Splunk rule coverage
162 events across 26 providers with Splunk detection rules, 2953 rule mappings total.
Microsoft-Windows-Security-Auditing
Event ID 4624: An account was successfully logged on. 21 rules
- Detect Password Spray Attack Behavior From Source production
- Detect Password Spray Attack Behavior On User production
- Multiple Host logons (Windows Event Log)
- Pass-the-Hash (Windows Event Log)
- Potential EternalBlue via Metasploit (Windows Event Log)
- Potential Exposed SMB_RDP Port - Windows (Windows Event Log)
- Potential SMB Activity from External IP - Windows (Windows Event Log)
- SecretsDump Credential Harvest (Windows Event Log)
- Suspicious Spool Authentication (Windows Event Log)
- Unusual Number of Remote Endpoint Authentication Events experimental
- Windows AD Domain Controller Promotion production
- Windows AD Replication Request Initiated by User Account production
- Windows AD Replication Request Initiated from Unsanctioned Location production
- Windows AD Short Lived Domain Controller SPN Attribute production
- Windows AD Suspicious Attribute Modification production
- Windows External Remote Login (Windows Event Log)
- Windows Identify PowerShell Web Access IIS Pool production
- Windows Kerberos Local Successful Logon production
- Windows Local Administrator Credential Stuffing production
- Windows Rapid Authentication On Multiple Hosts production
- Windows RDP Login Session Was Established production
Event ID 4625: An account failed to log on. 15 rules
- Detect Password Spray Attack Behavior From Source production
- Detect Password Spray Attack Behavior On User production
- Detect Password Spray Attempts production
- Meterpreter Reverse Shell (Windows Event Log)
- Multiple Failed Network Logon Attempts from Host (Windows Event Log)
- Password Spraying Windows (Windows Event Log)
- Potential EternalBlue via Metasploit (Windows Event Log)
- RDP Brute-force Detection (Windows Event Log)
- Suspicious Login Failures (Windows Event Log)
- Windows Identify PowerShell Web Access IIS Pool production
- Windows Local Administrator Credential Stuffing production
- Windows Multiple Users Failed To Authenticate From Process production
- Windows Multiple Users Remotely Failed To Authenticate From Host production
- Windows Unusual Count Of Users Failed To Authenticate From Process production
- Windows Unusual Count Of Users Remotely Failed To Auth From Host production
Event ID 4627: Group membership information. 1 rule
- Windows Domain Admin Impersonation Indicator production
Event ID 4656: A handle to an object was requested. 15 rules
- Browser Credential File Accessed - Windows (Windows Event Log)
- Common LSASS Memory Dump Behavior (Windows Event Log)
- Executable File Written to Disk (Windows Event Log)
- File Written to Startup Folder - Windows (Windows Event Log)
- Impacket atexec.py Temp File Creation (Windows Event Log)
- ISO File in Temp Folder (Windows Event Log)
- LSASS Handle request (Windows Event Log)
- Mimikatz (Windows Event Log)
- Potential Credential Dumping of LSASS (Windows Event Log)
- Potential nanodump execution (Windows Event Log)
- RDP File Written by Outlook (Windows Event Log)
- Service Stop Commands (Windows Event Log)
- Suspicious File written to Disk (Windows Event Log)
- Task Manager lsass Dump (Windows Event Log)
- Windows - Service Stop (Windows Event Log)
Event ID 4657: A registry value was modified. 14 rules
- Command Line Utility Added to Accessibility Features (Windows Event Log)
- ComputerDefaults UAC Bypass (Windows Event Log)
- ConsentPromptBehaviorAdmin Registry Value Modified (Windows Event Log)
- Defender Registry Values Modified (Windows Event Log)
- EnableLUA Registry Value Modified (Windows Event Log)
- Executable Running as NT AUTHORITY_SYSTEM Registered in BAM (Windows Event Log)
- Hidden User Created - Windows (Windows Event Log)
- LocalAccountTokenFilterPolicy Registry Value Modified (Windows Event Log)
- Modify Registry Key (Windows Event Log)
- Possible Credential Dumping via Windows Network Providers (Windows Event Log)
- Potential fodhelper UAC Bypass Attempt (Windows Event Log)
- PromptOnSecureDesktop Registry Value Modified (Windows Event Log)
- Suspicious Registry Key Created (Windows Event Log)
- Wow6432Node Classes Autorun Keys Modification (Windows Event Log)
Event ID 4662: An operation was performed on an object. 7 rules
- Excessive DRSGetNCChanges Requests (Windows Event Log)
- Potential DCSync (Windows Event Log)
- Windows AD Abnormal Object Access Activity production
- Windows AD Privileged Object Access Activity production
- Windows AD Replication Request Initiated by User Account production
- Windows AD Replication Request Initiated from Unsanctioned Location production
- Windows Kerberos Coercion via DNS production
Event ID 4663: An attempt was made to access an object. 31 rules
- Browser Credential File Accessed - Windows (Windows Event Log)
- ConnectWise ScreenConnect Path Traversal Windows SACL production
- ISO File in Temp Folder (Windows Event Log)
- ISO Image Mounted - Windows (Windows Event Log)
- Non Chrome Process Accessing Chrome Default Dir production
- Non Firefox Process Access Firefox Profile Dir production
- Potential Credential Dumping of LSASS (Windows Event Log)
- Potential nanodump execution (Windows Event Log)
- Rare dll called by Spoolsv.exe (Windows Event Log)
- RDP File Written by Outlook (Windows Event Log)
- Rename System Utilities (Windows Event Log)
- SAM Database File Access Attempt production
- SAM, System, Security Files Accessed (Windows Event Log)
- Task Manager lsass Dump (Windows Event Log)
- Temporary ConnectWise xml File Activity (Windows Event Log)
- Windows Credential Access From Browser Password Store production
- Windows Credentials from Password Stores Chrome Extension Access production
- Windows Credentials from Password Stores Chrome LocalState Access production
- Windows Credentials from Password Stores Chrome Login Data Access production
- Windows GrimResource - MMC Process Accessing APDS DLL production
- Windows Hosts File Access production
- Windows Increase in Group or Object Modification Activity production
- Windows Non Discord App Access Discord LevelDB production
- Windows Process Accessing Windows Recall Directory production
- Windows Product Key Registry Query production
- Windows Query Registry Browser List Application production
- Windows Query Registry UnInstall Program List production
- Windows Unsecured Outlook Credentials Access In Registry production
- Windows Unusual FileZilla XML Config Access production
- Windows Unusual Intelliform Storage Registry Access production
- Windows WinSCP Configuration Security Access production
Event ID 4688: A new process has been created. 789 rules
- .msc Executed from Unusual Location (Windows Event Log)
- 1 or 2 Character Executable (Windows Event Log)
- 3CXDesktopApp.exe Execution (Windows Event Log)
- 7zip CommandLine To SMB Share Path production
- Abuse EQNEDT32.EXE (Windows Event Log)
- Access Common Package Config file (Windows Event Log)
- Account Password Changed from Command Line - Windows (Windows Event Log)
- Account set to active via Net.exe (Windows Event Log)
- Add or Set Windows Defender Exclusion production
- ADExplorer Execution (Windows Event Log)
- ADExplorer Snapshot Creation (Windows Event Log)
- Adfind Commands (Windows Event Log)
- Adfind Execution (Windows Event Log)
- Advanced IP or Port Scanner Execution production
- Advanced IP Scanner Execution (Windows Event Log)
- Advanced Port Scanner Execution (Windows Event Log)
- Allow File And Printing Sharing In Firewall production
- Allow Network Discovery In Firewall production
- Anomalous usage of 7zip production
- AnyDesk Command Line Execution (Windows Event Log)
- AnyDesk Execution from Suspicious Folder (Windows Event Log)
- AnyDesk Silent Install (Windows Event Log)
- Application Discovery - Windows (Windows Event Log)
- ATBroker.exe Execution (Windows Event Log)
- Attacker Tools On Endpoint production
- Attempted Veeam Database Credential Dump (Windows Event Log)
- Attrib.exe Metasploit File Dropper (Windows Event Log)
- AutoHotkey Execution (Windows Event Log)
- AutoIt Execution (Windows Event Log)
- Bash -c Execution - Windows (Windows Event Log)
- Bcdedit Command Back To Normal Mode Boot production
- BCDEdit Failure Recovery Modification production
- BITS Job Persistence production
- BITSAdmin Download File production
- BITSadmin Execution (Windows Event Log)
- BitsAdmin NetCat PowerCat File Transfer (Windows Event Log)
- Browser Started with Remote Debugging - Windows (Windows Event Log)
- CDB Execution (Windows Event Log)
- Certificate Abuse - Windows (Windows Event Log)
- Certificate Enumeration - Windows (Windows Event Log)
- Certutil De-Obfuscate_Decode Files (Windows Event Log)
- Certutil exe certificate extraction production
- Certutil Execution (Windows Event Log)
- Certutil File Download (Windows Event Log)
- Certutil Obfuscate_Encode Files (Windows Event Log)
- Certutil Root Certificate Install (Windows Event Log)
- CertUtil With Decode Argument production
- Change To Safe Mode With Network Config production
- Check Elevated CMD using whoami production
- Child Processes of Spoolsv exe experimental
- Cipher.exe Execution (Windows Event Log)
- Clear Unallocated Sector Using Cipher App production
- Clop Common Exec Parameter production
- CMD Carry Out String Command Parameter production
- CMD Echo Pipe - Escalation production
- CMD execution with _c (Windows Event Log)
- Cmstp Execution (Windows Event Log)
- Command Line .cmd Execution (Windows Event Log)
- Command Line Homoglyphs - Windows (Windows Event Log)
- Command Line lsass request (Windows Event Log)
- Command Line Spawned by Archive Utility - Windows (Windows Event Log)
- Command Line Utility Added to Accessibility Features (Windows Event Log)
- Command Output Redirected to Localhost (Windows Event Log)
- Command-Line Interface Execution (Windows Event Log)
- Common Active Directory Commands (Windows Event Log)
- Common LSASS Memory Dump Behavior (Windows Event Log)
- Common Recon Commands in Short Burst (Windows Event Log)
- Common Reconnaissance Commands (Windows Event Log)
- Compressed File Execution (Windows Event Log)
- ComputerDefaults UAC Bypass (Windows Event Log)
- comsvcs.dll Lsass Memory Dump (Windows Event Log)
- Conhost.exe Kernel call (Windows Event Log)
- Consent.exe Suspicious Child Process (Windows Event Log)
- ConsentPromptBehaviorAdmin Registry Value Modified (Windows Event Log)
- Conti Common Exec parameter production
- Control Loading from World Writable Directory production
- Control Panel Abuse (Windows Event Log)
- Control_RunDLL Call from Command Line (Windows Event Log)
- Create or delete windows shares using net exe production
- Create_Add Local_Domain User (Windows Event Log)
- Create_Modify Schtasks (Windows Event Log)
- Creation of Shadow Copy production
- Creation of Shadow Copy with wmic and powershell production
- Credential Dumping via Copy Command from Shadow Copy production
- Credential Dumping via Symlink to Shadow Copy production
- Credentials in Registry (Windows Event Log)
- CSC Execution (Windows Event Log)
- CSC Net On The Fly Compilation production
- CSVDE Export Active Directory (Windows Event Log)
- Curl Execution with Percent Encoded URL production
- CVE-2022-30190: Microsoft Office Code Execution Vulnerability (Windows Event Log)
- Data Exfiltration via AWS CLI - Windows (Windows Event Log)
- Data Staged to File (Windows Event Log)
- Defender Registry Values Modified (Windows Event Log)
- Deleting Shadow Copies production
- Detect AzureHound Command-Line Arguments production
- Detect Certify Command Line Arguments production
- Detect HTML Help Renamed production
- Detect HTML Help Spawn Child Process production
- Detect HTML Help URL in Command Line production
- Detect HTML Help Using InfoTech Storage Handlers production
- Detect mshta inline hta execution production
- Detect mshta renamed production
- Detect MSHTA Url in Command Line production
- Detect Path Interception By Creation Of program exe production
- Detect Prohibited Applications Spawning cmd exe production
- Detect PsExec With accepteula Flag production
- Detect Rare Executables production
- Detect RClone Command-Line Usage production
- Detect Regasm Spawning a Process production
- Detect Regasm with no Command Line Arguments production
- Detect Regsvcs Spawning a Process production
- Detect Regsvcs with No Command Line Arguments production
- Detect Regsvr32 Application Control Bypass production
- Detect Remote Access Software Usage Process production
- Detect Renamed 7-Zip production
- Detect Renamed PSExec production
- Detect Renamed RClone production
- Detect Renamed WinRAR production
- Detect RTLO In Process production
- Detect Rundll32 Inline HTA Execution production
- Detect SharpHound Command-Line Arguments production
- Detect SharpHound Usage production
- Detect Use of cmd exe to Launch Script Interpreters production
- Detection of tools built by NirSoft experimental
- Disable Logs Using WevtUtil production
- Disable Schedule Task production
- Disabled Pre-Authentication Accounts Discovery - PowerShell (Sysmon)
- Disabled Pre-Authentication Accounts Discovery - PowerShell (Windows Event Log)
- Disabling Firewall with Netsh production
- Discovery using CHCP (Windows Event Log)
- DLL Called with RS32 (Windows Event Log)
- DLL Called with Uncommon Function (Windows Event Log)
- DLL Concatenation (Windows Event Log)
- DLL Execution from Uncommon Process (Windows Event Log)
- DLLRegisterServer Called from Command Line (Windows Event Log)
- DNS Exfiltration Using Nslookup App production
- DNX.exe Proxy Execution (Windows Event Log)
- Domain Account Discovery with Dsquery production
- Domain Account Discovery with Wmic production
- Domain Controller Discovery with Nltest production
- Domain Controller Discovery with Wmic production
- Domain Controller Enumeration via nltest (Windows Event Log)
- Domain Group Discovery With Dsquery production
- Domain Group Discovery With Wmic production
- Domain Trust Discovery Commands - Windows (Windows Event Log)
- Dotnet.exe Execution (Windows Event Log)
- Driver as Command Parameter (Windows Event Log)
- DSQuery Domain Discovery production
- Dump File Identified (Windows Event Log)
- Dump LSASS via comsvcs DLL production
- Dump LSASS via procdump production
- Dxcap Proxy Execution (Windows Event Log)
- Elevated Group Discovery With Wmic production
- EnableLUA Registry Value Modified (Windows Event Log)
- Encoded Powershell Command (Windows Event Log)
- Esentutl Execution (Windows Event Log)
- Esentutl SAM Copy production
- Event Logs Queried for RDP Sessions (Windows Event Log)
- Excessive Attempt To Disable Services production
- Excessive distinct processes from Windows Temp production
- Excessive number of service control start as disabled production
- Excessive number of taskhost processes production
- Excessive Usage Of Cacls App production
- Excessive Usage of NSLOOKUP App production
- Excessive Usage Of Taskkill production
- Executable Create Script Process (Windows Event Log)
- Executable Process from Suspicious Folder (Windows Event Log)
- Execute Javascript With Jscript COM CLSID production
- Execution from Startup Folder (Windows Event Log)
- Execution of File with Multiple Extensions production
- Exfiltration via curl.exe - Windows (Windows Event Log)
- Expand.exe Execution (Windows Event Log)
- File and Directory Discovery Output to File - Windows (Windows Event Log)
- File Download or Read to Pipe Execution production
- File Executed from INetCache (Windows Event Log)
- File_Folder Hidden - Windows (Windows Event Log)
- Finger Execution (Windows Event Log)
- Firewall Allowed Program Enable production
- First Time Seen Child Process of Zoom experimental
- FodHelper UAC Bypass production
- FScan.exe Network Scan (Windows Event Log)
- Fsutil fsinfo execution (Windows Event Log)
- Fsutil Zeroing File production
- Full Control Permissions Granted to Everyone - Windows (Windows Event Log)
- Get ADDefaultDomainPasswordPolicy with Powershell production
- Get ADUser with PowerShell production
- Get ADUserResultantPasswordPolicy with Powershell production
- Get DomainPolicy with Powershell production
- Get DomainUser with PowerShell production
- Get WMIObject Group Discovery production
- Get-DomainTrust with PowerShell production
- Get-ForestTrust with PowerShell production
- GetAdComputer with PowerShell production
- GetAdGroup with PowerShell production
- GetCurrent User with PowerShell production
- GetDomainComputer with PowerShell production
- GetDomainController with PowerShell production
- GetDomainGroup with PowerShell production
- GetLocalUser with PowerShell production
- GetNetTcpconnection with PowerShell production
- GetWmiObject Ds Computer with PowerShell production
- GetWmiObject Ds Group with PowerShell production
- GetWmiObject DS User with PowerShell production
- GetWmiObject User Account with PowerShell production
- Git Spawns System32 Process (Windows Event Log)
- Git Submodule Cloned - Windows (Windows Event Log)
- Go Run Execution (Windows Event Log)
- Group Policy Editor Execution (Windows Event Log)
- Headless Browser Mockbin or Mocky Request production
- Headless Browser Usage production
- hh.exe Execution (Windows Event Log)
- hh.exe Remote File Execution (Windows Event Log)
- Hidden User Created - Windows (Windows Event Log)
- Hiding Files And Directories With Attrib exe production
- HTTP_HTTPS Default Security Zone Modified to Local Machine (Windows Event Log)
- Hunting 3CXDesktopApp Software production
- Icacls Deny Command production
- ICACLS Grant Command production
- IcedID Discovery Commands (Windows Event Log)
- IIS Worker (W3WP) Spawn Command Line (Windows Event Log)
- Impacket atexec.py Execution (Windows Event Log)
- Impacket Lateral Movement Activity (Windows Event Log)
- Impacket Lateral Movement Commandline Parameters production
- Impacket Lateral Movement smbexec CommandLine Parameters production
- Impacket Lateral Movement WMIExec Commandline Parameters production
- Impacket PSexec (Windows Event Log)
- Impacket SMBexec (Windows Event Log)
- Impacket_Empire's WMIExec (Windows Event Log)
- Indirect Command Execution (Windows Event Log)
- Invoke-DCOM.ps1 - PowerShell (Windows Event Log)
- Invoke-Expression Command (Windows Event Log)
- Invoke-WebRequest Command (Windows Event Log)
- Known Process Injection Commands (Windows Event Log)
- Live Sysinternals Execution (Windows Event Log)
- Local Account Discovery With Wmic production
- LocalAccountTokenFilterPolicy Registry Value Modified (Windows Event Log)
- Locate Credentials (Windows Event Log)
- Logon Script Registry Key added (Windows Event Log)
- LSA Authentication Packages Registry Key Modified (Windows Event Log)
- Malicious Document Execution (Windows Event Log)
- Malicious PowerShell Process - Encoded Command production
- Malicious PowerShell Process - Execution Policy Bypass production
- masscan Execution - Windows (Windows Event Log)
- Mavinject Execution (Windows Event Log)
- Mega Utility Execution - Windows (Windows Event Log)
- Microsoft Build Engine Suspicious Parent Process (Windows Event Log)
- Microsoft Diagnostic Tool "DogWalk" Package Path Traversal (Windows Event Log)
- Microsoft SQL Server Suspicious Child Process - Windows (Windows Event Log)
- Mimikatz (Windows Event Log)
- Mimikatz Execution (Windows Event Log)
- Mimikatz PassTheTicket CommandLine Parameters production
- Mmc LOLBAS Execution Process Spawn production
- Mock System Directory - Windows (Windows Event Log)
- Modify ACL permission To Files Or Folder production
- Modify Windows Defender (Windows Event Log)
- MSBuild Suspicious Spawned By Script Process production
- Mshta spawning Rundll32 OR Regsvr32 Process production
- MSHTA.exe execution (Windows Event Log)
- mshta.exe File Download (Windows Event Log)
- MSI Installation via Appcert (Windows Event Log)
- Msiexec Abuse (Windows Event Log)
- MSIExec.exe Execution (Windows Event Log)
- MSTSC Execution (Windows Event Log)
- Msxsl Execution (Windows Event Log)
- MultiDump.exe Execution (Windows Event Log)
- Multiple nslookup commands (Windows Event Log)
- Native Archive Commands (Windows Event Log)
- Net.exe Use with URL (Windows Event Log)
- Network Connection Discovery With Arp production
- Network Connection Discovery With Netstat production
- Network Discovery Using Route Windows App production
- New AutoRun Registry Key (Windows Event Log)
- ngen.exe File Download (Windows Event Log)
- ngrok Execution - Windows (Windows Event Log)
- NirCmd Execution (Windows Event Log)
- Nishang PowershellTCPOneLine production
- NLTest Domain Trust Discovery production
- NMAP Execution (Windows Event Log)
- Non-MSIExec .msi Installation (Windows Event Log)
- Notepad with no Command Line Arguments production
- Nslookup Execution (Windows Event Log)
- ntds.dit Access from Unexpected Location (Windows Event Log)
- ntds.dit Command Line (Windows Event Log)
- Ntdsutil Export NTDS production
- NTDSUtil.exe execution (Windows Event Log)
- Office Binary Download Remote File (Windows Event Log)
- Office Spawns Suspicious Child Process (Windows Event Log)
- Output to File (Windows Event Log)
- Package installation (Windows Event Log)
- Parent in Public Folder Suspicious Process (Windows Event Log)
- Permission Groups Discovery: Domain Groups (Windows Event Log)
- Permission Groups Discovery: Local Groups (Windows Event Log)
- Permission Modification using Takeown App production
- Permissions Replaced by icacls - Windows (Windows Event Log)
- Possible Browser Pass View Parameter production
- Possible Credential Dumping via Windows Network Providers (Windows Event Log)
- Potential AutoHotkey .ahk Execution (Windows Event Log)
- Potential Cryptomining Commands (Windows Event Log)
- Potential CVE-2023-23397 (Windows Event Log)
- Potential Executable Masquerading as Document - Windows (Windows Event Log)
- Potential fodhelper UAC Bypass Attempt (Windows Event Log)
- Potential LSA password filter (Windows Event Log)
- Potential Ping Sweep (Windows Event Log)
- Potential PowerShell Post-Exploitation Activity (Windows Event Log)
- Potential Proxy Malware via AutoRun Key (Windows Event Log)
- Potential Sysinternals Tool Execution (Windows Event Log)
- Potential System Network Configuration Discovery Activity production
- Potential Telegram API Request Via CommandLine production
- PowerHuntShares Commands (Windows Event Log)
- PowerShell CreateDecryptor (Windows Event Log)
- Powershell Defender Threat Actions Set to Allow production
- Powershell Disable Security Monitoring production
- PowerShell Downgrade (Sysmon)
- PowerShell Downgrade (Windows Event Log)
- PowerShell DownloadFile_DownloadString (Windows Event Log)
- PowerShell Get LocalGroup Discovery production
- PowerShell Hidden Window (Windows Event Log)
- PowerShell Modifying Registry Values (Windows Event Log)
- PowerShell Start-BitsTransfer production
- PowerShell XML Retrieval (Windows Event Log)
- Prevent Automatic Repair Mode using Bcdedit production
- ProcDump Credential Harvest (Windows Event Log)
- Process Creation Using Sysnative Folder (Windows Event Log)
- Process Executed from Downloads Folder - Windows (Windows Event Log)
- Process Executed with Null Command Line (Windows Event Log)
- Process Execution From Suspicious Folder (Windows Event Log)
- Process Execution via WMI production
- Process Kill Base On File Path production
- PromptOnSecureDesktop Registry Value Modified (Windows Event Log)
- ProtocolHandler.exe File Download (Windows Event Log)
- Proxy Execution via Appcert (Windows Event Log)
- PuTTY Secure Copy Client Execution (Windows Event Log)
- pypykatz commands (Windows Event Log)
- Python Execution (Windows Event Log)
- QEMU Network Tunneling - Windows (Windows Event Log)
- Query Registry (Windows Event Log)
- Radmin execution (Windows Event Log)
- Rare executable from Microsoft Office (Windows Event Log)
- Rare Process Execution (Windows Event Log)
- Rclone Execution (Windows Event Log)
- RDP Enabled (Windows Event Log)
- RDP File Executed from Outlook Temp Directory (Windows Event Log)
- RDP Hijacking (Windows Event Log)
- RdrLeakDiag.exe Memory Dump (Windows Event Log)
- Read-Only Attribute Removed - Windows (Windows Event Log)
- Recursive Delete of Directory In Batch CMD production
- Reg exe Manipulating Windows Services Registry Keys production
- Reg.exe Process Execution (Windows Event Log)
- Regini.exe Execution (Windows Event Log)
- Registry key added with reg.exe (Windows Event Log)
- regsvr32 Execution (Windows Event Log)
- regsvr32 Referencing Unusual Paths (Windows Event Log)
- Regsvr32 Silent and Install Param Dll Loading production
- Remote .msi Installation (Windows Event Log)
- Remote .msi Installation (Windows Event Log)
- Remote Access Software Execution (Windows Event Log)
- Remote Admin Tools (Windows Event Log)
- Remote Desktop Process Running On System experimental
- Remote Process Instantiation via DCOM and PowerShell production
- Remote Process Instantiation via WinRM and PowerShell production
- Remote Process Instantiation via WinRM and Winrs production
- Remote Process Instantiation via WMI production
- Remote Process Instantiation via WMI and PowerShell production
- Remote Share Directory Listing - Windows (Windows Event Log)
- Remote System Discovery with Dsquery production
- Remote System Discovery with Wmic production
- Remote WMI Command Attempt production
- Remote WMIC Query (Windows Event Log)
- Resize ShadowStorage volume production
- Revil Common Exec Parameter production
- Rubeus Command Line Parameters production
- Rubeus Commands (Windows Event Log)
- Runas Execution in CommandLine production
- RunDLL Loading DLL By Ordinal production
- Rundll32 Command Line (Windows Event Log)
- Rundll32 Control RunDLL Hunt production
- Rundll32 Control RunDLL World Writable Directory production
- Rundll32 LockWorkStation production
- Rundll32 Shimcache Flush production
- Rundll32 Spawned by Disk Cleanup (Windows Event Log)
- Rundll32 Suspicious Command Line (Windows Event Log)
- rundll32 Suspicious Parent Process (Windows Event Log)
- rundll32 with No DLL in Command Line (Windows Event Log)
- Rundll32.exe as Parent Process (Windows Event Log)
- rundll32.exe Executing DLL from Non-standard Directory (Windows Event Log)
- Ryuk Wake on LAN Command production
- Scheduled Task Creation on Remote Endpoint using At production
- Scheduled Task Deleted Or Created via CMD production
- Scheduled Task Initiation on Remote Endpoint production
- Scheduled Task with Potential SSH Tunnel - Windows (Windows Event Log)
- Schtasks Run Task On Demand production
- Schtasks scheduling job on remote system production
- Schtasks used for forcing a reboot production
- Script Execution via WMI production
- Sdelete Application Execution production
- SecretDumps Offline NTDS Dumping Tool production
- Security Software Discovery via Findstr.exe (Windows Event Log)
- Security Software Discovery via WMI (Windows Event Log)
- Service Stop Commands (Windows Event Log)
- ServicePrincipalNames Discovery with SetSPN production
- Services Escalate Exe production
- Services LOLBAS Execution Process Spawn production
- Shell Spawned by Web Server - Windows (Windows Event Log)
- Shim Database Installation With Suspicious Parameters production
- SimpleHelp Remote Access Tool Execution (Windows Event Log)
- Single Letter Process On Endpoint production
- Sliver C2 Implant Activity Pattern (Windows Event Log)
- SLUI RunAs Elevated production
- SLUI Spawning a Process production
- SoftPerfect Network Scanner Execution (Windows Event Log)
- Spoolsv Spawning Rundll32 production
- Spoolsv Writing a DLL production
- ssh.exe Execution (Windows Event Log)
- Startup Folder Location Modified - Windows (Windows Event Log)
- Suspicious AteraAgent Installation - Windows (Windows Event Log)
- Suspicious Child Process for hh.exe (Windows Event Log)
- Suspicious Child Process for lsass.exe (Windows Event Log)
- Suspicious Child Process for mshta.exe (Windows Event Log)
- Suspicious ComputerDefaults.exe Execution (Windows Event Log)
- Suspicious Confluence Child Process - Windows (Windows Event Log)
- Suspicious Conhost.exe Commands (Windows Event Log)
- Suspicious Copy on System32 production
- Suspicious csc.exe Source File Folder (Windows Event Log)
- Suspicious Curl Network Connection experimental
- Suspicious DLLhost Execution (Windows Event Log)
- Suspicious DLLHost no Command Line Arguments production
- Suspicious Executable by CMD.exe (Windows Event Log)
- Suspicious Executable by Powershell (Windows Event Log)
- Suspicious Execution of Accessibility Tool Debuggers (Windows Event Log)
- Suspicious Execution via Microsoft Common Console (Windows Event Log)
- Suspicious GPUpdate no Command Line Arguments production
- Suspicious IcedID Rundll32 Cmdline production
- Suspicious InprocServer32 Registry Modification (Windows Event Log)
- Suspicious microsoft workflow compiler rename production
- Suspicious microsoft workflow compiler usage production
- Suspicious msbuild path production
- Suspicious MSBuild Rename production
- Suspicious MSBuild Spawn production
- Suspicious mshta child process production
- Suspicious mshta spawn production
- Suspicious ntds.dit Commands (Windows Event Log)
- Suspicious Parent Process for lsass.exe or services.exe (Windows Event Log)
- Suspicious Parent Process for msiexec.exe (Windows Event Log)
- Suspicious Parent Process for spoolsv.exe (Windows Event Log)
- Suspicious PlistBuddy Usage experimental
- Suspicious PowerShell Clipboard Activity (Windows Event Log)
- Suspicious PowerShell Parameter Substring (Windows Event Log)
- Suspicious Process Executed From Container File production
- Suspicious process Spawned by Java (Windows Event Log)
- Suspicious Reg exe Process production
- Suspicious Regsvr32 Register Suspicious Path production
- Suspicious Rundll32 dllregisterserver production
- Suspicious Rundll32 no Command Line Arguments production
- Suspicious Rundll32 PluginInit production
- Suspicious Rundll32 StartW production
- Suspicious Scheduled Task from Public Directory production
- Suspicious SearchProtocolHost no Command Line Arguments production
- Suspicious SQLite3 LSQuarantine Behavior experimental
- Suspicious WAV file in Appdata Folder production
- Suspicious wevtutil Usage production
- Symbolic OR Hard File Link Created (Windows Event Log)
- SyncAppvPublishingServer Execution (Windows Event Log)
- System Enumeration with WMIC (Windows Event Log)
- System Info Gathering Using Dxdiag Application production
- System Information Discovery - Windows (Windows Event Log)
- System Information Discovery Detection production
- System Network Connections Discovery - Windows (Windows Event Log)
- System Owner_User Discovery - Windows (Windows Event Log)
- System Processes Run From Unexpected Locations production
- System Time enumeration (Windows Event Log)
- System User Discovery With Query production
- System User Discovery With Whoami production
- Task Manager lsass Dump (Windows Event Log)
- Temporary File Executed from Public Folder (Windows Event Log)
- Timestamp Manipulation (Windows Event Log)
- Tunneling Process Created (Windows Event Log)
- Uninstall App Using MsiExec production
- Unload Sysmon Filter Driver production
- Unusual AppCert Child Process (Windows Event Log)
- Unusual svchost Child Process (Windows Event Log)
- Unusual winlogon.exe Child Process (Windows Event Log)
- Unusually Long Command Line experimental
- User Discovery With Env Vars PowerShell production
- User_Domain Enumeration Tool - Windows (Windows Event Log)
- USN Journal Deletion production
- Utility Archive Data (Windows Event Log)
- Verclsid CLSID Execution production
- Visio.exe File Download (Windows Event Log)
- Visual Studio Code Tunnel Execution (Windows Event Log)
- WBAdmin Delete System Backups production
- WDigest Forced Credential Caching (Windows Event Log)
- WebDAV LNK Execution (Windows Event Log)
- WebLogic CVE-2017-10271 (Windows Event Log)
- Wermgr Process Spawned CMD Or Powershell Process production
- Windows - Service Stop (Windows Event Log)
- Windows AdFind Exe production
- Windows Advanced Installer MSIX with AI_STUBS Execution production
- Windows Alternate DataStream - Process Execution production
- Windows Apache Benchmark Binary production
- Windows AppCertDLL Modification Via Command Line production
- Windows Application Whitelisting Bypass Attempt via Rundll32 production
- Windows Archive Collected Data via Rar production
- Windows Attempt To Stop Security Service production
- Windows Audit Policy Auditing Option Disabled via Auditpol production
- Windows Audit Policy Cleared via Auditpol production
- Windows Audit Policy Disabled via Auditpol production
- Windows Audit Policy Disabled via Legacy Auditpol production
- Windows Audit Policy Excluded Category via Auditpol production
- Windows Audit Policy Restored via Auditpol production
- Windows Audit Policy Security Descriptor Tampering via Auditpol production
- Windows AutoIt3 Execution production
- Windows Azure Storage Utility Execution Via CLI production
- Windows Binary Proxy Execution Mavinject DLL Injection production
- Windows BitLocker Suspicious Command Usage production
- Windows BitLockerToGo Process Execution production
- Windows Bypass UAC via Pkgmgr Tool production
- Windows Cabinet File Extraction Via Expand production
- Windows Cached Domain Credentials Reg Query production
- Windows Certutil Root Certificate Addition production
- Windows Change File Association Command To Notepad production
- Windows Chrome Enable Extension Loading via Command-Line production
- Windows Chromium Browser Launched with Small Window Size production
- Windows Chromium Browser No Security Sandbox Process production
- Windows Chromium Browser with Custom User Data Directory production
- Windows Chromium process Launched with Disable Popup Blocking production
- Windows Chromium Process Launched with Logging Disabled production
- Windows Chromium Process Loaded Extension via Command-Line production
- Windows Chromium Process with Disabled Extensions production
- Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc production
- Windows Cisco Secure Endpoint Unblock File Via Sfc production
- Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc production
- Windows Cmdline Tool Execution From Non-Shell Process production
- Windows COM Hijacking InprocServer32 Modification production
- Windows Command and Scripting Interpreter Hunting Path Traversal production
- Windows Command and Scripting Interpreter Path Traversal Exec production
- Windows Command Obfuscation with Environment Variable Substrings production
- Windows Compatibility Telemetry Suspicious Child Process production
- Windows ConHost with Headless Argument production
- Windows Copy Files (Windows Event Log)
- Windows Create Local Administrator Account Via Net production
- Windows Credential Dumping LSASS Memory Createdump production
- Windows Credentials from Password Stores Creation production
- Windows Credentials from Password Stores Deletion production
- Windows Credentials from Password Stores Query production
- Windows Credentials in Registry Reg Query production
- Windows Curl Download to Suspicious Path production
- Windows Curl Upload to Remote Destination production
- Windows Debugger Tool Execution production
- Windows Default Group Policy Object Modified with GPME production
- Windows Defender ASR or Threat Configuration Tamper production
- Windows Defender Disabled Detection (Windows Event Log)
- Windows Delete or Modify System Firewall production
- Windows Devtunnels Execution production
- Windows Dir Piped to Findstr Activity production
- Windows Disable Internet Explorer Addons production
- Windows Disable or Modify Tools Via Taskkill production
- Windows Disable Windows Event Logging Disable HTTP Logging production
- Windows DiskCryptor Usage production
- Windows Diskshadow Proxy Execution production
- Windows DISM Install PowerShell Web Access production
- Windows DISM Remove Defender production
- Windows DLL Search Order Hijacking with iscsicpl production
- Windows DLL Side-Loading Process Child Of Calc production
- Windows DNS Gather Network Info production
- Windows DotNet Binary in Non Standard Path production
- Windows EDRSilencer Execution production
- Windows EFI Volume Mount Attempt Via Mountvol production
- Windows Entra User Management Via Azure CLI production
- Windows ESX Admins Group Creation via Net production
- Windows Eventlog Cleared Via Wevtutil production
- Windows EventLog Recon Activity Using Log Query Utilities production
- Windows Excel Spawning Microsoft Project Application production
- Windows Excessive Service Stop Attempt production
- Windows Excessive Usage Of Net App production
- Windows Execute Arbitrary Commands with MSDT production
- Windows Execution of Microsoft MSC File In Suspicious Path production
- Windows Explorer LNK Exploit Process Launch With Padding production
- Windows Explorer.exe Spawning PowerShell or Cmd production
- Windows FFmpeg Audio and Video Device Discovery production
- Windows FFmpeg DirectShow Video Capture production
- Windows File and Directory Enable ReadOnly Permissions production
- Windows File and Directory Permissions Enable Inheritance production
- Windows File and Directory Permissions Remove Inheritance production
- Windows File Association Modification via Ftype production
- Windows File Collection Via Copy Utilities production
- Windows File Download Via CertUtil production
- Windows File Download Via PowerShell production
- Windows Files and Dirs Access Rights Modification Via Icacls production
- Windows Findstr GPP Discovery production
- Windows Firewall Disabled (Windows Event Log)
- Windows Firewall Rule Creation (Windows Event Log)
- Windows FTP Exfiltration (Windows Event Log)
- Windows Gdrive Binary Activity production
- Windows Get-Variable.EXE Execution from WindowsApps Folder production
- Windows Global Object Access Audit List Cleared Via Auditpol production
- Windows Group Discovery Via Net production
- Windows Guest Account Enabled Via Net.EXE production
- Windows Identify Protocol Handlers production
- Windows IIS Components Add New Module production
- Windows Impair Defense Add Xml Applocker Rules production
- Windows Indicator Removal Via Rmdir production
- Windows Indirect Command Execution Via Series Of Forfiles production
- Windows Information Discovery Fsutil production
- Windows Ingress Tool Transfer Using Explorer production
- Windows InstallUtil in Non Standard Path production
- Windows InstallUtil Uninstall Option production
- Windows InstallUtil URL in Command Line production
- Windows IOBit Unlocker Extension DLL Registration via Regsvr32 production
- Windows Ldifde Directory Object Behavior production
- Windows List ENV Variables Via SET Command From Uncommon Parent production
- Windows Local LLM Framework Execution production
- Windows LOLBAS Executed As Renamed File production
- Windows LOLBAS Executed Outside Expected Path production
- Windows Masquerading Explorer As Child Process production
- Windows Masquerading Msdtc Process production
- Windows Metasploit Confluence Plugin Execution production
- Windows Mimikatz Binary Execution production
- Windows Modify Registry Regedit Silent Reg Import production
- Windows Modify System Firewall with Notable Process Path production
- Windows MOF Event Triggered Execution via WMI production
- Windows MpCmdRun RemoveDefinitions Execution production
- Windows MSC EvilTwin Directory Path Manipulation production
- Windows MSIExec DLLRegisterServer production
- Windows MsiExec HideWindow Rundll32 Execution production
- Windows MSIExec Remote Download production
- Windows MSIExec Spawn Discovery Command production
- Windows MSIExec Spawn WinDBG production
- Windows MSIExec Unregister DLLRegisterServer production
- Windows MSTSC RDP Commandline production
- Windows Mustang Panda USB Tool Execution production
- Windows Net System Service Discovery production
- Windows Netspy Network Scanner Execution production
- Windows Network Connection Discovery Via Net production
- Windows Network Share Interaction Via Net production
- Windows Network Sniffing Tool Executed production
- Windows New Deny Permission Set On Service SD Via Sc.EXE production
- Windows New Service Security Descriptor Set Via Sc.EXE production
- Windows Ngrok Reverse Proxy Usage production
- Windows NirSoft AdvancedRun production
- Windows NirSoft Utilities production
- Windows NorthStar C2 Agent Execution production
- Windows Odbcconf Hunting production
- Windows Odbcconf Load DLL production
- Windows Odbcconf Load Response File production
- Windows Office Product Dropped Cab or Inf File production
- Windows Office Product Spawned Child Process For Download production
- Windows Office Product Spawned Control production
- Windows Office Product Spawned MSDT production
- Windows Office Product Spawned Rundll32 With No DLL production
- Windows Office Product Spawned Uncommon Process production
- Windows OneDrive Share Mounted via Net production
- Windows PaperCut NG Spawn Shell production
- Windows Parent PID Spoofing with Explorer production
- Windows Password Managers Discovery production
- Windows Password Policy Discovery with Net production
- Windows Phishing PDF File Executes URL Link production
- Windows Potato Privilege Escalation Tool Execution production
- Windows Potential Cloudflared Tunnel Execution production
- Windows PowerShell FakeCAPTCHA Clipboard Execution production
- Windows PowerShell Process Implementing Manual Base64 Decoder production
- Windows PowerShell Process With Malicious String production
- Windows Powershell RemoteSigned File production
- Windows PowerShell Script From WindowsApps Directory production
- Windows Private Keys Discovery production
- Windows Privilege Escalation Attempt Via MSI Rollback production
- Windows Process Commandline Discovery production
- Windows Process Copied from System Folder (Windows Event Log)
- Windows Process Execution From ProgramData production
- Windows Process Execution From RDP Share production
- Windows Process Execution in Temp Dir production
- Windows Process Injection In Non-Service SearchIndexer production
- Windows Process Injection Wermgr Child Process production
- Windows Process Outside of System Folder (Windows Event Log)
- Windows Process With NamedPipe CommandLine production
- Windows Process With NetExec Command Line Parameters production
- Windows Protocol Tunneling with Plink production
- Windows Proxy Execution of .NET Utilities via Scripts production
- Windows Proxy Via Netsh production
- Windows PsTools Recon Usage production
- Windows PuTTY Suite Utility Execution production
- Windows Raccine Scheduled Task Deletion production
- Windows Rasautou DLL Execution production
- Windows RDP File Execution production
- Windows Registry Entries Exported Via Reg production
- Windows Registry Entries Restored Via Reg production
- Windows Regsvr32 Renamed Binary production
- Windows Remote Assistance Spawning Process production
- Windows Remote Create Service production
- Windows Remote Host Computer Management Access production
- Windows Remote Management Execute Shell production
- Windows Remote Service Rdpwinst Tool Execution production
- Windows Remote Services Allow Rdp In Firewall production
- Windows Rundll32 Apply User Settings Changes production
- Windows Rundll32 Execution With Log.DLL production
- Windows Rundll32 WebDAV Request production
- Windows Rundll32 with Non-Standard File Extension production
- Windows Scheduled Task Created Via XML production
- Windows Scheduled Task with Highest Privileges production
- Windows Schtasks Create Run As System production
- Windows ScManager Security Descriptor Tampering Via Sc.EXE production
- Windows Security Account Manager Stopped production
- Windows Security Support Provider Reg Query production
- Windows Sensitive Group Discovery With Net production
- Windows Sensitive Registry Hive Dump Via CommandLine production
- Windows Server Software Component GACUtil Install to GAC production
- Windows Service Create Kernel Mode Driver production
- Windows Service Create with Tscon production
- Windows Service Created (Windows Event Log)
- Windows Service Creation on Remote Endpoint production
- Windows Service Execution RemCom production
- Windows Service Initiation on Remote Endpoint production
- Windows Service Started (Windows Event Log)
- Windows Service Stop Attempt production
- Windows Service Stop By Deletion production
- Windows Set Account Password Policy To Unlimited Via Net production
- Windows Set Custom DNS ServerLevelPlugin Via Dnscmd production
- Windows Shell Process from CrushFTP production
- Windows SOAPHound Binary Execution production
- Windows Spearphishing Attachment Onenote Spawn Mshta production
- Windows SpeechRuntime Suspicious Child Process production
- Windows SQL Spawning CertUtil experimental
- Windows SQLCMD Execution production
- Windows Sqlservr Spawning Shell production
- Windows Steal Authentication Certificates CertUtil Backup production
- Windows Steal Authentication Certificates Export Certificate production
- Windows Steal Authentication Certificates Export PfxCertificate production
- Windows Steal or Forge Kerberos Tickets Klist production
- Windows SubInAcl Execution production
- Windows Suspicious Child Process of Consent.EXE production
- Windows Suspicious Child Process of TieringEngineService.exe production
- Windows Suspicious Child Process Spawned From WebServer production
- Windows Suspicious Process File Path production
- Windows Suspicious VMWare Tools Child Process production
- Windows Svchost.exe Parent Process Anomaly production
- Windows SymbolicLink-Testing-Tools Utility Execution production
- Windows Symlink Evaluation Change via Fsutil production
- Windows System Binary Proxy Execution Compiled HTML File Decompile production
- Windows System Discovery Using ldap Nslookup production
- Windows System Discovery Using Qwinsta production
- Windows System LogOff Commandline production
- Windows System Network Config Discovery Display DNS production
- Windows System Network Connections Discovery Netsh production
- Windows System Reboot CommandLine production
- Windows System Remote Discovery With Query production
- Windows System Script Proxy Execution Syncappvpublishingserver production
- Windows System Shutdown CommandLine production
- Windows System Time Discovery W32tm Delay production
- Windows System User Discovery Via Quser production
- Windows System User Privilege Discovery production
- Windows TeamCity Payload Execution from Temp Directory production
- Windows Time Based Evasion via Choice Exec production
- Windows TinyCC Shellcode Execution production
- Windows TOR Client Execution production
- Windows UAC Bypass Suspicious Child Process production
- Windows Unusual SysWOW64 Process Run System32 Executable production
- Windows User Deletion Via Net production
- Windows User Disabled Via Net production
- Windows User Discovery Via Net production
- Windows WBAdmin File Recovery From Backup production
- Windows WinDBG Spawning AutoIt3 production
- Windows WinRAR Launched Outside Default Installation Directory production
- Windows WMI Process And Service List production
- Windows WMI Process Call Create production
- Windows WMI Reconnaissance Class Query production
- Windows Wmic CPU Discovery production
- Windows Wmic DiskDrive Discovery production
- Windows Wmic Memory Chip Discovery production
- Windows Wmic Network Discovery production
- Windows Wmic Systeminfo Discovery production
- Windows WSUS Spawning Shell production
- Winhlp32 Spawning a Process production
- WinRAR Spawning Shell Application production
- WinRM Spawning a Process experimental
- WinRM Tools (Windows Event Log)
- WinSCP Execution (Windows Event Log)
- WMI subscription execution (Windows Event Log)
- WMIC Explicit Credentials (Windows Event Log)
- Wmic Group Discovery production
- WMIC Host Reconniassance (Windows Event Log)
- Wmic NonInteractive App Uninstallation production
- WMIC XSL Execution via URL production
- Wmiprvse LOLBAS Execution Process Spawn production
- WmiPrvSE Suspicious Child Process (Windows Event Log)
- Wow6432Node Classes Autorun Keys Modification (Windows Event Log)
- Wscript Or Cscript Suspicious Child Process production
- Wscript_Cscript Execution (Windows Event Log)
- Wsmprovhost LOLBAS Execution Process Spawn production
- XSL Script Execution With WMIC production
Event ID 4698: A scheduled task was created. 16 rules
- Hidden Scheduled Task Created - Windows (Windows Event Log)
- Impacket atexec.py Scheduled Task Creation (Windows Event Log)
- Randomly Generated Scheduled Task Name experimental
- Rare Schedule Task Created (Windows Event Log)
- Rare Scheduled Task (Windows Event Log)
- Schedule Task with HTTP Command Arguments production
- Schedule Task with Rundll32 Command Trigger production
- Scheduled Task with Potential SSH Tunnel - Windows (Windows Event Log)
- Short Lived Scheduled Task production
- Windows Hidden Schedule Task Settings production
- Windows Level RMM Watchdog Task Created production
- Windows Scheduled Task with Suspicious Command production
- Windows Scheduled Task with Suspicious Name production
- Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr production
- WinEvent Scheduled Task Created to Spawn Shell production
- WinEvent Scheduled Task Created Within Public Path production
Event ID 4699: A scheduled task was deleted. 1 rule
- Short Lived Scheduled Task production
Event ID 4724: An attempt was made to reset an account's password. 4 rules
- PingID New MFA Method After Credential Reset production
- Windows Increase in User Modification Activity production
- Windows Multiple Account Passwords Changed production
- Windows Suspicious Burst of Password Changes production
Event ID 4725: A user account was disabled. 2 rules
- Windows Increase in User Modification Activity production
- Windows Multiple Accounts Disabled production
Event ID 4726: A user account was deleted. 3 rules
- Short Lived Windows Accounts production
- Windows Increase in User Modification Activity production
- Windows Multiple Accounts Deleted production
Event ID 4738: A user account was changed. 6 rules
- Kerberos Pre-Authentication Flag Disabled in UserAccountControl production
- Rubeus Password Change (Windows Event Log)
- Windows AD Cross Domain SID History Addition production
- Windows AD Privileged Account SID History Addition production
- Windows AD Same Domain SID History Addition production
- Windows Increase in User Modification Activity production
Event ID 4741: A computer account was created. 2 rules
- Windows Computer Account Created by Computer Account production
- Windows Computer Account With SPN production
Event ID 4742: A computer account was changed. 7 rules
- Detect Computer Changed with Anonymous Account production
- Windows AD Cross Domain SID History Addition production
- Windows AD Domain Controller Promotion production
- Windows AD Privileged Account SID History Addition production
- Windows AD Same Domain SID History Addition production
- Windows Computer Account Changed to Domain Controller production
- ZeroLogon CVE-2020-1472 (Windows Event Log)
Event ID 4744: A security-disabled local group was created. 1 rule
- Windows Privileged Group Modification production
Event ID 4749: A security-disabled global group was created. 1 rule
- Windows Privileged Group Modification production
Event ID 4754: A security-enabled universal group was created. 1 rule
- Windows Privileged Group Modification production
Event ID 4756: A member was added to a security-enabled universal group. 1 rule
- Windows Privileged Group Modification production
Event ID 4759: A security-disabled universal group was created. 1 rule
- Windows Privileged Group Modification production
Event ID 4768: A Kerberos authentication ticket (TGT) was requested. 12 rules
- Kerberos TGT Request Using RC4 Encryption production
- Kerberos User Enumeration production
- Kerberos Weak Encryption Methods (Windows Event Log)
- PetitPotam Suspicious Kerberos TGT Request production
- Suspicious Certificate Authentication (Windows Event Log)
- Suspicious Ticket Granting Ticket Request production
- Windows Computer Account Requesting Kerberos Ticket production
- Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos production
- Windows Multiple Invalid Users Fail To Authenticate Using Kerberos production
- Windows Steal Authentication Certificates - ESC1 Authentication production
- Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos production
- Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos production
Event ID 4769: A Kerberos service ticket was requested. 7 rules
- Kerberoasting spn request with RC4 encryption production
- Kerberos Service Ticket Request Using RC4 Encryption production
- Kerberos Weak Encryption Methods (Windows Event Log)
- Suspicious Kerberos Service Ticket Request production
- Unusual Number of Computer Service Tickets Requested experimental
- Unusual Number of Kerberos Service Tickets Requested production
- Windows Large Number of Computer Service Tickets Requested production
Event ID 4776: The domain controller attempted to validate the credentials for an account. 5 rules
- Potential EternalBlue via Metasploit (Windows Event Log)
- Windows Multiple Invalid Users Failed To Authenticate Using NTLM production
- Windows Multiple Users Failed To Authenticate From Host Using NTLM production
- Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM production
- Windows Unusual Count Of Users Failed To Authenticate Using NTLM production
Event ID 4781: The name of an account was changed. 2 rules
- Suspicious Computer Account Name Change production
- Suspicious Ticket Granting Ticket Request production
Event ID 4783: A basic application group was created. 1 rule
- Windows Privileged Group Modification production
Event ID 4790: An LDAP query group was created. 1 rule
- Windows Privileged Group Modification production
Event ID 4794: An attempt was made to set the Directory Services Restore Mode administrator password. 1 rule
- Windows AD DSRM Password Reset production
Event ID 4798: A user's local group membership was enumerated. 1 rule
- Enumerate Users Local Group Using Telegram production
Event ID 4887: Certificate Services approved a certificate request and issued a certificate. 4 rules
Event ID 4946: A change has been made to Windows Firewall exception list. A rule was added. 1 rule
- Windows Firewall Rule Added production
Event ID 4947: A change has been made to Windows Firewall exception list. A rule was modified. 1 rule
- Windows Firewall Rule Modification production
Event ID 4948: A change has been made to Windows Firewall exception list. A rule was deleted. 1 rule
- Windows Firewall Rule Deletion production
Event ID 5136: A directory service object was modified. 24 rules
- Modify Group Policy (Windows Event Log)
- Windows AD AdminSDHolder ACL Modified production
- Windows AD Dangerous Deny ACL Modification production
- Windows AD Dangerous Group ACL Modification production
- Windows AD Dangerous User ACL Modification production
- Windows AD DCShadow Privileges ACL Addition production
- Windows AD Domain Replication ACL Addition production
- Windows AD Domain Root ACL Deletion production
- Windows AD Domain Root ACL Modification production
- Windows AD GPO Deleted production
- Windows AD GPO Disabled production
- Windows AD GPO New CSE Addition production
- Windows AD Hidden OU Creation production
- Windows AD Object Owner Updated production
- Windows AD Self DACL Assignment production
- Windows AD ServicePrincipalName Added To Domain Account production
- Windows AD Short Lived Domain Account ServicePrincipalName production
- Windows AD Short Lived Domain Controller SPN Attribute production
- Windows AD SID History Attribute Modified production
- Windows AD Suspicious Attribute Modification production
- Windows Default Group Policy Object Modified production
- Windows Group Policy Object Created production
- Windows Kerberos Coercion via DNS production
- Windows Short Lived DNS Record production
Event ID 5137: A directory service object was created. 5 rules
- Modify Group Policy (Windows Event Log)
- Windows AD Short Lived Server Object production
- Windows Group Policy Object Created production
- Windows Kerberos Coercion via DNS production
- Windows Short Lived DNS Record production
Event ID 5140: A network share object was accessed. 8 rules
- Meterpreter Reverse Shell (Windows Event Log)
- Network Share Discovery Via Dir Command production
- Potential SMB Activity from External IP - Windows (Windows Event Log)
- SMB Write Access on Administrative Share (Windows Event Log)
- Windows Admin$ Share Access (Windows Event Log)
- Windows Administrative Shares Accessed On Multiple Hosts production
- Windows C$ Share Access (Windows Event Log)
- Windows IPC$ Share Access (Windows Event Log)
Event ID 5145: A network share object was checked to see whether client can be granted desired access. 16 rules
- Certificate Enumeration - Windows (Windows Event Log)
- Command Output Redirected to Localhost (Windows Event Log)
- Executable File Written in Administrative SMB Share production
- High Frequency Copy Of Files In Network Share production
- Impacket PSexec (Windows Event Log)
- PetitPotam Network Share Access Request production
- Potential SMB Activity from External IP - Windows (Windows Event Log)
- SecretsDump Credential Harvest (Windows Event Log)
- SMB Write Access on Administrative Share (Windows Event Log)
- Suspicious Spool Authentication (Windows Event Log)
- Windows Admin$ Share Access (Windows Event Log)
- Windows Administrative Shares Accessed On Multiple Hosts production
- Windows C$ Share Access (Windows Event Log)
- Windows IPC$ Share Access (Windows Event Log)
- Windows Scheduled Task Created in a Group Policy Object production
- Windows Share Multiple File Access (Windows Event Log)
Event ID 5156: The Windows Filtering Platform has permitted a connection. 15 rules
- Command and Control Detection (Windows Event Log)
- Internal Port Scan - Critical Ports (Windows Event Log)
- List Open Egress Ports (Windows Event Log)
- Meterpreter Reverse Shell (Windows Event Log)
- Network Connection with Suspicious Folder (Windows Event Log)
- Potential CVE-2024-21413: Outbound SMB from Outlook (Windows Event Log)
- Potential Lateral Movement via SMB (Windows Event Log)
- Potential network connection with CVE-2023-21554 (Windows Event Log)
- Process Connection to Mega - Windows (Windows Event Log)
- PuTTY Secure Copy Client Execution (Windows Event Log)
- RDP Brute-force Detection (Windows Event Log)
- RDP Connection (Windows Event Log)
- Script Connected to External Destination - Windows (Windows Event Log)
- Unexpected Network Connection from System Process (Windows Event Log)
- wuauclt.exe Network Connection (Windows Event Log)
Microsoft-Windows-Sysmon
Event ID 1: Process creation 810 rules
- .msc Executed from Unusual Location (Sysmon)
- 3CXDesktopApp.exe Execution (Sysmon)
- 7zip CommandLine To SMB Share Path production
- Abuse EQNEDT32.EXE (Sysmon)
- Access Common Package Config file (Sysmon)
- Account set to active via Net.exe (Sysmon)
- Add or Set Windows Defender Exclusion production
- ADExplorer Execution (Sysmon)
- ADExplorer Snapshot Creation (Sysmon)
- Adfind Commands (Sysmon)
- Adfind Execution (Sysmon)
- Advanced IP or Port Scanner Execution production
- Advanced IP Scanner Execution (Sysmon)
- Advanced Port Scanner Execution (Sysmon)
- Allow File And Printing Sharing In Firewall production
- Allow Network Discovery In Firewall production
- Anomalous usage of 7zip production
- AnyDesk Command Line Execution (Sysmon)
- AnyDesk Execution from Suspicious Folder (Sysmon)
- AnyDesk Silent Install (Sysmon)
- Application Discovery - Windows (Sysmon)
- ATBroker.exe Execution (Sysmon)
- Attacker Tools On Endpoint production
- Attempted Veeam Database Credential Dump (Sysmon)
- Attrib.exe Metasploit File Dropper (Sysmon)
- AutoHotkey Execution (Sysmon)
- AutoIt Execution (Sysmon)
- Bash -c Execution - Windows (Sysmon)
- Bcdedit Command Back To Normal Mode Boot production
- BCDEdit Failure Recovery Modification production
- BITS Job Persistence production
- BITSAdmin Download File production
- BITSadmin Execution (Sysmon)
- BitsAdmin NetCat PowerCat File Transfer (Sysmon)
- Browser Started with Remote Debugging - Windows (Sysmon)
- CDB Execution (Sysmon)
- Certificate Abuse - Windows (Sysmon)
- Certificate Enumeration - Windows (Sysmon)
- Certutil De-Obfuscate_Decode Files (Sysmon)
- Certutil exe certificate extraction production
- Certutil Execution (Sysmon)
- Certutil File Download (Sysmon)
- Certutil Obfuscate_Encode Files (Sysmon)
- CertUtil With Decode Argument production
- Change To Safe Mode With Network Config production
- Check Elevated CMD using whoami production
- Child Processes of Spoolsv exe experimental
- Cipher.exe Execution (Sysmon)
- Clear Unallocated Sector Using Cipher App production
- Clop Common Exec Parameter production
- CMD Carry Out String Command Parameter production
- CMD Echo Pipe - Escalation production
- CMD execution with _c (Sysmon)
- Cmstp Execution (Sysmon)
- Command Line .cmd Execution (Sysmon)
- Command Line Homoglyphs - Windows (Sysmon)
- Command Line lsass request (Sysmon)
- Command Line Spawned by Archive Utility - Windows (Sysmon)
- Command Line Utility Added to Accessibility Features (Sysmon)
- Command-Line Interface Execution (Sysmon)
- Common Active Directory Commands (Sysmon)
- Common Recon Commands in Short Burst (Sysmon)
- Common Reconnaissance Commands (Sysmon)
- ComputerDefaults UAC Bypass (Sysmon)
- comsvcs.dll Lsass Memory Dump (Sysmon)
- Conhost.exe Kernel call (Sysmon)
- Consent.exe Suspicious Child Process (Sysmon)
- ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon)
- Conti Common Exec parameter production
- Control Loading from World Writable Directory production
- Control Panel Abuse (Sysmon)
- Control_RunDLL Call from Command Line (Sysmon)
- Create or delete windows shares using net exe production
- Create_Add Local_Domain User (Sysmon)
- Create_Modify Schtasks (Sysmon)
- Creation of Shadow Copy production
- Creation of Shadow Copy with wmic and powershell production
- Credential Dumping via Copy Command from Shadow Copy production
- Credential Dumping via Symlink to Shadow Copy production
- CSC Net On The Fly Compilation production
- CSVDE Export Active Directory (Sysmon)
- Curl Execution with Percent Encoded URL production
- CVE-2022-30190: Microsoft Office Code Execution Vulnerability (Sysmon)
- Data Exfiltration via AWS CLI - Windows (Sysmon)
- Data Staged to File (Sysmon)
- Defender Registry Values Modified (Sysmon)
- Deleting Shadow Copies production
- Detect AzureHound Command-Line Arguments production
- Detect Certify Command Line Arguments production
- Detect HTML Help Renamed production
- Detect HTML Help Spawn Child Process production
- Detect HTML Help URL in Command Line production
- Detect HTML Help Using InfoTech Storage Handlers production
- Detect mshta inline hta execution production
- Detect mshta renamed production
- Detect MSHTA Url in Command Line production
- Detect Outlook exe writing a zip file production
- Detect Path Interception By Creation Of program exe production
- Detect Prohibited Applications Spawning cmd exe production
- Detect PsExec With accepteula Flag production
- Detect Rare Executables production
- Detect RClone Command-Line Usage production
- Detect Regasm Spawning a Process production
- Detect Regasm with no Command Line Arguments production
- Detect Regsvcs Spawning a Process production
- Detect Regsvcs with No Command Line Arguments production
- Detect Regsvr32 Application Control Bypass production
- Detect Remote Access Software Usage FileInfo production
- Detect Remote Access Software Usage Process production
- Detect Renamed 7-Zip production
- Detect Renamed PSExec production
- Detect Renamed RClone production
- Detect Renamed WinRAR production
- Detect RTLO In Process production
- Detect Rundll32 Inline HTA Execution production
- Detect SharpHound Command-Line Arguments production
- Detect SharpHound Usage production
- Detect Use of cmd exe to Launch Script Interpreters production
- Detection of tools built by NirSoft experimental
- Disable Logs Using WevtUtil production
- Disable Schedule Task production
- Disabling Firewall with Netsh production
- Discovery using CHCP (Sysmon)
- DLL Called with RS32 (Sysmon)
- DLL Called with Uncommon Function (Sysmon)
- DLL Concatenation (Sysmon)
- DLL Execution from Uncommon Process (Sysmon)
- DLLHost with no Command Line Arguments with Network production
- DLLRegisterServer Called from Command Line (Sysmon)
- DNS Exfiltration Using Nslookup App production
- Domain Account Discovery with Dsquery production
- Domain Account Discovery with Wmic production
- Domain Controller Discovery with Nltest production
- Domain Controller Discovery with Wmic production
- Domain Controller Enumeration via nltest (Sysmon)
- Domain Group Discovery With Dsquery production
- Domain Group Discovery With Wmic production
- Domain Trust Discovery Commands - Windows (Sysmon)
- DSQuery Domain Discovery production
- Dump File Identified (Sysmon)
- Dump LSASS via comsvcs DLL production
- Dump LSASS via procdump production
- Elevated Group Discovery With Wmic production
- EnableLUA Registry Value Modified (Sysmon)
- Encoded Powershell Command (Sysmon)
- Esentutl Execution (Sysmon)
- Esentutl SAM Copy production
- Esentutl.exe Collecting Browser Data (Sysmon)
- Event Logs Queried for RDP Sessions (Sysmon)
- Excessive Attempt To Disable Services production
- Excessive distinct processes from Windows Temp production
- Excessive number of service control start as disabled production
- Excessive number of taskhost processes production
- Excessive Usage Of Cacls App production
- Excessive Usage of NSLOOKUP App production
- Excessive Usage Of SC Service Utility production
- Excessive Usage Of Taskkill production
- Executable Create Script Process (Sysmon)
- Executable Process from Suspicious Folder (Sysmon)
- Execute Javascript With Jscript COM CLSID production
- Execution from Startup Folder (Sysmon)
- Execution of File with Multiple Extensions production
- Exfiltration via curl.exe - Windows (Sysmon)
- Expand.exe Execution (Sysmon)
- Explorer Child Process with Suspicious Command Line Padding (Sysmon)
- File and Directory Discovery Output to File - Windows (Sysmon)
- File Download or Read to Pipe Execution production
- File Executed from INetCache (Sysmon)
- File_Folder Hidden - Windows (Sysmon)
- Finger Execution (Sysmon)
- Firewall Allowed Program Enable production
- First Time Seen Child Process of Zoom experimental
- FodHelper UAC Bypass production
- FScan.exe Network Scan (Sysmon)
- Fsutil Zeroing File production
- Full Control Permissions Granted to Everyone - Windows (Sysmon)
- Get ADDefaultDomainPasswordPolicy with Powershell production
- Get ADUser with PowerShell production
- Get ADUserResultantPasswordPolicy with Powershell production
- Get DomainPolicy with Powershell production
- Get DomainUser with PowerShell production
- Get WMIObject Group Discovery production
- Get-DomainTrust with PowerShell production
- Get-ForestTrust with PowerShell production
- GetAdComputer with PowerShell production
- GetAdGroup with PowerShell production
- GetCurrent User with PowerShell production
- GetDomainComputer with PowerShell production
- GetDomainController with PowerShell production
- GetDomainGroup with PowerShell production
- GetLocalUser with PowerShell production
- GetNetTcpconnection with PowerShell production
- GetWmiObject Ds Computer with PowerShell production
- GetWmiObject Ds Group with PowerShell production
- GetWmiObject DS User with PowerShell production
- GetWmiObject User Account with PowerShell production
- Git Hooks Spawn System32 Process (Sysmon)
- Git Spawns System32 Process (Sysmon)
- Git Submodule Cloned - Windows (Sysmon)
- Go Run Execution (Sysmon)
- GPUpdate with no Command Line Arguments with Network production
- Group Policy Editor Execution (Sysmon)
- Headless Browser Mockbin or Mocky Request production
- Headless Browser Usage production
- hh.exe Execution (Sysmon)
- hh.exe Remote File Execution (Sysmon)
- Hidden User Created - Windows (Sysmon)
- Hiding Files And Directories With Attrib exe production
- Hunting 3CXDesktopApp Software production
- Icacls Deny Command production
- ICACLS Grant Command production
- IcedID Discovery Commands (Sysmon)
- Impacket atexec.py Execution (Sysmon)
- Impacket Lateral Movement Activity (Sysmon)
- Impacket Lateral Movement Commandline Parameters production
- Impacket Lateral Movement smbexec CommandLine Parameters production
- Impacket Lateral Movement WMIExec Commandline Parameters production
- Indirect Command Execution (Sysmon)
- Invoke-DCOM.ps1 - PowerShell (Sysmon)
- Invoke-Expression Command (Sysmon)
- Invoke-WebRequest Command (Sysmon)
- Jscript Execution Using Cscript App production
- Known Process Injection Commands (Sysmon)
- Live Sysinternals Execution (Sysmon)
- Local Account Discovery With Wmic production
- LocalAccountTokenFilterPolicy Registry Value Modified (Sysmon)
- Locate Credentials (Sysmon)
- Logon Script Registry Key added (Sysmon)
- MacOS - Re-opened Applications experimental
- Malicious Document Execution (Sysmon)
- Malicious PowerShell Process - Encoded Command production
- Malicious PowerShell Process - Execution Policy Bypass production
- Malicious PowerShell Process With Obfuscation Techniques production
- masscan Execution - Windows (Sysmon)
- Mavinject Execution (Sysmon)
- Mega Utility Execution - Windows (Sysmon)
- Microsoft Build Engine Suspicious Parent Process (Sysmon)
- Microsoft Diagnostic Tool "DogWalk" Package Path Traversal (Sysmon)
- Microsoft SQL Server Suspicious Child Process - Windows (Sysmon)
- Mimikatz (Sysmon)
- Mimikatz PassTheTicket CommandLine Parameters production
- Mmc LOLBAS Execution Process Spawn production
- Mock System Directory - Windows (Sysmon)
- Modify ACL permission To Files Or Folder production
- Modify Windows Defender (Sysmon)
- MS Exchange Mailbox Replication service writing Active Server Pages experimental
- MSBuild Suspicious Spawned By Script Process production
- Mshta spawning Rundll32 OR Regsvr32 Process production
- MSHTA.exe execution (Sysmon)
- mshta.exe File Download (Sysmon)
- MSI Installation via Appcert (Sysmon)
- Msiexec Abuse (Sysmon)
- MSIExec Install MSI File (Sysmon)
- MSIExec.exe Execution (Sysmon)
- Msxsl Execution (Sysmon)
- MultiDump.exe Execution (Sysmon)
- Multiple nslookup commands (Sysmon)
- Native Archive Commands (Sysmon)
- Net.exe Use with URL (Sysmon)
- Network Connection Discovery With Arp production
- Network Connection Discovery With Netstat production
- Network Discovery Using Route Windows App production
- New AutoRun Registry Key (Sysmon)
- ngen.exe File Download (Sysmon)
- ngrok Execution - Windows (Sysmon)
- NirCmd Execution (Sysmon)
- Nishang PowershellTCPOneLine production
- NLTest Domain Trust Discovery production
- Notepad with no Command Line Arguments production
- ntds.dit Access from Unexpected Location (Sysmon)
- ntds.dit Command Line (Sysmon)
- Ntdsutil Export NTDS production
- NTDSUtil.exe execution (Sysmon)
- Office Spawns Suspicious Child Process (Sysmon)
- Outbound Network Connection from Java Using Default Ports production
- Package installation (Sysmon)
- Parent in Public Folder Suspicious Process (Sysmon)
- Permission Groups Discovery: Domain Groups (Sysmon)
- Permission Groups Discovery: Local Groups (Sysmon)
- Permission Modification using Takeown App production
- Permissions Replaced by icacls - Windows (Sysmon)
- Ping Sleep Batch Command production
- Possible Browser Pass View Parameter production
- Possible Credential Dumping via Windows Network Providers (Sysmon)
- Possible Lateral Movement PowerShell Spawn production
- Potential AutoHotkey .ahk Execution (Sysmon)
- Potential Cryptomining Commands (Sysmon)
- Potential CVE-2023-23397 (Sysmon)
- Potential Executable Masquerading as Document - Windows (Sysmon)
- Potential fodhelper UAC Bypass Attempt (Sysmon)
- Potential PowerShell Post-Exploitation Activity (Sysmon)
- Potential Proxy Malware via AutoRun Key (Sysmon)
- Potential Sysinternals Tool Execution (Sysmon)
- Potential System Network Configuration Discovery Activity production
- Potential Telegram API Request Via CommandLine production
- PowerHuntShares Commands (Sysmon)
- PowerShell CreateDecryptor (Sysmon)
- Powershell Defender Threat Actions Set to Allow production
- Powershell Disable Security Monitoring production
- PowerShell DownloadFile_DownloadString (Sysmon)
- PowerShell Get LocalGroup Discovery production
- PowerShell Modifying Registry Values (Sysmon)
- PowerShell Start-BitsTransfer production
- PowerShell XML Retrieval (Sysmon)
- Prevent Automatic Repair Mode using Bcdedit production
- ProcDump Credential Harvest (Sysmon)
- Process Creation Using Sysnative Folder (Sysmon)
- Process Deleting Its Process File Path production
- Process Executed from Downloads Folder - Windows (Sysmon)
- Process Executed with Null Command Line (Sysmon)
- Process Execution From Suspicious Folder (Sysmon)
- Process Execution via WMI production
- Process Kill Base On File Path production
- PromptOnSecureDesktop Registry Value Modified (Sysmon)
- ProtocolHandler.exe File Download (Sysmon)
- Proxy Execution via Appcert (Sysmon)
- PuTTY Secure Copy Client Execution (Sysmon)
- QEMU Network Tunneling - Windows (Sysmon)
- Radmin execution (Sysmon)
- Rare executable from Microsoft Office (Sysmon)
- Rare Process Execution (Sysmon)
- Rclone Execution (Sysmon)
- RDP Enabled (Sysmon)
- RDP File Executed from Outlook Temp Directory (Sysmon)
- RdrLeakDiag.exe Memory Dump (Sysmon)
- Read-Only Attribute Removed - Windows (Sysmon)
- Recursive Delete of Directory In Batch CMD production
- Reg exe Manipulating Windows Services Registry Keys production
- Reg.exe Process Execution (Sysmon)
- Regini.exe Execution (Sysmon)
- Registry key added with reg.exe (Sysmon)
- regsvr32 Execution (Sysmon)
- regsvr32 Referencing Unusual Paths (Sysmon)
- Regsvr32 Silent and Install Param Dll Loading production
- Remote .msi Installation (Sysmon)
- Remote .msi Installation (Sysmon)
- Remote Access Software Execution (Sysmon)
- Remote Admin Tools (Sysmon)
- Remote Desktop Process Running On System experimental
- Remote Process Instantiation via DCOM and PowerShell production
- Remote Process Instantiation via WinRM and PowerShell production
- Remote Process Instantiation via WinRM and Winrs production
- Remote Process Instantiation via WMI production
- Remote Process Instantiation via WMI and PowerShell production
- Remote Share Directory Listing - Windows (Sysmon)
- Remote System Discovery with Dsquery production
- Remote System Discovery with Wmic production
- Remote WMI Command Attempt production
- Remote WMIC Query (Sysmon)
- Renamed Process (Sysmon)
- Resize ShadowStorage volume production
- Revil Common Exec Parameter production
- Rubeus Command Line Parameters production
- Rubeus Commands (Sysmon)
- Runas Execution in CommandLine production
- RunDLL Loading DLL By Ordinal production
- Rundll32 Command Line (Sysmon)
- Rundll32 Control RunDLL Hunt production
- Rundll32 Control RunDLL World Writable Directory production
- Rundll32 LockWorkStation production
- Rundll32 Shimcache Flush production
- Rundll32 Spawned by Disk Cleanup (Sysmon)
- Rundll32 Suspicious Command Line (Sysmon)
- rundll32 Suspicious Parent Process (Sysmon)
- Rundll32 with no Command Line Arguments with Network production
- rundll32 with No DLL in Command Line (Sysmon)
- Rundll32.exe as Parent Process (Sysmon)
- rundll32.exe Executing DLL from Non-standard Directory (Sysmon)
- Ryuk Wake on LAN Command production
- Scheduled Task Creation on Remote Endpoint using At production
- Scheduled Task Deleted Or Created via CMD production
- Scheduled Task Initiation on Remote Endpoint production
- Scheduled Task with Potential SSH Tunnel - Windows (Sysmon)
- Schtasks Run Task On Demand production
- Schtasks scheduling job on remote system production
- Schtasks used for forcing a reboot production
- Script Execution via WMI production
- Sdelete Application Execution production
- SearchProtocolHost with no Command Line with Network production
- SecretDumps Offline NTDS Dumping Tool production
- Security Software Discovery via Findstr.exe (Sysmon)
- Security Software Discovery via WMI (Sysmon)
- Service Stop Commands (Sysmon)
- ServicePrincipalNames Discovery with SetSPN production
- Services Escalate Exe production
- Services LOLBAS Execution Process Spawn production
- Shim Database Installation With Suspicious Parameters production
- SimpleHelp Remote Access Tool Execution (Sysmon)
- Single Letter Process On Endpoint production
- Sliver C2 Implant Activity Pattern (Sysmon)
- SLUI RunAs Elevated production
- SLUI Spawning a Process production
- SoftPerfect Network Scanner Execution (Sysmon)
- Spoolsv Spawning Rundll32 production
- Spoolsv Writing a DLL production
- ssh.exe Execution (Sysmon)
- Suspicious AteraAgent Installation - Windows (Sysmon)
- Suspicious Child Process for hh.exe (Sysmon)
- Suspicious Child Process for lsass.exe (Sysmon)
- Suspicious Child Process for mshta.exe (Sysmon)
- Suspicious ComputerDefaults.exe Execution (Sysmon)
- Suspicious Confluence Child Process - Windows (Sysmon)
- Suspicious Conhost.exe Commands (Sysmon)
- Suspicious Copy on System32 production
- Suspicious csc.exe Source File Folder (Sysmon)
- Suspicious Curl Network Connection experimental
- Suspicious DLLHost no Command Line Arguments production
- Suspicious Executable by CMD.exe (Sysmon)
- Suspicious Executable by Powershell (Sysmon)
- Suspicious Execution of Accessibility Tool Debuggers (Sysmon)
- Suspicious Execution via Microsoft Common Console (Sysmon)
- Suspicious GPUpdate no Command Line Arguments production
- Suspicious IcedID Rundll32 Cmdline production
- Suspicious Image Creation In Appdata Folder production
- Suspicious InprocServer32 Registry Modification (Sysmon)
- Suspicious microsoft workflow compiler rename production
- Suspicious microsoft workflow compiler usage production
- Suspicious msbuild path production
- Suspicious MSBuild Rename production
- Suspicious MSBuild Spawn production
- Suspicious mshta child process production
- Suspicious mshta spawn production
- Suspicious ntds.dit Commands (Sysmon)
- Suspicious Parent Process for lsass.exe or services.exe (Sysmon)
- Suspicious Parent Process for msiexec.exe (Sysmon)
- Suspicious Parent Process for spoolsv.exe (Sysmon)
- Suspicious PlistBuddy Usage experimental
- Suspicious PowerShell Clipboard Activity (Sysmon)
- Suspicious PowerShell Parameter Substring (Sysmon)
- Suspicious Process Executed From Container File production
- Suspicious reCAPTCHA Command Line (Sysmon)
- Suspicious Reg exe Process production
- Suspicious Regsvr32 Register Suspicious Path production
- Suspicious Rundll32 dllregisterserver production
- Suspicious Rundll32 no Command Line Arguments production
- Suspicious Rundll32 PluginInit production
- Suspicious Rundll32 StartW production
- Suspicious Scheduled Task from Public Directory production
- Suspicious SearchProtocolHost no Command Line Arguments production
- Suspicious SQLite3 LSQuarantine Behavior experimental
- Suspicious WAV file in Appdata Folder production
- Suspicious wevtutil Usage production
- Suspicious writes to windows Recycle Bin production
- Svchost LOLBAS Execution Process Spawn production
- System Enumeration with WMIC (Sysmon)
- System Info Gathering Using Dxdiag Application production
- System Information Discovery - Windows (Sysmon)
- System Information Discovery Detection production
- System Network Connections Discovery - Windows (Sysmon)
- System Owner_User Discovery - Windows (Sysmon)
- System Processes Run From Unexpected Locations production
- System User Discovery With Query production
- System User Discovery With Whoami production
- Temporary File Executed from Public Folder (Sysmon)
- Tunneling Process Created (Sysmon)
- Uninstall App Using MsiExec production
- Unknown Process Using The Kerberos Protocol production
- Unload Sysmon Filter Driver production
- Unusual AppCert Child Process (Sysmon)
- Unusual svchost Child Process (Sysmon)
- Unusual winlogon.exe Child Process (Sysmon)
- Unusually Long Command Line experimental
- User Discovery With Env Vars PowerShell production
- User_Domain Enumeration Tool - Windows (Sysmon)
- USN Journal Deletion production
- Vbscript Execution Using Wscript App production
- Verclsid CLSID Execution production
- Visio.exe File Download (Sysmon)
- Visual Studio Code Tunnel Execution (Sysmon)
- WBAdmin Delete System Backups production
- WDigest Forced Credential Caching (Sysmon)
- Web or Application Server Spawning a Shell production
- Web Servers Executing Suspicious Processes experimental
- WebDAV LNK Execution (Sysmon)
- WebLogic CVE-2017-10271 (Sysmon)
- Wermgr Process Spawned CMD Or Powershell Process production
- Windows Account Access Removal via Logoff Exec production
- Windows AdFind Exe production
- Windows Admin$ Share Access (Sysmon)
- Windows Advanced Installer MSIX with AI_STUBS Execution production
- Windows Alternate DataStream - Process Execution production
- Windows Apache Benchmark Binary production
- Windows AppCertDLL Modification Via Command Line production
- Windows Application Whitelisting Bypass Attempt via Rundll32 production
- Windows Archive Collected Data via Rar production
- Windows Attempt To Stop Security Service production
- Windows Audit Policy Auditing Option Disabled via Auditpol production
- Windows Audit Policy Cleared via Auditpol production
- Windows Audit Policy Disabled via Auditpol production
- Windows Audit Policy Disabled via Legacy Auditpol production
- Windows Audit Policy Excluded Category via Auditpol production
- Windows Audit Policy Restored via Auditpol production
- Windows Audit Policy Security Descriptor Tampering via Auditpol production
- Windows AutoIt3 Execution production
- Windows Azure Storage Utility Execution Via CLI production
- Windows Binary Execution from an Archive experimental
- Windows Binary Proxy Execution Mavinject DLL Injection production
- Windows BitLocker Suspicious Command Usage production
- Windows BitLockerToGo Process Execution production
- Windows Browser Process Launched with Unusual Flags production
- Windows Bypass UAC via Pkgmgr Tool production
- Windows C$ Share Access (Sysmon)
- Windows Cabinet File Extraction Via Expand production
- Windows Cached Domain Credentials Reg Query production
- Windows Certutil Root Certificate Addition production
- Windows Change File Association Command To Notepad production
- Windows Chrome Enable Extension Loading via Command-Line production
- Windows Chromium Browser Launched with Small Window Size production
- Windows Chromium Browser No Security Sandbox Process production
- Windows Chromium Browser with Custom User Data Directory production
- Windows Chromium process Launched with Disable Popup Blocking production
- Windows Chromium Process Launched with Logging Disabled production
- Windows Chromium Process Loaded Extension via Command-Line production
- Windows Chromium Process with Disabled Extensions production
- Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc production
- Windows Cisco Secure Endpoint Unblock File Via Sfc production
- Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc production
- Windows Cmdline Tool Execution From Non-Shell Process production
- Windows COM Hijacking InprocServer32 Modification production
- Windows Command and Scripting Interpreter Hunting Path Traversal production
- Windows Command and Scripting Interpreter Path Traversal Exec production
- Windows Command Obfuscation with Environment Variable Substrings production
- Windows Command Shell DCRat ForkBomb Payload production
- Windows Compatibility Telemetry Suspicious Child Process production
- Windows ComputerDefaults Spawning a Process production
- Windows ConHost with Headless Argument production
- Windows Copy Files (Sysmon)
- Windows Create Local Administrator Account Via Net production
- Windows Credential Dumping LSASS Memory Createdump production
- Windows Credential Target Information Structure in Commandline production
- Windows Credentials from Password Stores Creation production
- Windows Credentials from Password Stores Deletion production
- Windows Credentials from Password Stores Query production
- Windows Credentials in Registry Reg Query production
- Windows Crowdstrike RTR Script Execution production
- Windows Curl Download to Suspicious Path production
- Windows Curl Upload to Remote Destination production
- Windows Debugger Tool Execution production
- Windows Defacement Modify Transcodedwallpaper File production
- Windows Default Group Policy Object Modified with GPME production
- Windows Default RDP File Creation By Non MSTSC Process production
- Windows Default Rdp File Unhidden production
- Windows Defender ASR or Threat Configuration Tamper production
- Windows Delete or Modify System Firewall production
- Windows Deleted Registry By A Non Critical Process File Path production
- Windows Devtunnels Execution production
- Windows Dir Piped to Findstr Activity production
- Windows Disable Internet Explorer Addons production
- Windows Disable or Modify Tools Via Taskkill production
- Windows Disable or Stop Browser Process production
- Windows Disable Windows Event Logging Disable HTTP Logging production
- Windows DiskCryptor Usage production
- Windows Diskshadow Proxy Execution production
- Windows DISM Install PowerShell Web Access production
- Windows DISM Remove Defender production
- Windows DLL Search Order Hijacking with iscsicpl production
- Windows DLL Side-Loading Process Child Of Calc production
- Windows DNS Gather Network Info production
- Windows DotNet Binary in Non Standard Path production
- Windows EDRSilencer Execution production
- Windows EFI Volume Mount Attempt Via Mountvol production
- Windows Entra User Management Via Azure CLI production
- Windows ESX Admins Group Creation via Net production
- Windows Eventlog Cleared Via Wevtutil production
- Windows EventLog Recon Activity Using Log Query Utilities production
- Windows Excel Spawning Microsoft Project Application production
- Windows Excessive Service Stop Attempt production
- Windows Excessive Usage Of Net App production
- Windows Execute Arbitrary Commands with MSDT production
- Windows Execution of Microsoft MSC File In Suspicious Path production
- Windows Explorer LNK Exploit Process Launch With Padding production
- Windows Explorer.exe Spawning PowerShell or Cmd production
- Windows FFmpeg Audio and Video Device Discovery production
- Windows FFmpeg DirectShow Video Capture production
- Windows File and Directory Enable ReadOnly Permissions production
- Windows File and Directory Permissions Enable Inheritance production
- Windows File and Directory Permissions Remove Inheritance production
- Windows File Association Modification via Ftype production
- Windows File Collection Via Copy Utilities production
- Windows File Download Via CertUtil production
- Windows File Download Via PowerShell production
- Windows Files and Dirs Access Rights Modification Via Icacls production
- Windows Findstr GPP Discovery production
- Windows Firewall Disabled (Sysmon)
- Windows Firewall Rule Creation (Sysmon)
- Windows FTP Exfiltration (Sysmon)
- Windows Gdrive Binary Activity production
- Windows Get-Variable.EXE Execution from WindowsApps Folder production
- Windows Global Object Access Audit List Cleared Via Auditpol production
- Windows Group Discovery Via Net production
- Windows Guest Account Enabled Via Net.EXE production
- Windows HTTP Network Communication From MSIExec production
- Windows Identify Protocol Handlers production
- Windows IIS Components Add New Module production
- Windows Impair Defense Add Xml Applocker Rules production
- Windows Indicator Removal Via Rmdir production
- Windows Indirect Command Execution Via forfiles production
- Windows Indirect Command Execution Via pcalua production
- Windows Indirect Command Execution Via Series Of Forfiles production
- Windows Information Discovery Fsutil production
- Windows Ingress Tool Transfer Using Explorer production
- Windows InstallUtil in Non Standard Path production
- Windows InstallUtil Remote Network Connection production
- Windows InstallUtil Uninstall Option production
- Windows InstallUtil URL in Command Line production
- Windows IOBit Unlocker Extension DLL Registration via Regsvr32 production
- Windows IPC$ Share Access (Sysmon)
- Windows Ldifde Directory Object Behavior production
- Windows List ENV Variables Via SET Command From Uncommon Parent production
- Windows Local LLM Framework Execution production
- Windows LOLBAS Executed As Renamed File production
- Windows LOLBAS Executed Outside Expected Path production
- Windows Masquerading Explorer As Child Process production
- Windows Masquerading Msdtc Process production
- Windows Metasploit Confluence Plugin Execution production
- Windows Mimikatz Binary Execution production
- Windows Modify Registry Qakbot Binary Data Registry production
- Windows Modify Registry Regedit Silent Reg Import production
- Windows Modify System Firewall with Notable Process Path production
- Windows MOF Event Triggered Execution via WMI production
- Windows MpCmdRun RemoveDefinitions Execution production
- Windows MSC EvilTwin Directory Path Manipulation production
- Windows MSIExec DLLRegisterServer production
- Windows MsiExec HideWindow Rundll32 Execution production
- Windows MSIExec Remote Download production
- Windows MSIExec Spawn Discovery Command production
- Windows MSIExec Spawn WinDBG production
- Windows MSIExec Unregister DLLRegisterServer production
- Windows MSTSC RDP Commandline production
- Windows Mustang Panda USB Tool Execution production
- Windows Net System Service Discovery production
- Windows Netspy Network Scanner Execution production
- Windows Network Connection Discovery Via Net production
- Windows Network Share Interaction Via Net production
- Windows Network Sniffing Tool Executed production
- Windows New Deny Permission Set On Service SD Via Sc.EXE production
- Windows New Service Security Descriptor Set Via Sc.EXE production
- Windows Ngrok Reverse Proxy Usage production
- Windows NirSoft AdvancedRun production
- Windows NirSoft Utilities production
- Windows NorthStar C2 Agent Execution production
- Windows Odbcconf Hunting production
- Windows Odbcconf Load DLL production
- Windows Odbcconf Load Response File production
- Windows Office Product Dropped Cab or Inf File production
- Windows Office Product Dropped Uncommon File production
- Windows Office Product Spawned Child Process For Download production
- Windows Office Product Spawned Control production
- Windows Office Product Spawned MSDT production
- Windows Office Product Spawned Rundll32 With No DLL production
- Windows Office Product Spawned Uncommon Process production
- Windows OneDrive Share Mounted via Net production
- Windows PaperCut NG Spawn Shell production
- Windows Parent PID Spoofing with Explorer production
- Windows Password Managers Discovery production
- Windows Password Policy Discovery with Net production
- Windows Phishing Outlook Drop Dll In FORM Dir production
- Windows Phishing PDF File Executes URL Link production
- Windows Potato Privilege Escalation Tool Execution production
- Windows Potential Cloudflared Tunnel Execution production
- Windows PowerShell FakeCAPTCHA Clipboard Execution production
- Windows PowerShell Process Implementing Manual Base64 Decoder production
- Windows PowerShell Process With Malicious String production
- Windows Powershell RemoteSigned File production
- Windows PowerShell Script From WindowsApps Directory production
- Windows PowGoop Beacon Decoding production
- Windows Private Keys Discovery production
- Windows Privilege Escalation Attempt Via MSI Rollback production
- Windows Privilege Escalation Suspicious Process Elevation production
- Windows Privilege Escalation System Process Without System Parent production
- Windows Privilege Escalation User Process Spawn System Process production
- Windows Process Commandline Discovery production
- Windows Process Copied from System Folder (Sysmon)
- Windows Process Executed From Removable Media production
- Windows Process Execution From ProgramData production
- Windows Process Execution From RDP Share production
- Windows Process Execution in Temp Dir production
- Windows Process Injection In Non-Service SearchIndexer production
- Windows Process Injection Wermgr Child Process production
- Windows Process Outside of System Folder (Sysmon)
- Windows Process With NamedPipe CommandLine production
- Windows Process With NetExec Command Line Parameters production
- Windows Protocol Tunneling with Plink production
- Windows Proxy Execution of .NET Utilities via Scripts production
- Windows Proxy Via Netsh production
- Windows PsTools Recon Usage production
- Windows PuTTY Suite Utility Execution production
- Windows Raccine Scheduled Task Deletion production
- Windows Rasautou DLL Execution production
- Windows RDP Client Launched with Admin Session production
- Windows RDP File Execution production
- Windows Registry Entries Exported Via Reg production
- Windows Registry Entries Restored Via Reg production
- Windows Regsvr32 Renamed Binary production
- Windows Remote Assistance Spawning Process production
- Windows Remote Create Service production
- Windows Remote Host Computer Management Access production
- Windows Remote Management Execute Shell production
- Windows Remote Service Rdpwinst Tool Execution production
- Windows Remote Services Allow Rdp In Firewall production
- Windows Renamed Powershell Execution production
- Windows RMM Tool Execution production
- Windows Rundll32 Apply User Settings Changes production
- Windows Rundll32 Execution With Log.DLL production
- Windows Rundll32 Load DLL in Temp Dir production
- Windows Rundll32 WebDAV Request production
- Windows Rundll32 WebDav With Network Connection production
- Windows Rundll32 with Non-Standard File Extension production
- Windows Scheduled Task Created Via XML production
- Windows Scheduled Task Service Spawned Shell production
- Windows Scheduled Task with Highest Privileges production
- Windows Schtasks Create Run As System production
- Windows ScManager Security Descriptor Tampering Via Sc.EXE production
- Windows Security Account Manager Stopped production
- Windows Security Support Provider Reg Query production
- Windows Sensitive Group Discovery With Net production
- Windows Sensitive Registry Hive Dump Via CommandLine production
- Windows Server Software Component GACUtil Install to GAC production
- Windows Service Create Kernel Mode Driver production
- Windows Service Create with Tscon production
- Windows Service Created (Sysmon)
- Windows Service Creation on Remote Endpoint production
- Windows Service Execution RemCom production
- Windows Service Initiation on Remote Endpoint production
- Windows Service Started (Sysmon)
- Windows Service Stop Attempt production
- Windows Service Stop By Deletion production
- Windows Set Account Password Policy To Unlimited Via Net production
- Windows Set Custom DNS ServerLevelPlugin Via Dnscmd production
- Windows Shell or Script Execution From IIS Directory production
- Windows Shell Process from CrushFTP production
- Windows SOAPHound Binary Execution production
- Windows SoftEther VPN Masquerading as Legitimate Binary production
- Windows Spearphishing Attachment Onenote Spawn Mshta production
- Windows SpeechRuntime Suspicious Child Process production
- Windows SQL Spawning CertUtil experimental
- Windows SQLCMD Execution production
- Windows Sqlservr Spawning Shell production
- Windows SSH Proxy Command production
- Windows Steal Authentication Certificates CertUtil Backup production
- Windows Steal Authentication Certificates Export Certificate production
- Windows Steal Authentication Certificates Export PfxCertificate production
- Windows Steal or Forge Kerberos Tickets Klist production
- Windows SubInAcl Execution production
- Windows Suspicious Child Process of Consent.EXE production
- Windows Suspicious Child Process of TieringEngineService.exe production
- Windows Suspicious Child Process Spawned From WebServer production
- Windows Suspicious Process File Path production
- Windows Suspicious QEMU Execution production
- Windows Suspicious React or Next.js Child Process production
- Windows Suspicious VMWare Tools Child Process production
- Windows Svchost.exe Parent Process Anomaly production
- Windows SymbolicLink-Testing-Tools Utility Execution production
- Windows Symlink Evaluation Change via Fsutil production
- Windows System Binary Proxy Execution Compiled HTML File Decompile production
- Windows System Discovery Using ldap Nslookup production
- Windows System Discovery Using Qwinsta production
- Windows System LogOff Commandline production
- Windows System Network Config Discovery Display DNS production
- Windows System Network Connections Discovery Netsh production
- Windows System Reboot CommandLine production
- Windows System Remote Discovery With Query production
- Windows System Script Proxy Execution Syncappvpublishingserver production
- Windows System Shutdown CommandLine production
- Windows System Time Discovery W32tm Delay production
- Windows System User Discovery Via Quser production
- Windows System User Privilege Discovery production
- Windows TeamCity Payload Execution from Temp Directory production
- Windows Time Based Evasion production
- Windows Time Based Evasion via Choice Exec production
- Windows TinyCC Shellcode Execution production
- Windows TOR Client Execution production
- Windows UAC Bypass Suspicious Child Process production
- Windows UAC Bypass Suspicious Escalation Behavior production
- Windows Unusual SysWOW64 Process Run System32 Executable production
- Windows User Deletion Via Net production
- Windows User Disabled Via Net production
- Windows User Discovery Via Net production
- Windows Vulnerable 3CX Software production
- Windows WBAdmin File Recovery From Backup production
- Windows WinDBG Spawning AutoIt3 production
- Windows WinLogon with Public Network Connection production
- Windows WinRAR Launched Outside Default Installation Directory production
- Windows WMI Process And Service List production
- Windows WMI Process Call Create production
- Windows WMI Reconnaissance Class Query production
- Windows Wmic CPU Discovery production
- Windows Wmic DiskDrive Discovery production
- Windows Wmic Memory Chip Discovery production
- Windows Wmic Network Discovery production
- Windows WMIC Shadowcopy Delete production
- Windows Wmic Systeminfo Discovery production
- Windows WSUS Spawning Shell production
- Winhlp32 Spawning a Process production
- WinRAR Spawning Shell Application production
- WinRM Spawning a Process experimental
- WinRM Tools (Sysmon)
- WMI subscription execution (Sysmon)
- WMIC Explicit Credentials (Sysmon)
- Wmic Group Discovery production
- WMIC Host Reconniassance (Sysmon)
- Wmic NonInteractive App Uninstallation production
- WMIC XSL Execution via URL production
- Wmiprvse LOLBAS Execution Process Spawn production
- WmiPrvSE Suspicious Child Process (Sysmon)
- Wow6432Node Classes Autorun Keys Modification (Sysmon)
- Wscript Or Cscript Suspicious Child Process production
- Wscript_Cscript Execution (Sysmon)
- Wsmprovhost LOLBAS Execution Process Spawn production
- XSL Script Execution With WMIC production
Event ID 3: Network connection 34 rules
- Command and Control Detection (Sysmon)
- Detect Regasm with Network Connection production
- Detect Regsvcs with Network Connection production
- DLLHost with no Command Line Arguments with Network production
- GPUpdate with no Command Line Arguments with Network production
- List Open Egress Ports (Sysmon)
- LOLBAS With Network Traffic production
- Network Connection with Suspicious Folder (Sysmon)
- Network Traffic to Active Directory Web Services Protocol production
- Outbound Network Connection from Java Using Default Ports production
- Potential CVE-2024-21413: Outbound SMB from Outlook (Sysmon)
- Potential Lateral Movement via SMB (Sysmon)
- Potential network connection with CVE-2023-21554 (Sysmon)
- Process Connection to Mega - Windows (Sysmon)
- PuTTY Secure Copy Client Execution (Sysmon)
- RDP Connection (Sysmon)
- Rundll32 with no Command Line Arguments with Network production
- Script Connected to External Destination - Windows (Sysmon)
- SearchProtocolHost with no Command Line with Network production
- Unexpected Network Connection from System Process (Sysmon)
- Unknown Process Using The Kerberos Protocol production
- Unusual HTTP Download (Sysmon)
- Windows Detect Network Scanner Behavior production
- Windows File Transfer Protocol In Non-Common Process Path production
- Windows HTTP Network Communication From MSIExec production
- Windows InstallUtil Remote Network Connection production
- Windows Mail Protocol In Non-Common Process Path production
- Windows Network Connection From Program In Suspect Location production
- Windows Potential Cloudflared Network Connection production
- Windows Remote Desktop Network Bruteforce Attempt production
- Windows Rundll32 WebDav With Network Connection production
- Windows Suspect Process With Authentication Traffic production
- Windows WinLogon with Public Network Connection production
- wuauclt.exe Network Connection (Sysmon)
Event ID 5: Process terminated 2 rules
- High Process Termination Frequency production
- Windows Processes Killed By Industroyer2 Malware production
Event ID 6: Driver loaded 5 rules
- Driver Loaded from Unusual Path - Windows (Sysmon)
- Windows Drivers Loaded by Signature production
- Windows Suspicious Driver Loaded Path production
- Windows Vulnerable Driver Loaded production
- XMRIG Driver Loaded production
Event ID 7: Image loaded 39 rules
- CMLUA Or CMSTPLUA UAC Bypass production
- Loading Of Dynwrapx Module production
- MS Scripting Process Loading Ldap Module production
- MS Scripting Process Loading WMI Module production
- MSI Module Loaded by Non-System Binary production
- Potential Follina_DogWalk Activity - mdst.exe (Sysmon)
- Spoolsv Suspicious Loaded Modules production
- Sunburst Correlation DLL and Network Event experimental
- UAC Bypass MMC Load Unsigned Dll production
- UAC Bypass With Colorui COM Object production
- Wbemprox COM Object Execution production
- Windows BitDefender Submission Wizard DLL Sideloading experimental
- Windows Cloud Files Filter Loaded by Uncommon Process production
- Windows Credentials Access via VaultCli Module production
- Windows Devtunnels Image Loaded production
- Windows DLL Module Loaded in Temp Dir production
- Windows DLL Search Order Hijacking Hunt with Sysmon production
- Windows DLL Side-Loading In Calc production
- Windows Executable in Loaded Modules production
- Windows Gather Victim Identity SAM Info production
- Windows Hijack Execution Flow Version Dll Side Load production
- Windows Input Capture Using Credential UI Dll production
- Windows InstallUtil Credential Theft production
- Windows Known Abused DLL Loaded Suspiciously production
- Windows Known GraphicalProton Loaded Modules production
- Windows MMC Loaded Script Engine DLL production
- Windows NetSupport RMM DLL Loaded By Uncommon Process production
- Windows Office Product Loaded MSHTML Module production
- Windows Office Product Loading Taskschd DLL production
- Windows Office Product Loading VBE7 DLL production
- Windows Remote Access Software BRC4 Loaded Dll production
- Windows Remote Image Load production
- Windows Scheduled Task DLL Module Loaded production
- Windows SpeechRuntime COM Hijacking DLL Load production
- Windows SqlWriter SQLDumper DLL Sideload production
- Windows Unsigned DLL Side-Loading production
- Windows Unsigned DLL Side-Loading In Same Process Path production
- Windows Unsigned MS DLL Side-Loading production
- Windows Unusual Process Load Mozilla NSS-Mozglue Module production
Event ID 8: CreateRemoteThread 9 rules
- Create Remote Thread In Shell Application production
- Create Remote Thread into LSASS production
- Powershell Remote Thread To Known Windows Process production
- Rare Remote Thread (Sysmon)
- Remote Thread Created by Uncommon Process (Sysmon)
- Remote Thread from Suspicious Folder (Sysmon)
- Rundll32 Create Remote Thread To A Process production
- Windows Process Injection Remote Thread production
- Windows Uncommon Remote Thread Creation In Browser Process production
Event ID 9: RawAccessRead 2 rules
Event ID 10: ProcessAccess 16 rules
- Access LSASS Memory for Dump Creation production
- Detect Credential Dumping through LSASS access production
- Mimikatz (Sysmon)
- Rubeus Kerberos Ticket Exports Through Winlogon Access production
- Spoolsv Suspicious Process Access production
- Windows Access Token Manipulation Winlogon Duplicate Token Handle production
- Windows Access Token Winlogon Duplicate Handle In Uncommon Path production
- Windows Handle Duplication in Known UAC-Bypass Binaries production
- Windows Hunting System Account Targeting Lsass production
- Windows Non-System Account Targeting Lsass production
- Windows Possible Credential Dumping production
- Windows Process Injection into Commonly Abused Processes production
- Windows Process Injection into Notepad production
- Windows Terminating Lsass Process production
- Windows VSSVC Process Accessing Defender Engine production
- Windows WMI Impersonate Token production
Event ID 11: FileCreate 98 rules
- Additional dll added to Spool Driver (Sysmon)
- Batch File Write to System32 production
- Common Ransomware Extensions production
- Common Ransomware Notes production
- ConnectWise ScreenConnect Path Traversal production
- Creation of lsass Dump with Taskmgr production
- Detect AzureHound File Modifications production
- Detect Certipy File Modifications production
- Detect Exchange Web Shell production
- Detect Outlook exe writing a zip file production
- Detect Remote Access Software Usage File production
- Detect RTLO In File Name production
- Detect SharpHound File Modifications production
- Drop IcedID License dat production
- Email files written outside of the Outlook directory production
- Executable File Written to Disk (Sysmon)
- Executables Or Script Creation In Suspicious Path production
- Executables Or Script Creation In Temp Path production
- File with Samsam Extension production
- File Written to Startup Folder - Windows (Sysmon)
- GitHub Workflow File Creation or Modification production
- IcedID Exfiltrated Archived File Creation production
- Impacket atexec.py Temp File Creation (Sysmon)
- iphlpapi.dll File Write to Appdata_Local_Microsoft (Sysmon)
- LLM Model File Creation production
- MS Exchange Mailbox Replication service writing Active Server Pages experimental
- Msmpeng Application DLL Side Loading production
- Overwriting Accessibility Binaries production
- Process Creating LNK file in Suspicious Location production
- Process Writing DynamicWrapperX production
- Ransomware Notes bulk creation production
- RDP File Written by Outlook (Sysmon)
- Remcos RAT File Creation in Remcos Folder production
- Rundll32 Process Creating Exe Dll Files production
- Ryuk Test Files Detected production
- Samsam Test File Write production
- SchCache Change By App Connect And Create ADSI Object production
- Shai-Hulud 2 Exfiltration Artifact Files production
- Shai-Hulud Workflow File Creation or Modification production
- Shim Database File Creation production
- Spike in File Writes experimental
- Spoolsv Writing a DLL production
- Spoolsv Writing a DLL - Sysmon production
- Sqlite Module In Temp Folder production
- Suspicious .sys Created - Windows (Sysmon)
- Suspicious File Created in Public Folder (Sysmon)
- Suspicious Image Creation In Appdata Folder production
- Suspicious WAV file in Appdata Folder production
- Suspicious writes to windows Recycle Bin production
- Wermgr Process Create Executable File production
- Windows .Key File Creation in Root Directory production
- Windows Admin Permission Discovery production
- Windows Admin$ Share Access (Sysmon)
- Windows Archived Collected Data In TEMP Folder production
- Windows Boot or Logon Autostart Execution In Startup Folder production
- Windows C$ Share Access (Sysmon)
- Windows CAB File on Disk production
- Windows Cloud Files Filter Log Created by Non-System Process production
- Windows Credentials from Password Stores Chrome Copied in TEMP Dir production
- Windows Credentials from Web Browsers Saved in TEMP Folder production
- Windows Defacement Modify Transcodedwallpaper File production
- Windows Default RDP File Creation By Non MSTSC Process production
- Windows EFI Bootloader File Modification production
- Windows File Without Extension In Critical Folder production
- Windows IPC$ Share Access (Sysmon)
- Windows ISO LNK File Creation production
- Windows Known Abused DLL Created production
- Windows Mimikatz Crypto Export File Extensions production
- Windows Mock Trusted Directory MSC File Creation production
- Windows MOVEit Transfer Writing ASPX production
- Windows MSHTA Writing to World Writable Path production
- Windows MsMpEng Writing to System32 production
- Windows NirSoft Tool Bundle File Created production
- Windows Obfuscated Files or Information via RAR SFX production
- Windows Office Product Dropped Cab or Inf File production
- Windows Office Product Dropped Uncommon File production
- Windows Outlook Macro Created by Suspicious Process production
- Windows Phishing Outlook Drop Dll In FORM Dir production
- Windows Potential AppDomainManager Hijack Artifacts Creation production
- Windows Potential Web Shell Creation For VMware Workspace ONE production
- Windows PowerShell Module File Created production
- Windows Process Writing File to World Writable Path production
- Windows RDP Bitmap Cache File Creation production
- Windows Replication Through Removable Media production
- Windows Screen Capture in TEMP folder production
- Windows SharePoint Spinstall0 Webshell File Creation production
- Windows Snake Malware File Modification Crmlog production
- Windows Snake Malware Kernel Driver Comadmin production
- Windows Suspicious Defender Engine or Signature Files Created production
- Windows Suspicious Defender Update Activity in INetCache production
- Windows Suspicious File in EFI Volume production
- Windows System File on Disk production
- Windows TeamCity Plugin Installed production
- Windows Theme File Creation in Unusual Location production
- Windows Universal Data Link File Creation production
- Windows Unusual File Creation in Confluence Directory production
- Windows User Execution Malicious URL Shortcut File production
- Windows XLL File Creation Outside of Typical Location production
Event ID 12: RegistryEvent (Object create and delete) 24 rules
- Add DefaultUser And Password In Registry production
- ComputerDefaults UAC Bypass (Sysmon)
- Hidden User Created - Windows (Sysmon)
- LocalAccountTokenFilterPolicy Registry Value Modified (Sysmon)
- Logon Script Registry Key added (Sysmon)
- LSA Authentication Packages Registry Key Modified (Sysmon)
- Malicious InProcServer32 Modification production
- Possible Credential Dumping via Windows Network Providers (Sysmon)
- Potential fodhelper UAC Bypass Attempt (Sysmon)
- Remcos client registry install entry production
- Revil Registry Entry production
- Sdclt UAC Bypass production
- Startup Folder Location Modified - Windows (Sysmon)
- Windows CrowdStrike Agent Registry Key Removal production
- Windows Deleted Registry By A Non Critical Process File Path production
- Windows Downdate Registry Activity production
- Windows Modify Registry Delete Firewall Rules production
- Windows RDP Server Registry Deletion production
- Windows Registry Delete Task SD production
- Windows RunMRU Registry Key or Value Deleted production
- Windows USBSTOR Registry Key Modification production
- Windows WPDBusEnum Registry Key Modification production
- WinLogon Registry Key Modified (Sysmon)
- WSReset UAC Bypass production
Event ID 13: RegistryEvent (Value Set) 195 rules
- Active Setup Registry Autostart production
- Add DefaultUser And Password In Registry production
- Add DLL_EXE Registry Value (Sysmon)
- Allow Inbound Traffic By Firewall Rule Registry production
- Allow Operation with Consent Admin production
- Auto Admin Logon Registry Entry production
- Command Line Utility Added to Accessibility Features (Sysmon)
- ComputerDefaults UAC Bypass (Sysmon)
- ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon)
- Defender Registry Values Modified (Sysmon)
- Detect Remote Access Software Usage Registry production
- Disable AMSI Through Registry production
- Disable Defender AntiVirus Registry production
- Disable Defender BlockAtFirstSeen Feature production
- Disable Defender Enhanced Notification production
- Disable Defender MpEngine Registry production
- Disable Defender Spynet Reporting production
- Disable Defender Submit Samples Consent Feature production
- Disable ETW Through Registry production
- Disable Registry Tool production
- Disable Security Logs Using MiniNt Registry production
- Disable Show Hidden Files production
- Disable UAC Remote Restriction production
- Disable Windows App Hotkeys production
- Disable Windows Behavior Monitoring production
- Disable Windows SmartScreen Protection production
- Disabling CMD Application production
- Disabling ControlPanel production
- Disabling Defender Services production
- Disabling FolderOptions Windows Feature production
- Disabling NoRun Windows App production
- Disabling Remote User Account Control production
- Disabling SystemRestore In Registry production
- Disabling Task Manager production
- Disabling Windows Local Security Authority Defences via Registry production
- Enable RDP In Other Port Number production
- Enable WDigest UseLogonCredential Registry production
- EnableLUA Registry Value Modified (Sysmon)
- ETW Registry Disabled production
- Eventvwr UAC Bypass production
- Executable Running as NT AUTHORITY_SYSTEM Registered in BAM (Sysmon)
- Hidden User Created - Windows (Sysmon)
- Hide User Account From Sign-In Screen production
- LocalAccountTokenFilterPolicy Registry Value Modified (Sysmon)
- Logon Script Event Trigger Execution production
- Logon Script Registry Key added (Sysmon)
- LSA Authentication Packages Registry Key Modified (Sysmon)
- Malicious InProcServer32 Modification production
- Modification Of Wallpaper production
- Monitor Registry Keys for Print Monitors production
- NET Profiler UAC bypass production
- Potential fodhelper UAC Bypass Attempt (Sysmon)
- Print Processor Registry Autostart production
- PromptOnSecureDesktop Registry Value Modified (Sysmon)
- Registry Keys for Creating SHIM Databases production
- Registry Keys Used For Persistence production
- Registry Keys Used For Privilege Escalation production
- Remcos client registry install entry production
- Revil Registry Entry production
- Screensaver Event Trigger Execution production
- Sdclt UAC Bypass production
- Set Default PowerShell Execution Policy To Unrestricted or Bypass production
- SilentCleanup UAC Bypass production
- Startup Folder Location Modified - Windows (Sysmon)
- Suspicious InprocServer32 Registry Modification (Sysmon)
- Time Provider Persistence Registry production
- WDigest Forced Credential Caching (Sysmon)
- Windows AD DSRM Account Changes production
- Windows Anomalous Registry Value Length in Environment Key production
- Windows AppCertDLL Modification Via Registry production
- Windows Audit Policy Auditing Option Modified - Registry production
- Windows Autostart Execution LSASS Driver Registry Modification production
- Windows Chrome Auto-Update Disabled via Registry production
- Windows Chrome Extension Allowed Registry Modification production
- Windows Compatibility Telemetry Tampering Through Registry production
- Windows Defender Disabled Detection (Sysmon)
- Windows Defender Exclusion Registry Entry production
- Windows Disable Change Password Through Registry production
- Windows Disable Lock Workstation Feature Through Registry production
- Windows Disable LogOff Button Through Registry production
- Windows Disable Memory Crash Dump production
- Windows Disable Notification Center production
- Windows Disable Shutdown Button Through Registry production
- Windows Disable Windows Group Policy Features Through Registry production
- Windows DisableAntiSpyware Registry production
- Windows Downdate Registry Activity production
- Windows Enable Win32 ScheduledJob via Registry production
- Windows Filtering Platform Policy Added to Block EDR Process production
- Windows Hide Notification Features Through Registry production
- Windows Impair Defense Change Win Defender Health Check Intervals production
- Windows Impair Defense Change Win Defender Quick Scan Interval production
- Windows Impair Defense Change Win Defender Throttle Rate production
- Windows Impair Defense Change Win Defender Tracing Level production
- Windows Impair Defense Configure App Install Control production
- Windows Impair Defense Define Win Defender Threat Action production
- Windows Impair Defense Delete Win Defender Context Menu production
- Windows Impair Defense Delete Win Defender Profile Registry production
- Windows Impair Defense Deny Security Software With Applocker production
- Windows Impair Defense Disable Controlled Folder Access production
- Windows Impair Defense Disable Defender Firewall And Network production
- Windows Impair Defense Disable Defender Protocol Recognition production
- Windows Impair Defense Disable PUA Protection production
- Windows Impair Defense Disable Realtime Signature Delivery production
- Windows Impair Defense Disable Web Evaluation production
- Windows Impair Defense Disable Win Defender App Guard production
- Windows Impair Defense Disable Win Defender Compute File Hashes production
- Windows Impair Defense Disable Win Defender Gen reports production
- Windows Impair Defense Disable Win Defender Network Protection production
- Windows Impair Defense Disable Win Defender Report Infection production
- Windows Impair Defense Disable Win Defender Scan On Update production
- Windows Impair Defense Disable Win Defender Signature Retirement production
- Windows Impair Defense Overide Win Defender Phishing Filter production
- Windows Impair Defense Override SmartScreen Prompt production
- Windows Impair Defense Set Win Defender Smart Screen Level To Warn production
- Windows Impair Defenses Disable Auto Logger Session production
- Windows Impair Defenses Disable AV AutoStart via Registry production
- Windows Impair Defenses Disable HVCI production
- Windows Impair Defenses Disable Win Defender Auto Logging production
- Windows InProcServer32 New Outlook Form production
- Windows LSA Secrets NoLMhash Registry production
- Windows Modify Registry AuthenticationLevelOverride production
- Windows Modify Registry Auto Minor Updates production
- Windows Modify Registry Auto Update Notif production
- Windows Modify Registry Configure BitLocker production
- Windows Modify Registry Default Icon Setting production
- Windows Modify Registry Disable RDP production
- Windows Modify Registry Disable Restricted Admin production
- Windows Modify Registry Disable Toast Notifications production
- Windows Modify Registry Disable Win Defender Raw Write Notif production
- Windows Modify Registry Disable WinDefender Notifications production
- Windows Modify Registry Disable Windows Security Center Notif production
- Windows Modify Registry DisableRemoteDesktopAntiAlias production
- Windows Modify Registry DisableSecuritySettings production
- Windows Modify Registry Disabling WER Settings production
- Windows Modify Registry DisAllow Windows App production
- Windows Modify Registry Do Not Connect To Win Update production
- Windows Modify Registry DontShowUI production
- Windows Modify Registry EnableLinkedConnections production
- Windows Modify Registry LongPathsEnabled production
- Windows Modify Registry MaxConnectionPerServer production
- Windows Modify Registry No Auto Reboot With Logon User production
- Windows Modify Registry No Auto Update production
- Windows Modify Registry NoChangingWallPaper production
- Windows Modify Registry on Smart Card Group Policy production
- Windows Modify Registry ProxyEnable production
- Windows Modify Registry ProxyServer production
- Windows Modify Registry Qakbot Binary Data Registry production
- Windows Modify Registry Suppress Win Defender Notif production
- Windows Modify Registry Tamper Protection production
- Windows Modify Registry to Add or Modify Firewall Rule production
- Windows Modify Registry UpdateServiceUrlAlternate production
- Windows Modify Registry USeWuServer production
- Windows Modify Registry Utilize ProgIDs production
- Windows Modify Registry ValleyRAT C2 Config production
- Windows Modify Registry ValleyRat PWN Reg Entry production
- Windows Modify Registry With MD5 Reg Key Name production
- Windows Modify Registry WuServer production
- Windows Modify Registry wuStatusServer production
- Windows Modify Show Compress Color And Info Tip Registry production
- Windows Mshta Execution In Registry production
- Windows New Custom Security Descriptor Set On EventLog Channel production
- Windows New Default File Association Value Set production
- Windows New EventLog ChannelAccess Registry Value Set production
- Windows New InProcServer32 Added production
- Windows Njrat Fileless Storage via Registry production
- Windows Outlook Dialogs Disabled from Unusual Process production
- Windows Outlook LoadMacroProviderOnBoot Persistence production
- Windows Outlook Macro Security Modified production
- Windows Outlook WebView Registry Modification production
- Windows Phishing Recent ISO Exec Registry production
- Windows Process Executed From Removable Media production
- Windows Proxy Via Registry production
- Windows RDP Server Registry Deletion production
- Windows RDP Server Registry Entry Created production
- Windows Registry BootExecute Modification production
- Windows Registry Certificate Added production
- Windows Registry Dotnet ETW Disabled Via ENV Variable production
- Windows Registry Modification for Safe Mode Persistence production
- Windows Registry Payload Injection production
- Windows Registry SIP Provider Modification production
- Windows Remote Access Software RMS Registry production
- Windows Remote Services Allow Remote Assistance production
- Windows Remote Services Rdp Enable production
- Windows Routing and Remote Access Service Registry Key Change production
- Windows RunMRU Command Execution production
- Windows Service Creation Using Registry Entry production
- Windows Service Deletion In Registry production
- Windows Set Network Profile Category to Private via Registry production
- Windows Snake Malware Registry Modification wav OpenWithProgIds production
- Windows SnappyBee Create Test Registry production
- Windows USBSTOR Registry Key Modification production
- Windows WPDBusEnum Registry Key Modification production
- WinLogon Registry Key Modified (Sysmon)
- Wow6432Node Classes Autorun Keys Modification (Sysmon)
- WSReset UAC Bypass production
Event ID 14: RegistryEvent (Key and Value Rename) 2 rules
- Windows Downdate Registry Activity production
- Windows Modify Registry to Add or Modify Firewall Rule production
Event ID 17: PipeEvent (Pipe Created) 10 rules
- Named Pipe Created (Sysmon)
- Trickbot Named Pipe production
- Windows Anonymous Pipe Activity production
- Windows App Layer Protocol Qakbot NamedPipe production
- Windows App Layer Protocol Wermgr Connect To NamedPipe production
- Windows Application Layer Protocol RMS Radmin Tool Namedpipe production
- Windows PUA Named Pipe production
- Windows RMM Named Pipe production
- Windows Suspicious C2 Named Pipe production
- Windows Suspicious Named Pipe production
Event ID 18: PipeEvent (Pipe Connected) 10 rules
- Named Pipe Created (Sysmon)
- Trickbot Named Pipe production
- Windows Anonymous Pipe Activity production
- Windows App Layer Protocol Qakbot NamedPipe production
- Windows App Layer Protocol Wermgr Connect To NamedPipe production
- Windows Application Layer Protocol RMS Radmin Tool Namedpipe production
- Windows PUA Named Pipe production
- Windows RMM Named Pipe production
- Windows Suspicious C2 Named Pipe production
- Windows Suspicious Named Pipe production
Event ID 20: WmiEvent (WmiEventConsumer activity detected) 1 rule
- Detect WMI Event Subscription Persistence production
Event ID 21: WmiEvent (WmiEventConsumerToFilter activity detected) 1 rule
- WMI Permanent Event Subscription - Sysmon production
Event ID 22: DNSEvent (DNS query) 24 rules
- 3CX Supply Chain Attack Network Indicators production
- AteraAgent Installation - Windows (Sysmon)
- Detect DNS Query to Decommissioned S3 Bucket experimental
- Detect hosts connecting to dynamic domain providers production
- Detect Remote Access Software Usage DNS production
- DNS Kerberos Coercion production
- DNS Query Length With High Standard Deviation production
- Local LLM Framework DNS Query production
- Ngrok Reverse Proxy on Network production
- Rundll32 DNSQuery production
- Sunburst Correlation DLL and Network Event experimental
- Suspicious Process DNS Query Known Abuse Web Services production
- Suspicious Process With Discord DNS Query production
- Wermgr Process Connecting To IP Check Web Services production
- Windows Abused Web Services production
- Windows AI Platform DNS Query production
- Windows BitLockerToGo with Network Activity production
- Windows DNS Query Request by Telegram Bot API production
- Windows DNS Query Request To TinyUrl production
- Windows Gather Victim Network Info Through Ip Check Web Services production
- Windows Multi hop Proxy TOR Website Query production
- Windows Non-System Process Querying Definition Update production
- Windows Spearphishing Attachment Connect To None MS Office Domain production
- Windows Visual Basic Commandline Compiler DNSQuery production
Event ID 23: FileDelete (File Delete archived) 11 rules
- Additional dll added to Spool Driver (Sysmon)
- Excessive File Deletion In WinDefender Folder production
- Windows ConsoleHost History File Deletion production
- Windows Data Destruction Recursive Exec Files Deletion production
- Windows Default Rdp File Deletion production
- Windows High File Deletion Frequency production
- Windows Mark Of The Web Bypass production
- Windows MSI Rollback Script Deleted By Non-Msiexec Process production
- Windows Rdp AutomaticDestinations Deletion production
- Windows RDP Cache File Deletion production
- Windows Suspicious Defender Update Activity in INetCache production
Event ID 26: FileDeleteDetected (File Delete logged) 10 rules
- Excessive File Deletion In WinDefender Folder production
- Windows ConsoleHost History File Deletion production
- Windows Data Destruction Recursive Exec Files Deletion production
- Windows Default Rdp File Deletion production
- Windows High File Deletion Frequency production
- Windows Mark Of The Web Bypass production
- Windows MSI Rollback Script Deleted By Non-Msiexec Process production
- Windows Rdp AutomaticDestinations Deletion production
- Windows RDP Cache File Deletion production
- Windows Suspicious Defender Update Activity in INetCache production
Microsoft-Windows-Windows-Defender
Event ID 1121: Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator. 2 rules
- Windows Defender ASR Block Events production
- Windows Defender ASR Rules Stacking production
Event ID 1122: Microsoft Defender Exploit Guard audited an operation that is not allowed by your IT administrator. 2 rules
- Windows Defender ASR Audit Events production
- Windows Defender ASR Rules Stacking production
Event ID 1125: Your IT administrator would have caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection. 2 rules
- Windows Defender ASR Audit Events production
- Windows Defender ASR Rules Stacking production
Event ID 1126: Your IT administrator has caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection. 3 rules
- Windows Defender ASR Audit Events production
- Windows Defender ASR Block Events production
- Windows Defender ASR Rules Stacking production
Event ID 1129: A user has allowed a blocked Microsoft Defender Exploit Guard operation. 2 rules
- Windows Defender ASR Block Events production
- Windows Defender ASR Rules Stacking production
Event ID 1131: ProductName has blocked an operation that your administrator doesn't allow. 2 rules
- Windows Defender ASR Block Events production
- Windows Defender ASR Rules Stacking production
Event ID 1132: ProductName has audited an operation. 2 rules
- Windows Defender ASR Audit Events production
- Windows Defender ASR Rules Stacking production
Event ID 1133: ProductName has blocked an operation that your administrator doesn't allow. 2 rules
- Windows Defender ASR Block Events production
- Windows Defender ASR Rules Stacking production
Event ID 1134: ProductName has audited an operation. 2 rules
- Windows Defender ASR Audit Events production
- Windows Defender ASR Rules Stacking production
Event ID 5007: Product Name Configuration has changed. 3 rules
- Windows Defender ASR Registry Modification production
- Windows Defender ASR Rule Disabled production
- Windows Defender ASR Rules Stacking production
Microsoft-Windows-AppLocker
Event ID 8005: FilePathBuffer was allowed to run. 5 rules
- Windows Multiple NTLM Null Domain Authentications production
- Windows Unusual NTLM Authentication Destinations By Source production
- Windows Unusual NTLM Authentication Destinations By User production
- Windows Unusual NTLM Authentication Users By Destination production
- Windows Unusual NTLM Authentication Users By Source production
Microsoft-Windows-AppXDeployment-Server
Microsoft-Windows-Eventlog
Event ID 517: The audit log was cleared (legacy Windows 2000/XP/2003 event; superseded by 1102). 1 rule
MSSQLSERVER
Event ID 8128 1 rule
Event ID 15457 3 rules
Microsoft-Windows-PrintService
MsiInstaller
Service-Control-Manager
Event ID 7036: The Microsoft Software Shadow Copy Provider service entered the stopped state. 3 rules
- First Time Seen Running Windows Service experimental
- Windows Cisco Secure Endpoint Related Service Stopped production
- Windows Security And Backup Services Stop production
Event ID 7040: The start type of the msdsm service was changed from boot start to demand start. 3 rules
- Windows Event For Service Disabled production
- Windows Excessive Disabled Services Event production
- Windows Service Stop Win Updates production
Event ID 7045: A service was installed in the system. 18 rules
- Clop Ransomware Known Service Name production
- Impacket SMBexec (Windows Event Log)
- Kernel Service Installed - Windows (Windows Event Log)
- Malicious Powershell Executed As A Service production
- PSexec Service Creation (Windows Event Log)
- Randomly Generated Windows Service Name experimental
- Service Created containing Command Shell (Windows Event Log)
- Service Installed (Windows Event Log)
- SimpleHelp Remote Access Tool Service Installation (Windows Event Log)
- Windows Bluetooth Service Installed From Uncommon Location production
- Windows Driver Load Non-Standard Path production
- Windows KrbRelayUp Service Creation production
- Windows Service Create RemComSvc production
- Windows Service Create SliverC2 production
- Windows Service Created with Suspicious Service Name production
- Windows Service Created with Suspicious Service Path production
- Windows Snake Malware Service Create production
- Windows Vulnerable Driver Installed production
Microsoft-Windows-CAPI2
Microsoft-Windows-NTLM
Event ID 8004: NTLM authentication in this domain audit (domain controller): Audit NTLM authentication in this domain. 5 rules
- Windows Multiple NTLM Null Domain Authentications production
- Windows Unusual NTLM Authentication Destinations By Source production
- Windows Unusual NTLM Authentication Destinations By User production
- Windows Unusual NTLM Authentication Users By Destination production
- Windows Unusual NTLM Authentication Users By Source production
Event ID 8006: NTLM authentication in this domain audit (domain controller), event 8006. 5 rules
- Windows Multiple NTLM Null Domain Authentications production
- Windows Unusual NTLM Authentication Destinations By Source production
- Windows Unusual NTLM Authentication Destinations By User production
- Windows Unusual NTLM Authentication Users By Destination production
- Windows Unusual NTLM Authentication Users By Source production
Microsoft-Windows-PowerShell
Event ID 4103: Payload Context: ContextInfo User Data: UserData. 116 rules
- Adfind Commands (PowerShell)
- Adfind Execution (PowerShell)
- Application Discovery - Windows (PowerShell)
- ATBroker.exe Execution (PowerShell)
- AutoHotkey Execution (PowerShell)
- BITSadmin Execution (PowerShell)
- BitsAdmin NetCat PowerCat File Transfer (PowerShell)
- Browser Started with Remote Debugging - Windows (PowerShell)
- Bypass or Unrestricted PowerShell Execution (PowerShell)
- Certutil File Download (PowerShell)
- Certutil Obfuscate_Encode Files (PowerShell)
- Command Line Homoglyphs - Windows (PowerShell)
- Command Line lsass request (PowerShell)
- Command Line Utility Added to Accessibility Features (PowerShell)
- Command-Line Interface Execution (PowerShell)
- Common Exchange Recon cmdlets (PowerShell)
- ComputerDefaults UAC Bypass (PowerShell)
- ConsentPromptBehaviorAdmin Registry Value Modified (PowerShell)
- Create_Modify Schtasks (PowerShell)
- Defender Registry Values Modified (PowerShell)
- Disabled Pre-Authentication Accounts Discovery - PowerShell (PowerShell)
- DLL Concatenation (PowerShell)
- Domain Controller Enumeration via nltest (PowerShell)
- Dump File Identified (PowerShell)
- EnableLUA Registry Value Modified (PowerShell)
- Encoded Powershell Command (PowerShell)
- Esentutl Execution (PowerShell)
- ETW Trace Provider Modified - PowerShell (PowerShell)
- Exchange New Export Request (PowerShell)
- Exfiltration via curl.exe - Windows (PowerShell)
- Expand.exe Execution (PowerShell)
- File and Directory Discovery Output to File - Windows (PowerShell)
- File_Folder Hidden - Windows (PowerShell)
- Group Policy Editor Execution (PowerShell)
- hh.exe Execution (PowerShell)
- hh.exe Remote File Execution (PowerShell)
- Invoke-DCOM.ps1 - PowerShell (PowerShell)
- Invoke-Expression Command (PowerShell)
- Invoke-WebRequest Command (PowerShell)
- ISO Image Mounted - Windows (PowerShell)
- Known Process Injection Commands (PowerShell)
- LocalAccountTokenFilterPolicy Registry Value Modified (PowerShell)
- Locate Credentials (PowerShell)
- LSA Authentication Packages Registry Key Modified (PowerShell)
- masscan Execution - Windows (PowerShell)
- Modify Exchange Access Settings (PowerShell)
- MSHTA.exe execution (PowerShell)
- MSI Installation via Appcert (PowerShell)
- Network Share Connection Removal (PowerShell)
- New AutoRun Registry Key (PowerShell)
- ngen.exe File Download (PowerShell)
- Non-MSIExec .msi Installation (PowerShell)
- ntds.dit Command Line (PowerShell)
- Obfuscated Powershell Techniques (PowerShell)
- Output to File (PowerShell)
- Permission Groups Discovery: Domain Groups (PowerShell)
- Permission Groups Discovery: Local Groups (PowerShell)
- Possible Credential Dumping via Windows Network Providers (PowerShell)
- Potential AutoHotkey .ahk Execution (PowerShell)
- Potential fodhelper UAC Bypass Attempt (PowerShell)
- Potential LSA password filter (PowerShell)
- Potential Target Discovery via PowerShell Event Log Queries (PowerShell)
- PowerHuntShares Commands (PowerShell)
- PowerShell Clipboard Access (PowerShell)
- PowerShell CreateDecryptor (PowerShell)
- PowerShell Downgrade (PowerShell)
- PowerShell Download Activity (PowerShell)
- PowerShell DownloadFile_DownloadString (PowerShell)
- PowerShell Hidden Window (PowerShell)
- Powershell ICMP Data Exfiltration (PowerShell)
- PowerShell Modifying Registry Values (PowerShell)
- PowerShell Script Keylogger (PowerShell)
- PowerShell XML Retrieval (PowerShell)
- PowerShell: SMBExec Script (PowerShell)
- PowerView_SharpView Commands (PowerShell)
- PromptOnSecureDesktop Registry Value Modified (PowerShell)
- ProtocolHandler.exe File Download (PowerShell)
- Proxy Execution via Appcert (PowerShell)
- Query Registry (PowerShell)
- Rclone Execution (PowerShell)
- RdrLeakDiag.exe Memory Dump (PowerShell)
- Read-Only Attribute Removed - Windows (PowerShell)
- Registry Entry Created - PowerShell (PowerShell)
- regsvr32 Execution (PowerShell)
- Remote .msi Installation (PowerShell)
- Remote .msi Installation (PowerShell)
- Remote Admin Tools (PowerShell)
- Remote WMIC Query (PowerShell)
- Rundll32 Command Line (PowerShell)
- Scheduled Task with Potential SSH Tunnel - Windows (PowerShell)
- Security Software Discovery via Findstr.exe (PowerShell)
- Security Software Discovery via WMI (PowerShell)
- Sliver C2 Implant Activity Pattern (PowerShell)
- Startup Folder Location Modified - Windows (PowerShell)
- Stored Credentials from Web Browsers - Windows (PowerShell)
- Suspicious AteraAgent Installation - Windows (PowerShell)
- Suspicious DLLhost Execution (PowerShell)
- Suspicious Powershell (PowerShell)
- Suspicious PowerShell Clipboard Activity (PowerShell)
- Suspicious reCAPTCHA Command Line (PowerShell)
- Suspicious Registry Key Created (PowerShell)
- System Information Discovery - Windows (PowerShell)
- System Network Connections Discovery - Windows (PowerShell)
- System Owner_User Discovery - Windows (PowerShell)
- Timestamp Manipulation (PowerShell)
- User Discovery via Environment Variables - PowerShell (PowerShell)
- User_Domain Enumeration Tool - Windows (PowerShell)
- Visio.exe File Download (PowerShell)
- Visual Studio Code Tunnel Execution (PowerShell)
- WebLogic CVE-2017-10271 (PowerShell)
- Windows - Service Stop (PowerShell)
- Windows Copy Files (PowerShell)
- Windows Firewall Rule Creation (PowerShell)
- Windows Process Copied from System Folder (PowerShell)
- WinLogon Registry Key Modified (PowerShell)
- Wow6432Node Classes Autorun Keys Modification (PowerShell)
Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal). 287 rules
- Access Common Package Config file (PowerShell)
- Account Password Changed from Command Line - Windows (PowerShell)
- Adfind Commands (PowerShell)
- Adfind Execution (PowerShell)
- AdsiSearcher Account Discovery production
- Allow Inbound Traffic In Firewall Rule production
- Application Discovery - Windows (PowerShell)
- ATBroker.exe Execution (PowerShell)
- Attempted Veeam Database Credential Dump (PowerShell)
- AutoHotkey Execution (PowerShell)
- AutoIt Execution (PowerShell)
- BITSadmin Execution (PowerShell)
- BitsAdmin NetCat PowerCat File Transfer (PowerShell)
- Browser Started with Remote Debugging - Windows (PowerShell)
- Bypass or Unrestricted PowerShell Execution (PowerShell)
- Certutil File Download (PowerShell)
- Certutil Obfuscate_Encode Files (PowerShell)
- Clear Windows Event Logs (PowerShell)
- CMD execution with _c (PowerShell)
- Command Line Homoglyphs - Windows (PowerShell)
- Command Line lsass request (PowerShell)
- Common Active Directory Commands (PowerShell)
- Common Exchange Recon cmdlets (PowerShell)
- Common Reconnaissance Commands (PowerShell)
- ComputerDefaults UAC Bypass (PowerShell)
- ConsentPromptBehaviorAdmin Registry Value Modified (PowerShell)
- Create_Modify Schtasks (PowerShell)
- CSVDE Export Active Directory (PowerShell)
- Data Staged to File (PowerShell)
- Defender Registry Values Modified (PowerShell)
- Delete ShadowCopy With PowerShell production
- Detect Certify With PowerShell Script Block Logging production
- Detect Copy of ShadowCopy with Script Block Logging production
- Detect Empire with PowerShell Script Block Logging production
- Detect Mimikatz With PowerShell Script Block Logging production
- Disabled Kerberos Pre-Authentication Discovery With Get-ADUser production
- Disabled Kerberos Pre-Authentication Discovery With PowerView production
- Disabled Pre-Authentication Accounts Discovery - PowerShell (PowerShell)
- DLL Called with RS32 (PowerShell)
- DLL Called with Uncommon Function (PowerShell)
- DLL Concatenation (PowerShell)
- DLL Execution from Uncommon Process (PowerShell)
- DLLRegisterServer Called from Command Line (PowerShell)
- Domain Controller Enumeration via nltest (PowerShell)
- Domain Group Discovery with Adsisearcher production
- Domain Trust Discovery Commands - Windows (PowerShell)
- Dump File Identified (PowerShell)
- Elevated Group Discovery with PowerView production
- EnableLUA Registry Value Modified (PowerShell)
- Encoded Powershell Command (PowerShell)
- Esentutl Execution (PowerShell)
- ETW Trace Provider Modified - PowerShell (PowerShell)
- Event Logs Queried for RDP Sessions (PowerShell)
- Exchange New Export Request (PowerShell)
- Exchange PowerShell Module Usage production
- Executable Create Script Process (PowerShell)
- Executable Process from Suspicious Folder (PowerShell)
- Exfiltration via curl.exe - Windows (PowerShell)
- Expand.exe Execution (PowerShell)
- File and Directory Discovery Output to File - Windows (PowerShell)
- File_Folder Hidden - Windows (PowerShell)
- Get ADDefaultDomainPasswordPolicy with Powershell Script Block production
- Get ADUser with PowerShell Script Block production
- Get ADUserResultantPasswordPolicy with Powershell Script Block production
- Get DomainPolicy with Powershell Script Block production
- Get DomainUser with PowerShell Script Block production
- Get WMIObject Group Discovery with Script Block Logging production
- Get-DomainTrust with PowerShell Script Block production
- Get-ForestTrust with PowerShell Script Block production
- GetAdComputer with PowerShell Script Block production
- GetAdGroup with PowerShell Script Block production
- GetCurrent User with PowerShell Script Block production
- GetDomainComputer with PowerShell Script Block production
- GetDomainController with PowerShell Script Block production
- GetDomainGroup with PowerShell Script Block production
- GetLocalUser with PowerShell Script Block production
- GetNetTcpconnection with PowerShell Script Block production
- GetWmiObject Ds Computer with PowerShell Script Block production
- GetWmiObject Ds Group with PowerShell Script Block production
- GetWmiObject DS User with PowerShell Script Block production
- GetWmiObject User Account with PowerShell Script Block production
- Git Clone Repository (PowerShell)
- Go Run Execution (PowerShell)
- Group Policy Editor Execution (PowerShell)
- hh.exe Execution (PowerShell)
- hh.exe Remote File Execution (PowerShell)
- High Entropy Powershell (PowerShell)
- HTTP_HTTPS Default Security Zone Modified to Local Machine (PowerShell)
- Impacket atexec.py Execution (PowerShell)
- Interactive Session on Remote Endpoint with PowerShell production
- Invoke-DCOM.ps1 - PowerShell (PowerShell)
- Invoke-Expression Command (PowerShell)
- Invoke-WebRequest Command (PowerShell)
- ISO Image Mounted - Windows (PowerShell)
- Kerberos Pre-Authentication Flag Disabled with PowerShell production
- Known Process Injection Commands (PowerShell)
- LocalAccountTokenFilterPolicy Registry Value Modified (PowerShell)
- Locate Credentials (PowerShell)
- Logon Script Registry Key added (PowerShell)
- LSA Authentication Packages Registry Key Modified (PowerShell)
- Mailsniper Invoke functions production
- masscan Execution - Windows (PowerShell)
- Modify Exchange Access Settings (PowerShell)
- Modify Windows Defender (PowerShell)
- mshta.exe File Download (PowerShell)
- MSI Installation via Appcert (PowerShell)
- Native Archive Commands (PowerShell)
- Network Share Connection Removal (PowerShell)
- New AutoRun Registry Key (PowerShell)
- ngen.exe File Download (PowerShell)
- ngrok Execution - Windows (PowerShell)
- NirCmd Execution (PowerShell)
- NMAP Execution (PowerShell)
- Non-MSIExec .msi Installation (PowerShell)
- ntds.dit Command Line (PowerShell)
- Output to File (PowerShell)
- Package installation (PowerShell)
- Permission Groups Discovery: Domain Groups (PowerShell)
- Permission Groups Discovery: Local Groups (PowerShell)
- Permissions Replaced by icacls - Windows (PowerShell)
- Possible Credential Dumping via Windows Network Providers (PowerShell)
- Potential AutoHotkey .ahk Execution (PowerShell)
- Potential Cryptomining Commands (PowerShell)
- Potential fodhelper UAC Bypass Attempt (PowerShell)
- Potential LSA password filter (PowerShell)
- Potential Proxy Malware via AutoRun Key (PowerShell)
- Potential Sysinternals Tool Execution (PowerShell)
- Potential Target Discovery via PowerShell Event Log Queries (PowerShell)
- PowerShell 4104 Hunting production
- PowerShell Clipboard Access (PowerShell)
- Powershell COM Hijacking InprocServer32 Modification production
- PowerShell CreateDecryptor (PowerShell)
- Powershell Creating Thread Mutex production
- Powershell DLL_EXE Injection (PowerShell)
- PowerShell Domain Enumeration production
- PowerShell Downgrade (PowerShell)
- PowerShell Download Activity (PowerShell)
- PowerShell DownloadFile_DownloadString (PowerShell)
- PowerShell Enable PowerShell Remoting production
- Powershell Enable SMB1Protocol Feature production
- PowerShell Environment Variable Execution production
- Powershell Execute COM Object production
- Powershell Fileless Process Injection via GetProcAddress production
- Powershell Fileless Script Contains Base64 Encoded Content production
- Powershell Get LocalGroup Discovery with Script Block Logging production
- PowerShell Hidden Window (PowerShell)
- PowerShell Invoke CIMMethod CIMSession production
- PowerShell Invoke WmiExec Usage production
- Powershell Load Module in Meterpreter production
- PowerShell Loading DotNET into Memory via Reflection production
- PowerShell Modifying Registry Values (PowerShell)
- PowerShell PInvoke Process Injection API Chain production
- Powershell Processing Stream Of Data production
- Powershell Remote Services Add TrustedHost production
- Powershell Remove Windows Defender Directory production
- PowerShell Script Block With URL Chain production
- PowerShell Script Keylogger (PowerShell)
- PowerShell Start or Stop Service production
- Powershell Using memory As Backing Store production
- PowerShell WebRequest Using Memory Stream production
- Powershell Windows Defender Exclusion Commands production
- PowerShell XML Retrieval (PowerShell)
- Powersploit SPN Enumeration (PowerShell)
- PowerView_SharpView Commands (PowerShell)
- PromptOnSecureDesktop Registry Value Modified (PowerShell)
- ProtocolHandler.exe File Download (PowerShell)
- Proxy Execution via Appcert (PowerShell)
- PuTTY Secure Copy Client Execution (PowerShell)
- QEMU Network Tunneling - Windows (PowerShell)
- Query Registry (PowerShell)
- Rclone Execution (PowerShell)
- RDP Enabled (PowerShell)
- RdrLeakDiag.exe Memory Dump (PowerShell)
- Read-Only Attribute Removed - Windows (PowerShell)
- Recon AVProduct Through Pwh or WMI production
- Recon Using WMI Class production
- Registry Entry Created - PowerShell (PowerShell)
- regsvr32 Execution (PowerShell)
- Remote .msi Installation (PowerShell)
- Remote .msi Installation (PowerShell)
- Remote Admin Tools (PowerShell)
- Remote Process Instantiation via DCOM and PowerShell Script Block production
- Remote Process Instantiation via WinRM and PowerShell Script Block production
- Remote Process Instantiation via WMI and PowerShell Script Block production
- Remote Share Directory Listing - Windows (PowerShell)
- Remote System Discovery with Adsisearcher production
- Remote WMIC Query (PowerShell)
- Rubeus Commands (PowerShell)
- Rundll32 Command Line (PowerShell)
- Rundll32 Suspicious Command Line (PowerShell)
- rundll32.exe Executing DLL from Non-standard Directory (PowerShell)
- Scheduled Task with Potential SSH Tunnel - Windows (PowerShell)
- Security Software Discovery via Findstr.exe (PowerShell)
- Security Software Discovery via WMI (PowerShell)
- Service Stop Commands (PowerShell)
- ServicePrincipalNames Discovery with PowerShell production
- SharpHound Keywords (PowerShell)
- Shortcut Created in Startup Folder - Windows (PowerShell)
- Sliver C2 Implant Activity Pattern (PowerShell)
- Startup Folder Location Modified - Windows (PowerShell)
- Stored Credentials from Web Browsers - Windows (PowerShell)
- Suspicious DLLhost Execution (PowerShell)
- Suspicious ntds.dit Commands (PowerShell)
- Suspicious PowerShell Clipboard Activity (PowerShell)
- Suspicious PowerShell Parameter Substring (PowerShell)
- Suspicious reCAPTCHA Command Line (PowerShell)
- Suspicious Registry Key Created (PowerShell)
- Symbolic OR Hard File Link Created (PowerShell)
- System Information Discovery - Windows (PowerShell)
- System Network Connections Discovery - Windows (PowerShell)
- System Owner_User Discovery - Windows (PowerShell)
- Timestamp Manipulation (PowerShell)
- Tunneling Process Created (PowerShell)
- Unloading AMSI via Reflection production
- User Discovery via Environment Variables - PowerShell (PowerShell)
- User Discovery With Env Vars PowerShell Script Block production
- User_Domain Enumeration Tool - Windows (PowerShell)
- Utility Archive Data (PowerShell)
- Visio.exe File Download (PowerShell)
- Visual Studio Code Tunnel Execution (PowerShell)
- WDigest Forced Credential Caching (PowerShell)
- Windows - Service Stop (PowerShell)
- Windows Account Discovery for None Disable User Account production
- Windows Account Discovery for Sam Account Name production
- Windows Account Discovery With NetUser PreauthNotRequire production
- Windows Archive Collected Data via Powershell production
- Windows Azure PowerShell Module Installation Via PowerShell Script production
- Windows ClipBoard Data via Get-ClipBoard production
- Windows Cobalt Strike PowerShell Loader production
- Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script production
- Windows Copy Files (PowerShell)
- Windows Default Cobalt Strike PowerShell Beacon production
- Windows Defender Disabled Detection (PowerShell)
- Windows Domain Account Discovery Via Get-NetComputer production
- Windows Enable PowerShell Web Access production
- Windows ESX Admins Group Creation via PowerShell production
- Windows Exfiltration Over C2 Via Invoke RestMethod production
- Windows Exfiltration Over C2 Via Powershell UploadString production
- Windows File Share Discovery With Powerview production
- Windows Find Domain Organizational Units with GetDomainOU production
- Windows Find Interesting ACL with FindInterestingDomainAcl production
- Windows Firewall Disabled (PowerShell)
- Windows Firewall Rule Creation (PowerShell)
- Windows Forest Discovery with GetForestDomain production
- Windows FTP Exfiltration (PowerShell)
- Windows Gather Victim Host Information Camera production
- Windows Get Local Admin with FindLocalAdminAccess production
- Windows Get-AdComputer Unconstrained Delegation Discovery production
- Windows LAPS Password Gathering Via PowerShell Script production
- Windows Level RMM PowerShell Script Installer production
- Windows Linked Policies In ADSI Discovery production
- Windows PowerShell Add Module to Global Assembly Cache production
- Windows Powershell Commands from DNS TXT production
- Windows Powershell Cryptography Namespace production
- Windows PowerShell Disable HTTP Logging production
- Windows PowerShell Export Certificate production
- Windows PowerShell Export PfxCertificate production
- Windows PowerShell Get CIMInstance Remote Computer production
- Windows Powershell History File Deletion production
- Windows PowerShell IIS Components WebGlobalModule Usage production
- Windows Powershell Import Applocker Policy production
- Windows PowerShell Invoke-RestMethod IP Information Collection production
- Windows PowerShell Invoke-Sqlcmd Execution production
- Windows Powershell Logoff User via Quser production
- Windows PowerShell MSIX Package Installation production
- Windows PowerShell ScheduleTask production
- Windows PowerShell Script Block With Malicious String production
- Windows PowerShell Script TabExpansion Direct Call production
- Windows PowerShell WMI Win32 ScheduledJob production
- Windows PowerSploit GPP Discovery production
- Windows PowerView AD Access Control List Enumeration production
- Windows PowerView Constrained Delegation Discovery production
- Windows PowerView Kerberos Service Ticket Request production
- Windows PowerView SPN Discovery production
- Windows PowerView Unconstrained Delegation Discovery production
- Windows Process Copied from System Folder (PowerShell)
- Windows Root Domain linked policies Discovery production
- Windows Screen Capture Via Powershell production
- Windows Service Started (PowerShell)
- Windows Software Discovery Via PowerShell production
- Windows WinPEAS PowerShell Script Execution production
- WinLogon Registry Key Modified (PowerShell)
- WinRM Tools (PowerShell)
- WMI Recon Running Process Or Services production
- WMIC Host Reconniassance (PowerShell)
- Wow6432Node Classes Autorun Keys Modification (PowerShell)
- Wscript_Cscript Execution (PowerShell)
Microsoft-Windows-TaskScheduler
Microsoft-Windows-WMI-Activity
Application-Error
MSExchange-CmdletLogs
Event ID 1 1 rule
Microsoft-Windows-AppxPackagingOM
Microsoft-Windows-CertificateServicesClient-Lifecycle-System
Event ID 1007: A certificate has been exported. 1 rule
- Windows Export Certificate production