Elastic rule coverage
51 events across 5 providers with Elastic detection rules, 874 rule mappings total.
Microsoft-Windows-Security-Auditing
Event ID 4624: An account was successfully logged on. 12 rules
- Account Password Reset Remotely production
- Multiple Logon Failure Followed by Logon Success production
- NewCredential Logon by a Suspicious Process
- Potential Account Takeover - Logon from New Source IP production
- Potential Account Takeover - Mixed Logon Types production
- Potential Computer Account NTLM Relay Activity production
- Potential Kerberos Relay Attack against a Computer Account production
- Potential NTLM Relay Attack against a Computer Account production
- Potential Pass-the-Hash (PtH) Attempt production
- Process Creation via Secondary Logon production
- Remote Windows Service Installed production
- Service Creation via Local Kerberos Authentication production
Event ID 4625: An account failed to log on. 6 rules
- Multiple Logon Failure Followed by Logon Success production
- Multiple Logon Failure from the same Source Address production
- Potential Computer Account NTLM Relay Activity production
- Potential Kerberos Relay Attack against a Computer Account production
- Potential NTLM Relay Attack against a Computer Account production
- Privileged Accounts Brute Force production
Event ID 4656: A handle to an object was requested. 1 rule
- LSASS Memory Dump Handle Access production
Event ID 4662: An operation was performed on an object. 6 rules
- Access to a Sensitive LDAP Attribute production
- First Time Seen Account Performing DCSync production
- Potential Credential Access via DCSync production
- Potential Kerberos Coercion via DNS-Based SPN Spoofing production
- Suspicious Access to LDAP Attributes production
- WRITEDAC Access on Active Directory Object production
Event ID 4688: A new process has been created. 257 rules
- Accessing Outlook Data Files production
- Account Discovery Command via SYSTEM Account production
- Active Directory Discovery using AdExplorer production
- Adding Hidden File Attribute via Attrib production
- AdFind Command Activity production
- At.exe Command Lateral Movement production
- Attempt to Establish VScode Remote Tunnel production
- Attempt to Install or Run Kali Linux via WSL production
- Attempted Private Key Access production
- Backup Deletion with Wbadmin production
- Binary Content Copy via Cmd.exe production
- Bitsadmin Activity production
- Browser Process Spawned from an Unusual Parent production
- Bypass UAC via Event Viewer production
- Clearing Windows Console History production
- Clearing Windows Event Logs production
- Code Signing Policy Modification Through Built-in tools production
- Command and Scripting Interpreter via Windows Scripts production
- Command Execution via ForFiles production
- Command Execution via SolarWinds Process production
- Command Obfuscation via Unicode Modifier Letters production
- Command Shell Activity Started via RunDLL32 production
- Conhost Spawned By Suspicious Parent Process production
- Control Panel Process with Unusual Arguments production
- Credential Acquisition via Registry Hive Dumping production
- Delayed Execution via Ping production
- Delete Volume USN Journal with Fsutil production
- Disable Windows Event and Security Logs Using Built-in Tools production
- Disable Windows Firewall Rules via Netsh production
- Disabling Windows Defender Security Settings via PowerShell production
- Enable Host Network Discovery via Netsh production
- Encrypting Files with WinRar or 7z production
- Enumerating Domain Trusts via DSQUERY.EXE production
- Enumerating Domain Trusts via NLTEST.EXE production
- Enumeration Command Spawned via WMIPrvSE production
- Enumeration of Administrator Accounts production
- Execution from a Removable Media with Network Connection production
- Execution from Unusual Directory - Command Line production
- Execution of a Downloaded Windows Script production
- Execution of COM object via Xwizard production
- Execution of File Written or Modified by Microsoft Office production
- Execution of Persistent Suspicious Program production
- Execution via Microsoft DotNet ClickOnce Host production
- Execution via MS VisualStudio Pre/Post Build Events production
- Execution via TSClient Mountpoint production
- Execution via Windows Command Debugging Utility production
- Exporting Exchange Mailbox via PowerShell production
- File and Directory Permissions Modification production
- File or Directory Deletion Command production
- First Time Seen Remote Monitoring and Management Tool production
- First Time Seen RMM Signer Across the Environment production
- Group Policy Discovery via Microsoft GPResult Utility production
- Host File System Changes via Windows Subsystem for Linux production
- IIS HTTP Logging Disabled production
- ImageLoad via Windows Update Auto Update Client production
- Incoming DCOM Lateral Movement via MSHTA production
- Incoming DCOM Lateral Movement with MMC production
- Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows production
- Incoming Execution via PowerShell Remoting production
- Incoming Execution via WinRM Remote Shell production
- Indirect Command Execution via Forfiles/Pcalua production
- InstallUtil Activity production
- InstallUtil Process Making Network Connections production
- Java Dropped and Executed With DNS Lookup production
- Local Scheduled Task Creation production
- Microsoft Build Engine Started by a System Process production
- Microsoft Build Engine Started by an Office Application production
- Microsoft Build Engine Using an Alternate Name production
- Microsoft Exchange Server UM Spawning Suspicious Processes production
- Microsoft Exchange Worker Spawning Suspicious Processes production
- Microsoft IIS Connection Strings Decryption production
- Microsoft IIS Service Account Password Dumped production
- Microsoft Management Console File from Unusual Path production
- Modification of Boot Configuration production
- Mofcomp Activity production
- Mounting Hidden or WebDav Remote Shares production
- MsBuild Making Network Connections production
- Mshta Making Network Connections production
- MsiExec Service Child Process With Network Connection production
- Multiple Remote Management Tool Vendors on Same Host production
- NetSupport Manager Execution from an Unusual Path production
- Network Connection via Compiled HTML File production
- Network Connection via MsXsl production
- Network Connection via Registration Utility production
- Network Connection via Signed Binary production
- New ActiveSyncAllowedDeviceID Added via PowerShell production
- NTDS Dump via Wbadmin production
- NTDS or SAM Database File Copied production
- Parent Process PID Spoofing production
- Peripheral Device Discovery production
- Persistence via BITS Job Notify Cmdline production
- Persistence via TelemetryController Scheduled Task Hijack production
- Persistence via Update Orchestrator Service Hijack production
- Persistence via WMI Event Subscription production
- Potential Application Shimming via Sdbinst production
- Potential Command and Control via Internet Explorer production
- Potential Command Shell via NetCat production
- Potential Credential Access via Renamed COM+ Services DLL production
- Potential Credential Access via Trusted Developer Utility production
- Potential Credential Access via Windows Utilities production
- Potential CVE-2025-33053 Exploitation production
- Potential Data Exfiltration via Rclone production
- Potential Defense Evasion via CMSTP.exe production
- Potential DLL Side-Loading via Trusted Microsoft Programs production
- Potential DNS Tunneling via NsLookup production
- Potential EDR-Freeze via WerFaultSecure Abuse production
- Potential Escalation via Vulnerable MSI Repair production
- Potential Evasion via Filter Manager production
- Potential Execution via FileFix Phishing Attack production
- Potential Exploitation of an Unquoted Service Path Vulnerability production
- Potential Fake CAPTCHA Phishing Attack production
- Potential File Download via a Headless Browser production
- Potential File Transfer via Certreq production
- Potential File Transfer via Curl for Windows production
- Potential Foxmail Exploitation production
- Potential Local NTLM Relay via HTTP production
- Potential LSASS Clone Creation via PssCaptureSnapShot production
- Potential Masquerading as Browser Process production
- Potential Masquerading as Business App Installer production
- Potential Masquerading as Communication Apps production
- Potential Masquerading as System32 Executable production
- Potential Modification of Accessibility Binaries production
- Potential Notepad Markdown RCE Exploitation production
- Potential Privilege Escalation via InstallerFileTakeOver production
- Potential Process Injection from Malicious Document production
- Potential Protocol Tunneling via Cloudflared production
- Potential Protocol Tunneling via Yuze production
- Potential Remote Desktop Tunneling Detected production
- Potential Remote File Execution via MSIEXEC production
- Potential Remote Install via MsiExec production
- Potential SharpRDP Behavior production
- Potential SSH Reverse Port Forwarding production
- Potential Veeam Credential Access Command production
- Potential Windows Error Manager Masquerading production
- Potential WSUS Abuse for Lateral Movement production
- Privilege Escalation via Named Pipe Impersonation production
- Privileges Elevation via Parent Process PID Spoofing production
- Process Activity via Compiled HTML File production
- Process Created with a Duplicated Token production
- Process Created with an Elevated Token production
- Process Creation via Secondary Logon production
- Process Discovery Using Built-in Tools production
- Process Execution from an Unusual Directory production
- Program Files Directory Masquerading production
- Proxy Execution via Console Window Host production
- Proxy Execution via Windows OpenSSH production
- PsExec Network Connection production
- Remote Desktop Enabled in Windows Firewall by Netsh production
- Remote Desktop File Opened from Suspicious Path production
- Remote Execution via File Shares production
- Remote File Copy to a Hidden Share production
- Remote File Download via Desktopimgdownldr Utility production
- Remote File Download via MpCmdRun production
- Remote Management Access Launch After MSI Install production
- Remote System Discovery Commands production
- Remote XSL Script Execution via COM production
- Remotely Started Services via RPC production
- Renamed Automation Script Interpreter production
- Renamed Utility Executed with Short Program Name production
- ScreenConnect Server Spawning Suspicious Processes production
- Script Execution via Microsoft HTML Application production
- Searching for Saved Credentials via VaultCmd production
- Security Software Discovery using WMIC production
- Service Command Lateral Movement production
- Service Control Spawned via Script Interpreter production
- Service DACL Modification via sc.exe production
- Signed Proxy Execution via MS Work Folders production
- SMB Connections via LOLBin or Untrusted Process production
- Startup Folder Persistence via Unsigned Process production
- Suspicious .NET Code Compilation production
- Suspicious CertUtil Commands production
- Suspicious Child Process via Azure VM CustomScript Extension production
- Suspicious Cmd Execution via WMI production
- Suspicious Command Prompt Network Connection production
- Suspicious Communication App Child Process production
- Suspicious Endpoint Security Parent Process production
- Suspicious Execution from a Mounted Device production
- Suspicious Execution from a WebDav Share production
- Suspicious Execution from INET Cache production
- Suspicious Execution from VS Code Extension production
- Suspicious Execution via Microsoft Office Add-Ins production
- Suspicious Execution via MSIEXEC production
- Suspicious Execution via Scheduled Task production
- Suspicious Execution via Windows Subsystem for Linux production
- Suspicious Execution with NodeJS production
- Suspicious Explorer Child Process production
- Suspicious HTML File Creation production
- Suspicious Inter-Process Communication via Outlook production
- Suspicious JavaScript Execution via Deno production
- Suspicious JetBrains TeamCity Child Process production
- Suspicious Microsoft Antimalware Service Execution production
- Suspicious Microsoft Diagnostics Wizard Execution production
- Suspicious Microsoft HTML Application Child Process production
- Suspicious MS Office Child Process production
- Suspicious MS Outlook Child Process production
- Suspicious Outlook Child Process production
- Suspicious PDF Reader Child Process production
- Suspicious Process Execution via Renamed PsExec Executable production
- Suspicious ScreenConnect Client Child Process production
- Suspicious Shell Execution via Velociraptor production
- Suspicious SolarWinds Child Process production
- Suspicious Troubleshooting Pack Cabinet Execution production
- Suspicious WerFault Child Process production
- Suspicious Windows Command Shell Arguments production
- Suspicious Windows Powershell Arguments production
- Suspicious WMIC XSL Script Execution production
- Suspicious Zoom Child Process production
- Symbolic Link to Shadow Copy Created production
- System File Ownership Change production
- System Information Discovery via Windows Command Shell production
- System Service Discovery through built-in Windows Utilities production
- System Shells via Services production
- System Time Discovery production
- UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer production
- UAC Bypass Attempt via Windows Directory Masquerading production
- UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface production
- UAC Bypass via DiskCleanup Scheduled Task Hijack production
- UAC Bypass via ICMLuaUtil Elevated COM Interface production
- UAC Bypass via Windows Firewall Snap-In Hijack production
- Unusual Child Process from a System Virtual Process production
- Unusual Child Process of dns.exe production
- Unusual Child Processes of RunDLL32 production
- Unusual Execution via Microsoft Common Console File production
- Unusual Network Activity from a Windows System Binary production
- Unusual Network Connection via DllHost production
- Unusual Network Connection via RunDLL32 production
- Unusual Parent Process for cmd.exe production
- Unusual Parent-Child Relationship production
- Unusual Print Spooler Child Process production
- Unusual Process Execution on WBEM Path production
- Unusual Process Execution Path - Alternate Data Stream production
- Unusual Process Extension production
- Unusual Process For MSSQL Service Accounts production
- Unusual Process Network Connection production
- Unusual Service Host Child Process - Childless Service production
- User Account Creation production
- Veeam Backup Library Loaded by Unusual Process production
- Volume Shadow Copy Deleted or Resized via VssAdmin production
- Volume Shadow Copy Deletion via PowerShell production
- Volume Shadow Copy Deletion via WMIC production
- Whoami Process Activity production
- Windows Account or Group Discovery production
- Windows Defender Exclusions Added via PowerShell production
- Windows Firewall Disabled via PowerShell production
- Windows Installer with Suspicious Properties production
- Windows Network Enumeration production
- Windows Sandbox with Sensitive Configuration production
- Windows Script Executing PowerShell production
- Windows Script Execution from Archive production
- Windows Script Interpreter Executing Process via WMI production
- Windows Server Update Service Spawning Suspicious Processes production
- Windows Subsystem for Linux Enabled via Dism Utility production
- Windows System Information Discovery production
- Wireless Credential Dumping using Netsh Command production
- WMI Incoming Lateral Movement production
- WMI WBEMTEST Utility Execution production
- WMIC Remote Command production
Event ID 4697: A service was installed in the system. 4 rules
- Remote Windows Service Installed production
- Service Creation via Local Kerberos Authentication production
- Suspicious Service was Installed in the System production
- Windows Service Installed via an Unusual Client production
Event ID 4698: A scheduled task was created. 3 rules
- A scheduled task was created production
- Remote Scheduled Task Creation via RPC production
- Temporarily Scheduled Task Creation production
Event ID 4702: A scheduled task was updated. 1 rule
- Unusual Scheduled Task Update production
Event ID 4719: System audit policy was changed. 1 rule
- Sensitive Audit Policy Sub-Category Disabled production
Event ID 4724: An attempt was made to reset an account's password. 1 rule
- Account Password Reset Remotely production
Event ID 4738: A user account was changed. 3 rules
- Account Configured with Never-Expiring Password production
- Kerberos Pre-authentication Disabled for User production
- KRBTGT Delegation Backdoor production
Event ID 4742: A computer account was changed. 1 rule
- Remote Computer Account DnsHostName Update production
Event ID 5136: A directory service object was modified. 11 rules
- Account Configured with Never-Expiring Password production
- AdminSDHolder Backdoor production
- AdminSDHolder SDProp Exclusion Added production
- Delegated Managed Service Account Modification by an Unusual User production
- Group Policy Abuse for Privilege Addition production
- Modification of the msPKIAccountCredentials production
- Potential Active Directory Replication Account Backdoor production
- Potential Shadow Credentials added to AD Object production
- Scheduled Task Execution at Scale via GPO production
- Startup/Logon Script added to Group Policy Object production
- User account exposed to Kerberoasting production
Event ID 5145: A network share object was checked to see whether client can be granted desired access. 9 rules
- Active Directory Forced Authentication from Linux Host - SMB Named Pipes production
- Potential Kerberos Relay Attack against a Computer Account production
- Potential Machine Account Relay Attack via SMB production
- Potential Network Share Discovery production
- Potential NTLM Relay Attack against a Computer Account production
- Protected Storage Service Access via SMB production
- Scheduled Task Execution at Scale via GPO production
- Startup/Logon Script added to Group Policy Object production
- Suspicious Remote Registry Access via SeBackupPrivilege production
Microsoft-Windows-Sysmon
Event ID 1: Process creation 257 rules
- Accessing Outlook Data Files production
- Account Discovery Command via SYSTEM Account production
- Active Directory Discovery using AdExplorer production
- Adding Hidden File Attribute via Attrib production
- AdFind Command Activity production
- At.exe Command Lateral Movement production
- Attempt to Establish VScode Remote Tunnel production
- Attempt to Install or Run Kali Linux via WSL production
- Attempted Private Key Access production
- Backup Deletion with Wbadmin production
- Binary Content Copy via Cmd.exe production
- Bitsadmin Activity production
- Browser Process Spawned from an Unusual Parent production
- Bypass UAC via Event Viewer production
- Clearing Windows Console History production
- Clearing Windows Event Logs production
- Code Signing Policy Modification Through Built-in tools production
- Command and Scripting Interpreter via Windows Scripts production
- Command Execution via ForFiles production
- Command Execution via SolarWinds Process production
- Command Obfuscation via Unicode Modifier Letters production
- Command Shell Activity Started via RunDLL32 production
- Conhost Spawned By Suspicious Parent Process production
- Control Panel Process with Unusual Arguments production
- Credential Acquisition via Registry Hive Dumping production
- Delayed Execution via Ping production
- Delete Volume USN Journal with Fsutil production
- Disable Windows Event and Security Logs Using Built-in Tools production
- Disable Windows Firewall Rules via Netsh production
- Disabling Windows Defender Security Settings via PowerShell production
- Enable Host Network Discovery via Netsh production
- Encrypting Files with WinRar or 7z production
- Enumerating Domain Trusts via DSQUERY.EXE production
- Enumerating Domain Trusts via NLTEST.EXE production
- Enumeration Command Spawned via WMIPrvSE production
- Enumeration of Administrator Accounts production
- Execution from a Removable Media with Network Connection production
- Execution from Unusual Directory - Command Line production
- Execution of a Downloaded Windows Script production
- Execution of COM object via Xwizard production
- Execution of File Written or Modified by Microsoft Office production
- Execution of Persistent Suspicious Program production
- Execution via Microsoft DotNet ClickOnce Host production
- Execution via MS VisualStudio Pre/Post Build Events production
- Execution via TSClient Mountpoint production
- Execution via Windows Command Debugging Utility production
- Exporting Exchange Mailbox via PowerShell production
- File and Directory Permissions Modification production
- File or Directory Deletion Command production
- First Time Seen Remote Monitoring and Management Tool production
- First Time Seen RMM Signer Across the Environment production
- Group Policy Discovery via Microsoft GPResult Utility production
- Host File System Changes via Windows Subsystem for Linux production
- IIS HTTP Logging Disabled production
- ImageLoad via Windows Update Auto Update Client production
- Incoming DCOM Lateral Movement via MSHTA production
- Incoming DCOM Lateral Movement with MMC production
- Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows production
- Incoming Execution via PowerShell Remoting production
- Incoming Execution via WinRM Remote Shell production
- Indirect Command Execution via Forfiles/Pcalua production
- InstallUtil Activity production
- InstallUtil Process Making Network Connections production
- Java Dropped and Executed With DNS Lookup production
- Local Scheduled Task Creation production
- Microsoft Build Engine Started by a System Process production
- Microsoft Build Engine Started by an Office Application production
- Microsoft Build Engine Using an Alternate Name production
- Microsoft Exchange Server UM Spawning Suspicious Processes production
- Microsoft Exchange Worker Spawning Suspicious Processes production
- Microsoft IIS Connection Strings Decryption production
- Microsoft IIS Service Account Password Dumped production
- Microsoft Management Console File from Unusual Path production
- Modification of Boot Configuration production
- Mofcomp Activity production
- Mounting Hidden or WebDav Remote Shares production
- MsBuild Making Network Connections production
- Mshta Making Network Connections production
- MsiExec Service Child Process With Network Connection production
- Multiple Remote Management Tool Vendors on Same Host production
- NetSupport Manager Execution from an Unusual Path production
- Network Connection via Compiled HTML File production
- Network Connection via MsXsl production
- Network Connection via Registration Utility production
- Network Connection via Signed Binary production
- New ActiveSyncAllowedDeviceID Added via PowerShell production
- NTDS Dump via Wbadmin production
- NTDS or SAM Database File Copied production
- Parent Process PID Spoofing production
- Peripheral Device Discovery production
- Persistence via BITS Job Notify Cmdline production
- Persistence via TelemetryController Scheduled Task Hijack production
- Persistence via Update Orchestrator Service Hijack production
- Persistence via WMI Event Subscription production
- Potential Application Shimming via Sdbinst production
- Potential Command and Control via Internet Explorer production
- Potential Command Shell via NetCat production
- Potential Credential Access via Renamed COM+ Services DLL production
- Potential Credential Access via Trusted Developer Utility production
- Potential Credential Access via Windows Utilities production
- Potential CVE-2025-33053 Exploitation production
- Potential Data Exfiltration via Rclone production
- Potential Defense Evasion via CMSTP.exe production
- Potential DLL Side-Loading via Trusted Microsoft Programs production
- Potential DNS Tunneling via NsLookup production
- Potential EDR-Freeze via WerFaultSecure Abuse production
- Potential Escalation via Vulnerable MSI Repair production
- Potential Evasion via Filter Manager production
- Potential Execution via FileFix Phishing Attack production
- Potential Exploitation of an Unquoted Service Path Vulnerability production
- Potential Fake CAPTCHA Phishing Attack production
- Potential File Download via a Headless Browser production
- Potential File Transfer via Certreq production
- Potential File Transfer via Curl for Windows production
- Potential Foxmail Exploitation production
- Potential Local NTLM Relay via HTTP production
- Potential Masquerading as Browser Process production
- Potential Masquerading as Business App Installer production
- Potential Masquerading as Communication Apps production
- Potential Masquerading as System32 Executable production
- Potential Modification of Accessibility Binaries production
- Potential Notepad Markdown RCE Exploitation production
- Potential Privilege Escalation via InstallerFileTakeOver production
- Potential Process Injection from Malicious Document production
- Potential Protocol Tunneling via Cloudflared production
- Potential Protocol Tunneling via Yuze production
- Potential Remote Desktop Tunneling Detected production
- Potential Remote File Execution via MSIEXEC production
- Potential Remote Install via MsiExec production
- Potential SharpRDP Behavior production
- Potential SSH Reverse Port Forwarding production
- Potential Veeam Credential Access Command production
- Potential Windows Error Manager Masquerading production
- Potential WSUS Abuse for Lateral Movement production
- Privilege Escalation via Named Pipe Impersonation production
- Privileges Elevation via Parent Process PID Spoofing production
- Process Activity via Compiled HTML File production
- Process Created with a Duplicated Token production
- Process Created with an Elevated Token production
- Process Creation via Secondary Logon production
- Process Discovery Using Built-in Tools production
- Process Execution from an Unusual Directory production
- Program Files Directory Masquerading production
- Proxy Execution via Console Window Host production
- Proxy Execution via Windows OpenSSH production
- PsExec Network Connection production
- Remote Desktop Enabled in Windows Firewall by Netsh production
- Remote Desktop File Opened from Suspicious Path production
- Remote Execution via File Shares production
- Remote File Copy to a Hidden Share production
- Remote File Download via Desktopimgdownldr Utility production
- Remote File Download via MpCmdRun production
- Remote Management Access Launch After MSI Install production
- Remote System Discovery Commands production
- Remote XSL Script Execution via COM production
- Remotely Started Services via RPC production
- Renamed Automation Script Interpreter production
- Renamed Utility Executed with Short Program Name production
- ScreenConnect Server Spawning Suspicious Processes production
- Script Execution via Microsoft HTML Application production
- Searching for Saved Credentials via VaultCmd production
- Security Software Discovery using WMIC production
- Service Command Lateral Movement production
- Service Control Spawned via Script Interpreter production
- Service DACL Modification via sc.exe production
- Signed Proxy Execution via MS Work Folders production
- SMB Connections via LOLBin or Untrusted Process production
- Startup Folder Persistence via Unsigned Process production
- Suspicious .NET Code Compilation production
- Suspicious CertUtil Commands production
- Suspicious Child Process via Azure VM CustomScript Extension production
- Suspicious Cmd Execution via WMI production
- Suspicious Command Prompt Network Connection production
- Suspicious Communication App Child Process production
- Suspicious Endpoint Security Parent Process production
- Suspicious Execution from a Mounted Device production
- Suspicious Execution from a WebDav Share production
- Suspicious Execution from INET Cache production
- Suspicious Execution from VS Code Extension production
- Suspicious Execution via Microsoft Office Add-Ins production
- Suspicious Execution via MSIEXEC production
- Suspicious Execution via Scheduled Task production
- Suspicious Execution via Windows Subsystem for Linux production
- Suspicious Execution with NodeJS production
- Suspicious Explorer Child Process production
- Suspicious HTML File Creation production
- Suspicious Inter-Process Communication via Outlook production
- Suspicious JavaScript Execution via Deno production
- Suspicious JetBrains TeamCity Child Process production
- Suspicious Microsoft Antimalware Service Execution production
- Suspicious Microsoft Diagnostics Wizard Execution production
- Suspicious Microsoft HTML Application Child Process production
- Suspicious MS Office Child Process production
- Suspicious MS Outlook Child Process production
- Suspicious Outlook Child Process production
- Suspicious PDF Reader Child Process production
- Suspicious Process Creation CallTrace production
- Suspicious Process Execution via Renamed PsExec Executable production
- Suspicious ScreenConnect Client Child Process production
- Suspicious Shell Execution via Velociraptor production
- Suspicious SolarWinds Child Process production
- Suspicious Troubleshooting Pack Cabinet Execution production
- Suspicious WerFault Child Process production
- Suspicious Windows Command Shell Arguments production
- Suspicious Windows Powershell Arguments production
- Suspicious WMIC XSL Script Execution production
- Suspicious Zoom Child Process production
- Symbolic Link to Shadow Copy Created production
- System File Ownership Change production
- System Information Discovery via Windows Command Shell production
- System Service Discovery through built-in Windows Utilities production
- System Shells via Services production
- System Time Discovery production
- UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer production
- UAC Bypass Attempt via Windows Directory Masquerading production
- UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface production
- UAC Bypass via DiskCleanup Scheduled Task Hijack production
- UAC Bypass via ICMLuaUtil Elevated COM Interface production
- UAC Bypass via Windows Firewall Snap-In Hijack production
- Unusual Child Process from a System Virtual Process production
- Unusual Child Process of dns.exe production
- Unusual Child Processes of RunDLL32 production
- Unusual Execution via Microsoft Common Console File production
- Unusual Network Activity from a Windows System Binary production
- Unusual Network Connection via DllHost production
- Unusual Network Connection via RunDLL32 production
- Unusual Parent Process for cmd.exe production
- Unusual Parent-Child Relationship production
- Unusual Print Spooler Child Process production
- Unusual Process Execution on WBEM Path production
- Unusual Process Execution Path - Alternate Data Stream production
- Unusual Process Extension production
- Unusual Process For MSSQL Service Accounts production
- Unusual Process Network Connection production
- Unusual Service Host Child Process - Childless Service production
- User Account Creation production
- Veeam Backup Library Loaded by Unusual Process production
- Volume Shadow Copy Deleted or Resized via VssAdmin production
- Volume Shadow Copy Deletion via PowerShell production
- Volume Shadow Copy Deletion via WMIC production
- Whoami Process Activity production
- Windows Account or Group Discovery production
- Windows Defender Exclusions Added via PowerShell production
- Windows Firewall Disabled via PowerShell production
- Windows Installer with Suspicious Properties production
- Windows Network Enumeration production
- Windows Sandbox with Sensitive Configuration production
- Windows Script Executing PowerShell production
- Windows Script Execution from Archive production
- Windows Script Interpreter Executing Process via WMI production
- Windows Server Update Service Spawning Suspicious Processes production
- Windows Subsystem for Linux Enabled via Dism Utility production
- Windows System Information Discovery production
- Wireless Credential Dumping using Netsh Command production
- WMI Incoming Lateral Movement production
- WMI WBEMTEST Utility Execution production
- WMIC Remote Command production
Event ID 2: A process changed a file creation time 1 rule
- Potential Timestomp in Executable Files production
Event ID 3: Network connection 45 rules
- Connection to Commonly Abused Free SSL Certificate Providers production
- Connection to Commonly Abused Web Services production
- Deprecated - SUNBURST Command and Control Activity production
- Execution from a Removable Media with Network Connection production
- Execution via Microsoft DotNet ClickOnce Host production
- Incoming DCOM Lateral Movement via MSHTA production
- Incoming DCOM Lateral Movement with MMC production
- Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows production
- Incoming Execution via PowerShell Remoting production
- Incoming Execution via WinRM Remote Shell production
- InstallUtil Process Making Network Connections production
- Kerberos Traffic from Unusual Process production
- Mshta Making Network Connections production
- MsiExec Service Child Process With Network Connection production
- Network Activity to a Suspicious Top Level Domain production
- Network Connection via Certutil production
- Network Connection via Compiled HTML File production
- Network Connection via MsXsl production
- Network Connection via Registration Utility production
- Network Connection via Signed Binary production
- Outbound Scheduled Task Activity via PowerShell production
- Potential Command and Control via Internet Explorer production
- Potential Enumeration via Active Directory Web Service production
- Potential Evasion via Windows Filtering Platform production
- Potential Kerberos SPN Spoofing via Suspicious DNS Query production
- Potential Lateral Tool Transfer via SMB Share production
- Potential Outgoing RDP Connection by Unusual Process production
- Potential Remote File Execution via MSIEXEC production
- Potential SharpRDP Behavior production
- Potential Windows Error Manager Masquerading production
- PsExec Network Connection production
- Remote File Download via PowerShell production
- Remote File Download via Script Interpreter production
- Remote Scheduled Task Creation production
- Remotely Started Services via RPC production
- Service Command Lateral Movement production
- SMB Connections via LOLBin or Untrusted Process production
- Suspicious Command Prompt Network Connection production
- Suspicious Instance Metadata Service (IMDS) API Request production
- Suspicious Kerberos Authentication Ticket Request production
- System Public IP Discovery via DNS Query production
- Unusual Network Connection via DllHost production
- Unusual Network Connection via RunDLL32 production
- Unusual Process Network Connection production
- WMI Incoming Lateral Movement production
Event ID 6: Driver loaded 2 rules
- Expired or Revoked Driver Loaded production
- Untrusted Driver Loaded production
Event ID 7: Image loaded 16 rules
- Compression DLL Loaded by Unusual Process production
- Image Loaded with Invalid Signature production
- Potential Command and Control via Internet Explorer production
- Potential Credential Access via Renamed COM+ Services DLL production
- Potential Credential Access via Trusted Developer Utility production
- Potential Enumeration via Active Directory Web Service production
- Potential Masquerading as System32 DLL production
- Potential Masquerading as VLC DLL production
- Potential Windows Session Hijacking via CcmExec production
- Remote XSL Script Execution via COM production
- Suspicious Module Loaded by LSASS production
- Unsigned DLL Loaded by a Trusted Process production
- Unsigned DLL Loaded by Svchost production
- Unsigned DLL Side-Loading from a Suspicious Folder production
- Untrusted DLL Loaded by Azure AD Connect Authentication Agent production
- Veeam Backup Library Loaded by Unusual Process production
Event ID 10: ProcessAccess 7 rules
- Potential Credential Access via DuplicateHandle in LSASS production
- Potential Credential Access via LSASS Memory Dump production
- Potential LSASS Memory Dump via PssCaptureSnapShot production
- Suspicious LSASS Access via MalSecLogon production
- Suspicious Lsass Process Access production
- Suspicious Process Access via Direct System Call production
- Suspicious Process Creation CallTrace production
Event ID 11: FileCreate 22 rules
- Browser Extension Install production
- Creation of SettingContent-ms Files production
- Deprecated - Adobe Hijack Persistence production
- Deprecated - Suspicious PrintSpooler Service Executable File Creation production
- Downloaded Shortcut Files production
- Downloaded URL Files production
- Executable File Creation with Multiple Extensions production
- Execution of a Downloaded Windows Script production
- File Staged in Root Folder of Recycle Bin production
- File with Suspicious Extension Downloaded production
- Kirbi File Creation production
- Memory Dump File with Unusual Extension production
- Microsoft Exchange Server UM Writing Suspicious Files production
- Potential Credential Access via Memory Dump File Creation production
- Potential Ransomware Behavior - Note Files by System production
- Potential Ransomware Note File Dropped via SMB production
- Potential Remote Credential Access via Registry production
- Remote File Copy via TeamViewer production
- Remote File Download via PowerShell production
- Remote File Download via Script Interpreter production
- Unusual File Creation - Alternate Data Stream production
- Windows Registry File Creation in SMB Share production
Event ID 12: RegistryEvent (Object create and delete) 51 rules
- Code Signing Policy Modification Through Registry production
- Component Object Model Hijacking production
- Creation of a Hidden Local User Account production
- Creation or Modification of Root Certificate production
- Deprecated - Encoded Executable Stored in the Registry production
- Disabling Lsa Protection via Registry Modification production
- Disabling User Account Control via Registry Modification production
- DNS Global Query Block List Modified or Disabled production
- First Time Seen Removable Device production
- Full User-Mode Dumps Enabled System-Wide production
- Image File Execution Options Injection production
- Installation of Custom Shim Databases production
- Installation of Security Support Provider production
- Local Account TokenFilter Policy Disabled production
- Microsoft Windows Defender Tampering production
- Modification of AmsiEnable Registry Key production
- Modification of WDigest Security Provider production
- MS Office Macro Security Registry Modifications production
- Netsh Helper DLL production
- Network Logon Provider Registry Modification production
- NullSessionPipe Registry Modification production
- Persistence via Hidden Run Key Detected production
- Persistence via WMI Standard Registry Provider production
- Port Forwarding Rule Addition production
- Potential LSA Authentication Package Abuse production
- Potential Persistence via Time Provider Modification production
- Potential Port Monitor or Print Processor Registration Abuse production
- Potential Privilege Escalation via Service ImagePath Modification production
- Potential SharpRDP Behavior production
- PowerShell Script Block Logging Disabled production
- Privilege Escalation via Windir Environment Variable production
- RDP Enabled via Registry production
- Registry Persistence via AppCert DLL production
- Registry Persistence via AppInit DLL production
- Remote Scheduled Task Creation production
- Scheduled Task Created by a Windows Script production
- Scheduled Tasks AT Command Enabled production
- Service Disabled via Registry Modification production
- Service Path Modification production
- SIP Provider Modification production
- SolarWinds Process Disabling Services via Registry production
- Startup or Run Key Registry Modification production
- Suspicious ImagePath Service Creation production
- Suspicious Print Spooler Point and Print DLL production
- Suspicious Startup Shell Folder Modification production
- Uncommon Registry Persistence Change production
- Unusual Persistence via Services Registry production
- Werfault ReflectDebugger Persistence production
- Windows Defender Disabled via Registry Modification production
- Windows Installer with Suspicious Properties production
- Windows Subsystem for Linux Distribution Installed production
Event ID 13: RegistryEvent (Value Set) 51 rules
- Code Signing Policy Modification Through Registry production
- Component Object Model Hijacking production
- Creation of a Hidden Local User Account production
- Creation or Modification of Root Certificate production
- Deprecated - Encoded Executable Stored in the Registry production
- Disabling Lsa Protection via Registry Modification production
- Disabling User Account Control via Registry Modification production
- DNS Global Query Block List Modified or Disabled production
- First Time Seen Removable Device production
- Full User-Mode Dumps Enabled System-Wide production
- Image File Execution Options Injection production
- Installation of Custom Shim Databases production
- Installation of Security Support Provider production
- Local Account TokenFilter Policy Disabled production
- Microsoft Windows Defender Tampering production
- Modification of AmsiEnable Registry Key production
- Modification of WDigest Security Provider production
- MS Office Macro Security Registry Modifications production
- Netsh Helper DLL production
- Network Logon Provider Registry Modification production
- NullSessionPipe Registry Modification production
- Persistence via Hidden Run Key Detected production
- Persistence via WMI Standard Registry Provider production
- Port Forwarding Rule Addition production
- Potential LSA Authentication Package Abuse production
- Potential Persistence via Time Provider Modification production
- Potential Port Monitor or Print Processor Registration Abuse production
- Potential Privilege Escalation via Service ImagePath Modification production
- Potential SharpRDP Behavior production
- PowerShell Script Block Logging Disabled production
- Privilege Escalation via Windir Environment Variable production
- RDP Enabled via Registry production
- Registry Persistence via AppCert DLL production
- Registry Persistence via AppInit DLL production
- Remote Scheduled Task Creation production
- Scheduled Task Created by a Windows Script production
- Scheduled Tasks AT Command Enabled production
- Service Disabled via Registry Modification production
- Service Path Modification production
- SIP Provider Modification production
- SolarWinds Process Disabling Services via Registry production
- Startup or Run Key Registry Modification production
- Suspicious ImagePath Service Creation production
- Suspicious Print Spooler Point and Print DLL production
- Suspicious Startup Shell Folder Modification production
- Uncommon Registry Persistence Change production
- Unusual Persistence via Services Registry production
- Werfault ReflectDebugger Persistence production
- Windows Defender Disabled via Registry Modification production
- Windows Installer with Suspicious Properties production
- Windows Subsystem for Linux Distribution Installed production
Event ID 14: RegistryEvent (Key and Value Rename) 51 rules
- Code Signing Policy Modification Through Registry production
- Component Object Model Hijacking production
- Creation of a Hidden Local User Account production
- Creation or Modification of Root Certificate production
- Deprecated - Encoded Executable Stored in the Registry production
- Disabling Lsa Protection via Registry Modification production
- Disabling User Account Control via Registry Modification production
- DNS Global Query Block List Modified or Disabled production
- First Time Seen Removable Device production
- Full User-Mode Dumps Enabled System-Wide production
- Image File Execution Options Injection production
- Installation of Custom Shim Databases production
- Installation of Security Support Provider production
- Local Account TokenFilter Policy Disabled production
- Microsoft Windows Defender Tampering production
- Modification of AmsiEnable Registry Key production
- Modification of WDigest Security Provider production
- MS Office Macro Security Registry Modifications production
- Netsh Helper DLL production
- Network Logon Provider Registry Modification production
- NullSessionPipe Registry Modification production
- Persistence via Hidden Run Key Detected production
- Persistence via WMI Standard Registry Provider production
- Port Forwarding Rule Addition production
- Potential LSA Authentication Package Abuse production
- Potential Persistence via Time Provider Modification production
- Potential Port Monitor or Print Processor Registration Abuse production
- Potential Privilege Escalation via Service ImagePath Modification production
- Potential SharpRDP Behavior production
- PowerShell Script Block Logging Disabled production
- Privilege Escalation via Windir Environment Variable production
- RDP Enabled via Registry production
- Registry Persistence via AppCert DLL production
- Registry Persistence via AppInit DLL production
- Remote Scheduled Task Creation production
- Scheduled Task Created by a Windows Script production
- Scheduled Tasks AT Command Enabled production
- Service Disabled via Registry Modification production
- Service Path Modification production
- SIP Provider Modification production
- SolarWinds Process Disabling Services via Registry production
- Startup or Run Key Registry Modification production
- Suspicious ImagePath Service Creation production
- Suspicious Print Spooler Point and Print DLL production
- Suspicious Startup Shell Folder Modification production
- Uncommon Registry Persistence Change production
- Unusual Persistence via Services Registry production
- Werfault ReflectDebugger Persistence production
- Windows Defender Disabled via Registry Modification production
- Windows Installer with Suspicious Properties production
- Windows Subsystem for Linux Distribution Installed production
Event ID 21: WmiEvent (WmiEventConsumerToFilter activity detected) 1 rule
- Suspicious WMI Event Subscription Created production
Microsoft-Windows-Eventlog
Event ID 104: The LogFileCleared.Channel log file was cleared. 1 rule
- Windows Event Logs Cleared production
Event ID 1102: The audit log was cleared. 1 rule
- Windows Event Logs Cleared production
Microsoft-Windows-PowerShell
Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal). 14 rules
- Dynamic IEX Reconstruction via Method String Access production
- Potential AMSI Bypass via RPC Runtime Hooking production
- Potential Dynamic IEX Reconstruction via Environment Variables production
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion production
- Potential PowerShell Obfuscation via Character Array Reconstruction production
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation production
- Potential PowerShell Obfuscation via High Numeric Character Proportion production
- Potential PowerShell Obfuscation via High Special Character Proportion production
- Potential PowerShell Obfuscation via Invalid Escape Sequences production
- Potential PowerShell Obfuscation via Reverse Keywords production
- Potential PowerShell Obfuscation via Special Character Overuse production
- Potential PowerShell Obfuscation via String Concatenation production
- Potential PowerShell Obfuscation via String Reordering production
- PowerShell Obfuscation via Negative Index String Reversal production