Microsoft-Windows-Sysmon Event ID 1

Sigma (1476)

• 7Zip Compressing Dump Files severity medium T1560, T1560.001
• AADInternals PowerShell Cmdlets Execution - ProccessCreation severity high
• Abuse of Service Permissions to Hide Services Via Set-Service severity high T1574, T1574.011
• Abused Debug Privilege by Arbitrary Parent Processes severity high T1548
• Abusing Print Executable severity medium T1218
• Active Directory Database Snapshot Via ADExplorer severity medium T1069, T1069.002, T1087, T1087.002, T1482
• Active Directory Structure Export Via Csvde.EXE severity medium T1087, T1087.002
• Active Directory Structure Export Via Ldifde.EXE severity medium
• Add Insecure Download Source To Winget severity high T1059
• Add New Download Source To Winget severity medium T1059
• Add Potential Suspicious New Download Source To Winget severity medium T1059
• Add SafeBoot Keys Via Reg Utility severity high T1685
• Add Windows Capability Via PowerShell Cmdlet severity medium
• AddinUtil.EXE Execution From Uncommon Directory severity medium T1218
• Adwind RAT / JRAT severity high T1059, T1059.005, T1059.007
• AgentExecutor PowerShell Execution severity medium T1218
• All Backups Deleted Via Wbadmin.EXE severity high T1490
• Allow Service Access Using Security Descriptor Tampering Via Sc.EXE severity high T1543, T1543.003
• Always Install Elevated MSI Spawned Cmd And Powershell severity medium T1548, T1548.002
• Always Install Elevated Windows Installer severity medium T1548, T1548.002
• Application Removed Via Wmic.EXE severity medium T1047
• Application Terminated Via Wmic.EXE severity medium T1047
• APT27 - Emissary Panda Activity severity critical T1574, T1574.001
• APT29 2018 Phishing Campaign CommandLine Indicators severity critical T1218, T1218.011
• APT31 Judgement Panda Activity severity critical T1003, T1003.001, T1560, T1560.001
• Arbitrary Binary Execution Using GUP Utility severity medium
• Arbitrary Command Execution Using WSL severity medium T1202, T1218
• Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE severity medium T1218
• Arbitrary File Download Via ConfigSecurityPolicy.EXE severity medium T1567
• Arbitrary File Download Via GfxDownloadWrapper.EXE severity medium T1105
• Arbitrary File Download Via IMEWDBLD.EXE severity high T1218
• Arbitrary File Download Via MSEDGE_PROXY.EXE severity medium T1218
• Arbitrary File Download Via MSOHTMED.EXE severity medium T1218
• Arbitrary File Download Via MSPUB.EXE severity medium T1218
• Arbitrary File Download Via PresentationHost.EXE severity medium T1218
• Arbitrary File Download Via Squirrel.EXE severity medium T1218
• Arbitrary MSI Download Via Devinit.EXE severity medium T1218
• Arbitrary Shell Command Execution Via Settingcontent-Ms severity medium T1204, T1566, T1566.001
• AspNetCompiler Execution severity medium T1127
• Assembly Loading Via CL_LoadAssembly.ps1 severity medium T1216
• Attempts of Kerberos Coercion Via DNS SPN Spoofing severity high T1187, T1557, T1557.001
• Audio Capture via PowerShell severity medium T1123
• Audio Capture via SoundRecorder severity medium T1123
• Audit policy disabled by command line severity high T1562, T1562.002
• Audit policy enumerated severity high T1082
• Audit Policy Tampering Via Auditpol severity high T1685, T1685.001
• Audit Policy Tampering Via NT Resource Kit Auditpol severity high T1685, T1685.001
• Automated Collection Command Prompt severity medium T1119, T1552, T1552.001
• AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl severity medium T1216
• Axios NPM Compromise Indicators - Windows severity high T1059, T1059.003, T1059.005, T1105, T1195, T1195.002
• Bad Opsec Defaults Sacrificial Processes With Improper Arguments severity high T1218, T1218.011
• Base64 Encoded PowerShell Command Detected severity high T1027, T1059, T1059.001, T1140
• Base64 MZ Header In CommandLine severity high
• Binary Proxy Execution Via Dotnet-Trace.EXE severity medium T1218
• BitLocker feature configuration (Reg via command) severity high T1486
• BitLockerTogo.EXE Execution severity low T1218
• BITS payload downloaded via commandline severity medium T1048, T1105, T1197, T1570
• Blue Mockingbird severity high T1047, T1112
• Boot Configuration Tampering Via Bcdedit.EXE severity high T1490
• Browser Execution In Headless Mode severity low T1105, T1564, T1564.003
• Browser Started with Remote Debugging severity medium T1185
• Bypass UAC via CMSTP severity high T1218, T1218.003, T1548, T1548.002
• Bypass UAC via Fodhelper.exe severity high T1548, T1548.002
• Bypass UAC via WSReset.exe severity high T1548, T1548.002
• C# IL Code Compilation Via Ilasm.EXE severity medium T1127
• Cab File Extraction Via Wusa.EXE severity medium
• Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths severity high
• Capture Credentials with Rpcping.exe severity medium T1003
• Certificate Exported Via Certutil.EXE severity medium T1027
• Certificate Exported Via PowerShell severity medium T1059, T1059.001, T1552, T1552.004
• Certutil payload download (command) severity high T1105
• Certutil payload obfuscation (command) severity high T1140
• Certutil root certificate installation severity high T1553, T1553.004
• Change Default File Association To Executable Via Assoc severity high T1546, T1546.001
• Change Default File Association Via Assoc severity low T1546, T1546.001
• Change PowerShell Policies to an Insecure Level severity medium T1059, T1059.001
• Changing Existing Service ImagePath Value Via Reg.EXE severity medium T1574, T1574.011
• Chopper Webshell Process Pattern severity high T1018, T1033, T1087, T1505, T1505.003
• ChromeLoader Malware Execution severity high T1053, T1053.005, T1059, T1059.001, T1176
• Chromium Browser Headless Execution To Mockbin Like Site severity high
• Chromium Browser Instance Executed With Custom Extension severity medium T1176, T1176.001
• ClickOnce Deployment Execution - Dfsvc.EXE Child Process severity medium
• Cloudflared Portable Execution severity medium T1090, T1090.001
• Cloudflared Quick Tunnel Execution severity medium T1090, T1090.001
• Cloudflared Tunnel Connections Cleanup severity medium T1090, T1102, T1572
• Cloudflared Tunnel Execution severity medium T1090, T1102, T1572
• Cmd Launched with Hidden Start Flags to Suspicious Targets severity medium T1564, T1564.003
• CMD Shell Output Redirect severity low T1082
• Cmd.EXE Missing Space Characters Execution Anomaly severity high T1059, T1059.001
• CMSTP Execution Process Creation severity high T1218, T1218.003
• CMSTP UAC Bypass via COM Object Access severity high T1218, T1218.003, T1548, T1548.002
• CobaltStrike Load by Rundll32 severity high T1218, T1218.011
• Code Execution via Pcwutl.dll severity medium T1218, T1218.011
• CodePage Modification Via MODE.COM severity low T1036
• CodePage Modification Via MODE.COM To Russian Language severity medium T1036
• COLDSTEEL RAT Anonymous User Process Execution severity high
• COLDSTEEL RAT Cleanup Command Execution severity critical
• COLDSTEEL RAT Service Persistence Execution severity critical
• COM Object Execution via Xwizard.EXE severity medium T1218
• Command Line Execution with Suspicious URL and AppData Strings severity medium T1059, T1059.001, T1059.003, T1105
• Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791) severity high T1190
• Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788) severity medium T1078, T1078.001
• Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790) severity high T1505, T1505.003
• Compress Data and Lock With Password for Exfiltration With 7-ZIP severity medium T1560, T1560.001
• Compress Data and Lock With Password for Exfiltration With WINZIP severity medium T1560, T1560.001
• Compressed File Creation Via Tar.EXE severity low T1560, T1560.001
• Compressed File Extraction Via Tar.EXE severity low T1560, T1560.001
• Computer Discovery And Export Via Get-ADComputer Cmdlet severity medium T1033
• Computer Password Change Via Ksetup.EXE severity medium
• Computer System Reconnaissance Via Wmic.EXE severity medium T1047
• Conhost Spawned By Uncommon Parent Process severity medium T1059
• Conhost.exe CommandLine Path Traversal severity high T1059, T1059.003
• Console CodePage Lookup Via CHCP severity medium T1614, T1614.001
• Conti NTDS Exfiltration Command severity high T1560
• Conti Volume Shadow Listing severity high T1587, T1587.001
• Control Panel Items severity high T1218, T1218.002, T1546
• ConvertTo-SecureString Cmdlet Usage Via CommandLine severity medium T1027, T1059, T1059.001
• Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE severity high
• Copy From Or To Admin Share Or Sysvol Folder severity medium T1021, T1021.002, T1039, T1048
• Copy From VolumeShadowCopy Via Cmd.EXE severity high T1490
• Copying Sensitive Files with Credential Data severity high T1003, T1003.002, T1003.003
• CreateDump Process Dump severity high T1003, T1003.001, T1036
• Csc.EXE Execution Form Potentially Suspicious Parent severity high T1027, T1027.004, T1059, T1059.005, T1059.007, T1218
• Cscript/Wscript Potentially Suspicious Child Process severity medium
• Cscript/Wscript Uncommon Script Extension Execution severity high T1059, T1059.005, T1059.007
• Curl Download And Execute Combination severity high T1105, T1218
• Curl Web Request With Potential Custom User-Agent severity medium
• Curl.EXE Execution severity low T1105
• Curl.EXE Execution With Custom UserAgent severity medium T1071, T1071.001
• CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) severity medium T1059, T1190
• CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process severity high T1203
• CVE-2024-50623 Exploitation Attempt - Cleo severity high T1190
• DarkGate - Autoit3.EXE Execution Parameters severity high T1059
• DarkGate - User Created Via Net.EXE severity high T1136, T1136.001
• DarkSide Ransomware Pattern severity critical T1204
• Data Copied To Clipboard Via Clip.EXE severity low T1115
• Data Export From MSSQL Table Via BCP.EXE severity medium T1048
• Defrag Deactivation severity medium T1053, T1053.005
• Delete All Scheduled Tasks severity high T1489
• Delete Important Scheduled Task severity high T1489
• Deleted Data Overwritten Via Cipher.EXE severity medium T1485
• Deletion of Volume Shadow Copies via WMI with PowerShell severity high T1490
• Deny Service Access Using Security Descriptor Tampering Via Sc.EXE severity high T1543, T1543.003
• Detected Windows Software Discovery severity medium T1518
• Detection of PowerShell Execution via Sqlps.exe severity medium T1059, T1059.001, T1127
• Devcon Execution Disabling VMware VMCI Device severity high T1543, T1543.003, T1685
• DeviceCredentialDeployment Execution severity medium T1218
• Devtoolslauncher.exe Executes Specified Binary severity high T1218
• Diamond Sleet APT Process Activity Indicators severity high
• Direct Autorun Keys Modification severity medium T1547, T1547.001
• Directory Removal Via Rmdir severity low T1070, T1070.004
• DirLister Execution severity low T1083
• Disable Important Scheduled Task severity high T1489
• Disable Windows Defender AV Security Monitoring severity high T1685
• Disable Windows IIS HTTP Logging severity high T1685, T1685.001
• Disabled IE Security Features severity high T1685
• Disabled Volume Snapshots severity high T1685
• Disabling Windows Defender WMI Autologger Session via Reg.exe severity high T1685
• Discovery of a System Time severity low T1124
• Diskshadow Child Process Spawned severity medium T1218
• Diskshadow Script Mode - Execution From Potential Suspicious Location severity medium T1218
• Diskshadow Script Mode - Uncommon Script Extension Execution severity medium T1218
• Diskshadow Script Mode Execution severity medium T1218
• Dism Remove Online Package severity medium T1685
• DLL Call by Ordinal Via Rundll32.EXE severity medium T1218, T1218.011
• DLL Execution via Rasautou.exe severity medium T1218
• DLL Execution Via Register-cimprovider.exe severity medium T1574
• DLL Loaded via CertOC.EXE severity medium T1218
• DLL ServerLevelPluginDll command installation severity critical T1574, T1574.002
• DLL Sideloading by VMware Xfer Utility severity high T1574, T1574.001
• Dllhost.EXE Execution Anomaly severity high T1055
• DllUnregisterServer Function Call Via Msiexec.EXE severity medium T1218, T1218.007
• DNS Exfiltration and Tunneling Tools Execution severity high T1048, T1048.001, T1071, T1071.004, T1132, T1132.001
• DNS RCE CVE-2020-1350 severity critical T1190, T1569, T1569.002
• Domain Trust Discovery Via Dsquery severity medium T1482
• Driver/DLL Installation Via Odbcconf.EXE severity medium T1218, T1218.008
• DriverQuery.EXE Execution severity medium
• Droppers Exploiting CVE-2017-11882 severity critical T1203, T1204, T1204.002, T1566, T1566.001
• Dropping Of Password Filter DLL severity medium T1556, T1556.002
• DSInternals Suspicious PowerShell Cmdlets severity high T1059, T1059.001
• Dumping of Sensitive Hives Via Reg.EXE severity high T1003, T1003.002, T1003.004, T1003.005
• Dumping Process via Sqldumper.exe severity medium T1003, T1003.001
• DumpMinitool Execution severity medium T1003, T1003.001, T1036
• DumpStack.log Defender Evasion severity critical
• Dynamic .NET Compilation Via Csc.EXE severity medium T1027, T1027.004
• Dynamic .NET Compilation Via Csc.EXE - Hunting severity medium T1027, T1027.004
• EAP service activation by Liontail framework for DLL sideloading (via command) severity medium T1543, T1543.003
• Elevated System Shell Spawned severity medium T1059
• Elevated System Shell Spawned From Uncommon Parent Location severity medium T1059
• Elise Backdoor Activity severity critical T1059, T1059.003
• Email Exifiltration Via Powershell severity high
• Emotet Loader Execution Via .LNK File severity high T1059, T1059.006
• Enable LM Hash Storage - ProcCreation severity high T1112
• Encoded PowerShell payload deployed via process execution severity high T1027, T1059, T1059.003
• Enumerate All Information With Whoami.EXE severity medium T1033
• Enumeration for 3rd Party Creds From CLI severity medium T1552, T1552.002
• Enumeration for Credentials in Registry severity medium T1552, T1552.002
• Equation Group DLL_U Export Function Load severity critical T1218, T1218.011
• Esentutl Gather Credentials severity medium T1003, T1003.003
• Esentutl Steals Browser Information severity medium T1005
• ETW Logging Tamper In .NET Processes Via CommandLine severity high T1685
• ETW Trace Evasion Activity severity high T1070, T1685
• Event log clear attempt (command) severity high T1070, T1070.001
• Event log clear attempt (wmi) severity high T1070, T1070.001
• Event log deactivation or size reduction (command) severity high T1562, T1562.002
• EventLog Query Requests By Builtin Utilities severity medium T1552
• EvilNum APT Golden Chickens Deployment Via OCX Files severity critical T1218, T1218.011
• Exchange PowerShell Snap-Ins Usage severity high T1059, T1059.001, T1114
• Execute Code with Pester.bat severity medium T1059, T1059.001, T1216
• Execute Code with Pester.bat as Parent severity medium T1059, T1059.001, T1216
• Execute Files with Msdeploy.exe severity medium T1218
• Execute From Alternate Data Streams severity medium T1564, T1564.004
• Execute Pcwrun.EXE To Leverage Follina severity high T1218
• Execution From Webserver Root Folder severity medium T1505, T1505.003
• Execution Of Non-Existing File severity high
• Execution of Powershell Script in Public Folder severity high T1059, T1059.001
• Execution of Suspicious File Type Extension severity medium
• Execution via stordiag.exe severity high T1218
• Execution via WorkFolders.exe severity high T1218
• Exploit for CVE-2015-1641 severity critical T1036, T1036.005
• Exploit for CVE-2017-0261 severity medium T1203, T1204, T1204.002, T1566, T1566.001
• Exploit for CVE-2017-8759 severity critical T1203, T1204, T1204.002, T1566, T1566.001
• Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process severity high T1190, T1203
• Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC severity high T1210
• Exploited CVE-2020-10189 Zoho ManageEngine severity high T1059, T1059.001, T1059.003, T1190
• Exploiting CVE-2019-1388 severity critical T1068
• Exploiting SetupComplete.cmd CVE-2019-1378 severity high T1059, T1059.003, T1068, T1574
• Explorer NOUACCHECK Flag severity high T1548, T1548.002
• Explorer Process Tree Break severity medium T1036
• Exports Critical Registry Keys To a File severity high T1012
• Exports Registry Key To a File severity low T1012
• FakeUpdates/SocGholish Activity severity high T1059, T1059.001
• File And SubFolder Enumeration Via Dir Command severity low T1217
• File Decoded From Base64/Hex Via Certutil.EXE severity high T1027
• File Decryption Using Gpg4win severity medium
• File Deletion Via Del severity low T1070, T1070.004
• File Download And Execution Via IEExec.EXE severity high T1105
• File Download From Browser Process Via Inline URL severity medium T1105
• File Download From IP Based URL Via CertOC.EXE severity high T1105
• File Download From IP URL Via Curl.EXE severity medium
• File Download Using Notepad++ GUP Utility severity high T1105
• File Download Using ProtocolHandler.exe severity medium T1218
• File Download Via Bitsadmin severity medium T1036, T1036.003, T1105, T1197
• File Download Via Bitsadmin To A Suspicious Target Folder severity high T1036, T1036.003, T1105, T1197
• File Download via CertOC.EXE severity medium T1105
• File Download Via Curl.EXE severity medium T1105
• File Download Via InstallUtil.EXE severity medium T1218
• File Download Via Windows Defender MpCmpRun.EXE severity high T1105, T1218
• File Download with Headless Browser severity high T1105, T1564, T1564.003
• File Encoded To Base64 Via Certutil.EXE severity medium T1027
• File Encryption Using Gpg4win severity medium
• File Encryption/Decryption Via Gpg4win From Suspicious Locations severity high
• File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell severity high T1135
• File In Suspicious Location Encoded To Base64 Via Certutil.EXE severity high T1027
• File or Folder Permissions Modifications severity medium T1222, T1222.001
• File Recovery From Backup Via Wbadmin.EXE severity medium T1490
• File With Suspicious Extension Downloaded Via Bitsadmin severity high T1036, T1036.003, T1105, T1197
• Files Added To An Archive Using Rar.EXE severity low T1560, T1560.001
• Filter Driver Unloaded Via Fltmc.EXE severity medium T1070, T1685, T1685.001
• Findstr GPP Passwords severity high T1552, T1552.006
• Findstr Launching .lnk File severity medium T1027, T1027.003, T1036, T1202
• Finger.EXE Execution severity high T1105
• Fireball Archer Install severity high T1218, T1218.011
• Firewall Configuration Discovery Via Netsh.EXE severity low T1016
• Firewall Disabled via Netsh.EXE severity medium T1686, T1686.003
• Firewall Rule Deleted Via Netsh.EXE severity medium T1686, T1686.003
• Firewall Rule Update Via Netsh.EXE severity medium
• Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet severity medium T1074, T1074.001
• Forest Blizzard APT - Process Creation Activity severity high
• Forfiles Command Execution severity medium T1059
• Forfiles.EXE Child Process Masquerading severity high T1036
• Formbook Process Creation severity high T1587, T1587.001
• Fsutil Drive Enumeration severity low T1120
• Fsutil Suspicious Invocation severity high T1070, T1485
• FTP Connection Open Attempt Via Winscp CLI severity medium T1048
• GALLIUM IOCs severity high T1071, T1212
• Github Self-Hosted Runner Execution severity medium T1071, T1102, T1102.002
• Gpresult Display Group Policy Information severity medium T1615
• Gpscript Execution severity medium T1218
• Greedy File Deletion Using Del severity medium T1070, T1070.004
• Greenbug Espionage Group Indicators severity critical T1036, T1036.005, T1059, T1059.001, T1105
• Griffon Malware Attack Pattern severity critical
• Grixba Malware Reconnaissance Activity severity high T1046, T1595, T1595.001
• Group discovery (command) severity medium T1069, T1069.001, T1069.002, T1087, T1087.002
• Group Membership Reconnaissance Via Whoami.EXE severity medium T1033
• Gzip Archive Decode Via PowerShell severity medium T1132, T1132.001
• HackTool - ADCSPwn Execution severity high T1557, T1557.001
• HackTool - Bloodhound/Sharphound Execution severity high T1059, T1059.001, T1069, T1069.001, T1069.002, T1087
• HackTool - Certify Execution severity high T1649
• HackTool - Certipy Execution severity high T1649
• HackTool - CoercedPotato Execution severity high T1055
• HackTool - Covenant PowerShell Launcher severity high T1059, T1059.001, T1564, T1564.003
• HackTool - CrackMapExec Execution severity high T1047, T1053, T1059, T1059.001, T1059.003, T1110
• HackTool - CrackMapExec Execution Patterns severity high T1047, T1053, T1059, T1059.001, T1059.003
• HackTool - CrackMapExec PowerShell Obfuscation severity high T1027, T1027.005, T1059, T1059.001
• HackTool - CrackMapExec Process Patterns severity high T1003, T1003.001
• HackTool - CreateMiniDump Execution severity high T1003, T1003.001
• HackTool - Default PowerSploit/Empire Scheduled Task Creation severity high T1053, T1053.005, T1059, T1059.001
• HackTool - DInjector PowerShell Cradle Execution severity critical T1055
• HackTool - Doppelanger LSASS Dumper Execution severity high T1003, T1003.001
• HackTool - Dumpert Process Dumper Execution severity critical T1003, T1003.001
• Hacktool - EDR-Freeze Execution severity high T1685
• HackTool - EDRSilencer Execution severity high T1685
• HackTool - Empire PowerShell Launch Parameters severity high T1059, T1059.001
• HackTool - Empire PowerShell UAC Bypass severity critical T1548, T1548.002
• HackTool - F-Secure C3 Load by Rundll32 severity critical T1218, T1218.011
• HackTool - GMER Rootkit Detector and Remover Execution severity high
• HackTool - HandleKatz LSASS Dumper Execution severity high T1003, T1003.001
• HackTool - Hashcat Password Cracker Execution severity high T1110, T1110.002
• HackTool - HollowReaper Execution severity high T1055, T1055.012
• HackTool - Htran/NATBypass Execution severity high T1090
• HackTool - Hydra Password Bruteforce Execution severity high T1110, T1110.001
• HackTool - Impacket Tools Execution severity high T1557, T1557.001
• HackTool - Impersonate Execution severity medium T1134, T1134.001, T1134.003
• HackTool - Inveigh Execution severity critical T1003, T1003.001
• HackTool - Jlaive In-Memory Assembly Execution severity medium T1059, T1059.003
• HackTool - Koadic Execution severity high T1059, T1059.003, T1059.005, T1059.007
• HackTool - KrbRelay Execution severity high T1558, T1558.003
• HackTool - KrbRelayUp Execution severity high T1550, T1550.003, T1558, T1558.003
• HackTool - LaZagne Execution severity medium
• HackTool - LocalPotato Execution severity high
• HackTool - Mimikatz Execution severity high T1003, T1003.001, T1003.002, T1003.004, T1003.005, T1003.006
• HackTool - NetExec Execution severity high T1018, T1021
• HackTool - PCHunter Execution severity high T1007, T1012, T1057, T1082, T1083
• HackTool - Potential Impacket Lateral Movement Activity severity high T1021, T1021.003, T1047
• HackTool - PowerTool Execution severity high T1685
• HackTool - PPID Spoofing SelectMyParent Tool Execution severity high T1134, T1134.004
• HackTool - PurpleSharp Execution severity critical T1587
• HackTool - Pypykatz Credentials Dumping Activity severity high T1003, T1003.002
• HackTool - Quarks PwDump Execution severity high T1003, T1003.002
• HackTool - RedMimicry Winnti Playbook Execution severity high T1059, T1059.003, T1106, T1218, T1218.011
• HackTool - RemoteKrbRelay Execution severity high T1558, T1558.003
• HackTool - Rubeus Execution severity critical T1003, T1550, T1550.003, T1558, T1558.003
• HackTool - SafetyKatz Execution severity critical T1003, T1003.001
• HackTool - SecurityXploded Execution severity critical T1555
• HackTool - SharpChisel Execution severity high T1090, T1090.001
• HackTool - SharpDPAPI Execution severity high T1134, T1134.001, T1134.003
• HackTool - SharPersist Execution severity high T1053
• HackTool - SharpEvtMute Execution severity high T1685, T1685.001
• HackTool - SharpImpersonation Execution severity high T1134, T1134.001, T1134.003
• HackTool - SharpLDAPmonitor Execution severity medium
• HackTool - SharpLdapWhoami Execution severity high T1033
• HackTool - SharpMove Tool Execution severity high T1021, T1021.002
• HackTool - SharpUp PrivEsc Tool Execution severity critical T1569, T1569.002, T1574, T1574.005, T1615
• HackTool - SharpView Execution severity high T1033, T1049, T1069, T1069.002, T1135, T1482
• HackTool - SharpWSUS/WSUSpendu Execution severity high T1210
• HackTool - SILENTTRINITY Stager Execution severity high T1071
• HackTool - Sliver C2 Implant Activity Pattern severity critical T1059
• HackTool - SOAPHound Execution severity high T1087
• HackTool - Stracciatella Execution severity high T1059, T1685
• HackTool - SysmonEOP Execution severity critical T1068
• HackTool - TruffleSnout Execution severity high T1482
• HackTool - UACMe Akagi Execution severity high T1548, T1548.002
• HackTool - Windows Credential Editor (WCE) Execution severity critical T1003, T1003.001
• HackTool - winPEAS Execution severity high T1046, T1082, T1087
• HackTool - WinPwn Execution severity high T1046, T1082, T1106, T1518, T1548, T1548.002
• HackTool - WinRM Access Via Evil-WinRM severity medium T1021, T1021.006
• HackTool - Wmiexec Default Powershell Command severity high
• HackTool - WSASS Execution severity high T1003, T1003.001
• HackTool - XORDump Execution severity high T1003, T1003.001, T1036
• Hacktool Execution - Imphash severity critical T1003, T1588, T1588.002
• Hacktool Execution - PE Metadata severity high T1003, T1588, T1588.002
• HAFNIUM Exchange Exploitation Activity severity critical T1053, T1546
• Hardware Model Reconnaissance Via Wmic.EXE severity medium T1047
• Harvesting Of Wifi Credentials Via Netsh.EXE severity medium T1040
• Headless Process Launched Via Conhost.EXE severity medium T1059, T1059.001, T1059.003
• Hermetic Wiper TG Process Patterns severity high T1021, T1021.001
• HH.EXE Execution severity low T1218, T1218.001
• Hidden Powershell in Link File Pattern severity medium T1059, T1059.001
• Hiding Files with Attrib.exe severity medium T1564, T1564.001
• Hiding User Account Via SpecialAccounts Registry Key - CommandLine severity medium T1564, T1564.002
• HKTL - SharpSuccessor Privilege Escalation Tool Execution severity high T1068
• HTML File Opened From Download Folder severity low T1566, T1566.001, T1598, T1598.002
• HTML Help HH.EXE Suspicious Child Process severity high T1047, T1059, T1059.001, T1059.003, T1059.005, T1059.007
• Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine severity high T1685
• IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32 severity high T1218, T1218.011
• IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI severity high
• Ie4uinit Lolbin Use From Invalid Path severity medium T1218
• IFM creation detected from commandline (installation from media) severity high T1003, T1003.003
• IIS Application Pool credential dumping severity high T1003
• IIS Native-Code Module Command Line Installation severity medium T1505, T1505.003
• IIS WebServer Log Deletion via CommandLine Utilities severity medium T1070
• ImagingDevices Unusual Parent/Child Processes severity high
• Impacket DCOMexec process abuse via MMC severity high T1021, T1021.003
• Impacket WMIexec process execution severity high T1047
• Import LDAP Data Interchange Format File Via Ldifde.EXE severity medium T1105, T1218
• Import New Module Via PowerShell CommandLine severity low
• Import PowerShell Modules From Suspicious Directories - ProcCreation severity medium T1059, T1059.001
• Imports Registry Key From a File severity medium T1112
• Imports Registry Key From an ADS severity high T1112
• Indirect Command Execution By Program Compatibility Wizard severity low T1218
• Indirect Command Execution From Script File Via Bash.EXE severity medium T1202
• Indirect Command Execution via SFTP ProxyCommand severity medium T1202
• Indirect Inline Command Execution Via Bash.EXE severity medium T1202
• InfDefaultInstall.exe .inf Execution severity medium T1218
• Injected Browser Process Spawning Rundll32 - GuLoader Activity severity high T1055
• Insecure Proxy/DOH Transfer Via Curl.EXE severity medium
• Insecure Transfer Via Curl.EXE severity medium
• Insensitive Subfolder Search Via Findstr.EXE severity low T1105, T1218, T1552, T1552.001, T1564, T1564.004
• Install New Package Via Winget Local Manifest severity medium T1059
• Installation of WSL Kali-Linux severity high T1059
• Interactive AT Job severity high T1053, T1053.002
• Interesting Service Enumeration Via Sc.EXE severity low T1003
• Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) severity medium T1003, T1003.003
• Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace severity medium T1027, T1027.010, T1059, T1059.001
• Invoke-Obfuscation CLIP+ Launcher severity high T1027, T1059, T1059.001
• Invoke-Obfuscation COMPRESS OBFUSCATION severity medium T1027, T1059, T1059.001
• Invoke-Obfuscation Obfuscated IEX Invocation severity high T1027, T1059, T1059.001
• Invoke-Obfuscation STDIN+ Launcher severity high T1027, T1059, T1059.001
• Invoke-Obfuscation VAR+ Launcher severity high T1027, T1059, T1059.001
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION severity high T1027, T1059, T1059.001
• Invoke-Obfuscation Via Stdin severity high T1027, T1059, T1059.001
• Invoke-Obfuscation Via Use Clip severity high T1027, T1059, T1059.001
• Invoke-Obfuscation Via Use MSHTA severity high T1027, T1059, T1059.001
• Java Running with Remote Debugging severity medium T1203
• JScript Compiler Execution severity low T1127
• Kalambur Backdoor Curl TOR SOCKS Proxy Execution severity high T1059, T1059.001, T1071, T1071.001, T1090, T1573
• Kapeka Backdoor Execution Via RunDLL32.EXE severity high T1218, T1218.011
• Kapeka Backdoor Persistence Activity severity high T1053, T1053.005
• Kavremover Dropped Binary LOLBIN Usage severity high T1127
• Kernel Memory Dump Via LiveKD severity high
• Lace Tempest Cobalt Strike Download severity high
• Lace Tempest Malware Loader Execution severity high
• Launch-VsDevShell.PS1 Proxy Execution severity medium T1216, T1216.001
• Lazarus Group Activity severity critical T1059
• Lazarus System Binary Masquerading severity high T1036, T1036.005
• Loaded Module Enumeration Via Tasklist.EXE severity medium T1003
• Local Accounts Discovery severity low T1033, T1087, T1087.001
• Local File Read Using Curl.EXE severity medium
• Local Groups Reconnaissance Via Wmic.EXE severity low T1069, T1069.001
• LockerGoga Ransomware Activity severity critical T1486
• Logged-On User Password Change Via Ksetup.EXE severity medium
• LOL-Binary Copied From System Directory severity high T1036, T1036.003
• LOLBAS Data Exfiltration by DataSvcUtil.exe severity medium T1567
• LOLBIN Execution From Abnormal Drive severity medium
• Lolbin Runexehelper Use As Proxy severity medium T1218
• Lolbin Unregmp2.exe Use As Proxy severity medium T1218
• LSA PPL Protection Setting Modification via CommandLine severity medium T1689
• LSASS credential dump with LSASSY (process) severity high T1003, T1003.001
• LSASS Dump Keyword In CommandLine severity high T1003, T1003.001
• LSASS Process Reconnaissance Via Findstr.EXE severity high T1552, T1552.006
• Lummac Stealer Activity - Execution Of More.com And Vbc.exe severity high T1055
• Malicious Base64 Encoded PowerShell Keywords in Command Lines severity high T1059, T1059.001
• Malicious PE Execution by Microsoft Visual Studio Debugger severity medium T1218
• Malicious PowerShell Commandlets - ProcessCreation severity high T1059, T1059.001, T1069, T1069.001, T1069.002, T1087
• Malicious Windows Script Components File Execution by TAEF Detection severity low T1218
• ManageEngine Endpoint Central Dctask64.EXE Potential Abuse severity high T1055, T1055.001
• Manual Execution of Script Inside of a Compressed File severity medium T1059
• Massive processes termination burst severity high T1489
• Massive services deletion burst severity high T1489
• Massive services termination burst severity high T1489
• Mavinject Inject DLL Into Running Process severity high T1055, T1055.001, T1218, T1218.013
• MERCURY APT Activity severity high T1059, T1059.001
• Metasploit reverse shell injection in SQL Server severity high T1059, T1059.003
• Microsoft Defender service deactivation attempt (command) severity high T1562, T1562.001
• Microsoft IIS Connection Strings Decryption severity high T1003
• Microsoft IIS Service Account Password Dumped severity high T1003
• Microsoft Workflow Compiler Execution severity medium T1127, T1218
• Mint Sandstorm - AsperaFaspex Suspicious Process Execution severity critical
• Mint Sandstorm - Log4J Wstomcat Process Execution severity high
• Mint Sandstorm - ManageEngine Suspicious Process Execution severity critical
• MMC Executing Files with Reversed Extensions Using RTLO Abuse severity high T1036, T1036.002, T1204, T1204.002, T1218, T1218.014
• MMC Spawning Windows Shell severity high T1021, T1021.003
• MMC20 Lateral Movement severity high T1021, T1021.003
• Modify Group Policy Settings severity medium T1484, T1484.001
• Monitoring For Persistence Via BITS severity medium T1197
• MpiExec Lolbin severity high T1218
• MSDT Execution Via Answer File severity high T1218
• MSExchange Transport Agent Installation severity medium T1505, T1505.002
• MSHTA Execution with Suspicious File Extensions severity high T1059, T1059.007, T1140, T1218, T1218.005
• Mshtml.DLL RunHTMLApplication Suspicious Usage severity high
• Msiexec Quiet Installation severity medium T1218, T1218.007
• MsiExec Web Install severity medium T1105, T1218, T1218.007
• Mstsc.EXE Execution From Uncommon Parent severity high
• Mstsc.EXE Execution With Local RDP File severity low T1219, T1219.002
• Msxsl.EXE Execution severity medium T1220
• Mustang Panda Dropper severity high T1587, T1587.001
• Net WebClient Casing Anomalies severity high T1059, T1059.001
• Net.EXE Execution severity low T1007, T1018, T1021, T1021.002, T1049, T1069
• Netsh Allow Group Policy on Microsoft Defender Firewall severity medium T1686, T1686.003
• Network Reconnaissance Activity severity high T1082, T1087
• Network share discovery and/or connection via commandline severity high T1135
• New ActiveScriptEventConsumer Created Via Wmic.EXE severity high T1546, T1546.003
• New Capture Session Launched Via DXCap.EXE severity medium T1218
• New DLL Registered Via Odbcconf.EXE severity medium T1218, T1218.008
• New DMSA Service Account Created in Specific OUs severity medium T1078, T1078.002, T1098
• New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE severity high T1112, T1574, T1574.001
• New Firewall Rule Added Via Netsh.EXE severity medium T1686, T1686.003
• New Generic Credentials Added Via Cmdkey.EXE severity medium T1003, T1003.005
• New Kernel Driver Via SC.EXE severity medium T1543, T1543.003
• New Network Trace Capture Started Via Netsh.EXE severity medium T1040
• New Port Forwarding Rule Added Via Netsh.EXE severity medium T1090
• New Process Created Via Taskmgr.EXE severity low T1036
• New Process Created Via Wmic.EXE severity medium T1047
• New Remote Desktop Connection Initiated Via Mstsc.EXE severity medium T1021, T1021.001
• New Root Certificate Installed Via CertMgr.EXE severity medium T1553, T1553.004
• New Root Certificate Installed Via Certutil.EXE severity medium T1553, T1553.004
• New Self Extracting Package Created Via IExpress.EXE severity medium T1218
• New Service Creation Using PowerShell severity low T1543, T1543.003
• New Service Creation Using Sc.EXE severity low T1543, T1543.003
• New User Created Via Net.EXE severity medium T1136, T1136.001
• New User Created Via Net.EXE With Never Expire Option severity high T1136, T1136.001
• New Virtual Smart Card Created Via TpmVscMgr.EXE severity medium
• New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet severity low T1686, T1686.003
• Nltest.EXE Execution severity low T1016, T1018, T1482
• Node Process Executions severity medium T1059, T1059.007, T1127
• NodeJS Execution of JavaScript File severity low T1059, T1059.007
• Non Interactive PowerShell Process Spawned severity low T1059, T1059.001
• Non-privileged Usage of Reg or Powershell severity high T1112
• Notepad Password Files Discovery severity low T1083
• NotPetya Ransomware Activity severity critical T1003, T1003.001, T1218, T1218.011, T1685, T1685.005
• Nslookup PowerShell Download Cradle - ProcessCreation severity medium
• NtdllPipe Like Activity Execution severity high
• NTFS symbolic link configuration change severity medium T1547, T1547.009
• NTFS symbolic link creation severity medium T1547, T1547.009
• NTLM Hash Leak Via Curl NTLM Authentication severity high T1187
• Number of oustanding SMB requests increased severity medium T1021, T1021.002
• Obfuscated IP Download Activity severity medium
• Obfuscated IP Via CLI severity medium
• Obfuscated PowerShell MSI Install via WindowsInstaller COM severity high T1027, T1027.010, T1059, T1059.001, T1218, T1218.007
• Obfuscated PowerShell OneLiner Execution severity high T1059, T1059.001, T1685
• Odbcconf.EXE Suspicious DLL Location severity high T1218, T1218.008
• OilRig APT Activity severity critical T1053, T1053.005, T1071, T1071.004, T1112, T1543
• OneNote.EXE Execution of Malicious Embedded Scripts severity high T1218, T1218.001
• OpenEDR Spawning Command Shell severity medium T1021, T1021.004, T1059, T1059.003, T1219
• OpenWith.exe Executes Specified Binary severity high T1218
• Operation Wocao Activity severity high T1012, T1027, T1036, T1036.004, T1053, T1053.005
• Operator Bloopers Cobalt Strike Commands severity high T1059, T1059.003
• Operator Bloopers Cobalt Strike Modules severity high T1059, T1059.003
• Outlook EnableUnsafeClientMailRules Setting Enabled severity high T1059, T1202
• PaperCut MF/NG Exploitation Related Indicators severity high
• PaperCut MF/NG Potential Exploitation severity high
• Password policy discovery via commandline severity high T1201
• Password Protected Compressed File Extraction Via 7Zip severity low T1560, T1560.001
• Password Provided In Command Line Of Net.EXE severity medium T1021, T1021.002, T1078
• Password Set to Never Expire via WMI severity medium T1047, T1098
• PDQ Deploy Remote Adminstartion Tool Execution severity medium T1072
• Peach Sandstorm APT Process Activity Indicators severity high
• Perl Inline Command Execution severity medium T1059
• Permission Check Via Accesschk.EXE severity medium T1069, T1069.001
• Permission Misconfiguration Reconnaissance Via Findstr.EXE severity medium T1552, T1552.006
• Persistence Via Sticky Key Backdoor severity critical T1546, T1546.008
• Persistence Via TypedPaths - CommandLine severity medium
• Phishing Pattern ISO in Archive severity high T1566
• Php Inline Command Execution severity medium T1059
• Pikabot Fake DLL Extension Execution Via Rundll32.EXE severity high
• Ping Hex IP severity high T1027, T1140
• Pingback Backdoor Activity severity high T1574, T1574.001
• PktMon.EXE Execution severity medium T1040
• Port Forwarding Activity Via SSH.EXE severity medium T1021, T1021.001, T1021.004, T1572
• Portable Gpg.EXE Execution severity medium T1486
• Possible impact of 'SMOKEDHAM backdoor' with MSDTC service privilege escalation via command line severity medium T1543, T1543.003, T1574, T1574.002
• Possible Privilege Escalation via Weak Service Permissions severity high T1574, T1574.011
• Potential ACTINIUM Persistence Activity severity high T1053, T1053.005
• Potential Active Directory Enumeration Using AD Module - ProcCreation severity medium
• Potential Adplus.EXE Abuse severity high T1003, T1003.001
• Potential Amazon SSM Agent Hijacking severity medium T1219, T1219.002
• Potential AMSI Bypass Using NULL Bits severity medium T1685
• Potential AMSI Bypass Via .NET Reflection severity high T1685
• Potential Application Whitelisting Bypass via Dnx.EXE severity medium T1027, T1027.004, T1218
• Potential APT FIN7 Exploitation Activity severity medium T1059, T1059.001, T1059.003
• Potential APT FIN7 Reconnaissance/POWERTRASH Related Activity severity high
• Potential APT Mustang Panda Activity Against Australian Gov severity high
• Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32 severity medium T1218, T1218.010
• Potential APT10 Cloud Hopper Activity severity high T1059, T1059.005
• Potential Arbitrary Code Execution Via Node.EXE severity high T1127
• Potential Arbitrary Command Execution Using Msdt.EXE severity high T1202
• Potential Arbitrary Command Execution Via FTP.EXE severity medium T1059, T1202
• Potential Arbitrary DLL Load Using Winword severity medium T1202
• Potential Arbitrary File Download Using Office Application severity high T1202
• Potential Arbitrary File Download Via Cmdl32.EXE severity medium T1202, T1218
• Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt severity high T1059, T1190
• Potential Baby Shark Malware Activity severity high T1012, T1059, T1059.001, T1059.003, T1218, T1218.005
• Potential BearLPE Exploitation severity high T1053, T1053.005
• Potential Binary Impersonating Sysinternals Tools severity medium T1036, T1036.005, T1202, T1218
• Potential Binary Proxy Execution Via Cdb.EXE severity medium T1106, T1127, T1218
• Potential Binary Proxy Execution Via VSDiagnostics.EXE severity medium T1218
• Potential BlackByte Ransomware Activity severity high T1059, T1059.001, T1140, T1485, T1498
• Potential BOINC Software Execution (UC-Berkeley Signature) severity informational T1553
• Potential Browser Data Stealing severity medium T1555, T1555.003
• Potential CobaltStrike Process Patterns severity high T1059
• Potential COM Objects Download Cradles Usage - Process Creation severity medium T1105
• Potential Command Line Path Traversal Evasion Attempt severity medium T1036
• Potential Commandline Obfuscation Using Escape Characters severity medium T1140
• Potential CommandLine Obfuscation Using Unicode Characters severity medium T1027
• Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image severity high T1027
• Potential CommandLine Path Traversal Via Cmd.EXE severity high T1059, T1059.003
• Potential Compromised 3CXDesktopApp Execution severity high T1218
• Potential Compromised 3CXDesktopApp Update Activity severity high T1218
• Potential Configuration And Service Reconnaissance Via Reg.EXE severity medium T1007, T1012
• Potential Conti Ransomware Activity severity critical T1486
• Potential Conti Ransomware Database Dumping Activity Via SQLCmd severity high T1005
• Potential Cookies Session Hijacking severity medium
• Potential Credential Dumping Attempt Using New NetworkProvider - CLI severity high T1003
• Potential Credential Dumping Via LSASS Process Clone severity critical T1003, T1003.001
• Potential Credential Dumping Via WER severity high T1003, T1003.001
• Potential Crypto Mining Activity severity high T1496
• Potential CVE-2021-26857 Exploitation Attempt severity high T1203
• Potential CVE-2021-40444 Exploitation Attempt severity high T1059
• Potential CVE-2021-41379 Exploitation Attempt severity critical T1068
• Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon severity high T1190
• Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution severity medium T1059, T1059.006, T1190
• Potential CVE-2022-26809 Exploitation Attempt severity high T1190, T1569, T1569.002
• Potential CVE-2022-29072 Exploitation Attempt severity high
• Potential CVE-2023-21554 QueueJumper Exploitation severity high
• Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution severity high
• Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI severity high T1187
• Potential Data Exfiltration Activity Via CommandLine Tools severity high T1059, T1059.001
• Potential Data Exfiltration Via Curl.EXE severity medium T1105, T1567
• Potential Data Stealing Via Chromium Headless Debugging severity high T1185, T1564, T1564.003
• Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 severity high
• Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 severity high
• Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 severity high
• Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 severity high
• Potential Defense Evasion Via Binary Rename severity medium T1036, T1036.003
• Potential Defense Evasion Via Rename Of Highly Relevant Binaries severity high T1036, T1036.003
• Potential Defense Evasion Via Right-to-Left Override severity high T1036, T1036.002
• Potential Devil Bait Malware Reconnaissance severity high T1218
• Potential Discovery Activity Via Dnscmd.EXE severity medium
• Potential DLL File Download Via PowerShell Invoke-WebRequest severity medium T1059, T1059.001, T1105
• Potential DLL Injection Or Execution Using Tracker.exe severity medium T1055, T1055.001
• Potential DLL Injection Via AccCheckConsole severity medium
• Potential DLL Sideloading Activity Via ExtExport.EXE severity medium T1218
• Potential DLL Sideloading Via DeviceEnroller.EXE severity medium T1574, T1574.001
• Potential Dosfuscation Activity severity medium T1059
• Potential Download/Upload Activity Using Type Command severity medium T1105
• Potential Dridex Activity severity critical T1033, T1055, T1135
• Potential Dropper Script Execution Via WScript/CScript/MSHTA severity medium T1059, T1059.005, T1059.007
• Potential Dtrack RAT Activity severity critical T1490
• Potential Emotet Activity severity high T1027, T1059, T1059.001
• Potential Emotet Rundll32 Execution severity critical T1218, T1218.011
• Potential EmpireMonkey Activity severity high T1218, T1218.010
• Potential Encoded PowerShell Patterns In CommandLine severity low T1027, T1059, T1059.001
• Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp severity high T1021, T1021.003
• Potential Executable Run Itself As Sacrificial Process severity low T1055
• Potential Execution of Sysinternals Tools severity low T1588, T1588.002
• Potential Exploitation Attempt From Office Application severity high
• Potential Exploitation Attempt Of Undocumented WindowsServer RCE severity high T1190
• Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) severity high T1059, T1059.001, T1059.003, T1068, T1190
• Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group severity high
• Potential Exploitation of GoAnywhere MFT Vulnerability severity high T1059, T1059.001, T1133, T1190
• Potential Exploitation of RCE Vulnerability CVE-2025-33053 severity high T1105, T1218
• Potential Fake Instance Of Hxtsr.EXE Executed severity medium T1036
• Potential File Download Via MS-AppInstaller Protocol Handler severity medium T1218
• Potential File Override/Append Via SET Command severity low
• Potential File Overwrite Via Sysinternals SDelete severity high T1485
• Potential Goofy Guineapig Backdoor Activity severity high
• Potential Goofy Guineapig GoolgeUpdate Process Anomaly severity high
• Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI severity medium T1564, T1564.004
• Potential Homoglyph Attack Using Lookalike Characters severity medium T1036, T1036.003
• Potential KamiKakaBot Activity - Lure Document Execution severity medium T1059
• Potential KamiKakaBot Activity - Shutdown Schedule Task Creation severity medium
• Potential Ke3chang/TidePool Malware Activity severity high T1685
• Potential Lateral Movement via Windows Remote Shell severity medium T1021, T1021.006
• Potential LethalHTA Technique Execution severity high T1218, T1218.005
• Potential LSASS Process Dump Via Procdump severity high T1003, T1003.001, T1036
• Potential Manage-bde.wsf Abuse To Proxy Execution severity high T1216
• Potential Maze Ransomware Activity severity critical T1047, T1204, T1204.002, T1490
• Potential Memory Dumping Activity Via LiveKD severity medium
• Potential Meterpreter/CobaltStrike Activity severity high T1134, T1134.001, T1134.002
• Potential Mftrace.EXE Abuse severity medium T1127
• Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE severity medium T1059
• Potential Mpclient.DLL Sideloading Via Defender Binaries severity high T1574, T1574.001
• Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution severity medium T1218
• Potential MsiExec Masquerading severity high T1036, T1036.005
• Potential MSTSC Shadowing Activity severity high T1563, T1563.002
• Potential MuddyWater APT Activity severity high
• Potential Network Sniffing Activity Using Network Tools severity medium T1040
• Potential Notepad++ CVE-2025-49144 Exploitation severity high T1574, T1574.008
• Potential NTLM Coercion Via Certutil.EXE severity high T1218
• Potential Obfuscated Ordinal Call Via Rundll32 severity medium T1027, T1027.010
• Potential Password Reconnaissance Via Findstr.EXE severity medium T1552, T1552.001
• Potential Password Spraying Attempt Using Dsacls.EXE severity medium T1218
• Potential Persistence Attempt Via Existing Service Tampering severity medium T1543, T1543.003, T1574, T1574.011
• Potential Persistence Attempt Via Run Keys Using Reg.EXE severity medium T1547, T1547.001
• Potential Persistence Via Logon Scripts - CommandLine severity high T1037, T1037.001
• Potential Persistence Via Microsoft Compatibility Appraiser severity medium T1053, T1053.005
• Potential Persistence Via Netsh Helper DLL severity medium T1546, T1546.007
• Potential Persistence Via Powershell Search Order Hijacking - Task severity high T1053, T1053.005, T1059, T1059.001
• Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script severity medium T1059
• Potential Pikabot Discovery Activity severity high T1016, T1049, T1087
• Potential Pikabot Hollowing Activity severity high T1055, T1055.012
• Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE severity medium T1059, T1059.003, T1105, T1218
• Potential PlugX Activity severity high T1574, T1574.001
• Potential PowerShell Command Line Obfuscation severity high T1027, T1059, T1059.001
• Potential PowerShell Console History Access Attempt via History File severity medium T1552, T1552.001
• Potential PowerShell Downgrade Attack severity medium T1059, T1059.001
• Potential PowerShell Execution Policy Tampering - ProcCreation severity high
• Potential PowerShell Execution Via DLL severity high T1218, T1218.011
• Potential PowerShell Obfuscation Via Reversed Commands severity high T1027, T1059, T1059.001
• Potential PowerShell Obfuscation Via WCHAR/CHAR severity high T1027, T1059, T1059.001
• Potential Powershell ReverseShell Connection severity high T1059, T1059.001
• Potential Privilege Escalation To LOCAL SYSTEM severity high T1587, T1587.001
• Potential Privilege Escalation Using Symlink Between Osk and Cmd severity high T1546, T1546.008
• Potential Privilege Escalation via Service Permissions Weakness severity high T1574, T1574.011
• Potential Process Execution Proxy Via CL_Invocation.ps1 severity medium T1216
• Potential Process Injection Via Msra.EXE severity high T1055
• Potential Product Class Reconnaissance Via Wmic.EXE severity medium T1047, T1082
• Potential Product Reconnaissance Via Wmic.EXE severity medium T1047
• Potential Provisioning Registry Key Abuse For Binary Proxy Execution severity high T1218
• Potential Provlaunch.EXE Binary Proxy Execution Abuse severity medium T1218
• Potential Proxy Execution Via Explorer.EXE From Shell Process severity low T1218
• Potential PsExec Remote Execution severity high T1587, T1587.001
• Potential Qakbot Rundll32 Execution severity high
• Potential QBot Activity severity critical T1059, T1059.005
• Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE severity medium T1070, T1542, T1542.003
• Potential Raspberry Robin CPL Execution Activity severity high T1218, T1218.011
• Potential Raspberry Robin Dot Ending File severity high
• Potential RDP Session Hijacking Activity severity medium
• Potential RDP Tunneling Via Plink severity high T1572
• Potential RDP Tunneling Via SSH severity high T1572
• Potential Recon Activity Using DriverQuery.EXE severity high
• Potential Recon Activity Via Nltest.EXE severity medium T1016, T1482
• Potential Reconnaissance Activity Via GatherNetworkInfo.VBS severity medium T1059, T1059.005, T1615
• Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE severity high T1003, T1003.005
• Potential ReflectDebugger Content Execution Via WerFault.EXE severity medium T1036
• Potential Register_App.Vbs LOLScript Abuse severity medium T1218
• Potential Regsvr32 Commandline Flag Anomaly severity medium T1218, T1218.010
• Potential Remote Desktop Tunneling severity medium T1021
• Potential Remote SquiblyTwo Technique Execution severity high T1047, T1059, T1059.005, T1059.007, T1220
• Potential Renamed Rundll32 Execution severity high
• Potential Rundll32 Execution With DLL Stored In ADS severity high T1564, T1564.004
• Potential Russian APT Credential Theft Activity severity critical T1003, T1003.003, T1552, T1552.001
• Potential Ryuk Ransomware Activity severity high T1547, T1547.001
• Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 severity medium T1216
• Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators severity high T1190
• Potential ShellDispatch.DLL Functionality Abuse severity medium
• Potential Shim Database Persistence via Sdbinst.EXE severity medium T1546, T1546.011
• Potential Signing Bypass Via Windows Developer Features severity high
• Potential SMB Relay Attack Tool Execution severity critical T1557, T1557.001
• Potential SNAKE Malware Installation Binary Indicator severity high
• Potential SNAKE Malware Installation CLI Arguments Indicator severity high
• Potential SNAKE Malware Persistence Service Execution severity high
• Potential Snatch Ransomware Activity severity high T1204
• Potential SPN Enumeration Via Setspn.EXE severity medium T1558, T1558.003
• Potential SSH Tunnel Persistence Install Using A Scheduled Task severity high T1053, T1053.005
• Potential Suspicious Activity Using SeCEdit severity medium T1082, T1505, T1505.005, T1546, T1546.007, T1546.008
• Potential Suspicious Browser Launch From Document Reader Process severity medium T1204, T1204.002
• Potential Suspicious Child Process Of 3CXDesktopApp severity high T1218
• Potential Suspicious Execution From GUID Like Folder Names severity low T1027
• Potential Suspicious Mofcomp Execution severity high T1218
• Potential Suspicious Registry File Imported Via Reg.EXE severity medium T1112
• Potential Suspicious Windows Feature Enabled - ProcCreation severity medium
• Potential SysInternals ProcDump Evasion severity high T1003, T1003.001, T1036
• Potential SystemNightmare Exploitation Attempt severity critical T1068
• Potential Tampering With RDP Related Registry Keys Via Reg.EXE severity high T1021, T1021.001, T1112
• Potential Tampering With Security Products Via WMIC severity high T1685
• Potential UAC Bypass Via Sdclt.EXE severity medium T1548, T1548.002
• Potential Unquoted Service Path Reconnaissance Via Wmic.EXE severity medium T1047
• Potential WinAPI Calls Via CommandLine severity high T1106
• Potential Windows Defender AV Bypass Via Dump64.EXE Rename severity high T1003, T1003.001
• Potential Windows Defender Tampering Via Wmic.EXE severity high T1047, T1685
• Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell severity medium T1047, T1059, T1059.001
• Potentially Over Permissive Permissions Granted Using Dsacls.EXE severity medium T1218
• Potentially Suspicious ASP.NET Compilation Via AspNetCompiler severity high T1127
• Potentially Suspicious Cabinet File Expansion severity medium T1218
• Potentially Suspicious Call To Win32_NTEventlogFile Class severity high
• Potentially Suspicious Child Process Of ClickOnce Application severity medium
• Potentially Suspicious Child Process Of DiskShadow.EXE severity medium T1218
• Potentially Suspicious Child Process of KeyScrambler.exe severity medium T1203, T1574, T1574.001
• Potentially Suspicious Child Process Of Regsvr32 severity high T1218, T1218.010
• Potentially Suspicious Child Process Of VsCode severity medium T1202, T1218
• Potentially Suspicious Child Process Of WinRAR.EXE severity medium T1203
• Potentially Suspicious Child Processes Spawned by ConHost severity high T1202, T1218
• Potentially Suspicious CMD Shell Output Redirect severity medium T1218
• Potentially Suspicious Command Targeting Teams Sensitive Files severity medium T1528
• Potentially Suspicious Compression Tool Parameters severity medium T1560, T1560.001
• Potentially Suspicious Desktop Background Change Using Reg.EXE severity medium T1112, T1491, T1491.001
• Potentially Suspicious DLL Registered Via Odbcconf.EXE severity high T1218, T1218.008
• Potentially Suspicious Electron Application CommandLine severity medium
• Potentially Suspicious Event Viewer Child Process severity high T1548, T1548.002
• Potentially Suspicious EventLog Recon Activity Using Log Query Utilities severity medium T1087, T1552
• Potentially Suspicious Execution From Parent Process In Public Folder severity high T1059, T1564
• Potentially Suspicious Execution Of PDQDeployRunner severity medium
• Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location severity medium T1218, T1218.009
• Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension severity medium T1218, T1218.009
• Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE severity high
• Potentially Suspicious GoogleUpdate Child Process severity high
• Potentially Suspicious Inline JavaScript Execution via NodeJS Binary severity medium T1059, T1059.007
• Potentially Suspicious JWT Token Search Via CLI severity medium T1528, T1552, T1552.001
• Potentially Suspicious NTFS Symlink Behavior Modification severity medium T1059, T1222, T1222.001
• Potentially Suspicious Office Document Executed From Trusted Location severity high T1202
• Potentially Suspicious Ping/Copy Command Combination severity medium T1070, T1070.004
• Potentially Suspicious PowerShell Child Processes severity medium T1059, T1059.001
• Potentially Suspicious Powershell Script Execution From Temp Folder severity medium T1059, T1059.001
• Potentially Suspicious Regsvr32 HTTP IP Pattern severity high T1218, T1218.010
• Potentially Suspicious Regsvr32 HTTP/FTP Pattern severity medium T1218, T1218.010
• Potentially Suspicious Rundll32 Activity severity medium T1218, T1218.011
• Potentially Suspicious Rundll32.EXE Execution of UDL File severity medium T1071, T1218, T1218.011
• Potentially Suspicious Usage Of Qemu severity medium T1090, T1572
• Potentially Suspicious WebDAV LNK Execution severity medium T1059, T1059.001, T1204
• Potentially Suspicious Windows App Activity severity medium
• PowerShell Base64 Encoded FromBase64String Cmdlet severity high T1059, T1059.001, T1140
• PowerShell Base64 Encoded IEX Cmdlet severity high T1059, T1059.001
• PowerShell Base64 Encoded Invoke Keyword severity high T1027, T1059, T1059.001
• Powershell Base64 Encoded MpPreference Cmdlet severity high T1685
• PowerShell Base64 Encoded Reflective Assembly Load severity high T1027, T1059, T1059.001, T1620
• PowerShell Base64 Encoded WMI Classes severity high T1027, T1059, T1059.001
• Powershell Defender Disable Scan Feature severity high T1685
• Powershell Defender Exclusion severity medium T1685
• PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' severity high T1685
• PowerShell Download and Execution Cradles severity high T1059
• PowerShell Download Pattern severity medium T1059, T1059.001
• Powershell Executed From Headless ConHost Process severity medium T1059, T1059.001, T1059.003, T1564, T1564.003
• PowerShell Execution With Potential Decryption Capabilities severity high
• PowerShell Get-Clipboard Cmdlet Via CLI severity medium T1115
• PowerShell Get-Process LSASS severity high T1552, T1552.004
• Powershell Inline Execution From A File severity medium T1059, T1059.001
• PowerShell MSI Install via WindowsInstaller COM From Remote Location severity medium T1059, T1059.001, T1105, T1218
• PowerShell SAM Copy severity high T1003, T1003.002
• PowerShell Script Change Permission Via Set-Acl severity high
• PowerShell Script Run in AppData severity medium T1059, T1059.001
• PowerShell Set-Acl On Windows Folder severity high
• Powershell Token Obfuscation - Process Creation severity high T1027, T1027.009
• PowerShell Web Access Feature Enabled Via DISM severity high T1548, T1548.002
• PPL Tampering Via WerFaultSecure severity high T1003, T1003.001, T1685
• PrintBrm ZIP Creation of Extraction severity high T1105, T1564, T1564.004
• Private Keys Reconnaissance Via CommandLine Tools severity medium T1552, T1552.004
• Privilege Escalation via Named Pipe Impersonation severity high T1021
• Procdump Execution severity medium T1003, T1003.001, T1036
• Process Access via TrolleyExpress Exclusion severity high T1003, T1003.001, T1218, T1218.011
• Process Creation Using Sysnative Folder severity medium T1055
• Process Execution From A Potentially Suspicious Folder severity high T1036
• Process Execution From WebDAV Share severity low T1105
• Process Launched Without Image Name severity medium
• Process Memory Dump Via Comsvcs.DLL severity high T1003, T1003.001, T1036
• Process Memory Dump Via Dotnet-Dump severity medium T1218
• Process Memory Dump via RdrLeakDiag.EXE severity high T1003, T1003.001
• Process Proxy Execution Via Squirrel.EXE severity medium T1218
• Process Reconnaissance Via Wmic.EXE severity medium T1047
• Process Terminated Via Taskkill severity low T1489
• Program Executed Using Proxy/Local Command Via SSH.EXE severity medium T1218
• Proxy Execution via Vshadow severity medium T1202
• Proxy Execution Via Wuauclt.EXE severity high T1218
• Ps.exe Renamed SysInternals Tool severity high T1036, T1036.003
• PSexec application execution severity medium T1569, T1569.002
• Psexec Execution severity medium T1021, T1569
• PsExec Service Child Process Execution as LOCAL SYSTEM severity high
• PsExec Service Execution severity medium
• PsExec/PAExec Escalation to LOCAL SYSTEM severity high T1587, T1587.001
• PUA - 3Proxy Execution severity high T1572
• PUA - AdFind Suspicious Execution severity high T1018, T1069, T1069.002, T1087, T1087.002, T1482
• PUA - AdFind.EXE Execution severity medium T1087, T1087.002
• PUA - Adidnsdump Execution severity low T1018
• PUA - Advanced IP Scanner Execution severity medium T1046, T1135
• PUA - Advanced Port Scanner Execution severity medium T1046, T1135
• PUA - AdvancedRun Execution severity medium T1059, T1059.003, T1134, T1134.002, T1564, T1564.003
• PUA - AdvancedRun Suspicious Execution severity high T1134, T1134.002
• PUA - Chisel Tunneling Tool Execution severity high T1090, T1090.001
• PUA - CleanWipe Execution severity high T1685
• PUA - Crassus Execution severity high T1590, T1590.001
• PUA - CsExec Execution severity high T1569, T1569.002, T1587, T1587.001
• PUA - DefenderCheck Execution severity high T1027, T1027.005
• PUA - DIT Snapshot Viewer severity high T1003, T1003.003
• PUA - Fast Reverse Proxy (FRP) Execution severity high T1090
• PUA - Kernel Driver Utility (KDU) Execution severity high T1543, T1543.003
• PUA - Memory Dump Mount Via MemProcFS severity high T1003, T1003.001, T1003.002, T1003.004
• PUA - Mouse Lock Execution severity medium T1056, T1056.002
• PUA - Netcat Suspicious Execution severity high T1095
• PUA - Ngrok Execution severity high T1572
• PUA - Nimgrab Execution severity high T1105
• PUA - NimScan Execution severity medium T1046
• PUA - NirCmd Execution severity medium T1569, T1569.002
• PUA - NirCmd Execution As LOCAL SYSTEM severity high T1569, T1569.002
• PUA - Nmap/Zenmap Execution severity medium T1046
• PUA - NPS Tunneling Tool Execution severity high T1090
• PUA - NSudo Execution severity high T1569, T1569.002
• PUA - PingCastle Execution severity medium T1595
• PUA - PingCastle Execution From Potentially Suspicious Parent severity high T1595
• PUA - Potential PE Metadata Tamper Using Rcedit severity medium T1027, T1027.005, T1036, T1036.003
• PUA - Process Hacker Execution severity medium T1543, T1564, T1622
• PUA - Radmin Viewer Utility Execution severity medium T1072
• PUA - Rclone Execution severity high T1567, T1567.002
• PUA - Restic Backup Tool Execution severity high T1048, T1567, T1567.002
• PUA - RunXCmd Execution severity high T1569, T1569.002
• PUA - Seatbelt Execution severity high T1083, T1087, T1526
• PUA - SoftPerfect Netscan Execution severity medium T1046
• PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE severity high T1087, T1087.002
• PUA - System Informer Execution severity medium T1082, T1543, T1564
• PUA - TruffleHog Execution severity medium T1083, T1552, T1552.001
• PUA - WebBrowserPassView Execution severity medium T1555, T1555.003
• PUA - Wsudo Suspicious Execution severity high T1059
• PUA- IOX Tunneling Tool Execution severity high T1090
• Pubprn.vbs Proxy Execution severity medium T1216, T1216.001
• Python Function Execution Security Warning Disabled In Excel severity high T1685
• Python Inline Command Execution severity medium T1059
• Python One-Liners with Base64 Decoding severity high T1027, T1027.010, T1059, T1059.006
• Python Spawning Pretty TTY on Windows severity high T1059
• Qakbot Regsvr32 Calc Pattern severity high
• Qakbot Rundll32 Exports Execution severity critical
• Qakbot Rundll32 Fake DLL Extension Execution severity critical
• Qakbot Uninstaller Execution severity high
• Query Usage To Exfil Data severity medium
• QuickAssist Execution severity low T1219, T1219.002
• Raccine Uninstall severity high T1685
• Rar Usage with Password and Compression Level severity high T1560, T1560.001
• Raspberry Robin Initial Execution From External Drive severity high T1059, T1059.001
• Raspberry Robin Subsequent Execution of Commands severity high T1059, T1059.001
• RDP Connection Allowed Via Netsh.EXE severity high T1686, T1686.003
• RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class severity medium T1021, T1021.001, T1047
• RDP Port Forwarding Rule Added Via Netsh.EXE severity high T1090
• RDP shadow session started (command) severity high T1021, T1021.001, T1113, T1125
• RDP tunneling configuration enabled for port forwarding severity high T1021, T1021.001, T1572
• Read Contents From Stdin Via Cmd.EXE severity medium T1059, T1059.003
• Rebuild Performance Counter Values Via Lodctr.EXE severity medium
• Recon Command Output Piped To Findstr.EXE severity medium T1057
• Recon Information for Export with Command Prompt severity medium T1119
• RedSun - Conhost.exe Spawned by TieringEngineService.exe severity high T1036, T1036.005, T1134, T1134.002
• Reg Add Suspicious Paths severity high T1112, T1685
• RegAsm.EXE Execution Without CommandLine Flags or Files severity low T1218, T1218.009
• Regedit as Trusted Installer severity high T1548
• REGISTER_APP.VBS Proxy Execution severity medium T1218
• Registry Export of Third-Party Credentials severity high T1552, T1552.002
• Registry Manipulation via WMI Stdregprov severity medium T1012, T1047, T1112
• Registry Modification Attempt Via VBScript severity medium T1059, T1059.005, T1112
• Registry Modification of MS-settings Protocol Handler severity medium T1112, T1546, T1546.001, T1548, T1548.002
• Registry Modification Via Regini.EXE severity low T1112
• Regsvr32 DLL Execution With Suspicious File Extension severity high T1218, T1218.010
• Regsvr32 DLL Execution With Uncommon Extension severity medium T1574
• Regsvr32 Execution From Highly Suspicious Location severity high T1218, T1218.010
• Regsvr32 Execution From Potential Suspicious Location severity medium T1218, T1218.010
• Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly severity medium T1218
• Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions severity medium T1219, T1219.002
• Remote Access Tool - Ammy Admin Agent Execution severity medium
• Remote Access Tool - AnyDesk Execution severity medium T1219, T1219.002
• Remote Access Tool - Anydesk Execution From Suspicious Folder severity high T1219, T1219.002
• Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate severity medium
• Remote Access Tool - AnyDesk Piped Password Via CLI severity medium T1219, T1219.002
• Remote Access Tool - AnyDesk Silent Installation severity high T1219, T1219.002
• Remote Access Tool - Cmd.EXE Execution via AnyViewer severity medium
• Remote Access Tool - GoToAssist Execution severity medium T1219, T1219.002
• Remote Access Tool - LogMeIn Execution severity medium T1219, T1219.002
• Remote Access Tool - MeshAgent Command Execution via MeshCentral severity medium T1219, T1219.002
• Remote Access Tool - NetSupport Execution severity medium T1219, T1219.002
• Remote Access Tool - NetSupport Execution From Unusual Location severity medium
• Remote Access Tool - Potential MeshAgent Execution - Windows severity medium T1219, T1219.002
• Remote Access Tool - Renamed MeshAgent Execution - Windows severity high T1036, T1036.003, T1219, T1219.002
• Remote Access Tool - RURAT Execution From Unusual Location severity medium
• Remote Access Tool - ScreenConnect Execution severity medium T1219, T1219.002
• Remote Access Tool - ScreenConnect Installation Execution severity medium T1133
• Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution severity medium T1219, T1219.002
• Remote Access Tool - ScreenConnect Remote Command Execution severity low T1059, T1059.003
• Remote Access Tool - ScreenConnect Remote Command Execution - Hunting severity medium
• Remote Access Tool - ScreenConnect Server Web Shell Execution severity high T1190
• Remote Access Tool - Simple Help Execution severity medium T1219, T1219.002
• Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server severity medium T1105, T1219
• Remote Access Tool - Team Viewer Session Started On Windows Host severity low T1133
• Remote Access Tool - UltraViewer Execution severity medium T1219, T1219.002
• Remote CHM File Download/Execution Via HH.EXE severity high T1218, T1218.001
• Remote Code Execute via Winrm.vbs severity medium T1216
• Remote File Download Via Desktopimgdownldr Utility severity medium T1105
• Remote File Download Via Findstr.EXE severity medium T1105, T1218, T1552, T1552.001, T1564, T1564.004
• Remote PowerShell Session Host Process (WinRM) severity medium T1021, T1021.006, T1059, T1059.001
• Remote XSL Execution Via Msxsl.EXE severity high T1220
• RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses severity high T1218
• Remotely Hosted HTA File Executed Via Mshta.EXE severity high T1218, T1218.005
• Renamed AdFind Execution severity high T1018, T1069, T1069.002, T1087, T1087.002, T1482
• Renamed AutoHotkey.EXE Execution severity medium
• Renamed AutoIt Execution severity high T1027
• Renamed BOINC Client Execution severity medium T1553
• Renamed BrowserCore.EXE Execution severity high T1036, T1036.003, T1528
• Renamed Cloudflared.EXE Execution severity high T1090, T1090.001
• Renamed CreateDump Utility Execution severity high T1003, T1003.001, T1036
• Renamed CURL.EXE Execution severity medium T1059, T1202
• Renamed FTP.EXE Execution severity medium T1059, T1202
• Renamed Gpg.EXE Execution severity high T1486
• Renamed Jusched.EXE Execution severity high T1036, T1036.003
• Renamed Mavinject.EXE Execution severity high T1055, T1055.001, T1218, T1218.013
• Renamed MegaSync Execution severity high T1218
• Renamed Microsoft Teams Execution severity medium
• Renamed Msdt.EXE Execution severity high T1036, T1036.003
• Renamed NetSupport RAT Execution severity high
• Renamed NirCmd.EXE Execution severity high T1059, T1202
• Renamed Office Binary Execution severity high T1036, T1036.003
• Renamed PAExec Execution severity high T1202
• Renamed PingCastle Binary Execution severity high T1059, T1202
• Renamed Plink Execution severity high T1036
• Renamed ProcDump Execution severity high T1036, T1036.003
• Renamed Procdump tool used for dumping LSASS process severity high T1569, T1569.002
• Renamed PsExec Service Execution severity high
• Renamed Remote Utilities RAT (RURAT) Execution severity medium
• Renamed Schtasks Execution severity high T1036, T1036.003, T1053, T1053.005
• Renamed SysInternals DebugView Execution severity high T1588, T1588.002
• Renamed Sysinternals Sdelete Execution severity high T1485
• Renamed Visual Studio Code Tunnel Execution severity high T1071, T1071.001, T1219
• Renamed Vmnat.exe Execution severity high T1574, T1574.001
• Renamed Whoami Execution severity critical T1033
• Renamed ZOHO Dctask64 Execution severity high T1036, T1055, T1055.001, T1202, T1218
• Replace.exe Usage severity medium T1105
• Response File Execution Via Odbcconf.EXE severity medium T1218, T1218.008
• RestrictedAdminMode Registry Value Tampering - ProcCreation severity high T1112
• REvil Kaseya Incident Malware Patterns severity critical T1059
• Rhadamanthys Stealer Module Launch Via Rundll32.EXE severity medium T1218, T1218.011
• Root Certificate Installed From Susp Locations severity high T1553, T1553.004
• Rorschach Ransomware Execution Activity severity critical T1059, T1059.001, T1059.003
• Ruby Inline Command Execution severity medium T1059
• Run Once Task Execution as Configured in Registry severity low T1112
• Run PowerShell Script from ADS severity high T1564, T1564.004
• Run PowerShell Script from Redirected Input Stream severity high T1059
• Rundll32 Execution With Uncommon DLL Extension severity medium T1218, T1218.011
• Rundll32 Execution Without CommandLine Parameters severity high T1202
• Rundll32 Execution Without Parameters severity high T1021, T1021.002, T1569, T1569.002, T1570
• Rundll32 InstallScreenSaver Execution severity medium T1218, T1218.011
• Rundll32 Registered COM Objects severity high T1546, T1546.015
• Rundll32 Spawned Via Explorer.EXE severity medium
• RunDLL32 Spawning Explorer severity high T1218, T1218.011
• Rundll32 UNC Path Execution severity high T1021, T1021.002, T1218, T1218.011
• Rundll32.EXE Calling DllRegisterServer Export Function Explicitly severity medium T1218
• RunMRU Registry Key Deletion severity high T1070, T1070.003
• SafeBoot Registry Key Deleted Via Reg.EXE severity high T1685
• SC.EXE Query Execution severity low T1007
• Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE severity medium T1053, T1053.005
• Scheduled persistent task with SYSTEM privileges creation severity high T1053, T1053.005
• Scheduled Task Creation From Potential Suspicious Parent Location severity medium T1053, T1053.005
• Scheduled Task Creation Masquerading as System Processes severity high T1036, T1036.004, T1036.005, T1053, T1053.005
• Scheduled Task Creation Via Schtasks.EXE severity low T1053, T1053.005
• Scheduled task creation with command line severity medium T1053, T1053.005
• Scheduled Task Creation with Curl and PowerShell Execution Combo severity medium T1053, T1053.005, T1105, T1218
• Scheduled Task Executing Encoded Payload from Registry severity high T1053, T1053.005, T1059, T1059.001
• Scheduled Task Executing Payload from Registry severity medium T1053, T1053.005, T1059, T1059.001
• Schtasks Creation Or Modification With SYSTEM Privileges severity high T1053, T1053.005
• Schtasks From Suspicious Folders severity high T1053, T1053.005
• Screen Capture Activity Via Psr.EXE severity medium T1113
• Script Event Consumer Spawning Process severity high T1047
• Script Interpreter Execution From Suspicious Folder severity high T1059
• Script Interpreter Spawning Credential Scanner - Windows severity high T1005, T1059, T1059.007, T1552
• Scripting/CommandLine Process Spawned Regsvr32 severity medium T1218, T1218.010
• Sdclt Child Processes severity medium T1548, T1548.002
• Sdiagnhost Calling Suspicious Child Process severity high T1036, T1218
• SearchIndexer suspicious process activity severity medium T1036
• Security Event Logging Disabled via MiniNt Registry Key - Process severity high T1112, T1685, T1685.001
• Security package (SSP) added (Reg via command) severity high T1547, T1547.008
• Security Privileges Enumeration Via Whoami.EXE severity high T1033
• Security Service Disabled Via Reg.EXE severity high T1685
• Security Tools Keyword Lookup Via Findstr.EXE severity medium T1518, T1518.001
• Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location severity high T1218
• Sensitive File Access Via Volume Shadow Copy Backup severity high T1490
• Sensitive File Dump Via Print.EXE severity high T1003, T1003.002, T1003.003, T1218
• Sensitive File Dump Via Wbadmin.EXE severity high T1003, T1003.003
• Sensitive File Recovery From Backup Via Wbadmin.EXE severity high T1003, T1003.003
• Serial console process spawning CMD shell (via command) severity high T1059, T1059.003
• Serpent Backdoor Payload Execution Via Scheduled Task severity high T1053, T1053.005, T1059, T1059.006
• Serv-U Exploitation CVE-2021-35211 by DEV-0322 severity critical T1136, T1136.001
• Service abuse with malicious ImagePath (service) severity high T1543, T1543.003
• Service creation (command) severity high T1543, T1543.003
• Service DACL Abuse To Hide Services Via Sc.EXE severity high T1574, T1574.011
• Service deactivation (command) severity high T1489
• Service permissions hijacked for privileges abuse (service) severity high T1543, T1543.003, T1574, T1574.010
• Service Reconnaissance Via Wmic.EXE severity medium T1047
• Service Registry Key Deleted Via Reg.EXE severity high T1685
• Service Security Descriptor Tampering Via Sc.EXE severity medium T1574, T1574.011
• Service Started/Stopped Via Wmic.EXE severity medium T1047
• Service Startup Type Change Via Wmic.EXE severity medium T1047, T1685
• Service StartupType Change Via PowerShell Set-Service severity medium T1685
• Service StartupType Change Via Sc.EXE severity medium T1685
• Set Files as System Files Using Attrib.EXE severity low T1564, T1564.001
• Set Suspicious Files as System Files Using Attrib.EXE severity high T1564, T1564.001
• Setup16.EXE Execution With Custom .Lst File severity medium T1574, T1574.005
• Shadow Copies Creation Using Operating Systems Utilities severity medium T1003, T1003.002, T1003.003
• Shadow Copies Deletion Using Operating Systems Utilities severity high T1070, T1490
• Shai-Hulud 2.0 Malicious NPM Package Installation severity high T1195, T1195.002
• Shai-Hulud Malicious Bun Execution severity high T1195, T1195.002, T1203
• Shai-Hulud Malware Indicators - Windows severity high T1059
• Share And Session Enumeration Using Net.EXE severity low T1018
• Shell Process Spawned by Java.EXE severity medium
• Shell32 DLL Execution in Suspicious Directory severity high T1218, T1218.011
• ShimCache Flush severity high T1112
• Small Sieve Malware CommandLine Indicator severity high T1574, T1574.001
• SMB over QUIC Via Net.EXE severity medium T1570
• Sofacy Trojan Loader Activity severity high T1059, T1059.003, T1218, T1218.011
• SOURGUM Actor Behaviours severity high T1546, T1546.015
• SPN added to an account by command line severity high T1098
• Spool process spawned a CMD shell (PrintNightmare vulnerability - CVE-2021-36958) severity high T1574, T1574.002
• SQL Client Tools PowerShell Session Detection severity medium T1059, T1059.001, T1127
• SQL Server database's table enumeration severity medium T1518
• SQL server sqlcmd utility abuse for privilege escalation severity high T1505, T1505.001
• SQLite Chromium Profile Data DB Access severity high T1005, T1539, T1555, T1555.003
• SQLite Firefox Profile Data DB Access severity high T1005, T1539
• Start of NT Virtual DOS Machine severity medium
• Start Windows Service Via Net.EXE severity low T1569, T1569.002
• Stickey key called CMD via command execution severity high T1546, T1546.008
• Stickey key called CMD via command execution (hash detection) severity high T1546, T1546.008
• Sticky Key Like Backdoor Execution severity critical T1546, T1546.008
• Stop Windows Service Via Net.EXE severity low T1489
• Stop Windows Service Via PowerShell Stop-Service severity low T1489
• Stop Windows Service Via Sc.EXE severity low T1489
• Suspect Svchost Activity severity high T1055
• Suspicious Active Directory Database Snapshot Via ADExplorer severity high T1069, T1069.002, T1087, T1087.002, T1482
• Suspicious AddinUtil.EXE CommandLine Execution severity high T1218
• Suspicious Advpack Call Via Rundll32.EXE severity high
• Suspicious AgentExecutor PowerShell Execution severity high T1218
• Suspicious ArcSOC.exe Child Process severity high T1059, T1203
• Suspicious Autorun Registry Modified via WMI severity high T1047, T1547, T1547.001
• Suspicious Binary In User Directory Spawned From Office Application severity high T1204, T1204.002
• Suspicious BitLocker Access Agent Update Utility Execution severity high T1021, T1021.003, T1218
• Suspicious Cabinet File Execution Via Msdt.EXE severity medium T1202
• Suspicious Calculator Usage severity high T1036
• Suspicious CertReq Command to Download severity high T1105
• Suspicious Child Process Created as System severity high T1134, T1134.002
• Suspicious Child Process of AspNetCompiler severity high T1127
• Suspicious Child Process Of BgInfo.EXE severity high T1059, T1059.005, T1202, T1218
• Suspicious Child Process Of Manage Engine ServiceDesk severity high T1102
• Suspicious Child Process of Notepad++ Updater - GUP.Exe severity high T1195, T1195.002, T1557
• Suspicious Child Process of SAP NetWeaver severity medium T1059, T1059.003, T1190
• Suspicious Child Process of SolarWinds WebHelpDesk severity high T1190
• Suspicious Child Process Of SQL Server severity high T1190, T1505, T1505.003
• Suspicious Child Process Of Veeam Dabatase severity critical
• Suspicious Child Process Of Wermgr.EXE severity high T1036, T1055
• Suspicious Chromium Browser Instance Executed With Custom Extension severity high T1176, T1176.001
• Suspicious ClickFix/FileFix Execution Pattern severity high T1204, T1204.001, T1204.004
• Suspicious CodePage Switch Via CHCP severity medium T1036
• Suspicious Command Patterns In Scheduled Task Creation severity high T1053, T1053.005
• Suspicious Control Panel DLL Load severity high T1218, T1218.011
• Suspicious Copy From or To System Directory severity medium T1036, T1036.003
• Suspicious CrushFTP Child Process severity medium T1059, T1059.001, T1059.003, T1190
• Suspicious Csi.exe Usage severity medium T1072, T1218
• Suspicious Curl.EXE Download severity high T1105
• Suspicious CustomShellHost Execution severity high T1216
• Suspicious Debugger Registration Cmdline severity high T1546, T1546.008
• Suspicious Desktopimgdownldr Command severity high T1105
• Suspicious Diantz Alternate Data Stream Execution severity medium T1564, T1564.004
• Suspicious Diantz Download and Compress Into a CAB File severity medium T1105
• Suspicious DLL Loaded via CertOC.EXE severity high T1218
• Suspicious Double Extension File Execution severity high T1566, T1566.001
• Suspicious Download From Direct IP Via Bitsadmin severity high T1036, T1036.003, T1197
• Suspicious Download From File-Sharing Website Via Bitsadmin severity high T1036, T1036.003, T1105, T1197
• Suspicious Download from Office Domain severity high T1105, T1608
• Suspicious Download Via Certutil.EXE severity medium T1027, T1105
• Suspicious Driver Install by pnputil.exe severity medium T1547
• Suspicious Driver/DLL Installation Via Odbcconf.EXE severity high T1218, T1218.008
• Suspicious DumpMinitool Execution severity high T1003, T1003.001, T1036
• Suspicious Electron Application Child Processes severity medium
• Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call severity high T1027, T1059, T1059.001
• Suspicious Encoded PowerShell Command Line severity high T1059, T1059.001
• Suspicious Eventlog Clearing or Configuration Change Activity severity high T1685, T1685.001, T1685.005
• Suspicious Execution From Outlook Temporary Folder severity high T1566, T1566.001
• Suspicious Execution Location Of Wermgr.EXE severity high
• Suspicious Execution of Hostname severity low T1082
• Suspicious Execution of InstallUtil Without Log severity medium
• Suspicious Execution of Powershell with Base64 severity medium T1059, T1059.001
• Suspicious Execution of Shutdown severity medium T1529
• Suspicious Execution of Shutdown to Log Out severity medium T1529
• Suspicious Execution of Systeminfo severity low T1082
• Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix severity high T1027, T1027.010, T1204, T1204.004
• Suspicious Extrac32 Alternate Data Stream Execution severity medium T1564, T1564.004
• Suspicious Extrac32 Execution severity medium T1105
• Suspicious File Characteristics Due to Missing Fields severity medium T1059, T1059.006
• Suspicious File Download From File Sharing Domain Via Curl.EXE severity high
• Suspicious File Download From File Sharing Domain Via Wget.EXE severity high
• Suspicious File Download From IP Via Curl.EXE severity high
• Suspicious File Download From IP Via Wget.EXE severity high
• Suspicious File Download From IP Via Wget.EXE - Paths severity high
• Suspicious File Downloaded From Direct IP Via Certutil.EXE severity high T1027, T1105
• Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE severity high T1027, T1105
• Suspicious File Encoded To Base64 Via Certutil.EXE severity high T1027
• Suspicious File Execution From Internet Hosted WebDav Share severity high T1059, T1059.001
• Suspicious FileFix Execution Pattern severity high T1204, T1204.004
• Suspicious FromBase64String Usage On Gzip Archive - Process Creation severity medium T1132, T1132.001
• Suspicious Git Clone severity medium T1593, T1593.003
• Suspicious Greedy Compression Using Rar.EXE severity high T1059
• Suspicious Group And Account Reconnaissance Activity Using Net.EXE severity medium T1087, T1087.001, T1087.002
• Suspicious GrpConv Execution severity high T1547
• Suspicious GUP Usage severity high T1574, T1574.001
• Suspicious HH.EXE Execution severity high T1047, T1059, T1059.001, T1059.003, T1059.005, T1059.007
• Suspicious High IntegrityLevel Conhost Legacy Option severity informational T1202
• Suspicious HWP Sub Processes severity high T1059, T1059.003, T1203, T1566, T1566.001
• Suspicious IIS Module Registration severity high T1505, T1505.004
• Suspicious IIS URL GlobalRules Rewrite Via AppCmd severity medium
• Suspicious Invoke-WebRequest Execution severity high T1105
• Suspicious Invoke-WebRequest Execution With DirectIP severity medium T1105
• Suspicious JavaScript Execution Via Mshta.EXE severity high T1218, T1218.005
• Suspicious Kerberos Ticket Request via CLI severity high T1558, T1558.003
• Suspicious Kernel Dump Using Dtrace severity high T1082
• Suspicious Key Manager Access severity high T1555, T1555.004
• Suspicious LNK Command-Line Padding with Whitespace Characters severity high T1204, T1204.002
• Suspicious Manipulation Of Default Accounts Via Net.EXE severity high T1560, T1560.001
• Suspicious Microsoft Office Child Process severity high T1047, T1204, T1204.002, T1218, T1218.010
• Suspicious Microsoft OneNote Child Process severity high T1566, T1566.001
• Suspicious Modification Of Scheduled Tasks severity high T1053, T1053.005
• Suspicious Msbuild Execution By Uncommon Parent Process severity medium
• Suspicious MSDT Parent Process severity high T1036, T1218
• Suspicious MSHTA Child Process severity high T1218, T1218.005
• Suspicious Mshta.EXE Execution Patterns severity high T1106
• Suspicious MsiExec Embedding Parent severity medium T1218, T1218.007
• Suspicious Msiexec Execute Arbitrary DLL severity medium T1218, T1218.007
• Suspicious Msiexec Quiet Install From Remote Location severity medium T1218, T1218.007
• Suspicious Mstsc.EXE Execution With Local RDP File severity high T1219, T1219.002
• Suspicious Network Command severity low T1016
• Suspicious New Instance Of An Office COM Object severity medium
• Suspicious New Service Creation severity high T1543, T1543.003
• Suspicious NTLM Authentication on the Printer Spooler Service severity high T1212
• Suspicious Obfuscated PowerShell Code severity high
• Suspicious Outlook Child Process severity high T1204, T1204.002
• Suspicious Parent Double Extension File Execution severity high T1036, T1036.007
• Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script severity high T1059
• Suspicious Ping/Del Command Combination severity high T1070, T1070.004
• Suspicious Plink Port Forwarding severity high T1021, T1021.001, T1572
• Suspicious Powercfg Execution To Change Lock Screen Timeout severity medium
• Suspicious PowerShell Download and Execute Pattern severity high T1059, T1059.001
• Suspicious PowerShell Encoded Command Patterns severity high T1059, T1059.001
• Suspicious PowerShell IEX Execution Patterns severity high T1059, T1059.001
• Suspicious PowerShell Invocation From Script Engines severity medium T1059, T1059.001
• Suspicious PowerShell Invocations - Specific - ProcessCreation severity medium
• Suspicious PowerShell Mailbox Export to Share severity critical
• Suspicious PowerShell Parameter Substring severity high T1059, T1059.001
• Suspicious PowerShell Parent Process severity high T1059, T1059.001
• Suspicious PrinterPorts Creation (CVE-2020-1048) severity high T1059, T1059.001
• Suspicious Process By Web Server Process severity high T1190, T1505, T1505.003
• Suspicious Process Created Via Wmic.EXE severity high T1047
• Suspicious Process Execution From Fake Recycle.Bin Folder severity high
• Suspicious Process Masquerading As SvcHost.EXE severity high T1036, T1036.005
• Suspicious Process Parents severity high T1036
• Suspicious Process Patterns NTDS.DIT Exfil severity high T1003, T1003.003
• Suspicious Process Spawned by CentreStack Portal AppPool severity high T1059, T1059.003, T1505, T1505.003
• Suspicious Process Start Locations severity medium T1036
• Suspicious Processes Spawned by Java.EXE severity high
• Suspicious Processes Spawned by WinRM severity high T1190
• Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE severity high T1686, T1686.003
• Suspicious Program Names severity high T1059
• Suspicious Provlaunch.EXE Child Process severity high T1218
• Suspicious Query of MachineGUID severity low T1082
• Suspicious RASdial Activity severity medium T1059
• Suspicious RazerInstaller Explorer Subprocess severity high T1553
• Suspicious RDP Redirect Using TSCON severity high T1021, T1021.001, T1563, T1563.002
• Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet severity medium T1087, T1087.001
• Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS severity high T1059, T1059.005, T1615
• Suspicious Recursive Takeown severity medium T1222, T1222.001
• Suspicious Redirection to Local Admin Share severity high T1048
• Suspicious Reg Add BitLocker severity high T1486
• Suspicious Registry Modification From ADS Via Regini.EXE severity high T1112
• Suspicious Regsvr32 Execution From Remote Share severity high T1218, T1218.010
• Suspicious Remote Child Process From Outlook severity high T1059, T1202
• Suspicious Response File Execution Via Odbcconf.EXE severity high T1218, T1218.008
• Suspicious RunAs-Like Flag Combination severity medium
• Suspicious Rundll32 Activity Invoking Sys File severity high T1218, T1218.011
• Suspicious Rundll32 Execution With Image Extension severity high T1218, T1218.011
• Suspicious Rundll32 Invoking Inline VBScript severity high T1055
• Suspicious Rundll32 Setupapi.dll Activity severity medium T1218, T1218.011
• Suspicious Runscripthelper.exe severity medium T1059, T1202
• Suspicious Scan Loop Network severity medium T1018, T1059
• Suspicious Scheduled Task Creation Involving Temp Folder severity high T1053, T1053.005
• Suspicious Scheduled Task Creation via Masqueraded XML File severity medium T1036, T1036.005, T1053, T1053.005
• Suspicious Scheduled Task Name As GUID severity medium T1053, T1053.005
• Suspicious Schtasks Execution AppData Folder severity high T1053, T1053.005, T1059, T1059.001
• Suspicious Schtasks Schedule Type With High Privileges severity medium T1053, T1053.005
• Suspicious Schtasks Schedule Types severity high T1053, T1053.005
• Suspicious ScreenSave Change by Reg.exe severity medium T1546, T1546.002
• Suspicious Serv-U Process Pattern severity high T1555
• Suspicious Service Binary Directory severity high T1202
• Suspicious Service DACL Modification Via Set-Service Cmdlet severity high T1543, T1543.003
• Suspicious Service Path Modification severity high T1543, T1543.003
• Suspicious ShellExec_RunDLL Call Via Ordinal severity high T1218, T1218.011
• Suspicious Shells Spawn by Java Utility Keytool severity high
• Suspicious Speech Runtime Binary Child Process severity high T1021, T1021.003, T1218
• Suspicious Splwow64 Without Params severity high T1202
• Suspicious SPN enumeration previous to Kerberoasting attack (native commands) severity high T1087, T1087.002
• Suspicious Spool Service Child Process severity high T1068, T1203
• Suspicious SysAidServer Child severity medium T1210
• Suspicious Sysmon as Execution Parent severity high T1068
• Suspicious SYSTEM User Process Creation severity high T1003, T1027, T1134
• Suspicious SYSVOL Domain Group Policy Access severity medium T1552, T1552.006
• Suspicious Tasklist Discovery Command severity informational T1057
• Suspicious TSCON Start as SYSTEM severity high T1219, T1219.002
• Suspicious UltraVNC Execution severity high T1021, T1021.005
• Suspicious Uninstall of Windows Defender Feature via PowerShell severity high T1685
• Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) severity medium T1003, T1003.003
• Suspicious Usage of For Loop with Recursive Directory Search in CMD severity medium T1027, T1027.010, T1059, T1059.003
• Suspicious Usage Of ShellExec_RunDLL severity high
• Suspicious Use of CSharp Interactive Console severity high T1127
• Suspicious Use of PsLogList severity medium T1087, T1087.001, T1087.002
• Suspicious Userinit Child Process severity medium T1055
• Suspicious VBoxDrvInst.exe Parameters severity medium T1112
• Suspicious VBScript UN2452 Pattern severity high T1547, T1547.001
• Suspicious Velociraptor Child Process severity high T1219
• Suspicious Vsls-Agent Command With AgentExtensionPath Load severity medium T1218
• Suspicious WebDav Client Execution Via Rundll32.EXE severity high T1048, T1048.003
• Suspicious Where Execution severity low T1217
• Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE severity medium T1685
• Suspicious Windows Defender Registry Key Tampering Via Reg.EXE severity high T1685
• Suspicious Windows Service Tampering severity high T1489, T1685
• Suspicious Windows Trace ETW Session Tamper Via Logman.EXE severity high T1685, T1685.005
• Suspicious Windows Update Agent Empty Cmdline severity high T1036
• Suspicious WindowsTerminal Child Processes severity medium
• Suspicious WMIC Execution Via Office Process severity high T1047, T1204, T1204.002, T1218, T1218.010
• Suspicious WmiPrvSE Child Process severity high T1047, T1204, T1204.002, T1218, T1218.010
• Suspicious Workstation Locking via Rundll32 severity medium
• Suspicious X509Enrollment - Process Creation severity medium T1553, T1553.004
• Suspicious XOR Encoded PowerShell Command severity medium T1027, T1059, T1059.001, T1140
• Suspicious ZipExec Execution severity medium T1202, T1218
• SyncAppvPublishingServer Execute Arbitrary PowerShell Code severity medium T1218
• SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code severity medium T1216, T1218
• Sysinternals PsService Execution severity medium T1543, T1543.003
• Sysinternals PsSuspend Execution severity medium T1543, T1543.003
• Sysinternals PsSuspend Suspicious Execution severity high T1685
• Sysmon Configuration Update severity medium T1685
• Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE severity high T1518, T1518.001
• Sysmon Driver Unloaded Via Fltmc.EXE severity high T1070, T1685, T1685.001
• Sysprep on AppData Folder severity medium T1059
• System Disk And Volume Reconnaissance Via Wmic.EXE severity medium T1047, T1082
• System File Execution Location Anomaly severity high T1036
• System Information Discovery via Registry Queries severity low T1082
• System Information Discovery Via Wmic.EXE severity low T1082
• System Language Discovery via Reg.Exe severity medium T1614, T1614.001
• System Network Connections Discovery Via Net.EXE severity low T1049
• System Restore Registry Modification via CommandLine severity high T1490
• TAIDOOR RAT DLL Load severity high T1055, T1055.001
• Tamper Windows Defender Remove-MpPreference severity high T1685
• Tap Installer Execution severity medium T1048
• Task Manager access indicator for potential LSASS dump severity low T1003, T1003.001
• Taskkill Symantec Endpoint Protection severity high T1685
• Taskmgr as LOCAL_SYSTEM severity high T1036
• Tasks Folder Evasion severity high T1574, T1574.001
• Terminal Service Process Spawn severity high T1190, T1210
• Time Travel Debugging Utility Usage severity high T1003, T1003.001, T1218
• Tor Client/Browser Execution severity high T1090, T1090.003
• Trickbot Malware Activity severity high T1559
• TropicTrooper Campaign November 2018 severity high T1059, T1059.001
• TrustedPath UAC Bypass Pattern severity critical T1548, T1548.002
• Tunneling Tool Execution severity medium T1041, T1071, T1071.001, T1572
• Turla Group Commands May 2020 severity critical T1027, T1053, T1053.005, T1059, T1059.001
• Turla Group Lateral Movement severity critical T1021, T1021.002, T1059, T1083, T1135
• UAC Bypass Abusing Winsat Path Parsing - Process severity high T1548, T1548.002
• UAC Bypass Tools Using ComputerDefaults severity high T1548, T1548.002
• UAC Bypass Using ChangePK and SLUI severity high T1548, T1548.002
• UAC Bypass Using Consent and Comctl32 - Process severity high T1548, T1548.002
• UAC Bypass Using Disk Cleanup severity high T1548, T1548.002
• UAC Bypass Using DismHost severity high T1548, T1548.002
• UAC Bypass Using Event Viewer RecentViews severity high
• UAC Bypass Using IDiagnostic Profile severity high T1548, T1548.002
• UAC Bypass Using IEInstal - Process severity high T1548, T1548.002
• UAC Bypass Using MSConfig Token Modification - Process severity high T1548, T1548.002
• UAC Bypass Using NTFS Reparse Point - Process severity high T1548, T1548.002
• UAC Bypass Using PkgMgr and DISM severity high T1548, T1548.002
• UAC Bypass Using Windows Media Player - Process severity high T1548, T1548.002
• UAC Bypass via ICMLuaUtil severity high T1548, T1548.002
• UAC Bypass via Windows Firewall Snap-In Hijack severity medium T1548
• UAC Bypass WSReset severity high T1548, T1548.002
• UEFI Persistence Via Wpbbin - ProcessCreation severity high T1542, T1542.001
• UNC2452 PowerShell Pattern severity critical T1047, T1059, T1059.001
• UNC2452 Process Creation Patterns severity high T1059, T1059.001
• Uncommon Assistive Technology Applications Execution Via AtBroker.EXE severity medium T1218
• Uncommon AddinUtil.EXE CommandLine Execution severity medium T1218
• Uncommon Child Process Of AddinUtil.EXE severity medium T1218
• Uncommon Child Process Of Appvlp.EXE severity medium T1218
• Uncommon Child Process Of BgInfo.EXE severity medium T1059, T1059.005, T1202, T1218
• Uncommon Child Process Of Conhost.EXE severity medium T1202
• Uncommon Child Process Of Defaultpack.EXE severity medium T1218
• Uncommon Child Process Of Setres.EXE severity high T1202, T1218
• Uncommon Child Process Spawned By Odbcconf.EXE severity medium T1218, T1218.008
• Uncommon Child Processes Of SndVol.exe severity medium
• Uncommon Extension Shim Database Installation Via Sdbinst.EXE severity medium T1546, T1546.011
• Uncommon FileSystem Load Attempt By Format.com severity high
• Uncommon Link.EXE Parent Process severity medium T1218
• Uncommon One Time Only Scheduled Task At 00:00 severity high T1053, T1053.005
• Uncommon Sigverif.EXE Child Process severity medium T1216
• Uncommon Svchost Command Line Parameter severity high T1036, T1036.005, T1055, T1055.012
• Uncommon Svchost Parent Process severity medium T1036, T1036.005
• Uncommon System Information Discovery Via Wmic.EXE severity medium T1082
• Uncommon Userinit Child Process severity high T1037, T1037.001
• Uninstall Crowdstrike Falcon Sensor severity high T1685
• Uninstall Sysinternals Sysmon severity high T1685
• Unmount Share Via Net.EXE severity low T1070, T1070.005
• Unsigned AppX Installation Attempt Using Add-AppxPackage severity medium
• Unusual Child Process of dns.exe severity high T1133
• Unusual Parent Process For Cmd.EXE severity medium T1059
• Unusually Long PowerShell CommandLine severity low T1059, T1059.001
• Ursnif Redirection Of Discovery Commands severity high T1059
• Usage Of Web Request Commands And Cmdlets severity medium T1059, T1059.001
• Use Icacls to Hide File to Everyone severity medium T1564, T1564.001
• Use NTFS Short Name in Command Line severity medium T1564, T1564.004
• Use NTFS Short Name in Image severity medium T1564, T1564.004
• Use of FSharp Interpreters severity medium T1059
• Use of OpenConsole severity medium T1059
• Use of Pcalua For Execution severity medium T1059
• Use of Remote.exe severity medium T1127
• Use of Scriptrunner.exe severity medium T1218
• Use Of The SFTP.EXE Binary As A LOLBIN severity medium T1218
• Use of TTDInject.exe severity medium T1127
• Use of UltraVNC Remote Access Software severity medium T1219, T1219.002
• Use of VisualUiaVerifyNative.exe severity medium T1218
• Use of VSIISExeLauncher.exe severity medium T1127
• Use of W32tm as Timer severity high T1124
• Use of Wfc.exe severity medium T1127
• Use Short Name Path in Command Line severity medium T1564, T1564.004
• Use Short Name Path in Image severity medium T1564, T1564.004
• User added to a group via commandline severity high T1098
• User Added To Highly Privileged Group severity high T1098
• User Added to Local Administrators Group severity medium T1098
• User Added to Remote Desktop Users Group severity high T1021, T1021.001, T1133, T1136, T1136.001
• User creation via commandline severity high T1136, T1136.001, T1136.002
• User Discovery And Export Via Get-ADUser Cmdlet severity medium T1033
• User enumeration and creation related to Manic Menagerie 2.0 (via cmdline) severity medium T1136, T1136.001
• User properties enumeration via commandline severity high T1087, T1087.001, T1087.002
• User Shell Folders Registry Modification via CommandLine severity high T1112, T1547, T1547.001
• Using SettingSyncHost.exe as LOLBin severity high T1574, T1574.008
• UtilityFunctions.ps1 Proxy Dll severity medium T1216
• Veeam Backup Database Suspicious Query severity medium T1005
• VeeamBackup Database Credentials Dump Via Sqlcmd.EXE severity high T1005
• Verclsid.exe Runs COM Object severity medium T1218
• Virtualbox Driver Installation or Starting of VMs severity low T1564, T1564.006
• Visual Basic Command Line Compiler Usage severity high T1027, T1027.004
• Visual Studio Code Tunnel Execution severity medium T1071, T1071.001, T1219
• Visual Studio Code Tunnel Service Installation severity medium T1071, T1071.001
• Visual Studio Code Tunnel Shell Execution severity medium T1071, T1071.001
• Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution severity medium T1218
• Visual Studio NodejsTools PressAnyKey Renamed Execution severity medium T1218
• VMToolsd Suspicious Child Process severity high T1059
• VolumeShadowCopy Symlink Creation Via Mklink severity high T1003, T1003.002, T1003.003
• VSS backup deletion (WMI) severity high T1490
• Vulnerable Driver Blocklist Registry Tampering Via CommandLine severity high T1685
• Wab Execution From Non Default Location severity high
• Wab/Wabmig Unusual Parent Or Child Processes severity high
• WannaCry Ransomware Activity severity critical T1083, T1210, T1222, T1222.001, T1486, T1490
• Wdigest authentication enabled (Reg via command) severity high T1003, T1562
• Weak or Abused Passwords In CLI severity medium
• WebDav Client Execution Via Rundll32.EXE severity medium T1048, T1048.003
• Webserver IIS module installed (command) severity high T1505, T1505.004
• Webserver IIS module installed (command) severity high T1505, T1505.004
• Webshell Detection With Command Line Keywords severity high T1018, T1033, T1087, T1505, T1505.003
• Webshell Hacking Activity Patterns severity high T1018, T1033, T1087, T1505, T1505.003
• Webshell Tool Reconnaissance Activity severity high T1505, T1505.003
• WhoAmI as Parameter severity high T1033
• Whoami.EXE Execution Anomaly severity medium T1033
• Whoami.EXE Execution From Privileged Process severity high T1033
• Whoami.EXE Execution With Output Option severity medium T1033
• Windows Admin Share Mount Via Net.EXE severity medium T1021, T1021.002
• Windows AMSI Related Registry Tampering Via CommandLine severity high T1685
• Windows Backup Deleted Via Wbadmin.EXE severity medium T1490
• Windows Binary Executed From WSL severity medium T1202
• Windows Credential Guard Registry Tampering Via CommandLine severity high T1685
• Windows Credential Manager Access via VaultCmd severity medium T1555, T1555.004
• Windows Default Domain GPO Modification via GPME severity medium T1484, T1484.001
• Windows Defender Context Menu Removed severity high T1685
• Windows Defender Definition Files Removed severity high T1685
• Windows EventLog Autologger Session Registry Modification Via CommandLine severity high T1685, T1685.001
• Windows Firewall Disabled via PowerShell severity medium T1685
• Windows Hotfix Updates Reconnaissance Via Wmic.EXE severity medium T1047
• Windows Internet Hosted WebDav Share Mount Via Net.EXE severity high T1021, T1021.002
• Windows Kernel Debugger Execution severity medium
• Windows MSIX Package Support Framework AI_STUBS Execution severity low T1204, T1204.002, T1218, T1553, T1553.005
• Windows native backup deletion severity high T1490
• Windows native Pktmon sniffer abuse severity medium T1040
• Windows Processes Suspicious Parent Directory severity low T1036, T1036.003, T1036.005
• Windows Recall Feature Enabled Via Reg.EXE severity medium T1113
• Windows Recovery Environment Disabled Via Reagentc severity medium T1490
• Windows Share Mount Via Net.EXE severity low T1021, T1021.002
• Windows Shell/Scripting Processes Spawning Suspicious Programs severity high T1059, T1059.001, T1059.005, T1218
• Windows Subsystem for Linux (WSL) installation (command) severity medium T1564, T1564.006
• Windows Suspicious Child Process from Node.js - React2Shell severity high T1059, T1190
• Windows traffic capture abuse severity medium T1040
• Winlogon process contact to C2 - Blacklotus (Sysmon) severity high T1016
• Winnti Malware HK University Campaign severity critical T1574, T1574.001
• Winnti Pipemon Characteristics severity critical T1574, T1574.001
• Winrar Compressing Dump Files severity medium T1560, T1560.001
• WinRAR Execution in Non-Standard Folder severity medium T1560, T1560.001
• WinRM listening service reconnaissance (process) severity medium T1021, T1021.006
• Winrs Local Command Execution severity high T1021, T1021.006, T1218
• WinRS usage for remote execution severity high T1021, T1021.006
• Winscp Execution From Non Standard Folder severity medium T1048
• Wlrmdr.EXE Uncommon Argument Or Child Process severity medium T1218
• WMI Backdoor Exchange Transport Agent severity critical T1546, T1546.003
• WMI Persistence - Script Event Consumer severity medium T1546, T1546.003
• WMI spwaning PowerShell process - WMImplant severity high T1047
• WMIC Remote Command Execution severity medium T1047
• WmiPrvSE Spawned A Process severity medium T1047
• Write Protect For Storage Disabled severity medium T1685
• Writing Of Malicious Files To The Fonts Folder severity medium T1059, T1211
• Wscript Shell Run In CommandLine severity medium T1059
• WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript severity medium T1059, T1059.005, T1059.007
• WSL Child Process Anomaly severity medium T1202, T1218
• WSL Kali-Linux Usage severity high T1202
• Wusa.EXE Executed By Parent Process Located In Suspicious Location severity high
• XBAP Execution From Uncommon Locations Via PresentationHost.EXE severity medium T1218
• XSL Script Execution Via WMIC.EXE severity medium T1047, T1059, T1059.005, T1059.007, T1220
• Xwizard.EXE Execution From Non-Default Location severity high T1574, T1574.001
• ZxShell Malware severity critical T1059, T1059.003, T1218, T1218.011