Splunk rule coverage

149 events across 21 providers with Splunk detection rules, 2923 rule mappings total. Each rule links to its own page (predicates, exclusions, shared indicators). For the rule-centric ATT&CK browse across every vendor, see all detection rules; non-Windows Splunk rules are grouped by platform and technique at Splunk non-Windows coverage.

Microsoft-Windows-Sysmon 21 events, 1310 rules

Event ID 1 Process creation 826 rules

.msc Executed from Unusual Location (Sysmon) (source)
3CXDesktopApp.exe Execution (EDR) (source)
3CXDesktopApp.exe Execution (Sysmon) (source)
7zip CommandLine To SMB Share Path production (source)
Abuse EQNEDT32.EXE (EDR) (source)
Abuse EQNEDT32.EXE (Sysmon) (source)
Access Common Package Config file (EDR) (source)
Access Common Package Config file (Sysmon) (source)
Account set to active via Net.exe (EDR) (source)
Account set to active via Net.exe (Sysmon) (source)
Add or Set Windows Defender Exclusion production (source)
ADExplorer Execution (Sysmon) (source)
ADExplorer Snapshot Creation (Sysmon) (source)
Adfind Commands (Sysmon) (source)
Adfind Execution (EDR) (source)
Adfind Execution (Sysmon) (source)
Advanced IP or Port Scanner Execution production (source)
Advanced IP Scanner Execution (Sysmon) (source)
Advanced Port Scanner Execution (Sysmon) (source)
Allow File And Printing Sharing In Firewall production (source)
Allow Network Discovery In Firewall production (source)
Anomalous usage of 7zip production (source)
AnyDesk Command Line Execution (Sysmon) (source)
AnyDesk Execution from Suspicious Folder (Sysmon) (source)
AnyDesk Silent Install (Sysmon) (source)
Application Discovery - Windows (Sysmon) (source)
ATBroker.exe Execution (Sysmon) (source)
Attacker Tools On Endpoint production (source)
Attempted Veeam Database Credential Dump (Sysmon) (source)
Attrib.exe Metasploit File Dropper (EDR) (source)
Attrib.exe Metasploit File Dropper (Sysmon) (source)
AutoHotkey Execution (Sysmon) (source)
AutoIt Execution (Sysmon) (source)
Bash -c Execution - Windows (Sysmon) (source)
Bcdedit Command Back To Normal Mode Boot production (source)
BCDEdit Failure Recovery Modification production (source)
BITS Job Persistence production (source)
BITSAdmin Download File production (source)
BITSadmin Execution (Sysmon) (source)
BitsAdmin NetCat PowerCat File Transfer (EDR) (source)
BitsAdmin NetCat PowerCat File Transfer (Sysmon) (source)
Browser Started with Remote Debugging - Windows (Sysmon) (source)
CDB Execution (Sysmon) (source)
Certificate Abuse - Windows (Sysmon) (source)
Certutil De-Obfuscate_Decode Files (Sysmon) (source)
Certutil exe certificate extraction production (source)
Certutil Execution (Sysmon) (source)
Certutil File Download (Sysmon) (source)
Certutil Obfuscate_Encode Files (EDR) (source)
Certutil Obfuscate_Encode Files (Sysmon) (source)
CertUtil With Decode Argument production (source)
Change To Safe Mode With Network Config production (source)
Check Elevated CMD using whoami production (source)
Child Processes of Spoolsv exe experimental (source)
Cipher.exe Execution (Sysmon) (source)
Clear Unallocated Sector Using Cipher App production (source)
Clop Common Exec Parameter production (source)
CMD Carry Out String Command Parameter production (source)
CMD Echo Pipe - Escalation production (source)
CMD execution with _c (Sysmon) (source)
Cmstp Execution (Sysmon) (source)
Command Line .cmd Execution (Sysmon) (source)
Command Line Homoglyphs - Windows (Sysmon) (source)
Command Line lsass request (Sysmon) (source)
Command Line Spawned by Archive Utility - Windows (Sysmon) (source)
Command Line Utility Added to Accessibility Features (Sysmon) (source)
Command-Line Interface Execution (Sysmon) (source)
Common Active Directory Commands (Sysmon) (source)
Common Recon Commands in Short Burst (Sysmon) (source)
Common Reconnaissance Commands (Sysmon) (source)
ComputerDefaults UAC Bypass (Sysmon) (source)
comsvcs.dll Lsass Memory Dump (Sysmon) (source)
Conhost.exe Kernel call (Sysmon) (source)
Consent.exe Suspicious Child Process (Sysmon) (source)
ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon) (source)
Conti Common Exec parameter production (source)
Control Loading from World Writable Directory production (source)
Control Panel Abuse (Sysmon) (source)
Control_RunDLL Call from Command Line (Sysmon) (source)
Create or delete windows shares using net exe production (source)
Create_Add Local_Domain User (EDR) (source)
Create_Add Local_Domain User (Sysmon) (source)
Create_Modify Schtasks (Sysmon) (source)
Creation of Shadow Copy production (source)
Creation of Shadow Copy with wmic and powershell production (source)
Credential Dumping via Copy Command from Shadow Copy production (source)
Credential Dumping via Symlink to Shadow Copy production (source)
CSC Execution (EDR) (source)
CSC Net On The Fly Compilation production (source)
CSVDE Export Active Directory (Sysmon) (source)
Curl Execution with Percent Encoded URL production (source)
CVE-2022-30190: Microsoft Office Code Execution Vulnerability (EDR) (source)
CVE-2022-30190: Microsoft Office Code Execution Vulnerability (Sysmon) (source)
Data Exfiltration via AWS CLI - Windows (Sysmon) (source)
Data Staged to File (Sysmon) (source)
Defender Registry Values Modified (Sysmon) (source)
Deleting Shadow Copies production (source)
Detect AzureHound Command-Line Arguments production (source)
Detect Certify Command Line Arguments production (source)
Detect HTML Help Renamed production (source)
Detect HTML Help Spawn Child Process production (source)
Detect HTML Help URL in Command Line production (source)
Detect HTML Help Using InfoTech Storage Handlers production (source)
Detect mshta inline hta execution production (source)
Detect mshta renamed production (source)
Detect MSHTA Url in Command Line production (source)
Detect Outlook exe writing a zip file production (source)
Detect Path Interception By Creation Of program exe production (source)
Detect Prohibited Applications Spawning cmd exe production (source)
Detect PsExec With accepteula Flag production (source)
Detect Rare Executables production (source)
Detect RClone Command-Line Usage production (source)
Detect Regasm Spawning a Process production (source)
Detect Regasm with no Command Line Arguments production (source)
Detect Regsvcs Spawning a Process production (source)
Detect Regsvcs with No Command Line Arguments production (source)
Detect Regsvr32 Application Control Bypass production (source)
Detect Remote Access Software Usage FileInfo production (source)
Detect Remote Access Software Usage Process production (source)
Detect Renamed 7-Zip production (source)
Detect Renamed PSExec production (source)
Detect Renamed RClone production (source)
Detect Renamed WinRAR production (source)
Detect RTLO In Process production (source)
Detect Rundll32 Inline HTA Execution production (source)
Detect SharpHound Command-Line Arguments production (source)
Detect SharpHound Usage production (source)
Detect Use of cmd exe to Launch Script Interpreters production (source)
Detection of tools built by NirSoft experimental (source)
Disable Logs Using WevtUtil production (source)
Disable Schedule Task production (source)
Disabling Firewall with Netsh production (source)
Discovery using CHCP (Sysmon) (source)
DLL Called with RS32 (Sysmon) (source)
DLL Called with Uncommon Function (Sysmon) (source)
DLL Concatenation (Sysmon) (source)
DLL Execution from Uncommon Process (Sysmon) (source)
DLLHost with no Command Line Arguments with Network production (source)
DLLRegisterServer Called from Command Line (Sysmon) (source)
DNS Exfiltration Using Nslookup App production (source)
Domain Account Discovery with Dsquery production (source)
Domain Account Discovery with Wmic production (source)
Domain Controller Discovery with Nltest production (source)
Domain Controller Discovery with Wmic production (source)
Domain Controller Enumeration via nltest (Sysmon) (source)
Domain Group Discovery With Dsquery production (source)
Domain Group Discovery With Wmic production (source)
DSQuery Domain Discovery production (source)
Dump File Identified (Sysmon) (source)
Dump LSASS via comsvcs DLL production (source)
Dump LSASS via procdump production (source)
Elevated Group Discovery With Wmic production (source)
EnableLUA Registry Value Modified (Sysmon) (source)
Encoded Powershell Command (Sysmon) (source)
Esentutl Execution (Sysmon) (source)
Esentutl SAM Copy production (source)
Esentutl.exe Collecting Browser Data (Sysmon) (source)
Event Logs Queried for RDP Sessions (Sysmon) (source)
Excessive Attempt To Disable Services production (source)
Excessive distinct processes from Windows Temp production (source)
Excessive number of service control start as disabled production (source)
Excessive number of taskhost processes production (source)
Excessive Usage Of Cacls App production (source)
Excessive Usage of NSLOOKUP App production (source)
Excessive Usage Of SC Service Utility production (source)
Excessive Usage Of Taskkill production (source)
Executable Create Script Process (Sysmon) (source)
Executable Process from Suspicious Folder (Sysmon) (source)
Execute Javascript With Jscript COM CLSID production (source)
Execution from Startup Folder (Sysmon) (source)
Execution of File with Multiple Extensions production (source)
Exfiltration via curl.exe - Windows (Sysmon) (source)
Expand.exe Execution (Sysmon) (source)
Explorer Child Process with Suspicious Command Line Padding (Sysmon) (source)
File and Directory Discovery Output to File - Windows (Sysmon) (source)
File Download or Read to Pipe Execution production (source)
File Executed from INetCache (Sysmon) (source)
File_Folder Hidden - Windows (Sysmon) (source)
Finger Execution (Sysmon) (source)
Firewall Allowed Program Enable production (source)
First Time Seen Child Process of Zoom experimental (source)
FodHelper UAC Bypass production (source)
FScan.exe Network Scan (Sysmon) (source)
Fsutil fsinfo execution (EDR) (source)
Fsutil Zeroing File production (source)
Full Control Permissions Granted to Everyone - Windows (Sysmon) (source)
Get ADDefaultDomainPasswordPolicy with Powershell production (source)
Get ADUser with PowerShell production (source)
Get ADUserResultantPasswordPolicy with Powershell production (source)
Get DomainPolicy with Powershell production (source)
Get DomainUser with PowerShell production (source)
Get WMIObject Group Discovery production (source)
Get-DomainTrust with PowerShell production (source)
Get-ForestTrust with PowerShell production (source)
GetAdComputer with PowerShell production (source)
GetAdGroup with PowerShell production (source)
GetCurrent User with PowerShell production (source)
GetDomainComputer with PowerShell production (source)
GetDomainController with PowerShell production (source)
GetDomainGroup with PowerShell production (source)
GetLocalUser with PowerShell production (source)
GetNetTcpconnection with PowerShell production (source)
GetWmiObject Ds Computer with PowerShell production (source)
GetWmiObject Ds Group with PowerShell production (source)
GetWmiObject DS User with PowerShell production (source)
GetWmiObject User Account with PowerShell production (source)
Git Hooks Spawn System32 Process (Sysmon) (source)
Git Spawns System32 Process (Sysmon) (source)
Git Submodule Cloned - Windows (Sysmon) (source)
Go Run Execution (Sysmon) (source)
GPUpdate with no Command Line Arguments with Network production (source)
Group Policy Editor Execution (Sysmon) (source)
Headless Browser Mockbin or Mocky Request production (source)
Headless Browser Usage production (source)
hh.exe Execution (Sysmon) (source)
hh.exe Remote File Execution (Sysmon) (source)
Hidden User Created - Windows (Sysmon) (source)
Hiding Files And Directories With Attrib exe production (source)
Hunting 3CXDesktopApp Software production (source)
Icacls Deny Command production (source)
ICACLS Grant Command production (source)
IcedID Discovery Commands (EDR) (source)
IcedID Discovery Commands (Sysmon) (source)
Impacket atexec.py Execution (Sysmon) (source)
Impacket Lateral Movement Activity (Sysmon) (source)
Impacket Lateral Movement Commandline Parameters production (source)
Impacket Lateral Movement smbexec CommandLine Parameters production (source)
Impacket Lateral Movement WMIExec Commandline Parameters production (source)
Indirect Command Execution (Sysmon) (source)
Invoke-DCOM.ps1 - PowerShell (Sysmon) (source)
Invoke-Expression Command (Sysmon) (source)
Invoke-WebRequest Command (Sysmon) (source)
Jscript Execution Using Cscript App production (source)
Known Process Injection Commands (Sysmon) (source)
Live Sysinternals Execution (Sysmon) (source)
Local Account Discovery With Wmic production (source)
LocalAccountTokenFilterPolicy Registry Value Modified (Sysmon) (source)
Locate Credentials (Sysmon) (source)
Logon Script Registry Key added (EDR) (source)
Logon Script Registry Key added (Sysmon) (source)
MacOS - Re-opened Applications experimental (source)
Malicious Document Execution (Sysmon) (source)
Malicious PowerShell Process - Encoded Command production (source)
Malicious PowerShell Process - Execution Policy Bypass production (source)
Malicious PowerShell Process With Obfuscation Techniques production (source)
masscan Execution - Windows (Sysmon) (source)
Mavinject Execution (EDR) (source)
Mavinject Execution (Sysmon) (source)
Mega Utility Execution - Windows (Sysmon) (source)
Microsoft Build Engine Suspicious Parent Process (Sysmon) (source)
Microsoft Diagnostic Tool "DogWalk" Package Path Traversal (EDR) (source)
Microsoft Diagnostic Tool "DogWalk" Package Path Traversal (Sysmon) (source)
Microsoft SQL Server Suspicious Child Process - Windows (Sysmon) (source)
Mimikatz (Sysmon) (source)
Mimikatz PassTheTicket CommandLine Parameters production (source)
Mmc LOLBAS Execution Process Spawn production (source)
Mock System Directory - Windows (Sysmon) (source)
Modify ACL permission To Files Or Folder production (source)
Modify Windows Defender (EDR) (source)
Modify Windows Defender (Sysmon) (source)
MS Exchange Mailbox Replication service writing Active Server Pages experimental (source)
MSBuild Suspicious Spawned By Script Process production (source)
Mshta spawning Rundll32 OR Regsvr32 Process production (source)
MSHTA.exe execution (Sysmon) (source)
mshta.exe File Download (Sysmon) (source)
MSI Installation via Appcert (Sysmon) (source)
Msiexec Abuse (Sysmon) (source)
MSIExec Install MSI File (Sysmon) (source)
MSIExec.exe Execution (Sysmon) (source)
MSTSC Execution (EDR) (source)
Msxsl Execution (EDR) (source)
Msxsl Execution (Sysmon) (source)
MultiDump.exe Execution (Sysmon) (source)
Multiple nslookup commands (Sysmon) (source)
Native Archive Commands (Sysmon) (source)
Net.exe Use with URL (Sysmon) (source)
Network Connection Discovery With Arp production (source)
Network Connection Discovery With Netstat production (source)
Network Discovery Using Route Windows App production (source)
ngen.exe File Download (Sysmon) (source)
ngrok Execution - Windows (Sysmon) (source)
NirCmd Execution (Sysmon) (source)
Nishang PowershellTCPOneLine production (source)
NLTest Domain Trust Discovery production (source)
NMAP Execution (EDR) (source)
Notepad with no Command Line Arguments production (source)
ntds.dit Access from Unexpected Location (Sysmon) (source)
ntds.dit Command Line (Sysmon) (source)
Ntdsutil Export NTDS production (source)
NTDSUtil.exe execution (Sysmon) (source)
Office Spawns Suspicious Child Process (Sysmon) (source)
Outbound Network Connection from Java Using Default Ports production (source)
Package installation (Sysmon) (source)
Parent in Public Folder Suspicious Process (Sysmon) (source)
Permission Groups Discovery: Domain Groups (Sysmon) (source)
Permission Groups Discovery: Local Groups (Sysmon) (source)
Permission Modification using Takeown App production (source)
Permissions Replaced by icacls - Windows (Sysmon) (source)
Ping Sleep Batch Command production (source)
Possible Browser Pass View Parameter production (source)
Possible Lateral Movement PowerShell Spawn production (source)
Potential AutoHotkey .ahk Execution (Sysmon) (source)
Potential Cryptomining Commands (Sysmon) (source)
Potential CVE-2023-23397 (EDR) (source)
Potential CVE-2023-23397 (Sysmon) (source)
Potential Executable Masquerading as Document - Windows (Sysmon) (source)
Potential fodhelper UAC Bypass Attempt (Sysmon) (source)
Potential PowerShell Post-Exploitation Activity (Sysmon) (source)
Potential Proxy Malware via AutoRun Key (Sysmon) (source)
Potential Sysinternals Tool Execution (Sysmon) (source)
Potential System Network Configuration Discovery Activity production (source)
Potential Telegram API Request Via CommandLine production (source)
PowerHuntShares Commands (Sysmon) (source)
PowerShell - Connect To Internet With Hidden Window production (source)
PowerShell CreateDecryptor (Sysmon) (source)
Powershell Disable Security Monitoring production (source)
PowerShell DownloadFile_DownloadString (Sysmon) (source)
PowerShell Get LocalGroup Discovery production (source)
PowerShell Modifying Registry Values (Sysmon) (source)
PowerShell Start-BitsTransfer production (source)
PowerShell XML Retrieval (Sysmon) (source)
Prevent Automatic Repair Mode using Bcdedit production (source)
ProcDump Credential Harvest (Sysmon) (source)
Process Creation Using Sysnative Folder (Sysmon) (source)
Process Deleting Its Process File Path production (source)
Process Executed from Downloads Folder - Windows (Sysmon) (source)
Process Executed with Null Command Line (Sysmon) (source)
Process Execution From Suspicious Folder (Sysmon) (source)
Process Execution via WMI production (source)
Process Kill Base On File Path production (source)
PromptOnSecureDesktop Registry Value Modified (Sysmon) (source)
ProtocolHandler.exe File Download (Sysmon) (source)
Proxy Execution via Appcert (Sysmon) (source)
PuTTY Secure Copy Client Execution (Sysmon) (source)
QEMU Network Tunneling - Windows (Sysmon) (source)
Radmin execution (EDR) (source)
Radmin execution (Sysmon) (source)
Rare executable from Microsoft Office (Sysmon) (source)
Rare Process Execution (Sysmon) (source)
Rclone Execution (Sysmon) (source)
RDP Enabled (Sysmon) (source)
RDP File Executed from Outlook Temp Directory (Sysmon) (source)
RdrLeakDiag.exe Memory Dump (Sysmon) (source)
Read-Only Attribute Removed - Windows (Sysmon) (source)
Recursive Delete of Directory In Batch CMD production (source)
Reg exe Manipulating Windows Services Registry Keys production (source)
Reg.exe Process Execution (Sysmon) (source)
Regini.exe Execution (Sysmon) (source)
Registry key added with reg.exe (Sysmon) (source)
regsvr32 Execution (Sysmon) (source)
regsvr32 Referencing Unusual Paths (Sysmon) (source)
Regsvr32 Silent and Install Param Dll Loading production (source)
Regsvr32 with Known Silent Switch Cmdline production (source)
Remote .msi Installation (Sysmon) (source)
Remote .msi Installation (Sysmon) (source)
Remote Access Software Execution (Sysmon) (source)
Remote Admin Tools (EDR) (source)
Remote Admin Tools (Sysmon) (source)
Remote Desktop Process Running On System experimental (source)
Remote Process Instantiation via DCOM and PowerShell production (source)
Remote Process Instantiation via WinRM and PowerShell production (source)
Remote Process Instantiation via WinRM and Winrs production (source)
Remote Process Instantiation via WMI production (source)
Remote Process Instantiation via WMI and PowerShell production (source)
Remote Share Directory Listing - Windows (Sysmon) (source)
Remote System Discovery with Dsquery production (source)
Remote System Discovery with Wmic production (source)
Remote WMI Command Attempt production (source)
Renamed Process (Sysmon) (source)
Resize ShadowStorage volume production (source)
Revil Common Exec Parameter production (source)
Rubeus Command Line Parameters production (source)
Rubeus Commands (Sysmon) (source)
Runas Execution in CommandLine production (source)
RunDLL Loading DLL By Ordinal production (source)
Rundll32 Command Line (Sysmon) (source)
Rundll32 Control RunDLL Hunt production (source)
Rundll32 Control RunDLL World Writable Directory production (source)
Rundll32 LockWorkStation production (source)
Rundll32 Shimcache Flush production (source)
Rundll32 Spawned by Disk Cleanup (Sysmon) (source)
Rundll32 Suspicious Command Line (Sysmon) (source)
rundll32 Suspicious Parent Process (Sysmon) (source)
Rundll32 with no Command Line Arguments with Network production (source)
rundll32 with No DLL in Command Line (Sysmon) (source)
Rundll32.exe as Parent Process (Sysmon) (source)
rundll32.exe Executing DLL from Non-standard Directory (Sysmon) (source)
Ryuk Wake on LAN Command production (source)
Scheduled Task Creation on Remote Endpoint using At production (source)
Scheduled Task Deleted Or Created via CMD production (source)
Scheduled Task Initiation on Remote Endpoint production (source)
Scheduled Task with Potential SSH Tunnel - Windows (Sysmon) (source)
Schtasks Run Task On Demand production (source)
Schtasks scheduling job on remote system production (source)
Schtasks used for forcing a reboot production (source)
Script Execution via WMI production (source)
Sdelete Application Execution production (source)
SearchProtocolHost with no Command Line with Network production (source)
SecretDumps Offline NTDS Dumping Tool production (source)
Security Software Discovery via Findstr.exe (Sysmon) (source)
Security Software Discovery via WMI (Sysmon) (source)
Service Stop Commands (Sysmon) (source)
ServicePrincipalNames Discovery with SetSPN production (source)
Services Escalate Exe production (source)
Services LOLBAS Execution Process Spawn production (source)
Shim Database Installation With Suspicious Parameters production (source)
SimpleHelp Remote Access Tool Execution (Sysmon) (source)
Single Letter Process On Endpoint production (source)
Sliver C2 Implant Activity Pattern (Sysmon) (source)
SLUI RunAs Elevated production (source)
SLUI Spawning a Process production (source)
SoftPerfect Network Scanner Execution (Sysmon) (source)
Spoolsv Spawning Rundll32 production (source)
Spoolsv Writing a DLL production (source)
ssh.exe Execution (Sysmon) (source)
Suspicious AteraAgent Installation - Windows (Sysmon) (source)
Suspicious Child Process for hh.exe (Sysmon) (source)
Suspicious Child Process for lsass.exe (Sysmon) (source)
Suspicious Child Process for mshta.exe (Sysmon) (source)
Suspicious ComputerDefaults.exe Execution (Sysmon) (source)
Suspicious Confluence Child Process - Windows (Sysmon) (source)
Suspicious Conhost.exe Commands (Sysmon) (source)
Suspicious Copy on System32 production (source)
Suspicious csc.exe Source File Folder (Sysmon) (source)
Suspicious Curl Network Connection experimental (source)
Suspicious DLLhost Execution (EDR) (source)
Suspicious DLLHost no Command Line Arguments production (source)
Suspicious Executable by CMD.exe (Sysmon) (source)
Suspicious Executable by Powershell (EDR) (source)
Suspicious Executable by Powershell (Sysmon) (source)
Suspicious Execution of Accessibility Tool Debuggers (Sysmon) (source)
Suspicious Execution via Microsoft Common Console (Sysmon) (source)
Suspicious GPUpdate no Command Line Arguments production (source)
Suspicious IcedID Rundll32 Cmdline production (source)
Suspicious Image Creation In Appdata Folder production (source)
Suspicious InprocServer32 Registry Modification (Sysmon) (source)
Suspicious microsoft workflow compiler rename production (source)
Suspicious microsoft workflow compiler usage production (source)
Suspicious msbuild path production (source)
Suspicious MSBuild Rename production (source)
Suspicious MSBuild Spawn production (source)
Suspicious mshta child process production (source)
Suspicious mshta spawn production (source)
Suspicious ntds.dit Commands (Sysmon) (source)
Suspicious Parent Process for lsass.exe or services.exe (Sysmon) (source)
Suspicious Parent Process for msiexec.exe (Sysmon) (source)
Suspicious Parent Process for spoolsv.exe (Sysmon) (source)
Suspicious PlistBuddy Usage experimental (source)
Suspicious PowerShell Clipboard Activity (Sysmon) (source)
Suspicious PowerShell Parameter Substring (Sysmon) (source)
Suspicious Process Executed From Container File production (source)
Suspicious reCAPTCHA Command Line (Sysmon) (source)
Suspicious Reg exe Process production (source)
Suspicious Regsvr32 Register Suspicious Path production (source)
Suspicious Rundll32 dllregisterserver production (source)
Suspicious Rundll32 no Command Line Arguments production (source)
Suspicious Rundll32 PluginInit production (source)
Suspicious Rundll32 StartW production (source)
Suspicious Scheduled Task from Public Directory production (source)
Suspicious SearchProtocolHost no Command Line Arguments production (source)
Suspicious SQLite3 LSQuarantine Behavior experimental (source)
Suspicious WAV file in Appdata Folder production (source)
Suspicious wevtutil Usage production (source)
Suspicious writes to windows Recycle Bin production (source)
Svchost LOLBAS Execution Process Spawn production (source)
System Enumeration with WMIC (Sysmon) (source)
System Info Gathering Using Dxdiag Application production (source)
System Information Discovery - Windows (Sysmon) (source)
System Information Discovery Detection production (source)
System Network Connections Discovery - Windows (Sysmon) (source)
System Owner_User Discovery - Windows (Sysmon) (source)
System Processes Run From Unexpected Locations production (source)
System User Discovery With Query production (source)
System User Discovery With Whoami production (source)
Temporary File Executed from Public Folder (Sysmon) (source)
Tunneling Process Created (Sysmon) (source)
Uninstall App Using MsiExec production (source)
Unknown Process Using The Kerberos Protocol production (source)
Unload Sysmon Filter Driver production (source)
Unusual AppCert Child Process (Sysmon) (source)
Unusual svchost Child Process (Sysmon) (source)
Unusual winlogon.exe Child Process (Sysmon) (source)
Unusually Long Command Line experimental (source)
User Discovery With Env Vars PowerShell production (source)
User_Domain Enumeration Tool - Windows (Sysmon) (source)
USN Journal Deletion production (source)
Vbscript Execution Using Wscript App production (source)
Verclsid CLSID Execution production (source)
Visio.exe File Download (Sysmon) (source)
Visual Studio Code Tunnel Execution (Sysmon) (source)
WBAdmin Delete System Backups production (source)
WDigest Forced Credential Caching (Sysmon) (source)
Web or Application Server Spawning a Shell production (source)
Web Servers Executing Suspicious Processes experimental (source)
WebDAV LNK Execution (Sysmon) (source)
WebLogic CVE-2017-10271 (Sysmon) (source)
Wermgr Process Spawned CMD Or Powershell Process production (source)
Windows Account Access Removal via Logoff Exec production (source)
Windows AdFind Exe production (source)
Windows Admin$ Share Access (Sysmon) (source)
Windows Advanced Installer MSIX with AI_STUBS Execution production (source)
Windows Alternate DataStream - Process Execution production (source)
Windows Apache Benchmark Binary production (source)
Windows AppCertDLL Modification Via Command Line production (source)
Windows Application Whitelisting Bypass Attempt via Rundll32 production (source)
Windows Archive Collected Data via Rar production (source)
Windows Attempt To Stop Security Service production (source)
Windows Audit Policy Auditing Option Disabled via Auditpol production (source)
Windows Audit Policy Cleared via Auditpol production (source)
Windows Audit Policy Disabled via Auditpol production (source)
Windows Audit Policy Disabled via Legacy Auditpol production (source)
Windows Audit Policy Excluded Category via Auditpol production (source)
Windows Audit Policy Restored via Auditpol production (source)
Windows Audit Policy Security Descriptor Tampering via Auditpol production (source)
Windows AutoIt3 Execution production (source)
Windows Azure Storage Utility Execution Via CLI production (source)
Windows Binary Execution from an Archive experimental (source)
Windows Binary Proxy Execution Mavinject DLL Injection production (source)
Windows BitLocker Suspicious Command Usage production (source)
Windows BitLockerToGo Process Execution production (source)
Windows Browser Process Launched with Unusual Flags production (source)
Windows Bypass UAC via Pkgmgr Tool production (source)
Windows C$ Share Access (EDR) (source)
Windows C$ Share Access (Sysmon) (source)
Windows Cabinet File Extraction Via Expand production (source)
Windows Cached Domain Credentials Reg Query production (source)
Windows Certutil Root Certificate Addition production (source)
Windows Change File Association Command To Notepad production (source)
Windows Chrome Enable Extension Loading via Command-Line production (source)
Windows Chromium Browser Launched with Small Window Size production (source)
Windows Chromium Browser No Security Sandbox Process production (source)
Windows Chromium Browser with Custom User Data Directory production (source)
Windows Chromium process Launched with Disable Popup Blocking production (source)
Windows Chromium Process Launched with Logging Disabled production (source)
Windows Chromium Process Loaded Extension via Command-Line production (source)
Windows Chromium Process with Disabled Extensions production (source)
Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc production (source)
Windows Cisco Secure Endpoint Unblock File Via Sfc production (source)
Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc production (source)
Windows Cmdline Tool Execution From Non-Shell Process production (source)
Windows COM Hijacking InprocServer32 Modification production (source)
Windows Command and Scripting Interpreter Hunting Path Traversal production (source)
Windows Command and Scripting Interpreter Path Traversal Exec production (source)
Windows Command Obfuscation with Environment Variable Substrings production (source)
Windows Command Shell DCRat ForkBomb Payload production (source)
Windows Compatibility Telemetry Suspicious Child Process production (source)
Windows ComputerDefaults Spawning a Process production (source)
Windows ConHost with Headless Argument production (source)
Windows Copy Files (Sysmon) (source)
Windows Create Local Administrator Account Via Net production (source)
Windows Credential Dumping LSASS Memory Createdump production (source)
Windows Credential Target Information Structure in Commandline production (source)
Windows Credentials from Password Stores Creation production (source)
Windows Credentials from Password Stores Deletion production (source)
Windows Credentials from Password Stores Query production (source)
Windows Credentials in Registry Reg Query production (source)
Windows Crowdstrike RTR Script Execution production (source)
Windows Curl Download to Suspicious Path production (source)
Windows Curl Upload to Remote Destination production (source)
Windows Debugger Tool Execution production (source)
Windows Defacement Modify Transcodedwallpaper File production (source)
Windows Default Group Policy Object Modified with GPME production (source)
Windows Default RDP File Creation By Non MSTSC Process production (source)
Windows Default Rdp File Unhidden production (source)
Windows Defender ASR or Threat Configuration Tamper production (source)
Windows Defender Disabled Detection (EDR) (source)
Windows Delete or Modify System Firewall production (source)
Windows Deleted Registry By A Non Critical Process File Path production (source)
Windows Devtunnels Execution production (source)
Windows Disable Internet Explorer Addons production (source)
Windows Disable or Modify Tools Via Taskkill production (source)
Windows Disable or Stop Browser Process production (source)
Windows Disable Windows Event Logging Disable HTTP Logging production (source)
Windows DiskCryptor Usage production (source)
Windows Diskshadow Proxy Execution production (source)
Windows DISM Install PowerShell Web Access production (source)
Windows DISM Remove Defender production (source)
Windows DLL Search Order Hijacking with iscsicpl production (source)
Windows DLL Side-Loading Process Child Of Calc production (source)
Windows DNS Gather Network Info production (source)
Windows DotNet Binary in Non Standard Path production (source)
Windows EDRSilencer Execution production (source)
Windows EFI Volume Mount Attempt Via Mountvol production (source)
Windows Entra User Management Via Azure CLI production (source)
Windows ESX Admins Group Creation via Net production (source)
Windows Eventlog Cleared Via Wevtutil production (source)
Windows EventLog Recon Activity Using Log Query Utilities production (source)
Windows Excel Spawning Microsoft Project Application production (source)
Windows Excessive Service Stop Attempt production (source)
Windows Excessive Usage Of Net App production (source)
Windows Execute Arbitrary Commands with MSDT production (source)
Windows Execution of Microsoft MSC File In Suspicious Path production (source)
Windows Explorer LNK Exploit Process Launch With Padding production (source)
Windows Explorer.exe Spawning PowerShell or Cmd production (source)
Windows File and Directory Enable ReadOnly Permissions production (source)
Windows File and Directory Permissions Enable Inheritance production (source)
Windows File and Directory Permissions Remove Inheritance production (source)
Windows File Association Modification via Ftype production (source)
Windows File Collection Via Copy Utilities production (source)
Windows File Download Via CertUtil production (source)
Windows File Download Via PowerShell production (source)
Windows Files and Dirs Access Rights Modification Via Icacls production (source)
Windows Findstr GPP Discovery production (source)
Windows Firewall Disabled (Sysmon) (source)
Windows FTP Exfiltration (Sysmon) (source)
Windows Gdrive Binary Activity production (source)
Windows Get-Variable.EXE Execution from WindowsApps Folder production (source)
Windows Global Object Access Audit List Cleared Via Auditpol production (source)
Windows Group Discovery Via Net production (source)
Windows Guest Account Enabled Via Net.EXE production (source)
Windows HTTP Network Communication From MSIExec production (source)
Windows Identify Protocol Handlers production (source)
Windows IIS Components Add New Module production (source)
Windows Impair Defense Add Xml Applocker Rules production (source)
Windows Indicator Removal Via Rmdir production (source)
Windows Indirect Command Execution Via forfiles production (source)
Windows Indirect Command Execution Via pcalua production (source)
Windows Indirect Command Execution Via Series Of Forfiles production (source)
Windows Information Discovery Fsutil production (source)
Windows Ingress Tool Transfer Using Explorer production (source)
Windows InstallUtil in Non Standard Path production (source)
Windows InstallUtil Remote Network Connection production (source)
Windows InstallUtil Uninstall Option production (source)
Windows InstallUtil URL in Command Line production (source)
Windows IOBit Unlocker Extension DLL Registration via Regsvr32 production (source)
Windows IPC$ Share Access (Sysmon) (source)
Windows Ldifde Directory Object Behavior production (source)
Windows List ENV Variables Via SET Command From Uncommon Parent production (source)
Windows Local LLM Framework Execution production (source)
Windows LOLBAS Executed As Renamed File production (source)
Windows LOLBAS Executed Outside Expected Path production (source)
Windows Masquerading Explorer As Child Process production (source)
Windows Masquerading Msdtc Process production (source)
Windows Metasploit Confluence Plugin Execution production (source)
Windows Mimikatz Binary Execution production (source)
Windows Modify Registry Qakbot Binary Data Registry production (source)
Windows Modify Registry Regedit Silent Reg Import production (source)
Windows Modify System Firewall with Notable Process Path production (source)
Windows MOF Event Triggered Execution via WMI production (source)
Windows MpCmdRun RemoveDefinitions Execution production (source)
Windows MSC EvilTwin Directory Path Manipulation production (source)
Windows MSIExec DLLRegisterServer production (source)
Windows MsiExec HideWindow Rundll32 Execution production (source)
Windows MSIExec Remote Download production (source)
Windows MSIExec Spawn Discovery Command production (source)
Windows MSIExec Spawn WinDBG production (source)
Windows MSIExec Unregister DLLRegisterServer production (source)
Windows MSTSC RDP Commandline production (source)
Windows Mustang Panda USB Tool Execution production (source)
Windows Net System Service Discovery production (source)
Windows Netspy Network Scanner Execution production (source)
Windows Network Connection Discovery Via Net production (source)
Windows Network Share Interaction Via Net production (source)
Windows New Deny Permission Set On Service SD Via Sc.EXE production (source)
Windows New Service Security Descriptor Set Via Sc.EXE production (source)
Windows Ngrok Reverse Proxy Usage production (source)
Windows NirSoft AdvancedRun production (source)
Windows NirSoft Utilities production (source)
Windows NorthStar C2 Agent Execution production (source)
Windows Odbcconf Hunting production (source)
Windows Odbcconf Load DLL production (source)
Windows Odbcconf Load Response File production (source)
Windows Office Product Dropped Cab or Inf File production (source)
Windows Office Product Dropped Uncommon File production (source)
Windows Office Product Spawned Child Process For Download production (source)
Windows Office Product Spawned Control production (source)
Windows Office Product Spawned MSDT production (source)
Windows Office Product Spawned Rundll32 With No DLL production (source)
Windows Office Product Spawned Uncommon Process production (source)
Windows OneDrive Share Mounted via Net production (source)
Windows PaperCut NG Spawn Shell production (source)
Windows Parent PID Spoofing with Explorer production (source)
Windows Password Managers Discovery production (source)
Windows Password Policy Discovery with Net production (source)
Windows Phishing Outlook Drop Dll In FORM Dir production (source)
Windows Phishing PDF File Executes URL Link production (source)
Windows Potato Privilege Escalation Tool Execution production (source)
Windows Potential Cloudflared Tunnel Execution production (source)
Windows PowerShell FakeCAPTCHA Clipboard Execution production (source)
Windows PowerShell Process Implementing Manual Base64 Decoder production (source)
Windows PowerShell Process With Malicious String production (source)
Windows Powershell RemoteSigned File production (source)
Windows PowerShell Script From WindowsApps Directory production (source)
Windows PowGoop Beacon Decoding production (source)
Windows Private Keys Discovery production (source)
Windows Privilege Escalation Attempt Via MSI Rollback production (source)
Windows Privilege Escalation Suspicious Process Elevation production (source)
Windows Privilege Escalation System Process Without System Parent production (source)
Windows Privilege Escalation User Process Spawn System Process production (source)
Windows Process Commandline Discovery production (source)
Windows Process Copied from System Folder (Sysmon) (source)
Windows Process Executed From Removable Media production (source)
Windows Process Execution From ProgramData production (source)
Windows Process Execution From RDP Share production (source)
Windows Process Execution in Temp Dir production (source)
Windows Process Injection In Non-Service SearchIndexer production (source)
Windows Process Injection Wermgr Child Process production (source)
Windows Process Outside of System Folder (Sysmon) (source)
Windows Process With NamedPipe CommandLine production (source)
Windows Process With NetExec Command Line Parameters production (source)
Windows Protocol Tunneling with Plink production (source)
Windows Proxy Execution of .NET Utilities via Scripts production (source)
Windows Proxy Via Netsh production (source)
Windows PsTools Recon Usage production (source)
Windows PuTTY Suite Utility Execution production (source)
Windows Raccine Scheduled Task Deletion production (source)
Windows Rasautou DLL Execution production (source)
Windows RDP Client Launched with Admin Session production (source)
Windows RDP File Execution production (source)
Windows Registry Entries Exported Via Reg production (source)
Windows Registry Entries Restored Via Reg production (source)
Windows Regsvr32 Renamed Binary production (source)
Windows Remote Assistance Spawning Process production (source)
Windows Remote Create Service production (source)
Windows Remote Host Computer Management Access production (source)
Windows Remote Management Execute Shell production (source)
Windows Remote Service Rdpwinst Tool Execution production (source)
Windows Remote Services Allow Rdp In Firewall production (source)
Windows Renamed Powershell Execution production (source)
Windows RMM Tool Execution production (source)
Windows Rundll32 Apply User Settings Changes production (source)
Windows Rundll32 Execution With Log.DLL production (source)
Windows Rundll32 Load DLL in Temp Dir production (source)
Windows Rundll32 WebDAV Request production (source)
Windows Rundll32 WebDav With Network Connection production (source)
Windows Rundll32 with Non-Standard File Extension production (source)
Windows Scheduled Task Created Via XML production (source)
Windows Scheduled Task Service Spawned Shell production (source)
Windows Scheduled Task with Highest Privileges production (source)
Windows Schtasks Create Run As System production (source)
Windows ScManager Security Descriptor Tampering Via Sc.EXE production (source)
Windows Security Account Manager Stopped production (source)
Windows Security Support Provider Reg Query production (source)
Windows Sensitive Group Discovery With Net production (source)
Windows Sensitive Registry Hive Dump Via CommandLine production (source)
Windows Server Software Component GACUtil Install to GAC production (source)
Windows Service Create Kernel Mode Driver production (source)
Windows Service Create with Tscon production (source)
Windows Service Created (Sysmon) (source)
Windows Service Creation on Remote Endpoint production (source)
Windows Service Execution RemCom production (source)
Windows Service Initiation on Remote Endpoint production (source)
Windows Service Started (Sysmon) (source)
Windows Service Stop Attempt production (source)
Windows Service Stop By Deletion production (source)
Windows Set Account Password Policy To Unlimited Via Net production (source)
Windows Set Custom DNS ServerLevelPlugin Via Dnscmd production (source)
Windows Shell or Script Execution From IIS Directory production (source)
Windows Shell Process from CrushFTP production (source)
Windows SOAPHound Binary Execution production (source)
Windows SoftEther VPN Masquerading as Legitimate Binary production (source)
Windows Spearphishing Attachment Onenote Spawn Mshta production (source)
Windows SpeechRuntime Suspicious Child Process production (source)
Windows SQL Spawning CertUtil experimental (source)
Windows SQLCMD Execution production (source)
Windows Sqlservr Spawning Shell production (source)
Windows SSH Proxy Command production (source)
Windows Steal Authentication Certificates CertUtil Backup production (source)
Windows Steal Authentication Certificates Export Certificate production (source)
Windows Steal Authentication Certificates Export PfxCertificate production (source)
Windows Steal or Forge Kerberos Tickets Klist production (source)
Windows SubInAcl Execution production (source)
Windows Suspicious Child Process Spawned From WebServer production (source)
Windows Suspicious Process File Path production (source)
Windows Suspicious QEMU Execution production (source)
Windows Suspicious React or Next.js Child Process production (source)
Windows Suspicious VMWare Tools Child Process production (source)
Windows Svchost.exe Parent Process Anomaly production (source)
Windows SymbolicLink-Testing-Tools Utility Execution production (source)
Windows Symlink Evaluation Change via Fsutil production (source)
Windows System Binary Proxy Execution Compiled HTML File Decompile production (source)
Windows System Discovery Using ldap Nslookup production (source)
Windows System Discovery Using Qwinsta production (source)
Windows System LogOff Commandline production (source)
Windows System Network Config Discovery Display DNS production (source)
Windows System Network Connections Discovery Netsh production (source)
Windows System Reboot CommandLine production (source)
Windows System Remote Discovery With Query production (source)
Windows System Script Proxy Execution Syncappvpublishingserver production (source)
Windows System Shutdown CommandLine production (source)
Windows System Time Discovery W32tm Delay production (source)
Windows System User Discovery Via Quser production (source)
Windows System User Privilege Discovery production (source)
Windows TeamCity Payload Execution from Temp Directory production (source)
Windows Time Based Evasion production (source)
Windows Time Based Evasion via Choice Exec production (source)
Windows TinyCC Shellcode Execution production (source)
Windows TOR Client Execution production (source)
Windows UAC Bypass Suspicious Child Process production (source)
Windows UAC Bypass Suspicious Escalation Behavior production (source)
Windows Unusual SysWOW64 Process Run System32 Executable production (source)
Windows User Deletion Via Net production (source)
Windows User Disabled Via Net production (source)
Windows User Discovery Via Net production (source)
Windows Vulnerable 3CX Software production (source)
Windows WBAdmin File Recovery From Backup production (source)
Windows WinDBG Spawning AutoIt3 production (source)
Windows WinLogon with Public Network Connection production (source)
Windows WinRAR Launched Outside Default Installation Directory production (source)
Windows WMI Process And Service List production (source)
Windows WMI Process Call Create production (source)
Windows WMI Reconnaissance Class Query production (source)
Windows Wmic CPU Discovery production (source)
Windows Wmic DiskDrive Discovery production (source)
Windows Wmic Memory Chip Discovery production (source)
Windows Wmic Network Discovery production (source)
Windows WMIC Shadowcopy Delete production (source)
Windows Wmic Systeminfo Discovery production (source)
Windows WSUS Spawning Shell production (source)
Winhlp32 Spawning a Process production (source)
WinRAR Spawning Shell Application production (source)
WinRM Spawning a Process experimental (source)
WinRM Tools (Sysmon) (source)
WMI subscription execution (Sysmon) (source)
WMIC Explicit Credentials (Sysmon) (source)
Wmic Group Discovery production (source)
WMIC Host Reconniassance (Sysmon) (source)
Wmic NonInteractive App Uninstallation production (source)
WMIC XSL Execution via URL production (source)
Wmiprvse LOLBAS Execution Process Spawn production (source)
WmiPrvSE Suspicious Child Process (Sysmon) (source)
Wow6432Node Classes Autorun Keys Modification (Sysmon) (source)
Wscript Or Cscript Suspicious Child Process production (source)
Wscript_Cscript Execution (Sysmon) (source)
Wsmprovhost LOLBAS Execution Process Spawn production (source)
XSL Script Execution With WMIC production (source)

Event ID 3 Network connection 31 rules

Event ID 5 Process terminated 2 rules

High Process Termination Frequency production (source)
Windows Processes Killed By Industroyer2 Malware production (source)

Event ID 6 Driver loaded 5 rules

Driver Loaded from Unusual Path - Windows (Sysmon) (source)
Windows Drivers Loaded by Signature production (source)
Windows Suspicious Driver Loaded Path production (source)
Windows Vulnerable Driver Loaded production (source)
XMRIG Driver Loaded production (source)

Event ID 7 Image loaded 38 rules

CMLUA Or CMSTPLUA UAC Bypass production (source)
Loading Of Dynwrapx Module production (source)
MS Scripting Process Loading Ldap Module production (source)
MS Scripting Process Loading WMI Module production (source)
MSI Module Loaded by Non-System Binary production (source)
Potential Follina_DogWalk Activity - mdst.exe (Sysmon) (source)
Spoolsv Suspicious Loaded Modules production (source)
Sunburst Correlation DLL and Network Event experimental (source)
UAC Bypass MMC Load Unsigned Dll production (source)
UAC Bypass With Colorui COM Object production (source)
Wbemprox COM Object Execution production (source)
Windows BitDefender Submission Wizard DLL Sideloading experimental (source)
Windows Credentials Access via VaultCli Module production (source)
Windows Devtunnels Image Loaded production (source)
Windows DLL Module Loaded in Temp Dir production (source)
Windows DLL Search Order Hijacking Hunt with Sysmon production (source)
Windows DLL Side-Loading In Calc production (source)
Windows Executable in Loaded Modules production (source)
Windows Gather Victim Identity SAM Info production (source)
Windows Hijack Execution Flow Version Dll Side Load production (source)
Windows Input Capture Using Credential UI Dll production (source)
Windows InstallUtil Credential Theft production (source)
Windows Known Abused DLL Loaded Suspiciously production (source)
Windows Known GraphicalProton Loaded Modules production (source)
Windows MMC Loaded Script Engine DLL production (source)
Windows NetSupport RMM DLL Loaded By Uncommon Process production (source)
Windows Office Product Loaded MSHTML Module production (source)
Windows Office Product Loading Taskschd DLL production (source)
Windows Office Product Loading VBE7 DLL production (source)
Windows Remote Access Software BRC4 Loaded Dll production (source)
Windows Remote Image Load production (source)
Windows Scheduled Task DLL Module Loaded production (source)
Windows SpeechRuntime COM Hijacking DLL Load production (source)
Windows SqlWriter SQLDumper DLL Sideload production (source)
Windows Unsigned DLL Side-Loading production (source)
Windows Unsigned DLL Side-Loading In Same Process Path production (source)
Windows Unsigned MS DLL Side-Loading production (source)
Windows Unusual Process Load Mozilla NSS-Mozglue Module production (source)

Event ID 8 CreateRemoteThread 11 rules

Event ID 9 RawAccessRead 2 rules

Windows Raw Access To Disk Volume Partition production (source)
Windows Raw Access To Master Boot Record Drive production (source)

Event ID 10 ProcessAccess 15 rules

Access LSASS Memory for Dump Creation production (source)
Detect Credential Dumping through LSASS access production (source)
Mimikatz (Sysmon) (source)
Rubeus Kerberos Ticket Exports Through Winlogon Access production (source)
Spoolsv Suspicious Process Access production (source)
Windows Access Token Manipulation Winlogon Duplicate Token Handle production (source)
Windows Access Token Winlogon Duplicate Handle In Uncommon Path production (source)
Windows Handle Duplication in Known UAC-Bypass Binaries production (source)
Windows Hunting System Account Targeting Lsass production (source)
Windows Non-System Account Targeting Lsass production (source)
Windows Possible Credential Dumping production (source)
Windows Process Injection into Commonly Abused Processes production (source)
Windows Process Injection into Notepad production (source)
Windows Terminating Lsass Process production (source)
Windows WMI Impersonate Token production (source)

Event ID 11 FileCreate 94 rules

Additional dll added to Spool Driver (Sysmon) (source)
Batch File Write to System32 production (source)
Common Ransomware Extensions production (source)
Common Ransomware Notes production (source)
ConnectWise ScreenConnect Path Traversal production (source)
Creation of lsass Dump with Taskmgr production (source)
Detect AzureHound File Modifications production (source)
Detect Certipy File Modifications production (source)
Detect Exchange Web Shell production (source)
Detect Outlook exe writing a zip file production (source)
Detect Remote Access Software Usage File production (source)
Detect RTLO In File Name production (source)
Detect SharpHound File Modifications production (source)
Drop IcedID License dat production (source)
Email files written outside of the Outlook directory experimental (source)
Executable File Written to Disk (Sysmon) (source)
Executables Or Script Creation In Suspicious Path production (source)
Executables Or Script Creation In Temp Path production (source)
File with Samsam Extension production (source)
File Written to Startup Folder - Windows (Sysmon) (source)
GitHub Workflow File Creation or Modification production (source)
IcedID Exfiltrated Archived File Creation production (source)
Impacket atexec.py Temp File Creation (Sysmon) (source)
iphlpapi.dll File Write to Appdata_Local_Microsoft (Sysmon) (source)
LLM Model File Creation production (source)
MS Exchange Mailbox Replication service writing Active Server Pages experimental (source)
Msmpeng Application DLL Side Loading production (source)
Overwriting Accessibility Binaries production (source)
Process Creating LNK file in Suspicious Location production (source)
Process Writing DynamicWrapperX production (source)
Ransomware Notes bulk creation production (source)
RDP File Written by Outlook (Sysmon) (source)
Remcos RAT File Creation in Remcos Folder production (source)
Rundll32 Process Creating Exe Dll Files production (source)
Ryuk Test Files Detected production (source)
Samsam Test File Write production (source)
SchCache Change By App Connect And Create ADSI Object production (source)
Shai-Hulud 2 Exfiltration Artifact Files production (source)
Shai-Hulud Workflow File Creation or Modification production (source)
Shim Database File Creation production (source)
Spike in File Writes experimental (source)
Spoolsv Writing a DLL production (source)
Spoolsv Writing a DLL - Sysmon production (source)
Sqlite Module In Temp Folder production (source)
Suspicious .sys Created - Windows (Sysmon) (source)
Suspicious File Created in Public Folder (Sysmon) (source)
Suspicious Image Creation In Appdata Folder production (source)
Suspicious WAV file in Appdata Folder production (source)
Suspicious writes to windows Recycle Bin production (source)
Wermgr Process Create Executable File production (source)
Windows .Key File Creation in Root Directory production (source)
Windows Admin Permission Discovery production (source)
Windows Admin$ Share Access (Sysmon) (source)
Windows Archived Collected Data In TEMP Folder production (source)
Windows Boot or Logon Autostart Execution In Startup Folder production (source)
Windows C$ Share Access (Sysmon) (source)
Windows CAB File on Disk production (source)
Windows Credentials from Password Stores Chrome Copied in TEMP Dir production (source)
Windows Credentials from Web Browsers Saved in TEMP Folder production (source)
Windows Defacement Modify Transcodedwallpaper File production (source)
Windows Default RDP File Creation By Non MSTSC Process production (source)
Windows EFI Bootloader File Modification production (source)
Windows File Without Extension In Critical Folder production (source)
Windows IPC$ Share Access (Sysmon) (source)
Windows ISO LNK File Creation production (source)
Windows Known Abused DLL Created production (source)
Windows Mimikatz Crypto Export File Extensions production (source)
Windows Mock Trusted Directory MSC File Creation production (source)
Windows MOVEit Transfer Writing ASPX production (source)
Windows MSHTA Writing to World Writable Path production (source)
Windows NirSoft Tool Bundle File Created production (source)
Windows Obfuscated Files or Information via RAR SFX production (source)
Windows Office Product Dropped Cab or Inf File production (source)
Windows Office Product Dropped Uncommon File production (source)
Windows Outlook Macro Created by Suspicious Process production (source)
Windows Phishing Outlook Drop Dll In FORM Dir production (source)
Windows Potential AppDomainManager Hijack Artifacts Creation production (source)
Windows Potential Web Shell Creation For VMware Workspace ONE production (source)
Windows PowerShell Module File Created production (source)
Windows Process Writing File to World Writable Path production (source)
Windows RDP Bitmap Cache File Creation production (source)
Windows Replication Through Removable Media production (source)
Windows Screen Capture in TEMP folder production (source)
Windows SharePoint Spinstall0 Webshell File Creation production (source)
Windows Snake Malware File Modification Crmlog production (source)
Windows Snake Malware Kernel Driver Comadmin production (source)
Windows Suspicious File in EFI Volume production (source)
Windows System File on Disk production (source)
Windows TeamCity Plugin Installed production (source)
Windows Theme File Creation in Unusual Location production (source)
Windows Universal Data Link File Creation production (source)
Windows Unusual File Creation in Confluence Directory production (source)
Windows User Execution Malicious URL Shortcut File production (source)
Windows XLL File Creation Outside of Typical Location production (source)

Event ID 12 RegistryEvent (Object create and delete) 23 rules

Add DefaultUser And Password In Registry production (source)
ComputerDefaults UAC Bypass (Sysmon) (source)
Hidden User Created - Windows (Sysmon) (source)
LocalAccountTokenFilterPolicy Registry Value Modified (Sysmon) (source)
Logon Script Registry Key added (Sysmon) (source)
LSA Authentication Packages Registry Key Modified (Sysmon) (source)
Malicious InProcServer32 Modification production (source)
Potential fodhelper UAC Bypass Attempt (Sysmon) (source)
Remcos client registry install entry production (source)
Revil Registry Entry production (source)
Sdclt UAC Bypass production (source)
Startup Folder Location Modified - Windows (Sysmon) (source)
Windows CrowdStrike Agent Registry Key Removal production (source)
Windows Deleted Registry By A Non Critical Process File Path production (source)
Windows Downdate Registry Activity production (source)
Windows Modify Registry Delete Firewall Rules production (source)
Windows RDP Server Registry Deletion production (source)
Windows Registry Delete Task SD production (source)
Windows RunMRU Registry Key or Value Deleted production (source)
Windows USBSTOR Registry Key Modification production (source)
Windows WPDBusEnum Registry Key Modification production (source)
WinLogon Registry Key Modified (Sysmon) (source)
WSReset UAC Bypass production (source)

Event ID 13 RegistryEvent (Value Set) 194 rules

Active Setup Registry Autostart production (source)
Add DefaultUser And Password In Registry production (source)
Add DLL_EXE Registry Value (Sysmon) (source)
Allow Inbound Traffic By Firewall Rule Registry production (source)
Allow Operation with Consent Admin production (source)
Auto Admin Logon Registry Entry production (source)
Command Line Utility Added to Accessibility Features (Sysmon) (source)
ComputerDefaults UAC Bypass (Sysmon) (source)
ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon) (source)
Defender Registry Values Modified (Sysmon) (source)
Detect Remote Access Software Usage Registry production (source)
Disable AMSI Through Registry production (source)
Disable Defender AntiVirus Registry production (source)
Disable Defender BlockAtFirstSeen Feature production (source)
Disable Defender Enhanced Notification production (source)
Disable Defender MpEngine Registry production (source)
Disable Defender Spynet Reporting production (source)
Disable Defender Submit Samples Consent Feature production (source)
Disable ETW Through Registry production (source)
Disable Registry Tool production (source)
Disable Security Logs Using MiniNt Registry production (source)
Disable Show Hidden Files production (source)
Disable UAC Remote Restriction production (source)
Disable Windows App Hotkeys production (source)
Disable Windows Behavior Monitoring production (source)
Disable Windows SmartScreen Protection production (source)
Disabling CMD Application production (source)
Disabling ControlPanel production (source)
Disabling Defender Services production (source)
Disabling FolderOptions Windows Feature production (source)
Disabling NoRun Windows App production (source)
Disabling Remote User Account Control production (source)
Disabling SystemRestore In Registry production (source)
Disabling Task Manager production (source)
Disabling Windows Local Security Authority Defences via Registry production (source)
Enable RDP In Other Port Number production (source)
Enable WDigest UseLogonCredential Registry production (source)
EnableLUA Registry Value Modified (Sysmon) (source)
ETW Registry Disabled production (source)
Eventvwr UAC Bypass production (source)
Executable Running as NT AUTHORITY_SYSTEM Registered in BAM (Sysmon) (source)
Hidden User Created - Windows (Sysmon) (source)
Hide User Account From Sign-In Screen production (source)
LocalAccountTokenFilterPolicy Registry Value Modified (Sysmon) (source)
Logon Script Event Trigger Execution production (source)
Logon Script Registry Key added (Sysmon) (source)
LSA Authentication Packages Registry Key Modified (Sysmon) (source)
Malicious InProcServer32 Modification production (source)
Modification Of Wallpaper production (source)
Monitor Registry Keys for Print Monitors production (source)
NET Profiler UAC bypass production (source)
Potential fodhelper UAC Bypass Attempt (Sysmon) (source)
Print Processor Registry Autostart production (source)
PromptOnSecureDesktop Registry Value Modified (Sysmon) (source)
Registry Keys for Creating SHIM Databases production (source)
Registry Keys Used For Persistence production (source)
Registry Keys Used For Privilege Escalation production (source)
Remcos client registry install entry production (source)
Revil Registry Entry production (source)
Screensaver Event Trigger Execution production (source)
Sdclt UAC Bypass production (source)
Set Default PowerShell Execution Policy To Unrestricted or Bypass production (source)
SilentCleanup UAC Bypass production (source)
Startup Folder Location Modified - Windows (Sysmon) (source)
Suspicious InprocServer32 Registry Modification (Sysmon) (source)
Time Provider Persistence Registry production (source)
WDigest Forced Credential Caching (Sysmon) (source)
Windows AD DSRM Account Changes production (source)
Windows Anomalous Registry Value Length in Environment Key production (source)
Windows Audit Policy Auditing Option Modified - Registry production (source)
Windows Autostart Execution LSASS Driver Registry Modification production (source)
Windows Chrome Auto-Update Disabled via Registry production (source)
Windows Chrome Extension Allowed Registry Modification production (source)
Windows Compatibility Telemetry Tampering Through Registry production (source)
Windows Defender Disabled Detection (Sysmon) (source)
Windows Defender Exclusion Registry Entry production (source)
Windows Disable Change Password Through Registry production (source)
Windows Disable Lock Workstation Feature Through Registry production (source)
Windows Disable LogOff Button Through Registry production (source)
Windows Disable Memory Crash Dump production (source)
Windows Disable Notification Center production (source)
Windows Disable Shutdown Button Through Registry production (source)
Windows Disable Windows Group Policy Features Through Registry production (source)
Windows DisableAntiSpyware Registry production (source)
Windows Downdate Registry Activity production (source)
Windows Enable Win32 ScheduledJob via Registry production (source)
Windows Filtering Platform Policy Added to Block EDR Process production (source)
Windows Hide Notification Features Through Registry production (source)
Windows Impair Defense Change Win Defender Health Check Intervals production (source)
Windows Impair Defense Change Win Defender Quick Scan Interval production (source)
Windows Impair Defense Change Win Defender Throttle Rate production (source)
Windows Impair Defense Change Win Defender Tracing Level production (source)
Windows Impair Defense Configure App Install Control production (source)
Windows Impair Defense Define Win Defender Threat Action production (source)
Windows Impair Defense Delete Win Defender Context Menu production (source)
Windows Impair Defense Delete Win Defender Profile Registry production (source)
Windows Impair Defense Deny Security Software With Applocker production (source)
Windows Impair Defense Disable Controlled Folder Access production (source)
Windows Impair Defense Disable Defender Firewall And Network production (source)
Windows Impair Defense Disable Defender Protocol Recognition production (source)
Windows Impair Defense Disable PUA Protection production (source)
Windows Impair Defense Disable Realtime Signature Delivery production (source)
Windows Impair Defense Disable Web Evaluation production (source)
Windows Impair Defense Disable Win Defender App Guard production (source)
Windows Impair Defense Disable Win Defender Compute File Hashes production (source)
Windows Impair Defense Disable Win Defender Gen reports production (source)
Windows Impair Defense Disable Win Defender Network Protection production (source)
Windows Impair Defense Disable Win Defender Report Infection production (source)
Windows Impair Defense Disable Win Defender Scan On Update production (source)
Windows Impair Defense Disable Win Defender Signature Retirement production (source)
Windows Impair Defense Overide Win Defender Phishing Filter production (source)
Windows Impair Defense Override SmartScreen Prompt production (source)
Windows Impair Defense Set Win Defender Smart Screen Level To Warn production (source)
Windows Impair Defenses Disable Auto Logger Session production (source)
Windows Impair Defenses Disable AV AutoStart via Registry production (source)
Windows Impair Defenses Disable HVCI production (source)
Windows Impair Defenses Disable Win Defender Auto Logging production (source)
Windows InProcServer32 New Outlook Form production (source)
Windows LSA Secrets NoLMhash Registry production (source)
Windows Modify Registry AuthenticationLevelOverride production (source)
Windows Modify Registry Auto Minor Updates production (source)
Windows Modify Registry Auto Update Notif production (source)
Windows Modify Registry Configure BitLocker production (source)
Windows Modify Registry Default Icon Setting production (source)
Windows Modify Registry Disable RDP production (source)
Windows Modify Registry Disable Restricted Admin production (source)
Windows Modify Registry Disable Toast Notifications production (source)
Windows Modify Registry Disable Win Defender Raw Write Notif production (source)
Windows Modify Registry Disable WinDefender Notifications production (source)
Windows Modify Registry Disable Windows Security Center Notif production (source)
Windows Modify Registry DisableRemoteDesktopAntiAlias production (source)
Windows Modify Registry DisableSecuritySettings production (source)
Windows Modify Registry Disabling WER Settings production (source)
Windows Modify Registry DisAllow Windows App production (source)
Windows Modify Registry Do Not Connect To Win Update production (source)
Windows Modify Registry DontShowUI production (source)
Windows Modify Registry EnableLinkedConnections production (source)
Windows Modify Registry LongPathsEnabled production (source)
Windows Modify Registry MaxConnectionPerServer production (source)
Windows Modify Registry No Auto Reboot With Logon User production (source)
Windows Modify Registry No Auto Update production (source)
Windows Modify Registry NoChangingWallPaper production (source)
Windows Modify Registry on Smart Card Group Policy production (source)
Windows Modify Registry ProxyEnable production (source)
Windows Modify Registry ProxyServer production (source)
Windows Modify Registry Qakbot Binary Data Registry production (source)
Windows Modify Registry Suppress Win Defender Notif production (source)
Windows Modify Registry Tamper Protection production (source)
Windows Modify Registry to Add or Modify Firewall Rule production (source)
Windows Modify Registry UpdateServiceUrlAlternate production (source)
Windows Modify Registry USeWuServer production (source)
Windows Modify Registry Utilize ProgIDs production (source)
Windows Modify Registry ValleyRAT C2 Config production (source)
Windows Modify Registry ValleyRat PWN Reg Entry production (source)
Windows Modify Registry With MD5 Reg Key Name production (source)
Windows Modify Registry WuServer production (source)
Windows Modify Registry wuStatusServer production (source)
Windows Modify Show Compress Color And Info Tip Registry production (source)
Windows Mshta Execution In Registry production (source)
Windows New Custom Security Descriptor Set On EventLog Channel production (source)
Windows New Default File Association Value Set production (source)
Windows New EventLog ChannelAccess Registry Value Set production (source)
Windows New InProcServer32 Added production (source)
Windows Njrat Fileless Storage via Registry production (source)
Windows Outlook Dialogs Disabled from Unusual Process production (source)
Windows Outlook LoadMacroProviderOnBoot Persistence production (source)
Windows Outlook Macro Security Modified production (source)
Windows Outlook WebView Registry Modification production (source)
Windows Phishing Recent ISO Exec Registry production (source)
Windows Process Executed From Removable Media production (source)
Windows Proxy Via Registry production (source)
Windows RDP Server Registry Deletion production (source)
Windows RDP Server Registry Entry Created production (source)
Windows Registry BootExecute Modification production (source)
Windows Registry Certificate Added production (source)
Windows Registry Dotnet ETW Disabled Via ENV Variable production (source)
Windows Registry Modification for Safe Mode Persistence production (source)
Windows Registry Payload Injection production (source)
Windows Registry SIP Provider Modification production (source)
Windows Remote Access Software RMS Registry production (source)
Windows Remote Services Allow Remote Assistance production (source)
Windows Remote Services Rdp Enable production (source)
Windows Routing and Remote Access Service Registry Key Change production (source)
Windows RunMRU Command Execution production (source)
Windows Service Creation Using Registry Entry production (source)
Windows Service Deletion In Registry production (source)
Windows Set Network Profile Category to Private via Registry production (source)
Windows Snake Malware Registry Modification wav OpenWithProgIds production (source)
Windows SnappyBee Create Test Registry production (source)
Windows USBSTOR Registry Key Modification production (source)
Windows WPDBusEnum Registry Key Modification production (source)
WinLogon Registry Key Modified (Sysmon) (source)
Wow6432Node Classes Autorun Keys Modification (Sysmon) (source)
WSReset UAC Bypass production (source)

Event ID 14 RegistryEvent (Key and Value Rename) 2 rules

Windows Downdate Registry Activity production (source)
Windows Modify Registry to Add or Modify Firewall Rule production (source)

Event ID 15 FileCreateStreamHash 4 rules

Download Files Using Telegram production (source)
Unusual HTTP Download (Sysmon) (source)
Windows Alternate DataStream - Base64 Content production (source)
Windows Alternate DataStream - Executable Content production (source)

Event ID 17 PipeEvent (Pipe Created) 10 rules

Named Pipe Created (Sysmon) (source)
Trickbot Named Pipe production (source)
Windows Anonymous Pipe Activity production (source)
Windows App Layer Protocol Qakbot NamedPipe production (source)
Windows App Layer Protocol Wermgr Connect To NamedPipe production (source)
Windows Application Layer Protocol RMS Radmin Tool Namedpipe production (source)
Windows PUA Named Pipe production (source)
Windows RMM Named Pipe production (source)
Windows Suspicious C2 Named Pipe production (source)
Windows Suspicious Named Pipe production (source)

Event ID 18 PipeEvent (Pipe Connected) 10 rules

Named Pipe Created (Sysmon) (source)
Trickbot Named Pipe production (source)
Windows Anonymous Pipe Activity production (source)
Windows App Layer Protocol Qakbot NamedPipe production (source)
Windows App Layer Protocol Wermgr Connect To NamedPipe production (source)
Windows Application Layer Protocol RMS Radmin Tool Namedpipe production (source)
Windows PUA Named Pipe production (source)
Windows RMM Named Pipe production (source)
Windows Suspicious C2 Named Pipe production (source)
Windows Suspicious Named Pipe production (source)

Event ID 20 WmiEvent (WmiEventConsumer activity detected) 1 rule

Detect WMI Event Subscription Persistence production (source)

Event ID 21 WmiEvent (WmiEventConsumerToFilter activity detected) 1 rule

WMI Permanent Event Subscription - Sysmon production (source)

Event ID 22 DNSEvent (DNS query) 23 rules

3CX Supply Chain Attack Network Indicators production (source)
AteraAgent Installation - Windows (Sysmon) (source)
Detect DNS Query to Decommissioned S3 Bucket experimental (source)
Detect hosts connecting to dynamic domain providers production (source)
Detect Remote Access Software Usage DNS production (source)
DNS Kerberos Coercion production (source)
DNS Query Length With High Standard Deviation production (source)
Local LLM Framework DNS Query production (source)
Ngrok Reverse Proxy on Network production (source)
Rundll32 DNSQuery production (source)
Sunburst Correlation DLL and Network Event experimental (source)
Suspicious Process DNS Query Known Abuse Web Services production (source)
Suspicious Process With Discord DNS Query production (source)
Wermgr Process Connecting To IP Check Web Services production (source)
Windows Abused Web Services production (source)
Windows AI Platform DNS Query production (source)
Windows BitLockerToGo with Network Activity production (source)
Windows DNS Query Request by Telegram Bot API production (source)
Windows DNS Query Request To TinyUrl production (source)
Windows Gather Victim Network Info Through Ip Check Web Services production (source)
Windows Multi hop Proxy TOR Website Query production (source)
Windows Spearphishing Attachment Connect To None MS Office Domain production (source)
Windows Visual Basic Commandline Compiler DNSQuery production (source)

Event ID 23 FileDelete (File Delete archived) 10 rules

Event ID 26 FileDeleteDetected (File Delete logged) 7 rules

Excessive File Deletion In WinDefender Folder production (source)
Windows ConsoleHost History File Deletion production (source)
Windows Data Destruction Recursive Exec Files Deletion production (source)
Windows Default Rdp File Deletion production (source)
Windows High File Deletion Frequency production (source)
Windows Rdp AutomaticDestinations Deletion production (source)
Windows RDP Cache File Deletion production (source)

Event ID 29 FileExecutableDetected 1 rule

Windows Executable Masquerading as Benign File Types production (source)

Microsoft-Windows-Windows-Defender 10 events, 22 rules

Event ID 1121 2 rules

Windows Defender ASR Block Events production (source)
Windows Defender ASR Rules Stacking production (source)

Event ID 1122 2 rules

Windows Defender ASR Audit Events production (source)
Windows Defender ASR Rules Stacking production (source)

Event ID 1125 2 rules

Windows Defender ASR Audit Events production (source)
Windows Defender ASR Rules Stacking production (source)

Event ID 1126 3 rules

Windows Defender ASR Audit Events production (source)
Windows Defender ASR Block Events production (source)
Windows Defender ASR Rules Stacking production (source)

Event ID 1129 2 rules

Windows Defender ASR Block Events production (source)
Windows Defender ASR Rules Stacking production (source)

Event ID 1131 2 rules

Windows Defender ASR Block Events production (source)
Windows Defender ASR Rules Stacking production (source)

Event ID 1132 2 rules

Windows Defender ASR Audit Events production (source)
Windows Defender ASR Rules Stacking production (source)

Event ID 1133 2 rules

Windows Defender ASR Block Events production (source)
Windows Defender ASR Rules Stacking production (source)

Event ID 1134 2 rules

Windows Defender ASR Audit Events production (source)
Windows Defender ASR Rules Stacking production (source)

Event ID 5007 3 rules

Windows Defender ASR Registry Modification production (source)
Windows Defender ASR Rule Disabled production (source)
Windows Defender ASR Rules Stacking production (source)

Microsoft-Windows-AppXDeployment-Server 4 events, 5 rules

Event ID 400 Deployment DeploymentOperation operation with target volume MountPoint on Package PackageFullName from: Path finished successfully. 1 rule

Windows AppX Deployment Full Trust Package Installation production (source)

Event ID 603 Started deployment DeploymentOperation operation on a package with main parameter Path and Options Flags and FlagsHigh. 1 rule

Windows AppX Deployment Unsigned Package Installation production (source)

Event ID 854 Successfully added the following uri(s) to be processed: Path. 1 rule

Windows AppX Deployment Package Installation Success production (source)

Event ID 855 Finished resolving action lists. 2 rules

Windows AppX Deployment Unsigned Package Installation production (source)
Windows Developer-Signed MSIX Package Installation production (source)

Microsoft-Windows-Eventlog 4 events, 6 rules

Event ID 104 The LogFileCleared.Channel log file was cleared. 2 rules

Event ID 517 The audit log was cleared (legacy Windows 2000/XP/2003 event; superseded by 1102). 1 rule

Clear Windows Event Logs (Windows Event Log) (source)

Event ID 1100 The event logging service has shut down. 1 rule

Windows Event Logging Service Has Shutdown production (source)

Event ID 1102 The audit log was cleared. 2 rules

Microsoft-Windows-PrintService 3 events, 4 rules

Event ID 316 Printer driver param1 for param2 param3 was added or updated. 2 rules

Event ID 808 The print spooler failed to load a plug-in module PluginDllName, error code ErrorCode. 1 rule

Print Spooler Failed to Load a Plug-in production (source)

Event ID 4909 Print Service event 4909 (manifest stub). 1 rule

Print Spooler Failed to Load a Plug-in production (source)

MsiInstaller 3 events, 6 rules

Event ID 1033 Windows Installer installed the product. 1 rule

AteraAgent Installation - Windows (Windows Event Log) (source)

Event ID 1040 Beginning a Windows Installer transaction: %0 3 rules

Event ID 1042 Ending a Windows Installer transaction: %0 2 rules

Service-Control-Manager 3 events, 24 rules

Event ID 7036 3 rules

First Time Seen Running Windows Service experimental (source)
Windows Cisco Secure Endpoint Related Service Stopped production (source)
Windows Security And Backup Services Stop production (source)

Event ID 7040 3 rules

Windows Event For Service Disabled production (source)
Windows Excessive Disabled Services Event production (source)
Windows Service Stop Win Updates production (source)

Event ID 7045 18 rules

Clop Ransomware Known Service Name production (source)
Impacket SMBexec (Windows Event Log) (source)
Kernel Service Installed - Windows (Windows Event Log) (source)
Malicious Powershell Executed As A Service production (source)
PSexec Service Creation (Windows Event Log) (source)
Randomly Generated Windows Service Name experimental (source)
Service Created containing Command Shell (Windows Event Log) (source)
Service Installed (Windows Event Log) (source)
SimpleHelp Remote Access Tool Service Installation (Windows Event Log) (source)
Windows Bluetooth Service Installed From Uncommon Location production (source)
Windows Driver Load Non-Standard Path production (source)
Windows KrbRelayUp Service Creation production (source)
Windows Service Create RemComSvc production (source)
Windows Service Create SliverC2 production (source)
Windows Service Created with Suspicious Service Name production (source)
Windows Service Created with Suspicious Service Path production (source)
Windows Snake Malware Service Create production (source)
Windows Vulnerable Driver Installed production (source)

MSSQLSERVER 2 events, 4 rules

Event ID 8128 1 rule

Windows SQL Server Extended Procedure DLL Loading Hunt production (source)

Event ID 15457 3 rules

Windows SQL Server Configuration Option Hunt production (source)
Windows SQL Server Critical Procedures Enabled production (source)
Windows SQL Server xp_cmdshell Config Change production (source)

Microsoft-Windows-CAPI2 2 events, 2 rules

Event ID 70 For more details for this event, please refer to the "Details" section 1 rule

Windows Steal Authentication Certificates CryptoAPI production (source)

Event ID 81 For more details for this event, please refer to the "Details" section 1 rule

Windows SIP WinVerifyTrust Failed Trust Validation production (source)

Microsoft-Windows-PowerShell 2 events, 390 rules

Event ID 4103 Payload Context: ContextInfo User Data: UserData. 111 rules

Event ID 4104 Creating Scriptblock text (MessageNumber of MessageTotal). 279 rules

Microsoft-Windows-TaskScheduler 2 events, 2 rules

Event ID 200 Task Scheduler launched action "TaskName" in instance "ActionName" of task "Name". 1 rule

WinEvent Windows Task Scheduler Event Action Started production (source)

Event ID 201 Task Scheduler successfully completed task "Name" , instance "TaskInstanceId" , action "TaskName" . 1 rule

WinEvent Windows Task Scheduler Event Action Started production (source)

Application-Error 1 event, 1 rule

Event ID 1000 1 rule

Potential CVE-2024-49113 - LDAPNightmare (Windows Event Log) (source)

Microsoft-Windows-AppxPackagingOM 1 event, 1 rule

Event ID 171 The reader was created successfully for app package packageFullName. 1 rule

Windows MSIX Package Interaction production (source)

Microsoft-Windows-CertificateServicesClient-Lifecycle-System 1 event, 1 rule

Event ID 1007 A certificate has been exported. 1 rule

Windows Export Certificate production (source)

Microsoft-Windows-IIS-W3SVC-WP 1 event, 1 rule

Event ID 2282 The Module DLL 'ModuleDll' could not be loaded due to a configuration problem 1 rule

Windows IIS Components Module Failed to Load production (source)

Microsoft-Windows-ProcessExitMonitor 1 event, 1 rule

Event ID 3000 The process 'param1' exited with exit code param2. 1 rule

Windows Event Triggered Image File Execution Options Injection production (source)

Microsoft-Windows-TerminalServices-ClientActiveXCore 1 event, 1 rule

Event ID 1024 RDP ClientActiveX is trying to connect to the server (Value). 1 rule

Windows RDPClient Connection Sequence Events production (source)

Microsoft-Windows-TerminalServices-RemoteConnectionManager 1 event, 1 rule

Event ID 1149 Remote Desktop Services: User authentication succeeded. 1 rule

Windows RDP Connection Successful production (source)

User32 1 event, 1 rule

Event ID 1074 The process param1 has initiated the param5 of computer param2 on behalf of user param7 for the following reason: 1 rule

System Shutdown or Reboot (Windows Event Log) (source)

VSSAudit 1 event, 1 rule

Event ID 8222 1 rule

Shadow Copy Created (Windows Event Log) (source)

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)