Detection rules

15,987 catalog-relevant detection rules from Sigma, Elastic, Splunk, Kusto, Panther, and Sublime, indexed by ATT&CK tactic and technique. Each page shows its parsed predicates, exclusions, and shared indicators. Looking for something specific? Search the library.

MITRE ATT&CK Enterprise

Other frameworks MITRE ATT&CK Mobile / ICS, MITRE ATLAS, Email threats, Other detection categories

MITRE ATT&CK Mobile

MITRE ATT&CK ICS

MITRE ATLAS

Email threats Sublime taxonomy

Other categories

View all secondary frameworks

Reconnaissance

Gather Victim Identity Information T1589 9 rules

Gather Victim Identity Information: Credentials T1589.001 2 rules

Gather Victim Identity Information: Email Addresses T1589.002 3 rules

Gather Victim Identity Information: Employee Names T1589.003 1 rule

Gather Victim Network Information T1590 18 rules

Gather Victim Network Information: Domain Properties T1590.001 2 rules

Gather Victim Network Information: DNS T1590.002 2 rules

Gather Victim Network Information: IP Addresses T1590.005 4 rules

Gather Victim Org Information T1591 5 rules

Gather Victim Org Information: Identify Roles T1591.004 2 rules

Gather Victim Host Information T1592 13 rules

Gather Victim Host Information: Hardware T1592.001 1 rule

Gather Victim Host Information: Software T1592.002 1 rule

Gather Victim Host Information: Client Configurations T1592.004 5 rules

Search Open Websites/Domains T1593 4 rules

Search Open Websites/Domains: Code Repositories T1593.003 2 rules

Active Scanning T1595 68 rules

Active Scanning: Scanning IP Blocks T1595.001 13 rules

Active Scanning: Vulnerability Scanning T1595.002 16 rules

Active Scanning: Wordlist Scanning T1595.003 9 rules

Search Open Technical Databases T1596 1 rule

Phishing for Information T1598 9 rules

Phishing for Information: Spearphishing Attachment T1598.002 2 rules

No specific technique 8 rules

Resource Development

Acquire Infrastructure T1583 6 rules

Acquire Infrastructure: Domains T1583.001 1 rule

Acquire Infrastructure: Web Services T1583.006 2 rules

Compromise Infrastructure T1584 12 rules

Compromise Infrastructure: Domains T1584.001 3 rules

Compromise Infrastructure: DNS Server T1584.002 1 rule

Establish Accounts T1585 2 rules

Establish Accounts: Cloud Accounts T1585.003 1 rule

Compromise Accounts T1586 41 rules

Compromise Accounts: Cloud Accounts T1586.003 36 rules

Develop Capabilities T1587 24 rules

Develop Capabilities: Malware T1587.001 14 rules

Develop Capabilities: Code Signing Certificates T1587.002 1 rule

Develop Capabilities: Digital Certificates T1587.003 1 rule

Obtain Capabilities T1588 22 rules

Obtain Capabilities: Malware T1588.001 2 rules

Obtain Capabilities: Tool T1588.002 13 rules

Obtain Capabilities: Digital Certificates T1588.004 1 rule

Stage Capabilities T1608 14 rules

Stage Capabilities: Upload Malware T1608.001 3 rules

Stage Capabilities: Upload Tool T1608.002 1 rule

Stage Capabilities: Install Digital Certificate T1608.003 1 rule

No specific technique 1 rule

Initial Access

Valid Accounts T1078 782 rules

Valid Accounts: Default Accounts T1078.001 17 rules

Valid Accounts: Domain Accounts T1078.002 35 rules

Valid Accounts: Local Accounts T1078.003 23 rules

Valid Accounts: Cloud Accounts T1078.004 311 rules

Replication Through Removable Media T1091 11 rules

External Remote Services T1133 222 rules

Drive-by Compromise T1189 46 rules

Exploit Public-Facing Application T1190 549 rules

Supply Chain Compromise T1195 97 rules

Supply Chain Compromise: Compromise Software Dependencies and Development Tools T1195.001 21 rules

Supply Chain Compromise: Compromise Software Supply Chain T1195.002 56 rules

Trusted Relationship T1199 18 rules

Hardware Additions T1200 15 rules

Phishing T1566 351 rules

Phishing: Spearphishing Attachment T1566.001 164 rules

Phishing: Spearphishing Link T1566.002 78 rules

Phishing: Spearphishing via Service T1566.003 2 rules

Content Injection T1659 4 rules

No specific technique 30 rules

Execution

Windows Management Instrumentation T1047 140 rules

Scheduled Task/Job T1053 222 rules

Scheduled Task/Job: At T1053.002 19 rules

Scheduled Task/Job: Cron T1053.003 38 rules

Scheduled Task/Job: Scheduled Task T1053.005 130 rules

Scheduled Task/Job: Systemd Timers T1053.006 6 rules

Scheduled Task/Job: Container Orchestration Job T1053.007 4 rules

Command and Scripting Interpreter T1059 1505 rules

Command and Scripting Interpreter: PowerShell T1059.001 551 rules

Command and Scripting Interpreter: AppleScript T1059.002 49 rules

Command and Scripting Interpreter: Windows Command Shell T1059.003 179 rules

Command and Scripting Interpreter: Unix Shell T1059.004 341 rules

Command and Scripting Interpreter: Visual Basic T1059.005 113 rules

Command and Scripting Interpreter: Python T1059.006 88 rules

Command and Scripting Interpreter: JavaScript T1059.007 157 rules

Command and Scripting Interpreter: Cloud API T1059.009 6 rules

Command and Scripting Interpreter: AutoHotKey & AutoIT T1059.010 1 rule

Command and Scripting Interpreter: Lua T1059.011 14 rules

Command and Scripting Interpreter: Hypervisor CLI T1059.012 9 rules

Command and Scripting Interpreter: Container CLI/API T1059.013 1 rule

Software Deployment Tools T1072 30 rules

Native API T1106 58 rules

Trusted Developer Utilities Proxy Execution T1127 59 rules

Trusted Developer Utilities Proxy Execution: MSBuild T1127.001 23 rules

Trusted Developer Utilities Proxy Execution: ClickOnce T1127.002 1 rule

Shared Modules T1129 23 rules

BITS Jobs T1197 39 rules

Exploitation for Client Execution T1203 129 rules

User Execution T1204 322 rules

User Execution: Malicious Link T1204.001 31 rules

User Execution: Malicious File T1204.002 190 rules

User Execution: Malicious Image T1204.003 10 rules

User Execution: Malicious Copy and Paste T1204.004 10 rules

User Execution: Malicious Library T1204.005 1 rule

Inter-Process Communication T1559 38 rules

Inter-Process Communication: Component Object Model T1559.001 19 rules

Inter-Process Communication: Dynamic Data Exchange T1559.002 1 rule

Inter-Process Communication: XPC Services T1559.003 4 rules

System Services T1569 106 rules

System Services: Launchctl T1569.001 4 rules

System Services: Service Execution T1569.002 87 rules

Hijack Execution Flow T1574 321 rules

Hijack Execution Flow: DLL T1574.001 173 rules

Hijack Execution Flow: Dylib Hijacking T1574.004 1 rule

Hijack Execution Flow: Executable Installer File Permissions Weakness T1574.005 2 rules

Hijack Execution Flow: Dynamic Linker Hijacking T1574.006 26 rules

Hijack Execution Flow: Path Interception by PATH Environment Variable T1574.007 11 rules

Hijack Execution Flow: Path Interception by Search Order Hijacking T1574.008 6 rules

Hijack Execution Flow: Path Interception by Unquoted Path T1574.009 4 rules

Hijack Execution Flow: Services File Permissions Weakness T1574.010 7 rules

Hijack Execution Flow: Services Registry Permissions Weakness T1574.011 17 rules

Hijack Execution Flow: COR_PROFILER T1574.012 2 rules

Hijack Execution Flow: KernelCallbackTable T1574.013 2 rules

Hijack Execution Flow: AppDomainManager T1574.014 1 rule

Container Administration Command T1609 36 rules

Deploy Container T1610 33 rules

Serverless Execution T1648 17 rules

Cloud Administration Command T1651 27 rules

No specific technique 155 rules

Persistence

Boot or Logon Initialization Scripts T1037 52 rules

Boot or Logon Initialization Scripts: Logon Script (Windows) T1037.001 7 rules

Boot or Logon Initialization Scripts: Login Hook T1037.002 3 rules

Boot or Logon Initialization Scripts: RC Scripts T1037.004 12 rules

Boot or Logon Initialization Scripts: Startup Items T1037.005 3 rules

Scheduled Task/Job T1053 222 rules

Scheduled Task/Job: At T1053.002 19 rules

Scheduled Task/Job: Cron T1053.003 38 rules

Scheduled Task/Job: Scheduled Task T1053.005 130 rules

Scheduled Task/Job: Systemd Timers T1053.006 6 rules

Scheduled Task/Job: Container Orchestration Job T1053.007 4 rules

Valid Accounts T1078 782 rules

Valid Accounts: Default Accounts T1078.001 17 rules

Valid Accounts: Domain Accounts T1078.002 35 rules

Valid Accounts: Local Accounts T1078.003 23 rules

Valid Accounts: Cloud Accounts T1078.004 311 rules

Account Manipulation T1098 568 rules

Account Manipulation: Additional Cloud Credentials T1098.001 59 rules

Account Manipulation: Additional Email Delegate Permissions T1098.002 8 rules

Account Manipulation: Additional Cloud Roles T1098.003 111 rules

Account Manipulation: SSH Authorized Keys T1098.004 13 rules

Account Manipulation: Device Registration T1098.005 27 rules

Account Manipulation: Additional Container Cluster Roles T1098.006 23 rules

Account Manipulation: Additional Local or Domain Groups T1098.007 9 rules

Redundant Access T1108 3 rules

Modify Registry T1112 307 rules

External Remote Services T1133 222 rules

Create Account T1136 162 rules

Create Account: Local Account T1136.001 48 rules

Create Account: Domain Account T1136.002 18 rules

Create Account: Cloud Account T1136.003 56 rules

Office Application Startup T1137 33 rules

Office Application Startup: Office Template Macros T1137.001 2 rules

Office Application Startup: Office Test T1137.002 3 rules

Office Application Startup: Outlook Forms T1137.003 1 rule

Office Application Startup: Outlook Home Page T1137.004 2 rules

Office Application Startup: Outlook Rules T1137.005 3 rules

Office Application Startup: Add-ins T1137.006 8 rules

Software Extensions T1176 15 rules

Software Extensions: Browser Extensions T1176.001 10 rules

BITS Jobs T1197 39 rules

Traffic Signaling T1205 1 rule

Traffic Signaling: Port Knocking T1205.001 1 rule

Server Software Component T1505 158 rules

Server Software Component: SQL Stored Procedures T1505.001 20 rules

Server Software Component: Transport Agent T1505.002 8 rules

Server Software Component: Web Shell T1505.003 86 rules

Server Software Component: IIS Components T1505.004 22 rules

Server Software Component: Terminal Services DLL T1505.005 1 rule

Server Software Component: vSphere Installation Bundles T1505.006 1 rule

Implant Internal Image T1525 5 rules

Pre-OS Boot T1542 20 rules

Pre-OS Boot: System Firmware T1542.001 6 rules

Pre-OS Boot: Bootkit T1542.003 5 rules

Pre-OS Boot: TFTP Boot T1542.005 1 rule

Create or Modify System Process T1543 251 rules

Create or Modify System Process: Launch Agent T1543.001 15 rules

Create or Modify System Process: Systemd Service T1543.002 20 rules

Create or Modify System Process: Windows Service T1543.003 134 rules

Create or Modify System Process: Launch Daemon T1543.004 11 rules

Create or Modify System Process: Container Service T1543.005 2 rules

Event Triggered Execution T1546 241 rules

Event Triggered Execution: Change Default File Association T1546.001 8 rules

Event Triggered Execution: Screensaver T1546.002 9 rules

Event Triggered Execution: Windows Management Instrumentation Event Subscription T1546.003 24 rules

Event Triggered Execution: Unix Shell Configuration Modification T1546.004 17 rules

Event Triggered Execution: Trap T1546.005 1 rule

Event Triggered Execution: Netsh Helper DLL T1546.007 7 rules

Event Triggered Execution: Accessibility Features T1546.008 22 rules

Event Triggered Execution: AppCert DLLs T1546.009 6 rules

Event Triggered Execution: AppInit DLLs T1546.010 3 rules

Event Triggered Execution: Application Shimming T1546.011 11 rules

Event Triggered Execution: Image File Execution Options Injection T1546.012 12 rules

Event Triggered Execution: PowerShell Profile T1546.013 4 rules

Event Triggered Execution: Emond T1546.014 4 rules

Event Triggered Execution: Component Object Model Hijacking T1546.015 27 rules

Event Triggered Execution: Installer Packages T1546.016 15 rules

Event Triggered Execution: Udev Rules T1546.017 3 rules

Event Triggered Execution: Python Startup Hooks T1546.018 2 rules

Boot or Logon Autostart Execution T1547 252 rules

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001 115 rules

Boot or Logon Autostart Execution: Authentication Package T1547.002 9 rules

Boot or Logon Autostart Execution: Time Providers T1547.003 3 rules

Boot or Logon Autostart Execution: Winlogon Helper DLL T1547.004 9 rules

Boot or Logon Autostart Execution: Security Support Provider T1547.005 8 rules

Boot or Logon Autostart Execution: Kernel Modules and Extensions T1547.006 37 rules

Boot or Logon Autostart Execution: LSASS Driver T1547.008 4 rules

Boot or Logon Autostart Execution: Shortcut Modification T1547.009 15 rules

Boot or Logon Autostart Execution: Port Monitors T1547.010 11 rules

Boot or Logon Autostart Execution: Print Processors T1547.012 8 rules

Boot or Logon Autostart Execution: XDG Autostart Entries T1547.013 5 rules

Boot or Logon Autostart Execution: Active Setup T1547.014 4 rules

Boot or Logon Autostart Execution: Login Items T1547.015 2 rules

Compromise Host Software Binary T1554 39 rules

Modify Authentication Process T1556 161 rules

Modify Authentication Process: Password Filter DLL T1556.002 6 rules

Modify Authentication Process: Pluggable Authentication Modules T1556.003 6 rules

Modify Authentication Process: Network Device Authentication T1556.004 2 rules

Modify Authentication Process: Multi-Factor Authentication T1556.006 33 rules

Modify Authentication Process: Hybrid Identity T1556.007 6 rules

Modify Authentication Process: Network Provider DLL T1556.008 1 rule

Modify Authentication Process: Conditional Access Policies T1556.009 14 rules

Power Settings T1653 1 rule

No specific technique 97 rules

Privilege Escalation

Boot or Logon Initialization Scripts T1037 52 rules

Boot or Logon Initialization Scripts: Logon Script (Windows) T1037.001 7 rules

Boot or Logon Initialization Scripts: Login Hook T1037.002 3 rules

Boot or Logon Initialization Scripts: RC Scripts T1037.004 12 rules

Boot or Logon Initialization Scripts: Startup Items T1037.005 3 rules

Scheduled Task/Job T1053 222 rules

Scheduled Task/Job: At T1053.002 19 rules

Scheduled Task/Job: Cron T1053.003 38 rules

Scheduled Task/Job: Scheduled Task T1053.005 130 rules

Scheduled Task/Job: Systemd Timers T1053.006 6 rules

Scheduled Task/Job: Container Orchestration Job T1053.007 4 rules

Process Injection T1055 329 rules

Process Injection: Dynamic-link Library Injection T1055.001 20 rules

Process Injection: Portable Executable Injection T1055.002 7 rules

Process Injection: Thread Execution Hijacking T1055.003 4 rules

Process Injection: Asynchronous Procedure Call T1055.004 4 rules

Process Injection: Ptrace System Calls T1055.008 4 rules

Process Injection: Proc Memory T1055.009 15 rules

Process Injection: Extra Window Memory Injection T1055.011 1 rule

Process Injection: Process Hollowing T1055.012 11 rules

Process Injection: Process Doppelgänging T1055.013 2 rules

Exploitation for Privilege Escalation T1068 231 rules

Valid Accounts T1078 782 rules

Valid Accounts: Default Accounts T1078.001 17 rules

Valid Accounts: Domain Accounts T1078.002 35 rules

Valid Accounts: Local Accounts T1078.003 23 rules

Valid Accounts: Cloud Accounts T1078.004 311 rules

Account Manipulation T1098 568 rules

Account Manipulation: Additional Cloud Credentials T1098.001 59 rules

Account Manipulation: Additional Email Delegate Permissions T1098.002 8 rules

Account Manipulation: Additional Cloud Roles T1098.003 111 rules

Account Manipulation: SSH Authorized Keys T1098.004 13 rules

Account Manipulation: Device Registration T1098.005 27 rules

Account Manipulation: Additional Container Cluster Roles T1098.006 23 rules

Account Manipulation: Additional Local or Domain Groups T1098.007 9 rules

Access Token Manipulation T1134 98 rules

Access Token Manipulation: Token Impersonation/Theft T1134.001 31 rules

Access Token Manipulation: Create Process with Token T1134.002 30 rules

Access Token Manipulation: Make and Impersonate Token T1134.003 8 rules

Access Token Manipulation: Parent PID Spoofing T1134.004 12 rules

Access Token Manipulation: SID-History Injection T1134.005 6 rules

Domain or Tenant Policy Modification T1484 92 rules

Domain or Tenant Policy Modification: Group Policy Modification T1484.001 29 rules

Domain or Tenant Policy Modification: Trust Modification T1484.002 17 rules

Create or Modify System Process T1543 251 rules

Create or Modify System Process: Launch Agent T1543.001 15 rules

Create or Modify System Process: Systemd Service T1543.002 20 rules

Create or Modify System Process: Windows Service T1543.003 134 rules

Create or Modify System Process: Launch Daemon T1543.004 11 rules

Create or Modify System Process: Container Service T1543.005 2 rules

Event Triggered Execution T1546 241 rules

Event Triggered Execution: Change Default File Association T1546.001 8 rules

Event Triggered Execution: Screensaver T1546.002 9 rules

Event Triggered Execution: Windows Management Instrumentation Event Subscription T1546.003 24 rules

Event Triggered Execution: Unix Shell Configuration Modification T1546.004 17 rules

Event Triggered Execution: Trap T1546.005 1 rule

Event Triggered Execution: Netsh Helper DLL T1546.007 7 rules

Event Triggered Execution: Accessibility Features T1546.008 22 rules

Event Triggered Execution: AppCert DLLs T1546.009 6 rules

Event Triggered Execution: AppInit DLLs T1546.010 3 rules

Event Triggered Execution: Application Shimming T1546.011 11 rules

Event Triggered Execution: Image File Execution Options Injection T1546.012 12 rules

Event Triggered Execution: PowerShell Profile T1546.013 4 rules

Event Triggered Execution: Emond T1546.014 4 rules

Event Triggered Execution: Component Object Model Hijacking T1546.015 27 rules

Event Triggered Execution: Installer Packages T1546.016 15 rules

Event Triggered Execution: Udev Rules T1546.017 3 rules

Event Triggered Execution: Python Startup Hooks T1546.018 2 rules

Boot or Logon Autostart Execution T1547 252 rules

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001 115 rules

Boot or Logon Autostart Execution: Authentication Package T1547.002 9 rules

Boot or Logon Autostart Execution: Time Providers T1547.003 3 rules

Boot or Logon Autostart Execution: Winlogon Helper DLL T1547.004 9 rules

Boot or Logon Autostart Execution: Security Support Provider T1547.005 8 rules

Boot or Logon Autostart Execution: Kernel Modules and Extensions T1547.006 37 rules

Boot or Logon Autostart Execution: LSASS Driver T1547.008 4 rules

Boot or Logon Autostart Execution: Shortcut Modification T1547.009 15 rules

Boot or Logon Autostart Execution: Port Monitors T1547.010 11 rules

Boot or Logon Autostart Execution: Print Processors T1547.012 8 rules

Boot or Logon Autostart Execution: XDG Autostart Entries T1547.013 5 rules

Boot or Logon Autostart Execution: Active Setup T1547.014 4 rules

Boot or Logon Autostart Execution: Login Items T1547.015 2 rules

Abuse Elevation Control Mechanism T1548 365 rules

Abuse Elevation Control Mechanism: Setuid and Setgid T1548.001 44 rules

Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002 137 rules

Abuse Elevation Control Mechanism: Sudo and Sudo Caching T1548.003 60 rules

Abuse Elevation Control Mechanism: Elevated Execution with Prompt T1548.004 3 rules

Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access T1548.005 7 rules

Abuse Elevation Control Mechanism: TCC Manipulation T1548.006 7 rules

Escape to Host T1611 62 rules

No specific technique 50 rules

Stealth

Direct Volume Access T1006 8 rules

Rootkit T1014 37 rules

Obfuscated Files or Information T1027 284 rules

Obfuscated Files or Information: Binary Padding T1027.001 11 rules

Obfuscated Files or Information: Software Packing T1027.002 2 rules

Obfuscated Files or Information: Steganography T1027.003 5 rules

Obfuscated Files or Information: Compile After Delivery T1027.004 15 rules

Obfuscated Files or Information: Indicator Removal from Tools T1027.005 6 rules

Obfuscated Files or Information: HTML Smuggling T1027.006 2 rules

Obfuscated Files or Information: Embedded Payloads T1027.009 3 rules

Obfuscated Files or Information: Command Obfuscation T1027.010 40 rules

Obfuscated Files or Information: Fileless Storage T1027.011 4 rules

Obfuscated Files or Information: Encrypted/Encoded File T1027.013 9 rules

Obfuscated Files or Information: Compression T1027.015 3 rules

Masquerading T1036 313 rules

Masquerading: Invalid Code Signature T1036.001 19 rules

Masquerading: Right-to-Left Override T1036.002 7 rules

Masquerading: Rename Legitimate Utilities T1036.003 60 rules

Masquerading: Masquerade Task or Service T1036.004 20 rules

Masquerading: Match Legitimate Resource Name or Location T1036.005 69 rules

Masquerading: Space after Filename T1036.006 3 rules

Masquerading: Double File Extension T1036.007 8 rules

Masquerading: Masquerade File Type T1036.008 9 rules

Masquerading: Break Process Trees T1036.009 7 rules

Process Injection T1055 329 rules

Process Injection: Dynamic-link Library Injection T1055.001 20 rules

Process Injection: Portable Executable Injection T1055.002 7 rules

Process Injection: Thread Execution Hijacking T1055.003 4 rules

Process Injection: Asynchronous Procedure Call T1055.004 4 rules

Process Injection: Ptrace System Calls T1055.008 4 rules

Process Injection: Proc Memory T1055.009 15 rules

Process Injection: Extra Window Memory Injection T1055.011 1 rule

Process Injection: Process Hollowing T1055.012 11 rules

Process Injection: Process Doppelgänging T1055.013 2 rules

Indicator Removal T1070 200 rules

Indicator Removal: Clear Command History T1070.003 21 rules

Indicator Removal: File Deletion T1070.004 59 rules

Indicator Removal: Network Share Connection Removal T1070.005 6 rules

Indicator Removal: Timestomp T1070.006 17 rules

Indicator Removal: Clear Mailbox Data T1070.008 10 rules

Indicator Removal: Clear Persistence T1070.009 2 rules

Valid Accounts T1078 782 rules

Valid Accounts: Default Accounts T1078.001 17 rules

Valid Accounts: Domain Accounts T1078.002 35 rules

Valid Accounts: Local Accounts T1078.003 23 rules

Valid Accounts: Cloud Accounts T1078.004 311 rules

Redundant Access T1108 3 rules

Trusted Developer Utilities Proxy Execution T1127 59 rules

Trusted Developer Utilities Proxy Execution: MSBuild T1127.001 23 rules

Trusted Developer Utilities Proxy Execution: ClickOnce T1127.002 1 rule

Access Token Manipulation T1134 98 rules

Access Token Manipulation: Token Impersonation/Theft T1134.001 31 rules

Access Token Manipulation: Create Process with Token T1134.002 30 rules

Access Token Manipulation: Make and Impersonate Token T1134.003 8 rules

Access Token Manipulation: Parent PID Spoofing T1134.004 12 rules

Access Token Manipulation: SID-History Injection T1134.005 6 rules

Deobfuscate/Decode Files or Information T1140 102 rules

BITS Jobs T1197 39 rules

Indirect Command Execution T1202 71 rules

Traffic Signaling T1205 1 rule

Traffic Signaling: Port Knocking T1205.001 1 rule

Exploitation for Stealth T1211 27 rules

System Script Proxy Execution T1216 22 rules

System Script Proxy Execution: PubPrn T1216.001 3 rules

System Binary Proxy Execution T1218 672 rules

System Binary Proxy Execution: Compiled HTML File T1218.001 27 rules

System Binary Proxy Execution: Control Panel T1218.002 14 rules

System Binary Proxy Execution: CMSTP T1218.003 27 rules

System Binary Proxy Execution: InstallUtil T1218.004 22 rules

System Binary Proxy Execution: Mshta T1218.005 79 rules

System Binary Proxy Execution: Msiexec T1218.007 69 rules

System Binary Proxy Execution: Odbcconf T1218.008 18 rules

System Binary Proxy Execution: Regsvcs/Regasm T1218.009 21 rules

System Binary Proxy Execution: Regsvr32 T1218.010 69 rules

System Binary Proxy Execution: Rundll32 T1218.011 152 rules

System Binary Proxy Execution: Verclsid T1218.012 1 rule

System Binary Proxy Execution: Mavinject T1218.013 3 rules

System Binary Proxy Execution: MMC T1218.014 25 rules

XSL Script Processing T1220 20 rules

Template Injection T1221 2 rules

Execution Guardrails T1480 2 rules

Virtualization/Sandbox Evasion T1497 21 rules

Virtualization/Sandbox Evasion: System Checks T1497.001 9 rules

Virtualization/Sandbox Evasion: Time Based Checks T1497.003 4 rules

Unused/Unsupported Cloud Regions T1535 10 rules

Pre-OS Boot T1542 20 rules

Pre-OS Boot: System Firmware T1542.001 6 rules

Pre-OS Boot: Bootkit T1542.003 5 rules

Pre-OS Boot: TFTP Boot T1542.005 1 rule

Hide Artifacts T1564 170 rules

Hide Artifacts: Hidden Files and Directories T1564.001 39 rules

Hide Artifacts: Hidden Users T1564.002 11 rules

Hide Artifacts: Hidden Window T1564.003 18 rules

Hide Artifacts: NTFS File Attributes T1564.004 35 rules

Hide Artifacts: Run Virtual Instance T1564.006 10 rules

Hide Artifacts: Email Hiding Rules T1564.008 9 rules

Hijack Execution Flow T1574 321 rules

Hijack Execution Flow: DLL T1574.001 173 rules

Hijack Execution Flow: Dylib Hijacking T1574.004 1 rule

Hijack Execution Flow: Executable Installer File Permissions Weakness T1574.005 2 rules

Hijack Execution Flow: Dynamic Linker Hijacking T1574.006 26 rules

Hijack Execution Flow: Path Interception by PATH Environment Variable T1574.007 11 rules

Hijack Execution Flow: Path Interception by Search Order Hijacking T1574.008 6 rules

Hijack Execution Flow: Path Interception by Unquoted Path T1574.009 4 rules

Hijack Execution Flow: Services File Permissions Weakness T1574.010 7 rules

Hijack Execution Flow: Services Registry Permissions Weakness T1574.011 17 rules

Hijack Execution Flow: COR_PROFILER T1574.012 2 rules

Hijack Execution Flow: KernelCallbackTable T1574.013 2 rules

Hijack Execution Flow: AppDomainManager T1574.014 1 rule

Reflective Code Loading T1620 44 rules

Debugger Evasion T1622 2 rules

Social Engineering: Impersonation T1684.001 1 rule

No specific technique 147 rules

Defense Impairment

Modify Registry T1112 307 rules

Rogue Domain Controller T1207 13 rules

File and Directory Permissions Modification T1222 88 rules

File and Directory Permissions Modification: Windows Permissions T1222.001 45 rules

File and Directory Permissions Modification: Linux and Mac Permissions T1222.002 23 rules

Domain or Tenant Policy Modification T1484 92 rules

Domain or Tenant Policy Modification: Group Policy Modification T1484.001 29 rules

Domain or Tenant Policy Modification: Trust Modification T1484.002 17 rules

Subvert Trust Controls T1553 67 rules

Subvert Trust Controls: Gatekeeper Bypass T1553.001 13 rules

Subvert Trust Controls: Code Signing T1553.002 6 rules

Subvert Trust Controls: SIP and Trust Provider Hijacking T1553.003 7 rules

Subvert Trust Controls: Install Root Certificate T1553.004 17 rules

Subvert Trust Controls: Mark-of-the-Web Bypass T1553.005 14 rules

Subvert Trust Controls: Code Signing Policy Modification T1553.006 2 rules

Modify Authentication Process T1556 161 rules

Modify Authentication Process: Password Filter DLL T1556.002 6 rules

Modify Authentication Process: Pluggable Authentication Modules T1556.003 6 rules

Modify Authentication Process: Network Device Authentication T1556.004 2 rules

Modify Authentication Process: Multi-Factor Authentication T1556.006 33 rules

Modify Authentication Process: Hybrid Identity T1556.007 6 rules

Modify Authentication Process: Network Provider DLL T1556.008 1 rule

Modify Authentication Process: Conditional Access Policies T1556.009 14 rules

Modify Cloud Compute Infrastructure T1578 36 rules

Modify Cloud Compute Infrastructure: Create Snapshot T1578.001 1 rule

Modify Cloud Compute Infrastructure: Create Cloud Instance T1578.002 5 rules

Modify Cloud Compute Infrastructure: Delete Cloud Instance T1578.003 2 rules

Modify Cloud Compute Infrastructure: Revert Cloud Instance T1578.004 1 rule

Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations T1578.005 19 rules

Network Boundary Bridging T1599 7 rules

Network Boundary Bridging: Network Address Translation Traversal T1599.001 1 rule

Weaken Encryption T1600 3 rules

Weaken Encryption: Reduce Key Space T1600.001 2 rules

Modify System Image T1601 2 rules

Modify System Image: Patch System Image T1601.001 2 rules

Plist File Modification T1647 14 rules

Modify Cloud Resource Hierarchy T1666 1 rule

Disable or Modify Tools T1685 883 rules

Disable or Modify Tools: Disable or Modify Windows Event Log T1685.001 53 rules

Disable or Modify Tools: Disable or Modify Cloud Log T1685.002 91 rules

Disable or Modify Tools: Disable or Modify Linux Audit System Log T1685.004 4 rules

Disable or Modify Tools: Clear Windows Event Logs T1685.005 28 rules

Disable or Modify Tools: Clear Linux or Mac System Logs T1685.006 13 rules

Disable or Modify System Firewall T1686 79 rules

Disable or Modify System Firewall: Cloud Firewall T1686.001 66 rules

Disable or Modify System Firewall: Network Device Firewall T1686.002 2 rules

Disable or Modify System Firewall: Windows Host Firewall T1686.003 20 rules

Safe Mode Boot T1688 1 rule

Downgrade Attack T1689 7 rules

Prevent Command History Logging T1690 4 rules

No specific technique 26 rules

Credential Access

OS Credential Dumping T1003 423 rules

OS Credential Dumping: LSASS Memory T1003.001 176 rules

OS Credential Dumping: Security Account Manager T1003.002 66 rules

OS Credential Dumping: NTDS T1003.003 60 rules

OS Credential Dumping: LSA Secrets T1003.004 26 rules

OS Credential Dumping: Cached Domain Credentials T1003.005 19 rules

OS Credential Dumping: DCSync T1003.006 26 rules

OS Credential Dumping: Proc Filesystem T1003.007 9 rules

OS Credential Dumping: /etc/passwd and /etc/shadow T1003.008 17 rules

Network Sniffing T1040 25 rules

Input Capture T1056 35 rules

Input Capture: Keylogging T1056.001 17 rules

Input Capture: GUI Input Capture T1056.002 9 rules

Input Capture: Credential API Hooking T1056.004 3 rules

Brute Force T1110 304 rules

Brute Force: Password Guessing T1110.001 48 rules

Brute Force: Password Cracking T1110.002 3 rules

Brute Force: Password Spraying T1110.003 85 rules

Brute Force: Credential Stuffing T1110.004 32 rules

Multi-Factor Authentication Interception T1111 4 rules

Forced Authentication T1187 30 rules

Exploitation for Credential Access T1212 23 rules

Steal Application Access Token T1528 80 rules

Steal Web Session Cookie T1539 34 rules

Unsecured Credentials T1552 268 rules

Unsecured Credentials: Credentials In Files T1552.001 103 rules

Unsecured Credentials: Credentials in Registry T1552.002 10 rules

Unsecured Credentials: Shell History T1552.003 4 rules

Unsecured Credentials: Private Keys T1552.004 31 rules

Unsecured Credentials: Cloud Instance Metadata API T1552.005 18 rules

Unsecured Credentials: Group Policy Preferences T1552.006 10 rules

Unsecured Credentials: Container API T1552.007 33 rules

Unsecured Credentials: Chat Messages T1552.008 2 rules

Credentials from Password Stores T1555 149 rules

Credentials from Password Stores: Keychain T1555.001 20 rules

Credentials from Password Stores: Credentials from Web Browsers T1555.003 32 rules

Credentials from Password Stores: Windows Credential Manager T1555.004 27 rules

Credentials from Password Stores: Password Managers T1555.005 4 rules

Credentials from Password Stores: Cloud Secrets Management Stores T1555.006 8 rules

Modify Authentication Process T1556 161 rules

Modify Authentication Process: Password Filter DLL T1556.002 6 rules

Modify Authentication Process: Pluggable Authentication Modules T1556.003 6 rules

Modify Authentication Process: Network Device Authentication T1556.004 2 rules

Modify Authentication Process: Multi-Factor Authentication T1556.006 33 rules

Modify Authentication Process: Hybrid Identity T1556.007 6 rules

Modify Authentication Process: Network Provider DLL T1556.008 1 rule

Modify Authentication Process: Conditional Access Policies T1556.009 14 rules

Adversary-in-the-Middle T1557 69 rules

Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay T1557.001 28 rules

Adversary-in-the-Middle: ARP Cache Poisoning T1557.002 3 rules

Adversary-in-the-Middle: DHCP Spoofing T1557.003 2 rules

Steal or Forge Kerberos Tickets T1558 97 rules

Steal or Forge Kerberos Tickets: Golden Ticket T1558.001 14 rules

Steal or Forge Kerberos Tickets: Silver Ticket T1558.002 7 rules

Steal or Forge Kerberos Tickets: Kerberoasting T1558.003 44 rules

Steal or Forge Kerberos Tickets: AS-REP Roasting T1558.004 10 rules

Steal or Forge Kerberos Tickets: Ccache Files T1558.005 4 rules

Forge Web Credentials T1606 17 rules

Forge Web Credentials: Web Cookies T1606.001 1 rule

Forge Web Credentials: SAML Tokens T1606.002 2 rules

Multi-Factor Authentication Request Generation T1621 31 rules

Steal or Forge Authentication Certificates T1649 34 rules

No specific technique 37 rules

Discovery

System Service Discovery T1007 25 rules

Application Window Discovery T1010 2 rules

Query Registry T1012 34 rules

System Network Configuration Discovery T1016 74 rules

System Network Configuration Discovery: Internet Connection Discovery T1016.001 9 rules

Remote System Discovery T1018 86 rules

System Owner/User Discovery T1033 84 rules

Network Sniffing T1040 25 rules

Network Service Discovery T1046 101 rules

System Network Connections Discovery T1049 36 rules

Process Discovery T1057 36 rules

Permission Groups Discovery T1069 136 rules

Permission Groups Discovery: Local Groups T1069.001 46 rules

Permission Groups Discovery: Domain Groups T1069.002 78 rules

Permission Groups Discovery: Cloud Groups T1069.003 13 rules

System Information Discovery T1082 167 rules

File and Directory Discovery T1083 71 rules

Account Discovery T1087 217 rules

Account Discovery: Local Account T1087.001 48 rules

Account Discovery: Domain Account T1087.002 104 rules

Account Discovery: Email Account T1087.003 1 rule

Account Discovery: Cloud Account T1087.004 32 rules

Peripheral Device Discovery T1120 5 rules

System Time Discovery T1124 6 rules

Network Share Discovery T1135 36 rules

Password Policy Discovery T1201 32 rules

Browser Information Discovery T1217 6 rules

Domain Trust Discovery T1482 66 rules

Virtualization/Sandbox Evasion T1497 21 rules

Virtualization/Sandbox Evasion: System Checks T1497.001 9 rules

Virtualization/Sandbox Evasion: Time Based Checks T1497.003 4 rules

Software Discovery T1518 44 rules

Software Discovery: Security Software Discovery T1518.001 21 rules

Cloud Service Discovery T1526 48 rules

Cloud Service Dashboard T1538 4 rules

Cloud Infrastructure Discovery T1580 42 rules

Container and Resource Discovery T1613 54 rules

System Location Discovery T1614 6 rules

System Location Discovery: System Language Discovery T1614.001 4 rules

Group Policy Discovery T1615 11 rules

Cloud Storage Object Discovery T1619 7 rules

Debugger Evasion T1622 2 rules

Device Driver Discovery T1652 1 rule

Log Enumeration T1654 3 rules

Virtual Machine Discovery T1673 4 rules

No specific technique 27 rules

Lateral Movement

Remote Services T1021 416 rules

Remote Services: Remote Desktop Protocol T1021.001 82 rules

Remote Services: SMB/Windows Admin Shares T1021.002 122 rules

Remote Services: Distributed Component Object Model T1021.003 48 rules

Remote Services: SSH T1021.004 46 rules

Remote Services: VNC T1021.005 4 rules

Remote Services: Windows Remote Management T1021.006 38 rules

Remote Services: Cloud Services T1021.007 19 rules

Remote Services: Direct Cloud VM Connections T1021.008 5 rules

Software Deployment Tools T1072 30 rules

Taint Shared Content T1080 4 rules

Replication Through Removable Media T1091 11 rules

Exploitation of Remote Services T1210 83 rules

Internal Spearphishing T1534 4 rules

Use Alternate Authentication Material T1550 130 rules

Use Alternate Authentication Material: Application Access Token T1550.001 60 rules

Use Alternate Authentication Material: Pass the Hash T1550.002 16 rules

Use Alternate Authentication Material: Pass the Ticket T1550.003 14 rules

Use Alternate Authentication Material: Web Session Cookie T1550.004 8 rules

Remote Service Session Hijacking T1563 20 rules

Remote Service Session Hijacking: SSH Hijacking T1563.001 10 rules

Remote Service Session Hijacking: RDP Hijacking T1563.002 8 rules

Lateral Tool Transfer T1570 47 rules

No specific technique 12 rules

Collection

Data from Local System T1005 77 rules

Data from Removable Media T1025 5 rules

Data from Network Shared Drive T1039 15 rules

Input Capture T1056 35 rules

Input Capture: Keylogging T1056.001 17 rules

Input Capture: GUI Input Capture T1056.002 9 rules

Input Capture: Credential API Hooking T1056.004 3 rules

Data Staged T1074 41 rules

Data Staged: Local Data Staging T1074.001 27 rules

Data Staged: Remote Data Staging T1074.002 4 rules

Screen Capture T1113 27 rules

Email Collection T1114 68 rules

Email Collection: Local Email Collection T1114.001 14 rules

Email Collection: Remote Email Collection T1114.002 19 rules

Email Collection: Email Forwarding Rule T1114.003 16 rules

Clipboard Data T1115 21 rules

Automated Collection T1119 41 rules

Audio Capture T1123 11 rules

Video Capture T1125 10 rules

Browser Session Hijacking T1185 17 rules

Data from Information Repositories T1213 55 rules

Data from Information Repositories: Sharepoint T1213.002 4 rules

Data from Information Repositories: Code Repositories T1213.003 14 rules

Data from Information Repositories: Databases T1213.006 3 rules

Data from Cloud Storage T1530 83 rules

Adversary-in-the-Middle T1557 69 rules

Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay T1557.001 28 rules

Adversary-in-the-Middle: ARP Cache Poisoning T1557.002 3 rules

Adversary-in-the-Middle: DHCP Spoofing T1557.003 2 rules

Archive Collected Data T1560 45 rules

Archive Collected Data: Archive via Utility T1560.001 35 rules

Archive Collected Data: Archive via Library T1560.002 3 rules

Archive Collected Data: Archive via Custom Method T1560.003 1 rule

No specific technique 5 rules

Command & Control

Data Obfuscation T1001 8 rules

Data Obfuscation: Protocol or Service Impersonation T1001.003 3 rules

Fallback Channels T1008 17 rules

Application Layer Protocol T1071 505 rules

Application Layer Protocol: Web Protocols T1071.001 126 rules

Application Layer Protocol: File Transfer Protocols T1071.002 8 rules

Application Layer Protocol: Mail Protocols T1071.003 7 rules

Application Layer Protocol: DNS T1071.004 63 rules

Proxy T1090 88 rules

Proxy: Internal Proxy T1090.001 10 rules

Proxy: External Proxy T1090.002 9 rules

Proxy: Multi-hop Proxy T1090.003 13 rules

Proxy: Domain Fronting T1090.004 1 rule

Non-Application Layer Protocol T1095 46 rules

Web Service T1102 72 rules

Web Service: Dead Drop Resolver T1102.001 9 rules

Web Service: Bidirectional Communication T1102.002 22 rules

Web Service: One-Way Communication T1102.003 4 rules

Ingress Tool Transfer T1105 339 rules

Data Encoding T1132 15 rules

Data Encoding: Standard Encoding T1132.001 7 rules

Traffic Signaling T1205 1 rule

Traffic Signaling: Port Knocking T1205.001 1 rule

Remote Access Tools T1219 111 rules

Remote Access Tools: Remote Desktop Software T1219.002 53 rules

Dynamic Resolution T1568 37 rules

Dynamic Resolution: Fast Flux DNS T1568.001 1 rule

Dynamic Resolution: Domain Generation Algorithms T1568.002 15 rules

Non-Standard Port T1571 26 rules

Protocol Tunneling T1572 96 rules

Encrypted Channel T1573 26 rules

Encrypted Channel: Asymmetric Cryptography T1573.002 9 rules

Content Injection T1659 4 rules

No specific technique 54 rules

Exfiltration

Exfiltration Over Other Network Medium T1011 3 rules

Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth T1011.001 1 rule

Automated Exfiltration T1020 53 rules

Automated Exfiltration: Traffic Duplication T1020.001 1 rule

Scheduled Transfer T1029 3 rules

Data Transfer Size Limits T1030 27 rules

Exfiltration Over C2 Channel T1041 82 rules

Exfiltration Over Alternative Protocol T1048 130 rules

Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1048.001 2 rules

Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.002 4 rules

Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol T1048.003 33 rules

Exfiltration Over Physical Medium T1052 6 rules

Exfiltration Over Physical Medium: Exfiltration over USB T1052.001 4 rules

Transfer Data to Cloud Account T1537 56 rules

Exfiltration Over Web Service T1567 161 rules

Exfiltration Over Web Service: Exfiltration to Code Repository T1567.001 12 rules

Exfiltration Over Web Service: Exfiltration to Cloud Storage T1567.002 46 rules

Exfiltration Over Web Service: Exfiltration to Text Storage Sites T1567.003 4 rules

Exfiltration Over Web Service: Exfiltration Over Webhook T1567.004 1 rule

No specific technique 17 rules

Impact

Data Destruction T1485 194 rules

Data Destruction: Lifecycle-Triggered Deletion T1485.001 5 rules

Data Encrypted for Impact T1486 86 rules

Service Stop T1489 85 rules

Inhibit System Recovery T1490 115 rules

Defacement T1491 12 rules

Defacement: Internal Defacement T1491.001 4 rules

Defacement: External Defacement T1491.002 1 rule

Firmware Corruption T1495 2 rules

Resource Hijacking T1496 61 rules

Resource Hijacking: Compute Hijacking T1496.001 2 rules

Resource Hijacking: Cloud Service Hijacking T1496.004 5 rules

Network Denial of Service T1498 52 rules

Network Denial of Service: Direct Network Flood T1498.001 1 rule

Network Denial of Service: Reflection Amplification T1498.002 1 rule

Endpoint Denial of Service T1499 46 rules

Endpoint Denial of Service: OS Exhaustion Flood T1499.001 1 rule

Endpoint Denial of Service: Service Exhaustion Flood T1499.002 3 rules

Endpoint Denial of Service: Application Exhaustion Flood T1499.003 2 rules

Endpoint Denial of Service: Application or System Exploitation T1499.004 4 rules

System Shutdown/Reboot T1529 35 rules

Account Access Removal T1531 66 rules

Disk Wipe T1561 4 rules

Disk Wipe: Disk Content Wipe T1561.001 2 rules

Disk Wipe: Disk Structure Wipe T1561.002 3 rules

Data Manipulation T1565 72 rules

Data Manipulation: Stored Data Manipulation T1565.001 28 rules

Data Manipulation: Transmitted Data Manipulation T1565.002 3 rules

Financial Theft T1657 3 rules

No specific technique 48 rules

Untagged 36 rules without MITRE technique tags

Sublime MQL Attachment: Zip exploiting CVE-2023-38831 (unsolicited)
Kusto Cayosoft Guardian - Cloud Application Security Threats available
Kusto Cayosoft Guardian - Core Identity and Infrastructure Threats available
Splunk Cisco Secure Firewall - Bits Network Activity production
Kusto Cortex XDR Incident - High
Kusto Cortex XDR Incident - Low
Kusto Cortex XDR Incident - Medium
Sigma CrackMaxpExec share permission enumeration experimental
Panther CrowdStrike MacOS plutil Usage
Panther Crowdstrike WMI Query Detection
Splunk Detect malicious requests to exploit JBoss servers experimental
Kusto Detection Opportunities for Certighost (CVE-2026-54121)
Kusto DomainTools New Domain Discovery Indicators Ingested
Kusto DomainTools Newly Added Domains Feeds Ingested
Kusto DomainTools Newly Observed Domains Feeds Ingested
Kusto DomainTools Newly Observed Hostnames Feeds Ingested
Splunk F5 TMUI Authentication Bypass production
Splunk File with Samsam Extension production
Sublime MQL Fuzzy Attack Score: Advanced Graymail Detection
Sublime MQL Headers: Zimbra mailer from a non-supported OS version
Panther MacOS Browser Credential Access
Panther MacOS Browser Credential Access (crowdstrike_fdrevent table)
Sigma macOS ULS Potential TCC Bypass Indicators experimental
Sigma macOS ULS securityd CodeSignature Failure experimental
Sigma macOS ULS Sudo Execution Logged experimental
Sigma macOS ULS TCC Access Denied experimental
Elastic Microsoft Defender XDR Alert External Alerts production
Elastic Microsoft Defender XDR Incident External Alerts production
Elastic My First Rule production
Sublime MQL New sender domain (<=10d) from untrusted sender
Splunk Processes Tapping Keyboard Events experimental
Kusto Recorded Future Sandbox - Malicious Email Attachment available
Kusto Recorded Future Sandbox - Malicious File in Storage Account available
Splunk Splunk Secure Application Alerts for Runtime Security experimental
Sublime MQL Suspicious recipients pattern with no Compauth pass and suspicious content
Elastic Web Application Suspicious Activity: sqlmap User Agent production