Microsoft-Windows-Sysmon

Show 24 more (27 total) on the rules page

Elastic

Splunk

Rundll32 with no Command Line Arguments with Network (source)

Steven Dick, Michael Haag, Splunk

Windows HTTP Network Communication From MSIExec (source)

Michael Haag, Splunk

Windows InstallUtil Remote Network Connection (source)

Michael Haag, Splunk

Kusto

Europium - Hash and IP IOCs - September 2022 (source)

Microsoft Security Research

Mercury - Domain, Hash and IP IOCs - August 2022 (source)

Ajeet Prakash

Sysmon Event ID 3: Network connection→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

27 rules

Elastic

WMI Incoming Lateral Movement (source)

Elastic

Suspicious Command Prompt Network Connection (source)

Elastic

Incoming Execution via PowerShell Remoting (source)

Elastic

Show 21 more (24 total) on the rules page

Splunk

Rundll32 with no Command Line Arguments with Network (source)

Steven Dick, Michael Haag, Splunk

Windows HTTP Network Communication From MSIExec (source)

Michael Haag, Splunk

Windows InstallUtil Remote Network Connection (source)

Michael Haag, Splunk

Sysmon Event ID 1: Process creationANDEvent ID 3: Network connection

24 rules

Elastic

InstallUtil Process Making Network Connections (source)

Elastic

Network Connection via Signed Binary (source)

Elastic

Mshta Making Network Connections (source)

Elastic

Outbound Network Connection from Java Using Default Ports (source)

Splunk

Mauricio Velazco, Lou Stella, Splunk

DLLHost with no Command Line Arguments with Network (source)

Steven Dick, Michael Haag, Splunk

GPUpdate with no Command Line Arguments with Network (source)

Michael Haag, Splunk

Sysmon Event ID 7: Image loaded→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)→Event ID 3: Network connection

Show All Detection Patterns

23 rules

Elastic

Potential Command and Control via Internet Explorer (source)

Elastic

Incoming DCOM Lateral Movement via MSHTA (source)

Elastic

Elastic

Show 15 more (18 total) on the rules page

Splunk

Rundll32 with no Command Line Arguments with Network (source)

Steven Dick, Michael Haag, Splunk

Windows HTTP Network Communication From MSIExec (source)

Michael Haag, Splunk

Windows InstallUtil Remote Network Connection (source)

Michael Haag, Splunk

Kusto

Europium - Hash and IP IOCs - September 2022 (source)

Microsoft Security Research

Mercury - Domain, Hash and IP IOCs - August 2022 (source)

Ajeet Prakash

Network Connection

(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)→Event ID 3: Network connection→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

19 rules

Elastic

Potential Remote File Execution via MSIEXEC (source)

Elastic

Potential Command and Control via Internet Explorer (source)

Elastic

InstallUtil Process Making Network Connections (source)

Elastic

Rundll32 with no Command Line Arguments with Network (source)

Splunk

Steven Dick, Michael Haag, Splunk

Windows HTTP Network Communication From MSIExec (source)

Michael Haag, Splunk

Windows InstallUtil Remote Network Connection (source)

Michael Haag, Splunk

Security-Auditing Event ID 4688: A new process has been created.OREvent ID 4689: A process has exited.ORSysmon Event ID 1: Process creationOREvent ID 5: Process terminated

13 rules

Kusto

SUNBURST suspicious SolarWinds child processes (Normalized Process Events) (source)

Yuval Naor

Base64 encoded Windows process command-lines (Normalized Process Events) (source)

Yuval Naor

Process Creation with Suspicious CommandLine Arguments (source)

Sysmon Event ID 1: Process creationOREvent ID 13: RegistryEvent

13 rules

Splunk

Command Line Utility Added to Accessibility Features (Sysmon) (source)

Wow6432Node Classes Autorun Keys Modification (Sysmon) (source)

Suspicious InprocServer32 Registry Modification (Sysmon) (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Kusto

Pete Bryan

Sysmon Event ID 3: Network connection→(Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

13 rules

Elastic

Suspicious Command Prompt Network Connection (source)

Elastic

Incoming Execution via PowerShell Remoting (source)

Elastic

Elastic

Command Line Utility Added to Accessibility Features (Sysmon) (source)

Splunk

Sysmon Event ID 1: Process creationANDEvent ID 11: FileCreate

12 rules

Splunk

MS Exchange Mailbox Replication service writing Active Server Pages (source)

Michael Haag, Splunk

Windows Office Product Dropped Cab or Inf File (source)

Bhavin Patel, Splunk

Michael Haag, Splunk

Sysmon Event ID 1: Process creationOREvent ID 12: RegistryEventOREvent ID 13: RegistryEvent

12 rules

Splunk

ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon) (source)

EnableLUA Registry Value Modified (Sysmon) (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Kusto

Pete Bryan

Security-Auditing Event ID 4688: A new process has been created.→Sysmon Event ID 1: Process creation

9 rules

Elastic

Execution of File Written or Modified by Microsoft Office (source)

Elastic

Suspicious HTML File Creation (source)

Elastic

Windows Script Interpreter Executing Process via WMI (source)

Elastic

Delayed Execution via Ping (source)

8 rules

Elastic

Elastic

Local Scheduled Task Creation (source)

Elastic

Suspicious Child Process via Azure VM CustomScript Extension (source)

Elastic

(Security-Auditing Event ID 4688: A new process has been created.ANDSysmon Event ID 11: FileCreate)OR(Event ID 1: Process creationANDEvent ID 11: FileCreate)

7 rules

Splunk

Windows Office Product Dropped Cab or Inf File (source)

Michael Haag, Splunk

Windows Office Product Dropped Uncommon File (source)

Bhavin Patel, Splunk

Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github

Security-Auditing Event ID 4663: An attempt was made to access an object.ORSysmon Event ID 1: Process creationOREvent ID 3: Network connectionOREvent ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

Network Connection

6 rules

Elastic

Unusual Network Connection via DllHost (source)

Elastic

Unusual Network Connection via RunDLL32 (source)

Elastic

Suspicious Command Prompt Network Connection (source)

Elastic

Europium - Hash and IP IOCs - September 2022 (source)

Kusto

Microsoft Security Research

Mercury - Domain, Hash and IP IOCs - August 2022 (source)

Ajeet Prakash

Registry Value Modified Sysmon

Security-Auditing Event ID 4657: A registry value was modified.ANDEvent ID 4663: An attempt was made to access an object.ANDEvent ID 4688: A new process has been created.ANDEvent ID 4689: A process has exited.ANDSysmon Event ID 1: Process creationANDEvent ID 5: Process terminatedANDEvent ID 12: RegistryEventANDEvent ID 13: RegistryEventANDEvent ID 14: RegistryEvent

6 rules

Splunk

ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon) (source)

EnableLUA Registry Value Modified (Sysmon) (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Kusto

Pete Bryan

(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)→Event ID 7: Image loaded

5 rules

Elastic

Veeam Backup Library Loaded by Unusual Process (source)

Elastic

Potential Credential Access via Renamed COM+ Services DLL (source)

Elastic

Elastic

Sysmon Event ID 1: Process creationANDEvent ID 13: RegistryEvent

5 rules

Splunk

Windows Process Executed From Removable Media (source)

Steven Dick

Windows Modify Registry Qakbot Binary Data Registry (source)

Teoderick Contreras, Bhavin Patel, Splunk

Defender Registry Values Modified (Sysmon) (source)

Sysmon Event ID 1: Process creationOREvent ID 11: FileCreate

Share Access Sysmon

4 rules

Splunk

Windows Default RDP File Creation By Non MSTSC Process (source)

Teoderick Contreras, Splunk

Windows Admin$ Share Access (Sysmon) (source)

Windows C$ Share Access (Sysmon) (source)

Sysmon Event ID 7: Image loaded→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

3 rules

Elastic

Veeam Backup Library Loaded by Unusual Process (source)

Elastic

Elastic

Potential Command and Control via Internet Explorer (source)

Elastic

Sysmon Event ID 1: Process creationOREvent ID 3: Network connection

3 rules

Splunk

Windows Rundll32 WebDav With Network Connection (source)

Michael Haag, Splunk

PuTTY Secure Copy Client Execution (Sysmon) (source)

Kusto

[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022 (source)

Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creationORSysmon-for-Linux Event ID 1: Process Create

3 rules

Splunk

Curl Execution with Percent Encoded URL (source)

Nasreddine Bencherchali, Splunk

File Download or Read to Pipe Execution (source)

Michael Haag, Nasreddine Bencherchali, Splunk, DipsyTipsy

Suspicious Curl Network Connection (source)

Michael Haag, Splunk

Defense Impairment: Modify Registry

Sysmon Event ID 1: Process creationANDEvent ID 12: RegistryEvent

2 rules

Splunk

Windows Deleted Registry By A Non Critical Process File Path (source)

Steven Dick, Teoderick Contreras, Splunk

LocalAccountTokenFilterPolicy Registry Value Modified (Sysmon) (source)

First Time Seen

Security-Auditing Event ID 4688: A new process has been created.ANDSysmon Event ID 1: Process creation

2 rules

Elastic

First Time Seen Remote Monitoring and Management Tool (source)

Elastic

First Time Seen RMM Signer Across the Environment (source)

Elastic

(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

1 rule

Elastic

Execution of Persistent Suspicious Program (source)

Elastic

Sysmon Event ID 11: FileCreate→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

1 rule

Elastic

Execution of a Downloaded Windows Script (source)

Elastic

Credential Access: DCSync

Sysmon Event ID 1: Process creationOREvent ID 10: ProcessAccess

1 rule

Splunk

Mimikatz (Sysmon) (source)

(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)→Event ID 22: DNSEvent

1 rule

Elastic

Java Dropped and Executed With DNS Lookup (source)

Elastic

Sysmon Event ID 1: Process creationORSysmon-for-Linux Event ID 1: Process Create

1 rule

Splunk

Web or Application Server Spawning a Shell (source)

Michael Haag, Nasreddine Bencherchali, Splunk

Execution: Exploitation for Client Execution

Security-Auditing Event ID 4663: An attempt was made to access an object.ORSysmon Event ID 1: Process creationOREvent ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

1 rule

Kusto

Sysmon Event ID 1: Process creationANDEvent ID 7: Image loaded

Microsoft Security Research

Persistence: Create or Modify System Process

1 rule

Kusto

COM Event System Loading New DLL (source)

Shain

Stealth: Process Hollowing

Sysmon Event ID 1: Process creation→Event ID 10: ProcessAccess

1 rule

Elastic

Suspicious Process Creation CallTrace (source)

Elastic

Stealth: Create Process with Token

Security-Auditing Event ID 4624: An account was successfully logged on.→(Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

1 rule

Elastic

Process Creation via Secondary Logon (source)

Elastic

Stealth: Msiexec

(Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

1 rule

Elastic

Windows Installer with Suspicious Properties (source)

Elastic

Credential Access: NTDS

ESENT Event ID 216OREvent ID 325OREvent ID 326OREvent ID 327ORSecurity-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creationOREvent ID 11: FileCreate

1 rule

Kusto

Europium - Hash and IP IOCs - September 2022 (source)

Microsoft Security Research

Lateral Movement: Exploitation of Remote Services

Security-Auditing Event ID 4624: An account was successfully logged on.OREvent ID 4688: A new process has been created.ORSysmon Event ID 1: Process creationOREvent ID 19: WmiEventOREvent ID 20: WmiEventOREvent ID 21: WmiEvent

1 rule

Kusto

Gain Code Execution on ADFS Server via Remote WMI Execution (source)

Microsoft Security Research

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`event.type`	eq	`start`	239 rules	elastic
`Image`	ends_with	`\powershell.exe`	162 rules	sigma
`Image`	ends_with	`\pwsh.exe`	150 rules	sigma
`Image`	ends_with	`\cmd.exe`	117 rules	sigma
`Image`	ends_with	`\rundll32.exe`	81 rules	sigma
`Image`	ends_with	`\cscript.exe`	60 rules	sigma
`Image`	ends_with	`\wscript.exe`	60 rules	sigma
`Image`	ends_with	`\wmic.exe`	58 rules	sigma
`OriginalFileName`	eq	`powershell.exe`	120 rules	elastic, sigma, splunk
`OriginalFileName`	eq	`pwsh.dll`	112 rules	elastic, sigma, splunk
`OriginalFileName`	eq	`cmd.exe`	64 rules	elastic, sigma, splunk
`OriginalFileName`	eq	`wmic.exe`	63 rules	elastic, sigma, splunk
`OriginalFileName`	eq	`rundll32.exe`	62 rules	elastic, sigma, splunk
`process_name`	eq	`powershell.exe`	95 rules	elastic, splunk
`process_name`	eq	`cmd.exe`	73 rules	elastic, splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

7Zip Compressing Dump Files source medium: Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.T1560, T1560.001
Compress Data and Lock With Password for Exfiltration With 7-ZIP source medium: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilitiesT1560, T1560.001
Potential DLL Injection Via AccCheckConsole source medium: Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application's UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility.

Show 17 more (869 total) on the rules page

Splunk # view in coverage

Detect Remote Access Software Usage FileInfo source: The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote…T1219
Excessive Usage Of SC Service Utility source: The following analytic detects excessive usage of the sc.exe service utility on a host machine. It leverages Sysmon EventCode 1 logs to identify instances where sc.exe is executed more frequently than normal within a 15-minute window.…T1569, T1569.002
Jscript Execution Using Cscript App source: The following analytic detects the execution of JScript using the cscript.exe process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This behavior is significant…T1059, T1059.007

Show 17 more (274 total) on the rules page

Kusto # view in coverage

Audit policy manipulation using auditpol utility source medium: This detects attempts to manipulate audit policies using auditpol command. This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks. The process name in each data source is commented out as an adversary could rename it. It is advisable to keep process name commented but if the results show unrelated false positives, users may want to uncomment it. Refer to auditpol syntax: https://docs.microsoft.com/windows-server/administration/windows-commands/auditpol
Refer to our M365 blog for details on use during the Solorigate attack: https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/T1204
Modification of Accessibility Features source medium: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. [1] Ref: https://attack.mitre.org/techniques/T1546/008/T1546, T1546.008
Lateral Movement via DCOM source medium: This query detects a fairly uncommon attack technique using the Windows Distributed Component Object Model (DCOM) to make a remote execution call to another computer system and gain lateral movement throughout the network. Ref: http://thenegative.zone/incident response/2017/02/04/MMC20.Application-Lateral-Movement-Analysis.htmlT1021, T1021.003

Show 17 more (69 total) on the rules page

YARA-L # view in coverage

GCP_Uunauthorized_GKE_Pod_Token_Endpoint_Usage source: Alerts when an authorization token originating from GKE activity is subsequently used within a command line on an endpoint system, suggesting potential credential exfiltration and reuse.T1550, T1550.001
W3WP Launching Encoded Powershell source medium: Detects on the execution of an encoded powershell command with a parent process of w3wp.exe.T1059, T1059.001
Potential Webshell Process Execution source medium: Detects on the execution arguments associated with cmd.exe invocations originating from an active ASP.NET webshell.T1505, T1505.003

References #

Event ID 2: A process changed a file creation time

Channel: Operational
Level: Informational
Collection Priority: Recommended (Olaf Hartong, others)
Task: File creation time changed (rule: FileCreateTime)
Opcode: Info

Description

The change **file creation time** event is registered when a file creation time is explicitly modified by a process. This event helps tracking the real creation time of a file. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.

Message #

File creation time changed:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
TargetFilename: %6
CreationUtcTime: %7
PreviousCreationUtcTime: %8
User: %9

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that changed the file creation time
`ProcessId` UInt32	Process ID used by the OS to identify the process changing the file creation time
`Image` UnicodeString	File path of the process that changed the file creation time	13 detection rules
`TargetFilename` UnicodeString	Full path name of the file	7 detection rules
`CreationUtcTime` UnicodeString	New creation time of the file	1 detection rule
`PreviousCreationUtcTime` UnicodeString	Previous creation time of the file	1 detection rule
`User` UnicodeString	Name of the account who changed the file creation time of a file

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 2,
    "version": 5,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T13:31:51.7752086+00:00",
    "event_record_id": 17461544,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 13:31:51.770",
    "ProcessGuid": "{8a99384c-5bb9-6a2d-3605-000000001000}",
    "ProcessId": "7796",
    "Image": "C:\\Windows\\system32\\wbem\\wmiprvse.exe",
    "TargetFilename": "C:\\Windows\\Temp\\B776E034-9102-4917-A2BF-152F782EA60A\\WimProvider.dll",
    "CreationUtcTime": "2026-06-13 13:31:38.052",
    "PreviousCreationUtcTime": "2026-06-13 13:31:38.052",
    "User": "NT AUTHORITY\\SYSTEM"
  },
  "message": "File creation time changed:\r\nRuleName: -\r\nUtcTime: 2026-06-13 13:31:51.770\r\nProcessGuid: {8a99384c-5bb9-6a2d-3605-000000001000}\r\nProcessId: 7796\r\nImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nTargetFilename: C:\\Windows\\Temp\\B776E034-9102-4917-A2BF-152F782EA60A\\WimProvider.dll\r\nCreationUtcTime: 2026-06-13 13:31:38.052\r\nPreviousCreationUtcTime: 2026-06-13 13:31:38.052\r\nUser: NT AUTHORITY\\SYSTEM"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Image`	ends_with	`\dns.exe`	1 rule	sigma
`Provider_Name`	eq	`Microsoft-Windows-Sysmon`	1 rule	elastic
`TargetFilename`	wildcard	`?:\programdata\*`	1 rule	elastic
`TargetFilename`	wildcard	`?:\programdata\microsoft\windows\start menu\programs\startup\*`	1 rule	elastic
`TargetFilename`	wildcard	`?:\users\\appdata\roaming\microsoft\windows\start menu\programs\startup\`	1 rule	elastic
`TargetFilename`	wildcard	`?:\users\public\*`	1 rule	elastic
`TargetFilename`	wildcard	`?:\windows\system32\*`	1 rule	elastic
`TargetFilename`	wildcard	`?:\windows\syswow64\*`	1 rule	elastic
`file.extension`	eq	`dll`	1 rule	elastic
`file.extension`	eq	`exe`	1 rule	elastic
`file.extension`	eq	`lnk`	1 rule	elastic
`file.extension`	eq	`msi`	1 rule	elastic
`file.extension`	eq	`pif`	1 rule	elastic
`file.extension`	eq	`scr`	1 rule	elastic
`file.extension`	eq	`sys`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Unusual File Modification by dns.exe source high: Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)T1133
File Creation Date Changed to Another Year source low: Detects when the file creation time is changed to a year before 2020. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity. In order to use this rule in production, it is recommended first baseline normal behavior in your environment and then tune the rule accordingly. Hunting Recommendation: Focus on files with creation times set to years significantly before the current date, especially those in user-writable directories. Correlate with process execution logs to identify the source of the modification and investigate any unsigned or suspicious binaries involved.T1070, T1070.006

Elastic # view in coverage

Potential Timestomp in Executable Files source medium: Identifies the modification of a file creation time for executable files in sensitive system directories. Adversaries may modify file time attributes to blend malicious executables with legitimate system files. Timestomping is a technique that modifies the timestamps of a file often to mimic files that are in trusted directories.T1070, T1070.006

YARA-L # view in coverage

Suspicious Filewrites To Sharepoint Layouts source high: Detects a command-line interpreter (cmd.exe or powershell.exe) writing a file to a SharePoint (\TEMPLATE\LAYOUTS) directory.T1505, T1505.003↳ also matches Event ID 11: FileCreate, Event ID 23: FileDelete (File Delete archived)
Suspicious Unusual Location LNK File source low: Detects creation and movement of .lnk files to specific folders↳ also matches Event ID 11: FileCreate, Event ID 23: FileDelete (File Delete archived)

References #

Event ID 3: Network connection

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (Olaf Hartong, others)
Task: Network connection detected (rule: NetworkConnect)
Opcode: Info

Description

The **network connection** event logs TCP/UDP connections on the machine. It is disabled by default. Each connection is linked to a process through the ProcessId and ProcessGUID fields. The event also contains the source and destination host names IP addresses, port numbers and IPv6 status.

Message #

Network connection detected:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
User: %6
Protocol: %7
Initiated: %8
SourceIsIpv6: %9
SourceIp: %10
SourceHostname: %11
SourcePort: %12
SourcePortName: %13
DestinationIsIpv6: %14
DestinationIp: %15
DestinationHostname: %16
DestinationPort: %17
DestinationPortName: %18

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that made the network connection
`ProcessId` UInt32	Process ID used by the OS to identify the process that made the network connection
`Image` UnicodeString	File path of the process that made the network connection	394 detection rules
`User` UnicodeString	Name of the account who made the network connection. It usually contains domain name and user name	8 detection rules
`Protocol` UnicodeString	Protocol being used for the network connection. Sysmon emits the literal lowercase transport name rather than the IANA protocol number; tcp / udp are the only values produced by the kernel transport callback that drives this event. Known values `tcp` TCP connection. `udp` UDP datagram.	8 detection rules
`Initiated` Boolean	Indicates whether the process initiated the TCP connection	49 detection rules
`SourceIsIpv6` Boolean	Is the source IP an IPv6	1 detection rule
`SourceIp` UnicodeString	Source IP address that made the network connection	3 detection rules
`SourceHostname` UnicodeString	Name of the host that made the network connection	1 detection rule
`SourcePort` UInt16	Source port number	3 detection rules
`SourcePortName` UnicodeString	Name of the source port being used (i.e. netbios-dgm)
`DestinationIsIpv6` Boolean	Is the destination IP an IPv6	1 detection rule
`DestinationIp` UnicodeString	Destination IP address	72 detection rules
`DestinationHostname` UnicodeString	Name of the host that received the network connection	557 detection rules
`DestinationPort` UInt16	Destination port number	141 detection rules
`DestinationPortName` UnicodeString	Name of the destination port	4 detection rules

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 3,
    "version": 5,
    "level": 4,
    "task": 3,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:09:46.6013699+00:00",
    "event_record_id": 17613679,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5404
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 14:09:43.178",
    "ProcessGuid": "{8a99384c-e92c-6a2c-0c00-000000001000}",
    "ProcessId": "896",
    "Image": "C:\\Windows\\System32\\lsass.exe",
    "User": "NT AUTHORITY\\SYSTEM",
    "Protocol": "tcp",
    "Initiated": "false",
    "SourceIsIpv6": "false",
    "SourceIp": "127.0.0.1",
    "SourceHostname": "telemetry-DC-c.cell-c.ludus.domain",
    "SourcePort": "57872",
    "SourcePortName": "-",
    "DestinationIsIpv6": "false",
    "DestinationIp": "127.0.0.1",
    "DestinationHostname": "telemetry-DC-c.cell-c.ludus.domain",
    "DestinationPort": "389",
    "DestinationPortName": "ldap"
  },
  "message": "Network connection detected:\r\nRuleName: -\r\nUtcTime: 2026-06-13 14:09:43.178\r\nProcessGuid: {8a99384c-e92c-6a2c-0c00-000000001000}\r\nProcessId: 896\r\nImage: C:\\Windows\\System32\\lsass.exe\r\nUser: NT AUTHORITY\\SYSTEM\r\nProtocol: tcp\r\nInitiated: false\r\nSourceIsIpv6: false\r\nSourceIp: 127.0.0.1\r\nSourceHostname: telemetry-DC-c.cell-c.ludus.domain\r\nSourcePort: 57872\r\nSourcePortName: -\r\nDestinationIsIpv6: false\r\nDestinationIp: 127.0.0.1\r\nDestinationHostname: telemetry-DC-c.cell-c.ludus.domain\r\nDestinationPort: 389\r\nDestinationPortName: ldap"
}

Detection Patterns #

(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)→Event ID 3: Network connection

32 rules

Elastic

Suspicious Command Prompt Network Connection (source)

Elastic

Incoming Execution via PowerShell Remoting (source)

Elastic

Show 24 more (27 total) on the rules page

Elastic

Splunk

Rundll32 with no Command Line Arguments with Network (source)

Steven Dick, Michael Haag, Splunk

Windows HTTP Network Communication From MSIExec (source)

Michael Haag, Splunk

Windows InstallUtil Remote Network Connection (source)

Michael Haag, Splunk

Kusto

Europium - Hash and IP IOCs - September 2022 (source)

Microsoft Security Research

Mercury - Domain, Hash and IP IOCs - August 2022 (source)

Ajeet Prakash

Sysmon Event ID 3: Network connection→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

27 rules

Elastic

WMI Incoming Lateral Movement (source)

Elastic

Suspicious Command Prompt Network Connection (source)

Elastic

Incoming Execution via PowerShell Remoting (source)

Elastic

Show 21 more (24 total) on the rules page

Splunk

Rundll32 with no Command Line Arguments with Network (source)

Steven Dick, Michael Haag, Splunk

Windows HTTP Network Communication From MSIExec (source)

Michael Haag, Splunk

Windows InstallUtil Remote Network Connection (source)

Michael Haag, Splunk

Sysmon Event ID 1: Process creationANDEvent ID 3: Network connection

24 rules

Elastic

InstallUtil Process Making Network Connections (source)

Elastic

Network Connection via Signed Binary (source)

Elastic

Mshta Making Network Connections (source)

Elastic

Outbound Network Connection from Java Using Default Ports (source)

Splunk

Mauricio Velazco, Lou Stella, Splunk

DLLHost with no Command Line Arguments with Network (source)

Steven Dick, Michael Haag, Splunk

GPUpdate with no Command Line Arguments with Network (source)

Michael Haag, Splunk

Sysmon Event ID 7: Image loaded→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)→Event ID 3: Network connection

21 rules

Elastic

Potential Command and Control via Internet Explorer (source)

Elastic

Incoming DCOM Lateral Movement via MSHTA (source)

Elastic

Incoming DCOM Lateral Movement with MMC (source)

Elastic

Rundll32 with no Command Line Arguments with Network (source)

Splunk

Steven Dick, Michael Haag, Splunk

Windows HTTP Network Communication From MSIExec (source)

Michael Haag, Splunk

Windows InstallUtil Remote Network Connection (source)

Michael Haag, Splunk

Kusto

Europium - Hash and IP IOCs - September 2022 (source)

Microsoft Security Research

Mercury - Domain, Hash and IP IOCs - August 2022 (source)

Ajeet Prakash

Network Connection

19 rules

Elastic

Potential Remote File Execution via MSIEXEC (source)

Elastic

Potential Command and Control via Internet Explorer (source)

Elastic

InstallUtil Process Making Network Connections (source)

Elastic

Rundll32 with no Command Line Arguments with Network (source)

Splunk

Steven Dick, Michael Haag, Splunk

Windows HTTP Network Communication From MSIExec (source)

Michael Haag, Splunk

Windows InstallUtil Remote Network Connection (source)

Michael Haag, Splunk

Show All Detection Patterns

Asim Network Session Schema

Security-Auditing Event ID 5152: The Windows Filtering Platform blocked a packet.OREvent ID 5154: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.OREvent ID 5155: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.OREvent ID 5156: The Windows Filtering Platform has permitted a connection.OREvent ID 5157: The Windows Filtering Platform has blocked a connection.OREvent ID 5158: The Windows Filtering Platform has permitted a bind to a local port.OREvent ID 5159: The Windows Filtering Platform has blocked a bind to a local port.ORSysmon Event ID 3: Network connection

17 rules

Kusto

Network Port Sweep from External Network (ASIM Network Session schema) (source)

HoneyLabs TI Map IP Entity to Network Session (ASIM) (source)

Detect port misuse by anomaly based detection (ASIM Network Session schema) (source)

Show 14 more (17 total) on the rules page

13 rules

Elastic

Suspicious Command Prompt Network Connection (source)

Elastic

Incoming Execution via PowerShell Remoting (source)

Elastic

Elastic

Security-Auditing Event ID 5152: The Windows Filtering Platform blocked a packet.→Event ID 5154: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.→Event ID 5155: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.→Event ID 5156: The Windows Filtering Platform has permitted a connection.→Event ID 5157: The Windows Filtering Platform has blocked a connection.→Event ID 5158: The Windows Filtering Platform has permitted a bind to a local port.→Event ID 5159: The Windows Filtering Platform has blocked a bind to a local port.→Sysmon Event ID 3: Network connection

Asim Network Session Schema

8 rules

Kusto

Google Threat Intelligence - Threat Hunting IP (source)

GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema) (source)

HoneyLabs TI Map IP Entity to Network Session (ASIM) (source)

Unusual Network Connection via DllHost (source)

Network Connection

6 rules

Elastic

Elastic

Unusual Network Connection via RunDLL32 (source)

Elastic

Suspicious Command Prompt Network Connection (source)

Elastic

Europium - Hash and IP IOCs - September 2022 (source)

Kusto

Microsoft Security Research

Mercury - Domain, Hash and IP IOCs - August 2022 (source)

Ajeet Prakash

Sysmon Event ID 1: Process creationOREvent ID 3: Network connection

3 rules

Splunk

Windows Rundll32 WebDav With Network Connection (source)

Michael Haag, Splunk

PuTTY Secure Copy Client Execution (Sysmon) (source)

Kusto

[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022 (source)

Remote File Download

Sysmon Event ID 3: Network connection→Event ID 11: FileCreate

2 rules

Elastic

Remote File Download via PowerShell (source)

Elastic

Remote File Download via Script Interpreter (source)

Elastic

Sysmon Event ID 3: Network connection→(Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)

2 rules

Elastic

Elastic

Sysmon Event ID 3: Network connection→(Security-Auditing Event ID 4768: A Kerberos authentication ticket (TGT) was requested.OREvent ID 4769: A Kerberos service ticket was requested.)

Elastic

1 rule

Elastic

Suspicious Kerberos Authentication Ticket Request (source)

Elastic

Discovery: Domain Account

Sysmon Event ID 7: Image loaded→Event ID 3: Network connection

1 rule

Elastic

Potential Enumeration via Active Directory Web Service (source)

Elastic

Defense Impairment: Disable or Modify System Firewall

Security-Auditing Event ID 5152: The Windows Filtering Platform blocked a packet.OREvent ID 5157: The Windows Filtering Platform has blocked a connection.ORSysmon Event ID 3: Network connection

1 rule

Elastic

Potential Evasion via Windows Filtering Platform (source)

Elastic

Command & Control: Web Protocols

Sysmon Event ID 3: Network connectionOREvent ID 15: FileCreateStreamHash

1 rule

Splunk

Unusual HTTP Download (Sysmon) (source)

Collection: Data from Local System

Sysmon Event ID 3: Network connectionANDEvent ID 18: PipeEvent

1 rule

Kusto

AD FS Remote HTTP Network Connection (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Initiated`	eq	`true`	48 rules	sigma
`Initiated`	eq	`incoming`	10 rules	elastic
`Initiated`	eq	`ingress`	10 rules	elastic
`Initiated`	eq	`egress`	5 rules	elastic
`event.type`	eq	`start`	26 rules	elastic
`src_ip`	is_not_null		6 rules	elastic, kusto
`src_ip`	ne	`127.0.0.1`	11 rules	elastic
`src_ip`	ne	`::1`	10 rules	elastic
`Protocol`	eq	`tcp`	8 rules	elastic, sigma
`DestinationPort`	eq	`80`	7 rules	elastic, kusto, sigma
`DestinationPort`	eq	`443`	5 rules	sigma
`DestinationPort`	ne	`0`	7 rules	splunk
`graph.metadata.entity_type (Chronicle)`	eq	`IP_ADDRESS`	7 rules	chronicle
`graph.metadata.source_type (Chronicle)`	eq	`GLOBAL_CONTEXT`	6 rules	chronicle
`process_name`	eq	`rundll32.exe`	6 rules	elastic, splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Network Connection Initiated By AddinUtil.EXE source high: Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.T1218
Uncommon Connection to Active Directory Web Services source medium: Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.T1087
Uncommon Network Connection Initiated By Certutil.EXE source high: Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.T1105

Show 17 more (61 total) on the rules page

Elastic # view in coverage

Suspicious Instance Metadata Service (IMDS) API Request source medium: This rule identifies various tools/scripts performing network activities attempting to access the cloud service provider's instance metadata service (IMDS) API endpoint, which can be used to retrieve sensitive instance-specific information such as instance ID, public IP address, and even temporary security credentials if roles are assumed by that instance.T1016, T1082, T1552, T1552.005, T1580
Connection to Commonly Abused Web Services source low: Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in.T1071, T1071.001, T1090, T1090.002, T1102, T1102.001
Network Activity to a Suspicious Top Level Domain source high: Identifies DNS queries to commonly abused Top Level Domains by common LOLBINs or executables running from world writable directories or unsigned binaries. This behavior matches on common malware C2 abusing less formal domain names.T1071, T1071.004, T1127, T1127.001, T1218

Show 17 more (22 total) on the rules page

Splunk # view in coverage

Detect Regasm with Network Connection source: The following analytic detects the execution of regasm.exe establishing a network connection to a public IP address, excluding private IP ranges. This detection leverages Sysmon EventID 3 logs to identify such behavior. This activity is…T1218, T1218.009
Detect Regsvcs with Network Connection source: The following analytic identifies instances of Regsvcs.exe establishing a network connection to a public IP address, excluding private IP ranges. This detection leverages Sysmon EventID 3 logs to monitor network connections initiated by…T1218, T1218.009
LOLBAS With Network Traffic source: The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries,…T1105, T1218, T1567

Kusto # view in coverage

Log4j vulnerability exploit aka Log4Shell IP IOC source high: Identifies a match across various data feeds for IP IOCs related to the Log4j vulnerability exploit aka Log4Shell described in CVE-2021-44228. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228T1071
Suspicious Network Beacons - Sysmon source: Below query detects suspicious beaconing activity by analyzing Sysmon network connection events.
Spearphishing Attachment: ISO Images (Microsoft Sentinel) source: ISO images are often meant to be used offline and they are often used by IT Admins and/or used on Servers.
Installation from an iso file don't require network connection most of the time. Activities deviating from these situations can be considered as highly suspicious. Below queries detects opening a mounted image, process creation under a mounted image, and network connection from a process created under a mounted image.
All detections can be used seperately or combined together to generate a higher fidelity alert. WARNING: Check your Sysmon parsing functions and verify you have the logs. Using "Rendered Description" field for parsing causes parsing issues for registry events. Detect opening of a mounted image:↳ also matches Event ID 1: Process creation, Event ID 11: FileCreate, Event ID 13: RegistryEvent (Value Set)

YARA-L # view in coverage

Potential Remote PowerShell Session Initiated source high: Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.T1021, T1021.006
High Risk User Download Executable From Macro source high: Executable downloaded by Microsoft Excel by user with GCP entity relationshipT1204, T1204.002
Network Traffic To Specific Country source low: Identify network traffic based on target country

Sysmon Event ID 4: Sysmon service state changedOREvent ID 16: ServiceConfigurationChange

References #

Event ID 4: Sysmon service state changed

Channel: Operational
Level: Informational
Collection Priority: Recommended (Olaf Hartong, others)
Task: Sysmon service state changed
Opcode: Info

Description

The service state change event reports the state of the Sysmon service (started or stopped).

Message #

Sysmon service state changed:
UtcTime: %1
State: %2
Version: %3
SchemaVersion: %4

Fields #

Name	Description	Rules
`UtcTime` UnicodeString	Time in UTC when event was created
`State` UnicodeString	Sysmon service state (i.e. stopped) Known values `Started` Sysmon driver / service began collecting events. `Stopped` Sysmon driver / service stopped collecting events; a pairing 4 with State=Stopped immediately followed by State=Started indicates a config reload or driver restart.	2 detection rules
`Version` UnicodeString	Sysmon version
`SchemaVersion` UnicodeString	Sysmon config schema version

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 4,
    "version": 3,
    "level": 4,
    "task": 4,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T13:41:34.1645578+00:00",
    "event_record_id": 6120906,
    "correlation": {},
    "execution": {
      "process_id": 3872,
      "thread_id": 5252
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "UtcTime": "2026-06-13 13:41:34.151",
    "State": "Started",
    "Version": "15.20",
    "SchemaVersion": "4.91"
  },
  "message": "Sysmon service state changed:\r\nUtcTime: 2026-06-13 13:41:34.151\r\nState: Started\r\nVersion: 15.20\r\nSchemaVersion: 4.91"
}

Detection Patterns #

Stealth: Hide Artifacts

1 rule

Sigma

Sysmon Configuration Modification (source)

frack113

References #

Event ID 5: Process terminated

Channel: Operational
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: Process terminated (rule: ProcessTerminate)
Opcode: Info

Description

The **process terminate** event reports when a process terminates. It provides the UtcTime, ProcessGuid and ProcessId of the process.

Message #

Process terminated:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
User: %6

Fields #

Name	Description
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that terminated
`ProcessId` UInt32	Process ID used by the OS to identify the process that terminated
`Image` UnicodeString	File path of the process that terminated
`User` UnicodeString	Name of the account that terminated the process.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 5,
    "version": 3,
    "level": 4,
    "task": 5,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:09:29.7402157+00:00",
    "event_record_id": 17612823,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 14:09:29.726",
    "ProcessGuid": "{8a99384c-6499-6a2d-a205-000000001000}",
    "ProcessId": "7704",
    "Image": "C:\\ludus\\background\\bginfo.exe",
    "User": "cell-c\\domainadmin"
  },
  "message": "Process terminated:\r\nRuleName: -\r\nUtcTime: 2026-06-13 14:09:29.726\r\nProcessGuid: {8a99384c-6499-6a2d-a205-000000001000}\r\nProcessId: 7704\r\nImage: C:\\ludus\\background\\bginfo.exe\r\nUser: cell-c\\domainadmin"
}

Detection Patterns #

Security-Auditing Event ID 4688: A new process has been created.OREvent ID 4689: A process has exited.ORSysmon Event ID 1: Process creationOREvent ID 5: Process terminated

13 rules

Kusto

SUNBURST suspicious SolarWinds child processes (Normalized Process Events) (source)

Yuval Naor

Base64 encoded Windows process command-lines (Normalized Process Events) (source)

Yuval Naor

Process Creation with Suspicious CommandLine Arguments (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Privilege Escalation: Bypass User Account Control

1 rule

Kusto

Pete Bryan

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`CommandLine`	contains	`-r`	2 rules	kusto
`CommandLine`	contains	`-s`	2 rules	kusto
`CommandLine`	contains	`-exclusionpath`	1 rule	kusto
`CommandLine`	contains	`-exec bypass -w 1 -enc`	1 rule	kusto
`CommandLine`	contains	`-k gpsvcgroup`	1 rule	kusto
`CommandLine`	contains	`-q`	1 rule	kusto
`CommandLine`	contains	`-s gpsvc`	1 rule	kusto
`CommandLine`	contains	`/set`	1 rule	kusto
`CommandLine`	contains	`accepteula`	1 rule	kusto
`CommandLine`	contains	`adinfo`	1 rule	kusto
`CommandLine`	contains	`advfirewall`	1 rule	kusto
`CommandLine`	contains	`computers_pwdnotreqd`	1 rule	kusto
`CommandLine`	contains	`dclist`	1 rule	kusto
`CommandLine`	contains	`dcmodes`	1 rule	kusto
`Process`	contains	`powershell.exe`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk # view in coverage

High Process Termination Frequency source: The following analytic identifies a high frequency of process termination events on a computer within a short period. It leverages Sysmon EventCode 5 logs to detect instances where 15 or more processes are terminated within a 3-second…T1486
Windows Processes Killed By Industroyer2 Malware source: The following analytic detects the termination of specific processes by the Industroyer2 malware. It leverages Sysmon EventCode 5 to identify when processes like "PServiceControl.exe" and "PService_PPD.exe" are killed. This activity is…T1489

References #

Event ID 6: Driver loaded

Channel: Operational
Level: Informational
Collection Priority: Recommended (Olaf Hartong, others)
Task: Driver loaded (rule: DriverLoad)
Opcode: Info

Description

The **driver loaded** events provides information about a driver being loaded on the system. The configured hashes are provided as well as signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading.

Message #

Driver loaded:
RuleName: %1
UtcTime: %2
ImageLoaded: %3
Hashes: %4
Signed: %5
Signature: %6
SignatureStatus: %7

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`ImageLoaded` UnicodeString	Full path of the driver loaded	370 detection rules
`Hashes` UnicodeString	Hashes captured by Sysmon driver	5259 detection rules
`Signed` UnicodeString	Whether the loaded driver is signed
`Signature` UnicodeString	The signer	2 detection rules
`SignatureStatus` UnicodeString	Status of the signature (i.e. valid)

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 6,
    "version": 4,
    "level": 4,
    "task": 6,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T13:42:26.1541821+00:00",
    "event_record_id": 6170407,
    "correlation": {},
    "execution": {
      "process_id": 3872,
      "thread_id": 5268
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 13:41:41.166",
    "ImageLoaded": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26050.15-0\\Drivers\\WdNisDrv.sys",
    "Hashes": "SHA1=F34854FEBF0D58F5F9C2F3081DA0C384E031CC48,MD5=D91B0982401E5C29F1E584228A774142,SHA256=8F98F2093E6373F1D275AAD30D9EF08ECFCE453F6ED02243FD284BDB6012377E,IMPHASH=FBF34F374D5BBC52DBDD4925A27836EF",
    "Signed": "true",
    "Signature": "Microsoft Windows",
    "SignatureStatus": "Valid"
  },
  "message": "Driver loaded:\r\nRuleName: -\r\nUtcTime: 2026-06-13 13:41:41.166\r\nImageLoaded: C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26050.15-0\\Drivers\\WdNisDrv.sys\r\nHashes: SHA1=F34854FEBF0D58F5F9C2F3081DA0C384E031CC48,MD5=D91B0982401E5C29F1E584228A774142,SHA256=8F98F2093E6373F1D275AAD30D9EF08ECFCE453F6ED02243FD284BDB6012377E,IMPHASH=FBF34F374D5BBC52DBDD4925A27836EF\r\nSigned: true\r\nSignature: Microsoft Windows\r\nSignatureStatus: Valid"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Hashes`	contains	`imphash=28dc68bb6d6bf4f6b2db8dd7588b2511`	2 rules	sigma
`Hashes`	contains	`imphash=45bfe170e0cd654bc1e2ae3fca3ac3f4`	2 rules	sigma
`Hashes`	contains	`imphash=821d74031d3f625bcbd0df08b70f1e77`	2 rules	sigma
`Hashes`	contains	`imphash=d41fa95d4642dc981f10de36f4dc8cd7`	2 rules	sigma
`Hashes`	contains	`imphash=f86759bb4de4320918615dc06e998a39`	2 rules	sigma
`ImageLoaded`	contains	`\temp\`	1 rule	sigma
`ImageLoaded`	ends_with	`\kprocesshacker.sys`	2 rules	sigma
`ImageLoaded`	ends_with	`\winring0.sys`	2 rules	sigma
`process_id`	eq	`4`	2 rules	elastic
`dll.code_signature.exists`	eq	`false`	1 rule	elastic
`dll.code_signature.status`	eq	`errorexpired`	1 rule	elastic
`dll.code_signature.status`	eq	`errorrevoked`	1 rule	elastic
`dll.code_signature.trusted`	eq	`false`	1 rule	elastic
`is_driver`	eq	`true`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Malicious Driver Load source high: Detects loading of known malicious drivers via their hash.T1068, T1543, T1543.003
Malicious Driver Load By Name source medium: Detects loading of known malicious drivers via the file name of the drivers.T1068, T1543, T1543.003
PUA - Process Hacker Driver Load source high: Detects driver load of the Process Hacker toolT1543

Elastic # view in coverage

Untrusted Driver Loaded source high: Identifies an untrusted driver loaded by the Windows kernel. Adversaries may modify code signing policies to enable execution of unsigned or self-signed kernel code.T1036, T1036.001
Expired or Revoked Driver Loaded source medium: Identifies an attempt to load a revoked or expired driver. Adversaries may bring outdated drivers with vulnerabilities to gain code execution in kernel mode or abuse revoked certificates to sign their drivers.T1036, T1036.001, T1068, T1553, T1553.002

Splunk # view in coverage

Windows Drivers Loaded by Signature source: The following analytic identifies all drivers being loaded on Windows systems using Sysmon EventCode 6 (Driver Load). It leverages fields such as driver path, signature status, and hash to detect potentially suspicious drivers. This…T1014, T1068
Windows Suspicious Driver Loaded Path source: The following analytic detects the loading of drivers from suspicious paths, which is a technique often used by malicious software such as coin miners (e.g., xmrig). It leverages Sysmon EventCode 6 to identify drivers loaded from…T1543, T1543.003
Windows Vulnerable Driver Loaded source: The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and…T1543, T1543.003

(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)→Event ID 7: Image loaded

References #

Event ID 7: Image loaded

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (Olaf Hartong, others)
Task: Image loaded (rule: ImageLoad)
Opcode: Info

Description

The **image loaded** event logs when a module is loaded in a specific process. This event is disabled by default and needs to be configured with the -l option. It indicates the process in which the module is loaded, hashes and signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading. This event should be configured carefully, as monitoring all image load events will generate a large number of events.

Message #

Image loaded:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
ImageLoaded: %6
FileVersion: %7
Description: %8
Product: %9
Company: %10
OriginalFileName: %11
Hashes: %12
Signed: %13
Signature: %14
SignatureStatus: %15
User: %16

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that loaded the image
`ProcessId` UInt32	Process ID used by the OS to identify the process that loaded the image
`Image` UnicodeString	File path of the process that loaded the image	545 detection rules
`ImageLoaded` UnicodeString	Full path of the image loaded	1018 detection rules
`FileVersion` UnicodeString	Version of the image loaded	1 detection rule
`Description` UnicodeString	Description of the image loaded	7 detection rules
`Product` UnicodeString	Product name that the loaded image belongs to	5 detection rules
`Company` UnicodeString	Company name that the loaded image belongs to	6 detection rules
`OriginalFileName` UnicodeString	Original file name from the PE header, useful for detecting renamed modules	30 detection rules
`Hashes` UnicodeString	Hash of the file contents using the algorithms specified in the HashType field	18 detection rules
`Signed` UnicodeString	Is the image loaded signed	26 detection rules
`Signature` UnicodeString	The signer	6 detection rules
`SignatureStatus` UnicodeString	Status of the signature (i.e. valid)	20 detection rules
`User` UnicodeString	Name of the account that loaded the image.	3 detection rules

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 7,
    "version": 3,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:09:29.7375531+00:00",
    "event_record_id": 17612821,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 14:09:29.726",
    "ProcessGuid": "{8a99384c-6499-6a2d-a205-000000001000}",
    "ProcessId": "7704",
    "Image": "C:\\ludus\\background\\bginfo.exe",
    "ImageLoaded": "C:\\Windows\\SysWOW64\\CoreMessaging.dll",
    "FileVersion": "10.0.20348.1 (WinBuild.160101.0800)",
    "Description": "Microsoft CoreMessaging Dll",
    "Product": "Microsoft® Windows® Operating System",
    "Company": "Microsoft Corporation",
    "OriginalFileName": "CoreMessaging.dll",
    "Hashes": "SHA1=3461F4349EF97F0FDE633219894DA0F67F4A69BC,MD5=A8D1AC93678A40577CD19E7561D7A714,SHA256=7BF17030A0FFABA28D8322D466718DE8CF499CD1B72B7D7B50543E6D93914998,IMPHASH=345E67613280BA4F965702CB83E693FE",
    "Signed": "true",
    "Signature": "Microsoft Windows",
    "SignatureStatus": "Valid",
    "User": "cell-c\\domainadmin"
  },
  "message": "Image loaded:\r\nRuleName: -\r\nUtcTime: 2026-06-13 14:09:29.726\r\nProcessGuid: {8a99384c-6499-6a2d-a205-000000001000}\r\nProcessId: 7704\r\nImage: C:\\ludus\\background\\bginfo.exe\r\nImageLoaded: C:\\Windows\\SysWOW64\\CoreMessaging.dll\r\nFileVersion: 10.0.20348.1 (WinBuild.160101.0800)\r\nDescription: Microsoft CoreMessaging Dll\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CoreMessaging.dll\r\nHashes: SHA1=3461F4349EF97F0FDE633219894DA0F67F4A69BC,MD5=A8D1AC93678A40577CD19E7561D7A714,SHA256=7BF17030A0FFABA28D8322D466718DE8CF499CD1B72B7D7B50543E6D93914998,IMPHASH=345E67613280BA4F965702CB83E693FE\r\nSigned: true\r\nSignature: Microsoft Windows\r\nSignatureStatus: Valid\r\nUser: cell-c\\domainadmin"
}

Detection Patterns #

5 rules

Elastic

Veeam Backup Library Loaded by Unusual Process (source)

Elastic

Potential Credential Access via Renamed COM+ Services DLL (source)

Elastic

Elastic

Sysmon Event ID 7: Image loaded→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

3 rules

Elastic

Veeam Backup Library Loaded by Unusual Process (source)

Elastic

Elastic

Potential Command and Control via Internet Explorer (source)

Elastic

Sysmon Event ID 7: Image loaded→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)→Event ID 3: Network connection

3 rules

Elastic

Potential Command and Control via Internet Explorer (source)

Elastic

Potential Credential Access via Renamed COM+ Services DLL (source)

Elastic

Elastic

Discovery: Domain Account

Sysmon Event ID 7: Image loaded→Event ID 3: Network connection

1 rule

Elastic

Potential Enumeration via Active Directory Web Service (source)

Elastic

Execution: Exploitation for Client Execution

Sysmon Event ID 7: Image loadedANDEvent ID 22: DNSEvent

1 rule

Splunk

Sunburst Correlation DLL and Network Event (source)

Patrick Bareiss, Splunk

Show All Detection Patterns

Persistence: Create or Modify System Process

Sysmon Event ID 1: Process creationANDEvent ID 7: Image loaded

1 rule

Kusto

COM Event System Loading New DLL (source)

Shain

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Signed`	eq	`false`	9 rules	sigma, splunk
`Image`	contains	`:\users\public\`	4 rules	sigma
`Image`	ends_with	`\excel.exe`	8 rules	sigma
`Image`	ends_with	`\outlook.exe`	7 rules	sigma
`Image`	ends_with	`\winword.exe`	7 rules	sigma
`Image`	ends_with	`\powerpnt.exe`	6 rules	sigma
`Image`	ends_with	`\rundll32.exe`	6 rules	sigma
`Image`	ends_with	`\mspub.exe`	5 rules	sigma
`Image`	ends_with	`\onenote.exe`	5 rules	sigma
`Image`	ends_with	`\onenoteim.exe`	5 rules	sigma
`Image`	ends_with	`\svchost.exe`	4 rules	kusto, sigma
`EventType`	eq	`load`	6 rules	elastic
`ImageLoaded`	ends_with	`.dll`	6 rules	sigma, splunk
`ImageLoaded`	ends_with	`\dbgcore.dll`	6 rules	sigma
`ImageLoaded`	ends_with	`\dbghelp.dll`	6 rules	sigma

Community Notes #

Image loaded. Generated when a process loads a DLL into memory, ie, side-loading.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Clfs.SYS Loaded By Process Located In a Potential Suspicious Location source medium: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.T1059
DLL Loaded From Suspicious Location Via Cmspt.EXE source high: Detects cmstp loading "dll" or "ocx" files from suspicious locationsT1218, T1218.003
Amsi.DLL Loaded Via LOLBIN Process source medium: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack

Show 17 more (126 total) on the rules page

Elastic # view in coverage

Untrusted DLL Loaded by Azure AD Connect Authentication Agent source high: Identifies the load of an untrusted DLL by the Azure AD Connect Authentication Agent, which may indicate an attempt to persist or intercept credentials passing through the Pass-through Authentication service.T1003, T1556, T1556.007, T1574, T1574.001
Suspicious Module Loaded by LSASS source medium: Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.T1003, T1003.001, T1547, T1547.005
Potential Masquerading as System32 DLL source high: Identifies suspicious instances of default system32 DLLs either unsigned or signed with non-MS certificates. This can potentially indicate the attempt to masquerade as system DLLs, perform DLL Search Order Hijacking or backdoor and resign legitimate DLLs.T1036, T1036.001, T1036.005, T1553, T1553.002, T1554

Show 17 more (38 total) on the rules page

Splunk # view in coverage

CMLUA Or CMSTPLUA UAC Bypass source: The following analytic detects the use of COM objects like CMLUA or CMSTPLUA to bypass User Account Control (UAC). It leverages Sysmon EventCode 7 to identify the loading of specific DLLs (CMLUA.dll, CMSTPLUA.dll, CMLUAUTIL.dll) by…T1218, T1218.003
Loading Of Dynwrapx Module source: The following analytic detects the loading of the dynwrapx.dll module, which is associated with the DynamicWrapperX ActiveX component. This detection leverages Sysmon EventCode 7 to identify processes that load or register dynwrapx.dll.…T1055, T1055.001
MS Scripting Process Loading Ldap Module source: The following analytic detects the execution of MS scripting processes (wscript.exe or cscript.exe) loading LDAP-related modules (Wldap32.dll, adsldp.dll, adsldpc.dll). It leverages Sysmon EventCode 7 to identify these specific DLL loads.…T1059, T1059.007

YARA-L # view in coverage

GCTI Remote Access Tools source high: Alert process and file create events that are associated with hashes from the GCTI Remote Access Tool listT1219↳ also matches Event ID 1: Process creation, Event ID 11: FileCreate, Event ID 17: PipeEvent (Pipe Created), Event ID 18: PipeEvent (Pipe Connected)

References #

Event ID 8: CreateRemoteThread

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: CreateRemoteThread detected (rule: CreateRemoteThread)
Opcode: Info

Description

The **CreateRemoteThread** event detects when a process creates a thread in another process. This technique is used by malware to inject code and hide in other processes. The event indicates the source and target process. It gives information on the code that will be run in the new thread: StartAddress, StartModule and StartFunction. Note that StartModule and StartFunction fields are inferred, they might be empty if the starting address is outside loaded modules or known exported functions.

Message #

CreateRemoteThread detected:
RuleName: %1
UtcTime: %2
SourceProcessGuid: %3
SourceProcessId: %4
SourceImage: %5
TargetProcessGuid: %6
TargetProcessId: %7
TargetImage: %8
NewThreadId: %9
StartAddress: %10
StartModule: %11
StartFunction: %12
SourceUser: %13
TargetUser: %14

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`SourceProcessGuid` GUID	Process GUID of the source process that created a thread in another process
`SourceProcessId` UInt32	Process ID used by the OS to identify the source process that created a thread in another process
`SourceImage` UnicodeString	File path of the source process that created a thread in another process	112 detection rules
`TargetProcessGuid` GUID	Process GUID of the target process
`TargetProcessId` UInt32	Process ID used by the OS to identify the target process
`TargetImage` UnicodeString	File path of the target process	186 detection rules
`NewThreadId` UInt32	ID of the new thread created in the target process
`StartAddress` UnicodeString	New thread start address	3 detection rules
`StartModule` UnicodeString	Module where the new thread starts execution, resolved from the thread start address	1 detection rule
`StartFunction` UnicodeString	Exported function where the new thread starts, if the start address matches a known export	4 detection rules
`SourceUser` UnicodeString	Name of the account of the source process that created a thread in another process.
`TargetUser` UnicodeString	Name of the account of the target process

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 8,
    "version": 2,
    "level": 4,
    "task": 8,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:08:51.1140624+00:00",
    "event_record_id": 17610309,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 14:08:51.101",
    "SourceProcessGuid": "{8a99384c-e939-6a2c-5900-000000001000}",
    "SourceProcessId": "4028",
    "SourceImage": "C:\\Tools\\RPCFW_2.2.5\\rpcFwManager.exe",
    "TargetProcessGuid": "{8a99384c-6471-6a2d-a005-000000001000}",
    "TargetProcessId": "7864",
    "TargetImage": "C:\\Windows\\System32\\wsmprovhost.exe",
    "NewThreadId": "8000",
    "StartAddress": "0x00007FF9A37401F0",
    "StartModule": "C:\\Windows\\System32\\KERNEL32.DLL",
    "StartFunction": "LoadLibraryA",
    "SourceUser": "NT AUTHORITY\\SYSTEM",
    "TargetUser": "cell-c\\domainadmin"
  },
  "message": "CreateRemoteThread detected:\r\nRuleName: -\r\nUtcTime: 2026-06-13 14:08:51.101\r\nSourceProcessGuid: {8a99384c-e939-6a2c-5900-000000001000}\r\nSourceProcessId: 4028\r\nSourceImage: C:\\Tools\\RPCFW_2.2.5\\rpcFwManager.exe\r\nTargetProcessGuid: {8a99384c-6471-6a2d-a005-000000001000}\r\nTargetProcessId: 7864\r\nTargetImage: C:\\Windows\\System32\\wsmprovhost.exe\r\nNewThreadId: 8000\r\nStartAddress: 0x00007FF9A37401F0\r\nStartModule: C:\\Windows\\System32\\KERNEL32.DLL\r\nStartFunction: LoadLibraryA\r\nSourceUser: NT AUTHORITY\\SYSTEM\r\nTargetUser: cell-c\\domainadmin"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`SourceImage`	contains	`:\temp\`	1 rule	sigma
`SourceImage`	contains	`:\users\public\`	1 rule	sigma
`SourceImage`	ends_with	`\powershell.exe`	3 rules	sigma
`SourceImage`	ends_with	`\pwsh.exe`	3 rules	sigma
`SourceImage`	ends_with	`\excel.exe`	2 rules	sigma
`SourceImage`	ends_with	`\winword.exe`	2 rules	sigma
`TargetImage`	ends_with	`\lsass.exe`	2 rules	sigma
`TargetImage`	ends_with	`\rundll32.exe`	2 rules	sigma
`TargetImage`	ends_with	`\\lsass.exe`	1 rule	splunk
`TargetImage`	ends_with	`\calc.exe`	1 rule	sigma
`TargetImage`	ends_with	`\calculator.exe`	1 rule	sigma
`TargetImage`	in	`*\\cmd.exe`	2 rules	splunk
`TargetImage`	in	`*\\explorer.exe`	2 rules	splunk
`TargetImage`	in	`*\\powershell.exe`	2 rules	splunk
`Provider_Name`	eq	`Microsoft-Windows-Sysmon`	1 rule	elastic

Community Notes #

CreateRemoteThread. Detects some process-injection methods.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

HackTool - CACTUSTORCH Remote Thread Creation source high: Detects remote thread creation from CACTUSTORCH as described in references.T1055, T1055.012, T1059, T1059.005, T1059.007, T1218
HackTool - Potential CobaltStrike Process Injection source high: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beaconsT1055, T1055.001
Remote Thread Created In KeePass.EXE source high: Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activityT1555, T1555.005

Show 12 more (15 total) on the rules page

Elastic # view in coverage

Process Injection by the Microsoft Build Engine source low: An instance of MSBuild, the Microsoft Build Engine, created a thread in another process. This technique is sometimes used to evade detection or elevate privileges.T1055, T1127, T1127.001

Splunk # view in coverage

Create Remote Thread In Shell Application source: The following analytic detects suspicious process injection in command shell applications, specifically targeting cmd.exe and powershell.exe. It leverages Sysmon EventCode 8 to identify the creation of remote threads within these shell…T1055
Create Remote Thread into LSASS source: The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). This behavior is identified using Sysmon EventID 8 logs, focusing on processes that create remote threads in…T1003, T1003.001
Powershell Remote Thread To Known Windows Process source: The following analytic detects suspicious PowerShell processes attempting to inject code into critical Windows processes using CreateRemoteThread. It leverages Sysmon EventCode 8 to identify instances where PowerShell spawns threads in…T1055

Full rule details for this event, including ATT&CK technique mappings and native queries →

References #

Event ID 9: RawAccessRead

Channel: Operational
Level: Informational
Collection Priority: Recommended (JSCU-NL)
Task: RawAccessRead detected (rule: RawAccessRead)
Opcode: Info

Description

The **RawAccessRead** event detects when a process conducts reading operations from the drive using the .\ denotation. This technique is often used by malware for data exfiltration of files that are locked for reading, as well as to avoid file access auditing tools. The event indicates the source process and target device.

Message #

RawAccessRead detected:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
Device: %6
User: %7

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that conducted reading operations from the drive
`ProcessId` UInt32	Process ID used by the OS to identify the process that conducted reading operations from the drive
`Image` UnicodeString	File path of the process that conducted reading operations from the drive	36 detection rules
`Device` UnicodeString	Target device	5 detection rules
`User` UnicodeString	Name of the account of the process that conducted reading operations from the drive

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 9,
    "version": 2,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:23:56.8470704+00:00",
    "event_record_id": 16041099,
    "correlation": {},
    "execution": {
      "process_id": 4008,
      "thread_id": 5284
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-b.cell-b.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 14:23:56.843",
    "ProcessGuid": "{8a99384c-c2a8-6a19-9400-000000000f00}",
    "ProcessId": "6120",
    "Image": "C:\\Windows\\System32\\svchost.exe",
    "Device": "\\Device\\HarddiskVolume1",
    "User": "NT AUTHORITY\\SYSTEM"
  },
  "message": "RawAccessRead detected:\r\nRuleName: -\r\nUtcTime: 2026-06-13 14:23:56.843\r\nProcessGuid: {8a99384c-c2a8-6a19-9400-000000000f00}\r\nProcessId: 6120\r\nImage: C:\\Windows\\System32\\svchost.exe\r\nDevice: \\Device\\HarddiskVolume1\r\nUser: NT AUTHORITY\\SYSTEM"
}

Community Notes #

RawAccessRead, may indicate direct disk reads of ntds.dit, SAM, or page files for offline hash extraction.

Detection Rules #

Sigma # view in coverage

Potential Defense Evasion Via Raw Disk Access By Uncommon Tools source low: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attemptsT1006

Splunk # view in coverage

Windows Raw Access To Disk Volume Partition source: The following analytic detects suspicious raw access reads to the device disk partition of a host machine. It leverages Sysmon EventCode 9 logs to identify processes attempting to read or write to the boot sector, excluding legitimate…T1561, T1561.002
Windows Raw Access To Master Boot Record Drive source: The following analytic detects suspicious raw access reads to the drive containing the Master Boot Record (MBR). It leverages Sysmon EventCode 9 to identify processes attempting to read or write to the MBR sector, excluding legitimate…T1561, T1561.002

References #

Event ID 10: ProcessAccess

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (JSCU-NL)
Task: Process accessed (rule: ProcessAccess)
Opcode: Info

Description

The **process accessed** event reports when a process opens another process, an operation that's often followed by information queries or reading and writing the address space of the target process. This enables detection of hacking tools that read the memory contents of processes like Local Security Authority (Lsass.exe) in order to steal credentials for use in Pass-the-Hash attacks. Enabling it can generate significant amounts of logging if there are diagnostic utilities active that repeatedly open processes to query their state, so it generally should only be done so with filters that remove expected accesses.

Message #

Process accessed:
RuleName: %1
UtcTime: %2
SourceProcessGUID: %3
SourceProcessId: %4
SourceThreadId: %5
SourceImage: %6
TargetProcessGUID: %7
TargetProcessId: %8
TargetImage: %9
GrantedAccess: %10
CallTrace: %11
SourceUser: %12
TargetUser: %13

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`SourceProcessGUID` GUID
`SourceProcessId` UInt32	Process ID used by the os to identify the source process that opened another process. Derived partially from the EPROCESS kernel structure
`SourceThreadId` UInt32	ID of the specific thread inside of the source process that opened another process
`SourceImage` UnicodeString	File path of the source process that opened another process	296 detection rules
`TargetProcessGUID` GUID
`TargetProcessId` UInt32	Process ID used by the OS to identify the target process
`TargetImage` UnicodeString	File path of the target process	113 detection rules
`GrantedAccess` HexInt32	The access flags (bitmask) associated with the process rights requested for the target process Process access rights reference	199 detection rules
`CallTrace` UnicodeString	Stack trace of where OpenProcess is called, including the DLL and relative virtual address of each function in the call stack	52 detection rules
`SourceUser` UnicodeString	Name of the account of the source process that opened another process.	6 detection rules
`TargetUser` UnicodeString	Name of the account of the target process

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 10,
    "version": 3,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:09:58.2417162+00:00",
    "event_record_id": 17614233,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 14:09:58.226",
    "SourceProcessGUID": "{8a99384c-e93e-6a2c-7000-000000001000}",
    "SourceProcessId": "5508",
    "SourceThreadId": "6764",
    "SourceImage": "C:\\Windows\\system32\\wbem\\wmiprvse.exe",
    "TargetProcessGUID": "{8a99384c-e976-6a2c-b900-000000001000}",
    "TargetProcessId": "6984",
    "TargetImage": "C:\\Windows\\System32\\RuntimeBroker.exe",
    "GrantedAccess": "0x1410",
    "CallTrace": "C:\\Windows\\SYSTEM32\\ntdll.dll+9f3b4|C:\\Windows\\System32\\KERNELBASE.dll+2aafe|C:\\Windows\\system32\\wbem\\cimwin32.dll+e3a5|C:\\Windows\\system32\\wbem\\cimwin32.dll+ea1c|C:\\Windows\\SYSTEM32\\framedynos.dll+4006|C:\\Windows\\SYSTEM32\\framedynos.dll+4e74|C:\\Windows\\system32\\wbem\\wmiprvse.exe+180e|C:\\Windows\\system32\\wbem\\wmiprvse.exe+1420|C:\\Windows\\System32\\RPCRT4.dll+749d3|C:\\Windows\\System32\\RPCRT4.dll+2f745|C:\\Windows\\System32\\combase.dll+c373b|C:\\Windows\\System32\\RPCRT4.dll+58a85|C:\\Windows\\System32\\combase.dll+9e2fd|C:\\Windows\\System32\\combase.dll+9e08e|C:\\Windows\\System32\\combase.dll+c9de6|C:\\Windows\\System32\\combase.dll+658bd|C:\\Windows\\System32\\combase.dll+ba051|C:\\Windows\\System32\\combase.dll+4b4ce|C:\\Windows\\System32\\combase.dll+49f0f|C:\\Windows\\System32\\combase.dll+48839|C:\\Windows\\System32\\RPCRT4.dll+57ff2|C:\\Windows\\System32\\RPCRT4.dll+4762f|C:\\Windows\\System32\\RPCRT4.dll+47258|C:\\Windows\\System32\\RPCRT4.dll+1d1a3",
    "SourceUser": "NT AUTHORITY\\NETWORK SERVICE",
    "TargetUser": "cell-c\\domainadmin"
  },
  "message": "Process accessed:\r\nRuleName: -\r\nUtcTime: 2026-06-13 14:09:58.226\r\nSourceProcessGUID: {8a99384c-e93e-6a2c-7000-000000001000}\r\nSourceProcessId: 5508\r\nSourceThreadId: 6764\r\nSourceImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nTargetProcessGUID: {8a99384c-e976-6a2c-b900-000000001000}\r\nTargetProcessId: 6984\r\nTargetImage: C:\\Windows\\System32\\RuntimeBroker.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+9f3b4|C:\\Windows\\System32\\KERNELBASE.dll+2aafe|C:\\Windows\\system32\\wbem\\cimwin32.dll+e3a5|C:\\Windows\\system32\\wbem\\cimwin32.dll+ea1c|C:\\Windows\\SYSTEM32\\framedynos.dll+4006|C:\\Windows\\SYSTEM32\\framedynos.dll+4e74|C:\\Windows\\system32\\wbem\\wmiprvse.exe+180e|C:\\Windows\\system32\\wbem\\wmiprvse.exe+1420|C:\\Windows\\System32\\RPCRT4.dll+749d3|C:\\Windows\\System32\\RPCRT4.dll+2f745|C:\\Windows\\System32\\combase.dll+c373b|C:\\Windows\\System32\\RPCRT4.dll+58a85|C:\\Windows\\System32\\combase.dll+9e2fd|C:\\Windows\\System32\\combase.dll+9e08e|C:\\Windows\\System32\\combase.dll+c9de6|C:\\Windows\\System32\\combase.dll+658bd|C:\\Windows\\System32\\combase.dll+ba051|C:\\Windows\\System32\\combase.dll+4b4ce|C:\\Windows\\System32\\combase.dll+49f0f|C:\\Windows\\System32\\combase.dll+48839|C:\\Windows\\System32\\RPCRT4.dll+57ff2|C:\\Windows\\System32\\RPCRT4.dll+4762f|C:\\Windows\\System32\\RPCRT4.dll+47258|C:\\Windows\\System32\\RPCRT4.dll+1d1a3\r\nSourceUser: NT AUTHORITY\\NETWORK SERVICE\r\nTargetUser: cell-c\\domainadmin"
}

Detection Patterns #

Credential Access: DCSync

Sysmon Event ID 1: Process creationOREvent ID 10: ProcessAccess

1 rule

Splunk

Mimikatz (Sysmon) (source)

Stealth: Process Hollowing

Sysmon Event ID 1: Process creation→Event ID 10: ProcessAccess

1 rule

Elastic

Suspicious Process Creation CallTrace (source)

Elastic

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`TargetImage`	ends_with	`\lsass.exe`	14 rules	sigma
`TargetImage`	ends_with	`lsass.exe`	5 rules	splunk
`GrantedAccess`	ends_with	`0x14c2`	4 rules	sigma
`GrantedAccess`	ends_with	`10`	4 rules	sigma
`GrantedAccess`	ends_with	`18`	4 rules	sigma
`GrantedAccess`	ends_with	`1a`	4 rules	sigma
`GrantedAccess`	ends_with	`30`	4 rules	sigma
`GrantedAccess`	ends_with	`38`	4 rules	sigma
`GrantedAccess`	ends_with	`3a`	4 rules	sigma
`GrantedAccess`	ends_with	`50`	4 rules	sigma
`GrantedAccess`	ends_with	`58`	4 rules	sigma
`GrantedAccess`	eq	`0x1fffff`	9 rules	kusto, sigma, splunk
`CallTrace`	contains	`unknown`	5 rules	elastic, sigma
`CallTrace`	contains	`dbgcore.dll`	4 rules	kusto, sigma, splunk
`CallTrace`	contains	`dbghelp.dll`	4 rules	kusto, sigma, splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

CMSTP Execution Process Access source high: Detects various indicators of Microsoft Connection Manager Profile Installer executionT1218, T1218.003, T1559, T1559.001
HackTool - CobaltStrike BOF Injection Pattern source high: Detects a typical pattern of a CobaltStrike BOF which inject into other processesT1106, T1685
HackTool - Generic Process Access source high: Detects process access requests from hacktool processes based on their default image nameT1003, T1003.001

Show 17 more (30 total) on the rules page

Elastic # view in coverage

Potential Credential Access via DuplicateHandle in LSASS source medium: Identifies suspicious access to an LSASS handle via DuplicateHandle from an unknown call trace module. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump LSASS memory for credential access.T1003, T1003.001
Suspicious Lsass Process Access source medium: Identifies access attempts to LSASS handle, this may indicate an attempt to dump credentials from Lsass memory.T1003, T1003.001
Potential Credential Access via LSASS Memory Dump source high: Identifies suspicious access to LSASS handle from a call trace pointing to DBGHelp.dll or DBGCore.dll, which both export the MiniDumpWriteDump method that can be used to dump LSASS memory content in preparation for credential access.T1003, T1003.001, T1106

Show 12 more (15 total) on the rules page

Splunk # view in coverage

Access LSASS Memory for Dump Creation source: The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. It leverages Sysmon logs, specifically EventCode 10, to identify suspicious call traces to dbgcore.dll and…T1003, T1003.001
Detect Credential Dumping through LSASS access source: The following analytic detects attempts to read LSASS memory, indicative of credential dumping. It leverages Sysmon EventCode 10, filtering for specific access permissions (0x1010 and 0x1410) on the lsass.exe process. This activity is…T1003, T1003.001
Rubeus Kerberos Ticket Exports Through Winlogon Access source: The following analytic detects a process accessing the winlogon.exe system process, indicative of the Rubeus tool attempting to export Kerberos tickets from memory. This detection leverages Sysmon EventCode 10 logs, focusing on processes…T1550, T1550.003

Kusto # view in coverage

Dumping LSASS Process Into a File source high: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or system and used to conduct lateral movement using alternate authentication materials. As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system. Ref: https://attack.mitre.org/techniques/T1003/001/T1003, T1003.001

YARA-L # view in coverage

Credential Dumping Attempt Via WerFault source high: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and upT1003, T1003.001
HackTool - Generic Process Access source high: Detects process access requests from hacktool processes based on their default image nameT1003, T1003.001
LSASS Memory Access by Tool With Dump Keyword In Name source high: Detects LSASS process access requests from a source process with the dump keyword in its image nameT1003, T1003.001

Sysmon Event ID 1: Process creationANDEvent ID 11: FileCreate

References #

Event ID 11: FileCreate

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: File created (rule: FileCreate)
Opcode: Info

Description

**File create** operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.

Message #

File created:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
TargetFilename: %6
CreationUtcTime: %7
User: %8

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that created the file
`ProcessId` UInt32	Process ID used by the OS to identify the process that created the file
`Image` UnicodeString	File path of the process that created the file	491 detection rules
`TargetFilename` UnicodeString	Name of the file	1797 detection rules
`CreationUtcTime` UnicodeString	File creation time	4 detection rules
`User` UnicodeString	Name of the account who created the file	2 detection rules

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 11,
    "version": 2,
    "level": 4,
    "task": 11,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:09:34.7524084+00:00",
    "event_record_id": 17613105,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 14:09:34.741",
    "ProcessGuid": "{8a99384c-e971-6a2c-b200-000000001000}",
    "ProcessId": "6816",
    "Image": "C:\\Windows\\Explorer.EXE",
    "TargetFilename": "C:\\Users\\domainadmin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1024_768_POS1.jpg",
    "CreationUtcTime": "2026-06-13 14:09:34.741",
    "User": "cell-c\\domainadmin"
  },
  "message": "File created:\r\nRuleName: -\r\nUtcTime: 2026-06-13 14:09:34.741\r\nProcessGuid: {8a99384c-e971-6a2c-b200-000000001000}\r\nProcessId: 6816\r\nImage: C:\\Windows\\Explorer.EXE\r\nTargetFilename: C:\\Users\\domainadmin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1024_768_POS1.jpg\r\nCreationUtcTime: 2026-06-13 14:09:34.741\r\nUser: cell-c\\domainadmin"
}

Detection Patterns #

12 rules

Splunk

MS Exchange Mailbox Replication service writing Active Server Pages (source)

Michael Haag, Splunk

Windows Office Product Dropped Cab or Inf File (source)

Bhavin Patel, Splunk

Michael Haag, Splunk

(Security-Auditing Event ID 4688: A new process has been created.ANDSysmon Event ID 11: FileCreate)OR(Event ID 1: Process creationANDEvent ID 11: FileCreate)

7 rules

Splunk

Windows Office Product Dropped Cab or Inf File (source)

Michael Haag, Splunk

Windows Office Product Dropped Uncommon File (source)

Bhavin Patel, Splunk

Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github

Security-Auditing Event ID 4663: An attempt was made to access an object.ORSysmon Event ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

Threat Hunting Hash

4 rules

Kusto

RecordedFuture Threat Hunting Hash All Actors (source)

SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events) (source)

Yaron

Google Threat Intelligence - Threat Hunting Hash (source)

Sysmon Event ID 1: Process creationOREvent ID 11: FileCreate

Share Access Sysmon

4 rules

Splunk

Windows Default RDP File Creation By Non MSTSC Process (source)

Teoderick Contreras, Splunk

Windows Admin$ Share Access (Sysmon) (source)

Windows C$ Share Access (Sysmon) (source)

Sysmon Event ID 11: FileCreateORSysmon-for-Linux Event ID 11: File created

Workflow File Creation

3 rules

Splunk

GitHub Workflow File Creation or Modification (source)

Michael Haag, Splunk

Shai-Hulud 2 Exfiltration Artifact Files (source)

Michael Haag, Splunk

Shai-Hulud Workflow File Creation or Modification (source)

Michael Haag, Splunk

Show All Detection Patterns

Remote File Download

Sysmon Event ID 3: Network connection→Event ID 11: FileCreate

2 rules

Elastic

Remote File Download via PowerShell (source)

Elastic

Remote File Download via Script Interpreter (source)

Elastic

Hash And Ip Iocs

2 rules

Kusto

Europium - Hash and IP IOCs - September 2022 (source)

Microsoft Security Research

Mercury - Domain, Hash and IP IOCs - August 2022 (source)

Ajeet Prakash

Sysmon Event ID 11: FileCreate→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

1 rule

Elastic

Execution of a Downloaded Windows Script (source)

Elastic

Sysmon Event ID 11: FileCreateOREvent ID 15: FileCreateStreamHash

1 rule

Splunk

Windows MsMpEng Writing to System32 (source)

Raven Tait, Splunk

Sysmon Event ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

1 rule

Splunk

Windows Suspicious Defender Update Activity in INetCache (source)

Raven Tait, Splunk

Initial Access: Exploit Public-Facing Application

Security-Auditing Event ID 4663: An attempt was made to access an object.OREvent ID 4688: A new process has been created.ORSysmon Event ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

1 rule

Kusto

Identify SysAid Server web shell creation (source)

Microsoft Security Research

Execution: Exploitation for Client Execution

Security-Auditing Event ID 4663: An attempt was made to access an object.ORSysmon Event ID 1: Process creationOREvent ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

1 rule

Kusto

Sysmon Event ID 11: FileCreateOREvent ID 23: FileDelete

Microsoft Security Research

Persistence: Boot or Logon Autostart Execution

1 rule

Splunk

Additional dll added to Spool Driver (Sysmon) (source)

Credential Access: NTDS

ESENT Event ID 216OREvent ID 325OREvent ID 326OREvent ID 327ORSecurity-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creationOREvent ID 11: FileCreate

1 rule

Kusto

Europium - Hash and IP IOCs - September 2022 (source)

Microsoft Security Research

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`TargetFilename`	ends_with	`.dll`	23 rules	sigma
`TargetFilename`	ends_with	`.exe`	21 rules	sigma, splunk
`TargetFilename`	ends_with	`.vbs`	18 rules	sigma
`TargetFilename`	ends_with	`.bat`	17 rules	sigma
`TargetFilename`	ends_with	`.ps1`	17 rules	sigma
`TargetFilename`	ends_with	`.vbe`	16 rules	sigma
`TargetFilename`	ends_with	`.hta`	14 rules	sigma
`TargetFilename`	ends_with	`.js`	10 rules	sigma
`TargetFilename`	starts_with	`c:\users\`	10 rules	elastic, sigma
`event.type`	eq	`creation`	18 rules	elastic
`Image`	ends_with	`\powershell.exe`	13 rules	sigma
`Image`	ends_with	`\pwsh.exe`	12 rules	sigma
`Image`	ends_with	`\mshta.exe`	11 rules	sigma
`Image`	ends_with	`\cmd.exe`	8 rules	sigma
`event_action`	eq	`created`	9 rules	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

ADSI-Cache File Creation By Uncommon Tool source medium: Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.T1001, T1001.003
Advanced IP Scanner - File Event source medium: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.T1046
Anydesk Temporary Artefact source medium: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)T1219, T1219.002

Show 17 more (226 total) on the rules page

Elastic # view in coverage

Remote File Copy via TeamViewer source medium: Identifies an executable or script file remotely downloaded via a TeamViewer transfer session.T1105, T1219
Kirbi File Creation source high: Identifies the creation of .kirbi files, a suspicious Kerberos ticket artifact often produced by ticket export or dumping tools such as Rubeus or Mimikatz. This can indicate preparation for Kerberos ticket theft or later abuse, including Pass-The-Ticket (PTT), and should be validated with writer process and follow-on activity.T1003, T1558
Windows Registry File Creation in SMB Share source medium: Identifies the creation or modification of a medium-size registry hive file on a Server Message Block (SMB) share, which may indicate an exfiltration attempt of a previously dumped Security Account Manager (SAM) registry hive for credential extraction on an attacker-controlled system.T1003, T1003.002, T1021, T1021.002, T1048

Show 16 more (19 total) on the rules page

Splunk # view in coverage

Email files written outside of the Outlook directory source: The following analytic detects email files (.pst or .ost) being created outside the standard Outlook directories. It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in…T1114, T1114.001
Batch File Write to System32 source: The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. It leverages data from the Endpoint datamodel, focusing on process and…T1204, T1204.002
Common Ransomware Extensions source: The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns. This…T1485

Show 17 more (78 total) on the rules page

Kusto # view in coverage

Credential Dumping Tools - File Artifacts source high: This query detects the creation of credential dumping tools files. Several credential dumping tools export files with hardcoded file names. Ref: https://jpcertcc.github.io/ToolAnalysisResultSheet/T1003, T1003.001
Spearphishing Attachment: ISO Images (Microsoft Sentinel) source: ISO images are often meant to be used offline and they are often used by IT Admins and/or used on Servers.
Installation from an iso file don't require network connection most of the time. Activities deviating from these situations can be considered as highly suspicious. Below queries detects opening a mounted image, process creation under a mounted image, and network connection from a process created under a mounted image.
All detections can be used seperately or combined together to generate a higher fidelity alert. WARNING: Check your Sysmon parsing functions and verify you have the logs. Using "Rendered Description" field for parsing causes parsing issues for registry events. Detect opening of a mounted image:↳ also matches Event ID 1: Process creation, Event ID 3: Network connection, Event ID 13: RegistryEvent (Value Set)

YARA-L # view in coverage

Attempted SharePoint Webshell Creation CVE-2025-53770 source high: Detects the attempted creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of an attempt to exploit the SharePoint Server vulnerability CVE-2025-53770.T1505, T1505.003
Successful SharePoint Webshell Creation CVE-2025-53770 source critical: Detects the creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of successful post-exploitation of the SharePoint Server vulnerability CVE-2025-53770, where an attacker has likely placed a web shell for persistent access.T1505, T1505.003
Suspicious Filewrites To Sharepoint Layouts source high: Detects a command-line interpreter (cmd.exe or powershell.exe) writing a file to a SharePoint (\TEMPLATE\LAYOUTS) directory.T1505, T1505.003↳ also matches Event ID 2: A process changed a file creation time, Event ID 23: FileDelete (File Delete archived)

Show 17 more (20 total) on the rules page

References #

Event ID 12: RegistryEvent (Object create and delete)

Channel: Operational
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: Registry object added or deleted (rule: RegistryEvent)
Opcode: Info

Description

**Registry key and value create and delete** operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications.

Message #

Registry object added or deleted:
RuleName: %1
EventType: %2
UtcTime: %3
ProcessGuid: %4
ProcessId: %5
Image: %6
TargetObject: %7
User: %8

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`EventType` UnicodeString	Registry event. Either Create or Delete Known values `CreateKey` A new registry key was created. `DeleteKey` An existing registry key was deleted. `CreateValue` A new registry value was created under an existing key. `DeleteValue` An existing registry value was removed.	19 detection rules
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that created or deleted a registry key
`ProcessId` UInt32	Process ID used by the OS to identify the process that created or deleted a registry key
`Image` UnicodeString	File path of the process that created or deleted a registry key	21 detection rules
`TargetObject` UnicodeString	Complete path of the registry key	177 detection rules
`User` UnicodeString	The name of the account that created or deleted a registry key or value	2 detection rules

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 12,
    "version": 2,
    "level": 4,
    "task": 12,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:09:44.0868063+00:00",
    "event_record_id": 17613579,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "EventType": "CreateKey",
    "UtcTime": "2026-06-13 14:09:44.085",
    "ProcessGuid": "{8a99384c-e939-6a2c-5500-000000001000}",
    "ProcessId": "3932",
    "Image": "C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe",
    "TargetObject": "HKLM\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
    "User": "NT AUTHORITY\\SYSTEM"
  },
  "message": "Registry object added or deleted:\r\nRuleName: -\r\nEventType: CreateKey\r\nUtcTime: 2026-06-13 14:09:44.085\r\nProcessGuid: {8a99384c-e939-6a2c-5500-000000001000}\r\nProcessId: 3932\r\nImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\r\nUser: NT AUTHORITY\\SYSTEM"
}

Detection Patterns #

Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent

109 rules

Sigma

HybridConnectionManager Service Installation - Registry (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Windows Registry Trust Record Modification (source)

Antonlovesdnb, Trent Liffick (@tliffick)

Show 43 more (46 total) on the rules page

Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community

Elastic

SolarWinds Process Disabling Services via Registry (source)

Elastic

Persistence via WMI Standard Registry Provider (source)

Elastic

Show 44 more (47 total) on the rules page

Elastic

Splunk

LSA Authentication Packages Registry Key Modified (Sysmon) (source)

Startup Folder Location Modified - Windows (Sysmon) (source)

Detect Print Processors Registry Driver Key Creation/Modification (source)

Kusto

Detect Registry Run Key Creation/Modification (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Pete Bryan

Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEvent

90 rules

Sigma

Registry Persistence Mechanisms in Recycle Bin (source)

Dmitriy Lifanov, oscd.community

frack113

Show 27 more (30 total) on the rules page

omkar72

Elastic

Suspicious Startup Shell Folder Modification (source)

Elastic

Elastic

Show 38 more (41 total) on the rules page

Elastic

Splunk

Windows WPDBusEnum Registry Key Modification (source)

Steven Dick

Steven Dick

LSA Authentication Packages Registry Key Modified (Sysmon) (source)

Detect Print Processors Registry Driver Key Creation/Modification (source)

Kusto

Detect Registry Run Key Creation/Modification (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Pete Bryan

Security-Auditing Event ID 4657: A registry value was modified.OREvent ID 4663: An attempt was made to access an object.ORSysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent

73 rules

Sigma

Registry Persistence Mechanisms in Recycle Bin (source)

Dmitriy Lifanov, oscd.community

frack113

Show 19 more (22 total) on the rules page

omkar72

Elastic

Suspicious Startup Shell Folder Modification (source)

Elastic

Elastic

Show 36 more (39 total) on the rules page

Elastic

Splunk

LSA Authentication Packages Registry Key Modified (Sysmon) (source)

Startup Folder Location Modified - Windows (Sysmon) (source)

Detect Print Processors Registry Driver Key Creation/Modification (source)

Kusto

Detect Registry Run Key Creation/Modification (source)

Detect Windows Allow Firewall Rule Addition/Modification (source)

Sysmon Event ID 1: Process creationOREvent ID 12: RegistryEventOREvent ID 13: RegistryEvent

62 rules

Sigma

oscd.community, Dmitry Uchakin

Disable Security Events Logging Adding Reg Key MiniNt (source)

Christian Burkard (Nextron Systems)

Ilyas Ochkov, oscd.community

Elastic

Disabling User Account Control via Registry Modification (source)

Elastic

Elastic

Creation of a Hidden Local User Account (source)

Elastic

Splunk

Potential fodhelper UAC Bypass Attempt (Sysmon) (source)

Sdclt UAC Bypass (source)

Steven Dick, Teoderick Contreras, Splunk

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Kusto

Pete Bryan

Detect Registry Run Key Creation/Modification (source)

Sysmon Event ID 12: RegistryEventANDEvent ID 13: RegistryEventANDEvent ID 14: RegistryEvent

55 rules

Sigma

Disable Security Events Logging Adding Reg Key MiniNt (source)

Ilyas Ochkov, oscd.community

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Trent Liffick

Elastic

Elastic

Elastic

Elastic

Splunk

Michael Haag, Splunk

Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk

Steven Dick, Teoderick Contreras, Splunk

Detect Registry Run Key Creation/Modification (source)

Kusto

Show All Detection Patterns

(Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)→(Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)

53 rules

Sigma

Disable Security Events Logging Adding Reg Key MiniNt (source)

Ilyas Ochkov, oscd.community

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Trent Liffick

Suspicious Print Spooler Point and Print DLL (source)

Elastic

Elastic

Unusual Persistence via Services Registry (source)

Elastic

Potential Privilege Escalation via Service ImagePath Modification (source)

Elastic

Splunk

Michael Haag, Splunk

Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk

Steven Dick, Teoderick Contreras, Splunk

Detect Registry Run Key Creation/Modification (source)

Kusto

Sysmon Event ID 3: Network connection→(Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)

9 rules

Sigma

Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community

RDP shadow session configuration enabled (registry) (source)

Center for Threat Informed Defense (CTID) Summiting the Pyramid Team

mdecrevoisier

Elastic

Elastic

Scheduled Task Created by a Windows Script (source)

Elastic

Elastic

Uac Bypass

9 rules

Sigma

oscd.community, Dmitry Uchakin

Christian Burkard (Nextron Systems)

Elastic

Disabling User Account Control via Registry Modification (source)

Elastic

Elastic

Splunk

Potential fodhelper UAC Bypass Attempt (Sysmon) (source)

Sdclt UAC Bypass (source)

Steven Dick, Teoderick Contreras, Splunk

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Kusto

Pete Bryan

Execution: PowerShell

Sysmon Event ID 12: RegistryEvent→Event ID 13: RegistryEvent→Event ID 14: RegistryEvent

8 rules

Sigma

Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community

Registry Tampering by Potentially Suspicious Processes (source)

Center for Threat Informed Defense (CTID) Summiting the Pyramid Team

Swachchhanda Shrawan Poudel (Nextron Systems)

Elastic

Elastic

Scheduled Task Created by a Windows Script (source)

Elastic

Elastic

Registry Tampering by Potentially Suspicious Processes (source)

8 rules

Sigma

Swachchhanda Shrawan Poudel (Nextron Systems)

RDP shadow session configuration enabled (registry) (source)

mdecrevoisier

Elastic

Windows Subsystem for Linux Distribution Installed (source)

Elastic

Elastic

Scheduled Task Created by a Windows Script (source)

Elastic

(Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

Stealth: Msiexec

4 rules

Sigma

CMSTP Execution Registry Event (source)

Nik Seetharaman

Atbroker Registry Change (source)

Mateusz Wydra, oscd.community

Elastic

Windows Installer with Suspicious Properties (source)

Elastic

Splunk

Sysmon Event ID 12: RegistryEventANDEvent ID 13: RegistryEventANDEvent ID 14: RegistryEvent

Michael Haag, Splunk

Registry Key Modification

3 rules

Elastic

First Time Seen Removable Device (source)

Elastic

Splunk

Windows WPDBusEnum Registry Key Modification (source)

Steven Dick

Steven Dick

Defense Impairment: Modify Registry

Sysmon Event ID 1: Process creationANDEvent ID 12: RegistryEvent

2 rules

Splunk

Windows Deleted Registry By A Non Critical Process File Path (source)

Steven Dick, Teoderick Contreras, Splunk

LocalAccountTokenFilterPolicy Registry Value Modified (Sysmon) (source)

Command & Control: Proxy

Security-Auditing Event ID 4656: A handle to an object was requested.OREvent ID 4657: A registry value was modified.OREvent ID 4688: A new process has been created.ORSysmon Event ID 1: Process creationOREvent ID 12: RegistryEventOREvent ID 13: RegistryEvent

2 rules

Sigma

New PortProxy Registry Entry Added (source)

Andreas Hunkeler (@Karneades)

Elastic

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`event.type`	eq	`change`	44 rules	elastic
`Details`	ends_with	`.dll`	3 rules	elastic
`Details`	eq	`1`	8 rules	elastic, kusto
`Details`	eq	`0`	7 rules	elastic
`Details`	eq	`0x00000000`	7 rules	elastic
`Details`	eq	`0x00000001`	7 rules	elastic
`Details`	is_not_null		9 rules	elastic
`Details`	length_compare	`0`	4 rules	elastic
`Details`	length_compare	`>`	4 rules	elastic
`EventType`	eq	`setvalue`	5 rules	sigma
`EventType`	eq	`deleted`	4 rules	splunk
`EventType`	eq	`createkey`	3 rules	sigma
`EventType`	in	`RegistryKeyCreated`	5 rules	kusto
`EventType`	in	`RegistryValueSet`	5 rules	kusto
`Image`	is_not_null		3 rules	elastic

Detection Rules #

Sigma # view in coverage

Potential Persistence Via Disk Cleanup Handler - Registry source medium: Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.
Potential Ursnif Malware Activity - Registry source high: Detects registry keys related to Ursnif malware.T1112
Potential NetWire RAT Activity - Registry source high: Detects registry keys related to NetWire RATT1112

Splunk # view in coverage

Windows CrowdStrike Agent Registry Key Removal source: Detects delete events on the CrowdStrike registry keys. These keys are removed as part of the agent uninstallation process. This activity should only occur during planned events and any instances outside that should be evaluated for…T1685
Windows Modify Registry Delete Firewall Rules source: The following analytic detects a potential deletion of firewall rules, indicating a possible security breach or unauthorized access attempt. It identifies actions where firewall rules are removed using commands like netsh advfirewall…T1112
Windows Registry Delete Task SD source: The following analytic detects a process attempting to delete a scheduled task's Security Descriptor (SD) from the registry path of that task. It leverages the Endpoint.Registry data model to identify registry actions performed by the…T1053, T1053.005, T1685

Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent

YARA-L # view in coverage

MITRE ATT&CK T1090 Port Proxy Forwarding CISA Report source low: Detects port forwarding being enabled using netsh command and registry settings created or modified in support of portproxy v4tov4T1090↳ also matches Event ID 1: Process creation, Event ID 13: RegistryEvent (Value Set)

References #

Event ID 13: RegistryEvent (Value Set)

Channel: Operational
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: Registry value set (rule: RegistryEvent)
Opcode: Info

Description

This Registry event type identifies **Registry value modifications**. The event records the value written for Registry values of type DWORD and QWORD.

Message #

Registry value set:
RuleName: %1
EventType: %2
UtcTime: %3
ProcessGuid: %4
ProcessId: %5
Image: %6
TargetObject: %7
Details: %8
User: %9

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`EventType` UnicodeString	Registry value modification event	27 detection rules
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that modified a registry value
`ProcessId` UInt32	Process ID used by the OS to identify the process that modified a registry value
`Image` UnicodeString	File path of the process that modified a registry value	326 detection rules
`TargetObject` UnicodeString	Complete path of the registry key	992 detection rules
`Details` UnicodeString	Details added to the registry key	1031 detection rules
`User` UnicodeString	The name of the account that modified a registry value.	4 detection rules

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 13,
    "version": 2,
    "level": 4,
    "task": 13,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:09:29.7259683+00:00",
    "event_record_id": 17612810,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "EventType": "SetValue",
    "UtcTime": "2026-06-13 14:09:29.710",
    "ProcessGuid": "{8a99384c-6499-6a2d-a205-000000001000}",
    "ProcessId": "7704",
    "Image": "C:\\ludus\\background\\bginfo.exe",
    "TargetObject": "HKU\\S-1-5-21-1006758700-2167138679-1475694448-1105\\Software\\Winternals\\BGInfo\\WindowPosition",
    "Details": "Binary Data",
    "User": "cell-c\\domainadmin"
  },
  "message": "Registry value set:\r\nRuleName: -\r\nEventType: SetValue\r\nUtcTime: 2026-06-13 14:09:29.710\r\nProcessGuid: {8a99384c-6499-6a2d-a205-000000001000}\r\nProcessId: 7704\r\nImage: C:\\ludus\\background\\bginfo.exe\r\nTargetObject: HKU\\S-1-5-21-1006758700-2167138679-1475694448-1105\\Software\\Winternals\\BGInfo\\WindowPosition\r\nDetails: Binary Data\r\nUser: cell-c\\domainadmin"
}

Detection Patterns #

110 rules

Sigma

HybridConnectionManager Service Installation - Registry (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Windows Registry Trust Record Modification (source)

Antonlovesdnb, Trent Liffick (@tliffick)

Show 43 more (46 total) on the rules page

Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community

Elastic

SolarWinds Process Disabling Services via Registry (source)

Elastic

Persistence via WMI Standard Registry Provider (source)

Elastic

Show 44 more (47 total) on the rules page

Elastic

Splunk

LSA Authentication Packages Registry Key Modified (Sysmon) (source)

Startup Folder Location Modified - Windows (Sysmon) (source)

Detect Print Processors Registry Driver Key Creation/Modification (source)

Kusto

Detect Registry Run Key Creation/Modification (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Pete Bryan

Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEvent

90 rules

Sigma

Registry Persistence Mechanisms in Recycle Bin (source)

Dmitriy Lifanov, oscd.community

frack113

Show 27 more (30 total) on the rules page

omkar72

Elastic

Suspicious Startup Shell Folder Modification (source)

Elastic

Elastic

Show 38 more (41 total) on the rules page

Elastic

Splunk

Windows WPDBusEnum Registry Key Modification (source)

Steven Dick

Steven Dick

LSA Authentication Packages Registry Key Modified (Sysmon) (source)

Detect Print Processors Registry Driver Key Creation/Modification (source)

Kusto

Detect Registry Run Key Creation/Modification (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Pete Bryan

74 rules

Sigma

Registry Persistence Mechanisms in Recycle Bin (source)

Dmitriy Lifanov, oscd.community

frack113

Show 19 more (22 total) on the rules page

omkar72

Elastic

Suspicious Startup Shell Folder Modification (source)

Elastic

Elastic

Show 36 more (39 total) on the rules page

Elastic

Splunk

LSA Authentication Packages Registry Key Modified (Sysmon) (source)

Startup Folder Location Modified - Windows (Sysmon) (source)

Detect Print Processors Registry Driver Key Creation/Modification (source)

Kusto

Detect Registry Run Key Creation/Modification (source)

Detect Windows Allow Firewall Rule Addition/Modification (source)

Sysmon Event ID 1: Process creationOREvent ID 12: RegistryEventOREvent ID 13: RegistryEvent

67 rules

Sigma

oscd.community, Dmitry Uchakin

Disable Security Events Logging Adding Reg Key MiniNt (source)

Christian Burkard (Nextron Systems)

Ilyas Ochkov, oscd.community

Elastic

Disabling User Account Control via Registry Modification (source)

Elastic

Elastic

Creation of a Hidden Local User Account (source)

Elastic

Splunk

ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon) (source)

EnableLUA Registry Value Modified (Sysmon) (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Kusto

Pete Bryan

Detect Registry Run Key Creation/Modification (source)

Sysmon Event ID 12: RegistryEventANDEvent ID 13: RegistryEventANDEvent ID 14: RegistryEvent

56 rules

Sigma

Disable Security Events Logging Adding Reg Key MiniNt (source)

Ilyas Ochkov, oscd.community

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Trent Liffick

Elastic

Elastic

Elastic

Elastic

Splunk

Michael Haag, Splunk

Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk

Steven Dick, Teoderick Contreras, Splunk

Detect Registry Run Key Creation/Modification (source)

Kusto

Show All Detection Patterns

(Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)→(Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)

54 rules

Sigma

Disable Security Events Logging Adding Reg Key MiniNt (source)

Ilyas Ochkov, oscd.community

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Trent Liffick

Suspicious Print Spooler Point and Print DLL (source)

Elastic

Elastic

Unusual Persistence via Services Registry (source)

Elastic

Potential Privilege Escalation via Service ImagePath Modification (source)

Elastic

Splunk

Michael Haag, Splunk

Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk

Steven Dick, Teoderick Contreras, Splunk

Detect Registry Run Key Creation/Modification (source)

Kusto

Defense Impairment: Modify Registry

Sysmon Event ID 13: RegistryEventOREvent ID 14: RegistryEvent

48 rules

Sigma

Disable Security Events Logging Adding Reg Key MiniNt (source)

Ilyas Ochkov, oscd.community

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Hieu Tran

Elastic

Elastic

Elastic

Show 31 more (34 total) on the rules page

Elastic

Splunk

Windows Modify Registry to Add or Modify Firewall Rule (source)

Raven Tait, Splunk

Teoderick Contreras, Splunk

Kusto

Detect Registry Run Key Creation/Modification (source)

Sysmon Event ID 1: Process creationOREvent ID 13: RegistryEvent

13 rules

Splunk

Command Line Utility Added to Accessibility Features (Sysmon) (source)

Wow6432Node Classes Autorun Keys Modification (Sysmon) (source)

Suspicious InprocServer32 Registry Modification (Sysmon) (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Kusto

Pete Bryan

Uac Bypass

12 rules

Sigma

oscd.community, Dmitry Uchakin

Christian Burkard (Nextron Systems)

Elastic

Disabling User Account Control via Registry Modification (source)

Elastic

Elastic

Splunk

ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon) (source)

EnableLUA Registry Value Modified (Sysmon) (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Kusto

Pete Bryan

9 rules

Sigma

Registry Tampering by Potentially Suspicious Processes (source)

Swachchhanda Shrawan Poudel (Nextron Systems)

RDP shadow session configuration enabled (registry) (source)

mdecrevoisier

Elastic

Windows Subsystem for Linux Distribution Installed (source)

Elastic

Elastic

Scheduled Task Created by a Windows Script (source)

Elastic

Command Line Utility Added to Accessibility Features (Sysmon) (source)

Splunk

Sysmon Event ID 3: Network connection→(Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)

9 rules

Sigma

Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community

RDP shadow session configuration enabled (registry) (source)

Center for Threat Informed Defense (CTID) Summiting the Pyramid Team

mdecrevoisier

Elastic

Elastic

Scheduled Task Created by a Windows Script (source)

Elastic

Elastic

Sysmon Event ID 12: RegistryEvent→Event ID 13: RegistryEvent→Event ID 14: RegistryEvent

Execution: PowerShell

8 rules

Sigma

Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community

Registry Tampering by Potentially Suspicious Processes (source)

Center for Threat Informed Defense (CTID) Summiting the Pyramid Team

Swachchhanda Shrawan Poudel (Nextron Systems)

Elastic

Elastic

Scheduled Task Created by a Windows Script (source)

Elastic

Elastic

Sysmon Event ID 1: Process creationANDEvent ID 13: RegistryEvent

5 rules

Splunk

Windows Process Executed From Removable Media (source)

Steven Dick

Windows Modify Registry Qakbot Binary Data Registry (source)

Teoderick Contreras, Bhavin Patel, Splunk

Defender Registry Values Modified (Sysmon) (source)

(Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

Stealth: Msiexec

4 rules

Sigma

CMSTP Execution Registry Event (source)

Nik Seetharaman

Atbroker Registry Change (source)

Mateusz Wydra, oscd.community

Elastic

Windows Installer with Suspicious Properties (source)

Elastic

Splunk

Sysmon Event ID 12: RegistryEventANDEvent ID 13: RegistryEventANDEvent ID 14: RegistryEvent

Michael Haag, Splunk

Registry Key Modification

3 rules

Elastic

First Time Seen Removable Device (source)

Elastic

Splunk

Windows WPDBusEnum Registry Key Modification (source)

Steven Dick

Steven Dick

Key Creation Modification

Security-Auditing Event ID 4657: A registry value was modified.ORSysmon Event ID 13: RegistryEvent

2 rules

Kusto

Detect Print Processors Registry Driver Key Creation/Modification (source)

Detect Registry Run Key Creation/Modification (source)

Command & Control: Proxy

2 rules

Sigma

New PortProxy Registry Entry Added (source)

Andreas Hunkeler (@Karneades)

Elastic

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Details`	contains	`powershell`	10 rules	chronicle, sigma
`Details`	contains	`\appdata\local\temp\`	7 rules	sigma
`Details`	contains	`%temp%`	5 rules	chronicle, sigma
`Details`	ends_with	`.dll`	8 rules	elastic, sigma, splunk
`Details`	eq	`0x00000001`	59 rules	elastic, splunk
`Details`	eq	`0x00000000`	40 rules	elastic, splunk
`Details`	eq	`dword (0x00000001)`	40 rules	chronicle, sigma
`Details`	eq	`dword (0x00000000)`	38 rules	chronicle, sigma
`Details`	eq	`1`	10 rules	elastic, kusto, splunk
`Details`	eq	`dword (0x00000002)`	10 rules	chronicle, sigma
`Details`	eq	`0`	8 rules	elastic, sigma
`Details`	is_not_null		54 rules	elastic, splunk
`event.type`	eq	`change`	44 rules	elastic
`EventType`	eq	`modified`	7 rules	splunk
`EventType`	eq	`setvalue`	6 rules	sigma

Detection Rules #

Sigma # view in coverage

Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback source medium: Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.T1685
Registry Persistence via Service in Safe Mode source high: Detects the modification of the registry to allow a driver or service to persist in Safe Mode.T1564, T1564.001
Add Port Monitor Persistence in Registry source medium: Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.T1547, T1547.010

Show 17 more (230 total) on the rules page

Splunk # view in coverage

Active Setup Registry Autostart source: The following analytic detects suspicious modifications to the Active Setup registry for persistence and privilege escalation. It leverages data from the Endpoint.Registry data model, focusing on changes to the "StubPath" value within the…T1547, T1547.014
Allow Inbound Traffic By Firewall Rule Registry source: The following analytic detects suspicious modifications to firewall rule registry settings that allow inbound traffic on specific ports with a public profile. It leverages data from the Endpoint.Registry data model, focusing on registry…T1021, T1021.001
Allow Operation with Consent Admin source: The following analytic detects a registry modification that allows the 'Consent Admin' to perform operations requiring elevation without user consent or credentials. It leverages data from the Endpoint.Registry data model, specifically…T1548

Show 17 more (167 total) on the rules page

Kusto # view in coverage

DSRM Account Abuse source high: This query detects an abuse of the DSRM account in order to maintain persistence and access to the organization's Active Directory. Ref: https://adsecurity.org/?p=1785T1098
Registry Persistence via AppCert DLL Modification source medium: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. Ref: https://attack.mitre.org/techniques/T1546/009/T1546, T1546.009
Registry Persistence via AppInit DLLs Modification source medium: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. Ref: https://attack.mitre.org/techniques/T1546/010/T1546, T1546.010

Show 12 more (15 total) on the rules page

YARA-L # view in coverage

Blackbyte Ransomware Registry source high: BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryptionT1112
CurrentControlSet Autorun Keys Modification source medium: Detects modification of autostart extensibility point (ASEP) in registryT1547, T1547.001
CurrentVersion Autorun Keys Modification source medium: Detects modification of autostart extensibility point (ASEP) in registryT1547, T1547.001

References #

Event ID 14: RegistryEvent (Key and Value Rename)

Channel: Operational
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: Registry object renamed (rule: RegistryEvent)
Opcode: Info

Description

**Registry key and value rename** operations map to this event type, recording the new name of the key or value that was renamed.

Message #

Registry object renamed:
RuleName: %1
EventType: %2
UtcTime: %3
ProcessGuid: %4
ProcessId: %5
Image: %6
TargetObject: %7
NewName: %8
User: %9

Fields #

Name	Description	Rules
`EventType` UnicodeString → string	Registry event. Registry key and value renamed Known values `RenameKey` An existing registry key was renamed (NewName carries the destination key path). `RenameValue` A registry value name was changed under an existing key.	4 detection rules
`UtcTime` UnicodeString → string	Time in UTC when event was created
`ProcessGuid` GUID → GUID	Process GUID of the process that renamed a registry value and key
`ProcessId` UInt32 → PID	Process ID used by the OS to identify the process that renamed a registry value and key
`Image` UnicodeString → string	File path of the process that renamed a registry value and key	35 detection rules
`TargetObject` UnicodeString → string	Complete path of the registry key	27 detection rules
`NewName` UnicodeString → string	New name of the registry key
`RuleName` UnicodeString → string	custom tag mapped to event. i.e ATT&CK technique ID
`User` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
    "event_source_name": "",
    "event_id": 14,
    "version": 2,
    "level": 4,
    "task": 14,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-05-29T23:53:07.2285127+00:00",
    "event_record_id": 160620,
    "correlation": {},
    "execution": {
      "process_id": 11572,
      "thread_id": 11700
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "EventType": "RenameKey",
    "UtcTime": "2026-05-29 23:53:07.227",
    "ProcessGuid": "{e124ce79-26e3-6a1a-dc11-000000000700}",
    "ProcessId": "11804",
    "Image": "C:\\caps\\dwrename.exe",
    "TargetObject": "HKU\\S-1-5-21-3798294047-1846905762-1150995898-1000\\Software\\dwtest_key",
    "NewName": "HKU\\S-1-5-21-3798294047-1846905762-1150995898-1000\\Software\\dwtest_key_renamed",
    "User": "DESKTOP-FF3N5XK\\localuser"
  },
  "message": "Registry object renamed:\r\nRuleName: -\r\nEventType: RenameKey\r\nUtcTime: 2026-05-29 23:53:07.227\r\nProcessGuid: {e124ce79-26e3-6a1a-dc11-000000000700}\r\nProcessId: 11804\r\nImage: C:\\caps\\dwrename.exe\r\nTargetObject: HKU\\S-1-5-21-3798294047-1846905762-1150995898-1000\\Software\\dwtest_key\r\nNewName: HKU\\S-1-5-21-3798294047-1846905762-1150995898-1000\\Software\\dwtest_key_renamed\r\nUser: DESKTOP-FF3N5XK\\localuser"
}

Detection Patterns #

Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent

96 rules

Sigma

HybridConnectionManager Service Installation - Registry (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Windows Registry Trust Record Modification (source)

Antonlovesdnb, Trent Liffick (@tliffick)

Show 41 more (44 total) on the rules page

Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community

Elastic

SolarWinds Process Disabling Services via Registry (source)

Elastic

Persistence via WMI Standard Registry Provider (source)

Elastic

Show 44 more (47 total) on the rules page

Elastic

Splunk

Windows Modify Registry to Add or Modify Firewall Rule (source)

Raven Tait, Splunk

Teoderick Contreras, Splunk

Kusto

Detect Print Processors Registry Driver Key Creation/Modification (source)

Detect Registry Run Key Creation/Modification (source)

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Pete Bryan

66 rules

Sigma

Registry Persistence Mechanisms in Recycle Bin (source)

Dmitriy Lifanov, oscd.community

frack113

Show 18 more (21 total) on the rules page

omkar72

Elastic

Suspicious Startup Shell Folder Modification (source)

Elastic

Elastic

Show 36 more (39 total) on the rules page

Elastic

Splunk

Windows Modify Registry to Add or Modify Firewall Rule (source)

Raven Tait, Splunk

Teoderick Contreras, Splunk

Kusto

Detect Print Processors Registry Driver Key Creation/Modification (source)

Detect Registry Run Key Creation/Modification (source)

Detect Windows Allow Firewall Rule Addition/Modification (source)

Sysmon Event ID 12: RegistryEventANDEvent ID 13: RegistryEventANDEvent ID 14: RegistryEvent

51 rules

Sigma

Disable Security Events Logging Adding Reg Key MiniNt (source)

Ilyas Ochkov, oscd.community

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Hieu Tran

Elastic

Elastic

Elastic

Elastic

Splunk

Windows Modify Registry to Add or Modify Firewall Rule (source)

Raven Tait, Splunk

Teoderick Contreras, Splunk

Kusto

Detect Registry Run Key Creation/Modification (source)

(Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)→(Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)

49 rules

Sigma

Disable Security Events Logging Adding Reg Key MiniNt (source)

Ilyas Ochkov, oscd.community

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Hieu Tran

Suspicious Print Spooler Point and Print DLL (source)

Elastic

Elastic

Unusual Persistence via Services Registry (source)

Elastic

Potential Privilege Escalation via Service ImagePath Modification (source)

Elastic

Splunk

Windows Modify Registry to Add or Modify Firewall Rule (source)

Raven Tait, Splunk

Teoderick Contreras, Splunk

Kusto

Detect Registry Run Key Creation/Modification (source)

Defense Impairment: Modify Registry

Sysmon Event ID 13: RegistryEventOREvent ID 14: RegistryEvent

48 rules

Sigma

Disable Security Events Logging Adding Reg Key MiniNt (source)

Ilyas Ochkov, oscd.community

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Hieu Tran

Elastic

Elastic

Elastic

Show 31 more (34 total) on the rules page

Elastic

Splunk

Windows Modify Registry to Add or Modify Firewall Rule (source)

Raven Tait, Splunk

Teoderick Contreras, Splunk

Kusto

Detect Registry Run Key Creation/Modification (source)

Show All Detection Patterns

Sysmon Event ID 3: Network connection→(Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)

9 rules

Sigma

Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community

RDP shadow session configuration enabled (registry) (source)

Center for Threat Informed Defense (CTID) Summiting the Pyramid Team

mdecrevoisier

Elastic

Elastic

Scheduled Task Created by a Windows Script (source)

Elastic

Elastic

Sysmon Event ID 12: RegistryEvent→Event ID 13: RegistryEvent→Event ID 14: RegistryEvent

Execution: PowerShell

8 rules

Sigma

Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community

Registry Tampering by Potentially Suspicious Processes (source)

Center for Threat Informed Defense (CTID) Summiting the Pyramid Team

Swachchhanda Shrawan Poudel (Nextron Systems)

Elastic

Elastic

Scheduled Task Created by a Windows Script (source)

Elastic

Elastic

Registry Tampering by Potentially Suspicious Processes (source)

8 rules

Sigma

Swachchhanda Shrawan Poudel (Nextron Systems)

RDP shadow session configuration enabled (registry) (source)

mdecrevoisier

Elastic

Windows Subsystem for Linux Distribution Installed (source)

Elastic

Elastic

Scheduled Task Created by a Windows Script (source)

Elastic

Privilege Escalation: Bypass User Account Control

5 rules

Sigma

oscd.community, Dmitry Uchakin

Christian Burkard (Nextron Systems)

Elastic

Disabling User Account Control via Registry Modification (source)

Elastic

Elastic

Kusto

Potential Fodhelper UAC Bypass (ASIM Version) (source)

Pete Bryan

Stealth: Msiexec

(Sysmon Event ID 12: RegistryEventOREvent ID 13: RegistryEventOREvent ID 14: RegistryEvent)→(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)

3 rules

Sigma

CMSTP Execution Registry Event (source)

Nik Seetharaman

Atbroker Registry Change (source)

Mateusz Wydra, oscd.community

Elastic

Windows Installer with Suspicious Properties (source)

Elastic

Sysmon Event ID 12: RegistryEventANDEvent ID 13: RegistryEventANDEvent ID 14: RegistryEvent

1 rule

Elastic

First Time Seen Removable Device (source)

Elastic

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`event.type`	eq	`change`	44 rules	elastic
`Details`	ends_with	`.dll`	3 rules	elastic
`Details`	eq	`1`	8 rules	elastic, kusto
`Details`	eq	`0`	7 rules	elastic
`Details`	eq	`0x00000000`	7 rules	elastic
`Details`	eq	`0x00000001`	7 rules	elastic
`Details`	is_not_null		9 rules	elastic
`Details`	length_compare	`0`	4 rules	elastic
`Details`	length_compare	`>`	4 rules	elastic
`EventType`	eq	`deletevalue`	4 rules	sigma
`EventType`	eq	`setvalue`	4 rules	sigma
`Image`	is_not_null		3 rules	elastic
`TargetObject`	contains	`\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\`	3 rules	sigma
`TargetObject`	wildcard	`hkey_users\\software\microsoft\windows\currentversion\policies\explorer\run\`	3 rules	elastic
`TargetObject`	wildcard	`hklm\software\microsoft\windows\currentversion\policies\explorer\run\*`	3 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Delete Defender Scan ShellEx Context Menu Registry Key source medium: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.
Windows Credential Guard Related Registry Value Deleted - Registry source high: Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.T1685
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted source medium: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.T1113

Sysmon Event ID 11: FileCreateOREvent ID 15: FileCreateStreamHash

References #

Event ID 15: FileCreateStreamHash

Channel: Operational
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: File stream created (rule: FileCreateStreamHash)
Opcode: Info

Description

This event logs when a **named file stream is created**, and it generates events that log the hash of the contents of the file to which the stream is assigned (the unnamed stream), as well as the contents of the named stream. There are malware variants that drop their executables or configuration settings via browser downloads, and this event is aimed at capturing that based on the browser attaching a Zone.Identifier "mark of the web" stream.

Message #

File stream created:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
TargetFilename: %6
CreationUtcTime: %7
Hash: %8
Contents: %9
User: %10

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that created the named file stream
`ProcessId` UInt32	Process ID used by the OS to identify the process that created the named file stream
`Image` UnicodeString	File path of the process that created the named file stream	24 detection rules
`TargetFilename` UnicodeString	Name of the file	76 detection rules
`CreationUtcTime` UnicodeString	File download time
`Hash` UnicodeString	Hash of the file contents using the algorithms specified in the HashType field	104 detection rules
`Contents` UnicodeString	Content of the named file stream (e.g., Zone.Identifier)	86 detection rules
`User` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 15,
    "version": 2,
    "level": 4,
    "task": 15,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T13:42:03.6658910+00:00",
    "event_record_id": 6137955,
    "correlation": {},
    "execution": {
      "process_id": 3872,
      "thread_id": 5252
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 13:42:03.651",
    "ProcessGuid": "{8a99384c-5e0b-6a2d-4c00-000000000a00}",
    "ProcessId": "3488",
    "Image": "C:\\Windows\\system32\\DFSRs.exe",
    "TargetFilename": "C:\\Windows\\SYSVOL\\staging\\domain\\ContentSet{F961A193-E171-4E37-B0B3-7E1394CCD8E0}-{02199C3B-68C2-47D3-88A0-F16A83088C75}:ReplicatedFolderList",
    "CreationUtcTime": "2026-05-28 00:46:59.105",
    "Hash": "SHA1=13D7A18758C123CD4479C81E4B2D70301C31F7C3,MD5=2CB80232D48F726137F136C129FB2D2D,SHA256=F0336167989447F25357C51FEF44D321E40A6310DD8DD2FEFF37B8E55E4543A0,IMPHASH=00000000000000000000000000000000",
    "Contents": "{",
    "User": "F"
  },
  "message": "File stream created:\r\nRuleName: -\r\nUtcTime: 2026-06-13 13:42:03.651\r\nProcessGuid: {8a99384c-5e0b-6a2d-4c00-000000000a00}\r\nProcessId: 3488\r\nImage: C:\\Windows\\system32\\DFSRs.exe\r\nTargetFilename: C:\\Windows\\SYSVOL\\staging\\domain\\ContentSet{F961A193-E171-4E37-B0B3-7E1394CCD8E0}-{02199C3B-68C2-47D3-88A0-F16A83088C75}:ReplicatedFolderList\r\nCreationUtcTime: 2026-05-28 00:46:59.105\r\nHash: SHA1=13D7A18758C123CD4479C81E4B2D70301C31F7C3,MD5=2CB80232D48F726137F136C129FB2D2D,SHA256=F0336167989447F25357C51FEF44D321E40A6310DD8DD2FEFF37B8E55E4543A0,IMPHASH=00000000000000000000000000000000\r\nContents: {\r\nUser: F"
}

Detection Patterns #

1 rule

Splunk

Windows MsMpEng Writing to System32 (source)

Raven Tait, Splunk

Command & Control: Web Protocols

Sysmon Event ID 3: Network connectionOREvent ID 15: FileCreateStreamHash

1 rule

Splunk

Unusual HTTP Download (Sysmon) (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`TargetFilename`	contains	`.bat:zone`	3 rules	sigma
`TargetFilename`	contains	`.dll:zone`	3 rules	sigma
`TargetFilename`	contains	`.exe:zone`	3 rules	sigma
`TargetFilename`	contains	`.hta:zone`	3 rules	sigma
`TargetFilename`	contains	`.ps1:zone`	3 rules	sigma
`TargetFilename`	contains	`.vbe:zone`	3 rules	sigma
`TargetFilename`	contains	`.vbs:zone`	3 rules	sigma
`TargetFilename`	contains	`.xll:zone`	3 rules	sigma
`TargetFilename`	ends_with	`:zone.identifier`	3 rules	sigma, splunk
`Contents`	contains	`.githubusercontent.com`	2 rules	sigma
`Contents`	contains	`0x0.st`	2 rules	sigma
`Contents`	contains	`anonfiles.com`	2 rules	sigma
`Contents`	contains	`bashupload.com`	2 rules	sigma
`Contents`	contains	`cdn.discordapp.com`	2 rules	sigma
`Contents`	contains	`chunk.io`	2 rules	sigma

Community Notes #

May contain Mark of the Web, referrer, and host URL data.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Hidden Executable In NTFS Alternate Data Stream source medium: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty ImphashT1564, T1564.004
Creation Of a Suspicious ADS File Outside a Browser Download source medium: Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers
Suspicious File Download From File Sharing Websites - File Stream source high: Detects the download of suspicious file type from a well-known file and paste sharing domainT1564, T1564.004

Splunk # view in coverage

Download Files Using Telegram source: The following analytic detects suspicious file downloads by the Telegram application on a Windows system. It leverages Sysmon EventCode 15 to identify instances where Telegram.exe creates files with a Zone.Identifier, indicating a…T1105
Windows Alternate DataStream - Base64 Content source: The following analytic detects the creation of Alternate Data Streams (ADS) with Base64 content on Windows systems. It leverages Sysmon EventID 15, which captures file creation events, including the content of named streams. ADS can…T1564, T1564.004
Windows Alternate DataStream - Executable Content source: The following analytic detects the writing of data with an IMPHASH value to an Alternate Data Stream (ADS) in the NTFS file system. It leverages Sysmon Event ID 15 and regex to identify files with a Portable Executable (PE) structure. This…T1564, T1564.004

Sysmon Event ID 4: Sysmon service state changedOREvent ID 16: ServiceConfigurationChange

References #

Event ID 16: ServiceConfigurationChange

Channel: Operational
Level: Informational
Collection Priority: Recommended (Olaf Hartong, others)
Task: Sysmon config state changed
Opcode: Info

Description

This event logs changes in the Sysmon configuration.

Message #

Sysmon config state changed:
UtcTime: %1
Configuration: %2
ConfigurationFileHash: %3

Fields #

Name	Description
`UtcTime` UnicodeString → string	Time in UTC when event was created
`Configuration` UnicodeString → string	Name of the Sysmon config file being updated
`ConfigurationFileHash` UnicodeString → string	Hash (SHA1) of the Sysmon config file being updated

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9",
    "event_source_name": "",
    "event_id": 16,
    "version": 3,
    "level": 4,
    "task": 16,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T00:47:11.932399+00:00",
    "event_record_id": 994662,
    "correlation": {},
    "execution": {
      "process_id": 8688,
      "thread_id": 13092
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "UtcTime": "2023-11-06 00:47:11.921",
    "Configuration": "C:\\Users\\User\\Downloads\\Sysmon\\sysmonconfig-trace.xml",
    "ConfigurationFileHash": "SHA256=43F367924B48AF65F121C0D369E7971C0757CC35D984C71887A5840987E154F9"
  },
  "message": ""
}

Detection Patterns #

Stealth: Hide Artifacts

1 rule

Sigma

Sysmon Configuration Modification (source)

frack113

Community Notes #

May indicate an attacker attempting to reduce visibility prior to staging a payload.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Sysmon Configuration Change source medium: Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration

References #

Microsoft Learn
Example event sourced from https://github.com/NextronSystems/evtx-baseline
OSSEM-DD

Event ID 17: PipeEvent (Pipe Created)

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: Pipe Created (rule: PipeEvent)
Opcode: Info

Description

This event generates when a **named pipe is created**. Malware often uses named pipes for interprocess communication.

Message #

Pipe Created:
RuleName: %1
EventType: %2
UtcTime: %3
ProcessGuid: %4
ProcessId: %5
PipeName: %6
Image: %7
User: %8

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`EventType` UnicodeString	The type of pipe event (CreatePipe)	8 detection rules
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that created the pipe
`ProcessId` UInt32	Process ID used by the OS to identify the process that created the pipe
`PipeName` UnicodeString	Name of the pipe created	104 detection rules
`Image` UnicodeString	File path of the process that created the pipe	60 detection rules
`User` UnicodeString	The name of the account that created the named pipe.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 17,
    "version": 1,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:08:49.4169649+00:00",
    "event_record_id": 17610185,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "EventType": "CreatePipe",
    "UtcTime": "2026-06-13 14:08:49.413",
    "ProcessGuid": "{8a99384c-6471-6a2d-a005-000000001000}",
    "ProcessId": "7864",
    "PipeName": "\\PSHost.134258333292497101.7864.DefaultAppDomain.wsmprovhost",
    "Image": "C:\\Windows\\system32\\wsmprovhost.exe",
    "User": "cell-c\\domainadmin"
  },
  "message": "Pipe Created:\r\nRuleName: -\r\nEventType: CreatePipe\r\nUtcTime: 2026-06-13 14:08:49.413\r\nProcessGuid: {8a99384c-6471-6a2d-a005-000000001000}\r\nProcessId: 7864\r\nPipeName: \\PSHost.134258333292497101.7864.DefaultAppDomain.wsmprovhost\r\nImage: C:\\Windows\\system32\\wsmprovhost.exe\r\nUser: cell-c\\domainadmin"
}

Detection Patterns #

Named Pipe

Sysmon Event ID 17: PipeEventOREvent ID 18: PipeEvent

30 rules

Sigma

WMI Event Consumer Created Named Pipe (source)

Florian Roth (Nextron Systems)

Alternate PowerShell Hosts Pipe (source)

Roberto Rodriguez @Cyb3rWard0g, Tim Shelton

New PowerShell Instance Created (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Show 16 more (19 total) on the rules page

Splunk

Windows Anonymous Pipe Activity (source)

Teoderick Contreras, Splunk

Raven Tait, Splunk

Raven Tait, Splunk

Kusto

Security-Auditing Event ID 5145: A network share object was checked to see whether client can be granted desired access.ORSysmon Event ID 17: PipeEventOREvent ID 18: PipeEvent

Microsoft Security Research

Named Pipe

14 rules

Sigma

CobaltStrike Named Pipe (source)

Florian Roth (Nextron Systems), Wojciech Lesicki

CobaltStrike Named Pipe Pattern Regex (source)

Florian Roth (Nextron Systems)

CobaltStrike Named Pipe Patterns (source)

Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

Trickbot Named Pipe (source)

Splunk

Teoderick Contreras, Splunk

Raven Tait, Splunk

Raven Tait, Splunk

Kusto

Full rule details for this event, including ATT&CK technique mappings and native queries →

Microsoft Security Research

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType`	in	`connectpipe`	4 rules	splunk
`EventType`	in	`createpipe`	4 rules	splunk
`tool`	is_not_null		4 rules	splunk
`PipeName`	eq	`\psexesvc`	2 rules	sigma
`PipeName`	eq	`\sdlrpc`	2 rules	sigma
`PipeName`	starts_with	`\PSHost`	2 rules	sigma
`AccessList`	contains	`%%4418`	1 rule	kusto
`Hashes`	is_not_null		1 rule	chronicle
`Image`	contains	`:\users\public\`	1 rule	sigma
`Image`	contains	`:\windows\temp\`	1 rule	sigma
`Image`	contains	`\appdata\local\temp\`	1 rule	sigma
`Image`	contains	`\desktop\`	1 rule	sigma
`Image`	contains	`\downloads\`	1 rule	sigma
`Image`	ends_with	`\scrcons.exe`	1 rule	sigma
`Provider_Name`	eq	`Microsoft-Windows-Sysmon`	1 rule	elastic

Detection Rules #

Sigma # view in coverage

HackTool - DiagTrackEoP Default Named Pipe source critical: Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.↳ also matches Event ID 18: PipeEvent (Pipe Connected)

Elastic # view in coverage

Privilege Escalation via Rogue Named Pipe Impersonation source high: Identifies a privilege escalation attempt via rogue named pipe impersonation. An adversary may abuse this technique by masquerading as a known named pipe and manipulating a privileged process to connect to it.T1134, T1134.001

YARA-L # view in coverage

ADFS DB Suspicious Named Pipe Connection source medium: Connection to ADFS via named pipes that are not using specific Windows ADFS processes may be indicative of user attempting to access ADFS for suspicious purposes↳ also matches Event ID 18: PipeEvent (Pipe Connected)
GCTI Remote Access Tools source high: Alert process and file create events that are associated with hashes from the GCTI Remote Access Tool listT1219↳ also matches Event ID 1: Process creation, Event ID 7: Image loaded, Event ID 11: FileCreate, Event ID 18: PipeEvent (Pipe Connected)

References #

Event ID 18: PipeEvent (Pipe Connected)

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: Pipe Connected (rule: PipeEvent)
Opcode: Info

Description

This event logs when a named pipe connection is made between a client and a server.

Message #

Pipe Connected:
RuleName: %1
EventType: %2
UtcTime: %3
ProcessGuid: %4
ProcessId: %5
PipeName: %6
Image: %7
User: %8

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`EventType` UnicodeString	The type of pipe event (ConnectPipe)
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that connected the pipe
`ProcessId` UInt32	Process ID used by the OS to identify the process that connected the pipe
`PipeName` UnicodeString	Name of the pipe connected	1 detection rule
`Image` UnicodeString	File path of the process that connected the pipe
`User` UnicodeString	The name of the account that made a named pipe connection.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 18,
    "version": 1,
    "level": 4,
    "task": 18,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:09:29.4179487+00:00",
    "event_record_id": 17612764,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "EventType": "ConnectPipe",
    "UtcTime": "2026-06-13 14:09:29.413",
    "ProcessGuid": "{8a99384c-6499-6a2d-a205-000000001000}",
    "ProcessId": "7704",
    "PipeName": "\\srvsvc",
    "Image": "C:\\ludus\\background\\bginfo.exe",
    "User": "cell-c\\domainadmin"
  },
  "message": "Pipe Connected:\r\nRuleName: -\r\nEventType: ConnectPipe\r\nUtcTime: 2026-06-13 14:09:29.413\r\nProcessGuid: {8a99384c-6499-6a2d-a205-000000001000}\r\nProcessId: 7704\r\nPipeName: \\srvsvc\r\nImage: C:\\ludus\\background\\bginfo.exe\r\nUser: cell-c\\domainadmin"
}

Detection Patterns #

Named Pipe

Sysmon Event ID 17: PipeEventOREvent ID 18: PipeEvent

30 rules

Sigma

WMI Event Consumer Created Named Pipe (source)

Florian Roth (Nextron Systems)

Alternate PowerShell Hosts Pipe (source)

Roberto Rodriguez @Cyb3rWard0g, Tim Shelton

New PowerShell Instance Created (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Show 16 more (19 total) on the rules page

Splunk

Windows Anonymous Pipe Activity (source)

Teoderick Contreras, Splunk

Raven Tait, Splunk

Raven Tait, Splunk

Kusto

Security-Auditing Event ID 5145: A network share object was checked to see whether client can be granted desired access.ORSysmon Event ID 17: PipeEventOREvent ID 18: PipeEvent

Microsoft Security Research

Named Pipe

14 rules

Sigma

CobaltStrike Named Pipe (source)

Florian Roth (Nextron Systems), Wojciech Lesicki

CobaltStrike Named Pipe Pattern Regex (source)

Florian Roth (Nextron Systems)

CobaltStrike Named Pipe Patterns (source)

Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

Trickbot Named Pipe (source)

Splunk

Teoderick Contreras, Splunk

Raven Tait, Splunk

Raven Tait, Splunk

Kusto

Sysmon Event ID 3: Network connectionANDEvent ID 18: PipeEvent

Microsoft Security Research

Collection: Data from Local System

1 rule

Kusto

AD FS Remote HTTP Network Connection (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType`	in	`connectpipe`	4 rules	splunk
`EventType`	in	`createpipe`	4 rules	splunk
`tool`	is_not_null		4 rules	splunk
`Computer`	eq	`adfs_servers`	2 rules	kusto
`PipeName`	eq	`\psexesvc`	2 rules	sigma
`PipeName`	eq	`\sdlrpc`	2 rules	sigma
`PipeName`	starts_with	`\PSHost`	2 rules	sigma
`AccessList`	contains	`%%4418`	1 rule	kusto
`DestinationPort`	eq	`80`	1 rule	kusto
`Image`	contains	`:\users\public\`	1 rule	sigma
`Image`	contains	`:\windows\temp\`	1 rule	sigma
`Image`	contains	`\appdata\local\temp\`	1 rule	sigma
`Image`	contains	`\desktop\`	1 rule	sigma
`Image`	contains	`\downloads\`	1 rule	sigma
`Image`	ends_with	`\scrcons.exe`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

HackTool - DiagTrackEoP Default Named Pipe source critical: Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.↳ also matches Event ID 17: PipeEvent (Pipe Created)

Kusto # view in coverage

ADFS Database Named Pipe Connection source medium: This detection uses Sysmon telemetry to detect suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). In order to use this query you need to be collecting Sysmon EventIdD 18 (Pipe Connected). If you do not have Sysmon data in your workspace this query will raise an error stating: Failed to resolve scalar expression named "[@Name]"T1005

YARA-L # view in coverage

ADFS DB Suspicious Named Pipe Connection source medium: Connection to ADFS via named pipes that are not using specific Windows ADFS processes may be indicative of user attempting to access ADFS for suspicious purposes↳ also matches Event ID 17: PipeEvent (Pipe Created)
GCTI Remote Access Tools source high: Alert process and file create events that are associated with hashes from the GCTI Remote Access Tool listT1219↳ also matches Event ID 1: Process creation, Event ID 7: Image loaded, Event ID 11: FileCreate, Event ID 17: PipeEvent (Pipe Created)

References #

Event ID 19: WmiEvent (WmiEventFilter activity detected)

Channel: Operational
Level: Informational
Collection Priority: Recommended (Olaf Hartong, others)
Task: WmiEventFilter activity detected (rule: WmiEvent)
Opcode: Info

Description

When a WMI event filter is registered, this event logs the WMI namespace, filter name and filter expression.

Message #

WmiEventFilter activity detected:
RuleName: %1
EventType: %2
UtcTime: %3
Operation: %4
User: %5
EventNamespace: %6
Name: %7
Query: %8

Fields #

Name	Description
`RuleName` UnicodeString → string	Custom tag mapped to event, i.e. ATT&CK technique ID
`EventType` UnicodeString → string	WMI event type
`UtcTime` UnicodeString → string	Time in UTC when event was created
`Operation` UnicodeString → string	WMI event filter operation Known values `Created` A WMI persistence artifact was registered (filter, consumer, or binding established). `Deleted` An existing WMI persistence artifact was removed. `Modified` An existing WMI persistence artifact was updated in place (rare).
`User` UnicodeString → string	User that created the WMI filter
`EventNamespace` UnicodeString → string	Event namespace where the WMI class is registered
`Name` UnicodeString → string	WMI filter name being created
`Query` UnicodeString → string	WMI filter query

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9",
    "event_source_name": "",
    "event_id": 19,
    "version": 3,
    "level": 4,
    "task": 19,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2019-07-19T14:54:57.044623Z",
    "event_record_id": 4055,
    "correlation": {},
    "execution": {
      "process_id": 2796,
      "thread_id": 1776
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "",
    "EventType": "WmiFilterEvent",
    "UtcTime": "2019-07-19 14:54:57.041",
    "Operation": "Created",
    "User": "MSEDGEWIN10\\IEUser",
    "EventNamespace": " \"root\\\\CimV2\"",
    "Name": " \"AtomicRedTeam-WMIPersistence-Example\"",
    "Query": " \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325\""
  }
}

Detection Patterns #

WMI Consumer

Sysmon Event ID 19: WmiEventOREvent ID 20: WmiEventOREvent ID 21: WmiEvent

4 rules

Sigma

Suspicious Encoded Scripts in a WMI Consumer (source)

Florian Roth (Nextron Systems)

Suspicious Scripting in a WMI Consumer (source)

Florian Roth (Nextron Systems), Jonhnathan Ribeiro

WMI Event Subscription (source)

Tom Ueltschi (@c_APT_ure)

Gain Code Execution on ADFS Server via Remote WMI Execution (source)

Lateral Movement: Exploitation of Remote Services

1 rule

Kusto

Microsoft Security Research

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`CommandLine`	contains	`rundll32`	1 rule	kusto
`Computer`	eq	`adfs_servers`	1 rule	kusto

References #

Microsoft Learn
Example event sourced from https://github.com/NextronSystems/evtx-baseline
OSSEM-DD

Event ID 20: WmiEvent (WmiEventConsumer activity detected)

Channel: Operational
Level: Informational
Collection Priority: Recommended (Olaf Hartong, others)
Task: WmiEventConsumer activity detected (rule: WmiEvent)
Opcode: Info

Description

This event logs the **registration of WMI consumers**, recording the consumer name, log, and destination.

Message #

WmiEventConsumer activity detected:
RuleName: %1
EventType: %2
UtcTime: %3
Operation: %4
User: %5
Name: %6
Type: %7
Destination: %8

Fields #

Name	Description
`RuleName` UnicodeString → string	Custom tag mapped to event, i.e. ATT&CK technique ID
`EventType` UnicodeString → string	WMI event type
`UtcTime` UnicodeString → string	Time in UTC when event was created
`Operation` UnicodeString → string	WMI consumer operation (e.g., Created, Deleted) Known values `Created` A WMI persistence artifact was registered (filter, consumer, or binding established). `Deleted` An existing WMI persistence artifact was removed. `Modified` An existing WMI persistence artifact was updated in place (rare).
`User` UnicodeString → string	User that created the WMI consumer
`Name` UnicodeString → string	Name of the consumer created
`Type` UnicodeString → string	Type of WMI consumer
`Destination` UnicodeString → string	Destination or command executed by the WMI consumer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9",
    "event_source_name": "",
    "event_id": 20,
    "version": 3,
    "level": 4,
    "task": 20,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2019-07-19T14:54:58.819106Z",
    "event_record_id": 4056,
    "correlation": {},
    "execution": {
      "process_id": 2796,
      "thread_id": 1776
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "",
    "EventType": "WmiConsumerEvent",
    "UtcTime": "2019-07-19 14:54:58.807",
    "Operation": "Created",
    "User": "MSEDGEWIN10\\IEUser",
    "Name": " \"AtomicRedTeam-WMIPersistence-Example\"",
    "Type": "Command Line",
    "Destination": " \"C:\\\\Windows\\\\System32\\\\notepad.exe\""
  }
}

Detection Patterns #

WMI Consumer

Sysmon Event ID 19: WmiEventOREvent ID 20: WmiEventOREvent ID 21: WmiEvent

4 rules

Sigma

Suspicious Encoded Scripts in a WMI Consumer (source)

Florian Roth (Nextron Systems)

Suspicious Scripting in a WMI Consumer (source)

Florian Roth (Nextron Systems), Jonhnathan Ribeiro

WMI Event Subscription (source)

Tom Ueltschi (@c_APT_ure)

Gain Code Execution on ADFS Server via Remote WMI Execution (source)

Lateral Movement: Exploitation of Remote Services

1 rule

Kusto

Microsoft Security Research

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`CommandLine`	contains	`rundll32`	1 rule	kusto
`Computer`	eq	`adfs_servers`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk # view in coverage

Detect WMI Event Subscription Persistence source: The following analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It detects EventID 19 (EventFilter creation), EventID 20 (EventConsumer creation), and…T1546, T1546.003

References #

Microsoft Learn
Example event sourced from https://github.com/NextronSystems/evtx-baseline
OSSEM-DD

Event ID 21: WmiEvent (WmiEventConsumerToFilter activity detected)

Channel: Operational
Level: Informational
Collection Priority: Recommended (Olaf Hartong, others)
Task: WmiEventConsumerToFilter activity detected (rule: WmiEvent)
Opcode: Info

Description

When a consumer binds to a filter, this event logs the consumer name and filter path.

Message #

WmiEventConsumerToFilter activity detected:
RuleName: %1
EventType: %2
UtcTime: %3
Operation: %4
User: %5
Consumer: %6
Filter: %7

Fields #

Name	Description
`RuleName` UnicodeString → string	Custom tag mapped to event, i.e. ATT&CK technique ID
`EventType` UnicodeString → string	WMI event type
`UtcTime` UnicodeString → string	Time in UTC when event was created
`Operation` UnicodeString → string	WMI consumer-to-filter binding operation Known values `Created` A WMI persistence artifact was registered (filter, consumer, or binding established). `Deleted` An existing WMI persistence artifact was removed. `Modified` An existing WMI persistence artifact was updated in place (rare).
`User` UnicodeString → string	User that created the WMI consumer-to-filter binding
`Consumer` UnicodeString → string	Consumer created to bind
`Filter` UnicodeString → string	Filter created to bind

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9",
    "event_source_name": "",
    "event_id": 21,
    "version": 3,
    "level": 4,
    "task": 21,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2019-07-19T14:57:02.378480Z",
    "event_record_id": 4057,
    "correlation": {},
    "execution": {
      "process_id": 2796,
      "thread_id": 4356
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "",
    "EventType": "WmiBindingEvent",
    "UtcTime": "2019-07-19 14:57:02.369",
    "Operation": "Created",
    "User": "MSEDGEWIN10\\IEUser",
    "Consumer": " \"\\\\\\\\.\\\\ROOT\\\\subscription:CommandLineEventConsumer.Name=\\\"AtomicRedTeam-WMIPersistence-Example\\\"\"",
    "Filter": " \"\\\\\\\\.\\\\ROOT\\\\subscription:__EventFilter.Name=\\\"AtomicRedTeam-WMIPersistence-Example\\\"\""
  }
}

Detection Patterns #

WMI Consumer

Sysmon Event ID 19: WmiEventOREvent ID 20: WmiEventOREvent ID 21: WmiEvent

4 rules

Sigma

Suspicious Encoded Scripts in a WMI Consumer (source)

Florian Roth (Nextron Systems)

Suspicious Scripting in a WMI Consumer (source)

Florian Roth (Nextron Systems), Jonhnathan Ribeiro

WMI Event Subscription (source)

Tom Ueltschi (@c_APT_ure)

Gain Code Execution on ADFS Server via Remote WMI Execution (source)

Lateral Movement: Exploitation of Remote Services

1 rule

Kusto

Microsoft Security Research

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`CommandLine`	contains	`rundll32`	1 rule	kusto
`Computer`	eq	`adfs_servers`	1 rule	kusto
`data_stream.dataset`	eq	`windows.sysmon_operational`	1 rule	elastic

Community Notes #

May surface registration of WMI event-based auto-runs that survive reboots.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic # view in coverage

Suspicious WMI Event Subscription Created source medium: Detects the creation of a WMI Event Subscription. Attackers can abuse this mechanism for persistence or to elevate to SYSTEM privileges.T1546, T1546.003

Splunk # view in coverage

WMI Permanent Event Subscription - Sysmon source: The following analytic identifies the creation of WMI permanent event subscriptions, which can be used to establish persistence or perform privilege escalation. It leverages Sysmon data, specifically EventCodes 19, 20, and 21, to detect…T1546, T1546.003

References #

Microsoft Learn
Example event sourced from https://github.com/NextronSystems/evtx-baseline
OSSEM-DD

Event ID 22: DNSEvent (DNS query)

Channel: Operational
Level: Informational
Collection Priority: Recommended (JSCU-NL)
Task: Dns query (rule: DnsQuery)
Opcode: Info

Description

This event generates when a process executes a **DNS query**, whether the result is successful or fails, cached or not.

Message #

Dns query:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
QueryName: %5
QueryStatus: %6
QueryResults: %7
Image: %8
User: %9

Fields #

Name	Description	Rules
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that executed the DNS query
`ProcessId` UInt32	Process ID of the process that executed the DNS query
`QueryName` UnicodeString	DNS query name	342 detection rules
`QueryStatus` UnicodeString	DNS query status Known values `0` Success (records returned or no error) `5` ERROR_ACCESS_DENIED `87` ERROR_INVALID_PARAMETER `1460` ERROR_TIMEOUT `9001` DNS_ERROR_RCODE_FORMAT_ERROR (FORMERR) `9002` DNS_ERROR_RCODE_SERVER_FAILURE (SERVFAIL) `9003` DNS_ERROR_RCODE_NAME_ERROR (NXDOMAIN) `9004` DNS_ERROR_RCODE_NOT_IMPLEMENTED (NOTIMP) `9005` DNS_ERROR_RCODE_REFUSED `9501` DNS_INFO_NO_RECORDS (no error, zero records) `9701` DNS_ERROR_RECORD_DOES_NOT_EXIST (specific record not found) `9702` DNS_ERROR_RECORD_FORMAT (record format error) `9714` DNS_ERROR_NAME_DOES_NOT_EXIST (name itself does not exist) `9852` DNS_ERROR_NO_DNS_SERVERS (no configured resolvers)
`QueryResults` UnicodeString	DNS query results
`Image` UnicodeString	The full path related to the process that executed the DNS query	226 detection rules
`User` UnicodeString	The name of the account that executes a DNS Query.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 22,
    "version": 5,
    "level": 4,
    "task": 22,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:09:53.5641227+00:00",
    "event_record_id": 6320060,
    "correlation": {},
    "execution": {
      "process_id": 3872,
      "thread_id": 5372
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 14:09:52.247",
    "ProcessGuid": "{8a99384c-5e0c-6a2d-5d00-000000000a00}",
    "ProcessId": "3872",
    "QueryName": "172.210.232.199.in-addr.arpa.",
    "QueryStatus": "9003",
    "QueryResults": "-",
    "Image": "C:\\Windows\\Sysmon64.exe",
    "User": "NT AUTHORITY\\SYSTEM"
  },
  "message": "Dns query:\r\nRuleName: -\r\nUtcTime: 2026-06-13 14:09:52.247\r\nProcessGuid: {8a99384c-5e0c-6a2d-5d00-000000000a00}\r\nProcessId: 3872\r\nQueryName: 172.210.232.199.in-addr.arpa.\r\nQueryStatus: 9003\r\nQueryResults: -\r\nImage: C:\\Windows\\Sysmon64.exe\r\nUser: NT AUTHORITY\\SYSTEM"
}

Detection Patterns #

(Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation)→Event ID 22: DNSEvent

1 rule

Elastic

Java Dropped and Executed With DNS Lookup (source)

Elastic

Execution: Exploitation for Client Execution

Sysmon Event ID 7: Image loadedANDEvent ID 22: DNSEvent

1 rule

Splunk

Sunburst Correlation DLL and Network Event (source)

Patrick Bareiss, Splunk

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`graph.metadata.entity_type (Chronicle)`	eq	`DOMAIN_NAME`	5 rules	chronicle
`QueryName`	eq	`*`	3 rules	splunk
`QueryName`	is_not_null		4 rules	elastic, kusto
`score`	ge	`5`	4 rules	kusto
`EventTime_t`	cross_field_compare	`min_t`	3 rules	kusto
`ValidUntil`	is_null		3 rules	kusto
`Category`	eq	`AzureFirewallApplicationRule`	2 rules	kusto
`DnsQueryTypeName`	in	`A`	2 rules	kusto
`DnsQueryTypeName`	in	`AAAA`	2 rules	kusto
`DnsResponseName`	is_not_null		2 rules	kusto
`EventResultDetails_s`	eq	`NXDOMAIN`	2 rules	kusto
`EventType`	eq	`lookup_requested`	2 rules	elastic
`EventType`	in	`dnsevent (dns query)`	2 rules	elastic
`EventType`	in	`lookup_requested`	2 rules	elastic
`Image`	in	`\\appdata\\`	2 rules	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

DNS Query for Anonfiles.com Domain - Sysmon source high: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposesT1567, T1567.002
AppX Package Installation Attempts Via AppInstaller.EXE source medium: Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URLT1105
Cloudflared Tunnels Related DNS Requests source medium: Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.T1071, T1071.001, T1572

Show 17 more (28 total) on the rules page

Elastic # view in coverage

First Time Seen DNS Query to RMM Domain source medium: Detects DNS queries to commonly abused remote monitoring and management (RMM) or remote access software domains from processes that are not browsers. Intended to surface RMM clients, scripts, or other non-browser activity contacting these services.T1219, T1219.002
Potential DNS Exfiltration via Excessive Chunked Queries source medium: Identifies potential DNS exfiltration on Windows hosts by detecting a high volume of DNS queries whose subdomain labels follow a chunked encoding pattern (index-payload.base_domain). Attackers split stolen data across many DNS queries to evade volume-based detection; this rule aggregates queries per process, base domain, and five-minute window and flags sessions with many distinct chunk indices and sufficiently long encoded payloads.T1048, T1048.003, T1572
External IP Lookup from Non-Browser Process source low: Identifies domains commonly used by adversaries for post-exploitation IP lookups. It is common for adversaries to test for Internet access and acquire their external IP address after they have gained access to a system. Among others, this has been observed in campaigns leveraging the information stealer, Trickbot.T1016, T1016.001, T1614

Splunk # view in coverage

Local LLM Framework DNS Query source: Detects DNS queries related to local LLM models on endpoints by monitoring Sysmon DNS query events (Event ID 22) for known LLM model domains and services. Local LLM frameworks like Ollama, LM Studio, and GPT4All make DNS calls to…T1590
Windows AI Platform DNS Query source: The following analytic detects DNS queries initiated by the Windows AI Platform to domains associated with Hugging Face, OpenAI, and other popular providers of machine learning models and services. Monitoring these DNS requests is…T1071, T1071.004
Windows BitLockerToGo with Network Activity source: The following analytic detects suspicious usage of BitLockerToGo.exe, which has been observed being abused by Lumma stealer malware. The malware leverages this legitimate Windows utility to manipulate registry keys, search for…T1218

Show 17 more (23 total) on the rules page

Kusto # view in coverage

DNS events related to mining pools (ASIM DNS Schema) source low: Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM DNS schemaT1496
DNS events related to ToR proxies (ASIM DNS Schema) source low: Identifies IP addresses performing DNS lookups associated with common ToR proxies. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM DNS schemaT1048
Excessive NXDOMAIN DNS Queries (ASIM DNS Schema) source medium: This creates an incident in the event a client generates excessive amounts of DNS queries for non-existent domains. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM DNS schemaT1008, T1568

Show 17 more (21 total) on the rules page

YARA-L # view in coverage

Recon Environment Enumeration Network CISA Report source low: Detects network enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking intoT1016↳ also matches Event ID 1: Process creation
DNS Query To Recently Created Domain source low: DNS query to a recently created domain
Domain Prevalence source low: Detects DNS events querying domains that have a low rolling max prevalence.

Sysmon Event ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

References #

Event ID 23: FileDelete (File Delete archived)

Channel: Operational
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: File Delete archived (rule: FileDelete)
Opcode: Info

Description

A file was deleted. Additionally the deleted file is saved in the ArchiveDirectory.

Message #

File Delete archived:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
User: %5
Image: %6
TargetFilename: %7
Hashes: %8
IsExecutable: %9
Archived: %10

Fields #

Name	Description	Rules
`RuleName` UnicodeString → string	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString → string	Time in UTC when event was created
`ProcessGuid` GUID → GUID	Process GUID of the process that deleted the file
`ProcessId` UInt32 → PID	Process ID used by the OS to identify the process that deleted the file
`User` UnicodeString → string	Name of the account who deleted the file.	2 detection rules
`Image` UnicodeString → string	File path of the process that deleted the file	22 detection rules
`TargetFilename` UnicodeString → string	Full path name of the deleted file	79 detection rules
`Hashes` UnicodeString → string	Hashes captured by the Sysmon driver of the deleted file
`IsExecutable` Boolean → boolean	Whether the deleted file is a PE executable
`Archived` UnicodeString → string	States if the file was archived when deleted

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9",
    "event_source_name": "",
    "event_id": 23,
    "version": 5,
    "level": 4,
    "task": 23,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2020-10-20T11:50:55.461859Z",
    "event_record_id": 769,
    "correlation": {},
    "execution": {
      "process_id": 7212,
      "thread_id": 9748
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "DESKTOP-NTSSLJD",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2020-10-20 11:50:55.457",
    "ProcessGuid": "23F38D93-CF1F-5F8E-CA08-000000000C00",
    "ProcessId": 8736,
    "User": "DESKTOP-NTSSLJD\\den",
    "Image": "C:\\Program Files\\Internet Explorer\\IEInstal.exe",
    "TargetFilename": "C:\\Users\\den\\AppData\\Local\\Temp\\dfcc1807-03a1-4ae1-ab29-5675b285edea\\consent.exe.dat",
    "Hashes": "SHA1=6BFB38629570909D3D9EEDFC783A948CE7849105,MD5=EE2A1C85C472F89B146CC8EE598CCCBC,SHA256=19FD0010DA92B654D1CA270247061A39EA13C0A58529FD8257A97E2EF7794911,IMPHASH=522D83761201075834F05037F5307949",
    "IsExecutable": true,
    "Archived": "true"
  }
}

Detection Patterns #

26 rules

Sigma

Unusual File Deletion by Dns.exe (source)

Tim Rauch (Nextron Systems), Elastic (idea)

EventLog EVTX File Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

Exchange PowerShell Cmdlet History Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

Elastic

Mark-of-the-Web Removal by an Unusual Process (source)

Elastic

Elastic

Third-party Backup Files Deleted via Unexpected Process (source)

Elastic

Splunk

Windows MSI Rollback Script Deleted By Non-Msiexec Process (source)

Raven Tait, Splunk

Windows Suspicious Defender Update Activity in INetCache (source)

Raven Tait, Splunk

Windows ConsoleHost History File Deletion (source)

Teoderick Contreras, Splunk

Security-Auditing Event ID 4663: An attempt was made to access an object.ORSysmon Event ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

Threat Hunting Hash

4 rules

Kusto

RecordedFuture Threat Hunting Hash All Actors (source)

SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events) (source)

Yaron

Google Threat Intelligence - Threat Hunting Hash (source)

Sysmon Event ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

3 rules

Elastic

Windows Suspicious Defender Update Activity in INetCache (source)

Elastic

Splunk

Raven Tait, Splunk

Windows MSI Rollback Script Deleted By Non-Msiexec Process (source)

Raven Tait, Splunk

Hash And Ip Iocs

2 rules

Kusto

Europium - Hash and IP IOCs - September 2022 (source)

Microsoft Security Research

Mercury - Domain, Hash and IP IOCs - August 2022 (source)

Ajeet Prakash

Initial Access: Exploit Public-Facing Application

1 rule

Kusto

Identify SysAid Server web shell creation (source)

Microsoft Security Research

Show All Detection Patterns

Execution: Exploitation for Client Execution

Security-Auditing Event ID 4663: An attempt was made to access an object.ORSysmon Event ID 1: Process creationOREvent ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

1 rule

Kusto

Sysmon Event ID 11: FileCreateOREvent ID 23: FileDelete

Microsoft Security Research

Persistence: Boot or Logon Autostart Execution

1 rule

Splunk

Additional dll added to Spool Driver (Sysmon) (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Hashes[0]`	eq	`sha256`	3 rules	kusto
`TargetFilename`	ends_with	`:zone.identifier`	3 rules	sigma, splunk
`TargetFilename`	ends_with	`.log`	2 rules	sigma
`event.type`	eq	`deletion`	3 rules	elastic
`ClientIP`	eq	`IPList`	2 rules	kusto
`DestinationIP`	eq	`IPList`	2 rules	kusto
`EventType`	eq	`FileCreated`	2 rules	kusto
`Hashes`	is_not_null		2 rules	kusto
`Hashes[1]`	contains	`sha256hashes`	2 rules	kusto
`IPAddresses`	eq	`IPList`	2 rules	kusto
`InitiatingProcessSHA256`	eq	`sha256hashes`	2 rules	kusto
`Message`	contains	`iplist`	2 rules	kusto
`ObservableKey`	contains	`file:hashes`	2 rules	kusto
`ObservableValue`	is_not_null		2 rules	kusto
`SourceIP`	eq	`IPList`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Process Deletion of Its Own Executable source medium: Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.↳ also matches Event ID 26: FileDeleteDetected (File Delete logged)

YARA-L # view in coverage

Suspicious Filewrites To Sharepoint Layouts source high: Detects a command-line interpreter (cmd.exe or powershell.exe) writing a file to a SharePoint (\TEMPLATE\LAYOUTS) directory.T1505, T1505.003↳ also matches Event ID 2: A process changed a file creation time, Event ID 11: FileCreate
Suspicious Unusual Location LNK File source low: Detects creation and movement of .lnk files to specific folders↳ also matches Event ID 2: A process changed a file creation time, Event ID 11: FileCreate

References #

Microsoft Learn
Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
OSSEM-DD

Event ID 24: ClipboardChange (New content in the clipboard)

Channel: Operational
Level: Informational
Collection Priority: Recommended (JSCU-NL)
Task: Clipboard changed (rule: ClipboardChange)
Opcode: Info

Description

This event is generated when the system clipboard contents change.

Message #

Clipboard changed:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
Session: %6
ClientInfo: %7
Hashes: %8
Archived: %9
User: %10

Fields #

Name	Description
`RuleName` UnicodeString → string
`UtcTime` UnicodeString → string
`ProcessGuid` GUID → GUID
`ProcessId` UInt32 → PID
`Image` UnicodeString → string
`Session` UInt32 → unsignedInt
`ClientInfo` UnicodeString → string
`Hashes` UnicodeString → string
`Archived` UnicodeString → string
`User` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9",
    "event_source_name": "",
    "event_id": 24,
    "version": 5,
    "level": 4,
    "task": 24,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:34:43.177918+00:00",
    "event_record_id": 1300545,
    "correlation": {},
    "execution": {
      "process_id": 7064,
      "thread_id": 18652
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2023-11-06 01:34:43.168",
    "ProcessGuid": "E56ADA26-3DE0-6548-E908-000000000D00",
    "ProcessId": 11112,
    "Image": "C:\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal_1.18.2822.0_x64__8wekyb3d8bbwe\\WindowsTerminal.exe",
    "Session": 1,
    "ClientInfo": "user: WINDEV2310EVAL\\User",
    "Hashes": "SHA1=179A4D08834E913B14727CF6474BAC31E082D275,MD5=64D76D5B160C1EB41680025DD778622D,SHA256=35EC5A2FD3F20757A957DC280EF330892A9D76378252CD381BF34518E6A30427,IMPHASH=00000000000000000000000000000000",
    "Archived": "true",
    "User": "WINDEV2310EVAL\\User"
  },
  "message": ""
}

References #

Microsoft Learn
Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 25: ProcessTampering (Process image change)

Channel: Operational
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: Process Tampering (rule: ProcessTampering)
Opcode: Info

Description

This event is generated when process hiding techniques are being detected.

Message #

Process Tampering:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
Type: %6
User: %7

Fields #

Name	Description	Rules
`RuleName` UnicodeString
`UtcTime` UnicodeString
`ProcessGuid` GUID
`ProcessId` UInt32
`Image` UnicodeString		7 detection rules
`Type` UnicodeString	Known values `Image is replaced` The on-disk image backing the process was modified after the process started (process hollowing variant detected via PsSetCreateProcessNotifyRoutineEx hash comparison against the loaded image). `Image is unmapped` The PE image was unmapped from the process address space after creation; the loader's expected image is no longer present. `Image is locked for access` Sysmon could not open the on-disk PE for read because another handle holds it with an exclusive sharing mode. May indicate process herpaderping using the optional exclusive-lock variant (jxy-s/herpaderping `-e` flag; the herpaderping primitive itself is content modification after image mapping, not the lock — see https://github.com/jxy-s/herpaderping). Benign locking by AV/EDR scan engines and installers can produce the same Sysmon signal; the catalog sample observed Avira wsc_agent.exe triggering this Type.	1 detection rule
`User` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 25,
    "version": 5,
    "level": 4,
    "task": 25,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T13:41:34.2634917+00:00",
    "event_record_id": 6122317,
    "correlation": {},
    "execution": {
      "process_id": 3872,
      "thread_id": 5252
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 13:41:19.666",
    "ProcessGuid": "{00000000-0000-0000-0000-000000000000}",
    "ProcessId": "604",
    "Image": "<unknown process>",
    "Type": "Image is replaced",
    "User": "NT AUTHORITY\\SYSTEM"
  },
  "message": "Process Tampering:\r\nRuleName: -\r\nUtcTime: 2026-06-13 13:41:19.666\r\nProcessGuid: {00000000-0000-0000-0000-000000000000}\r\nProcessId: 604\r\nImage: <unknown process>\r\nType: Image is replaced\r\nUser: NT AUTHORITY\\SYSTEM"
}

Community Notes #

Process tampering, detects process herpaderping.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Potential Process Hollowing Activity source medium: Detects when a memory process image does not match the disk image, indicative of process hollowing.T1055, T1055.012

References #

Event ID 26: FileDeleteDetected (File Delete logged)

Channel: Operational
Level: Informational
Collection Priority: Recommended (JSCU-NL)
Task: File Delete logged (rule: FileDeleteDetected)
Opcode: Info

Description

A file was deleted.

Message #

File Delete logged:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
User: %5
Image: %6
TargetFilename: %7
Hashes: %8
IsExecutable: %9

Fields #

Name	Description
`RuleName` UnicodeString	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString	Time in UTC when event was created
`ProcessGuid` GUID	Process GUID of the process that deleted the file
`ProcessId` UInt32	Process ID used by the OS to identify the process that deleted the file
`User` UnicodeString	Name of the account who deleted the file.
`Image` UnicodeString	File path of the process that deleted the file
`TargetFilename` UnicodeString	Full path name of the deleted file
`Hashes` UnicodeString	Hashes captured by the Sysmon driver of the deleted file
`IsExecutable` Boolean	Whether the deleted file is a PE executable

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "event_source_name": "",
    "event_id": 26,
    "version": 5,
    "level": 4,
    "task": 26,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:09:29.6982228+00:00",
    "event_record_id": 17612805,
    "correlation": {},
    "execution": {
      "process_id": 4080,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-06-13 14:09:29.694",
    "ProcessGuid": "{8a99384c-e971-6a2c-b200-000000001000}",
    "ProcessId": "6816",
    "User": "cell-c\\domainadmin",
    "Image": "C:\\Windows\\Explorer.EXE",
    "TargetFilename": "C:\\Users\\domainadmin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1024_768_POS1.jpg",
    "Hashes": "SHA1=45418D43C67E2CEE415B678094EABC2A7D9FF2E4,MD5=210CC081ECEF04E020E21D53341EE954,SHA256=4F3BA3A9948CDDF013F02C82832BE6CE9203B2E874D9675BAEF3F9026C3B266F,IMPHASH=00000000000000000000000000000000",
    "IsExecutable": "false"
  },
  "message": "File Delete logged:\r\nRuleName: -\r\nUtcTime: 2026-06-13 14:09:29.694\r\nProcessGuid: {8a99384c-e971-6a2c-b200-000000001000}\r\nProcessId: 6816\r\nUser: cell-c\\domainadmin\r\nImage: C:\\Windows\\Explorer.EXE\r\nTargetFilename: C:\\Users\\domainadmin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1024_768_POS1.jpg\r\nHashes: SHA1=45418D43C67E2CEE415B678094EABC2A7D9FF2E4,MD5=210CC081ECEF04E020E21D53341EE954,SHA256=4F3BA3A9948CDDF013F02C82832BE6CE9203B2E874D9675BAEF3F9026C3B266F,IMPHASH=00000000000000000000000000000000\r\nIsExecutable: false"
}

Detection Patterns #

Sysmon Event ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

26 rules

Sigma

Unusual File Deletion by Dns.exe (source)

Tim Rauch (Nextron Systems), Elastic (idea)

EventLog EVTX File Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

Exchange PowerShell Cmdlet History Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

Elastic

Mark-of-the-Web Removal by an Unusual Process (source)

Elastic

Elastic

Third-party Backup Files Deleted via Unexpected Process (source)

Elastic

Splunk

Windows MSI Rollback Script Deleted By Non-Msiexec Process (source)

Raven Tait, Splunk

Windows Suspicious Defender Update Activity in INetCache (source)

Raven Tait, Splunk

Windows ConsoleHost History File Deletion (source)

Teoderick Contreras, Splunk

Security-Auditing Event ID 4663: An attempt was made to access an object.ORSysmon Event ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

Threat Hunting Hash

4 rules

Kusto

RecordedFuture Threat Hunting Hash All Actors (source)

SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events) (source)

Yaron

Google Threat Intelligence - Threat Hunting Hash (source)

Sysmon Event ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

3 rules

Elastic

Windows Suspicious Defender Update Activity in INetCache (source)

Elastic

Splunk

Raven Tait, Splunk

Windows MSI Rollback Script Deleted By Non-Msiexec Process (source)

Raven Tait, Splunk

Hash And Ip Iocs

2 rules

Kusto

Europium - Hash and IP IOCs - September 2022 (source)

Microsoft Security Research

Mercury - Domain, Hash and IP IOCs - August 2022 (source)

Ajeet Prakash

Initial Access: Exploit Public-Facing Application

1 rule

Kusto

Identify SysAid Server web shell creation (source)

Microsoft Security Research

Show All Detection Patterns

Execution: Exploitation for Client Execution

Security-Auditing Event ID 4663: An attempt was made to access an object.ORSysmon Event ID 1: Process creationOREvent ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

1 rule

Kusto