detection.wiki

Elastic Inferred Detection Coverage

954 inferred rule mappings across 46 events and 2 providers, covering 398 unique Elastic detection rules.

Most Elastic detection rules don't explicitly filter by Windows event ID. Instead, they query using EQL event categories (like process where or file where) or match on fields that only appear in specific event types. This embeds the connection between a rule and the Windows events it operates on in the query logic rather than stating it directly.

To surface these relationships, this analysis parses each rule's query into an abstract syntax tree and extracts the EQL categories and field names it references. Where a category or field maps to a known set of Windows events, the mappings below link the rule to those events: answering the question: if I collect this Windows event, which Elastic rules could use it as a data source?

For rules that do explicitly reference event IDs, see the Elastic Detection Rules Reference.

Download as JSON (558 additional rules across 13 collapsed sections)

Confidence levels
  • Medium: Rule uses an EQL category (e.g., process where, file where) that maps to this event type. The rule fires if this event is collected, though other data sources may also satisfy it.
  • Low: Rule references fields that appear in only a few different events. The rule may use this event, but the mapping is less certain.

Rules group by inference method so you can see exactly which EQL category or field name links each rule to the event.

Microsoft-Windows-Security-Auditing (32 events, 264 rules) #

Channel: Security Event ID 4610: An authentication package has been loaded by the Local Security Authority. (4 low)

Shared field: AuthenticationPackageNamelow confidence: 4 rules
Potential Computer Account NTLM Relay Activity mediumRelated:
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Potential Kerberos Relay Attack against a Computer Account highRelated:
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Potential NTLM Relay Attack against a Computer Account highRelated:
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Service Creation via Local Kerberos Authentication highRelated:
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.

Channel: Security Event ID 4611: A trusted logon process has been registered with the Local Security Authority. (4 low)

Shared field: LogonProcessNamelow confidence: 4 rules
Potential Pass-the-Hash (PtH) Attempt mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4649: A replay attack was detected.
Process Creation via Secondary Logon mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4688: A new process has been created.
  • Security-Auditing Event ID 4649: A replay attack was detected.
Interactive Logon by an Unusual Process highRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4649: A replay attack was detected.
First Time Seen NewCredentials Logon Process mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4649: A replay attack was detected.

Channel: Security Event ID 4624: An account was successfully logged on. (6 medium, 2 low)

EQL category authentication wheremedium confidence: 6 rules
Multiple Logon Failure Followed by Logon Success mediumRelated:
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Suspicious Kerberos Authentication Ticket Request highRelated:
  • Sysmon Event ID 3: Network connection
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Remote Windows Service Installed mediumRelated:
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Account Password Reset Remotely mediumRelated:
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Process Creation via Secondary Logon mediumRelated:
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4688: A new process has been created.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.
Interactive Logon by an Unusual Process highRelated:
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.
Shared field: LogonProcessNamelow confidence: 2 rules
Potential Pass-the-Hash (PtH) Attempt mediumRelated:
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.
First Time Seen NewCredentials Logon Process mediumRelated:
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.

Channel: Security Event ID 4625: An account failed to log on. (7 medium)

EQL category authentication wheremedium confidence: 7 rules
Multiple Logon Failure Followed by Logon Success mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Suspicious Kerberos Authentication Ticket Request highRelated:
  • Sysmon Event ID 3: Network connection
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Remote Windows Service Installed mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Account Password Reset Remotely mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Process Creation via Secondary Logon mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4688: A new process has been created.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.
Service Creation via Local Kerberos Authentication highRelated:
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Interactive Logon by an Unusual Process highRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.

Channel: Security Event ID 4634: An account was logged off. (10 medium)

EQL category authentication wheremedium confidence: 10 rules
Multiple Logon Failure Followed by Logon Success mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Potential Computer Account NTLM Relay Activity mediumRelated:
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Potential Kerberos Relay Attack against a Computer Account highRelated:
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Potential NTLM Relay Attack against a Computer Account highRelated:
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Suspicious Kerberos Authentication Ticket Request highRelated:
  • Sysmon Event ID 3: Network connection
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Remote Windows Service Installed mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Account Password Reset Remotely mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Process Creation via Secondary Logon mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4688: A new process has been created.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.
Service Creation via Local Kerberos Authentication highRelated:
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Interactive Logon by an Unusual Process highRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.

Channel: Security Event ID 4647: User initiated logoff. (10 medium)

EQL category authentication wheremedium confidence: 10 rules
Multiple Logon Failure Followed by Logon Success mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Potential Computer Account NTLM Relay Activity mediumRelated:
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Potential Kerberos Relay Attack against a Computer Account highRelated:
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Potential NTLM Relay Attack against a Computer Account highRelated:
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Suspicious Kerberos Authentication Ticket Request highRelated:
  • Sysmon Event ID 3: Network connection
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Remote Windows Service Installed mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Account Password Reset Remotely mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
Process Creation via Secondary Logon mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4688: A new process has been created.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.
Service Creation via Local Kerberos Authentication highRelated:
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Interactive Logon by an Unusual Process highRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.

Channel: Security Event ID 4648: A logon was attempted using explicit credentials. (10 medium)

EQL category authentication wheremedium confidence: 10 rules
Multiple Logon Failure Followed by Logon Success mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
Potential Computer Account NTLM Relay Activity mediumRelated:
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Potential Kerberos Relay Attack against a Computer Account highRelated:
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Potential NTLM Relay Attack against a Computer Account highRelated:
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Suspicious Kerberos Authentication Ticket Request highRelated:
  • Sysmon Event ID 3: Network connection
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
Remote Windows Service Installed mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
Account Password Reset Remotely mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
Process Creation via Secondary Logon mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4688: A new process has been created.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.
Service Creation via Local Kerberos Authentication highRelated:
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4610: An authentication package has been loaded by the Local Security Authority.
Interactive Logon by an Unusual Process highRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4649: A replay attack was detected.

Channel: Security Event ID 4649: A replay attack was detected. (4 low)

Shared field: LogonProcessNamelow confidence: 4 rules
Potential Pass-the-Hash (PtH) Attempt mediumRelated:
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4624: An account was successfully logged on.
Process Creation via Secondary Logon mediumRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4688: A new process has been created.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
Interactive Logon by an Unusual Process highRelated:
  • Security-Auditing Event ID 4624: An account was successfully logged on.
  • Security-Auditing Event ID 4625: An account failed to log on.
  • Security-Auditing Event ID 4634: An account was logged off.
  • Security-Auditing Event ID 4647: User initiated logoff.
  • Security-Auditing Event ID 4648: A logon was attempted using explicit credentials.
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
First Time Seen NewCredentials Logon Process mediumRelated:
  • Security-Auditing Event ID 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing Event ID 4624: An account was successfully logged on.

Channel: Security Event ID 4657: A registry value was modified. (3 low)

Shared field: OperationTypelow confidence: 3 rules
User account exposed to Kerberoasting mediumRelated:
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Account Configured with Never-Expiring Password mediumRelated:
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
  • Security-Auditing Event ID 5137: A directory service object was created.
  • Security-Auditing Event ID 5141: A directory service object was deleted.
Modification of the msPKIAccountCredentials mediumRelated:
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 4659: A handle to an object was requested with intent to delete. (2 low)

Shared field: AccessListlow confidence: 2 rules
Startup/Logon Script added to Group Policy Object mediumRelated:
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPO mediumRelated:
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 4661: A handle to an object was requested. (4 low)

Shared field: Propertieslow confidence: 4 rules
FirstTime Seen Account Performing DCSync high
Potential Credential Access via DCSync medium
Access to a Sensitive LDAP Attribute medium
Suspicious Access to LDAP Attributes low

Channel: Security Event ID 4663: An attempt was made to access an object. (2 low)

Shared field: AccessListlow confidence: 2 rules
Startup/Logon Script added to Group Policy Object mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPO mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 4688: A new process has been created. (133 medium)

EQL category process where → start medium confidence: 133 rules
Curl or Wget Spawned via Node.js mediumRelated:
  • Sysmon Event ID 1: Process creation
Potential Traffic Tunneling using QEMU mediumRelated:
  • Sysmon Event ID 1: Process creation
Potential Secret Scanning via Gitleaks mediumRelated:
  • Sysmon Event ID 1: Process creation
Credential Access via TruffleHog Execution mediumRelated:
  • Sysmon Event ID 1: Process creation
Data Encrypted via OpenSSL Utility lowRelated:
  • Sysmon Event ID 1: Process creation
Kubernetes Direct API Request via Curl or Wget mediumRelated:
  • Sysmon Event ID 1: Process creation
Remote GitHub Actions Runner Registration mediumRelated:
  • Sysmon Event ID 1: Process creation
Execution via GitHub Actions Runner mediumRelated:
  • Sysmon Event ID 1: Process creation
Potential Data Exfiltration Through Curl mediumRelated:
  • Sysmon Event ID 1: Process creation
Exporting Exchange Mailbox via PowerShell mediumRelated:
  • Sysmon Event ID 1: Process creation
Potential File Transfer via Certreq mediumRelated:
  • Sysmon Event ID 1: Process creation
Potential DNS Tunneling via NsLookup mediumRelated:
  • Sysmon Event ID 1: Process creation
Potential File Download via a Headless Browser highRelated:
  • Sysmon Event ID 1: Process creation
Potential Remote Desktop Tunneling Detected highRelated:
  • Sysmon Event ID 1: Process creation
Remote File Download via Desktopimgdownldr Utility mediumRelated:
  • Sysmon Event ID 1: Process creation
Show all 133 rules (118 more)

Channel: Security Event ID 4691: Indirect access to an object was requested. (2 low)

Shared field: AccessListlow confidence: 2 rules
Startup/Logon Script added to Group Policy Object mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPO mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 4700: A scheduled task was enabled. (4 low)

Shared field: RpcCallClientLocalitylow confidence: 1 rule
Remote Scheduled Task Creation via RPC mediumRelated:
  • Security-Auditing Event ID 4701: A scheduled task was disabled.
Shared field: TaskNamelow confidence: 2 rules
A scheduled task was created lowRelated:
  • Security-Auditing Event ID 4701: A scheduled task was disabled.
Temporarily Scheduled Task Creation mediumRelated:
  • Security-Auditing Event ID 4701: A scheduled task was disabled.
Shared field: ParentProcessIdlow confidence: 1 rule
Windows Service Installed via an Unusual Client highRelated:
  • Security-Auditing Event ID 4701: A scheduled task was disabled.
  • Sysmon Event ID 1: Process creation

Channel: Security Event ID 4701: A scheduled task was disabled. (4 low)

Shared field: RpcCallClientLocalitylow confidence: 1 rule
Remote Scheduled Task Creation via RPC mediumRelated:
  • Security-Auditing Event ID 4700: A scheduled task was enabled.
Shared field: TaskNamelow confidence: 2 rules
A scheduled task was created lowRelated:
  • Security-Auditing Event ID 4700: A scheduled task was enabled.
Temporarily Scheduled Task Creation mediumRelated:
  • Security-Auditing Event ID 4700: A scheduled task was enabled.
Shared field: ParentProcessIdlow confidence: 1 rule
Windows Service Installed via an Unusual Client highRelated:
  • Security-Auditing Event ID 4700: A scheduled task was enabled.
  • Sysmon Event ID 1: Process creation

Channel: Security Event ID 4720: A user account was created. (1 low)

Shared field: AllowedToDelegateTolow confidence: 1 rule
KRBTGT Delegation Backdoor highRelated:
  • Security-Auditing Event ID 4741: A computer account was created.
  • Security-Auditing Event ID 4742: A computer account was changed.

Channel: Security Event ID 4741: A computer account was created. (1 low)

Shared field: AllowedToDelegateTolow confidence: 1 rule
KRBTGT Delegation Backdoor highRelated:
  • Security-Auditing Event ID 4720: A user account was created.
  • Security-Auditing Event ID 4742: A computer account was changed.

Channel: Security Event ID 4742: A computer account was changed. (1 low)

Shared field: AllowedToDelegateTolow confidence: 1 rule
KRBTGT Delegation Backdoor highRelated:
  • Security-Auditing Event ID 4720: A user account was created.
  • Security-Auditing Event ID 4741: A computer account was created.

Channel: Security Event ID 4798: A user's local group membership was enumerated. (1 low)

Shared field: CallerProcessNamelow confidence: 1 rule
Enumeration of Privileged Local Groups Membership mediumRelated:
  • Security-Auditing Event ID 4799: A security-enabled local group membership was enumerated.
  • Security-Auditing Event ID 5050: An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE) interface was rejected.

Channel: Security Event ID 4799: A security-enabled local group membership was enumerated. (1 low)

Shared field: CallerProcessNamelow confidence: 1 rule
Enumeration of Privileged Local Groups Membership mediumRelated:
  • Security-Auditing Event ID 4798: A user's local group membership was enumerated.
  • Security-Auditing Event ID 5050: An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE) interface was rejected.

Channel: Security Event ID 5050: An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE) interface was rejected. (1 low)

Shared field: CallerProcessNamelow confidence: 1 rule
Enumeration of Privileged Local Groups Membership mediumRelated:
  • Security-Auditing Event ID 4798: A user's local group membership was enumerated.
  • Security-Auditing Event ID 4799: A security-enabled local group membership was enumerated.

Channel: Security Event ID 5136: A directory service object was modified. (3 low)

Shared field: ObjectDNlow confidence: 3 rules
Potential ADIDNS Poisoning via Wildcard Record Creation highRelated:
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Potential WPAD Spoofing via DNS Record Creation mediumRelated:
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Potential Kerberos Coercion via DNS-Based SPN Spoofing highRelated:
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5137: A directory service object was created. (2 low)

Shared field: ObjectDNlow confidence: 2 rules
AdminSDHolder Backdoor highRelated:
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Account Configured with Never-Expiring Password mediumRelated:
  • Security-Auditing Event ID 4657: A registry value was modified.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
  • Security-Auditing Event ID 5141: A directory service object was deleted.

Channel: Security Event ID 5140: A network share object was accessed. (2 low)

Shared field: AccessListlow confidence: 2 rules
Startup/Logon Script added to Group Policy Object mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPO mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5141: A directory service object was deleted. (5 low)

Shared field: ObjectDNlow confidence: 5 rules
Potential ADIDNS Poisoning via Wildcard Record Creation highRelated:
  • Security-Auditing Event ID 5136: A directory service object was modified.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Potential WPAD Spoofing via DNS Record Creation mediumRelated:
  • Security-Auditing Event ID 5136: A directory service object was modified.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Potential Kerberos Coercion via DNS-Based SPN Spoofing highRelated:
  • Security-Auditing Event ID 5136: A directory service object was modified.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
AdminSDHolder Backdoor highRelated:
  • Security-Auditing Event ID 5137: A directory service object was created.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Account Configured with Never-Expiring Password mediumRelated:
  • Security-Auditing Event ID 4657: A registry value was modified.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
  • Security-Auditing Event ID 5137: A directory service object was created.

Channel: Security Event ID 5142: A network share object was added. (2 low)

Shared field: ShareNamelow confidence: 2 rules
Startup/Logon Script added to Group Policy Object mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPO mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5143: A network share object was modified. (2 low)

Shared field: ShareNamelow confidence: 2 rules
Startup/Logon Script added to Group Policy Object mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPO mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5144: A network share object was deleted. (2 low)

Shared field: ShareNamelow confidence: 2 rules
Startup/Logon Script added to Group Policy Object mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPO mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5169: A directory service object was modified. (14 low)

Shared field: ObjectDNlow confidence: 4 rules
Potential ADIDNS Poisoning via Wildcard Record Creation highRelated:
  • Security-Auditing Event ID 5136: A directory service object was modified.
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Potential WPAD Spoofing via DNS Record Creation mediumRelated:
  • Security-Auditing Event ID 5136: A directory service object was modified.
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Potential Kerberos Coercion via DNS-Based SPN Spoofing highRelated:
  • Security-Auditing Event ID 5136: A directory service object was modified.
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
AdminSDHolder Backdoor highRelated:
  • Security-Auditing Event ID 5137: A directory service object was created.
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Shared field: AttributeLDAPDisplayNamelow confidence: 7 rules
Potential Active Directory Replication Account Backdoor mediumRelated:
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Potential Shadow Credentials added to AD Object highRelated:
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
AdminSDHolder SDProp Exclusion Added highRelated:
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Delegated Managed Service Account Modification by an Unusual User highRelated:
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Startup/Logon Script added to Group Policy Object mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Group Policy Abuse for Privilege Addition highRelated:
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPO mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Shared field: OperationTypelow confidence: 3 rules
User account exposed to Kerberoasting mediumRelated:
  • Security-Auditing Event ID 4657: A registry value was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
Account Configured with Never-Expiring Password mediumRelated:
  • Security-Auditing Event ID 4657: A registry value was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.
  • Security-Auditing Event ID 5137: A directory service object was created.
  • Security-Auditing Event ID 5141: A directory service object was deleted.
Modification of the msPKIAccountCredentials mediumRelated:
  • Security-Auditing Event ID 4657: A registry value was modified.
  • Security-Auditing Event ID 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5170: A directory service object was modified during a background cleanup task. (14 low)

Shared field: ObjectDNlow confidence: 4 rules
Potential ADIDNS Poisoning via Wildcard Record Creation highRelated:
  • Security-Auditing Event ID 5136: A directory service object was modified.
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
Potential WPAD Spoofing via DNS Record Creation mediumRelated:
  • Security-Auditing Event ID 5136: A directory service object was modified.
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
Potential Kerberos Coercion via DNS-Based SPN Spoofing highRelated:
  • Security-Auditing Event ID 5136: A directory service object was modified.
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
AdminSDHolder Backdoor highRelated:
  • Security-Auditing Event ID 5137: A directory service object was created.
  • Security-Auditing Event ID 5141: A directory service object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
Shared field: AttributeLDAPDisplayNamelow confidence: 7 rules
Potential Active Directory Replication Account Backdoor mediumRelated:
  • Security-Auditing Event ID 5169: A directory service object was modified.
Potential Shadow Credentials added to AD Object highRelated:
  • Security-Auditing Event ID 5169: A directory service object was modified.
AdminSDHolder SDProp Exclusion Added highRelated:
  • Security-Auditing Event ID 5169: A directory service object was modified.
Delegated Managed Service Account Modification by an Unusual User highRelated:
  • Security-Auditing Event ID 5169: A directory service object was modified.
Startup/Logon Script added to Group Policy Object mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
Group Policy Abuse for Privilege Addition highRelated:
  • Security-Auditing Event ID 5169: A directory service object was modified.
Scheduled Task Execution at Scale via GPO mediumRelated:
  • Security-Auditing Event ID 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing Event ID 4663: An attempt was made to access an object.
  • Security-Auditing Event ID 4691: Indirect access to an object was requested.
  • Security-Auditing Event ID 5140: A network share object was accessed.
  • Security-Auditing Event ID 5142: A network share object was added.
  • Security-Auditing Event ID 5143: A network share object was modified.
  • Security-Auditing Event ID 5144: A network share object was deleted.
  • Security-Auditing Event ID 5169: A directory service object was modified.
Shared field: OperationTypelow confidence: 3 rules
User account exposed to Kerberoasting mediumRelated:
  • Security-Auditing Event ID 4657: A registry value was modified.
  • Security-Auditing Event ID 5169: A directory service object was modified.
Account Configured with Never-Expiring Password mediumRelated:
  • Security-Auditing Event ID 4657: A registry value was modified.
  • Security-Auditing Event ID 5169: A directory service object was modified.
  • Security-Auditing Event ID 5137: A directory service object was created.
  • Security-Auditing Event ID 5141: A directory service object was deleted.
Modification of the msPKIAccountCredentials mediumRelated:
  • Security-Auditing Event ID 4657: A registry value was modified.
  • Security-Auditing Event ID 5169: A directory service object was modified.

Channel: Security Event ID 5380: Vault Find Credential. (1 low)

Shared field: SchemaFriendlyNamelow confidence: 1 rule
Multiple Vault Web Credentials Read medium

Microsoft-Windows-Sysmon (14 events, 690 rules) #

Channel: Operational Event ID 1: Process creation (229 medium, 1 low)

EQL category process where → start medium confidence: 209 rules
Curl or Wget Spawned via Node.js mediumRelated:
  • Security-Auditing Event ID 4688: A new process has been created.
Potential Traffic Tunneling using QEMU mediumRelated:
  • Security-Auditing Event ID 4688: A new process has been created.
Potential Secret Scanning via Gitleaks mediumRelated:
  • Security-Auditing Event ID 4688: A new process has been created.
Credential Access via TruffleHog Execution mediumRelated:
  • Security-Auditing Event ID 4688: A new process has been created.
Data Encrypted via OpenSSL Utility lowRelated:
  • Security-Auditing Event ID 4688: A new process has been created.
Elastic Agent Service Terminated medium
ROT Encoded Python Script Execution mediumRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
GenAI Process Compiling or Generating Executables medium
GenAI Process Performing Encoding/Chunking Prior to Network Activity mediumRelated:
  • Sysmon Event ID 3: Network connection
Kubernetes Direct API Request via Curl or Wget mediumRelated:
  • Security-Auditing Event ID 4688: A new process has been created.
Execution via OpenClaw Agent medium
Remote GitHub Actions Runner Registration mediumRelated:
  • Security-Auditing Event ID 4688: A new process has been created.
Potential SAP NetWeaver Exploitation high
Execution via GitHub Actions Runner mediumRelated:
  • Security-Auditing Event ID 4688: A new process has been created.
Potential Data Exfiltration Through Curl mediumRelated:
  • Security-Auditing Event ID 4688: A new process has been created.
Show all 209 rules (194 more)
EQL category process wheremedium confidence: 20 rules
Potential Cookies Theft via Browser Debugging mediumRelated:
  • Sysmon Event ID 5: Process terminated
Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score highRelated:
  • Sysmon Event ID 5: Process terminated
Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score lowRelated:
  • Sysmon Event ID 5: Process terminated
Suspicious Inter-Process Communication via Outlook mediumRelated:
  • Sysmon Event ID 5: Process terminated
Suspicious LSASS Access via MalSecLogon highRelated:
  • Sysmon Event ID 5: Process terminated
  • Sysmon Event ID 8: CreateRemoteThread
Potential Credential Access via DuplicateHandle in LSASS mediumRelated:
  • Sysmon Event ID 5: Process terminated
Potential Credential Access via Renamed COM+ Services DLL highRelated:
  • Sysmon Event ID 5: Process terminated
Suspicious Lsass Process Access mediumRelated:
  • Sysmon Event ID 5: Process terminated
  • Sysmon Event ID 8: CreateRemoteThread
Potential Credential Access via LSASS Memory Dump highRelated:
  • Sysmon Event ID 5: Process terminated
  • Sysmon Event ID 8: CreateRemoteThread
Process Injection by the Microsoft Build Engine lowRelated:
  • Sysmon Event ID 5: Process terminated
Suspicious Process Access via Direct System Call highRelated:
  • Sysmon Event ID 5: Process terminated
  • Sysmon Event ID 8: CreateRemoteThread
Delayed Execution via Ping lowRelated:
  • Sysmon Event ID 5: Process terminated
Suspicious HTML File Creation mediumRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
  • Sysmon Event ID 5: Process terminated
Execution from a Removable Media with Network Connection lowRelated:
  • Sysmon Event ID 5: Process terminated
  • Sysmon Event ID 3: Network connection
Potential Remote File Execution via MSIEXEC lowRelated:
  • Sysmon Event ID 5: Process terminated
  • Sysmon Event ID 3: Network connection
Show all 20 rules (5 more)
Shared field: ParentProcessIdlow confidence: 1 rule
Windows Service Installed via an Unusual Client highRelated:
  • Security-Auditing Event ID 4700: A scheduled task was enabled.
  • Security-Auditing Event ID 4701: A scheduled task was disabled.

Channel: Operational Event ID 2: A process changed a file creation time (40 medium)

EQL category file wheremedium confidence: 38 rules
GenAI Process Accessing Sensitive Files highRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
ROT Encoded Python Script Execution mediumRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential SAP NetWeaver WebShell Creation highRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Initial Access via File Upload Followed by GET Request mediumRelated:
  • Sysmon Event ID 3: Network connection
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Ingress Transfer via Windows BITS lowRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Creation or Modification of Domain Backup DPAPI private key highRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
LSASS Memory Dump Creation highRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Mimikatz Memssp Log File Detected highRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Sensitive Registry Hive Access via RegBack highRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential Remote Credential Access via Registry highRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Suspicious Antimalware Scan Interface DLL highRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Suspicious Managed Code Hosting Process highRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Unusual Executable File Creation by a System Critical Process highRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
WDAC Policy File by an Unusual Process highRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Host File System Changes via Windows Subsystem for Linux mediumRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Show all 38 rules (23 more)
EQL category file where → change medium confidence: 2 rules
Potential Secure File Deletion via SDelete Utility low
UAC Bypass Attempt via Privileged IFileOperation COM Interface high

Channel: Operational Event ID 3: Network connection (52 medium)

EQL category network wheremedium confidence: 44 rules
Connection to Common Large Language Model Endpoints medium
GenAI Process Connection to Suspicious Top Level Domain medium
PANW and Elastic Defend - Command and Control Correlation medium
FortiGate SOCKS Traffic from an Unusual Process medium
Suricata and Elastic Defend Network Correlation medium
Initial Access via File Upload Followed by GET Request mediumRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Ollama API Accessed from External Network medium
Connection to Commonly Abused Web Services low
Network Activity to a Suspicious Top Level Domain high
Connection to Commonly Abused Free SSL Certificate Providers low
Potential Command and Control via Internet Explorer mediumRelated:
  • Sysmon Event ID 7: Image loaded
  • Sysmon Event ID 1: Process creation
Remote File Download via PowerShell mediumRelated:
  • Sysmon Event ID 11: FileCreate
Remote File Download via Script Interpreter mediumRelated:
  • Sysmon Event ID 11: FileCreate
Potential Kerberos SPN Spoofing via Suspicious DNS Query high
InstallUtil Process Making Network Connections mediumRelated:
  • Sysmon Event ID 1: Process creation
Show all 44 rules (29 more)
EQL category network where → start medium confidence: 7 rules
GenAI Process Performing Encoding/Chunking Prior to Network Activity mediumRelated:
  • Sysmon Event ID 1: Process creation
Kerberos Traffic from Unusual Process medium
Incoming DCOM Lateral Movement via MSHTA highRelated:
  • Sysmon Event ID 1: Process creation
Incoming DCOM Lateral Movement with MMC highRelated:
  • Sysmon Event ID 1: Process creation
Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows mediumRelated:
  • Sysmon Event ID 1: Process creation
Potential Lateral Tool Transfer via SMB Share mediumRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential SharpRDP Behavior highRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
  • Sysmon Event ID 1: Process creation
EQL category network where → protocol medium confidence: 1 rule
SUNBURST Command and Control Activity high

Channel: Operational Event ID 5: Process terminated (21 medium)

EQL category process wheremedium confidence: 21 rules
Potential Cookies Theft via Browser Debugging mediumRelated:
  • Sysmon Event ID 1: Process creation
Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score highRelated:
  • Sysmon Event ID 1: Process creation
Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score lowRelated:
  • Sysmon Event ID 1: Process creation
Suspicious Inter-Process Communication via Outlook mediumRelated:
  • Sysmon Event ID 1: Process creation
Suspicious LSASS Access via MalSecLogon highRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 8: CreateRemoteThread
Potential Credential Access via DuplicateHandle in LSASS mediumRelated:
  • Sysmon Event ID 1: Process creation
Potential Credential Access via Renamed COM+ Services DLL highRelated:
  • Sysmon Event ID 1: Process creation
Suspicious Lsass Process Access mediumRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 8: CreateRemoteThread
Potential Credential Access via LSASS Memory Dump highRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 8: CreateRemoteThread
Process Injection by the Microsoft Build Engine lowRelated:
  • Sysmon Event ID 1: Process creation
Suspicious Process Access via Direct System Call highRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 8: CreateRemoteThread
Suspicious Process Creation CallTrace medium
Delayed Execution via Ping lowRelated:
  • Sysmon Event ID 1: Process creation
Suspicious HTML File Creation mediumRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
  • Sysmon Event ID 1: Process creation
Execution from a Removable Media with Network Connection lowRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 3: Network connection
Show all 21 rules (6 more)

Channel: Operational Event ID 6: Driver loaded (2 medium)

EQL category driver wheremedium confidence: 2 rules
Untrusted Driver Loaded high
Expired or Revoked Driver Loaded medium

Channel: Operational Event ID 7: Image loaded (7 medium)

EQL category library wheremedium confidence: 7 rules
Potential Command and Control via Internet Explorer mediumRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 3: Network connection
Veeam Backup Library Loaded by Unusual Process medium
Potential Windows Session Hijacking via CcmExec medium
Unsigned DLL Side-Loading from a Suspicious Folder medium
Potential Enumeration via Active Directory Web Service mediumRelated:
  • Sysmon Event ID 3: Network connection
Remote XSL Script Execution via COM lowRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 5: Process terminated
Unsigned DLL Loaded by Svchost medium

Channel: Operational Event ID 8: CreateRemoteThread (5 low)

Shared field: TargetImagelow confidence: 5 rules
Suspicious LSASS Access via MalSecLogon highRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 5: Process terminated
Suspicious Lsass Process Access mediumRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 5: Process terminated
Potential Credential Access via LSASS Memory Dump highRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 5: Process terminated
Potential LSASS Memory Dump via PssCaptureSnapShot high
Suspicious Process Access via Direct System Call highRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 5: Process terminated

Channel: Operational Event ID 11: FileCreate (51 medium)

EQL category file wheremedium confidence: 39 rules
GenAI Process Accessing Sensitive Files highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
ROT Encoded Python Script Execution mediumRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential SAP NetWeaver WebShell Creation highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Initial Access via File Upload Followed by GET Request mediumRelated:
  • Sysmon Event ID 3: Network connection
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Ingress Transfer via Windows BITS lowRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Creation or Modification of Domain Backup DPAPI private key highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
LSASS Memory Dump Creation highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Mimikatz Memssp Log File Detected highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Sensitive Registry Hive Access via RegBack highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential Remote Credential Access via Registry highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Suspicious Antimalware Scan Interface DLL highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Suspicious Managed Code Hosting Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Unusual Executable File Creation by a System Critical Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential Timestomp in Executable Files mediumRelated:
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
WDAC Policy File by an Unusual Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Show all 39 rules (24 more)
EQL category file where → creation medium confidence: 12 rules
Remote File Download via PowerShell mediumRelated:
  • Sysmon Event ID 3: Network connection
Remote File Download via Script Interpreter mediumRelated:
  • Sysmon Event ID 3: Network connection
Remote File Copy via TeamViewer medium
Kirbi File Creation high
Windows Registry File Creation in SMB Share medium
Executable File Creation with Multiple Extensions medium
Unusual File Creation - Alternate Data Stream high
Downloaded Shortcut Files medium
Downloaded URL Files medium
Microsoft Exchange Server UM Writing Suspicious Files medium
Deprecated - Adobe Hijack Persistence low
Browser Extension Install low

Channel: Operational Event ID 12: RegistryEvent (Object create and delete) (53 medium)

EQL category registry wheremedium confidence: 9 rules
Outlook Home Page Registry Modification highRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Full User-Mode Dumps Enabled System-Wide mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Modification of WDigest Security Provider highRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Network-Level Authentication (NLA) Disabled lowRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Deprecated - Encoded Executable Stored in the Registry mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Potential NetNTLMv1 Downgrade Attack mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Potential RemoteMonologue Attack mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Office Test Registry Persistence lowRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Suspicious Print Spooler Point and Print DLL highRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
EQL category registry where → change medium confidence: 44 rules
Port Forwarding Rule Addition mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Network Logon Provider Registry Modification mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Modification of AmsiEnable Registry Key highRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Code Signing Policy Modification Through Registry mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Creation or Modification of Root Certificate lowRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Windows Defender Disabled via Registry Modification lowRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
PowerShell Script Block Logging Disabled mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
DNS-over-HTTPS Enabled via Registry lowRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Disabling Lsa Protection via Registry Modification highRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Microsoft Windows Defender Tampering mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
MS Office Macro Security Registry Modifications mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Local Account TokenFilter Policy Disabled mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
DNS Global Query Block List Modified or Disabled mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Scheduled Tasks AT Command Enabled mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
SIP Provider Modification mediumRelated:
  • Sysmon Event ID 13: RegistryEvent (Value Set)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Show all 44 rules (29 more)

Channel: Operational Event ID 13: RegistryEvent (Value Set) (53 medium)

EQL category registry wheremedium confidence: 9 rules
Outlook Home Page Registry Modification highRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Full User-Mode Dumps Enabled System-Wide mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Modification of WDigest Security Provider highRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Network-Level Authentication (NLA) Disabled lowRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Deprecated - Encoded Executable Stored in the Registry mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Potential NetNTLMv1 Downgrade Attack mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Potential RemoteMonologue Attack mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Office Test Registry Persistence lowRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Suspicious Print Spooler Point and Print DLL highRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
EQL category registry where → change medium confidence: 44 rules
Port Forwarding Rule Addition mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Network Logon Provider Registry Modification mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Modification of AmsiEnable Registry Key highRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Code Signing Policy Modification Through Registry mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Creation or Modification of Root Certificate lowRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Windows Defender Disabled via Registry Modification lowRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
PowerShell Script Block Logging Disabled mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
DNS-over-HTTPS Enabled via Registry lowRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Disabling Lsa Protection via Registry Modification highRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Microsoft Windows Defender Tampering mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
MS Office Macro Security Registry Modifications mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Local Account TokenFilter Policy Disabled mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
DNS Global Query Block List Modified or Disabled mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Scheduled Tasks AT Command Enabled mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
SIP Provider Modification mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 14: RegistryEvent (Key and Value Rename)
Show all 44 rules (29 more)

Channel: Operational Event ID 14: RegistryEvent (Key and Value Rename) (53 medium)

EQL category registry wheremedium confidence: 9 rules
Outlook Home Page Registry Modification highRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Full User-Mode Dumps Enabled System-Wide mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Modification of WDigest Security Provider highRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Network-Level Authentication (NLA) Disabled lowRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Deprecated - Encoded Executable Stored in the Registry mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Potential NetNTLMv1 Downgrade Attack mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Potential RemoteMonologue Attack mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Office Test Registry Persistence lowRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Suspicious Print Spooler Point and Print DLL highRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
EQL category registry where → change medium confidence: 44 rules
Port Forwarding Rule Addition mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Network Logon Provider Registry Modification mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Modification of AmsiEnable Registry Key highRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Code Signing Policy Modification Through Registry mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Creation or Modification of Root Certificate lowRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Windows Defender Disabled via Registry Modification lowRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
PowerShell Script Block Logging Disabled mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
DNS-over-HTTPS Enabled via Registry lowRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Disabling Lsa Protection via Registry Modification highRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Microsoft Windows Defender Tampering mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
MS Office Macro Security Registry Modifications mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Local Account TokenFilter Policy Disabled mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
DNS Global Query Block List Modified or Disabled mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Scheduled Tasks AT Command Enabled mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
SIP Provider Modification mediumRelated:
  • Sysmon Event ID 12: RegistryEvent (Object create and delete)
  • Sysmon Event ID 13: RegistryEvent (Value Set)
Show all 44 rules (29 more)

Channel: Operational Event ID 15: FileCreateStreamHash (39 medium)

EQL category file wheremedium confidence: 39 rules
GenAI Process Accessing Sensitive Files highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
ROT Encoded Python Script Execution mediumRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential SAP NetWeaver WebShell Creation highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Initial Access via File Upload Followed by GET Request mediumRelated:
  • Sysmon Event ID 3: Network connection
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Ingress Transfer via Windows BITS lowRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Creation or Modification of Domain Backup DPAPI private key highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
LSASS Memory Dump Creation highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Mimikatz Memssp Log File Detected highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Sensitive Registry Hive Access via RegBack highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential Remote Credential Access via Registry highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Suspicious Antimalware Scan Interface DLL highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Suspicious Managed Code Hosting Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Unusual Executable File Creation by a System Critical Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential Timestomp in Executable Files mediumRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
WDAC Policy File by an Unusual Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 23: FileDelete (File Delete archived)
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Show all 39 rules (24 more)

Channel: Operational Event ID 23: FileDelete (File Delete archived) (42 medium)

EQL category file wheremedium confidence: 39 rules
GenAI Process Accessing Sensitive Files highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
ROT Encoded Python Script Execution mediumRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential SAP NetWeaver WebShell Creation highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Initial Access via File Upload Followed by GET Request mediumRelated:
  • Sysmon Event ID 3: Network connection
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Ingress Transfer via Windows BITS lowRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Creation or Modification of Domain Backup DPAPI private key highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
LSASS Memory Dump Creation highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Mimikatz Memssp Log File Detected highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Sensitive Registry Hive Access via RegBack highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential Remote Credential Access via Registry highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Suspicious Antimalware Scan Interface DLL highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Suspicious Managed Code Hosting Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Unusual Executable File Creation by a System Critical Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Potential Timestomp in Executable Files mediumRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
WDAC Policy File by an Unusual Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Show all 39 rules (24 more)
EQL category file where → deletion medium confidence: 3 rules
WebServer Access Logs Deleted mediumRelated:
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Third-party Backup Files Deleted via Unexpected Process mediumRelated:
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)
Suspicious Print Spooler File Deletion mediumRelated:
  • Sysmon Event ID 26: FileDeleteDetected (File Delete logged)

Channel: Operational Event ID 26: FileDeleteDetected (File Delete logged) (42 medium)

EQL category file wheremedium confidence: 39 rules
GenAI Process Accessing Sensitive Files highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
ROT Encoded Python Script Execution mediumRelated:
  • Sysmon Event ID 1: Process creation
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Potential SAP NetWeaver WebShell Creation highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Initial Access via File Upload Followed by GET Request mediumRelated:
  • Sysmon Event ID 3: Network connection
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Ingress Transfer via Windows BITS lowRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Creation or Modification of Domain Backup DPAPI private key highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
LSASS Memory Dump Creation highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Mimikatz Memssp Log File Detected highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Sensitive Registry Hive Access via RegBack highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Potential Remote Credential Access via Registry highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Suspicious Antimalware Scan Interface DLL highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Suspicious Managed Code Hosting Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Unusual Executable File Creation by a System Critical Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Potential Timestomp in Executable Files mediumRelated:
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
WDAC Policy File by an Unusual Process highRelated:
  • Sysmon Event ID 2: A process changed a file creation time
  • Sysmon Event ID 11: FileCreate
  • Sysmon Event ID 15: FileCreateStreamHash
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Show all 39 rules (24 more)
EQL category file where → deletion medium confidence: 3 rules
WebServer Access Logs Deleted mediumRelated:
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Third-party Backup Files Deleted via Unexpected Process mediumRelated:
  • Sysmon Event ID 23: FileDelete (File Delete archived)
Suspicious Print Spooler File Deletion mediumRelated:
  • Sysmon Event ID 23: FileDelete (File Delete archived)