free subdomain link with credential theft indicators
- Headers: Self-sender using Microsoft CompAuth bypass with credential theft content
length_compare: 0 9 rules
Sample rules (showing 8 of 9):
- Free subdomain link with credential theft indicators
- Invoicera infrastructure abuse
- Job scam (unsolicited sender)
- Link abuse: Self-service creation platform link with suspicious recipient behavior
- Link: Free file hosting with undisclosed recipients
- Reconnaissance: All recipients cc/bcc'd or undisclosed
- Reconnaissance: Short generic greeting message
- Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern
process.interactive 2 values
eq: true 17 rules
Command and Scripting Interpreter
T1059, Unix Shell T1059.004, Permission Groups Discovery T1069, Account Discovery T1087, Container Administration Command T1609, Deploy Container T1610Sample rules (showing 8 of 17):
- Container Management Utility Run Inside A Container
- Direct Interactive Kubernetes API Request by Common Utilities
- Direct Interactive Kubernetes API Request by Unusual Utilities
- Execution of Memory File Descriptor via Interactive Session
- Forbidden Direct Interactive Kubernetes API Request
- Long Base64 Command Execution via Interactive Shell
- Payload Downloaded and Piped to Interpreter
- Potential Fileless Execution via Memory File Descriptor by LoLBin
eq: true 2 rules
priority_s 2 values
eq: P1 16 rules
Sample rules (showing 8 of 16):
eq: P2 16 rules
Sample rules (showing 8 of 16):
ProviderName 2 values
eq: IoTSecurity 15 rules
Sample rules (showing 8 of 15):
- Denial of Service (Microsoft Defender for IoT)
- Excessive Login Attempts (Microsoft Defender for IoT)
- Firmware Updates (Microsoft Defender for IoT)
- High bandwidth in the network (Microsoft Defender for IoT)
- Illegal Function Codes for ICS traffic (Microsoft Defender for IoT)
- Internet Access (Microsoft Defender for IoT)
- Multiple scans in the network (Microsoft Defender for IoT)
- No traffic on Sensor Detected (Microsoft Defender for IoT)
recipients.to[0].email.domain.valid 2 values
eq: true 15 rules
Sample rules (showing 8 of 15):
- Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure
- Attachment: EML with QR code redirecting to Cloudflare challenges
- Attachment: PDF with credential theft language and invalid reply-to domain
- Attachment: QR code with recipient targeting and special characters
- Attachment: QR code with suspicious URL patterns in EML file
- Link: Commonly Abused Web Service redirecting to ZIP file
- Link: Credential theft with invisible Unicode character in page title from unsolicited sender
- Link: JavaScript obfuscation with Telegram bot integration
eq: false 10 rules
Sample rules (showing 8 of 10):
- Attachment: PDF with localhost IP in EXIF title metadata
- Attachment: PDF with self-service platform links with self sender or blank recipients
- Attachment: Self-sender PDF with minimal content and view prompt
- Brand impersonation: Bids & Tenders
- Headers: Self-sender using Microsoft CompAuth bypass with credential theft content
- Link: Gmail phishkit with suspicious recipient
- Link: PDF filename impersonation with credential theft language
- Link: Self-sent message with quarterly document review request
network.http.method 2 values
eq: GET 14 rules
Exfiltration Over Alternative Protocol
T1048, Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.002Sample rules (showing 8 of 14):
- API access to mailboxes for top N messages via the Microsoft Graph
- Entra ID application enumeration observed in the Microsoft Graph API
- Enumeration observed in the Microsoft Graph API using GraphRunner GraphRecon command
- Enumeration of inboxes accessible by a user in the Microsoft Graph API
- Enumeration of updatable groups in the Microsoft Graph API
- Enumeration of users and group membership observed in the Microsoft Graph API
- Hunt for application API calls in the Microsoft Graph
- Hunt for authorization policy API calls in the Microsoft Graph
eq: POST 7 rules
Sample rules:
- Enumeration observed in the Microsoft Graph API using GraphRunner GraphRecon command
- Enumeration of updatable groups in the Microsoft Graph API
- Hunt for Bad Request errors against the Groups endpoint in the Microsoft Graph API
- Hunt for search/query endpoint API requests in the Microsoft Graph
- Hunt for successful group creation in the Microsoft Graph API
- Hunt for Undocumented API - Estimate Access called in Microsoft Graph API
- SharePoint CVE-2025-49706 Exploitation
network.http.response_code 2 values
eq: 200 12 rules
Sample rules (showing 8 of 12):
- API access to mailboxes for top N messages via the Microsoft Graph
- Entra ID application enumeration observed in the Microsoft Graph API
- Enumeration observed in the Microsoft Graph API using GraphRunner GraphRecon command
- Enumeration of updatable groups in the Microsoft Graph API
- Enumeration of users and group membership observed in the Microsoft Graph API
- Hunt for application API calls in the Microsoft Graph
- Hunt for authorization policy API calls in the Microsoft Graph
- Hunt for group members enumeration in the Microsoft Graph API
process.entry_leader.entry_meta.type 2 values
eq: container 11 rules
Sample rules (showing 8 of 11):
- AWS Credentials Searched For Inside A Container
- Container Management Utility Run Inside A Container
- Egress Connection from Entrypoint in Container
- Exec Into Container Detected via Defend for Containers
- File System Debugger Launched Inside a Container
- Mount Launched Inside a Container
- Potential Docker Escape via Nsenter
- Sensitive Files Compression Inside A Container
eq: container 2 rules
action_id_s 2 values
contains: BCM 10 rules
Sample rules (showing 8 of 10):
- Affected rows stateful anomaly on database
- Credential errors stateful anomaly on database
- Drop attempts stateful anomaly on database
- Execution attempts stateful anomaly on database
- Firewall errors stateful anomaly on database
- Firewall rule manipulation attempts stateful anomaly on database
- OLE object manipulation attempts stateful anomaly on database
- Outgoing connection attempts stateful anomaly on database
contains: RCM 10 rules
Sample rules (showing 8 of 10):
- Affected rows stateful anomaly on database
- Credential errors stateful anomaly on database
- Drop attempts stateful anomaly on database
- Execution attempts stateful anomaly on database
- Firewall errors stateful anomaly on database
- Firewall rule manipulation attempts stateful anomaly on database
- OLE object manipulation attempts stateful anomaly on database
- Outgoing connection attempts stateful anomaly on database
azure_ad::user_type 2 values
eq: Member 10 rules
Valid Accounts
T1078, Cloud Accounts T1078.004, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Modify Authentication Process T1556, Steal Application Access Token T1528Sample rules (showing 8 of 10):
- Entra ID ADRS Token Request by Microsoft Authentication Broker
- Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN
- Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource
- Entra ID OAuth ROPC Grant Login Detected
- Entra ID OAuth user_impersonation Scope for Unusual User and Client
- Entra ID User Sign-In via Unusual Legacy Authentication Client
- Entra ID User Sign-in with Unusual Authentication Type
- Entra ID User Sign-in with Unusual Client
eq: Member 5 rules
Use Alternate Authentication Material
T1550, Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Application Access Token T1550.001, Account Manipulation T1098Sample rules:
- Entra ID AiTM Phishing-Kit Chain Detected
- Entra ID Deviceless Windows Hello Sign-in Followed by Device Registration
- Entra ID MFA TOTP Brute Force Attempted
- Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS)
- Entra ID OAuth PRT Issuance to Non-Managed Device Detected
source.as.number 2 values
is_not_null:
Valid Accounts
T1078, Cloud Accounts T1078.004, Cloud Administration Command T1651, Modify Authentication Process T1556, Conditional Access Policies T1556.009, Boot or Logon Initialization Scripts T1037Sample rules (showing 8 of 10):
- Azure AD Graph Access with Unusual User and ASN
- Azure Compute VM Command Executed
- Azure VM Extension CRUD Operation with Unusual Source ASN
- Azure VM Serial Console Connection with Unusual User and ASN
- Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN
- Entra ID Service Principal with Unusual Source ASN
- Entra ID Windows Hello for Business Credential Registered
- GKE Secrets List from Unusual Source AS Organization
uid 2 values
is_not_null:
Signed 2 values
eq: false 9 rules, 2 vendors
Hijack Execution Flow
T1574, DLL T1574.001, OS Credential Dumping T1003, LSASS Memory T1003.001, Masquerading T1036, Match Legitimate Resource Name or Location T1036.005Sample rules (showing 8 of 9):
- Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded
- Unsigned .node File Loaded
- Unsigned Image Loaded Into LSASS Process
- Unsigned Module Loaded by ClickOnce Application
- UAC Bypass MMC Load Unsigned Dll
- Windows Hijack Execution Flow Version Dll Side Load
- Windows Unsigned DLL Side-Loading
- Windows Unsigned DLL Side-Loading In Same Process Path
DvcAction 2 values
eq: Allowed 8 rules
Sample rules:
- Cisco Cloud Security - Connection to non-corporate private network
- Cisco Cloud Security - Request Allowed to harmful/malicious URI category
- Cisco Cloud Security - Request to blocklisted file type
- Cisco Cloud Security - URI contains IP address
- Cisco Umbrella - Connection to non-corporate private network
- Cisco Umbrella - Request Allowed to harmful/malicious URI category
- Cisco Umbrella - Request to blocklisted file type
- Cisco Umbrella - URI contains IP address
dc_host 2 values
http_method 2 values
eq: POST 8 rules
Sample rules:
- Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity
- HTTP Rapid POST with Mixed Status Codes
- JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198
- Multiple Archive Files Http Post Traffic
- Nginx ConnectWise ScreenConnect Authentication Bypass
- Plain HTTP POST Exfiltrated Data
- Suspicious Java Classes
- Web Spring4Shell HTTP Request Class Module
Esql.recent 2 values
le: 6 7 rules
Sample rules:
- First Seen Network Flow Exporter
- First Time Seen DNS Query to RMM Domain
- First-Time FortiGate Administrator Login
- FortiGate Administrator Login from Multiple IP Addresses
- FortiGate FortiCloud SSO Login from Unusual Source
- Newly Observed Process Exhibiting High CPU Usage
- Newly Observed ScreenConnect Host Server
EventSubType 2 values
ne: AttackAttempt 7 rules
Sample rules:
- CyberArkEPM - MSBuild usage as LOLBin
- CyberArkEPM - Possible execution of Powershell Empire
- CyberArkEPM - Process started from different locations
- CyberArkEPM - Renamed Windows binary
- CyberArkEPM - Uncommon Windows process started from System folder
- CyberArkEPM - Unexpected executable extension
- CyberArkEPM - Unexpected executable location
eq: AttackAttempt 2 rules
SuspiciousLevel 2 values
eq: high suspicious attack 7 rules
Sample rules:
- AIShield - Image classification AI Model Evasion high suspicious vulnerability detection
- AIShield - Image classification AI Model extraction high suspicious vulnerability detection
- AIShield - Image Segmentation AI Model extraction high suspicious vulnerability detection
- AIShield - Natural language processing AI model extraction high suspicious vulnerability detection
- AIShield - Tabular classification AI Model Evasion high suspicious vulnerability detection
- AIShield - Tabular classification AI Model extraction high suspicious vulnerability detection
- AIShield - Timeseries Forecasting AI Model extraction high suspicious vulnerability detection
eq: low suspicious attack 2 rules
endgame.metadata.type 2 values
eq: detection 7 rules
Sample rules:
- Credential Dumping - Detected - Elastic Endgame
- Credential Manipulation - Detected - Elastic Endgame
- Exploit - Detected - Elastic Endgame
- Malware - Detected - Elastic Endgame
- Permission Theft - Detected - Elastic Endgame
- Process Injection - Detected - Elastic Endgame
- Ransomware - Detected - Elastic Endgame
eq: prevention 7 rules
Sample rules:
- Credential Dumping - Prevented - Elastic Endgame
- Credential Manipulation - Prevented - Elastic Endgame
- Exploit - Prevented - Elastic Endgame
- Malware - Prevented - Elastic Endgame
- Permission Theft - Prevented - Elastic Endgame
- Process Injection - Prevented - Elastic Endgame
- Ransomware - Prevented - Elastic Endgame
event_platform 2 values
eq: Win 7 rules
eq: Mac 3 rules
message_id 2 values
in: 111008 7 rules
in: 111010 7 rules
prefix 2 values
process.parent.interactive 2 values
eq: false 7 rules
Sample rules:
- Payload Downloaded via Curl or Wget by Web Server
- Payload Execution by Node.js Web Server
- Payload Execution by Web Server
- Potential Remote Code Execution via Database Server
- Potential Remote Code Execution via Mail Server
- Suspicious Web Server Child Process
- Web Server Exploitation Detected via Defend for Containers
eq: true 2 rules
source.as.organization.name 2 values
is_not_null:
Unsecured Credentials
T1552, Account Discovery T1087, Cloud Account T1087.004, Serverless Execution T1648, Valid Accounts T1078, Cloud Accounts T1078.004Sample rules:
- AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN
- AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure
- AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization
- AWS EC2 Role GetCallerIdentity from New Source AS Organization
- AWS Lambda Function Invoked from an Unusual Source ASN
- AWS Rare Source AS Organization Activity
- GKE Secrets List from Unusual Source AS Organization
ne: MICROSOFT-CORP-MSN-as-BLOCK 2 rules
Esql.script_block_length 2 values
gt: 500 6 rules
Obfuscated Files or Information
T1027, Command Obfuscation T1027.010, Command and Scripting Interpreter T1059, PowerShell T1059.001, Deobfuscate/Decode Files or Information T1140Sample rules:
- Dynamic IEX Reconstruction via Method String Access
- Potential Dynamic IEX Reconstruction via Environment Variables
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- Potential PowerShell Obfuscation via String Concatenation
- Potential PowerShell Obfuscation via String Reordering
- PowerShell Obfuscation via Negative Index String Reversal
Esql.script_block_pattern_count 2 values
ge: 1 6 rules
Obfuscated Files or Information
T1027, Command Obfuscation T1027.010, Command and Scripting Interpreter T1059, PowerShell T1059.001, Deobfuscate/Decode Files or Information T1140Sample rules:
- Dynamic IEX Reconstruction via Method String Access
- Potential Dynamic IEX Reconstruction via Environment Variables
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- Potential PowerShell Obfuscation via Character Array Reconstruction
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
- PowerShell Obfuscation via Negative Index String Reversal
EventResourceId 2 values
eq: TRAFFIC 6 rules
file.Ext.windows.zone_identifier 2 values
github.programmatic_access_type 2 values
in: Fine-grained personal access token 6 rules
Sample rules:
- First Occurrence GitHub Event for a Personal Access Token (PAT)
- First Occurrence of IP Address For GitHub Personal Access Token (PAT)
- First Occurrence of Personal Access Token (PAT) Use For a GitHub User
- First Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT)
- First Occurrence of User Agent For a GitHub Personal Access Token (PAT)
- High Number of Cloned GitHub Repos From PAT
in: OAuth access token 6 rules
Sample rules:
- First Occurrence GitHub Event for a Personal Access Token (PAT)
- First Occurrence of IP Address For GitHub Personal Access Token (PAT)
- First Occurrence of Personal Access Token (PAT) Use For a GitHub User
- First Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT)
- First Occurrence of User Agent For a GitHub Personal Access Token (PAT)
- High Number of Cloned GitHub Repos From PAT
http.response.status_code 2 values
eq: 200 6 rules
Sample rules:
- Entra ID External Authentication Methods (EAM) Modified
- Inbound Connection to an Unsecure Elasticsearch Node
- Microsoft Graph Request User Impersonation by Unusual Client
- Web Server Local File Inclusion Activity
- Web Server Potential Command Injection Request
- Web Server Potential Remote File Inclusion Activity
okta::actor.alternateId 2 values
outcome.result 2 values
eq: SUCCESS 6 rules
eq: FAILURE 2 rules, 2 vendors
ResultStatus 2 values
eq: Success 5 rules, 2 vendors
eq: Succeeded 2 rules
EVENT_TYPE 2 values
eq: LOGIN 5 rules
in: ApiConnectedApp 2 rules
body.html.inner_text 2 values
regex_match: \+𝟭|𝗽𝗮𝘆𝗺𝗲𝗻𝘁|𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸|𝗿𝗲𝗳𝘂𝗻𝗱|𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀|𝗰𝗮𝗹𝗹|𝗰𝗮𝗻𝗰𝗲𝗹 5 rules
contains: *kindly* 4 rules
current 2 values
eq: True 5 rules
ne: false 3 rules
file.Ext.entropy 2 values
ge: 6 5 rules
match 2 values
is_not_null:
eq: 0 2 rules
process.group.id 2 values
eq: 0 5 rules
process.real_group.id 2 values
ne: 0 5 rules
process.real_user.id 2 values
ne: 0 5 rules
process.user.id 2 values
eq: 0 5 rules
properties.authenticationDetails{}.succeeded 2 values
eq: false 5 rules
properties.status.errorCode 2 values
resource 2 values
in: clusterroles 5 rules
AccountType 2 values
eq: User 4 rules
Esql.verdict 2 values
in: SUSPICIOUS 4 rules
ThreatLevel 2 values
eq: dangerous 4 rules
action_s 2 values
eq: AnomalyScoring 4 rules
eq: Matched 2 rules
beta.parse_exif 2 values
func_call: beta.parse_exif(file.message_screenshot()).image_height < 2000 4 rules
func_call: beta.parse_exif(file.message_screenshot()).image_width < 2000 4 rules
data.details.response.body.enabled 2 values
eq: false 4 rules
eq: true 2 rules
dc_process_name 2 values
gt: 2 4 rules
graph.entity.file.prevalence.rolling_max 2 values
gt: 0 4 rules
le: 3 3 rules
m365::Folder.Path 2 values
in: \Recoverable Items\Deletions 4 rules
in: \Sent Items 4 rules
process.thread.Ext.call_stack_final_user_module.protection_provenance_path 2 values
is_not_null:
wildcard: c:\windows\microsoft.net\framework*\clr.dll 3 rules
registry.hive 2 values
eq: HKEY_USERS 4 rules
result 2 values
eq: EXPLOITED 4 rules
eq: success 2 rules
signature 2 values
eq: ConsoleLogin 4 rules
eq: user.session.start 2 rules
target.resource.product_object_id 2 values
eq: %sap_sensitive_roles.role 4 rules
eq: 1b730954-1685-4b74-9bfd-dac224a7b894 3 rules
additionalEventData.MFAUsed 2 values
eq: NO 3 rules, 2 vendors
AdditionalFields 2 values
contains: ESAURLDetails 3 rules
contains: ESAAMPVerdict 2 rules
All_Traffic.action 2 values
in: allow 3 rules
in: allowed 3 rules
AppId 2 values
eq: * 3 rules
eq: 00000003-0000-0000-c000-000000000000 2 rules
Esql.rule_severity_values 2 values
eq: 73 3 rules
IS_SUCCESS 2 values
eq: NO 3 rules
eq: YES 2 rules
Identity 2 values
ne: MS-PIM 3 rules
ne: MS-PIM-Fairfax 3 rules
Score 2 values
ge: 50 3 rules
ge: 3 2 rules
TableName 2 values
is_not_null:
eq: UserInfo 2 rules
Url 2 values
is_not_null:
contains: attachments 2 rules
auditLevel 2 values
eq: WORKSPACE_LEVEL 3 rules
eq: ACCOUNT_LEVEL 2 rules
azure.signinlogs.result_signature 2 values
eq: SUCCESS 3 rules
azure_ad::authentication_protocol 2 values
data.details.response.statusCode 2 values
eq: 200 3 rules
eq: 200 2 rules
error_code 2 values
is_not_null:
ne: 394304 2 rules
graph.entity.domain.prevalence.rolling_max 2 values
gt: 0 3 rules
le: 3 2 rules
graph.relations.relationship 2 values
eq: CONTACTS 3 rules
eq: DOWNLOADED_FROM 2 rules
group.name 2 values
eq: ACCOUNT 3 rules
eq: LOGIN 2 rules
headers.message_id 2 values
ends_with: @odspnotify> 3 rules
starts_with: <Share- 3 rules
headers.return_path.domain.domain 2 values
eq: sendgrid.net 3 rules
ne: calendar-server.bounces.google.com 2 rules
m365::ApplicationId 2 values
is_not_null:
eq: 29d9ed98-a469-4536-ade2-f981bc1d605e 2 rules
objectCategory 2 values
starts_with: CN=Group-Policy-Container* 3 rules
starts_with: CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=* 2 rules
sha256 2 values
is_not_null:
eq: c92c158d7c37fea795114fa6491fe5f145ad2f8c08776b18ae79db811e8e36a3 2 rules
strings.icontains 2 values
func_call: strings.icontains(subject.subject, sender.display_name) 3 rules
func_call: strings.icontains(sender.display_name, mailbox.email.domain.sld) 2 rules
target.resource.attribute.labels.key 2 values
regex_match: NewValue_EntitlementId- 3 rules
regex_match: OldValue_EntitlementId- 3 rules
comm 2 values
eq: insmod 2 rules, 2 vendors
eq: split 2 rules, 2 vendors
ActivityStatusValue 2 values
eq: Success 2 rules
starts_with: Accept 2 rules
All_Changes.command 2 values
contains: *USER TABLE MODIFIED* 2 rules
contains: *tftp-server* 2 rules
All_Traffic.app 2 values
eq: smb 2 rules
Sample rules:
ChangeType 2 values
in: %%16384 2 rules
DnsQueryTypeName 2 values
in: A 2 rules
Esql.document_count 2 values
Esql.region_count 2 values
ge: 2 2 rules
Esql.total_attempts 2 values
ge: 10 2 rules
EventSeverity 2 values
eq: High 2 rules
is_not_null:
LogType 2 values
eq: Update 2 rules
in: Update 2 rules
LogonId 2 values
eq: 0 2 rules
NewTargetUserName 2 values
ends_with: $ 2 rules
ParentUser 2 values
contains: AUTHORI 2 rules
Path 2 values
contains: \Desktop\ 2 rules
contains: \Downloads\ 2 rules
QueryType 2 values
eq: SELECT 2 rules
eq: SHOW 2 rules
RenderedDescription 2 values
contains: Downloaded 2 rules
contains: Uploaded 2 rules
RescanVerdict 2 values
in: Malware 2 rules
Target.process.name 2 values
eq: lsass.exe 2 rules
eq: lsass.exe 2 rules
UriPath 2 values
contains: /api/login 2 rules
Sample rules:
contains: /api/login?user= 2 rules
Sample rules:
UserAccountControl 2 values
eq: %%2093 2 rules
UserType 2 values
in: Admin 2 rules
in: DcAdmin 2 rules
XCsAppCcl 2 values
eq: low 2 rules
eq: poor 2 rules
a2 2 values
eq: clip 2 rules
eq: clipboard 2 rules
a3 2 values
ends_with: .jpg 2 rules
ends_with: .png 2 rules
aceType 2 values
in: Access denied 2 rules
actor_details.email 2 values
macro: (tostring(actor_details.email) != tostring(aux_details.email)) 2 rules
macro: (tostring(actor_details.email) == tostring(aux_details.email)) 2 rules
azure.auditlogs.properties.category 2 values
eq: DirectoryManagement 2 rules
eq: RoleManagement 2 rules
azure.platformlogs.properties.log.objectRef.resource 2 values
eq: nodes 2 rules
azure.platformlogs.properties.log.responseStatus.code 2 values
in: 200 2 rules
azure.signinlogs.properties.incoming_token_type 2 values
eq: primaryRefreshToken 2 rules
azure.signinlogs.properties.token_protection_status_details.sign_in_session_status 2 values
eq: unbound 2 rules
azure_ad::target_resources 2 values
contains: offline 2 rules
is_not_null:
cs-host 2 values
eq: api.telegram.org 2 rules
data.details.request.path 2 values
eq: /api/v2/guardian/policies 2 rules
Sample rules:
eq: /api/v2/risk-assessment/config 2 rules
data_action_s 2 values
eq: ACCEPT 2 rules
eq: REJECT 2 rules
entity_type 2 values
eq: account 2 rules
eq: host 2 rules
event.OperationName 2 values
in: CreateAllowlistGroup 2 rules
in: UpdateAllowlistGroup 2 rules
failed_attempts 2 values
gt: 10 2 rules
firstTimeSeenUser 2 values
is_null:
macro: (firstTimeSeenUser > relative_time(now(), "-24h@h")) 2 rules
headers.mailer 2 values
eq: Microsoft CDO for Windows 2000 2 rules
starts_with: Open-Xchange Mailer 2 rules
kibana.alert.rule.threat.tactic.name 2 values
eq: Lateral Movement 2 rules
is_not_null:
logger 2 values
in: wt.method.MethodContextMonitor.contexts.servletRequest 2 rules
in: wt.servlet.ServletRequestMonitor.request 2 rules
network.application 2 values
in: ssl 2 rules
in: web-browsing 2 rules
okta::debugContext.debugData.dt_hash 2 values
is_not_null:
primaryDisplayName 2 values
contains: *admin* 2 rules
ne: *admin* 2 rules
process.Ext.protection 2 values
ne: PsProtectedSignerAntimalware-Light 2 rules
starts_with: PsProtectedSigner* 2 rules
proctitle 2 values
in: *service * 2 rules
in: *systemctl * 2 rules
properties.message 2 values
eq: Add app role assignment to service principal 2 rules
eq: Add delegated permission grant 2 rules
requestParameters.VersioningConfiguration.Status 2 values
in: Disabled 2 rules
in: Suspended 2 rules
resource.type 2 values
eq: http_load_balancer 2 rules
starts_with: bigquery 2 rules
Sample rules:
risk_type 2 values
eq: DUPLICATE_PASSWORD 2 rules
eq: WEAK_PASSWORD_POLICY 2 rules
scStatus 2 values
in: 401 2 rules
in: 403 2 rules
stage 2 values
eq: ResponseComplete 2 rules
is_not_null:
strings.count 2 values
func_call: strings.count(body.current_thread.text, '©') == 1 2 rules
func_call: strings.count(subject.base, " ") > 8 2 rules
target.resource.attribute.labels["visibility"] 2 values
eq: people_with_link 2 rules
eq: public_on_the_web 2 rules
target.resource.name 2 values
eq: IDENTITY 2 rules
eq: PFCG 2 rules
type.inbound 1 value
eq: true 1212 rules
Sample rules (showing 8 of 1212):
- Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure
- Abuse: Robinhood injected content
- Adobe branded PDF file linking to a password-protected file from untrusted sender
- Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
- AnonymousFox indicators
- Anthropic Magic String in HTML
- Attachment soliciting user to enable macros
- Attachment with auto-executing macro (unsolicited)
type.outbound 1 value
Active 1 value
eq: true 60 rules
Application Layer Protocol
T1071, Phishing T1566, Valid Accounts T0859, Remote Services T0886, Remote Services T1021, Valid Accounts T1078Sample rules (showing 8 of 60):
- Dataverse - TI map IP to DataverseActivity
- Dataverse - TI map URL to DataverseActivity
- GreyNoise TI Map IP Entity to CommonSecurityLog
- GreyNoise TI Map IP Entity to DnsEvents
- GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)
- GreyNoise TI map IP entity to OfficeActivity
- GreyNoise TI Map IP Entity to SigninLogs
- Infoblox - TI - CommonSecurityLog Match Found - MalwareC2
isOutlier 1 value
eq: 1 33 rules
Brute Force
T1110, Password Spraying T1110.003, Credential Stuffing T1110.004, Compromise Accounts T1586, Cloud Accounts T1586.003, Account Manipulation T1098Sample rules (showing 8 of 33):
- AWS Unusual Number of Failed Authentications From Ip
- Azure AD Unusual Number of Failed Authentications From Ip
- Cloud Security Groups Modifications by User
- Detect Distributed Password Spray Attempts
- Detect New Login Attempts to Routers
- Detect Password Spray Attempts
- Detect Spike in AWS Security Hub Alerts for EC2 Instance
- Detect Spike in AWS Security Hub Alerts for User
headers.auth_summary.spf.pass 1 value
eq: true 32 rules
Sample rules (showing 8 of 32):
- Attachment: HTML attachment with login portal indicators
- Brand impersonation: Adobe with suspicious language and link
- Brand impersonation: QuickBooks notification from Intuit themed company name
- Callback phishing via Adobe Sign comment
- Callback phishing via DocuSign comment
- Callback phishing via e-signature service
- Callback phishing via Intuit service abuse
- Callback Phishing via Signable E-Signature Request
headers.reply_to 1 value
length_compare: 0 31 rules
Sample rules (showing 8 of 31):
- Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
- Attachment: Office document with VSTO add-in
- BEC with unusual reply-to or return-path mismatch
- BEC/Fraud: Generic scam attempt to undisclosed recipients
- BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns
- BEC: Tax document request
- Brand impersonation: LinkedIn
- Brand impersonation: Microsoft fake sign-in alert
process.parent.code_signature.trusted 1 value
eq: false 26 rules
Command and Scripting Interpreter
T1059, Unix Shell T1059.004, AppleScript T1059.002, Hijack Execution Flow T1574, Abuse Elevation Control Mechanism T1548, Credentials from Password Stores T1555Sample rules (showing 8 of 26):
- Apple Scripting Execution with Administrator Privileges
- Attempt to Install Root Certificate
- Default Application Hijacking
- Enumeration of Users or Groups via Built-in Commands
- ExecuteWithPrivileges Prompt via Unsigned or Untrusted Application
- External IP Address Discovery via Curl
- Finder Sync Plugin Registered and Enabled
- Keychain CommandLine Interaction via Unsigned or Untrusted Process
process.parent.code_signature.exists 1 value
eq: false 25 rules
Command and Scripting Interpreter
T1059, AppleScript T1059.002, Unix Shell T1059.004, Hijack Execution Flow T1574, Abuse Elevation Control Mechanism T1548, Credentials from Password Stores T1555Sample rules (showing 8 of 25):
- Apple Scripting Execution with Administrator Privileges
- Attempt to Install Root Certificate
- Default Application Hijacking
- Enumeration of Users or Groups via Built-in Commands
- ExecuteWithPrivileges Prompt via Unsigned or Untrusted Application
- External IP Address Discovery via Curl
- Finder Sync Plugin Registered and Enabled
- Keychain CommandLine Interaction via Unsigned or Untrusted Process
username 1 value
contains: serviceaccount 24 rules
Cloud Accounts
T1078.004, Escape to Host T1611, Unsecured Credentials T1552, Account Manipulation T1098, Container API T1552.007, Data from Cloud Storage T1530Sample rules (showing 8 of 24):
- Kubernetes Admission Controller Webhook Created
- Kubernetes All Secrets Dumped Across Namespaces
- Kubernetes Client Certificate Credential Created
- Kubernetes ClusterRoleBinding to Privileged Role
- Kubernetes CronJob Created or Modified
- Kubernetes DaemonSet Created
- Kubernetes Data Copy via kubectl cp
- Kubernetes Ingress Created Without TLS
dll.code_signature.exists 1 value
eq: false 22 rules
Sample rules (showing 8 of 22):
- DLL Loaded from a Macro Enabled Document
- DLL Side Loading of a file dropped by Microsoft Office
- Evasion via LdrpKernel32 Overwrite
- Execution of a File Downloaded via Windows OpenSSH
- Known Desktop Application DLL Search Order Hijack
- Library Loaded via a CallBack Function
- Library Loaded via Thread Fiber CallBack
- Microsoft Office AddIn Loaded
data.details.request.channel 1 value
eq: https://manage.auth0.com/ 17 rules
protoPayload.authorizationInfo 1 value
is_not_null:
Abuse Elevation Control Mechanism
T1548, Exfiltration Over C2 Channel T1041, Escape to Host T1611, Exploit Public-Facing Application T1190Sample rules (showing 8 of 17):
- GCP Cloud Run Service Created
- GCP Cloud Run Set IAM Policy
- GCP CloudBuild Potential Privilege Escalation
- GCP cloudfunctions functions create
- GCP cloudfunctions functions update
- GCP GKE Kubernetes Cron Job Created Or Modified
- GCP IAM serviceAccounts getAccessToken Privilege Escalation
- GCP IAM serviceAccounts signBlob
OperationType 1 value
eq: %%14674 16 rules, 3 vendors
Account Manipulation
T1098, Domain or Tenant Policy Modification T1484, File and Directory Permissions Modification T1222, Windows Permissions T1222.001, Group Policy Modification T1484.001, Event Triggered Execution T1546Sample rules (showing 8 of 16):
- AdminSDHolder SDProp Exclusion Added
- Modification of the msPKIAccountCredentials
- User account exposed to Kerberoasting
- AdminSDHolder permissions changed for persistence
- Computer account modifying Active Directory permissions
- Computer account modifying Active Directory permissions (PrivExchange)
- Extended rights backdoor obfuscation (via localizationDisplayId attribute)
- Permissions changed on a Group Policy (GPO)
ExtendedProperties.isNew 1 value
eq: True 15 rules
Sample rules (showing 8 of 15):
- Denial of Service (Microsoft Defender for IoT)
- Excessive Login Attempts (Microsoft Defender for IoT)
- Firmware Updates (Microsoft Defender for IoT)
- High bandwidth in the network (Microsoft Defender for IoT)
- Illegal Function Codes for ICS traffic (Microsoft Defender for IoT)
- Internet Access (Microsoft Defender for IoT)
- Multiple scans in the network (Microsoft Defender for IoT)
- No traffic on Sensor Detected (Microsoft Defender for IoT)
kibana.alert.rule.name 1 value
is_not_null:
Sample rules (showing 8 of 14):
- Alerts From Multiple Integrations by Destination Address
- Alerts From Multiple Integrations by Source Address
- Alerts From Multiple Integrations by User Name
- Alerts in Different ATT&CK Tactics by Host
- AWS IAM Long-Term Access Key Correlated with Elevated Detection Alerts
- Correlated Alerts on Similar User Identities
- First Seen Network Flow Exporter Followed by Suspicious Source Activity
- FortiGate SSL VPN Login Followed by SIEM Alert by User
IsActive 1 value
eq: true 12 rules
Sample rules (showing 8 of 12):
- HoneyLabs TI Map IP Entity to CommonSecurityLog
- HoneyLabs TI Map IP Entity to Network Session (ASIM)
- HoneyLabs TI Map IP Entity to SigninLogs
- HoneyLabs TI Map URL Entity to CommonSecurityLog
- Lumen TI domain in DnsEvents
- Lumen TI IPAddress in CommonSecurityLog
- Lumen TI IPAddress in DeviceEvents
- Lumen TI IPAddress in IdentityLogonEvents
log_source 1 value
eq: auditevents 12 rules
Modify Authentication Process
T1556, Account Manipulation T1098, Valid Accounts T1078, Disable or Modify Tools T1562, Create Account T1136, Credentials from Password Stores T1555Sample rules (showing 8 of 12):
- 1Password - Changes to firewall rules
- 1Password - Changes to SSO configuration
- 1Password - Disable MFA factor or type for all user accounts
- 1Password - New service account integration created
- 1Password - Non-privileged vault user permission change
- 1Password - Potential insider privilege escalation via group
- 1Password - Potential insider privilege escalation via vault
- 1Password - Privileged vault permission change
pattern 1 value
contains: file:hashes 12 rules
Sample rules (showing 8 of 12):
- CYFIRMA - High severity File Hash Indicators with Block Action and Malware
- CYFIRMA - High severity File Hash Indicators with Block Action Rule
- CYFIRMA - High severity File Hash Indicators with Monitor Action and Malware
- CYFIRMA - High severity File Hash Indicators with Monitor Action Rule
- CYFIRMA - High severity Trojan File Hash Indicators with Block Action Rule
- CYFIRMA - High severity Trojan File Hash Indicators with Monitor Action Rule
- CYFIRMA - Medium severity File Hash Indicators with Block Action and Malware
- CYFIRMA - Medium severity File Hash Indicators with Block Action Rule
azure_ad::logged_by_service 1 value
eq: Core Directory 11 rules, 2 vendors
Valid Accounts
T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Additional Cloud Roles T1098.003, Use Alternate Authentication Material T1550, Steal Application Access Token T1528Sample rules (showing 8 of 11):
- [Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions
- [Entra ID] Application Granted Administrative Permission to Assign Microsoft Entra ID Roles
- Admin promotion after Role Management Application Permission Grant
- full_access_as_app Granted To Application
- Microsoft Entra ID Role Management Permission Grant
- NRT Privileged Role Assigned Outside PIM
- Privileged Role Assigned Outside PIM
- Suspicious application consent for offline access
process.parent.Ext.real.pid 1 value
gt: 0 11 rules
Sample rules (showing 8 of 11):
- API Call from a Process with a Spoofed Parent
- Parent Process PID Spoofing
- Parent Process PID Spoofing
- Potential Parent Process PID Spoofing via MalSecLogon
- Potential Privilege Escalation via Rogue WinRM
- Potential Privilege Escalation via Token Impersonation
- Privilege Escalation via EXTENDED STARTUPINFO
- Privileges Elevation via Parent Process PID Spoofing
subject.is_reply 1 value
eq: true 11 rules
Sample rules (showing 8 of 11):
- BEC/Fraud: Job scam fake thread or plaintext pivot to freemail
- BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply
- Credential phishing: Blue button styled link with file-sharing template artifacts
- Fake message thread with a suspicious link and engaging language from an unknown sender
- Fake thread with suspicious indicators
- Link: Non-standard port 8443 in display URL
- Reconnaissance: Large unknown recipient list
- Spam: Website errors solicitation
Activity 1 value
contains: modified 10 rules
Domain or Tenant Policy Modification
T1484, Group Policy Modification T1484.001, Valid Accounts T1078, Domain Accounts T1078.002, File and Directory Permissions Modification T1222, Windows Permissions T1222.001Sample rules (showing 8 of 10):
- PROD (TM001.1) - GROUP - Added to Group Outside the Object Tier Level
- PROD (TM005.1) - GPO - Linked, Unlinked, or Enforced at Tier Level OU
- PROD (TM006.1) - ACL - Modified at Tier Level OU
- PROD (TM008.1) - GPO - Linked, Unlinked, or Enforced at Root of Domain
- PROD (TM009.1) - ACL - Modified at Root of the Domain
- PROD (TM012.1) - GPO - Enforced Outside of Tier Model
- PROD (TM013.1) - OU - Block Inheritance was Enabled on an OU
- PROD (TM014.1) - GPO - Linked, Unlinked, or Enforced at the AD Site Level
ObservableKey 1 value
eq: ipv4-addr:value 10 rules
Sample rules (showing 8 of 10):
- HoneyLabs TI Map IP Entity to CommonSecurityLog
- HoneyLabs TI Map IP Entity to Network Session (ASIM)
- HoneyLabs TI Map IP Entity to SigninLogs
- Lumen TI IPAddress in CommonSecurityLog
- Lumen TI IPAddress in DeviceEvents
- Lumen TI IPAddress in IdentityLogonEvents
- Lumen TI IPAddress in OfficeActivity
- Lumen TI IPAddress in SecurityEvents
RiskScore 1 value
aws::userIdentity.arn 1 value
is_not_null:
Cloud Service Discovery
T1526, Cloud Infrastructure Discovery T1580, Serverless Execution T1648, Account Manipulation T1098, Data from Cloud Storage T1530, Cloud Storage Object Discovery T1619Sample rules (showing 8 of 10):
- AWS Access Token Used from Multiple Addresses
- AWS Bedrock High-Frequency Single-Model Inference API Probing
- AWS Discovery API Calls from VPN ASN for the First Time by Identity
- AWS EKS Access Entry Created Then Deleted by Same Identity
- AWS IAM User Self-Created Access Key Subsequently Used
- AWS Lambda Function High-Frequency Invocation by a Single Principal
- AWS Lambda Function Invoked by an Unusual Principal
- AWS Lambda Function Invoked Cross-Account
data_data_result_s 1 value
data_data_severity_s 1 value
deviceProduct_s 1 value
enough_data 1 value
eq: 1 10 rules
Sample rules (showing 8 of 10):
- Cloud API Calls From Previously Unseen User Roles
- Cloud Compute Instance Created By Previously Unseen User
- Cloud Compute Instance Created In Previously Unused Region
- Cloud Compute Instance Created With Previously Unseen Image
- Cloud Compute Instance Created With Previously Unseen Instance Type
- Cloud Instance Modified By Previously Unseen User
- Cloud Provisioning Activity From Previously Unseen City
- Cloud Provisioning Activity From Previously Unseen Country
event.errorcode 1 value
event.result 1 value
eq: SUCCESS 10 rules
process.Ext.api.parameters.app_name 1 value
eq: PowerShell 10 rules
Sample rules (showing 8 of 10):
- AMSI Bypass via PowerShell
- Potential Obfuscated PowerShell Script
- Potential Pentesting PowerShell Script
- Potential Reverse Shell via Powershell
- PowerShell Empire Script Execution
- PowerShell Execution from WinGet Configuration Remoting Server
- Powershell Execution via Named Pipe
- PowerShell Script with Passwords Vault Access Capability
fdr_event_type 1 value
eq: ProcessRollup2 9 rules
Sample rules (showing 8 of 9):
security_result.about.labels["Sample"] 1 value
ne: true 9 rules
Sample rules (showing 8 of 9):
- AWS GuardDuty Black Hole Traffic Detected
- AWS GuardDuty Bruteforce Activity Detected
- AWS GuardDuty Command And Control Activity Detected
- AWS GuardDuty Cryptocurrency Activity Detected
- AWS GuardDuty Denial Of Service Activity Detected
- AWS GuardDuty DGA Domain Activity Detected
- AWS GuardDuty Malicious Or Suspicious File Executed
- AWS GuardDuty Penetration Testing Activity Detected
span 1 value
eq: 10s 9 rules
Sample rules (showing 8 of 9):
- Kubernetes Anomalous Inbound Network Activity from Process
- Kubernetes Anomalous Inbound Outbound Network IO
- Kubernetes Anomalous Inbound to Outbound Network IO Ratio
- Kubernetes Anomalous Outbound Network Activity from Process
- Kubernetes Anomalous Traffic on Network Edge
- Kubernetes Process with Anomalous Resource Utilisation
- Kubernetes Process with Resource Ratio Anomalies
- Kubernetes Shell Running on Worker Node
unique_accounts 1 value
gt: 30 9 rules
Sample rules (showing 8 of 9):
- AWS Multiple Users Failing To Authenticate From Ip
- Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
- Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
- Windows Multiple Invalid Users Failed To Authenticate Using NTLM
- Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials
- Windows Multiple Users Failed To Authenticate From Host Using NTLM
- Windows Multiple Users Failed To Authenticate From Process
- Windows Multiple Users Failed To Authenticate Using Kerberos
TicketEncryptionType 1 value
eq: 0x17 8 rules, 3 vendors
Steal or Forge Kerberos Tickets
T1558, Kerberoasting T1558.003, Golden Ticket T1558.001, Use Alternate Authentication Material T1550Sample rules:
- Newly Observed RC4 Kerberos Service Ticket Request
- Kerberoasting Activity - Initial Query
- Potential AS-REP Roasting via Kerberos TGT Requests
- Suspicious Kerberos RC4 Ticket Encryption
- Kerberoasting spn request with RC4 encryption
- Kerberos Service Ticket Request Using RC4 Encryption
- Kerberos TGT Request Using RC4 Encryption
- Unusual Number of Kerberos Service Tickets Requested
ComplianceStatus 1 value
eq: FAILED 8 rules
Sample rules:
- AWS Security Hub - Detect CloudTrail trails lacking KMS encryption
- AWS Security Hub - Detect EC2 Security groups allowing unrestricted high-risk ports
- AWS Security Hub - Detect IAM Policies allowing full administrative privileges
- AWS Security Hub - Detect IAM root user Access Key existence
- AWS Security Hub - Detect root user lacking MFA
- AWS Security Hub - Detect SQS Queue lacking encryption at rest
- AWS Security Hub - Detect SQS Queue policy allowing public access
- AWS Security Hub - Detect SSM documents public sharing enabled
CsUsername 1 value
is_not_null:
Sample rules:
- Netskope - Anomalous User Behavior (High Volume from Unmanaged Device)
- Netskope - Data Movement Tracking (Upload/Download Monitoring)
- Netskope - Heavy Personal Cloud Storage Usage (Shadow IT)
- Netskope - Impossible Travel Detection (Two Countries in Less Than 1 Hour)
- Netskope - Large Outbound Data Transfer / Sensitive Upload (DLP)
- Netskope - Repeated or Critical Policy Violations
- Netskope - Suspicious Network Context (Unusual IPs/Geo/Ports)
- Netskope - Unsanctioned/Risky Cloud App Access (Shadow IT)
Reason 1 value
eq: NEW_ALERT 8 rules
Sample rules:
- Palo Alto Prisma Cloud - Access keys are not rotated for 90 days
- Palo Alto Prisma Cloud - High risk score alert
- Palo Alto Prisma Cloud - High severity alert opened for several days
- Palo Alto Prisma Cloud - IAM Group with Administrator Access Permissions
- Palo Alto Prisma Cloud - Maximum risk score alert
- Palo Alto Prisma Cloud - Network ACL allow all outbound traffic
- Palo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports
- Palo Alto Prisma Cloud - Network ACLs Inbound rule to allow All Traffic
RecordState 1 value
eq: ACTIVE 8 rules
Sample rules:
- AWS Security Hub - Detect CloudTrail trails lacking KMS encryption
- AWS Security Hub - Detect EC2 Security groups allowing unrestricted high-risk ports
- AWS Security Hub - Detect IAM Policies allowing full administrative privileges
- AWS Security Hub - Detect IAM root user Access Key existence
- AWS Security Hub - Detect root user lacking MFA
- AWS Security Hub - Detect SQS Queue lacking encryption at rest
- AWS Security Hub - Detect SQS Queue policy allowing public access
- AWS Security Hub - Detect SSM documents public sharing enabled
azure_ad::user_principal_name 1 value
is_not_null:
Valid Accounts
T1078, Cloud Accounts T1078.004, Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004Sample rules:
- Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN
- Entra ID Excessive Account Lockouts Detected
- Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS)
- Entra ID Sign-in Brute Force Attempted (Microsoft 365)
- Entra ID User Sign-in Brute Force Attempted
- Entra ID User Sign-in with Unusual Non-Managed Device
- Entra ID Windows Hello or Passkey Sign-in from Unregistered Device
- Microsoft Entra ID Impossible Travel Sign-in
objectRef:resource 1 value
eq: pods 8 rules
Sample rules:
- Kubernetes Pod Created in Pre-Configured or Default Name Spaces
- Pod attached to the Node Host Network
- Pod Created or Modified Using the Host IPC Namespace
- Pod Created or Modified Using the Host PID Namespace
- Pod Created with Overly Permissive Linux Capabilities
- Pod creation or modification to a Host Path Volume Mount
- Privileged Pod Created
- Unauthorized Kubernetes Pod Execution
process.Ext.api.parameters.hook_type 1 value
eq: WH_KEYBOARD_LL 8 rules
Sample rules:
- Keystroke Capture by Unsigned Process
- Keystroke Messages Hooking via SetWindowsHookEx
- Keystrokes Input Capture from a Managed Application
- Keystrokes Input Capture from a Suspicious Module
- Keystrokes Input Capture from Suspicious CallStack
- Keystrokes Input Capture from Unsigned DLL
- Keystrokes Input Capture via PowerShell
- Keystrokes Input Capture via SetWindowsHookEx
subject.is_forward 1 value
eq: true 8 rules
Sample rules:
- BEC/Fraud: Job scam fake thread or plaintext pivot to freemail
- Credential phishing: Blue button styled link with file-sharing template artifacts
- Fake message thread with a suspicious link and engaging language from an unknown sender
- Fake thread with suspicious indicators
- Link: Non-standard port 8443 in display URL
- Spam: Website errors solicitation
- VIP Impersonation via Google Group relay with suspicious indicators
- VIP impersonation with charitable donation fraud
tool 1 value
azure_ad::authentication_requirement 1 value
eq: singleFactorAuthentication 7 rules, 2 vendors
Valid Accounts
T1078, Cloud Accounts T1078.004, Modify Authentication Process T1556, Multi-Factor Authentication T1556.006, Brute Force T1110, Password Guessing T1110.001Sample rules:
- Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN
- Entra ID Excessive Account Lockouts Detected
- Entra ID OAuth ROPC Grant Login Detected
- Entra ID OAuth user_impersonation Scope for Unusual User and Client
- Azure AD Only Single Factor Authentication Required
- Sign-ins by Unknown Devices
- Suspicious SignIns From A Non Registered Device
All_Risk.risk_object_type 1 value
eq: system 7 rules
Sample rules:
- Active Directory Lateral Movement Identified
- Active Directory Privilege Escalation Identified
- Linux Persistence and Privilege Escalation Risk Behavior
- Living Off The Land Detection
- Log4Shell CVE-2021-44228 Exploitation
- ProxyShell ProxyNotShell Behavior Detected
- Steal or Forge Authentication Certificates Behavior Identified
Esql.agent_id_count_distinct 1 value
eq: 1 7 rules
Sample rules:
- File Transfer Utility Launched from Unusual Parent
- High Number of Egress Network Connections from Unusual Executable
- Potential Malware-Driven SSH Brute Force Attempt
- Potential Port Scanning Activity from Compromised Host
- Potential Subnet Scanning Activity from Compromised Host
- Unusual Base64 Encoding/Decoding Activity
- Unusual File Creation by Web Server
Version 1 value
eq: 2 7 rules
User Execution
T1204, Remote Services T1021, Distributed Component Object Model T1021.003, System Services T1569, Service Execution T1569.002, Windows Management Instrumentation T1047Sample rules:
- Certutil payload obfuscation - Tchopper (command)
- Edge abuse for payload download via console
- Impacket DCOMexec process abuse via MMC
- PSexec application execution
- Spool process spawned a CMD shell (PrintNightmare vulnerability - CVE-2021-36958)
- Stickey key called CMD via command execution
- WMI spwaning PowerShell process - WMImplant
_waf_matches_any_group 1 value
func_call: event.get('terminatingRuleId', ''), rule_groups 7 rules
Sample rules:
- AWS WAF Managed Admin Protection Passthrough Rule
- AWS WAF Managed Anti-DDoS Passthrough Rule
- AWS WAF Managed Bot Control Passthrough Rule
- AWS WAF Managed Core Rule Set Passthrough Rule
- AWS WAF Managed IP Reputation Passthrough Rule
- AWS WAF Managed Known Bad Inputs Passthrough Rule
- AWS WAF Managed SQL Database Passthrough Rule
azure.platformlogs.properties.log.stage 1 value
eq: ResponseComplete 7 rules
Adversary-in-the-Middle
T1557, Steal or Forge Authentication Certificates T1649, Steal Application Access Token T1528, Indicator Removal T1070, Permission Groups Discovery T1069, Cloud Groups T1069.003Sample rules:
- Azure AKS Certificate Signing Request Created or Approved
- Azure AKS CoreDNS or Kube-DNS Configuration Modified
- Azure AKS Ephemeral Container Added to Pod
- Azure AKS Kubernetes Events Deleted
- Azure AKS Potential API Enumeration by User
- Azure AKS Service Account Token Created via TokenRequest API
- Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity
beta.ocr 1 value
func_call: beta.ocr(file.message_screenshot()).text != "" 7 rules
beta.scan_qr 1 value
func_call: beta.scan_qr(file.message_screenshot()).found 7 rules
Sample rules:
- Brand impersonation: DHL
- Constant Contact link infrastructure abuse
- Impersonation: Legal firm with copyright infringement notice
- QR code to auto-download of a suspicious file type (unsolicited)
- Service abuse: Monday.com infrastructure with phishing intent
- Service abuse: Square marketing with suspicious QR code
- Suspicious message with unscannable Cloudflare link
execution_status 1 value
graph.metadata.threat.threat_feed_name 1 value
eq: Tor Exit Nodes 7 rules
host.id 1 value
is_not_null:
Sample rules:
- Alerts in Different ATT&CK Tactics by Host
- Entra ID Phishing Kit Default OS Build (Entity Analytics)
- Lateral Movement Alerts from a Newly Observed Source Address
- Lateral Movement Alerts from a Newly Observed User
- LLM-Based Attack Chain Triage by Host
- Multiple Alerts in Same ATT&CK Tactic by Host
- Multiple External EDR Alerts by Host
isutility 1 value
eq: TRUE 7 rules
Sample rules:
match_count 1 value
gt: 0 7 rules
Abuse Elevation Control Mechanism
T1548, Sudo and Sudo Caching T1548.003, Account Manipulation T1098, SSH Authorized Keys T1098.004, Scheduled Task/Job T1053, Cron T1053.003Sample rules:
- Linux Auditd Doas Conf File Creation
- Linux Auditd Possible Access Or Modification Of Sshd Config File
- Linux Auditd Possible Access To Sudoers File
- Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File
- Linux Auditd Preload Hijack Via Preload File
- Linux Auditd Unix Shell Configuration Modification
- Linux Magic SysRq Key Abuse
process.parent.thread.Ext.call_stack_contains_unbacked 1 value
eq: true 7 rules
Sample rules:
- Potential Injection via the Console Window Class
- Potential Process Creation via ShellCode
- Process Creation from Unbacked Memory via Unsigned Parent
- Process Creation with Unusual Mitigation
- Process from Archive or Removable Media via Unbacked Code
- Suspicious Suspended Process Creation
- Windows Console Execution from Unbacked Memory
process.thread.Ext.call_stack_final_user_module.code_signature 1 value
is_not_null:
Sample rules:
- Process Memory Write to a Non Child Process
- Remote Memory Write to Trusted Target Process
- Remote Process Memory Write by Low Reputation Module
- Shellcode API behavior from a signed module
- Shellcode behavior from suspicious RWX provenance
- Shellcode Heap Allocation from Unbacked Memory
- VirtualProtect via Vectored Exception Handling
sender.email.domain.tld 1 value
macro: sender.email.domain.tld in suspicious_tlds 7 rules
Sample rules:
- Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
- BEC/Fraud: Fake investment outreach from suspicious TLD
- Callback phishing solicitation in message body
- File sharing link from suspicious sender domain
- Link: Executable file download with suspicious message content
- QR Code with suspicious indicators
- Suspicious newly registered reply-to domain with engaging financial or urgent language
CategoryValue 1 value
eq: Administrative 6 rules, 2 vendors
Modify Cloud Compute Infrastructure
T1578, Delete Cloud Instance T1578.003, Steal Application Access Token T1528, Use Alternate Authentication Material T1550Sample rules:
- Microsoft Entra ID Hybrid Health AD FS New Server
- Microsoft Entra ID Hybrid Health AD FS Service Delete
- Microsoft Entra ID Hybrid Health AD FS Suspicious Application
- NRT Microsoft Entra ID Hybrid Health AD FS New Server
- Azure Active Directory Hybrid Health AD FS New Server
- Azure Active Directory Hybrid Health AD FS Service Delete
ResourceProviderValue 1 value
eq: Microsoft.ADHybridHealthService 6 rules, 2 vendors
Modify Cloud Compute Infrastructure
T1578, Delete Cloud Instance T1578.003, Steal Application Access Token T1528, Use Alternate Authentication Material T1550Sample rules:
- Microsoft Entra ID Hybrid Health AD FS New Server
- Microsoft Entra ID Hybrid Health AD FS Service Delete
- Microsoft Entra ID Hybrid Health AD FS Suspicious Application
- NRT Microsoft Entra ID Hybrid Health AD FS New Server
- Azure Active Directory Hybrid Health AD FS New Server
- Azure Active Directory Hybrid Health AD FS Service Delete
1 1 value
@timestamp 1 value
All_Changes.status 1 value
eq: success 6 rules
Sample rules:
- Cloud API Calls From Previously Unseen User Roles
- Cloud Instance Modified By Previously Unseen User
- Cloud Provisioning Activity From Previously Unseen City
- Cloud Provisioning Activity From Previously Unseen Country
- Cloud Provisioning Activity From Previously Unseen IP Address
- Cloud Provisioning Activity From Previously Unseen Region
DstBytes 1 value
DstUserName 1 value
is_not_null:
Esql.event_module_distinct_count 1 value
ge: 2 6 rules
Sample rules:
SrcBytes 1 value
category_type 1 value
event.Success 1 value
ml.nlu_classifier 1 value
func_call: ml.nlu_classifier(body.current_thread.text).language == "english" 6 rules
Sample rules:
properties.result 1 value
EXECUTION_STATUS 1 value
Findings.state 1 value
eq: ACTIVE 5 rules
Sample rules:
- GCP Security Command Center - Detect DNSSEC disabled for DNS zones
- GCP Security Command Center - Detect Firewall rules allowing unrestricted high-risk ports
- GCP Security Command Center - Detect Open/Unrestricted API Keys
- GCP Security Command Center - Detect projects with API Keys present
- GCP Security Command Center - Detect Resources with Logging Disabled
FixStatus 1 value
eq: open 5 rules
SrcFileName 1 value
TargetDomainName 1 value
ThreatName 1 value
admonEventType 1 value
file.directory 1 value
is_null:
Obfuscated Files or Information
T1027, Command Obfuscation T1027.010, Command and Scripting Interpreter T1059, PowerShell T1059.001, Deobfuscate/Decode Files or Information T1140Sample rules:
- Dynamic IEX Reconstruction via Method String Access
- Potential PowerShell Obfuscation via High Numeric Character Proportion
- Potential PowerShell Obfuscation via High Special Character Proportion
- Potential PowerShell Obfuscation via Invalid Escape Sequences
- Potential PowerShell Obfuscation via String Reordering
gen_ai.policy.action 1 value
eq: BLOCKED 5 rules
Sample rules:
github.hashed_token 1 value
is_not_null:
Sample rules:
- First Occurrence GitHub Event for a Personal Access Token (PAT)
- First Occurrence of IP Address For GitHub Personal Access Token (PAT)
- First Occurrence of Personal Access Token (PAT) Use For a GitHub User
- First Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT)
- First Occurrence of User Agent For a GitHub Personal Access Token (PAT)
github.repository_public 1 value
eq: false 5 rules
Data from Information Repositories
T1213, Code Repositories T1213.003, Serverless Execution T1648, Command and Scripting Interpreter T1059, Valid Accounts T1078, Cloud Accounts T1078.004Sample rules:
- First Occurrence of GitHub Repo Interaction From a New IP
- First Occurrence of GitHub User Interaction with Private Repo
- First Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT)
- Github Activity on a Private Repository from an Unusual IP
- High Number of Cloned GitHub Repos From PAT
inspected_document 1 value
is_not_null:
kubernetes.audit.objectRef.subresource 1 value
module_s 1 value
unique_targets 1 value
upwind_is_known_severity 1 value
user.email 1 value
OldTargetUserName 1 value
ends_with: $ 4 rules, 3 vendors
All_Traffic.transport 1 value
AmpFileName 1 value
CollectorHostName 1 value
Esql.client_ip 1 value
Esql.dest_host 1 value
Esql.destination_host_count 1 value
Esql.event_category_distinct_count 1 value
Esql.executed_command 1 value
Esql.host_key 1 value
FileDirection 1 value
InitiatedBy.app.displayName 1 value
contains: @ 4 rules
Sample rules:
- First access credential added to Application or Service Principal where no credential was present
- New access credential added to Application or Service Principal
- NRT First access credential added to Application or Service Principal where no credential was present
- NRT New access credential added to Application or Service Principal
InitiatedBy.user.userPrincipalName 1 value
contains: @ 4 rules
Sample rules:
- First access credential added to Application or Service Principal where no credential was present
- New access credential added to Application or Service Principal
- NRT First access credential added to Application or Service Principal where no credential was present
- NRT New access credential added to Application or Service Principal
QueryExecutionStatus 1 value
SChannelName 1 value
ServiceSid 1 value
ends_with: -502 4 rules
Target.process.executable 1 value
WorkstationName 1 value
_ResourceId 1 value
contains: AdFederationService 4 rules
actionResult 1 value
alertState 1 value
azure.activitylogs.identity.claims_initiated_by_user.name 1 value
direction 1 value
eq: inbound 4 rules
distinct_ip_count 1 value
gt: 1 4 rules
event.name 1 value
github.category 1 value
graph.entity.file.prevalence.day_count 1 value
is_anomalous 1 value
isprvilegedadrole 1 value
kibana.alert.workflow_status 1 value
kubernetes.audit.requestURI 1 value
m365::UserId 1 value
match1 1 value
match2 1 value
process.Ext.api.parameters.hook_module 1 value
process.Ext.api.parameters.usage 1 value
process.Ext.session_info.logon_type 1 value
process.code_signature.signing_id 1 value
regex_match: [A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40} 4 rules
process.thread.Ext.call_stack_contains_unbacked 1 value
properties.statusCode 1 value
eq: Created 4 rules
protoPayload.response.error 1 value
service.additionalInfo.sample 1 value
short_lived 1 value
unique_apps 1 value
Authentication_Package 1 value
DeviceCustomString5 1 value
ne: True 3 rules
ERROR_MESSAGE 1 value
ne: OVERFLOW_FAILURE_EVENTS_ELIDED 3 rules
EntityName 1 value
Esql.distinct_count_dst_ip 1 value
Esql.distinct_count_src_ip 1 value
Esql.event_action_count_distinct 1 value
Esql.rule_risk_score_distinct_count 1 value
Esql.source_ip_count_distinct 1 value
File 1 value
is_not_null:
Fqdn 1 value
is_not_null:
HasVirtualTraffic 1 value
HostCount 1 value
gt: 0 3 rules
HostName 1 value
ImageId 1 value
eq: EXAMPLE-AMI-ID 3 rules
Muted 1 value
Target.process.Ext.token.integrity_level_name 1 value
ne: low 3 rules
TargetName 1 value
contains: Microsoft_Windows_Shell_ZipFolder:filename 3 rules
ThreatLevel_Score 1 value
Threshold 1 value
UserCount 1 value
gt: 0 3 rules
action.name 1 value
eq: admin_login 3 rules
admin_email 1 value
agent.id 1 value
azure.activitylogs.identity.authorization.evidence.principal_id 1 value
azure.graphactivitylogs.properties.client_auth_method 1 value
azure.signinlogs.properties.device_detail.device_id 1 value
cities_count 1 value
client.ip 1 value
is_not_null:
cmd 1 value
dc_event_id 1 value
dest_domain 1 value
eq: internal_test_email.com 3 rules
dll.Ext.load_index 1 value
event.origin 1 value
eq: ADMIN_CONSOLE 3 rules
gen_ai.compliance.violation_detected 1 value
github.actor_ip 1 value
github.repo 1 value
graph.entity.domain.prevalence.day_count 1 value
graph.relations.entity_type 1 value
eq: IP_ADDRESS 3 rules
host_count_d 1 value
gt: 0 3 rules
islibrary 1 value
kibana.alert.rule.rule_id 1 value
kubernetes.audit.objectRef.namespace 1 value
match3 1 value
network.type 1 value
outcome:result 1 value
parameters.message_info.is_spam 1 value
principal.ip_geo_artifact.location.country_or_region 1 value
process.Ext.ancestry 1 value
process.Ext.api.parameters.flags 1 value
contains: *INPUTSINK* 3 rules
prompt_text 1 value
is_not_null:
properties.metricResponseType 1 value
eq: Success 3 rules
rule.name 1 value
sender.email.domain.valid 1 value
server.ip 1 value
is_not_null:
source.geo.country_name 1 value
source.geo.region_name 1 value
source_type 1 value
eq: account_setting 3 rules
status.value 1 value
strings.contains 1 value
func_call: strings.contains(body.current_thread.text, sender.email.email) 3 rules
target.resource.attribute.labels["TABNAME"] 1 value
eq: AGR_USERS 3 rules
target.resource.attribute.labels["ser_binding_deltas_action"] 1 value
unique_users 1 value
user.groups{} 1 value
eq: system:unauthenticated 3 rules
user.username 1 value
eq: system:anonymous 3 rules
user_arn 1 value
user_count_d 1 value
gt: 0 3 rules
user_type 1 value
ut_shannon 1 value
ClientProcessId 1 value
Flags 1 value
HasFullTrust 1 value
ObjectDN 1 value
starts_with: CN=AdminSDHolder,CN=System* 2 rules, 2 vendors
Resource 1 value
starts_with: http 2 rules, 2 vendors
aws::sourceIPAddress 1 value
blocked 1 value
eq: false 2 rules, 2 vendors
comment 1 value
is_not_null:
m365::Directionality 1 value
eq: InBound 2 rules, 2 vendors
method 1 value
eq: POST 2 rules, 2 vendors
nametype 1 value
eq: CREATE 2 rules, 2 vendors
okta::client.ipAddress 1 value
is_not_null:
outcome.reason 1 value
eq: FastPass declined phishing attempt 2 rules, 2 vendors
param2 1 value
eq: stopped 2 rules, 2 vendors
query 1 value
eq: api.telegram.org 2 rules, 2 vendors
.25 1 value
macro: (.25 > (success / failure)) 2 rules
AddedUrls 1 value
AlertSeverity 1 value
All_Changes.object_category 1 value
All_Changes.result 1 value
contains: *lock* 2 rules
All_Changes.result_id 1 value
eq: 4720 2 rules
All_Email.file_name 1 value
eq: * 2 rules
AppName 1 value
Attachments.name 1 value
regex_match: (?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i) 2 rules
AuthenticationMechanism 1 value
starts_with: PAT 2 rules
Authorization 1 value
AutoScalingDescriptions 1 value
is_null:
BillingModeSummary 1 value
is_null:
ClientAppId 1 value
ClientIp 1 value
is_not_null:
ComplianceStandard 1 value
eq: NIST-SP-800-171-R2 2 rules
ContextInfo 1 value
contains: System.Net.WebClient 2 rules
CsBytes 1 value
DAVISRiskLevel 1 value
DNS.message_type 1 value
eq: QUERY 2 rules
DbAction 1 value
eq: CONNECT 2 rules
DeletedUsers 1 value
gt: 10 2 rules
DestinationIP 1 value
is_not_null:
DeviceCustomString3 1 value
is_not_null:
DstGeoCountry 1 value
is_not_null:
ElevatedToken 1 value
EnabledPrivilegeList 1 value
eq: SeDebugPrivilege 2 rules
ErrorNumber 1 value
Esql.brute_force_type 1 value
Esql.cloud_region_count_distinct 1 value
Esql.count_distinct_host_id 1 value
Esql.date_diff 1 value
le: 10 2 rules
Esql.distance_km 1 value
Esql.event_code_distinct_count 1 value
ge: 2 2 rules
Esql.kibana_alert_rule_name_distinct_count 1 value
ge: 3 2 rules
Esql.kubernetes_audit_objectRef_resource_count_distinct 1 value
Esql.kubernetes_audit_requestURI_count_distinct 1 value
Esql.last_time_seen 1 value
eq: Esql.first_time_seen 2 rules
Esql.logon_count 1 value
eq: 1 2 rules
Esql.max_logon 1 value
ge: 1000 2 rules
Esql.min_logon 1 value
Esql.rule_name_distinct_count 1 value
ge: 2 2 rules
Esql.server_ip 1 value
is_not_null:
Esql.source_ip 1 value
is_not_null:
Esql.travel_kmh 1 value
Esql.unique_host_count 1 value
Esql.unique_rules_count 1 value
Esql.unique_source_ips 1 value
Event 1 value
eq: account.settings_updated 2 rules
EventProduct 1 value
eq: Filewall for Microsoft 365 2 rules
Sample rules:
EventVendor 1 value
eq: ODI-X 2 rules
Sample rules:
Finding 1 value
eq: LargeDefaultGroupsPSRemote 2 rules
HttpUserAgent 1 value
Imphash 1 value
ne: 28a18f58924d2f4dd2bffbbc85a12952 2 rules
IncomingTokenType 1 value
IsHighValueEvent 1 value
eq: true 2 rules
Key 1 value
is_not_null:
Level 1 value
eq: 2 2 rules
LinksClicked 1 value
gt: 0 2 rules
Log_Type 1 value
eq: Firewall 2 rules
LoginIsSuccess 1 value
eq: No 2 rules
LoginStatus 1 value
ne: LOGIN_NO_ERROR 2 rules
MatchedPolicies 1 value
is_not_null:
Message.object 1 value
is_not_null:
MitreTtp 1 value
contains: KNOX.2 2 rules
NetworkPackets 1 value
gt: 0 2 rules
NewTemplateContent 1 value
contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT 2 rules
PolicyViolatedControlFeature 1 value
eq: JSON 2 rules
PreAuthType 1 value
PrivilegeLevel 1 value
Process 1 value
contains: powershell.exe 2 rules
RADIUSAuth 1 value
eq: Reject 2 rules
RatingDifferance 1 value
lt: 0 2 rules
RawData 1 value
contains: Download failed and temporary file 2 rules
RecordType 1 value
eq: SharePointFileOperation 2 rules
RemoteIPType 1 value
Resource.Type 1 value
eq: AwsSqsQueue 2 rules
ResourceId 1 value
contains: AdFederationService 2 rules
RiskState 1 value
SHA_Disposition 1 value
eq: Malware 2 rules
SandboxScore_s 1 value
ge: 50 2 rules
ScBytes 1 value
SecurityRiskName 1 value
is_not_null:
ServiceAccount 1 value
eq: LocalSystem 2 rules
ServicePrincipalNames 1 value
contains: GC/ 2 rules
ServiceType 1 value
eq: kernel mode driver 2 rules
SignalNumber 1 value
SourceSeverity 1 value
eq: High 2 rules
SubStatus 1 value
eq: 0xc0000064 2 rules
Tags 1 value
eq: MDR - Customer Escalation 2 rules
TargetResources_0_modifiedProperties 1 value
is_not_null:
TargetResources_modifiedProperties.displayName 1 value
eq: AppAddress 2 rules
TargetServerName 1 value
TargetType 1 value
eq: employee 2 rules
Target_User_Name 1 value
TaskContent 1 value
contains: rundll32 2 rules
TemplateContent 1 value
contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT 2 rules
TimeGenerated 1 value
macro: (TimeGenerated between (ago(14d) .. 1d)) 2 rules
TransmittedServices 1 value
UpdateAvailable 1 value
is_not_null:
VirusName 1 value
is_not_null:
WAFAction 1 value
eq: Allow 2 rules
WAFRuleID 1 value
is_not_null:
WAFRuleMessage 1 value
is_not_null:
XCsApp 1 value
is_not_null:
XCsAppTags 1 value
contains: Unsanctioned 2 rules
XRsFileSize 1 value
_time 1 value
macro: (_time >= relative_time(now(), "@d")) 2 rules
about.labels["is_suspicious"] 1 value
actor:type 1 value
eq: User 2 rules
additional.fields["param1_1"] 1 value
macro: re.capture($change.target.resource.attribute.labels["TABKEY"], "^.{33}\\s*(\\S+)\\s*\\d{16}$") 2 rules
admin_consent 1 value
api.response.error 1 value
eq: AccessDenied 2 rules
aws.bedrock_agentcore.operation 1 value
eq: InvokeAgentRuntime 2 rules
aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm 1 value
aws::sessionCredentialFromConsole 1 value
azure.activitylogs.identity.authorization.evidence.principal_type 1 value
azure.activitylogs.properties.authentication_protocol 1 value
azure.activitylogs.properties.status_code 1 value
azure.auditlogs.properties.additional_details.key 1 value
azure.auditlogs.properties.initiated_by.user.id 1 value
azure.auditlogs.properties.initiated_by.user.userPrincipalName 1 value
azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value 1 value
azure.graphactivitylogs.properties.app_id 1 value
is_not_null:
azure.graphactivitylogs.properties.c_idtyp 1 value
eq: user 2 rules
azure.open_ai.operation_name 1 value
eq: ChatCompletions_Create 2 rules
azure.platformlogs.properties.log.objectRef.subresource 1 value
azure.resource.name 1 value
azure.signinlogs.identity 1 value
azure.signinlogs.properties.device_detail.is_managed 1 value
azure.signinlogs.properties.original_transfer_method 1 value
azure.signinlogs.properties.token_issuer_type 1 value
eq: AzureAD 2 rules
azure_ad::app_display_name 1 value
eq: Microsoft Authentication Broker 2 rules
azure_ad::resource_display_name 1 value
ne: Device Registration Service 2 rules
blocklist_label 1 value
body.html.display_text 1 value
length_compare: 500 2 rules
c_process_name 1 value
c_process_path_ext 1 value
class_type 1 value
client:app_name 1 value
ne: 1Password SCIM Bridge 2 rules
client:device 1 value
eq: Computer 2 rules
client:ipAddress 1 value
wildcard: *.*.*.* 2 rules
client:ip_address 1 value
wildcard: *.*.*.* 2 rules
columns.command 1 value
is_not_null:
computer_name 1 value
container.security_context.privileged 1 value
eq: true 2 rules
counts 1 value
ge: 5 2 rules
cs-uri 1 value
contains: /oauth/idp/.well-known/openid-configuration 2 rules
csUriQuery 1 value
is_not_null:
csUserAgent 1 value
csUserName 1 value
ne: - 2 rules
customProps_RuleId_s 1 value
eq: TRIS0032 2 rules
data.details.request.body.enabled 1 value
data_stream.namespace 1 value
is_not_null:
debugContext.debugData.factor 1 value
eq: OKTA_VERIFY_PUSH 2 rules
desc 1 value
dest 1 value
eq: * 2 rules
dns.question.registered_domain 1 value
is_not_null:
dns_query 1 value
is_not_null:
Sample rules:
domain_abuse 1 value
eq: true 2 rules
download_count 1 value
gt: 10 2 rules
dropped_file_path_split_count 1 value
egress 1 value
event.event_platform 1 value
eq: Win 2 rules
event.event_simpleName 1 value
eq: ProcessRollup2 2 rules
eventTypeName 1 value
eq: INVITED_TO_ORG 2 rules
event_type_id 1 value
eq: 11 2 rules
exe 1 value
failures 1 value
ge: 5 2 rules
field 1 value
file.origin_referrer_url 1 value
file.origin_url 1 value
firstTimeSeenRegion 1 value
is_null:
from 1 value
eq: null 2 rules
gcp::method_name 1 value
github.permission 1 value
github.user_agent 1 value
is_not_null:
graph.entity.domain.creation_time.seconds 1 value
gt: 0 2 rules
graph.entity.domain.expiration_time.seconds 1 value
gt: 0 2 rules
graph.metadata.threat.category 1 value
eq: SOFTWARE_MALICIOUS 2 rules
graph.metadata.threat.severity 1 value
eq: CRITICAL 2 rules
graph.relations.entity.group.group_display_name 1 value
eq: Domain Admins 2 rules
gws::admin_application_name 1 value
eq: Google Workspace Marketplace 2 rules
gws::device_account_state 1 value
eq: REGISTERED 2 rules
gws::event_type 1 value
gws::token_client_id 1 value
ends_with: *apps.googleusercontent.com 2 rules
headers.return_path.email 1 value
is_not_null:
headers.return_path.local_part 1 value
http.request.body.content 1 value
contains: *prototype* 2 rules
http.request.referrer 1 value
ends_with: *SignOut.aspx 2 rules
http.status 1 value
ident_s 1 value
eq: TRAFFIC 2 rules
index_number 1 value
infected 1 value
ge: 2 2 rules
instanceId 1 value
eq: 24070 2 rules
Sample rules:
isReadRole 1 value
is_anomaly_b 1 value
eq: true 2 rules
is_driver 1 value
is_prioritized 1 value
eq: true 2 rules
kubernetes.audit.impersonatedUser.username 1 value
level 1 value
eq: ERROR 2 rules
log_level 1 value
eq: DEBUG 2 rules
logsource.product 1 value
m365::ExtendedProperties.RequestType 1 value
eq: Cmsi:Cmsi 2 rules
m365::ObjectId 1 value
is_not_null:
mailbox.email.domain.sld 1 value
length_compare: 4 2 rules
mfa_prompts 1 value
ml_is_dga.malicious_prediction 1 value
network_traffic.redis.query 1 value
contains: *CONFIG SET dir* 2 rules
nodename 1 value
eq: DNS 2 rules
numOfDelFilePath 1 value
num_message_attachments 1 value
gt: 0 2 rules
o365.audit.DeviceProperties.Value 1 value
observer.ip 1 value
is_not_null:
observer.serial_number 1 value
is_not_null:
okta::authenticationContext.externalSessionId 1 value
okta::debugContext.debugData.factor 1 value
okta::securityContext.isProxy 1 value
eq: true 2 rules
p_enrichment.tor_exit_nodes 1 value
is_not_null:
p_event_time 1 value
is_not_null:
p_occurs_between 1 value
macro: '2022-01-14' , '2022-03-22' 2 rules
Sample rules:
parameters.APPLICATION_NAME 1 value
eq: gmail 2 rules
parameters.NEW_VALUE 1 value
parent_commandline 1 value
is_null:
passwordProtected 1 value
eq: false 2 rules
peer_system_ip 1 value
is_not_null:
peer_type 1 value
is_not_null:
principal.resource.type 1 value
eq: AssumedRole 2 rules
problemchild.prediction 1 value
process.Ext.api.metadata.background_callcount 1 value
ge: 400 2 rules
process.Ext.api.metadata.ms_since_last_keyevent 1 value
ge: 100 2 rules
process.Ext.api.parameters.protection_old 1 value
eq: RW- 2 rules
process.Ext.api.parameters.search_filter 1 value
wildcard: (&(objectCategory=person)(objectClass=user)(directReports=?)(!(manager=?))) 2 rules
process.Ext.api.summary 1 value
contains: * amsi.dll* 2 rules
process.Ext.desktop_name 1 value
starts_with: WinSta0\* 2 rules
process.Ext.token.security_attributes 1 value
eq: SMARTLOCKER://SMARTSCREENORIGINCLAIM 2 rules
process.cpu.utilization 1 value
gt: 0 2 rules
process.thread.Ext.hardware_breakpoint_set 1 value
eq: true 2 rules
process.thread.capabilities.effective 1 value
eq: CAP_SYS_PTRACE 2 rules
process.thread.capabilities.permitted 1 value
eq: CAP_SYS_PTRACE 2 rules
process.uptime 1 value
ge: 300 2 rules
process_arguments 1 value
contains: *mshtml* 2 rules
profile.by_sender_domain 1 value
func_call: profile.by_sender_domain().prevalence == "new" 2 rules
properties.authenticationRequirement 1 value
eq: singleFactorAuthentication 2 rules
properties.initiatedBy.user.id 1 value
properties.userPrincipalName 1 value
protoPayload.authenticationInfo.principalEmail 1 value
contains: gs-project-accounts.iam.gserviceaccount.com 2 rules
protoPayload.metadata.jobChange.job.jobConfig.type 1 value
eq: QUERY 2 rules
Sample rules: