Windows Files and Paths

This tree combines rule paths with a Windows 11 24H2 filesystem snapshot. Inferred path suggests a specific file or folder. Inferred branch suggests a parent folder when the precise path is unresolved.

• C:\ #

  • C:\$SysReset\Framework\Stack\RjvPlatform.dll#
    • Potential RjvPlatform.DLL Sideloading From Default Location Sigma
  • C:\Debuggers#
    • VMMap Signed Dbghelp.DLL Potential Sideloading Sigma (inferred branch)
    • VMMap Unsigned Dbghelp.DLL Potential Sideloading Sigma (inferred branch)
  • C:\FOR_DECRYPT.html#
    • Dev-0530 File Extension Rename Kusto
  • C:\inetpub\logs\LogFiles#
    • WebServer Access Logs Deleted Elastic (inferred branch)
  • C:\Intel#
    • Startup Folder Persistence via Unsigned Process Elastic (inferred branch)
    • Suspicious RDP ActiveX Client Loaded Elastic (inferred branch)
  • C:\kworking\agent.exe#
    • REvil Kaseya Incident Malware Patterns Sigma (inferred path)
  • C:\kworking1\agent.exe#
    • REvil Kaseya Incident Malware Patterns Sigma (inferred path)
  • C:\PerfLogs#
    • DLL Load By System Process From Suspicious Locations Sigma (inferred branch)
    • File Creation In Suspicious Directory By Msdt.EXE Sigma (inferred branch)
    • ScreenConnect - SlashAndGrab Exploitation Indicators Sigma (inferred branch)
    • Startup Folder Persistence via Unsigned Process Elastic (inferred branch)
    • Suspicious File Created In PerfLogs Sigma (inferred branch)
    • Suspicious RDP ActiveX Client Loaded Elastic (inferred branch)
    • Suspicious Service Binary Directory Sigma (inferred branch)
    • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred branch)
  • C:\Program Files#
    • Potential Execution via Shortcut Modification Elastic (inferred branch)
    • C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions#
      • Suspicious File Write to SharePoint Layouts Directory Sigma (inferred branch)
    • C:\Program Files\Internet Explorer#
      • Potential Image Load with a Spoofed Creation Time Elastic (inferred branch)
      • C:\Program Files\Internet Explorer\ExtExport.exe#
        • Amsi.DLL Loaded Via LOLBIN Process Sigma (inferred path)
        • DarkGate - Autoit3.EXE File Creation By Uncommon Process Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Potential DLL Sideloading Activity Via ExtExport.EXE Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Program Files\Internet Explorer\iediagcmd.exe#
        • Potential CVE-2025-33053 Exploitation Elastic (inferred path)
        • Potential CVE-2025-33053 Exploitation Elastic (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 Sigma
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access Sigma
        • Visual Studio Code Tunnel Execution (Windows Event Log) Splunk (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
      • C:\Program Files\Internet Explorer\ieinstal.exe#
        • UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer Elastic (inferred path)
        • UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer Elastic (inferred path)
        • UAC Bypass Using IEInstal - File Sigma
        • UAC Bypass Using IEInstal - Process Sigma (inferred path)
      • C:\Program Files\Internet Explorer\ielowutil.exe#
        • Suspicious Command and Control via Internet Explorer Elastic (inferred path)
      • C:\Program Files\Internet Explorer\iertutil.dll#
        • Potential DCOM InternetExplorer.Application DLL Hijack Sigma (inferred path)
        • Potential DCOM InternetExplorer.Application DLL Hijack - Image Load Sigma (inferred path)
      • C:\Program Files\Internet Explorer\iexplore.exe#
        • .RDP File Created By Uncommon Application Sigma (inferred path)
        • Browser Process Started in a Hidden Desktop Elastic (inferred path)
        • Exploiting CVE-2019-1388 Sigma (inferred path)
        • Malicious Reputation of Executable Download Elastic (inferred path)
        • Mstsc.EXE Execution From Uncommon Parent Sigma (inferred path)
        • Office ASR rule triggered from browser spawned office process. Kusto (inferred path)
        • Office Macro File Download Sigma (inferred path)
        • Potential Browser Exploit via Fake RPC Messages Elastic (inferred path)
        • Potential Command and Control via Internet Explorer Elastic (inferred path)
        • Potential DCOM InternetExplorer.Application DLL Hijack - Image Load Sigma (inferred path)
        • Potential Escalation via Vulnerable MSI Repair Elastic (inferred path)
        • Potential Privilege Escalation via MSI Repair Elastic (inferred path)
        • Potential Shellcode Injection by a Browser Process Elastic (inferred path)
        • Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Scheduled Task from a Browser or Compression Utility Descendant Elastic (inferred path)
        • Startup Persistence by a Suspicious Process Elastic (inferred path)
        • Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred path)
        • Suspicious File Delivery via HTML Smuggling Elastic (inferred path)
        • Suspicious HTML File Creation Elastic (inferred path)
        • Suspicious MSC File Launched Kusto (inferred path)
        • Suspicious parentprocess relationship - Office child processes. Kusto (inferred path)
        • Suspicious PowerShell Parent Process Sigma (inferred path)
        • Suspicious Troubleshooting Pack Cabinet Execution Elastic (inferred path)
        • Suspicious VirtualProtect via Jscript9 from Internet Explorer Elastic (inferred path)
        • VHD Image Download Via Browser Sigma (inferred path)
        • Windows Disable Internet Explorer Addons Splunk (inferred path)
        • Windows Phishing PDF File Executes URL Link Splunk (inferred path)
    • C:\Program Files\Microsoft#
      • Suspicious System Path File Overwrite Elastic (inferred branch)
    • C:\Program Files\Oracle\VirtualBox Guest Additions\VBoxDrvInst.exe#
      • Suspicious VBoxDrvInst.exe Parameters Sigma (inferred path)
    • C:\Program Files\Windows Defender#
      • C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe#
        • Arbitrary File Download Via ConfigSecurityPolicy.EXE Sigma (inferred path)
      • C:\Program Files\Windows Defender\MpClient.dll#
        • Potential Mpclient.DLL Sideloading Sigma (inferred path)
        • Windows Defender MpClient.dll Loaded by Non-Defender Process Splunk (inferred path)
      • C:\Program Files\Windows Defender\MpCmdRun.exe#
        • File Download Via Windows Defender MpCmpRun.EXE Chronicle (inferred path)
        • File Download Via Windows Defender MpCmpRun.EXE Sigma (inferred path)
        • Microsoft Defender Blocked from Loading Unsigned DLL Sigma (inferred path)
        • Potential Mpclient.DLL Sideloading Sigma (inferred path)
        • Potential Mpclient.DLL Sideloading Via Defender Binaries Sigma (inferred path)
        • Remote File Download via MpCmdRun Elastic (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Windows Defender Definition Files Removed Sigma (inferred path)
        • Windows MpCmdRun RemoveDefinitions Execution Splunk (inferred path)
      • C:\Program Files\Windows Defender\MpDlpCmd.exe#
        • Visual Studio Code Tunnel Execution (Windows Event Log) Splunk (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
      • C:\Program Files\Windows Defender\MpSvc.dll#
        • Potential DLL Sideloading Of MpSvc.DLL Sigma (inferred path)
      • C:\Program Files\Windows Defender\MsMpEng.exe#
        • Potential Evasion via Windows Filtering Platform Elastic (inferred path)
        • Potential PlugX Activity Sigma (inferred path)
        • Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze Sigma (inferred path)
        • Windows MsMpEng Writing to System32 Splunk (inferred path)
        • Windows VSSVC Process Accessing Defender Engine Splunk (inferred path)
      • C:\Program Files\Windows Defender\NisSrv.exe#
        • Microsoft Defender Blocked from Loading Unsigned DLL Sigma (inferred path)
        • Potential Mpclient.DLL Sideloading Sigma (inferred path)
        • Potential Mpclient.DLL Sideloading Via Defender Binaries Sigma (inferred path)
      • C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe#
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution Sigma (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
    • C:\Program Files\Windows Defender Advanced Threat Protection#
      • C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe#
      • C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe#
        • Potential Evasion via Windows Filtering Platform Elastic (inferred path)
    • C:\Program Files\Windows Mail#
      • C:\Program Files\Windows Mail\wab.exe#
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Potential Bumblebee Remote Thread Creation Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wab Execution From Non Default Location Sigma (inferred path)
        • Wab/Wabmig Unusual Parent Or Child Processes Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Program Files\Windows Mail\wabmig.exe#
        • Potential Bumblebee Remote Thread Creation Sigma (inferred path)
        • Wab Execution From Non Default Location Sigma (inferred path)
        • Wab/Wabmig Unusual Parent Or Child Processes Sigma (inferred path)
    • C:\Program Files\Windows Media Player#
      • UAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder Elastic (inferred branch)
      • C:\Program Files\Windows Media Player\osk.exe#
        • UAC Bypass Using Windows Media Player - File Sigma
        • UAC Bypass Using Windows Media Player - Process Sigma
      • C:\Program Files\Windows Media Player\wmplayer.exe#
        • Winnti Malware HK University Campaign Sigma (inferred path)
      • C:\Program Files\Windows Media Player\wmprph.exe#
        • DarkGate - Autoit3.EXE File Creation By Uncommon Process Sigma (inferred path)
    • C:\Program Files\Windows NT#
      • Potential DLL Hijacking via Environment Paths Elastic (inferred branch)
      • C:\Program Files\Windows NT\accessories\wordpad.exe#
        • Potential Decoy Document via User Execution Elastic (inferred path)
    • C:\Program Files\Windows Photo Viewer\ImagingDevices.exe#
      • ImagingDevices Unusual Parent/Child Processes Sigma (inferred path)
      • Potential Bumblebee Remote Thread Creation Sigma (inferred path)
    • C:\Program Files\WindowsApps#
      • AppX Package Installation Attempts Via AppInstaller.EXE Sigma (inferred branch)
      • Potentially Suspicious Windows App Activity Sigma (inferred branch)
    • C:\Program Files\WindowsPowerShell#
      • C:\Program Files\WindowsPowerShell\Modules#
        • PowerShell Module File Created Sigma (inferred branch)
        • PowerShell Module File Created By Non-PowerShell Process Sigma (inferred branch)
        • Windows PowerShell Module File Created Splunk (inferred branch)
        • C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin#
          • ScreenConnect Temporary Installation Artefact Sigma (inferred branch)
        • C:\Program Files\WindowsPowerShell\Modules\webAdministration\webAdministration.psm1#
          • CVE-2022-24527 Microsoft Connected Cache LPE Sigma (inferred path)
      • C:\Program Files\WindowsPowerShell\profile.ps1#
        • PowerShell Profile Modification Sigma (inferred path)
  • C:\Program Files #
    • DLL Search Order Hijackig Via Additional Space in Path Sigma (inferred branch)
  • C:\Program Files (x86)#
    • Potential Execution via Shortcut Modification Elastic (inferred branch)
    • C:\Program Files (x86)\Common Files#
      • C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions#
        • Suspicious File Write to SharePoint Layouts Directory Sigma (inferred branch)
      • C:\Program Files (x86)\Common Files\Oracle\Java\javapath#
        • Potential DLL Hijacking via Environment Paths Elastic (inferred branch)
    • C:\Program Files (x86)\Internet Explorer#
      • C:\Program Files (x86)\Internet Explorer\iertutil.dll#
        • Potential DCOM InternetExplorer.Application DLL Hijack Sigma (inferred path)
        • Potential DCOM InternetExplorer.Application DLL Hijack - Image Load Sigma (inferred path)
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe#
        • Suspicious VirtualProtect via Jscript9 from Internet Explorer Elastic (inferred path)
    • C:\Program Files (x86)\Microsoft#
      • Potential Image Load with a Spoofed Creation Time Elastic (inferred branch)
      • Potential Privilege Escalation via DLL Redirection Elastic (inferred branch)
      • Potential Privilege Escalation via Elevated IFileOperation Elastic (inferred branch)
      • Potential Privilege Escalation via File Redirection Elastic (inferred branch)
      • Potential Privilege Escalation via Token Impersonation Elastic (inferred branch)
      • Suspicious System Path File Overwrite Elastic (inferred branch)
      • Untrusted DLL Loaded by a System Windows Process Elastic (inferred branch)
      • C:\Program Files (x86)\Microsoft\Edge#
        • Suspicious File Access to Browser Credential Storage Sigma (inferred branch)
        • C:\Program Files (x86)\Microsoft\Edge\Application#
          • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.106\elevation_service.exe#
            • InstallerFileTakeOver LPE CVE-2021-41379 File Create Event Sigma (inferred path)
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe#
            • .RDP File Created By Uncommon Application Sigma (inferred path)
            • Browser Debugging from Unusual Parent Elastic (inferred path)
            • Browser Execution In Headless Mode Sigma (inferred path)
            • Browser Process Spawned from an Unusual Parent Elastic (inferred path)
            • Browser Process Started in a Hidden Desktop Elastic (inferred path)
            • Chromium Browser Headless Execution To Mockbin Like Site Sigma (inferred path)
            • Chromium Browser Instance Executed With Custom Extension Sigma (inferred path)
            • Download Activity via a Headless Browser Elastic (inferred path)
            • Execution of a Downloaded Windows Script Elastic (inferred path)
            • File Download From Browser Process Via Inline URL Sigma (inferred path)
            • File Download with Headless Browser Sigma (inferred path)
            • Headless Browser Usage Splunk (inferred path)
            • HTML File Opened From Download Folder Sigma (inferred path)
            • Injected Browser Process Spawning Rundll32 - GuLoader Activity Sigma (inferred path)
            • Malicious Reputation of Executable Download Elastic (inferred path)
            • Mstsc.EXE Execution From Uncommon Parent Sigma (inferred path)
            • Office ASR rule triggered from browser spawned office process. Kusto (inferred path)
            • Office Macro File Download Sigma (inferred path)
            • Potential Browser Debugging via Localhost Elastic (inferred path)
            • Potential Browser Exploit via Fake RPC Messages Elastic (inferred path)
            • Potential Cookies Theft via Browser Debugging Elastic (inferred path)
            • Potential Decoy Document via User Execution Elastic (inferred path)
            • Potential Escalation via Vulnerable MSI Repair Elastic (inferred path)
            • Potential Execution via VS Code Tasks Elastic (inferred path)
            • Potential Google Credentials Phishing Elastic (inferred path)
            • Potential HawkEyes Stealer Infection Elastic (inferred path)
            • Potential Privilege Escalation via MSI Repair Elastic (inferred path)
            • Potential Shellcode Injection by a Browser Process Elastic (inferred path)
            • Potential Suspicious Browser Launch From Document Reader Process Sigma (inferred path)
            • Potentially Suspicious Electron Application CommandLine Sigma (inferred path)
            • Scheduled Task from a Browser or Compression Utility Descendant Elastic (inferred path)
            • Silent Enabling of Chrome DevTools Protocol Kusto (inferred path)
            • Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred path)
            • Suspicious Chromium Browser Instance Executed With Custom Extension Sigma (inferred path)
            • Suspicious Electron Application Child Processes Sigma (inferred path)
            • Suspicious Execution from a PDF Documents Elastic (inferred path)
            • Suspicious File Delivery via HTML Smuggling Elastic (inferred path)
            • Suspicious FileFix Execution Pattern Sigma (inferred path)
            • Suspicious HTML File Creation Elastic (inferred path)
            • Suspicious MSC File Launched Kusto (inferred path)
            • Suspicious Oversized Script Execution Elastic (inferred path)
            • Suspicious parentprocess relationship - Office child processes. Kusto (inferred path)
            • Suspicious Troubleshooting Pack Cabinet Execution Elastic (inferred path)
            • VHD Image Download Via Browser Sigma (inferred path)
            • Windows Browser Process Launched with Unusual Flags Splunk (inferred path)
            • Windows Chromium Browser Launched with Small Window Size Splunk (inferred path)
            • Windows Chromium Browser No Security Sandbox Process Splunk (inferred path)
            • Windows Chromium Browser with Custom User Data Directory Splunk (inferred path)
            • Windows Chromium process Launched with Disable Popup Blocking Splunk (inferred path)
            • Windows Chromium Process Launched with Logging Disabled Splunk (inferred path)
            • Windows Chromium Process with Disabled Extensions Splunk (inferred path)
            • Windows Uncommon Remote Thread Creation In Browser Process Splunk (inferred path)
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe#
            • Arbitrary File Download Via MSEDGE_PROXY.EXE Sigma (inferred path)
            • Potentially Suspicious Electron Application CommandLine Sigma (inferred path)
      • C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106#
        • C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe#
          • Potential CVE-2021-41379 Exploitation Attempt Sigma (inferred path)
          • Potential Privilege Escalation via InstallerFileTakeOver Elastic (inferred path)
        • C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\vcruntime140.dll#
          • Windows SqlWriter SQLDumper DLL Sideload Splunk (inferred path)
    • C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\module\BES#
      • Suspicious Trend Micro Security Agent Child Process Elastic (inferred path)
    • C:\Program Files (x86)\Windows Media Player#
      • UAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder Elastic (inferred branch)
    • C:\Program Files (x86)\Windows NT#
      • Potential DLL Hijacking via Environment Paths Elastic (inferred branch)
    • C:\Program Files (x86)\WindowsPowerShell#
      • C:\Program Files (x86)\WindowsPowerShell\Modules#
        • PowerShell Module File Created Sigma (inferred branch)
        • PowerShell Module File Created By Non-PowerShell Process Sigma (inferred branch)
        • Windows PowerShell Module File Created Splunk (inferred branch)
        • C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin#
          • ScreenConnect Temporary Installation Artefact Sigma (inferred branch)
        • C:\Program Files (x86)\WindowsPowerShell\Modules\webAdministration\webAdministration.psm1#
          • CVE-2022-24527 Microsoft Connected Cache LPE Sigma (inferred path)
      • C:\Program Files (x86)\WindowsPowerShell\profile.ps1#
        • PowerShell Profile Modification Sigma (inferred path)
  • C:\Program Files (x86) #
    • DLL Search Order Hijackig Via Additional Space in Path Sigma (inferred branch)
  • C:\program.exe#
    • Creation Exe for Service with Unquoted Path Sigma
  • C:\ProgramData#
    • DNS Over HTTPS by an Unusual Process Elastic (inferred branch)
    • File Creation In Suspicious Directory By Msdt.EXE Sigma (inferred branch)
    • Forest Blizzard APT - File Creation Activity Sigma (inferred branch)
    • ScreenConnect - SlashAndGrab Exploitation Indicators Sigma (inferred branch)
    • Startup Folder Persistence via Unsigned Process Elastic (inferred branch)
    • Suspicious PHP Script Execution Elastic (inferred branch)
    • Suspicious RDP ActiveX Client Loaded Elastic (inferred branch)
    • Windows Script Interpreter Executing Process via WMI Elastic (inferred branch)
    • C:\ProgramData\Adobe#
      • C:\ProgramData\Adobe\ARM#
        • C:\ProgramData\Adobe\ARM\HID.dll#
          • Lazarus APT DLL Sideloading Activity Sigma
        • C:\ProgramData\Adobe\ARM\tabcal.exe#
          • Lazarus APT DLL Sideloading Activity Sigma
      • C:\ProgramData\Adobe\colorcpl.exe#
        • Lazarus APT DLL Sideloading Activity Sigma
      • C:\ProgramData\Adobe\colorui.dll#
        • Lazarus APT DLL Sideloading Activity Sigma
    • C:\ProgramData\DRM\CLR\CLR.exe#
      • Winnti Malware HK University Campaign Sigma (inferred path)
    • C:\ProgramData\GoogleUpdate#
      • C:\ProgramData\GoogleUpdate\config.dat#
        • Goofy Guineapig Backdoor IOC Sigma
      • C:\ProgramData\GoogleUpdate\GoogleUpdate\tmp.bat#
        • Goofy Guineapig Backdoor IOC Sigma
      • C:\ProgramData\GoogleUpdate\GoogleUpdate.exe#
      • C:\ProgramData\GoogleUpdate\goopdate.dll#
        • Goofy Guineapig Backdoor IOC Sigma
    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp#
      • ScreenConnect - SlashAndGrab Exploitation Indicators Sigma (inferred branch)
      • Shortcut File Written or Modified on Startup Folder Elastic (inferred branch)
      • Startup Folder Persistence via Unsigned Process Elastic (inferred branch)
      • Startup Persistence by a Suspicious Process Elastic (inferred branch)
    • C:\ProgramData\Oracle\Java#
      • C:\ProgramData\Oracle\Java\fixmapi.exe#
        • Lazarus APT DLL Sideloading Activity Sigma
      • C:\ProgramData\Oracle\Java\mapistub.dll#
        • Lazarus APT DLL Sideloading Activity Sigma
    • C:\ProgramData\system.bat#
    • C:\ProgramData\wt.exe#
      • Axios NPM Compromise File Creation Indicators - Windows Sigma
  • C:\ProgramShared\PresentationHost.exe#
    • Lazarus APT DLL Sideloading Activity Sigma
  • C:\Temp#
    • DLL Loaded From Suspicious Location Via Cmspt.EXE Sigma (inferred branch)
    • Potential CobaltStrike Process Patterns Sigma (inferred branch)
    • Publisher Attachment File Dropped In Suspicious Location Sigma (inferred branch)
    • WSL Child Process Anomaly Sigma (inferred branch)
  • C:\Users#
    • Binary Masquerading via Untrusted Path Elastic (inferred branch)
    • Cloud Instance Metadata Credential Path HTTP Request Elastic (inferred branch)
    • Potential Ransomware Note File Dropped via SMB Elastic (inferred branch)
    • Potential Ransomware Note File via SMB Elastic (inferred branch)
    • Startup Folder Persistence via Unsigned Process Elastic (inferred branch)
    • Suspicious Binary In User Directory Spawned From Office Application Sigma (inferred branch)
    • Suspicious File Rename via SMB Elastic (inferred branch)
    • Suspicious File Renamed via SMB Elastic (inferred branch)
    • Suspicious Instance Metadata Service (IMDS) API Command Line Execution Elastic (inferred branch)
    • Suspicious PHP Script Execution Elastic (inferred branch)
    • UAC Bypass Using DismHost Sigma (inferred branch)
    • Windows Script Interpreter Executing Process via WMI Elastic (inferred branch)
    • C:\Users\Default#
      • Suspicious RDP ActiveX Client Loaded Elastic (inferred branch)
    • C:\Users\oldadmin\Documents\MilsoftConnect\Files#
      • ScreenConnect - SlashAndGrab Exploitation Indicators Sigma (inferred branch)
    • C:\Users\Public#
      • DLL Load By System Process From Suspicious Locations Sigma (inferred branch)
      • DNS Over HTTPS by an Unusual Process Elastic (inferred branch)
      • File Creation In Suspicious Directory By Msdt.EXE Sigma (inferred branch)
      • Potential BlackByte Ransomware Activity Sigma (inferred branch)
      • Suspicious RDP ActiveX Client Loaded Elastic (inferred branch)
      • Suspicious WindowsTerminal Child Processes Sigma (inferred branch)
      • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred branch)
      • WSL Child Process Anomaly Sigma (inferred branch)
      • C:\users\public\Documents\dllhost.exe#
        • Potential COLDSTEEL RAT File Indicators Sigma
  • C:\Windows#
    • DNS Over HTTPS by an Unusual Process Elastic (inferred branch)
    • HackTool - SysmonEnte Execution Sigma (inferred branch)
    • Potential DLL Hijacking via Environment Paths Elastic (inferred branch)
    • Potential Privilege Escalation via Missing DLL Elastic (inferred branch)
    • Process Created with a Duplicated Token Elastic (inferred branch)
    • Process Created with an Elevated Token Elastic (inferred branch)
    • ScreenConnect - SlashAndGrab Exploitation Indicators Sigma (inferred branch)
    • SeDebugPrivilege Enabled by an Unusual Microsoft Binary Elastic (inferred branch)
    • Suspicious DLL Loaded for Persistence or Privilege Escalation Elastic (inferred branch)
    • Suspicious Execution via Windows Services Elastic (inferred branch)
    • Suspicious Windows Explorer Execution Elastic (inferred branch)
    • Unexpected SMB Connection from User-mode Process Elastic (inferred branch)
    • Unusual Remote Desktop Client Process Elastic (inferred branch)
    • C:\Windows\addins#
      • Suspicious Process Start Locations Sigma (inferred branch)
    • C:\Windows\ADFS\version.dll#
      • FoggyWeb Backdoor DLL Loading Sigma
    • c:\windows\adws\microsoft.activedirectory.webservices.exe#
      • Hunt for ADWS requests from unknown devices Kusto
    • C:\Windows\appcompat#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\apppatch#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\apppatch\Custom#
      • C:\Windows\apppatch\CustomSDB#
        • New Custom Shim Database Created Sigma (inferred branch)
    • C:\Windows\assembly#
      • DotNET Assembly DLL Loaded Via Office Application Sigma (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • C:\Windows\assembly\GAC_MSIL#
        • C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.Resources.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Security.Resources.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
          • PowerShell Core DLL Loaded By Non PowerShell Process Sigma (inferred path)
          • PowerShell Core DLL Loaded Via Office Application Sigma (inferred path)
          • PowerShell Engine Loaded via Injection Elastic (inferred path)
          • PowerShell without powershell.exe Kusto (inferred path)
          • Unusual PowerShell Engine ImageLoad Elastic (inferred path)
        • C:\Windows\assembly\GAC_MSIL\System.Management.Automation.Resources\1.0.0.0_en_31bf3856ad364e35\System.Management.Automation.Resources.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • PowerShell without powershell.exe Kusto (inferred path)
      • C:\Windows\assembly\NativeImages_v4.0.30319_32#
        • C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f9a5e83#\b69986dfd69101f59cbcf4c3b39f37e0\Microsoft.PowerShell.Security.Activities.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\369b06a78feb3f942f137e97d8a2b014\System.Configuration.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\5bfd72a40b9a7f8070f5725dc111f745\System.Net.Http.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b#\a335f1bfac6fdfa172e7a90c61bb9c59\System.Runtime.WindowsRuntime.UI.Xaml.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a116f7b0afa16a58e03142ea923fd66d\System.Runtime.Serialization.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\f87388646cc7fc167821ede4eaedf66d\System.Xaml.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\e225ab59b706491212b3bd35fe7d3704\System.Xml.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\418434cb331b5a61b8212b302d2670c2\System.Xml.Linq.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
      • C:\Windows\assembly\NativeImages_v4.0.30319_64#
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\1134c490ef121cc3e59d25388ee9814f\Accessibility.ni.dll#
          • UAC Bypass via Windows Firewall Snap-In Hijack Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\381003111201b9e93baa7d91c94ca1bb\Microsoft.PowerShell.Security.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\96f748786db96e4095b0a0402a3cfcae\Microsoft.PowerShell.ConsoleHost.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.We0722664#\cbac57d4af0604641117224898d5342a\Microsoft.WSMan.Management.ni.dll#
          • Suspicious WSMAN Provider Image Loads Sigma (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\9522e9d60dce78466351819fac6f1535\System.Configuration.Install.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data\c0f2267703d2c3d0768dbc57d53e7e3c\System.Data.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\db25590f5c6520057ee01f6d1195a529\System.DirectoryServices.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • Potential Enumeration via Active Directory Web Service Elastic (inferred path)
          • Unusual Kerberos Client Process Elastic (inferred path)
          • Unusual LDAP Client Process Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\5dad8bf588cacf05cd175d4bf7556c04\System.Drawing.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • System Drawing DLL Load Sigma (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\a5059cabee51b63ca636d3c567a63e6e#
          • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\a5059cabee51b63ca636d3c567a63e6e\System.Management.Automation.ni.dll#
            • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
            • PowerShell Core DLL Loaded By Non PowerShell Process Sigma (inferred path)
            • PowerShell Core DLL Loaded Via Office Application Sigma (inferred path)
            • PowerShell Engine Loaded via Injection Elastic (inferred path)
            • PowerShell without powershell.exe Kusto (inferred path)
            • Unusual PowerShell Engine ImageLoad Elastic (inferred path)
          • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\a5059cabee51b63ca636d3c567a63e6e\System.Management.Automation.ni.dll.aux#
            • PowerShell Core DLL Loaded Via Office Application Sigma (inferred path)
            • PowerShell without powershell.exe Kusto (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\d5d4c2f82133638be395e71f5164da00\System.Management.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt73a1fc9d#\5b490bc1c32c959312a53e99eacb6f25\System.Runtime.Remoting.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\d44f46176e6eeb813ad7419aec59ee0b\System.ServiceProcess.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.ServiceModel\3fd1a35ee4a3a0f63ece39ecbccefa45\System.ServiceModel.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Transactions\9dc77def1d4d12af3fc58732dcaa3459\System.Transactions.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.Services\de897f3177d8bdbaa7885d88b2235228\System.Web.Services.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\31927bf0a5cc32035fc779bd4cb73aa1\System.Windows.Forms.ni.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
    • C:\Windows\bcastdvr#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\Boot#
      • Cloud Instance Metadata Credential Path HTTP Request Elastic (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Suspicious Instance Metadata Service (IMDS) API Command Line Execution Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • Windows File Without Extension In Critical Folder Splunk (inferred branch)
      • C:\Windows\Boot\PCAT\bootmgr#
        • Suspicious Critical System Files Modification Elastic (inferred path)
    • C:\Windows\Branding#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\cert.exe#
      • REvil Kaseya Incident Malware Patterns Sigma (inferred path)
    • C:\Windows\CSC#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\CSC\v2.0.6\temp#
        • Driver Load From A Temporary Directory Sigma (inferred branch)
        • LSASS Access From Program In Potentially Suspicious Folder Sigma (inferred branch)
        • Microsoft Excel Add-In Loaded From Uncommon Location Sigma (inferred branch)
        • NTDS.DIT Creation By Uncommon Parent Process Sigma (inferred branch)
        • NTDS.DIT Creation By Uncommon Process Sigma (inferred branch)
        • Potential Maze Ransomware Activity Sigma (inferred branch)
        • Potential SMB Relay Attack Tool Execution Sigma (inferred branch)
        • Service Binary in Suspicious Folder Sigma (inferred branch)
        • Shell Execution via Windows Shortcut File Elastic (inferred branch)
        • Suspicious Process DNS Query Known Abuse Web Services Splunk (inferred branch)
        • Suspicious Process Patterns NTDS.DIT Exfil Sigma (inferred branch)
        • Windows Bluetooth Service Installed From Uncommon Location Splunk (inferred branch)
        • Windows Credentials from Password Stores Chrome Copied in TEMP Dir Splunk (inferred branch)
        • Windows Credentials from Web Browsers Saved in TEMP Folder Splunk (inferred branch)
        • Windows DLL Module Loaded in Temp Dir Splunk (inferred branch)
        • Windows DNS Query Request To TinyUrl Splunk (inferred branch)
        • Windows FFmpeg Audio and Video Device Discovery Splunk (inferred branch)
        • Windows FFmpeg DirectShow Video Capture Splunk (inferred branch)
        • Windows Potential AppDomainManager Hijack Artifacts Creation Splunk (inferred branch)
        • Windows Privilege Escalation Suspicious Process Elevation Splunk (inferred branch)
        • Windows Privilege Escalation User Process Spawn System Process Splunk (inferred branch)
        • Windows Process Execution in Temp Dir Splunk (inferred branch)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred branch)
        • Windows Scheduled Task DLL Module Loaded Splunk (inferred branch)
        • Windows Screen Capture in TEMP folder Splunk (inferred branch)
        • Windows Suspicious Driver Loaded Path Splunk (inferred branch)
        • Windows Theme File Creation in Unusual Location Splunk (inferred branch)
        • Windows Wermgr Alternate Data Stream in Temp Dir Splunk (inferred branch)
        • C:\Windows\CSC\v2.0.6\temp\debug.bin#
          • HackTool - SafetyKatz Dump Indicator Sigma (inferred path)
        • C:\Windows\CSC\v2.0.6\temp\rot.exe#
          • HackTool - Generic Process Access Sigma (inferred path)
        • C:\Windows\CSC\v2.0.6\temp\sam#
          • Potential SAM Database Dump Sigma (inferred path)
        • C:\Windows\CSC\v2.0.6\temp\sqlite32.dll#
        • C:\Windows\CSC\v2.0.6\temp\sqlite64.dll#
          • Sqlite Module In Temp Folder Splunk (inferred path)
        • C:\Windows\CSC\v2.0.6\temp\winwsh.exe#
          • Mustang Panda Dropper Sigma (inferred path)
    • C:\Windows\Cursors#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Suspicious Process Start Locations Sigma (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • Windows Rundll32 with Non-Standard File Extension Splunk (inferred branch)
      • Windows Suspicious Driver Loaded Path Splunk (inferred branch)
      • Windows Suspicious Process File Path Splunk (inferred branch)
    • C:\Windows\debug#
      • Attempt to Establish VScode Remote Tunnel Elastic (inferred branch)
      • Executables Or Script Creation In Suspicious Path Splunk (inferred branch)
      • Process Execution From A Potentially Suspicious Folder Sigma (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Suspicious Process Start Locations Sigma (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • Windows Credentials Access via VaultCli Module Splunk (inferred branch)
      • Windows Potential AppDomainManager Hijack Artifacts Creation Splunk (inferred branch)
      • Windows Rundll32 with Non-Standard File Extension Splunk (inferred branch)
      • Windows Scheduled Task DLL Module Loaded Splunk (inferred branch)
      • Windows Suspicious Driver Loaded Path Splunk (inferred branch)
      • Windows Suspicious Process File Path Splunk (inferred branch)
    • C:\Windows\diagnostics#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\drivers#
      • Suspicious Process Start Locations Sigma (inferred branch)
    • C:\Windows\en-US#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\explorer.exe#
      • Connection to Commonly Abused Free SSL Certificate Providers Elastic
      • Hidden Powershell in Link File Pattern Sigma (inferred path)
      • Potential Execution via Shortcut Modification Elastic (inferred path)
      • Suspicious Execution via ShellBrowserWindow/ShellWindow COM Elastic (inferred path)
      • Untrusted DLL Loaded by a Persistent Program Elastic (inferred path)
      • Windows Installer Execution via Explorer Elastic (inferred path)
    • C:\Windows\Fonts#
      • Executables Or Script Creation In Suspicious Path Splunk (inferred branch)
      • HackTool - LaZagne Execution Sigma (inferred branch)
      • Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder Sigma (inferred branch)
      • Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location Sigma (inferred branch)
      • Process Execution From A Potentially Suspicious Folder Sigma (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Suspicious Process Start Locations Sigma (inferred branch)
      • Suspicious Service Binary Directory Sigma (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • Windows Credentials Access via VaultCli Module Splunk (inferred branch)
      • Windows Potential AppDomainManager Hijack Artifacts Creation Splunk (inferred branch)
      • Windows Rundll32 with Non-Standard File Extension Splunk (inferred branch)
      • Windows Scheduled Task DLL Module Loaded Splunk (inferred branch)
      • Windows Suspicious Driver Loaded Path Splunk (inferred branch)
      • Windows Suspicious Process File Path Splunk (inferred branch)
      • C:\Windows\Fonts\desktop.ini#
        • Desktop.INI Created by Uncommon Process Sigma (inferred path)
    • C:\Windows\Globalization#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\Help#
      • Execution from Suspicious Directory Elastic (inferred branch)
      • Process Execution From A Potentially Suspicious Folder Sigma (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Suspicious Process Start Locations Sigma (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\Help\Help#
        • ScreenConnect - SlashAndGrab Exploitation Indicators Sigma (inferred branch)
    • C:\Windows\HelpPane.exe#
      • Suspicious Execution via IHxHelpPaneServer Elastic (inferred path)
    • C:\Windows\hh.exe#
      • Suspicious Execution via Compiled HTML File Elastic (inferred path)
      • Suspicious Microsoft HTML Help Descendant Elastic (inferred path)
    • C:\Windows\IdentityCRL#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\IME#
      • HackTool - LaZagne Execution Sigma (inferred branch)
      • Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder Sigma (inferred branch)
      • Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location Sigma (inferred branch)
      • Process Execution From A Potentially Suspicious Folder Sigma (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Suspicious Service Binary Directory Sigma (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\ImmersiveControlPanel#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\ImmersiveControlPanel\SystemSettings.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
    • C:\Windows\INF#
      • Execution from Suspicious Directory Elastic (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • Windows File Without Extension In Critical Folder Splunk (inferred branch)
      • Windows Rundll32 with Non-Standard File Extension Splunk (inferred branch)
      • Windows Suspicious Process File Path Splunk (inferred branch)
      • C:\Windows\INF\wdmvsc.PNF#
      • C:\Windows\INF\wnetvsc.PNF#
      • C:\Windows\INF\wstorvsc.PNF#
        • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
    • c:\windows\installer#
      • Suspicious API call via a Windows Installer Module Elastic (inferred branch)
    • C:\Windows\L2Schemas#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\livekd.dmp#
      • LiveKD Kernel Memory Dump File Created Sigma
    • C:\Windows\Logs#
      • Execution from Suspicious Directory Elastic (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\Logs\DISM\dism.log#
        • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
    • C:\Windows\Media#
      • Executables Or Script Creation In Suspicious Path Splunk (inferred branch)
      • Process Execution From A Potentially Suspicious Folder Sigma (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • Windows Credentials Access via VaultCli Module Splunk (inferred branch)
      • Windows Potential AppDomainManager Hijack Artifacts Creation Splunk (inferred branch)
      • Windows Rundll32 with Non-Standard File Extension Splunk (inferred branch)
      • Windows Scheduled Task DLL Module Loaded Splunk (inferred branch)
      • Windows Suspicious Driver Loaded Path Splunk (inferred branch)
      • Windows Suspicious Process File Path Splunk (inferred branch)
    • C:\Windows\Microsoft.NET#
      • Attempt to Disable Windows Defender Services Elastic (inferred branch)
      • Chromium Extension Loaded from Unusual Parent Elastic (inferred branch)
      • Connection to Dynamic DNS Provider by a Signed Binary Proxy Elastic (inferred branch)
      • Connection to WebService by a Signed Binary Proxy Elastic (inferred branch)
      • Defense Evasion via Registry Modification Elastic (inferred branch)
      • Execution via a Suspicious WMI Client Elastic (inferred branch)
      • External IP Address Discovery via a Trusted Program Elastic (inferred branch)
      • Firewall Policy Changed by a Suspicious Process Elastic (inferred branch)
      • Parent Process PID Spoofing Elastic (inferred branch)
      • Persistence via BITS SetNotifyCmdLine Method Elastic (inferred branch)
      • Potential Browser Information Discovery Elastic (inferred branch)
      • Potential Privilege Escalation via Token Impersonation Elastic (inferred branch)
      • Potential Remote Code Injection Elastic (inferred branch)
      • Suspicious Execution via DCOM Elastic (inferred branch)
      • Suspicious PowerShell Console History Deletion Elastic (inferred branch)
      • Suspicious Registry Modification via WMI Elastic (inferred branch)
      • Suspicious Windows Defender Exclusions Added via PowerShell Elastic (inferred branch)
      • Suspicious Windows Defender Registry Modification Elastic (inferred branch)
      • Suspicious Windows Explorer Execution Elastic (inferred branch)
      • Suspicious Windows Script Interpreter Child Process Elastic (inferred branch)
      • Uncommon Persistence via Registry Modification Elastic (inferred branch)
      • Unusual PowerShell Engine ImageLoad Elastic (inferred branch)
      • Unusual Remote Desktop Client Process Elastic (inferred branch)
      • Windows Defender Exclusions by Extension Elastic (inferred branch)
      • C:\Windows\Microsoft.NET\assembly\GAC_MSIL#
        • GAC DLL Loaded Via Office Applications Sigma (inferred branch)
        • C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Activities\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.Activities.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
      • C:\Windows\Microsoft.NET\Framework#
        • AspNetCompiler Execution Sigma (inferred branch)
        • Potentially Suspicious ASP.NET Compilation Via AspNetCompiler Sigma (inferred branch)
        • Suspicious Execution of InstallUtil Without Log Sigma (inferred branch)
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe#
            • Suspicious Execution via DotNet Remoting Elastic (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe#
            • AddinUtil.EXE Execution From Uncommon Directory Sigma (inferred path)
            • Network Connection Initiated By AddinUtil.EXE Sigma (inferred path)
            • Suspicious AddinUtil.EXE CommandLine Execution Sigma (inferred path)
            • Uncommon AddinUtil.EXE CommandLine Execution Sigma (inferred path)
            • Uncommon Child Process Of AddinUtil.EXE Sigma (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users#
            • DLL Loaded From Suspicious Location Via Cmspt.EXE Sigma (inferred branch)
            • Windows Known Abused DLL Created Splunk (inferred branch)
            • Windows Privilege Escalation Suspicious Process Elevation Splunk (inferred branch)
            • Windows Privilege Escalation User Process Spawn System Process Splunk (inferred branch)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe#
            • AspNetCompiler Execution Sigma (inferred path)
            • Assembly DLL Creation Via AspNetCompiler Sigma (inferred path)
            • Potential Evasion via ASP.NET Compiler Elastic (inferred path)
            • Potentially Suspicious ASP.NET Compilation Via AspNetCompiler Sigma (inferred path)
            • Suspicious Child Process of AspNetCompiler Sigma (inferred path)
            • Windows Proxy Execution of .NET Utilities via Scripts Splunk (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe#
            • Microsoft IIS Connection Strings Decryption Elastic (inferred path)
            • Microsoft IIS Connection Strings Decryption Sigma (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll#
            • CLR DLL Loaded Via Office Applications Sigma (inferred path)
            • Common Language Runtime Loaded via an Unsigned Module Elastic (inferred path)
            • Delayed Common Language Runtime Load Elastic (inferred path)
            • DotNet CLR DLL Loaded By Scripting Applications Sigma (inferred path)
            • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
            • Microsoft Common Language Runtime Loaded from Modified Memory Elastic (inferred path)
            • Microsoft Common Language Runtime Loaded from Suspicious Memory Elastic (inferred path)
            • Potential Exploitation via ComDotNet Exploit Elastic (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe#
            • CSC Net On The Fly Compilation Splunk (inferred path)
            • Csc.EXE Execution Form Potentially Suspicious Parent Sigma (inferred path)
            • Dynamic .NET Compilation Via Csc.EXE Sigma (inferred path)
            • Dynamic .NET Compilation Via Csc.EXE - Hunting Sigma (inferred path)
            • Exploit for CVE-2017-8759 Sigma (inferred path)
            • GenAI Process Compiling or Generating Executables Elastic (inferred path)
            • Managed .NET Code Execution via PowerShell Elastic (inferred path)
            • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
            • Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE Sigma (inferred path)
            • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
            • Remote Access Tool - ScreenConnect Server Web Shell Execution Sigma (inferred path)
            • Rename System Utilities Kusto (inferred path)
            • ScreenConnect Server Spawning Suspicious Processes Elastic (inferred path)
            • Suspicious .NET Code Compilation Elastic (inferred path)
            • Suspicious WindowsTerminal Child Processes Sigma (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe#
            • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
            • Visual Basic Command Line Compiler Usage Sigma (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe#
            • LOLBAS Data Exfiltration by DataSvcUtil.exe Sigma (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe#
            • ClickOnce Deployment Execution - Dfsvc.EXE Child Process Sigma (inferred path)
            • Dfsvc.EXE Initiated Network Connection Over Uncommon Port Sigma (inferred path)
            • Dfsvc.EXE Network Connection To Non-Local IPs Sigma (inferred path)
            • Execution via Microsoft DotNet ClickOnce Host Elastic (inferred path)
            • Rename System Utilities Kusto (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe#
            • C# IL Code Compilation Via Ilasm.EXE Sigma (inferred path)
            • Rename System Utilities Kusto (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe#
            • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
            • File Download Via InstallUtil.EXE Sigma (inferred path)
            • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
            • InstallUtil Activity Elastic (inferred path)
            • InstallUtil Process Making Network Connections Elastic (inferred path)
            • LOLBIN Execution From Abnormal Drive Sigma (inferred path)
            • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
            • Potential PowerShell Execution Via DLL Sigma (inferred path)
            • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
            • Rename System Utilities Kusto (inferred path)
            • Services LOLBAS Execution Process Spawn Splunk (inferred path)
            • Startup Persistence by a Suspicious Process Elastic (inferred path)
            • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
            • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
            • Suspicious Execution from a Mounted Device Elastic (inferred path)
            • Suspicious Execution of InstallUtil Without Log Sigma (inferred path)
            • Suspicious Execution via Compiled HTML File Elastic (inferred path)
            • Suspicious Microsoft Office Child Process Sigma (inferred path)
            • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
            • Suspicious MS Outlook Child Process Elastic (inferred path)
            • Suspicious PDF Reader Child Process Elastic (inferred path)
            • Unsigned DLL Loaded by Windows Utility Sigma (inferred path)
            • Windows InstallUtil Remote Network Connection Splunk (inferred path)
            • Windows InstallUtil Uninstall Option Splunk (inferred path)
            • Windows InstallUtil URL in Command Line Splunk (inferred path)
            • Windows Proxy Execution of .NET Utilities via Scripts Splunk (inferred path)
            • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
            • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
            • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe#
            • JScript Compiler Execution Sigma (inferred path)
            • Rename System Utilities Kusto (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe#
            • Microsoft Workflow Compiler Execution Sigma (inferred path)
            • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
            • Rename System Utilities Kusto (inferred path)
            • Services LOLBAS Execution Process Spawn Splunk (inferred path)
            • Suspicious Execution from a Mounted Device Elastic (inferred path)
            • Suspicious Microsoft Office Child Process Sigma (inferred path)
            • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
            • Suspicious microsoft workflow compiler usage Splunk (inferred path)
            • Suspicious MS Outlook Child Process Elastic (inferred path)
            • Suspicious mshta child process Splunk (inferred path)
            • Suspicious PDF Reader Child Process Elastic (inferred path)
            • Unusual Process Network Connection Elastic (inferred path)
            • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
            • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe#
            • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
            • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
            • Execution via MS VisualStudio Pre/Post Build Events Elastic (inferred path)
            • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
            • Microsoft Build Engine Started by a System Process Elastic (inferred path)
            • Microsoft Build Engine Started by an Office Application Elastic (inferred path)
            • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
            • MsBuild Making Network Connections Elastic (inferred path)
            • MSBuild Suspicious Spawned By Script Process Splunk (inferred path)
            • Potential Credential Access via Trusted Developer Utility Elastic (inferred path)
            • Potential SAP NetWeaver Exploitation Elastic (inferred path)
            • Process Injection by the Microsoft Build Engine Elastic (inferred path)
            • Protected Process from Unusual Parent Elastic (inferred path)
            • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
            • Rename System Utilities Kusto (inferred path)
            • Script Event Consumer Spawning Process Sigma (inferred path)
            • Services LOLBAS Execution Process Spawn Splunk (inferred path)
            • Silenttrinity Stager Msbuild Activity Sigma (inferred path)
            • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
            • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
            • Suspicious Execution from a Mounted Device Elastic (inferred path)
            • Suspicious Execution from a Mounted Device Elastic (inferred path)
            • Suspicious Execution via Compiled HTML File Elastic (inferred path)
            • Suspicious Microsoft Office Child Process Sigma (inferred path)
            • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
            • Suspicious Msbuild Execution By Uncommon Parent Process Sigma (inferred path)
            • Suspicious MSBuild Spawn Splunk (inferred path)
            • Suspicious mshta child process Splunk (inferred path)
            • Suspicious Outlook Child Process Sigma (inferred path)
            • Suspicious PDF Reader Child Process Elastic (inferred path)
            • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
            • Windows Proxy Execution of .NET Utilities via Scripts Splunk (inferred path)
            • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
            • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
            • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
            • Wscript Or Cscript Suspicious Child Process Splunk (inferred path)
            • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll#
            • Detect .NET runtime being loaded in JScript for code execution Kusto (inferred path)
            • DotNet CLR DLL Loaded By Scripting Applications Sigma (inferred path)
            • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll#
            • Potential DLL Sideloading Of MsCorSvc.DLL Sigma (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\NativeImages#
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\NativeImages\mscorlib.ni.dll#
              • Detect .NET runtime being loaded in JScript for code execution Kusto (inferred path)
              • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\NativeImages\system.core.ni.dll#
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\NativeImages\system.ni.dll#
              • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#
            • Bad Opsec Defaults Sacrificial Processes With Improper Arguments Sigma (inferred path)
            • Detect Regasm Spawning a Process Splunk (inferred path)
            • Detect Regasm with no Command Line Arguments Splunk (inferred path)
            • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
            • Network Connection via Registration Utility Elastic (inferred path)
            • Potential PowerShell Execution Via DLL Sigma (inferred path)
            • Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location Sigma (inferred path)
            • Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension Sigma (inferred path)
            • RegAsm.EXE Execution Without CommandLine Flags or Files Sigma (inferred path)
            • RegAsm.EXE Initiating Network Connection To Public IP Sigma (inferred path)
            • Rename System Utilities Kusto (inferred path)
            • Services LOLBAS Execution Process Spawn Splunk (inferred path)
            • Startup Persistence by a Suspicious Process Elastic (inferred path)
            • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
            • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
            • Suspicious Microsoft Office Child Process Sigma (inferred path)
            • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
            • Suspicious MS Outlook Child Process Elastic (inferred path)
            • Suspicious PDF Reader Child Process Elastic (inferred path)
            • Unsigned DLL Loaded by Windows Utility Sigma (inferred path)
            • Windows Proxy Execution of .NET Utilities via Scripts Splunk (inferred path)
            • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
            • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe#
            • Bad Opsec Defaults Sacrificial Processes With Improper Arguments Sigma (inferred path)
            • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
            • Detect Regsvcs Spawning a Process Splunk (inferred path)
            • Detect Regsvcs with No Command Line Arguments Splunk (inferred path)
            • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
            • Network Connection via Registration Utility Elastic (inferred path)
            • Potential PowerShell Execution Via DLL Sigma (inferred path)
            • Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location Sigma (inferred path)
            • Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension Sigma (inferred path)
            • Rename System Utilities Kusto (inferred path)
            • Services LOLBAS Execution Process Spawn Splunk (inferred path)
            • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
            • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
            • Suspicious Execution from a Mounted Device Elastic (inferred path)
            • Suspicious Microsoft Office Child Process Sigma (inferred path)
            • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
            • Suspicious MS Outlook Child Process Elastic (inferred path)
            • Suspicious PDF Reader Child Process Elastic (inferred path)
            • Unsigned DLL Loaded by Windows Utility Sigma (inferred path)
            • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
            • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe#
            • SafeBoot Registry Key Deleted Via Reg.EXE Sigma (inferred path)
            • Service Registry Key Deleted Via Reg.EXE Sigma (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Activities.Core.Presentation.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Activities.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Activities.DurableInstancing.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Activities.Presentation.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.AddIn.Contract.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.AddIn.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.AppContext.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Collections.Concurrent.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Collections.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Collections.NonGeneric.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Collections.Specialized.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ComponentModel.Annotations.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ComponentModel.Composition.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\system.componentmodel.composition.registration.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ComponentModel.DataAnnotations.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ComponentModel.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ComponentModel.EventBasedAsync.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ComponentModel.Primitives.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ComponentModel.TypeConverter.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Configuration.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Configuration.Install.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Console.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Core.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Common.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.DataSetExtensions.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Entity.Design.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Entity.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Linq.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.OracleClient.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.Client.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.Design.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.SqlXml.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Deployment.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Design.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Device.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Diagnostics.Contracts.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Diagnostics.Debug.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Diagnostics.FileVersionInfo.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Diagnostics.Process.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Diagnostics.StackTrace.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Diagnostics.TextWriterTraceListener.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Diagnostics.Tools.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Diagnostics.TraceSource.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Diagnostics.Tracing.dll#
            • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.DirectoryServices.AccountManagement.dll#
            • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
            • Potential Enumeration via Active Directory Web Service Elastic (inferred path)
            • Unusual Kerberos Client Process Elastic (inferred path)
            • Unusual LDAP Client Process Elastic (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.DirectoryServices.dll#
            • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
            • Potential Enumeration via Active Directory Web Service Elastic (inferred path)
            • Unusual LDAP Client Process Elastic (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.DirectoryServices.Protocols.dll#
            • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
            • Potential Enumeration via Active Directory Web Service Elastic (inferred path)
            • Unusual Kerberos Client Process Elastic (inferred path)
            • Unusual LDAP Client Process Elastic (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.Design.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.Primitives.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Dynamic.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Dynamic.Runtime.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.Thunk.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.Wrapper.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Globalization.Calendars.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Globalization.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Globalization.Extensions.dll#
            • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IdentityModel.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IdentityModel.Selectors.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IdentityModel.Services.dll#
            • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
            • Potential Enumeration via Active Directory Web Service Elastic (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.Compression.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.Compression.FileSystem.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.Compression.ZipFile.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.FileSystem.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.FileSystem.DriveInfo.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.FileSystem.Primitives.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.FileSystem.Watcher.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.IsolatedStorage.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.Log.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.MemoryMappedFiles.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.Pipes.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.UnmanagedMemoryStream.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Linq.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Linq.Expressions.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Linq.Parallel.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Linq.Queryable.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Management.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Management.Instrumentation.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Messaging.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.Http.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.Http.Rtc.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.Http.WebRequest.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.NameResolution.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.NetworkInformation.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.Ping.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.Primitives.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.Requests.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.Security.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.Sockets.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.WebHeaderCollection.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.WebSockets.Client.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.WebSockets.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Numerics.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ObjectModel.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Reflection.context.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Reflection.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Reflection.Emit.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Reflection.Emit.ILGeneration.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Reflection.Emit.Lightweight.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Reflection.Extensions.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Reflection.Primitives.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Resources.Reader.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Resources.ResourceManager.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Resources.Writer.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Caching.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.CompilerServices.VisualC.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.DurableInstancing.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Extensions.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Handles.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.InteropServices.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.InteropServices.RuntimeInformation.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.InteropServices.WindowsRuntime.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Numerics.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Remoting.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.Formatters.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.Formatters.Soap.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.Json.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.Primitives.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.Xml.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.WindowsRuntime.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.WindowsRuntime.UI.Xaml.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Claims.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Cryptography.Algorithms.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Cryptography.Csp.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Cryptography.Encoding.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Cryptography.Primitives.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Cryptography.X509Certificates.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Principal.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.SecureString.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Activation.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Activities.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Channels.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Discovery.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Duplex.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Http.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Internals.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.NetTcp.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Primitives.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Routing.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Security.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.ServiceMoniker40.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.WasHosting.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Web.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceProcess.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Text.Encoding.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Text.Encoding.Extensions.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Text.RegularExpressions.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Threading.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Threading.Overlapped.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Threading.Tasks.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Threading.Tasks.Parallel.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Threading.Thread.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Threading.ThreadPool.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Threading.Timer.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Transactions.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ValueTuple.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Abstractions.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.ApplicationServices.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.DataVisualization.Design.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.DataVisualization.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.DynamicData.Design.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.DynamicData.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Entity.Design.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Entity.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Extensions.Design.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Extensions.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Mobile.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.RegularExpressions.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Routing.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Services.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Windows.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Windows.Forms.DataVisualization.Design.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Windows.Forms.DataVisualization.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Windows.Forms.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Workflow.Activities.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Workflow.ComponentModel.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Workflow.Runtime.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.WorkflowServices.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xaml.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xaml.Hosting.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.XML.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.Linq.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.ReaderWriter.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.Serialization.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.XDocument.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.XmlDocument.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.XmlSerializer.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.XPath.dll#
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.XPath.XDocument.dll#
            • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe#
            • GenAI Process Compiling or Generating Executables Elastic (inferred path)
            • Lummac Stealer Activity - Execution Of More.com And Vbc.exe Sigma (inferred path)
            • Rename System Utilities Kusto (inferred path)
            • Suspicious .NET Code Compilation Elastic (inferred path)
            • Visual Basic Command Line Compiler Usage Sigma (inferred path)
            • Windows Proxy Execution of .NET Utilities via Scripts Splunk (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\WMINet_Utils.dll#
            • Suspicious WMI Library Load Elastic (inferred path)
            • WMI module loaded by suspicious process Sigma (inferred path)
            • WMI Module Loaded By Uncommon Process Sigma (inferred path)
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF#
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\System.Printing.dll#
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\System.Speech.dll#
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\System.Windows.Controls.Ribbon.dll#
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\System.Windows.Input.Manipulations.dll#
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\System.Windows.Presentation.dll#
              • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
      • C:\Windows\Microsoft.NET\Framework64#
        • AspNetCompiler Execution Sigma (inferred branch)
        • Potentially Suspicious ASP.NET Compilation Via AspNetCompiler Sigma (inferred branch)
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Users#
          • DLL Loaded From Suspicious Location Via Cmspt.EXE Sigma (inferred branch)
          • Windows Known Abused DLL Created Splunk (inferred branch)
          • Windows Privilege Escalation Suspicious Process Elevation Splunk (inferred branch)
          • Windows Privilege Escalation User Process Spawn System Process Splunk (inferred branch)
      • C:\Windows\Microsoft.NET\FrameworkArm#
      • C:\Windows\Microsoft.NET\FrameworkArm64#
        • AspNetCompiler Execution Sigma (inferred branch)
        • Potentially Suspicious ASP.NET Compilation Via AspNetCompiler Sigma (inferred branch)
    • C:\Windows\Migration#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\MsMpEng.exe#
      • REvil Kaseya Incident Malware Patterns Sigma (inferred path)
    • C:\Windows\notepad.exe#
      • Connection to Commonly Abused Free SSL Certificate Providers Elastic
      • Unusual Remote Desktop Client Process Elastic (inferred path)
    • C:\Windows\oci.dll#
      • Pingback Backdoor DLL Loading Activity Sigma
      • Pingback Backdoor File Indicators Sigma
    • C:\Windows\OCR#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\Panther#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\Panther\Unattend#
        • C:\Windows\Panther\Unattend\Unattend.xml#
        • C:\Windows\Panther\Unattend\Unattended.xml#
          • Sensitive File Access - Unattended Panther Elastic (inferred path)
      • C:\Windows\Panther\unattend.xml#
        • Sensitive File Access - Unattended Panther Elastic (inferred path)
        • Unattend.XML File Access Attempt Sigma (inferred path)
      • C:\Windows\Panther\Unattended.xml#
        • Sensitive File Access - Unattended Panther Elastic (inferred path)
    • C:\Windows\PLA#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\PLA\Reports#
        • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
        • Windows Process Writing File to World Writable Path Splunk (inferred branch)
        • C:\Windows\PLA\Reports\en-US#
          • Windows Process Writing File to World Writable Path Splunk (inferred branch)
      • C:\Windows\PLA\Rules#
        • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
        • Windows Process Writing File to World Writable Path Splunk (inferred branch)
        • C:\Windows\PLA\Rules\en-US#
          • Windows Process Writing File to World Writable Path Splunk (inferred branch)
      • C:\Windows\PLA\Templates#
        • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
        • Windows Process Writing File to World Writable Path Splunk (inferred branch)
    • C:\Windows\PolicyDefinitions#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\PolicyDefinitions\postgresql.exe#
        • Hermetic Wiper TG Process Patterns Sigma (inferred path)
    • C:\Windows\Prefetch#
      • Prefetch File Deleted Sigma (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • Windows Rundll32 with Non-Standard File Extension Splunk (inferred branch)
      • Windows Suspicious Driver Loaded Path Splunk (inferred branch)
      • Windows Suspicious Process File Path Splunk (inferred branch)
      • C:\Windows\Prefetch\CMD.EXE-0BD30981.pf#
        • Suspicious File Execution From Internet Hosted WebDav Share Sigma (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
      • C:\Windows\Prefetch\POWERSHELL.EXE-CA1AE517.pf#
        • Command-Line Interface Execution (Windows Event Log) Splunk (inferred path)
        • Copy From Or To Admin Share Or Sysvol Folder Sigma (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
      • C:\Windows\Prefetch\REGSVR32.EXE-03D3FB87.pf#
      • C:\Windows\Prefetch\REGSVR32.EXE-B31EC963.pf#
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
    • C:\Windows\Provisioning#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\PSEXESVC.exe#
      • PsExec Service Child Process Execution as LOCAL SYSTEM Sigma (inferred path)
      • PsExec Service Execution Sigma (inferred path)
      • PsExec Service File Creation Sigma (inferred path)
      • PsExec Service Installation Sigma (inferred path)
    • C:\Windows\Registration#
      • Windows Snake Malware File Modification Crmlog Splunk (inferred branch)
      • C:\Windows\Registration\CRMLog#
        • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
        • Windows Process Writing File to World Writable Path Splunk (inferred branch)
    • C:\Windows\rescache#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\Resources#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\Resources\Themes#
        • Suspicious Windows Defender Exclusions Added via PowerShell Elastic (inferred branch)
    • C:\Windows\schemas#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\security#
      • Process Execution From A Potentially Suspicious Folder Sigma (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\ServiceProfiles#
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT#
        • Registry Hive File Staged Outside Standard User Profile Path Sigma (inferred path)
    • C:\Windows\ServiceState#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\servicing#
      • Executables Or Script Creation In Suspicious Path Splunk (inferred branch)
      • Potential Privilege Escalation via Token Impersonation Elastic (inferred branch)
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • Windows Credentials Access via VaultCli Module Splunk (inferred branch)
      • Windows File Without Extension In Critical Folder Splunk (inferred branch)
      • Windows Potential AppDomainManager Hijack Artifacts Creation Splunk (inferred branch)
      • Windows Scheduled Task DLL Module Loaded Splunk (inferred branch)
      • C:\Windows\servicing\TrustedInstaller.exe#
        • Regedit as Trusted Installer Sigma (inferred path)
    • C:\Windows\Setup#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\Setup\Scripts\ErrorHandler.cmd#
        • Potential Persistence Attempt Via ErrorHandler.Cmd Sigma (inferred path)
    • C:\Windows\ShellComponents#
    • C:\Windows\ShellExperiences#
    • C:\Windows\SKB#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\SoftwareDistribution\Download\Install#
      • Potential WSUS Abuse for Lateral Movement Elastic (inferred branch)
    • C:\Windows\splwow64.exe#
      • Suspicious Splwow64 Without Params Sigma (inferred path)
    • C:\Windows\Sys?????\msiexec.exe#
      • Suspicious Memory Mapping from a Windows Installer Elastic (inferred path)
    • C:\Windows\System#
      • Connection to Commonly Abused Free SSL Certificate Providers Elastic (inferred branch)
      • Potential Privilege Escalation via Missing DLL Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\System32#
      • Batch File Write to System32 Splunk (inferred branch)
      • COLDSTEEL RAT Anonymous User Process Execution Sigma (inferred branch)
      • Command Shell Execution from Untrusted Origin Elastic (inferred branch)
      • Connection to Commonly Abused Free SSL Certificate Providers Elastic (inferred branch)
      • Control Panel Process with Unusual Arguments Elastic (inferred branch)
      • CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum Sigma (inferred branch)
      • LSASS Access Attempt from Unbacked Memory Elastic (inferred branch)
      • Potential Execution via Sliver Framework Elastic (inferred branch)
      • Potential Image Load with a Spoofed Creation Time Elastic (inferred branch)
      • Potential Privilege Escalation Attempt Via .Exe.Local Technique Sigma (inferred branch)
      • Potential Privilege Escalation via DLL Redirection Elastic (inferred branch)
      • Potential Privilege Escalation via Elevated IFileOperation Elastic (inferred branch)
      • Potential Privilege Escalation via File Redirection Elastic (inferred branch)
      • Potential Privilege Escalation via Missing DLL Elastic (inferred branch)
      • Potential Privilege Escalation via Token Impersonation Elastic (inferred branch)
      • Potential Process Injection from Malicious Document Elastic (inferred branch)
      • Potential Remote Credential Access via Registry Elastic (inferred branch)
      • Potential Timestomp in Executable Files Elastic (inferred branch)
      • SOURGUM Actor Behaviours Sigma (inferred branch)
      • Suspicious Execution via Windows Subsystem for Linux Elastic (inferred branch)
      • Suspicious Script Object Execution Elastic (inferred branch)
      • Suspicious System Path File Overwrite Elastic (inferred branch)
      • Suspicious Windows Script Interpreter Child Process Elastic (inferred branch)
      • UAC Bypass Attempt via CDSSync Scheduled Task Hijack Elastic (inferred branch)
      • UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface Elastic (inferred branch)
      • UAC Bypass Using Consent and Comctl32 - File Sigma (inferred branch)
      • UAC Bypass Using IDiagnostic Profile - File Sigma (inferred branch)
      • Unsigned DLL Loaded from Fake Windows Directory Elastic (inferred branch)
      • Untrusted DLL Loaded by a System Windows Process Elastic (inferred branch)
      • Unusual LDAP Client Process Elastic (inferred branch)
      • Unusual PowerShell Engine ImageLoad Elastic (inferred branch)
      • Unusual Remote Desktop Client Process Elastic (inferred branch)
      • VirtualProtect via Indirect Syscall Elastic (inferred branch)
      • Windows MsMpEng Writing to System32 Splunk (inferred branch)
      • Windows Unsigned DLL Side-Loading Splunk (inferred branch)
      • C:\Windows\System32\aclui.dll#
        • Potential Raspberry Robin Aclui Dll SideLoading Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\activeds.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\adsldp.dll#
        • MS Scripting Process Loading Ldap Module Splunk (inferred path)
      • C:\Windows\System32\adsldpc.dll#
        • MS Scripting Process Loading Ldap Module Splunk (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\aepic.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\amsi.dll#
        • Amsi.DLL Load By Uncommon Process Sigma (inferred path)
        • Amsi.DLL Loaded Via LOLBIN Process Sigma (inferred path)
        • Library Load from a Truncated Stack Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • Potential AMSI Bypass via SetThreadContext Elastic (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\apds.dll#
        • Script Execution via APDS XSS Injection Elastic (inferred path)
      • C:\Windows\System32\apphelp.dll#
      • C:\Windows\System32\ApplicationFrame.dll#
      • C:\Windows\System32\appraiser.dll#
      • C:\Windows\System32\AppVPolicy.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\appwiz.cpl#
        • System Control Panel Item Loaded From Uncommon Location Sigma (inferred path)
      • C:\Windows\System32\AppxAllUserStore.dll#
      • C:\Windows\System32\AppXDeploymentClient.dll#
      • C:\Windows\System32\archiveint.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\ARP.EXE#
        • Network Connection Discovery With Arp Splunk (inferred path)
        • Obfuscated IP Via CLI Sigma (inferred path)
        • Potential Process Injection Via Msra.EXE Sigma (inferred path)
        • Qakbot Discovery Activies Kusto (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Windows Cmdline Tool Execution From Non-Shell Process Splunk (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
      • C:\Windows\System32\at.exe#
        • At.exe Command Lateral Movement Elastic (inferred path)
        • Interactive AT Job Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Scheduled Task Creation on Remote Endpoint using At Splunk (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\AtBroker.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Uncommon Assistive Technology Applications Execution Via AtBroker.EXE Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\atl.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\attrib.exe#
        • Adding Hidden File Attribute via Attrib Elastic (inferred path)
        • File and Directory Permissions Modification Elastic (inferred path)
        • File or Folder Permissions Modifications Sigma (inferred path)
        • HackTool - Jlaive In-Memory Assembly Execution Sigma (inferred path)
        • Hiding Files And Directories With Attrib exe Splunk (inferred path)
        • Hiding Files with Attrib.exe Sigma (inferred path)
        • Set Files as System Files Using Attrib.EXE Sigma (inferred path)
        • Set Suspicious Files as System Files Using Attrib.EXE Sigma (inferred path)
        • Windows Default Rdp File Unhidden Splunk (inferred path)
      • C:\Windows\System32\audiodg.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\AudioSes.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\auditpol.exe#
        • Audit Policy Tampering Via Auditpol Sigma (inferred path)
        • Disable Windows Event and Security Logs Using Built-in Tools Elastic (inferred path)
        • Windows Audit Policy Auditing Option Disabled via Auditpol Splunk (inferred path)
        • Windows Audit Policy Cleared via Auditpol Splunk (inferred path)
        • Windows Audit Policy Disabled via Auditpol Splunk (inferred path)
        • Windows Audit Policy Disabled via Legacy Auditpol Splunk (inferred path)
        • Windows Audit Policy Excluded Category via Auditpol Splunk (inferred path)
        • Windows Audit Policy Restored via Auditpol Splunk (inferred path)
        • Windows Audit Policy Security Descriptor Tampering via Auditpol Splunk (inferred path)
        • Windows Global Object Access Audit List Cleared Via Auditpol Splunk (inferred path)
      • C:\Windows\System32\auditpolcore.dll#
      • C:\Windows\System32\authfwcfg.dll#
      • C:\Windows\System32\authz.dll#
      • C:\Windows\System32\avrt.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\axeonoffhelper.dll#
        • Creation Of Non-Existent System DLL Sigma (inferred path)
        • Potential DLL Sideloading Of Non-Existent DLLs From System Folders Sigma (inferred path)
        • Windows Phantom DLL Created on Disk Splunk (inferred path)
      • C:\Windows\System32\backgroundTaskHost.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Windows Process Injection into Commonly Abused Processes Splunk (inferred path)
      • C:\Windows\System32\bash.exe#
        • Indirect Command Execution From Script File Via Bash.EXE Sigma (inferred path)
        • Indirect Inline Command Execution Via Bash.EXE Sigma (inferred path)
      • C:\Windows\System32\batmeter.dll#
      • C:\Windows\System32\bcd.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\bcdedit.exe#
        • Bcdedit Command Back To Normal Mode Boot Splunk (inferred path)
        • BCDEdit Failure Recovery Modification Splunk (inferred path)
        • BCDEdit Safe Mode Command Execution Elastic (inferred path)
        • Boot Configuration Tampering Via Bcdedit.EXE Sigma (inferred path)
        • Change To Safe Mode With Network Config Splunk (inferred path)
        • Code Signing Policy Modification Through Built-in tools Elastic (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Modification of Boot Configuration Elastic (inferred path)
        • Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE Sigma (inferred path)
        • Prevent Automatic Repair Mode using Bcdedit Splunk (inferred path)
        • Rorschach Ransomware Execution Activity Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\BCP47Langs.dll#
      • C:\Windows\System32\BCP47mrm.dll#
      • C:\Windows\System32\bcrypt.dll#
      • C:\Windows\System32\bderepair.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\bindfltapi.dll#
        • BindFltApi Loaded by an Unusual Process Elastic (inferred path)
      • C:\Windows\System32\BitLockerWizardElev.exe#
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\bitsadmin.exe#
        • BITS Job Persistence Splunk (inferred path)
        • Bitsadmin Activity Elastic (inferred path)
        • Bitsadmin Activity Kusto (inferred path)
        • BITSAdmin Download File Splunk (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Exploited CVE-2020-10189 Zoho ManageEngine Sigma (inferred path)
        • File Download Via Bitsadmin Sigma (inferred path)
        • File Download Via Bitsadmin To A Suspicious Target Folder Sigma (inferred path)
        • File With Suspicious Extension Downloaded Via Bitsadmin Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Monitoring For Persistence Via BITS Sigma (inferred path)
        • New BITS Job Created Via Bitsadmin Sigma (inferred path)
        • Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) Sigma (inferred path)
        • Potentially Suspicious Execution From Parent Process In Public Folder Sigma (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious BitLocker Access Agent Update Utility Execution Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process of SAP NetWeaver Sigma (inferred path)
        • Suspicious Child Process Of SQL Server Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Download From Direct IP Via Bitsadmin Sigma (inferred path)
        • Suspicious Download From File-Sharing Website Via Bitsadmin Sigma (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution via Microsoft Exchange Transport Agent Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious MSHTA Child Process Sigma (inferred path)
        • Suspicious mshta child process Splunk (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious Process Parents Sigma (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Processes Spawned by WinRM Sigma (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows Office Product Spawned Uncommon Process Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process of TieringEngineService.exe Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • WinRAR Spawning Shell Application Splunk (inferred path)
        • WinRM Spawning a Process Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\BitsProxy.dll#
        • BITS Client BitsProxy DLL Loaded By Uncommon Process Sigma (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • Unsigned BITS Service Client Process Elastic (inferred path)
      • C:\Windows\System32\Boot#
        • Cloud Instance Metadata Credential Path HTTP Request Elastic (inferred branch)
        • Suspicious Instance Metadata Service (IMDS) API Command Line Execution Elastic (inferred branch)
        • Windows File Without Extension In Critical Folder Splunk (inferred branch)
        • C:\Windows\System32\Boot\winload.efi#
        • C:\Windows\System32\Boot\winload.exe#
          • Suspicious Critical System Files Modification Elastic (inferred path)
      • C:\Windows\System32\BootMenuUX.dll#
      • C:\Windows\System32\bootux.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\bthprops.cpl#
        • System Control Panel Item Loaded From Uncommon Location Sigma (inferred path)
      • C:\Windows\System32\cabinet.dll#
      • C:\Windows\System32\cabview.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\cacls.exe#
        • Excessive Usage Of Cacls App Splunk (inferred path)
        • File and Directory Permissions Modification Elastic (inferred path)
        • File or Folder Permissions Modifications Sigma (inferred path)
        • Icacls Deny Command Splunk (inferred path)
        • ICACLS Grant Command Splunk (inferred path)
        • Modify ACL permission To Files Or Folder Splunk (inferred path)
        • Windows File and Directory Enable ReadOnly Permissions Splunk (inferred path)
        • Windows File and Directory Permissions Enable Inheritance Splunk (inferred path)
        • Windows File and Directory Permissions Remove Inheritance Splunk (inferred path)
        • Windows Files and Dirs Access Rights Modification Via Icacls Splunk (inferred path)
      • C:\Windows\System32\calc.exe#
        • LOLBIN Execution From Abnormal Drive Sigma (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Potentially Suspicious Child Process Of VsCode Sigma (inferred path)
        • Remote Thread Creation In Uncommon Target Image Sigma (inferred path)
        • Sdiagnhost Calling Suspicious Child Process Sigma (inferred path)
        • Suspicious Calculator Usage Sigma (inferred path)
        • Suspicious Child Process of AspNetCompiler Sigma (inferred path)
        • Suspicious Child Process Of BgInfo.EXE Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Cross-User Process Spawn Sigma (inferred path)
        • Suspicious Process Parents Sigma (inferred path)
        • Suspicious Provlaunch.EXE Child Process Sigma (inferred path)
        • Suspicious SYSTEM User Process Creation Sigma (inferred path)
        • Uncommon Process Access Rights For Target Image Sigma (inferred path)
        • Windows App Layer Protocol Qakbot NamedPipe Splunk (inferred path)
        • Windows DLL Side-Loading Process Child Of Calc Splunk (inferred path)
        • Windows Process Injection into Commonly Abused Processes Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • WSL Child Process Anomaly Sigma (inferred path)
      • C:\Windows\System32\cdpsgshims.dll#
        • Creation Of Non-Existent System DLL Sigma (inferred path)
        • Potential DLL Sideloading Of Non-Existent DLLs From System Folders Sigma (inferred path)
        • Windows Phantom DLL Created on Disk Splunk (inferred path)
      • C:\Windows\System32\certcli.dll#
      • C:\Windows\System32\CertEnroll.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\certreq.exe#
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Execution of a File Written by a Signed Binary Proxy Elastic (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • Ingress DLL Transfer followed by DLL SideLoading Elastic (inferred path)
        • Ingress Transfer via Windows Utility Elastic (inferred path)
        • Legitimate Application Dropped Archive Sigma (inferred path)
        • Legitimate Application Dropped Executable Sigma (inferred path)
        • Legitimate Application Dropped Script Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • Potential File Transfer via Certreq Elastic (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Suspicious Certreq Command to Download Chronicle (inferred path)
        • Suspicious CertReq Command to Download Sigma (inferred path)
        • Suspicious Execution via Compiled HTML File Elastic (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\certutil.exe#
        • Certificate Exported Via Certutil.EXE Sigma (inferred path)
        • Certutil exe certificate extraction Splunk (inferred path)
        • CertUtil Used for File Download (Living off the Land) Kusto (inferred path)
        • CertUtil With Decode Argument Splunk (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Creation or Modification of Root Certificate Elastic (inferred path)
        • Execution of a File Written by a Signed Binary Proxy Elastic (inferred path)
        • Execution via OpenClaw Agent Elastic (inferred path)
        • File Decoded From Base64/Hex Via Certutil.EXE Sigma (inferred path)
        • File Encoded To Base64 Via Certutil.EXE Sigma (inferred path)
        • File In Suspicious Location Encoded To Base64 Via Certutil.EXE Sigma (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • Ingress DLL Transfer followed by DLL SideLoading Elastic (inferred path)
        • Ingress Tool Transfer - Certutil Kusto (inferred path)
        • Ingress Transfer via Windows Utility Elastic (inferred path)
        • Legitimate Application Dropped Archive Sigma (inferred path)
        • Legitimate Application Dropped Executable Sigma (inferred path)
        • Legitimate Application Dropped Script Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • LOLBIN Execution From Abnormal Drive Sigma (inferred path)
        • Network Connection via Certutil Elastic (inferred path)
        • New Root Certificate Installed Via Certutil.EXE Sigma (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Payload Decoded via CertUtil Elastic (inferred path)
        • Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) Sigma (inferred path)
        • Potential IIS Web Shell File Creation Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Sigma (inferred path)
        • Potential NTLM Coercion Via Certutil.EXE Sigma (inferred path)
        • Potential SAP NetWeaver Exploitation Elastic (inferred path)
        • Potentially Suspicious Child Process Of DiskShadow.EXE Sigma (inferred path)
        • Potentially Suspicious Execution From Parent Process In Public Folder Sigma (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Suspicious CertUtil Commands Elastic (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process of SAP NetWeaver Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Download Via Certutil.EXE Chronicle (inferred path)
        • Suspicious Download Via Certutil.EXE Sigma (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution via Compiled HTML File Elastic (inferred path)
        • Suspicious Execution via Microsoft Exchange Transport Agent Elastic (inferred path)
        • Suspicious File Downloaded From Direct IP Via Certutil.EXE Sigma (inferred path)
        • Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE Chronicle (inferred path)
        • Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE Sigma (inferred path)
        • Suspicious File Encoded To Base64 Via Certutil.EXE Sigma (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious Oversized Script Execution Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious Process Parents Sigma (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Processes Spawned by WinRM Sigma (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Suspicious WindowsTerminal Child Processes Sigma (inferred path)
        • Suspicious WmiPrvSE Child Process Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Uncommon Network Connection Initiated By Certutil.EXE Sigma (inferred path)
        • Windows Certutil Root Certificate Addition Splunk (inferred path)
        • Windows File Download Via CertUtil Splunk (inferred path)
        • Windows Office Product Spawned Uncommon Process Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
        • Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma (inferred path)
        • Windows SQL Spawning CertUtil Splunk (inferred path)
        • Windows Steal Authentication Certificates CertUtil Backup Splunk (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • WinRAR Spawning Shell Application Splunk (inferred path)
        • WinRM Spawning a Process Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • Wscript Or Cscript Suspicious Child Process Splunk (inferred path)
      • C:\Windows\System32\cfgmgr32.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\changepk.exe#
        • Detecting UAC bypass - ChangePK and SLUI registry tampering Kusto (inferred path)
        • UAC Bypass Using ChangePK and SLUI Sigma (inferred path)
        • UAC Bypass via Windows Activation Execution Hijack Elastic (inferred path)
      • C:\Windows\System32\charmap.exe#
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
      • C:\Windows\System32\chcp.com#
        • Console CodePage Lookup Via CHCP Sigma (inferred path)
        • Suspicious CodePage Switch Via CHCP Sigma (inferred path)
      • C:\Windows\System32\choice.exe#
        • Windows Time Based Evasion via Choice Exec Splunk (inferred path)
      • C:\Windows\System32\cipher.exe#
        • Cipher.exe Execution (Sysmon) Splunk (inferred path)
        • Cipher.exe Execution (Windows Event Log) Splunk (inferred path)
        • Clear Unallocated Sector Using Cipher App Splunk (inferred path)
        • Deleted Data Overwritten Via Cipher.EXE Sigma (inferred path)
        • Deletion of data on multiple drives using cipher exe Kusto (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
      • C:\Windows\System32\cldapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Windows Cloud Files Filter Loaded by Uncommon Process Splunk (inferred path)
      • C:\Windows\System32\clfsw32.dll#
        • APT PRIVATELOG Image Load Pattern Sigma (inferred path)
      • C:\Windows\System32\cliconfg.exe#
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\clip.exe#
        • Data Copied To Clipboard Via Clip.EXE Sigma (inferred path)
      • C:\Windows\System32\Clipc.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\ClipUp.exe#
        • Potential Evasion via ClipUp Execution Elastic (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\clusapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\cmd.exe#
        • Abused Debug Privilege by Arbitrary Parent Processes Sigma (inferred path)
        • Always Install Elevated MSI Spawned Cmd And Powershell Sigma (inferred path)
        • Axios NPM Compromise Indicators - Windows Sigma (inferred path)
        • Backup Files Deleted Sigma (inferred path)
        • Binary Content Copy via Cmd.exe Elastic (inferred path)
        • Blue Mockingbird Sigma (inferred path)
        • Change Default File Association To Executable Via Assoc Sigma (inferred path)
        • Change Default File Association Via Assoc Sigma (inferred path)
        • Cloud Instance Metadata Credential Path HTTP Request Elastic (inferred path)
        • CMD Carry Out String Command Parameter Splunk (inferred path)
        • CMD Echo Pipe - Escalation Splunk (inferred path)
        • Cmd Launched with Hidden Start Flags to Suspicious Targets Sigma (inferred path)
        • CMD Shell Output Redirect Sigma (inferred path)
        • Command and Scripting Interpreter from Suspicious Parent Elastic (inferred path)
        • Command and Scripting Interpreter via Windows Scripts Elastic (inferred path)
        • Command Execution via SolarWinds Process Elastic (inferred path)
        • Command Line Execution with Suspicious URL and AppData Strings Sigma (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Command Shell Activity Started via RunDLL32 Elastic (inferred path)
        • Console CodePage Lookup Via CHCP Sigma (inferred path)
        • Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE Sigma (inferred path)
        • Copy From Or To Admin Share Or Sysvol Folder Chronicle (inferred path)
        • Copy From Or To Admin Share Or Sysvol Folder Sigma (inferred path)
        • Create Remote Thread In Shell Application Splunk (inferred path)
        • Creation or Modification of Root Certificate Elastic (inferred path)
        • Credential Dumping via Copy Command from Shadow Copy Splunk (inferred path)
        • Credential Dumping via Symlink to Shadow Copy Splunk (inferred path)
        • Cscript/Wscript Potentially Suspicious Child Process Sigma (inferred path)
        • Curl HTTP Fetch Piped to Cmd or Node via Command Shell Elastic (inferred path)
        • CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) Sigma (inferred path)
        • CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process Sigma (inferred path)
        • CVE-2024-50623 Exploitation Attempt - Cleo Sigma (inferred path)
        • DarkGate - Autoit3.EXE Execution Parameters Sigma (inferred path)
        • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
        • Delayed Execution via Ping Elastic (inferred path)
        • Detect Prohibited Applications Spawning cmd exe Splunk (inferred path)
        • Detect Suspicious Commands Initiated by Webserver Processes Kusto (inferred path)
        • Detect Use of cmd exe to Launch Script Interpreters Splunk (inferred path)
        • Directory Removal Via Rmdir Sigma (inferred path)
        • Download Activity via a Headless Browser Elastic (inferred path)
        • Elevated System Shell Spawned Sigma (inferred path)
        • Elevated System Shell Spawned From Uncommon Parent Location Sigma (inferred path)
        • Embedded Executable via Windows Shortcut File Elastic (inferred path)
        • Emotet Loader Execution Via .LNK File Sigma (inferred path)
        • Evasion via Device Credential Deployment Elastic (inferred path)
        • Execute Code with Pester.bat Sigma (inferred path)
        • Execution from a Downloaded ISO File Elastic (inferred path)
        • Execution of a Downloaded Windows Script Elastic (inferred path)
        • Execution via MS VisualStudio Pre/Post Build Events Elastic (inferred path)
        • Execution via OpenClaw Agent Elastic (inferred path)
        • Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process Sigma (inferred path)
        • Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC Sigma (inferred path)
        • Exploited CVE-2020-10189 Zoho ManageEngine Sigma (inferred path)
        • FakeUpdates/SocGholish Activity Sigma (inferred path)
        • File And SubFolder Enumeration Via Dir Command Sigma (inferred path)
        • File Deletion Via Del Sigma (inferred path)
        • File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell Sigma (inferred path)
        • File or Directory Deletion Command Elastic (inferred path)
        • Forfiles.EXE Child Process Masquerading Sigma (inferred path)
        • Get ADDefaultDomainPasswordPolicy with Powershell Splunk (inferred path)
        • Get ADUser with PowerShell Splunk (inferred path)
        • Get ADUserResultantPasswordPolicy with Powershell Splunk (inferred path)
        • Get DomainPolicy with Powershell Splunk (inferred path)
        • Get DomainUser with PowerShell Splunk (inferred path)
        • Get WMIObject Group Discovery Splunk (inferred path)
        • Get-ForestTrust with PowerShell Splunk (inferred path)
        • GetWmiObject Ds Computer with PowerShell Splunk (inferred path)
        • GetWmiObject Ds Group with PowerShell Splunk (inferred path)
        • GetWmiObject DS User with PowerShell Splunk (inferred path)
        • Greedy File Deletion Using Del Sigma (inferred path)
        • HackTool - Jlaive In-Memory Assembly Execution Sigma (inferred path)
        • HackTool - Koadic Execution Sigma (inferred path)
        • HackTool - RedMimicry Winnti Playbook Execution Sigma (inferred path)
        • Hidden Powershell in Link File Pattern Sigma (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • IIS WebServer Log Deletion via CommandLine Utilities Sigma (inferred path)
        • Impacket Lateral Movement Commandline Parameters Splunk (inferred path)
        • Impacket Lateral Movement smbexec CommandLine Parameters Splunk (inferred path)
        • Impacket WMIexec process execution Sigma (inferred path)
        • Inhibit System Recovery via Windows Command Shell Elastic (inferred path)
        • Java Executing cmd to run Powershell Kusto (inferred path)
        • Local Accounts Discovery Chronicle (inferred path)
        • Local Accounts Discovery Sigma (inferred path)
        • LOL-Binary Copied From System Directory Sigma (inferred path)
        • Microsoft Exchange Worker Spawning Suspicious Processes Elastic (inferred path)
        • Microsoft Office File Execution via Script Interpreter Elastic (inferred path)
        • MMC Spawning Windows Shell Sigma (inferred path)
        • NTDS or SAM Database File Copied Elastic (inferred path)
        • NTDS.DIT Creation By Uncommon Process Sigma (inferred path)
        • OneNote.EXE Execution of Malicious Embedded Scripts Sigma (inferred path)
        • Operator Bloopers Cobalt Strike Commands Sigma (inferred path)
        • Operator Bloopers Cobalt Strike Modules Sigma (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Pikabot Fake DLL Extension Execution Via Rundll32.EXE Sigma (inferred path)
        • Possible Lateral Movement PowerShell Spawn Splunk (inferred path)
        • Potential APT FIN7 Exploitation Activity Sigma (inferred path)
        • Potential Command Shell via NetCat Elastic (inferred path)
        • Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image Sigma (inferred path)
        • Potential CommandLine Path Traversal Via Cmd.EXE Sigma (inferred path)
        • Potential CVE-2021-41379 Exploitation Attempt Sigma (inferred path)
        • Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution Sigma (inferred path)
        • Potential CVE-2022-29072 Exploitation Attempt Sigma (inferred path)
        • Potential CVE-2023-21554 QueueJumper Exploitation Sigma (inferred path)
        • Potential Data Exfiltration Activity Via CommandLine Tools Sigma (inferred path)
        • Potential Devil Bait Malware Reconnaissance Sigma (inferred path)
        • Potential Execution via VS Code Tasks Elastic (inferred path)
        • Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) Sigma (inferred path)
        • Potential Exploitation of GoAnywhere MFT Vulnerability Sigma (inferred path)
        • Potential Fake CAPTCHA Phishing Attack Elastic (inferred path)
        • Potential File Download via a Headless Browser Elastic (inferred path)
        • Potential File Override/Append Via SET Command Sigma (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
        • Potential IIS Web Shell File Creation Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Sigma (inferred path)
        • Potential KamiKakaBot Activity - Lure Document Execution Sigma (inferred path)
        • Potential Payload Download via Finger LOLBin Elastic (inferred path)
        • Potential Privilege Escalation Using Symlink Between Osk and Cmd Sigma (inferred path)
        • Potential Process Injection Via Msra.EXE Sigma (inferred path)
        • Potential Proxy Execution Via Explorer.EXE From Shell Process Sigma (inferred path)
        • Potential Qakbot Rundll32 Execution Sigma (inferred path)
        • Potential Remote Install via MsiExec Elastic (inferred path)
        • Potential Reverse Shell via Java Elastic (inferred path)
        • Potential SAP NetWeaver Exploitation Elastic (inferred path)
        • Potential SharpRDP Behavior Elastic (inferred path)
        • Potential Shell Execution via NetCat Elastic (inferred path)
        • Potential Suspicious Child Process Of 3CXDesktopApp Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process of KeyScrambler.exe Sigma (inferred path)
        • Potentially Suspicious Child Process Of VsCode Sigma (inferred path)
        • Potentially Suspicious Child Process Of WinRAR.EXE Sigma (inferred path)
        • Potentially Suspicious Child Processes Spawned by ConHost Sigma (inferred path)
        • Potentially Suspicious CMD Shell Output Redirect Sigma (inferred path)
        • Potentially Suspicious DMP/HDMP File Creation Sigma (inferred path)
        • Potentially Suspicious Execution From Parent Process In Public Folder Sigma (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Potentially Suspicious Mofcomp Execution Sigma (inferred path)
        • Potentially Suspicious NTFS Symlink Behavior Modification Sigma (inferred path)
        • Potentially Suspicious Ping/Copy Command Combination Sigma (inferred path)
        • Potentially Suspicious WebDAV LNK Execution Sigma (inferred path)
        • Potentially Suspicious Windows App Activity Sigma (inferred path)
        • PowerShell Get LocalGroup Discovery Splunk (inferred path)
        • Private Keys Reconnaissance Via CommandLine Tools Sigma (inferred path)
        • Privilege Escalation via Named Pipe Impersonation Elastic (inferred path)
        • Privilege Escalation via Named Pipe Impersonation Elastic (inferred path)
        • Privilege Escalation via Named Pipe Impersonation Sigma (inferred path)
        • Probable AdFind Recon Tool Usage Kusto (inferred path)
        • Process Activity via Compiled HTML File Elastic (inferred path)
        • Process Deleting Its Process File Path Splunk (inferred path)
        • Process Execution with Unusual File Extension Elastic (inferred path)
        • Qakbot Campaign Self Deletion Kusto (inferred path)
        • Qakbot Rundll32 Exports Execution Sigma (inferred path)
        • Qakbot Rundll32 Fake DLL Extension Execution Sigma (inferred path)
        • Raspberry Robin Initial Execution From External Drive Sigma (inferred path)
        • Read Contents From Stdin Via Cmd.EXE Sigma (inferred path)
        • Recursive Delete of Directory In Batch CMD Splunk (inferred path)
        • RedSun - Conhost.exe Spawned by TieringEngineService.exe Sigma (inferred path)
        • Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
        • Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions Sigma (inferred path)
        • Remote Access Tool - Cmd.EXE Execution via AnyViewer Sigma (inferred path)
        • Remote Access Tool - MeshAgent Command Execution via MeshCentral Sigma (inferred path)
        • Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution Sigma (inferred path)
        • Remote Access Tool - ScreenConnect Remote Command Execution Sigma (inferred path)
        • Remote Access Tool - ScreenConnect Server Web Shell Execution Sigma (inferred path)
        • Remote File Copy to a Hidden Share Elastic (inferred path)
        • Remote Thread Created In Shell Application Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Renamed Visual Studio Code Tunnel Execution Sigma (inferred path)
        • Resize ShadowStorage volume Splunk (inferred path)
        • Scheduled Task Creation via Unsigned Parent Elastic (inferred path)
        • Scheduled Task Deleted Or Created via CMD Splunk (inferred path)
        • ScreenConnect Server Spawning Suspicious Processes Elastic (inferred path)
        • Scripting/CommandLine Process Spawned Regsvr32 Sigma (inferred path)
        • Sdiagnhost Calling Suspicious Child Process Sigma (inferred path)
        • Serial console process spawning CMD shell (via command) Sigma (inferred path)
        • Serpent Backdoor Payload Execution Via Scheduled Task Sigma (inferred path)
        • Service Control Spawned via Script Interpreter Elastic (inferred path)
        • Shell Execution via Windows Shortcut File Elastic (inferred path)
        • Shell Process Spawned by Java.EXE Sigma (inferred path)
        • Signed Binary Execution via Microsoft Office Elastic (inferred path)
        • Spool process spawned a CMD shell (PrintNightmare vulnerability - CVE-2021-36958) Sigma (inferred path)
        • Startup Persistence by a Suspicious Process Elastic (inferred path)
        • Sticky key file created from CMD copy Sigma (inferred path)
        • Sticky Key Like Backdoor Execution Sigma (inferred path)
        • Suspicious ArcSOC.exe Child Process Sigma (inferred path)
        • Suspicious BitLocker Access Agent Update Utility Execution Sigma (inferred path)
        • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
        • Suspicious Child Process Of BgInfo.EXE Sigma (inferred path)
        • Suspicious Child Process of Notepad++ Updater - GUP.Exe Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process of SAP NetWeaver Sigma (inferred path)
        • Suspicious Child Process Of SQL Server Sigma (inferred path)
        • Suspicious Child Process Of Veeam Dabatase Sigma (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious Chromium Browser Instance Executed With Custom Extension Sigma (inferred path)
        • Suspicious Cmd Execution via WMI Elastic (inferred path)
        • Suspicious Command Prompt Network Connection Elastic (inferred path)
        • Suspicious Copy From or To System Directory Sigma (inferred path)
        • Suspicious Copy on System32 Splunk (inferred path)
        • Suspicious Creation TXT File in User Desktop Sigma (inferred path)
        • Suspicious CrushFTP Child Process Sigma (inferred path)
        • Suspicious Electron Application Child Processes Sigma (inferred path)
        • Suspicious Execution as System via Windows Command Shell Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution via Compiled HTML File Elastic (inferred path)
        • Suspicious Execution via Microsoft Exchange Transport Agent Elastic (inferred path)
        • Suspicious Explorer Child Process Elastic (inferred path)
        • Suspicious File Execution From Internet Hosted WebDav Share Sigma (inferred path)
        • Suspicious File Write to SharePoint Layouts Directory Sigma (inferred path)
        • Suspicious ImageLoad from an ISO Mounted Device Elastic (inferred path)
        • Suspicious Instance Metadata Service (IMDS) API Command Line Execution Elastic (inferred path)
        • Suspicious Microsoft Diagnostics Wizard Execution Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious MSDT Parent Process Sigma (inferred path)
        • Suspicious MSHTA Child Process Sigma (inferred path)
        • Suspicious mshta child process Splunk (inferred path)
        • Suspicious Mshta.EXE Execution Patterns Sigma (inferred path)
        • Suspicious MsiExec Embedding Parent Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious Oversized Script Execution Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious PHP Script Execution Elastic (inferred path)
        • Suspicious PowerShell Console History Deletion Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious Process Spawned by CentreStack Portal AppPool Sigma (inferred path)
        • Suspicious Processes Spawned by WinRM Sigma (inferred path)
        • Suspicious Provlaunch.EXE Child Process Sigma (inferred path)
        • Suspicious Reg exe Process Splunk (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious SolarWinds Web Help Desk Java Module Load or Child Process Elastic (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Suspicious Windows Defender Exclusions Added via PowerShell Elastic (inferred path)
        • Suspicious WmiPrvSE Child Process Sigma (inferred path)
        • Suspicious Workstation Locking via Rundll32 Sigma (inferred path)
        • Suspicious Zoom Child Process Elastic (inferred path)
        • Symbolic Link to Shadow Copy Created Elastic (inferred path)
        • System Information Discovery via Windows Command Shell Elastic (inferred path)
        • System Shells via Services Elastic (inferred path)
        • System Utility Execution from Unbacked Memory Elastic (inferred path)
        • UAC Bypass Using Windows Media Player - Process Sigma
        • Unusual File Creation - Alternate Data Stream Elastic (inferred path)
        • Unusual Parent Process for cmd.exe Elastic (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • Ursnif Redirection Of Discovery Commands Sigma (inferred path)
        • Visual Studio Code Tunnel Execution Sigma (inferred path)
        • Visual Studio Code Tunnel Execution (Windows Event Log) Splunk (inferred path)
        • VMToolsd Suspicious Child Process Sigma (inferred path)
        • Web or Application Server Spawning a Shell Splunk (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Wermgr Process Spawned CMD Or Powershell Process Splunk (inferred path)
        • Windows Account Access Removal via Logoff Exec Splunk (inferred path)
        • Windows Account or Group Discovery Elastic (inferred path)
        • Windows Command Shell DCRat ForkBomb Payload Splunk (inferred path)
        • Windows Command Shell Spawned via Microsoft Office Elastic (inferred path)
        • Windows DLL Search Order Hijacking with iscsicpl Splunk (inferred path)
        • Windows Explorer LNK Exploit Process Launch With Padding Splunk (inferred path)
        • Windows Explorer.exe Spawning PowerShell or Cmd Splunk (inferred path)
        • Windows List ENV Variables Via SET Command From Uncommon Parent Splunk (inferred path)
        • Windows Masquerading Explorer As Child Process Splunk (inferred path)
        • Windows MOF Event Triggered Execution via WMI Splunk (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Office Product Spawned Uncommon Process Splunk (inferred path)
        • Windows PaperCut NG Spawn Shell Splunk (inferred path)
        • Windows PowerShell Script From WindowsApps Directory Splunk (inferred path)
        • Windows Private Keys Discovery Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
        • Windows Remote Assistance Spawning Process Splunk (inferred path)
        • Windows Remote Management Execute Shell Splunk (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Scheduled Task Service Spawned Shell Splunk (inferred path)
        • Windows Script Execution from Archive File Elastic (inferred path)
        • Windows Server Update Service Spawning Suspicious Processes Elastic (inferred path)
        • Windows Shell or Script Execution From IIS Directory Splunk (inferred path)
        • Windows Shell Process from CrushFTP Splunk (inferred path)
        • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
        • Windows Shortcut File Embedded Object Execution Elastic (inferred path)
        • Windows Sqlservr Spawning Shell Splunk (inferred path)
        • Windows Steal or Forge Kerberos Tickets Klist Splunk (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process of TieringEngineService.exe Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • Windows System Information Discovery Elastic (inferred path)
        • Windows Terminal Profile Settings Modification By Uncommon Process Sigma (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows WSUS Spawning Shell Splunk (inferred path)
        • WinRAR Spawning Shell Application Splunk (inferred path)
        • WinRM Spawning a Process Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • Wscript Or Cscript Suspicious Child Process Splunk (inferred path)
        • WSL Child Process Anomaly Sigma (inferred path)
      • C:\Windows\System32\cmdkey.exe#
        • Local Accounts Discovery Chronicle (inferred path)
        • Local Accounts Discovery Sigma (inferred path)
        • New Generic Credentials Added Via Cmdkey.EXE Sigma (inferred path)
        • Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Windows Credentials from Password Stores Creation Splunk (inferred path)
        • Windows Credentials from Password Stores Deletion Splunk (inferred path)
        • Windows Credentials from Password Stores Query Splunk (inferred path)
      • C:\Windows\System32\cmdl32.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • Potential Arbitrary File Download Via Cmdl32.EXE Sigma (inferred path)
      • C:\Windows\System32\cmlua.dll#
        • CMLUA Or CMSTPLUA UAC Bypass Splunk (inferred path)
      • C:\Windows\System32\cmpbk32.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\cmstp.exe#
        • Bypass UAC via CMSTP Sigma (inferred path)
        • CMSTP Execution Process Creation Sigma (inferred path)
        • DLL Loaded From Suspicious Location Via Cmspt.EXE Sigma (inferred path)
        • DotNet CLR DLL Loaded By Scripting Applications Sigma (inferred path)
        • Dynwrapx Image Load via Windows Scripts Elastic (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • LOLBIN Execution From Abnormal Drive Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Outbound Network Connection Initiated By Cmstp.EXE Sigma (inferred path)
        • Potential Defense Evasion via CMSTP.exe Elastic (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious .NET Code Compilation Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Unusual Process Network Connection Elastic (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\cmstplua.dll#
        • CMLUA Or CMSTPLUA UAC Bypass Splunk (inferred path)
      • C:\Windows\System32\cmutil.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\CodeIntegrity#
        • Potentially Suspicious WDAC Policy File Creation Sigma (inferred branch)
        • WDAC Policy File by an Unusual Process Elastic (inferred branch)
        • WDAC Policy File Creation In CodeIntegrity Folder Sigma (inferred branch)
        • C:\Windows\System32\CodeIntegrity\CIPolicies\Active#
          • WDAC Policy File by an Unusual Process Elastic (inferred branch)
      • C:\Windows\System32\colorcpl.exe#
        • Suspicious Creation with Colorcpl Sigma (inferred path)
        • Suspicious mshta child process Splunk (inferred path)
        • Windows Handle Duplication in Known UAC-Bypass Binaries Splunk (inferred path)
      • C:\Windows\System32\colorui.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • UAC Bypass With Colorui COM Object Splunk (inferred path)
      • C:\Windows\System32\Com#
        • Windows Snake Malware Kernel Driver Comadmin Splunk (inferred branch)
        • C:\Windows\System32\Com\Comadmin.dat#
          • SNAKE Malware Kernel Driver File Indicator Sigma
        • C:\Windows\System32\Com\dmp#
          • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
          • Windows Process Writing File to World Writable Path Splunk (inferred branch)
      • C:\Windows\System32\comdlg32.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\CompatTelRunner.exe#
        • Persistence via TelemetryController Scheduled Task Hijack Elastic (inferred path)
        • Windows Compatibility Telemetry Suspicious Child Process Splunk (inferred path)
      • C:\Windows\System32\CompMgmtLauncher.exe#
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\ComputerDefaults.exe#
        • Suspicious ComputerDefaults.exe Execution (Sysmon) Splunk (inferred path)
        • Suspicious ComputerDefaults.exe Execution (Windows Event Log) Splunk (inferred path)
        • UAC Bypass Tools Using ComputerDefaults Sigma (inferred path)
        • UAC Bypass via ComputerDefaults Execution Hijack Elastic (inferred path)
        • Windows ComputerDefaults Spawning a Process Splunk (inferred path)
        • Windows Handle Duplication in Known UAC-Bypass Binaries Splunk (inferred path)
      • C:\Windows\System32\comres.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\config#
        • GatherNetworkInfo.VBS Reconnaissance Script Output Sigma (inferred branch)
        • Security Account Manager (SAM) File Access Elastic (inferred branch)
        • C:\Windows\System32\config\config#
          • CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum Sigma (inferred branch)
        • C:\Windows\System32\config\cy-GB\Setup\SKB\InputMethod#
          • CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum Sigma (inferred branch)
        • C:\Windows\System32\config\RegBack#
          • C:\Windows\System32\config\RegBack\SAM#
            • Sensitive Hive Access via Registry Backup Elastic (inferred path)
            • Sensitive Registry Hive Access via RegBack Elastic (inferred path)
          • C:\Windows\System32\config\RegBack\SECURITY#
          • C:\Windows\System32\config\RegBack\SYSTEM#
            • Sensitive File Access by an Unsigned Process Elastic (inferred path)
            • Sensitive Hive Access via Registry Backup Elastic (inferred path)
            • Sensitive Registry Hive Access via RegBack Elastic (inferred path)
        • C:\Windows\System32\config\SAM#
        • C:\Windows\System32\config\SECURITY#
          • Transferring Files with Credential Data via Network Shares Sigma (inferred branch)
        • C:\Windows\System32\config\spp\ServiceState\Recovery#
          • CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum Sigma (inferred branch)
        • C:\Windows\System32\config\SYSTEM#
          • Potential DCOM InternetExplorer.Application DLL Hijack Sigma (inferred path)
          • Transferring Files with Credential Data via Network Shares Sigma (inferred branch)
          • Wmiprvse Wbemcomn DLL Hijack - File Sigma (inferred path)
        • C:\Windows\System32\config\systemprofile#
          • Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder Sigma (inferred branch)
          • Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location Sigma (inferred branch)
          • Process Execution From A Potentially Suspicious Folder Sigma (inferred branch)
          • Suspicious Scheduled Task Write to System32 Tasks Sigma (inferred branch)
          • Suspicious Service Binary Directory Sigma (inferred branch)
          • C:\Windows\System32\config\systemprofile\AppData#
            • C:\Windows\System32\config\systemprofile\AppData\Local#
              • C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps#
                • LSASS Process Dump Artefact In CrashDumps Folder Sigma (inferred branch)
              • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft#
                • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Taskbar\autoit3.exe#
                  • OilRig APT Activity Sigma (inferred path)
                • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Vault#
                  • Sensitive File Access by an Unsigned Process Elastic (inferred branch)
                • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows#
                  • DLL Load By System Process From Suspicious Locations Sigma (inferred branch)
                  • Indirect Command Execution via ForFiles Elastic (inferred branch)
                  • Ingress Tool Transfer via INET Cache Elastic (inferred branch)
                  • Keystroke Input Capture via DirectInput Elastic (inferred branch)
                  • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
                  • Library Load of a File Written by a Signed Binary Proxy Elastic (inferred branch)
                  • Potential Privilege Escalation via LocalPotato Exploit Elastic (inferred branch)
                  • Potential System Tampering via File Modification Elastic (inferred branch)
                  • Registry Run Key Modified by Unusual Process Elastic (inferred branch)
                  • Remote Memory Write to Trusted Target Process Elastic (inferred branch)
                  • Startup Persistence via Unusual Process Elastic (inferred branch)
                  • Suspicious DLL Loaded for Persistence or Privilege Escalation Elastic (inferred branch)
                  • Suspicious PHP Script Execution Elastic (inferred branch)
                  • Suspicious RDP ActiveX Client Loaded Elastic (inferred branch)
                  • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell#
                    • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\profile.ps1#
                      • PowerShell Profile Modification Sigma (inferred path)
                    • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive#
                      • Suspicious Interactive PowerShell as SYSTEM Sigma
                  • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\SchCache#
                    • ADSI-Cache File Creation By Uncommon Tool Sigma (inferred branch)
                • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\WindowsApps#
                  • Windows PowerShell Script From WindowsApps Directory Splunk (inferred branch)
                  • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe#
                    • Suspicious Get-Variable.exe Creation Sigma (inferred path)
            • C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft#
              • C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\iertutil.dll#
                • Potential DCOM InternetExplorer.Application DLL Hijack Sigma (inferred path)
                • Potential DCOM InternetExplorer.Application DLL Hijack - Image Load Sigma (inferred path)
              • C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows#
                • DLL Load By System Process From Suspicious Locations Sigma (inferred branch)
                • Indirect Command Execution via ForFiles Elastic (inferred branch)
                • Ingress Tool Transfer via INET Cache Elastic (inferred branch)
                • Keystroke Input Capture via DirectInput Elastic (inferred branch)
                • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
                • Library Load of a File Written by a Signed Binary Proxy Elastic (inferred branch)
                • Potential Privilege Escalation via LocalPotato Exploit Elastic (inferred branch)
                • Potential System Tampering via File Modification Elastic (inferred branch)
                • Registry Run Key Modified by Unusual Process Elastic (inferred branch)
                • Remote Memory Write to Trusted Target Process Elastic (inferred branch)
                • Startup Persistence via Unusual Process Elastic (inferred branch)
                • Suspicious DLL Loaded for Persistence or Privilege Escalation Elastic (inferred branch)
                • Suspicious PHP Script Execution Elastic (inferred branch)
                • Suspicious RDP ActiveX Client Loaded Elastic (inferred branch)
                • C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell#
                  • C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\profile.ps1#
                    • PowerShell Profile Modification Sigma (inferred path)
                  • C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt#
                    • PowerShell Console History Logs Deleted Sigma (inferred path)
                    • Suspicious Interactive PowerShell as SYSTEM Sigma
                    • Suspicious PowerShell Console History Deletion Elastic (inferred path)
      • C:\Windows\System32\configmanager2.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\conhost.exe#
        • Binary Proxy Execution via Windows OpenSSH Elastic (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Conhost Spawned By Suspicious Parent Process Elastic (inferred path)
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • Download Activity via a Headless Browser Elastic (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Headless Process Launched Via Conhost.EXE Sigma (inferred path)
        • Potential File Download via a Headless Browser Elastic (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
        • Potential Injection via the Console Window Class Elastic (inferred path)
        • Potential Remote Install via MsiExec Elastic (inferred path)
        • Potential Reverse Shell via Java Elastic (inferred path)
        • Potentially Suspicious Child Processes Spawned by ConHost Sigma (inferred path)
        • Powershell Executed From Headless ConHost Process Sigma (inferred path)
        • Proxy Execution via Console Window Host Elastic (inferred path)
        • RedSun - Conhost.exe Spawned by TieringEngineService.exe Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Uncommon Child Process Of Conhost.EXE Sigma (inferred path)
        • Windows ConHost with Headless Argument Splunk (inferred path)
        • Windows Console Execution from Unbacked Memory Elastic (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Suspicious Child Process of TieringEngineService.exe Splunk (inferred path)
      • C:\Windows\System32\connect.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\consent.exe#
        • Consent.exe Suspicious Child Process (Sysmon) Splunk (inferred path)
        • Consent.exe Suspicious Child Process (Windows Event Log) Splunk (inferred path)
        • Exploiting CVE-2019-1388 Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • UAC Bypass Attempt via Consent DLL Search Order Hijacking Elastic (inferred path)
        • UAC Bypass Using Consent and Comctl32 - Process Sigma (inferred path)
        • UAC Bypass Using IEInstal - Process Sigma (inferred path)
        • Windows Suspicious Child Process of Consent.EXE Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\consent.exe.local#
        • Potential DLL Sideloading Via comctl32.dll Sigma (inferred branch)
      • C:\Windows\System32\control.exe#
        • Control Loading from World Writable Directory Splunk (inferred path)
        • Control Panel Process with Unusual Arguments Elastic (inferred path)
        • Execution via WorkFolders.exe Sigma (inferred path)
        • Potential CVE-2021-40444 Exploitation Attempt Sigma (inferred path)
        • Potential Raspberry Robin CPL Execution Activity Sigma (inferred path)
        • Potential Raspberry Robin Registry Set Internet Settings ZoneMap Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Suspicious Control Panel DLL Load Sigma (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • UAC Bypass via Control Panel Execution Hijack Elastic (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows Office Product Spawned Control Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\CoreMessaging.dll#
      • C:\Windows\System32\CoreUIComponents.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\credui.dll#
        • CredUI.DLL Loaded By Uncommon Process Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Windows Input Capture Using Credential UI Dll Splunk (inferred path)
      • C:\Windows\System32\credwiz.exe#
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\cryptbase.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\cryptdll.dll#
      • C:\Windows\System32\cryptnet.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\cryptsp.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\cryptui.dll#
      • C:\Windows\System32\cryptxml.dll#
      • C:\Windows\System32\cscapi.dll#
      • C:\Windows\System32\cscobj.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\cscript.exe#
        • Attempt to Disable Windows Defender Services Elastic (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Creation or Modification of Root Certificate Elastic (inferred path)
        • Csc.EXE Execution Form Potentially Suspicious Parent Sigma (inferred path)
        • Cscript/Wscript Potentially Suspicious Child Process Sigma (inferred path)
        • Cscript/Wscript Uncommon Script Extension Execution Sigma (inferred path)
        • CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process Sigma (inferred path)
        • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
        • Detect Use of cmd exe to Launch Script Interpreters Splunk (inferred path)
        • DotNet CLR DLL Loaded By Scripting Applications Sigma (inferred path)
        • Download Activity via a Headless Browser Elastic (inferred path)
        • Dynwrapx Image Load via Windows Scripts Elastic (inferred path)
        • Execute Javascript With Jscript COM CLSID Splunk (inferred path)
        • Execution of a Downloaded Windows Script Elastic (inferred path)
        • Execution of a File Downloaded via Windows OpenSSH Elastic (inferred path)
        • Execution of a File Written by Windows Script Host Elastic (inferred path)
        • Execution of a Windows Script Downloaded from the Internet Elastic (inferred path)
        • HackTool - CACTUSTORCH Remote Thread Creation Sigma (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • Jscript Execution Using Cscript App Splunk (inferred path)
        • Local Network Connection Initiated By Script Interpreter Sigma (inferred path)
        • LOLBIN Execution From Abnormal Drive Sigma (inferred path)
        • Manual Execution of Script Inside of a Compressed File Sigma (inferred path)
        • Microsoft Office File Execution via Script Interpreter Elastic (inferred path)
        • MMC Spawning Windows Shell Sigma (inferred path)
        • MS Scripting Process Loading Ldap Module Splunk (inferred path)
        • MS Scripting Process Loading WMI Module Splunk (inferred path)
        • MSBuild Suspicious Spawned By Script Process Splunk (inferred path)
        • Network Connection via Startup Item Elastic (inferred path)
        • NTDS.DIT Creation By Uncommon Parent Process Sigma (inferred path)
        • NTDS.DIT Creation By Uncommon Process Sigma (inferred path)
        • Office Macro File Creation From Suspicious Process Sigma (inferred path)
        • OneNote.EXE Execution of Malicious Embedded Scripts Sigma (inferred path)
        • Outbound Network Connection Initiated By Script Interpreter Sigma (inferred path)
        • Oversized Windows Script Execution Elastic (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Persistent Scripts in the Startup Directory Elastic (inferred path)
        • Pikabot Fake DLL Extension Execution Via Rundll32.EXE Sigma (inferred path)
        • Potential APT10 Cloud Hopper Activity Sigma (inferred path)
        • Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image Sigma (inferred path)
        • Potential CVE-2023-21554 QueueJumper Exploitation Sigma (inferred path)
        • Potential Dropper Script Execution Via WScript/CScript/MSHTA Sigma (inferred path)
        • Potential Execution via VS Code Tasks Elastic (inferred path)
        • Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) Sigma (inferred path)
        • Potential File Download via a Headless Browser Elastic (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Sigma (inferred path)
        • Potential Manage-bde.wsf Abuse To Proxy Execution Sigma (inferred path)
        • Potential Qakbot Rundll32 Execution Sigma (inferred path)
        • Potential Recon Activity Using DriverQuery.EXE Sigma (inferred path)
        • Potential Reconnaissance Activity Via GatherNetworkInfo.VBS Sigma (inferred path)
        • Potential Register_App.Vbs LOLScript Abuse Sigma (inferred path)
        • Potential Suspicious Child Process Of 3CXDesktopApp Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of DiskShadow.EXE Sigma (inferred path)
        • Potentially Suspicious Child Process of KeyScrambler.exe Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Potentially Suspicious Child Process Of VsCode Sigma (inferred path)
        • Potentially Suspicious Child Process Of WinRAR.EXE Sigma (inferred path)
        • Potentially Suspicious Child Processes Spawned by ConHost Sigma (inferred path)
        • Potentially Suspicious DMP/HDMP File Creation Sigma (inferred path)
        • Potentially Suspicious Execution From Parent Process In Public Folder Sigma (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Potentially Suspicious Mofcomp Execution Sigma (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Potentially Suspicious WebDAV LNK Execution Sigma (inferred path)
        • Potentially Suspicious Windows App Activity Sigma (inferred path)
        • Process Activity via Compiled HTML File Elastic (inferred path)
        • Process Execution with Unusual File Extension Elastic (inferred path)
        • Qakbot Rundll32 Exports Execution Sigma (inferred path)
        • Qakbot Rundll32 Fake DLL Extension Execution Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Registry Tampering by Potentially Suspicious Processes Sigma (inferred path)
        • Remote Code Execute via Winrm.vbs Sigma (inferred path)
        • Remote File Download via Script Interpreter Elastic (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Scheduled Task Created by a Windows Script Elastic (inferred path)
        • Script Event Consumer Spawning Process Sigma (inferred path)
        • Script Interpreter Execution From Suspicious Folder Sigma (inferred path)
        • Script Interpreter Loading DotNet Assembly From Memory Kusto (inferred path)
        • Scripting/CommandLine Process Spawned Regsvr32 Sigma (inferred path)
        • Sdiagnhost Calling Suspicious Child Process Sigma (inferred path)
        • Startup Persistence by a Suspicious Process Elastic (inferred path)
        • Sticky Key Like Backdoor Execution Sigma (inferred path)
        • Suspicious .NET Code Compilation Elastic (inferred path)
        • Suspicious ArcSOC.exe Child Process Sigma (inferred path)
        • Suspicious BitLocker Access Agent Update Utility Execution Sigma (inferred path)
        • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
        • Suspicious Child Process Of BgInfo.EXE Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process of Notepad++ Updater - GUP.Exe Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process of SAP NetWeaver Sigma (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Chromium Browser Instance Executed With Custom Extension Sigma (inferred path)
        • Suspicious CrushFTP Child Process Sigma (inferred path)
        • Suspicious Electron Application Child Processes Sigma (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution from a Windows Script Elastic (inferred path)
        • Suspicious Execution via Compiled HTML File Elastic (inferred path)
        • Suspicious Execution via ShellBrowserWindow/ShellWindow COM Elastic (inferred path)
        • Suspicious Explorer Child Process Elastic (inferred path)
        • Suspicious Java Execution via a Windows Script Elastic (inferred path)
        • Suspicious Microsoft Diagnostics Wizard Execution Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious MSDT Parent Process Sigma (inferred path)
        • Suspicious MSHTA Child Process Sigma (inferred path)
        • Suspicious mshta child process Splunk (inferred path)
        • Suspicious Mshta.EXE Execution Patterns Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious Oversized Script Execution Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious PowerShell Console History Deletion Elastic (inferred path)
        • Suspicious PowerShell Invocation From Script Engines Sigma (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Provlaunch.EXE Child Process Sigma (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious SYSTEM User Process Creation Sigma (inferred path)
        • Suspicious WindowsTerminal Child Processes Sigma (inferred path)
        • Suspicious WmiPrvSE Child Process Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Unusual File Creation - Alternate Data Stream Elastic (inferred path)
        • User Account Control Disabled via Registry Elastic (inferred path)
        • VMToolsd Suspicious Child Process Sigma (inferred path)
        • Web or Application Server Spawning a Shell Splunk (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows DLL Search Order Hijacking with iscsicpl Splunk (inferred path)
        • Windows Office Product Spawned Uncommon Process Splunk (inferred path)
        • Windows Remote Assistance Spawning Process Splunk (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Scheduled Task Service Spawned Shell Splunk (inferred path)
        • Windows Script Interpreter Executing Process via WMI Elastic (inferred path)
        • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
        • Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process of TieringEngineService.exe Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • Windows System Script Proxy Execution Syncappvpublishingserver Splunk (inferred path)
        • Windows Terminal Profile Settings Modification By Uncommon Process Sigma (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • WinRAR Spawning Shell Application Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • WScript or CScript Dropper - File Sigma (inferred path)
        • Wscript Or Cscript Suspicious Child Process Splunk (inferred path)
        • WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript Sigma (inferred path)
        • WSL Child Process Anomaly Sigma (inferred path)
      • C:\Windows\System32\cscui.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\csrss.exe#
        • Abused Debug Privilege by Arbitrary Parent Processes Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
        • Suspicious Process Parents Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • Windows Binaries Write Suspicious Extensions Sigma (inferred path)
        • Windows Processes Suspicious Parent Directory Sigma (inferred path)
      • C:\Windows\System32\ctfmon.exe#
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
      • C:\Windows\System32\curl.exe#
        • Axios NPM Compromise Indicators - Windows Sigma (inferred path)
        • Cloud Instance Metadata Credential Path HTTP Request Elastic (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Curl Execution with Percent Encoded URL Splunk (inferred path)
        • Curl File Upload To File Sharing Websites Sigma (inferred path)
        • Curl Web Request With Potential Custom User-Agent Sigma (inferred path)
        • Curl.EXE Execution Sigma (inferred path)
        • Curl.EXE Execution With Custom UserAgent Sigma (inferred path)
        • DarkGate - Autoit3.EXE File Creation By Uncommon Process Sigma (inferred path)
        • Execution via OpenClaw Agent Elastic (inferred path)
        • Exfiltration via curl.exe - Windows (Sysmon) Splunk (inferred path)
        • Exfiltration via curl.exe - Windows (Windows Event Log) Splunk (inferred path)
        • File Download From IP URL Via Curl.EXE Sigma (inferred path)
        • File Download Via Curl.EXE Sigma (inferred path)
        • Ingress DLL Transfer followed by DLL SideLoading Elastic (inferred path)
        • Ingress Tool Transfer via CURL Elastic (inferred path)
        • Insecure Proxy/DOH Transfer Via Curl.EXE Sigma (inferred path)
        • Insecure Transfer Via Curl.EXE Sigma (inferred path)
        • Kalambur Backdoor Curl TOR SOCKS Proxy Execution Sigma (inferred path)
        • LLM-Based Curl Activity Triage Elastic (inferred path)
        • Local File Read Using Curl.EXE Sigma (inferred path)
        • Mint Sandstorm - AsperaFaspex Suspicious Process Execution Sigma (inferred path)
        • Mint Sandstorm - ManageEngine Suspicious Process Execution Sigma (inferred path)
        • NTLM Hash Leak Via Curl NTLM Authentication Sigma (inferred path)
        • Potential Cookies Session Hijacking Sigma (inferred path)
        • Potential Data Exfiltration Activity Via CommandLine Tools Sigma (inferred path)
        • Potential Data Exfiltration Via Curl.EXE Sigma (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Sigma (inferred path)
        • Potential Qakbot Rundll32 Execution Sigma (inferred path)
        • Potential SAP NetWeaver Exploitation Elastic (inferred path)
        • Qakbot Rundll32 Exports Execution Sigma (inferred path)
        • Qakbot Rundll32 Fake DLL Extension Execution Sigma (inferred path)
        • Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution Sigma (inferred path)
        • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Curl Network Connection Splunk (inferred path)
        • Suspicious Curl.EXE Download Sigma (inferred path)
        • Suspicious Download from Office Domain Sigma (inferred path)
        • Suspicious Execution via Microsoft Exchange Transport Agent Elastic (inferred path)
        • Suspicious File Download From File Sharing Domain Via Curl.EXE Sigma (inferred path)
        • Suspicious File Download From IP Via Curl.EXE Sigma (inferred path)
        • Suspicious Instance Metadata Service (IMDS) API Command Line Execution Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Windows Curl Download to Suspicious Path Splunk (inferred path)
        • Windows Curl Upload to Remote Destination Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Server Update Service Spawning Suspicious Processes Elastic (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process of TieringEngineService.exe Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
      • C:\Windows\System32\CustomShellHost.exe#
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 Sigma
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access Sigma
        • Suspicious CustomShellHost Execution Sigma (inferred path)
      • C:\Windows\System32\d2d1.dll#
      • C:\Windows\System32\d3d10.dll#
      • C:\Windows\System32\d3d10_1.dll#
      • C:\Windows\System32\d3d10_1core.dll#
      • C:\Windows\System32\d3d10core.dll#
      • C:\Windows\System32\d3d10warp.dll#
      • C:\Windows\System32\d3d11.dll#
      • C:\Windows\System32\D3D12.dll#
      • C:\Windows\System32\d3d9.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\dasHost.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\DataExchange.dll#
      • C:\Windows\System32\davclnt.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\dbgcore.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
        • Potential DLL Sideloading Of DBGCORE.DLL Sigma (inferred path)
        • Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location Sigma (inferred path)
        • Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded Sigma (inferred path)
        • WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze Sigma (inferred path)
      • C:\Windows\System32\dbghelp.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
        • Library Load from a Truncated Stack Elastic (inferred path)
        • Potential DLL Sideloading Of DBGHELP.DLL Sigma (inferred path)
        • Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location Sigma (inferred path)
        • Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded Sigma (inferred path)
        • WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze Sigma (inferred path)
      • C:\Windows\System32\DbgModel.dll#
        • Potential DLL Sideloading Of DbgModel.DLL Sigma (inferred path)
      • C:\Windows\System32\dccw.exe#
        • UAC Bypass Attempt via DCCW DLL Search Order Hijacking Elastic (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\dcntel.dll#
      • C:\Windows\System32\dcomp.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\Defrag.exe#
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\defragproxy.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\desktopimgdownldr.exe#
        • Legitimate Application Dropped Archive Sigma (inferred path)
        • Legitimate Application Dropped Executable Sigma (inferred path)
        • Legitimate Application Dropped Script Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • Remote File Download via Desktopimgdownldr Utility Elastic (inferred path)
        • Remote File Download Via Desktopimgdownldr Utility Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
      • C:\Windows\System32\DesktopShellExt.dll#
      • C:\Windows\System32\deviceassociation.dll#
      • C:\Windows\System32\DeviceCredential.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\DeviceCredentialDeployment.exe#
        • DeviceCredentialDeployment Execution Sigma (inferred path)
        • Evasion via Device Credential Deployment Elastic (inferred path)
      • C:\Windows\System32\DeviceEnroller.exe#
        • Potential DLL Sideloading Via DeviceEnroller.EXE Sigma (inferred path)
      • C:\Windows\System32\DevicePairing.dll#
      • C:\Windows\System32\devobj.dll#
      • C:\Windows\System32\devrtl.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\dfrgui.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\dhcpcmonitor.dll#
      • C:\Windows\System32\dhcpcsvc.dll#
      • C:\Windows\System32\dhcpcsvc6.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\dialer.exe#
        • Outbound Network Connection Initiated By Microsoft Dialer Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
      • C:\Windows\System32\directmanipulation.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\Dism#
        • C:\Windows\System32\Dism\DismCore.dll#
          • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
          • UAC Bypass With Fake DLL Sigma (inferred path)
        • C:\Windows\System32\Dism\DismHost.exe#
          • Dism Remove Online Package Sigma (inferred path)
          • UAC Bypass Using DismHost Sigma (inferred path)
          • UAC Bypass Using NTFS Reparse Point - Process Sigma (inferred path)
          • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
          • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\Dism.exe#
        • Dism Remove Online Package Sigma (inferred path)
        • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
        • PowerShell Web Access Feature Enabled Via DISM Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • UAC Bypass Attempt via DismCore DLL Side-Loading Elastic (inferred path)
        • UAC Bypass Using PkgMgr and DISM Sigma (inferred path)
        • UAC Bypass With Fake DLL Sigma (inferred path)
        • Windows DISM Install PowerShell Web Access Splunk (inferred path)
        • Windows DISM Remove Defender Splunk (inferred path)
        • Windows Subsystem for Linux Enabled via Dism Utility Elastic (inferred path)
      • C:\Windows\System32\DismApi.dll#
      • C:\Windows\System32\DispBroker.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\dllhost.exe#
        • Anomalous usage of 7zip Splunk (inferred path)
        • CMSTP UAC Bypass via COM Object Access Sigma (inferred path)
        • Detecting UAC bypass - elevated COM interface Kusto (inferred path)
        • Dev-0270 WMIC Discovery Kusto (inferred path)
        • DLLHost with no Command Line Arguments with Network Splunk (inferred path)
        • Dllhost.EXE Execution Anomaly Sigma (inferred path)
        • Dllhost.EXE Initiated Network Connection To Non-Local IP Address Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Host File System Changes via Windows Subsystem for Linux Elastic (inferred path)
        • ImagingDevices Unusual Parent/Child Processes Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Potential CobaltStrike Process Patterns Sigma (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
        • Potential Privilege Escalation via Elevated IFileOperation Elastic (inferred path)
        • Potential UAC Bypass via IElevatedFactoryServer Elastic (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution Sigma (inferred path)
        • Script Event Consumer Spawning Process Sigma (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious DLLHost no Command Line Arguments Splunk (inferred path)
        • Suspicious Network Connection Binary No CommandLine Sigma (inferred path)
        • Suspicious Windows Component Object Model via DLLHOST Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • UAC Bypass Attempt via Consent DLL Search Order Hijacking Elastic (inferred path)
        • UAC Bypass Attempt via DCCW DLL Search Order Hijacking Elastic (inferred path)
        • UAC Bypass Attempt via DismCore DLL Side-Loading Elastic (inferred path)
        • UAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder Elastic (inferred path)
        • UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer Elastic (inferred path)
        • UAC Bypass Attempt via Privileged IFileOperation COM Interface Elastic (inferred path)
        • UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface Elastic (inferred path)
        • UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface Elastic (inferred path)
        • UAC Bypass Using IDiagnostic Profile Sigma (inferred path)
        • UAC Bypass Using IDiagnostic Profile - File Sigma (inferred path)
        • UAC Bypass Using Windows Media Player - File Sigma
        • UAC Bypass via ICMLuaUtil Sigma (inferred path)
        • UAC Bypass via ICMLuaUtil Elevated COM Interface Elastic (inferred path)
        • UAC Bypass via ICMLuaUtil Elevated COM Interface Elastic (inferred path)
        • UAC Bypass via Windows Firewall Snap-In Hijack Elastic (inferred path)
        • UNC2452 Process Creation Patterns Sigma (inferred path)
        • Unusual Network Connection via DllHost Elastic (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • Wab/Wabmig Unusual Parent Or Child Processes Sigma (inferred path)
        • Windows Binaries Write Suspicious Extensions Sigma (inferred path)
        • Windows Crowdstrike RTR Script Execution Splunk (inferred path)
        • Windows Process Injection into Commonly Abused Processes Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\dllhst3g.exe#
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\dmcfgutils.dll#
      • C:\Windows\System32\dmcmnutils.dll#
      • C:\Windows\System32\dmcommandlineutils.dll#
      • C:\Windows\System32\dmenrollengine.dll#
      • C:\Windows\System32\dmenterprisediagnostics.dll#
      • C:\Windows\System32\dmiso8601utils.dll#
      • C:\Windows\System32\dmoleaututils.dll#
      • C:\Windows\System32\dmprocessxmlfiltered.dll#
      • C:\Windows\System32\dmpushproxy.dll#
      • C:\Windows\System32\dmxmlhelputils.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\dns.exe#
        • DNS RCE CVE-2020-1350 Sigma (inferred path)
        • Unsigned DLL loaded by DNS Service Elastic (inferred path)
        • Unsigned DLL loaded by DNS Service Elastic (inferred path)
      • C:\Windows\System32\dnsapi.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • Module Stomping from a Copied Library Elastic (inferred path)
        • Network Activity from Modified Module Elastic (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\doskey.exe#
        • Recon Information for Export with Command Prompt Sigma (inferred path)
      • C:\Windows\System32\dot3api.dll#
      • C:\Windows\System32\dot3cfg.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\dpapi.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
      • C:\Windows\System32\dpx.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\driverquery.exe#
        • DriverQuery.EXE Execution Sigma (inferred path)
        • Potential Recon Activity Using DriverQuery.EXE Sigma (inferred path)
      • C:\Windows\System32\drivers#
        • Windows File Without Extension In Critical Folder Splunk (inferred branch)
        • C:\Windows\System32\drivers\clfs.sys#
          • Clfs.SYS Loaded By Process Located In a Potential Suspicious Location Sigma (inferred path)
        • C:\Windows\System32\drivers\dmvsc.sys#
          • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
        • C:\Windows\System32\drivers\en-US#
          • C:\Windows\System32\drivers\en-US\dmvsc.sys.mui#
          • C:\Windows\System32\drivers\en-US\netvsc.sys.mui#
            • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
        • C:\Windows\System32\drivers\etc\hosts#
          • DNS hosts file modified Sigma (inferred path)
          • Hosts File Modified Elastic (inferred path)
          • Windows Hosts File Access Splunk (inferred path)
        • C:\Windows\System32\drivers\LiveKdD.SYS#
          • LiveKD Driver Creation Sigma
          • LiveKD Driver Creation By Uncommon Process Sigma
        • C:\Windows\System32\drivers\MoriyaStreamWatchmen.sys#
          • Moriya Rootkit File Created Sigma
        • C:\Windows\System32\drivers\netvsc.sys#
        • C:\Windows\System32\drivers\storvsc.sys#
          • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
      • C:\Windows\System32\DriverStore#
        • Windows File Without Extension In Critical Folder Splunk (inferred branch)
        • C:\Windows\System32\DriverStore\en-US#
          • C:\Windows\System32\DriverStore\en-US\tpmvsc.inf_loc#
          • C:\Windows\System32\DriverStore\en-US\wdmvsc.inf_loc#
          • C:\Windows\System32\DriverStore\en-US\wfcvsc.inf_loc#
          • C:\Windows\System32\DriverStore\en-US\wnetvsc.inf_loc#
          • C:\Windows\System32\DriverStore\en-US\wstorvsc.inf_loc#
            • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
        • C:\Windows\System32\DriverStore\FileRepository#
          • Forest Blizzard APT - JavaScript Constrained File Creation Sigma (inferred branch)
          • C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_9fb0c298f541c56e\Amd64#
            • C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_9fb0c298f541c56e\Amd64\FXSAPI.DLL#
            • C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_9fb0c298f541c56e\Amd64\FXSTIFF.DLL#
              • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
          • C:\Windows\System32\DriverStore\FileRepository\tpmvsc.inf_amd64_3bc161037ebf1c97\tpmvsc.inf#
            • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
          • C:\Windows\System32\DriverStore\FileRepository\wdmvsc.inf_amd64_36d1b94bfd3ae7a6\wdmvsc.inf#
            • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
          • C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_7ec3098da45b4d69#
            • C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_7ec3098da45b4d69\fcvsc.sys#
            • C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_7ec3098da45b4d69\wfcvsc.inf#
              • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
          • C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_3ea8686d80de3706\wnetvsc.inf#
            • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
          • C:\Windows\System32\DriverStore\FileRepository\wstorvsc.inf_amd64_7fd93a3eaba3c55b\wstorvsc.inf#
            • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
      • C:\Windows\System32\drprov.dll#
      • C:\Windows\System32\drvstore.dll#
      • C:\Windows\System32\dsclient.dll#
      • C:\Windows\System32\dsound.dll#
      • C:\Windows\System32\dsparse.dll#
      • C:\Windows\System32\dsprop.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\dsquery.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
      • C:\Windows\System32\dsreg.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\dsregcmd.exe#
        • Visual Studio Code Tunnel Execution (Windows Event Log) Splunk (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
      • C:\Windows\System32\dsrole.dll#
      • C:\Windows\System32\dui70.dll#
      • C:\Windows\System32\duser.dll#
      • C:\Windows\System32\dusmapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\dwm.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Suspicious Desktop Window Manager API Call Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Unusual Desktop Window Manager Child Process Elastic (inferred path)
      • C:\Windows\System32\dwmapi.dll#
      • C:\Windows\System32\dwmcore.dll#
      • C:\Windows\System32\DWrite.dll#
      • C:\Windows\System32\DXCore.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\dxdiag.exe#
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access Sigma (inferred path)
        • System Info Gathering Using Dxdiag Application Splunk (inferred path)
        • Windows App Layer Protocol Qakbot NamedPipe Splunk (inferred path)
        • Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
      • C:\Windows\System32\dxgi.dll#
      • C:\Windows\System32\dxilconv.dll#
      • C:\Windows\System32\dxva2.dll#
      • C:\Windows\System32\dynamoapi.dll#
      • C:\Windows\System32\eappcfg.dll#
      • C:\Windows\System32\eappprxy.dll#
      • C:\Windows\System32\edgeIso.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\edputil.dll#
        • Potential Edputil.DLL Sideloading Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\efsadu.dll#
      • C:\Windows\System32\efsutil.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\en-US#
        • C:\Windows\System32\en-US\cipher.exe.mui#
          • Cipher.exe Execution (Sysmon) Splunk (inferred path)
          • Cipher.exe Execution (Windows Event Log) Splunk (inferred path)
        • C:\Windows\System32\en-US\cmd.exe.mui#
          • Suspicious File Execution From Internet Hosted WebDav Share Sigma (inferred path)
          • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • C:\Windows\System32\en-US\ComputerDefaults.exe.mui#
          • Suspicious ComputerDefaults.exe Execution (Sysmon) Splunk (inferred path)
        • C:\Windows\System32\en-US\cscript.exe.mui#
          • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • C:\Windows\System32\en-US\Dism.exe.mui#
          • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
        • C:\Windows\System32\en-US\dsregcmd.exe.mui#
          • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • C:\Windows\System32\en-US\eventvwr.exe.mui#
          • Windows Handle Duplication in Known UAC-Bypass Binaries Splunk (inferred path)
        • C:\Windows\System32\en-US\mshta.exe.mui#
          • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • C:\Windows\System32\en-US\nslookup.exe.mui#
          • Nslookup PowerShell Download Cradle - ProcessCreation Sigma (inferred path)
        • C:\Windows\System32\en-US\regsvr32.exe.mui#
          • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • C:\Windows\System32\en-US\schtasks.exe.mui#
          • Uncommon One Time Only Scheduled Task At 00:00 Sigma (inferred path)
        • C:\Windows\System32\en-US\services.exe.mui#
          • Rare Process as a Service Kusto (inferred path)
        • C:\Windows\System32\en-US\shell32.dll.mui#
          • Invoke-Obfuscation Via Use Rundll32 - Security Sigma (inferred path)
          • Invoke-Obfuscation Via Use Rundll32 - System Sigma (inferred path)
        • C:\Windows\System32\en-US\tpmvsc.dll.mui#
          • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
        • C:\Windows\System32\en-US\VaultCmd.exe.mui#
          • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • C:\Windows\System32\en-US\WMVDECOD.dll.mui#
        • C:\Windows\System32\en-US\WMVENCOD.dll.mui#
          • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
        • C:\Windows\System32\en-US\wscript.exe.mui#
          • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
      • C:\Windows\System32\esent.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\esentutl.exe#
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Copying Sensitive Files with Credential Data Sigma (inferred path)
        • Esentutl SAM Copy Splunk (inferred path)
        • Esentutl Steals Browser Information Sigma (inferred path)
        • Esentutl Volume Shadow Copy Service Keys Sigma (inferred path)
        • Legitimate Application Dropped Archive Sigma (inferred path)
        • Legitimate Application Dropped Executable Sigma (inferred path)
        • Legitimate Application Dropped Script Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • NTDS or SAM Database File Copied Elastic (inferred path)
        • Potential Browser Data Stealing Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Windows Handle Duplication in Known UAC-Bypass Binaries Splunk (inferred path)
      • C:\Windows\System32\eventcreate.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
      • C:\Windows\System32\eventvwr.exe#
        • Bypass UAC via Event Viewer Elastic (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Potentially Suspicious Event Viewer Child Process Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Suspicious Process Parents Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • UAC Bypass via Event Viewer Elastic (inferred path)
        • Windows Handle Duplication in Known UAC-Bypass Binaries Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\execmodelproxy.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\expand.exe#
        • Creation or Modification of Root Certificate Elastic (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • Network Connection via Signed Binary Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
        • Potentially Suspicious Cabinet File Expansion Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Suspicious Oversized Script Execution Elastic (inferred path)
        • Windows Cabinet File Extraction Via Expand Splunk (inferred path)
      • C:\Windows\System32\ExplorerFrame.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\extrac32.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • Network Connection via Signed Binary Elastic (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Suspicious Extrac32 Execution Sigma (inferred path)
      • C:\Windows\System32\Faultrep.dll#
      • C:\Windows\System32\FdDevQuery.dll#
      • C:\Windows\System32\feclient.dll#
      • C:\Windows\System32\fhcfg.dll#
      • C:\Windows\System32\fhsvcctl.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\filepath2#
        • SOURGUM Actor Behaviours Sigma (inferred branch)
      • C:\Windows\System32\find.exe#
        • Findstr GPP Passwords Sigma (inferred path)
        • Findstr Launching .lnk File Sigma (inferred path)
        • LSASS Process Reconnaissance Via Findstr.EXE Sigma (inferred path)
        • Permission Misconfiguration Reconnaissance Via Findstr.EXE Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Security Tools Keyword Lookup Via Findstr.EXE Sigma (inferred path)
        • Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE Sigma (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
      • C:\Windows\System32\findstr.exe#
        • Findstr GPP Passwords Sigma (inferred path)
        • Findstr Launching .lnk File Sigma (inferred path)
        • Insensitive Subfolder Search Via Findstr.EXE Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • LSASS Process Reconnaissance Via Findstr.EXE Sigma (inferred path)
        • Permission Misconfiguration Reconnaissance Via Findstr.EXE Sigma (inferred path)
        • Potential Password Reconnaissance Via Findstr.EXE Sigma (inferred path)
        • Private Keys Reconnaissance Via CommandLine Tools Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Remote File Download Via Findstr.EXE Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Security Tools Keyword Lookup Via Findstr.EXE Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE Sigma (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Findstr GPP Discovery Splunk (inferred path)
        • Windows Private Keys Discovery Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
      • C:\Windows\System32\finger.exe#
        • DNS Query by Finger Utility Sigma (inferred path)
        • Finger.EXE Execution Chronicle (inferred path)
        • Finger.EXE Execution Sigma (inferred path)
        • Legitimate Application Dropped Archive Sigma (inferred path)
        • Legitimate Application Dropped Executable Sigma (inferred path)
        • Legitimate Application Dropped Script Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • Network Connection Initiated via Finger.EXE Sigma (inferred path)
        • Potential Payload Download via Finger LOLBin Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\FirewallAPI.dll#
      • C:\Windows\System32\FlightSettings.dll#
      • C:\Windows\System32\fltLib.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\fltMC.exe#
        • Execution via stordiag.exe Sigma (inferred path)
        • Filter Driver Unloaded Via Fltmc.EXE Sigma (inferred path)
        • Potential Evasion via Filter Manager Elastic (inferred path)
        • Sysmon Driver Unloaded Via Fltmc.EXE Sigma (inferred path)
        • Unload Sysmon Filter Driver Splunk (inferred path)
      • C:\Windows\System32\fodhelper.exe#
        • Bypass UAC via Fodhelper.exe Sigma (inferred path)
        • FodHelper UAC Bypass Splunk (inferred path)
        • Raspberry Robin Subsequent Execution of Commands Sigma (inferred path)
        • UAC Bypass via FodHelper Execution Hijack Elastic (inferred path)
        • Windows Handle Duplication in Known UAC-Bypass Binaries Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\fontdrvhost.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
      • C:\Windows\System32\forfiles.exe#
        • Command Execution via ForFiles Elastic (inferred path)
        • Download Activity via a Headless Browser Elastic (inferred path)
        • Forfiles Command Execution Sigma (inferred path)
        • Indirect Command Execution via ForFiles Elastic (inferred path)
        • Indirect Command Execution via Forfiles/Pcalua Elastic (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Potential File Download via a Headless Browser Elastic (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
        • Potential Remote Install via MsiExec Elastic (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious SYSTEM User Process Creation Sigma (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows Indirect Command Execution Via Series Of Forfiles Splunk (inferred path)
        • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\format.com#
        • Uncommon FileSystem Load Attempt By Format.com Sigma (inferred path)
      • C:\Windows\System32\framedynos.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\fsquirt.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\fsutil.exe#
        • Delete Volume USN Journal with Fsutil Elastic (inferred path)
        • Fsutil Drive Enumeration Sigma (inferred path)
        • Fsutil Suspicious Invocation Sigma (inferred path)
        • Fsutil Zeroing File Splunk (inferred path)
        • Peripheral Device Discovery Elastic (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • USN Journal Deletion Splunk (inferred path)
        • Webshell Hacking Activity Patterns Sigma (inferred path)
        • Windows Information Discovery Fsutil Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Symlink Evaluation Change via Fsutil Splunk (inferred path)
      • C:\Windows\System32\ftp.exe#
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Potential Arbitrary Command Execution Via FTP.EXE Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\fveapi.dll#
      • C:\Windows\System32\fveskybackup.dll#
      • C:\Windows\System32\fvewiz.dll#
      • C:\Windows\System32\fwbase.dll#
      • C:\Windows\System32\fwcfg.dll#
      • C:\Windows\System32\fwpolicyiomgr.dll#
      • C:\Windows\System32\FWPUCLNT.DLL#
      • C:\Windows\System32\getuname.dll#
      • C:\Windows\System32\gpapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\gpresult.exe#
        • Gpresult Display Group Policy Information Sigma (inferred path)
        • Group Policy Discovery via Microsoft GPResult Utility Elastic (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
      • C:\Windows\System32\gpscript.exe#
        • Gpscript Execution Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\gpupdate.exe#
        • GPUpdate with no Command Line Arguments with Network Splunk (inferred path)
        • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Suspicious GPUpdate no Command Line Arguments Splunk (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
      • C:\Windows\System32\GroupPolicy\Machine\Registry.pol#
        • QoS Policy Group Policy Registry Overwrite via WMI Elastic (inferred path)
      • C:\Windows\System32\hdwwiz.cpl#
        • System Control Panel Item Loaded From Uncommon Location Sigma (inferred path)
      • C:\Windows\System32\hid.dll#
      • C:\Windows\System32\hnetmon.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\HOSTNAME.EXE#
        • Suspicious Execution of Hostname Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Windows Cmdline Tool Execution From Non-Shell Process Splunk (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows System Information Discovery Elastic (inferred path)
      • C:\Windows\System32\httpapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\icacls.exe#
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Excessive Usage Of Cacls App Splunk (inferred path)
        • File and Directory Permissions Modification Elastic (inferred path)
        • File or Folder Permissions Modifications Sigma (inferred path)
        • Icacls Deny Command Splunk (inferred path)
        • ICACLS Grant Command Splunk (inferred path)
        • Modify ACL permission To Files Or Folder Splunk (inferred path)
        • System Boot Files Permission Change Elastic (inferred path)
        • System File Ownership Change Elastic (inferred path)
        • Use Icacls to Hide File to Everyone Sigma (inferred path)
        • Windows File and Directory Enable ReadOnly Permissions Splunk (inferred path)
        • Windows File and Directory Permissions Enable Inheritance Splunk (inferred path)
        • Windows File and Directory Permissions Remove Inheritance Splunk (inferred path)
        • Windows Files and Dirs Access Rights Modification Via Icacls Splunk (inferred path)
      • C:\Windows\System32\icmp.dll#
      • C:\Windows\System32\IDStore.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\ie4uinit.exe#
        • Ie4uinit Lolbin Use From Invalid Path Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\IEAdvpack.dll#
      • C:\Windows\System32\iedkcs32.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\ieproxy.dll#
        • Potential Command and Control via Internet Explorer Elastic (inferred path)
      • C:\Windows\System32\iernonce.dll#
      • C:\Windows\System32\iertutil.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\iexpress.exe#
        • New Self Extracting Package Created Via IExpress.EXE Sigma (inferred path)
        • Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Unusual Process Network Connection Elastic (inferred path)
      • C:\Windows\System32\ifmon.dll#
      • C:\Windows\System32\ifsutil.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\IME#
        • SOURGUM Actor Behaviours Sigma (inferred branch)
        • C:\Windows\System32\IME\IMEJP#
        • C:\Windows\System32\IME\IMETC#
          • CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum Sigma (inferred branch)
          • SOURGUM Actor Behaviours Sigma (inferred branch)
        • C:\Windows\System32\IME\SHARED#
          • CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum Sigma (inferred branch)
          • SOURGUM Actor Behaviours Sigma (inferred branch)
          • C:\Windows\System32\IME\SHARED\IMEWDBLD.EXE#
            • Arbitrary File Download Via IMEWDBLD.EXE Sigma (inferred path)
            • Network Connection Initiated By IMEWDBLD.EXE Sigma (inferred path)
      • C:\Windows\System32\inetsrv#
        • Windows Shell or Script Execution From IIS Directory Splunk (inferred branch)
      • C:\Windows\System32\InfDefaultInstall.exe#
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\InprocLogger.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\ipconfig.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Cmdline Tool Execution From Non-Shell Process Splunk (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • Windows System Network Config Discovery Display DNS Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
      • C:\Windows\System32\IPHLPAPI.DLL#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\iri.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\iscsicli.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\iscsicpl.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Windows DLL Search Order Hijacking with iscsicpl Splunk (inferred path)
      • C:\Windows\System32\iscsidsc.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\iscsiexe.dll#
        • UAC Bypass Using Iscsicpl - ImageLoad Sigma (inferred path)
      • C:\Windows\System32\iscsium.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\ISM.dll#
      • C:\Windows\System32\ISM.exe#
        • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
      • C:\Windows\System32\isoburn.exe#
        • Phishing Pattern ISO in Archive Sigma (inferred path)
      • C:\Windows\System32\iumbase.dll#
      • C:\Windows\System32\IumSdk.dll#
      • C:\Windows\System32\joinutil.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\jscript.dll#
        • MMC Loading Script Engines DLLs Sigma (inferred path)
        • Script Execution via MSXSL Elastic (inferred path)
        • Suspicious WMIC XSL Script Execution Elastic (inferred path)
        • Suspicious WMIC XSL Script Execution Elastic (inferred path)
        • Windows MMC Loaded Script Engine DLL Splunk (inferred path)
        • WMIC Loading Scripting Libraries Sigma (inferred path)
      • C:\Windows\System32\jscript9.dll#
        • MMC Loading Script Engines DLLs Sigma (inferred path)
        • Script Execution via MSXSL Elastic (inferred path)
        • Windows MMC Loaded Script Engine DLL Splunk (inferred path)
      • C:\Windows\System32\kdstub.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\kernel32.dll#
      • C:\Windows\System32\KernelBase.dll#
        • Library Load from a Truncated Stack Elastic (inferred path)
      • C:\Windows\System32\kiwissp.log#
        • Mimikatz malicious Security package (SSP) exfiltrates cleartext passwords in file Sigma (inferred path)
      • C:\Windows\System32\klist.exe#
        • Windows Steal or Forge Kerberos Tickets Klist Splunk (inferred path)
      • C:\Windows\System32\ksetup.exe#
        • Computer Password Change Via Ksetup.EXE Sigma (inferred path)
        • Logged-On User Password Change Via Ksetup.EXE Sigma (inferred path)
      • C:\Windows\System32\ksproxy.ax#
        • Potential CVE-2024-35250 Exploitation Activity Sigma (inferred path)
      • C:\Windows\System32\ksuser.dll#
      • C:\Windows\System32\ktmw32.dll#
      • C:\Windows\System32\LicenseManagerApi.dll#
      • C:\Windows\System32\LicensingDiagSpp.dll#
      • C:\Windows\System32\linkinfo.dll#
      • C:\Windows\System32\loadperf.dll#
      • C:\Windows\System32\LockHostingFramework.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\lodctr.exe#
        • Rebuild Performance Counter Values Via Lodctr.EXE Sigma (inferred path)
      • C:\Windows\System32\LogFiles#
        • C:\Windows\System32\LogFiles\CloudFiles#
          • Windows Cloud Files Filter Log Created by Non-System Process Splunk (inferred branch)
        • C:\Windows\System32\LogFiles\WMI#
          • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
          • Windows Process Writing File to World Writable Path Splunk (inferred branch)
      • C:\Windows\System32\logman.exe#
        • Disable Windows Event and Security Logs Using Built-in Tools Elastic (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Suspicious Windows Trace ETW Session Tamper Via Logman.EXE Sigma (inferred path)
      • C:\Windows\System32\logoff.exe#
        • Windows Account Access Removal via Logoff Exec Splunk (inferred path)
      • C:\Windows\System32\logoncli.dll#
      • C:\Windows\System32\LogonController.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\LogonUI.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Potential Privilege Escalation via LogonUI Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
      • C:\Windows\System32\logonUI.exe.local#
        • Potential DLL Sideloading Via comctl32.dll Sigma (inferred branch)
      • C:\Windows\System32\lpksetupproxyserv.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\LsaIso.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Windows Processes Suspicious Parent Directory Sigma (inferred path)
      • C:\Windows\System32\lsass.exe#
        • Abused Debug Privilege by Arbitrary Parent Processes Sigma (inferred path)
        • Access LSASS Memory for Dump Creation Splunk (inferred path)
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • Create Remote Thread into LSASS Splunk (inferred path)
        • Creation of a Local Hidden User Account by Registry Sigma (inferred path)
        • Credential Dumping Activity By Python Based Tool Sigma (inferred path)
        • Credential Dumping Attempt Via WerFault Chronicle (inferred path)
        • Credential Dumping Attempt Via WerFault Sigma (inferred path)
        • Detect Credential Dumping through LSASS access Splunk (inferred path)
        • Dumping LSASS Process Into a File Kusto
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • HackTool - HandleKatz Duplicating LSASS Handle Sigma (inferred path)
        • LSASS Access From Potentially White-Listed Processes Sigma (inferred path)
        • LSASS Access From Program In Potentially Suspicious Folder Sigma (inferred path)
        • LSASS dump via process access Sigma (inferred path)
        • LSASS Memory Access by Tool With Dump Keyword In Name Sigma (inferred path)
        • Lsass Memory Dump via Comsvcs DLL Chronicle (inferred path)
        • Lsass Memory Dump via Comsvcs DLL Sigma (inferred path)
        • Mimikatz malicious Security package (SSP) exfiltrates cleartext passwords in file Sigma (inferred path)
        • Mimikatz Memssp Log File Detected Elastic (inferred path)
        • Password Dumper Remote Thread in LSASS Sigma (inferred path)
        • Potential Credential Access via DuplicateHandle in LSASS Elastic (inferred path)
        • Potential Credential Access via LSASS Memory Dump Elastic (inferred path)
        • Potential Credential Dumping Activity Via LSASS Chronicle (inferred path)
        • Potential Credential Dumping Activity Via LSASS Sigma (inferred path)
        • Potential Credential Dumping Attempt Via PowerShell Sigma (inferred path)
        • Potential Credential Dumping Attempt Via PowerShell Remote Thread Sigma (inferred path)
        • Potential Credential Dumping Via LSASS Process Clone Sigma (inferred path)
        • Potential LSASS Clone Creation via PssCaptureSnapShot Elastic (inferred path)
        • Potentially Suspicious GrantedAccess Flags On LSASS Sigma (inferred path)
        • Remote LSASS Process Access Through Windows Remote Management Sigma (inferred path)
        • Suspicious LSASS Access via MalSecLogon Elastic (inferred path)
        • Suspicious LSASS Access Via MalSecLogon Sigma (inferred path)
        • Suspicious Lsass Process Access Elastic (inferred path)
        • Suspicious Module Loaded by LSASS Elastic (inferred path)
        • Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs Sigma (inferred path)
        • Suspicious Vault Files Access via RPC Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Uncommon GrantedAccess Flags On LSASS Sigma (inferred path)
        • Unsigned Image Loaded Into LSASS Process Sigma (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • WerFault LSASS Process Memory Dump Sigma (inferred path)
        • Windows Binaries Write Suspicious Extensions Sigma (inferred path)
        • Windows Hunting System Account Targeting Lsass Splunk (inferred path)
        • Windows Non-System Account Targeting Lsass Splunk (inferred path)
        • Windows Process Injection into Commonly Abused Processes Splunk (inferred path)
        • Windows Processes Suspicious Parent Directory Sigma (inferred path)
        • Windows Terminating Lsass Process Splunk (inferred path)
      • C:\Windows\System32\Magnification.dll#
      • C:\Windows\System32\MaintenanceUI.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\makecab.exe#
        • HAFNIUM Exchange Exploitation Activity Sigma (inferred path)
        • Network Connection via Signed Binary Elastic (inferred path)
        • New Self Extracting Package Created Via IExpress.EXE Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
      • C:\Windows\System32\manage-bde.exe#
        • Windows BitLocker Suspicious Command Usage Splunk (inferred path)
      • C:\Windows\System32\mapistub.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\mavinject.exe#
        • DLL Injection via MavInject Utility Elastic (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows Binary Proxy Execution Mavinject DLL Injection Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\MdmDiagnostics.dll#
      • C:\Windows\System32\mfc42u.dll#
      • C:\Windows\System32\mfcore.dll#
      • C:\Windows\System32\mfplat.dll#
      • C:\Windows\System32\mi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\Microsoft#
        • C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys#
          • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
          • Windows Process Writing File to World Writable Path Splunk (inferred branch)
        • C:\Windows\System32\MICROSOFT\PROTECT\S-1-5-18\USER#
          • Potential Discovery of DPAPI Master Keys Elastic (inferred branch)
      • C:\Windows\System32\Microsoft-Edge-WebView#
        • C:\Windows\System32\Microsoft-Edge-WebView\msedgewebview2.exe#
          • Office Macro File Download Sigma (inferred path)
          • Potentially Suspicious Electron Application CommandLine Sigma (inferred path)
          • Suspicious Electron Application Child Processes Sigma (inferred path)
          • Suspicious MSC File Launched Kusto (inferred path)
          • VHD Image Download Via Browser Sigma (inferred path)
        • C:\Windows\System32\Microsoft-Edge-WebView\vcruntime140.dll#
          • Potential Vcruntime140 DLL Sideloading Sigma (inferred path)
      • C:\Windows\System32\MicrosoftAccountTokenProvider.dll#
        • Potential Azure Browser SSO Abuse Sigma
      • C:\Windows\System32\MicrosoftEdgeCP.exe#
      • C:\Windows\System32\MicrosoftEdgeSH.exe#
        • Suspicious PowerShell Parent Process Sigma (inferred path)
      • C:\Windows\System32\midimap.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\mimilsa.log#
        • Mimikatz malicious Security package (SSP) exfiltrates cleartext passwords in file Sigma (inferred path)
      • C:\Windows\System32\miutils.dll#
      • C:\Windows\System32\mlang.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\mmc.exe#
        • Execution of a Downloaded Windows Script via Explorer Elastic (inferred path)
        • HackTool - Potential Impacket Lateral Movement Activity Sigma (inferred path)
        • Impacket DCOMexec process abuse via MMC Sigma (inferred path)
        • Incoming DCOM Lateral Movement with MMC Elastic (inferred path)
        • Microsoft Management Console File from Unusual Path Elastic (inferred path)
        • MMC Executing Files with Reversed Extensions Using RTLO Abuse Sigma (inferred path)
        • MMC Loading Script Engines DLLs Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • MMC Spawning Windows Shell Sigma (inferred path)
        • MMC20 Lateral Movement Sigma (inferred path)
        • Possible Lateral Movement PowerShell Spawn Splunk (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
        • Process Injection Initiated By MMC Kusto (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Script Execution via APDS XSS Injection Elastic (inferred path)
        • Script Interpreter Loading DotNet Assembly From Memory Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Execution via Microsoft Common Console Elastic (inferred path)
        • Suspicious MSC File Launched Kusto (inferred path)
        • Suspicious Windows Script Downloaded from the Internet Elastic (inferred path)
        • UAC Bypass Attempt via MMC DLL Search Order Hijacking Elastic (inferred path)
        • UAC Bypass MMC Load Unsigned Dll Splunk (inferred path)
        • UAC Bypass via Event Viewer Elastic (inferred path)
        • UAC Bypass via Hijacking WinMgmt MMC Elastic (inferred path)
        • UAC Bypass via Malicious MMC Snap-In Execution Elastic (inferred path)
        • UAC Bypass via Windows Firewall Snap-In Hijack Elastic (inferred path)
        • UAC Bypass via Windows Firewall Snap-In Hijack Elastic (inferred path)
        • UAC Bypass via Windows Firewall Snap-In Hijack Sigma (inferred path)
        • Unusual Execution via Microsoft Common Console File Elastic (inferred path)
        • Windows Default Domain GPO Modification via GPME Sigma (inferred path)
        • Windows Default Group Policy Object Modified with GPME Splunk (inferred path)
        • Windows Execution of Microsoft MSC File In Suspicious Path Splunk (inferred path)
        • Windows Handle Duplication in Known UAC-Bypass Binaries Splunk (inferred path)
        • Windows MSC EvilTwin Directory Path Manipulation Splunk (inferred path)
        • Windows Remote Host Computer Management Access Splunk (inferred path)
        • Windows Script Executed From a Suspicious Path Elastic (inferred path)
        • Windows Script Execution via MMC Console File Elastic (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\MMDevAPI.dll#
      • C:\Windows\System32\mobilenetworking.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\mobsync.exe#
        • Created Files by Microsoft Sync Center Sigma (inferred path)
        • Microsoft Sync Center Suspicious Network Connections Sigma (inferred path)
        • Qakbot Discovery Activies Kusto (inferred path)
        • Windows App Layer Protocol Qakbot NamedPipe Splunk (inferred path)
        • Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
      • C:\Windows\System32\mode.com#
        • CodePage Modification Via MODE.COM Sigma (inferred path)
        • CodePage Modification Via MODE.COM To Russian Language Sigma (inferred path)
      • C:\Windows\System32\more.com#
        • Lummac Stealer Activity - Execution Of More.com And Vbc.exe Sigma (inferred path)
      • C:\Windows\System32\mountvol.exe#
        • Windows EFI Volume Mount Attempt Via Mountvol Splunk (inferred path)
      • C:\Windows\System32\mpr.dll#
      • C:\Windows\System32\mprapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\mqsvc.exe#
        • Potential CVE-2023-21554 QueueJumper Exploitation Sigma (inferred path)
      • C:\Windows\System32\MrmCoreR.dll#
      • C:\Windows\System32\msacm32.dll#
      • C:\Windows\System32\mscms.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\msconfig.exe#
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\mscoree.dll#
        • Detect .NET runtime being loaded in JScript for code execution Kusto (inferred path)
        • DotNet CLR DLL Loaded By Scripting Applications Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\msctf.dll#
      • C:\Windows\System32\MsCtfMonitor.dll#
      • C:\Windows\System32\msdrm.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\msdt.exe#
        • Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE Sigma (inferred path)
        • File Creation In Suspicious Directory By Msdt.EXE Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • MSDT Execution Via Answer File Sigma (inferred path)
        • Potential Arbitrary Command Execution Using Msdt.EXE Sigma (inferred path)
        • Potential Follina_DogWalk Activity - mdst.exe (Sysmon) Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Cabinet File Execution Via Msdt.EXE Sigma (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MSDT Parent Process Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious Troubleshooting Pack Cabinet Execution Elastic (inferred path)
        • Windows Execute Arbitrary Commands with MSDT Splunk (inferred path)
        • Windows Office Product Spawned MSDT Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\msdtc.exe#
        • Lazarus System Binary Masquerading Sigma (inferred path)
        • Persistence via MSDTC Service Hijack Elastic (inferred path)
        • Pingback Backdoor DLL Loading Activity Sigma (inferred path)
        • Windows Masquerading Msdtc Process Splunk (inferred path)
      • C:\Windows\System32\msdtctm.dll#
      • C:\Windows\System32\msdtcVSp1res.dll#
      • C:\Windows\System32\msftedit.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\mshta.exe#
        • Attempt to Disable Windows Defender Services Elastic (inferred path)
        • Command and Scripting Interpreter via Windows Scripts Elastic (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Connection to a Suspicious URL Elastic (inferred path)
        • Creation or Modification of Root Certificate Elastic (inferred path)
        • Csc.EXE Execution Form Potentially Suspicious Parent Sigma (inferred path)
        • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
        • Detect mshta inline hta execution Splunk (inferred path)
        • Detect MSHTA Url in Command Line Splunk (inferred path)
        • DotNet CLR DLL Loaded By Scripting Applications Sigma (inferred path)
        • Download Activity via a Headless Browser Elastic (inferred path)
        • Dynwrapx Image Load via Windows Scripts Elastic (inferred path)
        • Execution of a Downloaded Windows Script Elastic (inferred path)
        • Execution of a Downloaded Windows Script via Explorer Elastic (inferred path)
        • Execution of a File Downloaded via Windows OpenSSH Elastic (inferred path)
        • Execution of a File Written by a Signed Binary Proxy Elastic (inferred path)
        • Execution of a Windows Script Downloaded from the Internet Elastic (inferred path)
        • HackTool - CACTUSTORCH Remote Thread Creation Sigma (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • Incoming DCOM Lateral Movement via MSHTA Elastic (inferred path)
        • Ingress DLL Transfer followed by DLL SideLoading Elastic (inferred path)
        • Legitimate Application Dropped Archive Sigma (inferred path)
        • Legitimate Application Dropped Executable Sigma (inferred path)
        • Legitimate Application Dropped Script Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • LOLBIN Execution From Abnormal Drive Sigma (inferred path)
        • Manual Execution of Script Inside of a Compressed File Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • MSHTA Execution with Suspicious File Extensions Sigma (inferred path)
        • Mshta Making Network Connections Elastic (inferred path)
        • Mshta spawning Rundll32 OR Regsvr32 Process Splunk (inferred path)
        • Network Connection via Startup Item Elastic (inferred path)
        • NTDS.DIT Creation By Uncommon Process Sigma (inferred path)
        • Office Macro File Creation From Suspicious Process Sigma (inferred path)
        • OneNote.EXE Execution of Malicious Embedded Scripts Sigma (inferred path)
        • Oversized Windows Script Execution Elastic (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Pikabot Fake DLL Extension Execution Via Rundll32.EXE Sigma (inferred path)
        • Potential CVE-2023-21554 QueueJumper Exploitation Sigma (inferred path)
        • Potential Devil Bait Related Indicator Sigma (inferred path)
        • Potential Dropper Script Execution Via WScript/CScript/MSHTA Sigma (inferred path)
        • Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) Sigma (inferred path)
        • Potential Fake CAPTCHA Phishing Attack Elastic (inferred path)
        • Potential File Download via a Headless Browser Elastic (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Sigma (inferred path)
        • Potential LethalHTA Technique Execution Sigma (inferred path)
        • Potential Qakbot Rundll32 Execution Sigma (inferred path)
        • Potential Recon Activity Using DriverQuery.EXE Sigma (inferred path)
        • Potential Remote Install via MsiExec Elastic (inferred path)
        • Potential Suspicious Child Process Of 3CXDesktopApp Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of DiskShadow.EXE Sigma (inferred path)
        • Potentially Suspicious Child Process of KeyScrambler.exe Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Potentially Suspicious Child Process Of WinRAR.EXE Sigma (inferred path)
        • Potentially Suspicious Child Processes Spawned by ConHost Sigma (inferred path)
        • Potentially Suspicious DMP/HDMP File Creation Sigma (inferred path)
        • Potentially Suspicious Execution From Parent Process In Public Folder Sigma (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Potentially Suspicious WebDAV LNK Execution Sigma (inferred path)
        • Potentially Suspicious Windows App Activity Sigma (inferred path)
        • Process Activity via Compiled HTML File Elastic (inferred path)
        • Process Execution with Unusual File Extension Elastic (inferred path)
        • Qakbot Rundll32 Exports Execution Sigma (inferred path)
        • Qakbot Rundll32 Fake DLL Extension Execution Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Registry Tampering by Potentially Suspicious Processes Sigma (inferred path)
        • Remotely Hosted HTA File Executed Via Mshta.EXE Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Script Event Consumer Spawning Process Sigma (inferred path)
        • Script Execution via Microsoft HTML Application Elastic (inferred path)
        • Script Interpreter Execution From Suspicious Folder Sigma (inferred path)
        • Script Interpreter Loading DotNet Assembly From Memory Kusto (inferred path)
        • Scripting/CommandLine Process Spawned Regsvr32 Sigma (inferred path)
        • Sdiagnhost Calling Suspicious Child Process Sigma (inferred path)
        • Service Control Spawned via Script Interpreter Elastic (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Shell Execution via Windows Shortcut File Elastic (inferred path)
        • Startup Persistence by a Suspicious Process Elastic (inferred path)
        • Sticky Key Like Backdoor Execution Sigma (inferred path)
        • Suspicious .NET Code Compilation Elastic (inferred path)
        • Suspicious ArcSOC.exe Child Process Sigma (inferred path)
        • Suspicious BitLocker Access Agent Update Utility Execution Sigma (inferred path)
        • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
        • Suspicious Child Process Of BgInfo.EXE Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process of Notepad++ Updater - GUP.Exe Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process of SAP NetWeaver Sigma (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Chromium Browser Instance Executed With Custom Extension Sigma (inferred path)
        • Suspicious CrushFTP Child Process Sigma (inferred path)
        • Suspicious Electron Application Child Processes Sigma (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution via Compiled HTML File Elastic (inferred path)
        • Suspicious Execution via Microsoft Exchange Transport Agent Elastic (inferred path)
        • Suspicious Execution via ShellBrowserWindow/ShellWindow COM Elastic (inferred path)
        • Suspicious Explorer Child Process Elastic (inferred path)
        • Suspicious JavaScript Execution Via Mshta.EXE Sigma (inferred path)
        • Suspicious Microsoft Diagnostics Wizard Execution Elastic (inferred path)
        • Suspicious Microsoft HTML Application Child Process Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious MSDT Parent Process Sigma (inferred path)
        • Suspicious MSHTA Child Process Sigma (inferred path)
        • Suspicious mshta child process Splunk (inferred path)
        • Suspicious mshta spawn Splunk (inferred path)
        • Suspicious Mshta.EXE Execution Patterns Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious Oversized Script Execution Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious PowerShell Console History Deletion Elastic (inferred path)
        • Suspicious PowerShell Parent Process Sigma (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Provlaunch.EXE Child Process Sigma (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious SYSTEM User Process Creation Sigma (inferred path)
        • Suspicious Windows Script Base64 Encoding Elastic (inferred path)
        • Suspicious Windows Script Downloaded from the Internet Elastic (inferred path)
        • Suspicious WMI Enumeration via Windows Scripts Elastic (inferred path)
        • Suspicious WmiPrvSE Child Process Sigma (inferred path)
        • Unusual File Creation - Alternate Data Stream Elastic (inferred path)
        • VMToolsd Suspicious Child Process Sigma (inferred path)
        • Web or Application Server Spawning a Shell Splunk (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows DLL Search Order Hijacking with iscsicpl Splunk (inferred path)
        • Windows MSHTA Writing to World Writable Path Splunk (inferred path)
        • Windows Office Product Spawned Uncommon Process Splunk (inferred path)
        • Windows Remote Assistance Spawning Process Splunk (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Script Executed From a Suspicious Path Elastic (inferred path)
        • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
        • Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma (inferred path)
        • Windows Spearphishing Attachment Onenote Spawn Mshta Splunk (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • Windows Terminal Profile Settings Modification By Uncommon Process Sigma (inferred path)
        • WinRAR Spawning Shell Application Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wscript Or Cscript Suspicious Child Process Splunk (inferred path)
        • WSL Child Process Anomaly Sigma (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\mshtml.dll#
      • C:\Windows\System32\MshtmlDac.dll#
        • Windows Office Product Loaded MSHTML Module Splunk (inferred path)
      • C:\Windows\System32\msi.dll#
        • MSI Module Loaded by Non-System Binary Splunk (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\msiexec.exe#
        • Always Install Elevated Windows Installer Sigma (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • DarkGate - Autoit3.EXE Execution Parameters Sigma (inferred path)
        • Detect Msiexec executing DLL network connections Kusto (inferred path)
        • DLL Dropped by MSIEXEC followed by SideLoad Elastic (inferred path)
        • DllUnregisterServer Function Call Via Msiexec.EXE Sigma (inferred path)
        • Download Activity via a Headless Browser Elastic (inferred path)
        • Encoded Powershell Execution via MsiExec Elastic (inferred path)
        • Execution of a Downloaded Windows Script Elastic (inferred path)
        • Execution via Windows Installer Transforms Elastic (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • InstallerFileTakeOver LPE CVE-2021-41379 File Create Event Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Msiexec Execution via a Windows Script Interpreter Elastic (inferred path)
        • Msiexec Quiet Installation Sigma (inferred path)
        • MsiExec Service Child Process With Network Connection Elastic (inferred path)
        • Msiexec.EXE Initiated Network Connection Over HTTP Sigma (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Persistence via a Windows Installer Elastic (inferred path)
        • Potential File Download via a Headless Browser Elastic (inferred path)
        • Potential Lateral Movement via MSI ODBC Driver Install over DCOM Kusto (inferred path)
        • Potential MsiExec Masquerading Sigma (inferred path)
        • Potential Remote Execution via IMsiServer Elastic (inferred path)
        • Potential Remote File Execution via MSIEXEC Elastic (inferred path)
        • Potential Remote Install via MsiExec Elastic (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Privilege Escalation via Windows Installer Hijack Elastic (inferred path)
        • Raspberry Robin Initial Execution From External Drive Sigma (inferred path)
        • Remote File Execution via MSIEXEC Elastic (inferred path)
        • Remote Management Access Launch After MSI Install Elastic (inferred path)
        • Remote MSI Package Installation via MSIEXEC Elastic (inferred path)
        • Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Script Event Consumer Spawning Process Sigma (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious API call via a Windows Installer Module Elastic (inferred path)
        • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
        • Suspicious DNS Lookup by Remote Utilities RMM Elastic (inferred path)
        • Suspicious DNS Query by MSIEXEC Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution via Compiled HTML File Elastic (inferred path)
        • Suspicious Execution via MSIEXEC Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MsiExec Child Process Elastic (inferred path)
        • Suspicious Msiexec Execute Arbitrary DLL Sigma (inferred path)
        • Suspicious Msiexec Quiet Install From Remote Location Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious Oversized Script Execution Elastic (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Suspicious Startup Persistence via a Windows Installer Elastic (inferred path)
        • Suspicious WmiPrvSE Child Process Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Uninstall App Using MsiExec Splunk (inferred path)
        • User Account Control Disabled via Registry Elastic (inferred path)
        • Windows HTTP Network Communication From MSIExec Splunk (inferred path)
        • Windows Installer Execution via Explorer Elastic (inferred path)
        • Windows Installer with Suspicious Properties Elastic (inferred path)
        • Windows MSIExec DLLRegisterServer Splunk (inferred path)
        • Windows MsiExec HideWindow Rundll32 Execution Splunk (inferred path)
        • Windows MSIExec Remote Download Splunk (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows MSIExec Spawn WinDBG Splunk (inferred path)
        • Windows MSIExec Unregister DLLRegisterServer Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\msinfo32.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
      • C:\Windows\System32\msIso.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\msra.exe#
        • Potential Process Injection Via Msra.EXE Sigma (inferred path)
        • Windows App Layer Protocol Qakbot NamedPipe Splunk (inferred path)
        • Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
        • Windows Remote Assistance Spawning Process Splunk (inferred path)
      • C:\Windows\System32\mstask.dll#
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
      • C:\Windows\System32\mstsc.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Hijack Legit RDP Session to Move Laterally Sigma (inferred path)
        • Lateral Movement via Startup Folder Elastic (inferred path)
        • Mstsc.EXE Execution From Uncommon Parent Sigma (inferred path)
        • Mstsc.EXE Execution With Local RDP File Sigma (inferred path)
        • New Remote Desktop Connection Initiated Via Mstsc.EXE Sigma (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
        • Potential Initial Access via Rogue RDP Server Elastic (inferred path)
        • Remote Desktop File Opened from Suspicious Path Elastic (inferred path)
        • Remote Thread Creation In Mstsc.Exe From Suspicious Location Sigma (inferred path)
        • Rouge RDP: Suspicious File Creation Kusto (inferred path)
        • Suspicious Mstsc.EXE Execution With Local RDP File Sigma (inferred path)
        • Windows MSTSC RDP Commandline Splunk (inferred path)
        • Windows RDP Client Launched with Admin Session Splunk (inferred path)
      • C:\Windows\System32\mstscax.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • Suspicious RDP ActiveX Client Loaded Elastic (inferred path)
        • Unusual Remote Desktop Client Process Elastic (inferred path)
      • C:\Windows\System32\msutb.dll#
      • C:\Windows\System32\msvcp110_win.dll#
      • C:\Windows\System32\MSWB7.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\mswsock.dll#
        • Library Load from a Truncated Stack Elastic (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\msxml3.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Remote XSL Script Execution via COM Elastic (inferred path)
      • C:\Windows\System32\mtxclu.dll#
      • C:\Windows\System32\NapiNSP.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\narrator.exe.local#
        • Potential DLL Sideloading Via comctl32.dll Sigma (inferred branch)
      • C:\Windows\System32\nbtstat.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows System Network Connections Discovery Elastic (inferred path)
      • C:\Windows\System32\ncrypt.dll#
      • C:\Windows\System32\ndfapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\NDKPerfCmd.exe#
        • Visual Studio Code Tunnel Execution (Windows Event Log) Splunk (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
      • C:\Windows\System32\net.exe#
        • Account Creation Kusto (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • DarkGate - User Created Via Net.EXE Sigma (inferred path)
        • Discovery of a System Time Sigma (inferred path)
        • Enumeration of Administrator Accounts Elastic (inferred path)
        • Exploited CVE-2020-10189 Zoho ManageEngine Sigma (inferred path)
        • File or Folder Permissions Modifications Sigma (inferred path)
        • Local Accounts Discovery Chronicle (inferred path)
        • Local Accounts Discovery Sigma (inferred path)
        • Mounting Hidden or WebDav Remote Shares Elastic (inferred path)
        • Net.EXE Execution Sigma (inferred path)
        • New User Created Via Net.EXE Chronicle (inferred path)
        • New User Created Via Net.EXE Sigma (inferred path)
        • New User Created Via Net.EXE With Never Expire Option Sigma (inferred path)
        • Password Provided In Command Line Of Net.EXE Sigma (inferred path)
        • Potential Dridex Activity Sigma (inferred path)
        • Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group Sigma (inferred path)
        • Potential Process Injection Via Msra.EXE Sigma (inferred path)
        • Potential Ryuk Ransomware Activity Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Qakbot Discovery Activies Kusto (inferred path)
        • Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution Sigma (inferred path)
        • Rorschach Ransomware Execution Activity Sigma (inferred path)
        • Share And Session Enumeration Using Net.EXE Sigma (inferred path)
        • SMB over QUIC Via Net.EXE Sigma (inferred path)
        • Start Windows Service Via Net.EXE Sigma (inferred path)
        • Stop Windows Service Via Net.EXE Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process Of Veeam Dabatase Sigma (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Execution via Microsoft Exchange Transport Agent Elastic (inferred path)
        • Suspicious Group And Account Reconnaissance Activity Using Net.EXE Sigma (inferred path)
        • Suspicious Manipulation Of Default Accounts Via Net.EXE Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Suspicious Windows Service Tampering Sigma (inferred path)
        • System Network Connections Discovery Via Net.EXE Sigma (inferred path)
        • System Service Discovery through built-in Windows Utilities Elastic (inferred path)
        • System Time Discovery Elastic (inferred path)
        • Unmount Share Via Net.EXE Sigma (inferred path)
        • User Account Creation Elastic (inferred path)
        • User enumeration and creation related to Manic Menagerie 2.0 (via cmdline) Sigma (inferred path)
        • Windows Account or Group Discovery Elastic (inferred path)
        • Windows Admin Share Mount Via Net.EXE Sigma (inferred path)
        • Windows Internet Hosted WebDav Share Mount Via Net.EXE Sigma (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Network Connection Discovery Via Net Splunk (inferred path)
        • Windows Network Enumeration Elastic (inferred path)
        • Windows Network Share Interaction Via Net Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Security Account Manager Stopped Splunk (inferred path)
        • Windows Share Mount Via Net.EXE Sigma (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows System Network Connections Discovery Elastic (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
      • C:\Windows\System32\net1.exe#
        • Account Creation Kusto (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Create or delete windows shares using net exe Splunk (inferred path)
        • DarkGate - User Created Via Net.EXE Sigma (inferred path)
        • Discovery of a System Time Sigma (inferred path)
        • Enumeration of Administrator Accounts Elastic (inferred path)
        • Exploited CVE-2020-10189 Zoho ManageEngine Sigma (inferred path)
        • File or Folder Permissions Modifications Sigma (inferred path)
        • Local Accounts Discovery Chronicle (inferred path)
        • Local Accounts Discovery Sigma (inferred path)
        • Mounting Hidden or WebDav Remote Shares Elastic (inferred path)
        • Net.EXE Execution Sigma (inferred path)
        • New User Created Via Net.EXE Chronicle (inferred path)
        • New User Created Via Net.EXE Sigma (inferred path)
        • New User Created Via Net.EXE With Never Expire Option Sigma (inferred path)
        • Password Provided In Command Line Of Net.EXE Sigma (inferred path)
        • Potential Dridex Activity Sigma (inferred path)
        • Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group Sigma (inferred path)
        • Potential Ryuk Ransomware Activity Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Rorschach Ransomware Execution Activity Sigma (inferred path)
        • Share And Session Enumeration Using Net.EXE Sigma (inferred path)
        • SMB over QUIC Via Net.EXE Sigma (inferred path)
        • Start Windows Service Via Net.EXE Sigma (inferred path)
        • Stop Windows Service Via Net.EXE Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process Of Veeam Dabatase Sigma (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Group And Account Reconnaissance Activity Using Net.EXE Sigma (inferred path)
        • Suspicious Manipulation Of Default Accounts Via Net.EXE Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Suspicious Windows Service Tampering Sigma (inferred path)
        • System Network Connections Discovery Via Net.EXE Sigma (inferred path)
        • System Service Discovery through built-in Windows Utilities Elastic (inferred path)
        • System Time Discovery Elastic (inferred path)
        • Unmount Share Via Net.EXE Sigma (inferred path)
        • User Account Creation Elastic (inferred path)
        • User enumeration and creation related to Manic Menagerie 2.0 (via cmdline) Sigma (inferred path)
        • Windows Account or Group Discovery Elastic (inferred path)
        • Windows Admin Share Mount Via Net.EXE Sigma (inferred path)
        • Windows Attempt To Stop Security Service Splunk (inferred path)
        • Windows Cmdline Tool Execution From Non-Shell Process Splunk (inferred path)
        • Windows Create Local Administrator Account Via Net Splunk (inferred path)
        • Windows ESX Admins Group Creation via Net Splunk (inferred path)
        • Windows Excessive Service Stop Attempt Splunk (inferred path)
        • Windows Excessive Usage Of Net App Splunk (inferred path)
        • Windows Group Discovery Via Net Splunk (inferred path)
        • Windows Guest Account Enabled Via Net.EXE Splunk (inferred path)
        • Windows Internet Hosted WebDav Share Mount Via Net.EXE Sigma (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Net System Service Discovery Splunk (inferred path)
        • Windows Network Connection Discovery Via Net Splunk (inferred path)
        • Windows Network Enumeration Elastic (inferred path)
        • Windows Network Share Interaction Via Net Splunk (inferred path)
        • Windows OneDrive Share Mounted via Net Splunk (inferred path)
        • Windows Password Policy Discovery with Net Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Security Account Manager Stopped Splunk (inferred path)
        • Windows Sensitive Group Discovery With Net Splunk (inferred path)
        • Windows Service Stop Attempt Splunk (inferred path)
        • Windows Set Account Password Policy To Unlimited Via Net Splunk (inferred path)
        • Windows Share Mount Via Net.EXE Sigma (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows System Network Connections Discovery Elastic (inferred path)
        • Windows User Deletion Via Net Splunk (inferred path)
        • Windows User Disabled Via Net Splunk (inferred path)
        • Windows User Discovery Via Net Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
      • C:\Windows\System32\netapi32.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Load from a Truncated Stack Elastic (inferred path)
        • Library Loaded from a Spoofed Call Stack Elastic (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\netbtugc.exe#
      • C:\Windows\System32\netcfg.exe#
      • C:\Windows\System32\NetCfgNotifyObjectHost.exe#
      • C:\Windows\System32\NetEvtFwdr.exe#
      • C:\Windows\System32\NetHost.exe#
        • Windows Security Account Manager Stopped Splunk (inferred path)
      • C:\Windows\System32\netid.dll#
      • C:\Windows\System32\netiohlp.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\netiougc.exe#
        • Windows Security Account Manager Stopped Splunk (inferred path)
      • C:\Windows\System32\netjoin.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\netlogon.dll#
        • LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089 Sigma (inferred path)
      • C:\Windows\System32\netplwiz.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\Netplwiz.exe#
        • Windows Security Account Manager Stopped Splunk (inferred path)
      • C:\Windows\System32\netprofm.dll#
      • C:\Windows\System32\netprovfw.dll#
      • C:\Windows\System32\NetSetupApi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\netsh.exe#
        • Allow File And Printing Sharing In Firewall Splunk (inferred path)
        • Allow Network Discovery In Firewall Splunk (inferred path)
        • Disable Windows Firewall Rules via Netsh Elastic (inferred path)
        • Disabling Firewall with Netsh Splunk (inferred path)
        • Enable Host Network Discovery via Netsh Elastic (inferred path)
        • Firewall Configuration Discovery Via Netsh.EXE Sigma (inferred path)
        • Firewall Disabled via Netsh.EXE Sigma (inferred path)
        • Firewall Rule Deleted Via Netsh.EXE Sigma (inferred path)
        • Firewall Rule Update Via Netsh.EXE Sigma (inferred path)
        • Harvesting Of Wifi Credentials Via Netsh.EXE Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Netsh Allow Group Policy on Microsoft Defender Firewall Sigma (inferred path)
        • New Firewall Rule Added Via Netsh.EXE Sigma (inferred path)
        • New Network Trace Capture Started Via Netsh.EXE Sigma (inferred path)
        • New Port Forwarding Rule Added Via Netsh.EXE Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access Sigma (inferred path)
        • Potential Persistence Via Netsh Helper DLL Sigma (inferred path)
        • RDP Connection Allowed Via Netsh.EXE Sigma (inferred path)
        • RDP Port Forwarding Rule Added Via Netsh.EXE Sigma (inferred path)
        • Remote Desktop Enabled in Windows Firewall by Netsh Elastic (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Rorschach Ransomware Execution Activity Sigma (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Windows Delete or Modify System Firewall Splunk (inferred path)
        • Windows Firewall Exception List Modified via Untrusted Process Elastic (inferred path)
        • Windows Proxy Via Netsh Splunk (inferred path)
        • Windows Remote Services Allow Rdp In Firewall Splunk (inferred path)
        • Windows Security Account Manager Stopped Splunk (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows System Network Connections Discovery Netsh Splunk (inferred path)
        • Wireless Credential Dumping using Netsh Command Elastic (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\netshell.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\NETSTAT.EXE#
        • Network Connection Discovery With Netstat Splunk (inferred path)
        • Potential Process Injection Via Msra.EXE Sigma (inferred path)
        • Qakbot Discovery Activies Kusto (inferred path)
        • Suspicious Child Process Of SQL Server Sigma (inferred path)
        • Suspicious Child Process Of Veeam Dabatase Sigma (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Cmdline Tool Execution From Non-Shell Process Splunk (inferred path)
        • Windows Security Account Manager Stopped Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • Windows System Network Connections Discovery Elastic (inferred path)
      • C:\Windows\System32\nettrace.dll#
      • C:\Windows\System32\netutils.dll#
      • C:\Windows\System32\networkexplorer.dll#
      • C:\Windows\System32\newdev.dll#
      • C:\Windows\System32\ninput.dll#
      • C:\Windows\System32\nlaapi.dll#
      • C:\Windows\System32\nlansp_c.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\nltest.exe#
        • Domain Controller Discovery with Nltest Splunk (inferred path)
        • Enumerating Domain Trusts via NLTEST.EXE Elastic (inferred path)
        • NLTest Domain Trust Discovery Splunk (inferred path)
        • Nltest.EXE Execution Sigma (inferred path)
        • Potential Recon Activity Via Nltest.EXE Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process Of SQL Server Sigma (inferred path)
        • Suspicious Child Process Of Veeam Dabatase Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
      • C:\Windows\System32\notepad.exe#
        • Legitimate Application Dropped Archive Sigma (inferred path)
        • Network Connection Initiated Via Notepad.EXE Sigma (inferred path)
        • Notepad Password Files Discovery Sigma (inferred path)
        • Notepad with no Command Line Arguments Splunk (inferred path)
        • Potential Notepad Markdown RCE Exploitation Elastic (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Remote Thread Creation In Uncommon Target Image Sigma (inferred path)
        • Suspicious Child Process of AspNetCompiler Sigma (inferred path)
        • Suspicious Child Process Of BgInfo.EXE Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Cross-User Process Spawn Sigma (inferred path)
        • Suspicious Process Parents Sigma (inferred path)
        • Suspicious Provlaunch.EXE Child Process Sigma (inferred path)
        • Uncommon Process Access Rights For Target Image Sigma (inferred path)
        • Windows App Layer Protocol Qakbot NamedPipe Splunk (inferred path)
        • Windows Command Shell DCRat ForkBomb Payload Splunk (inferred path)
        • Windows Process Injection into Commonly Abused Processes Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
      • C:\Windows\System32\npmproxy.dll#
      • C:\Windows\System32\nshhttp.dll#
      • C:\Windows\System32\nshipsec.dll#
      • C:\Windows\System32\nshwfp.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\nslookup.exe#
        • DNS Exfiltration Using Nslookup App Splunk (inferred path)
        • Excessive Usage of NSLOOKUP App Splunk (inferred path)
        • Nslookup PowerShell Download Cradle - ProcessCreation Sigma (inferred path)
        • Potential DNS Tunneling via NsLookup Elastic (inferred path)
        • Potential Process Injection Via Msra.EXE Sigma (inferred path)
        • Qakbot Discovery Activies Kusto (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Cmdline Tool Execution From Non-Shell Process Splunk (inferred path)
        • Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows System Discovery Using ldap Nslookup Splunk (inferred path)
      • C:\Windows\System32\ntdll.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Load from a Truncated Stack Elastic (inferred path)
        • NTDLL library loaded for a second time Elastic (inferred path)
        • Parallel NTDLL Loaded from Unbacked Memory Elastic (inferred path)
        • Potential NTDLL Memory Unhooking Elastic (inferred path)
        • Shellcode Fluctuation via CallBack Elastic (inferred path)
        • Suspicious NTDLL Image Load Elastic (inferred path)
      • C:\Windows\System32\ntdsapi.dll#
      • C:\Windows\System32\ntlanman.dll#
      • C:\Windows\System32\NtlmShared.dll#
      • C:\Windows\System32\ntmarta.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\ntoskrnl.exe#
        • Suspicious Critical System Files Modification Elastic (inferred path)
        • Suspicious NtOSKrnl Image Load Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\ntshrui.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\oci.dll#
        • Creation Of Non-Existent System DLL Sigma (inferred path)
        • Potential DLL Sideloading Of Non-Existent DLLs From System Folders Sigma (inferred path)
        • Windows Phantom DLL Created on Disk Splunk (inferred path)
      • C:\Windows\System32\odbcconf.exe#
        • Amsi.DLL Loaded Via LOLBIN Process Sigma (inferred path)
        • Driver/DLL Installation Via Odbcconf.EXE Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • New DLL Registered Via Odbcconf.EXE Sigma (inferred path)
        • Odbcconf.EXE Suspicious DLL Location Sigma (inferred path)
        • Potentially Suspicious DLL Registered Via Odbcconf.EXE Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Response File Execution Via Odbcconf.EXE Sigma (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Driver/DLL Installation Via Odbcconf.EXE Sigma (inferred path)
        • Suspicious ImageLoad from an ISO Mounted Device Elastic (inferred path)
        • Suspicious ImageLoad via ODBC Driver Configuration Program Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Response File Execution Via Odbcconf.EXE Sigma (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Uncommon Child Process Spawned By Odbcconf.EXE Sigma (inferred path)
        • Unusual Process Network Connection Elastic (inferred path)
        • Windows Odbcconf Hunting Splunk (inferred path)
        • Windows Odbcconf Load DLL Splunk (inferred path)
        • Windows Odbcconf Load Response File Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\offdmpsvc.dll#
        • Creation Of Non-Existent System DLL Sigma (inferred path)
        • Potential DLL Sideloading Of Non-Existent DLLs From System Folders Sigma (inferred path)
        • Windows Phantom DLL Created on Disk Splunk (inferred path)
      • C:\Windows\System32\offreg.dll#
        • Potentially Suspicious Image Load of Offreg.dll Sigma (inferred path)
      • C:\Windows\System32\oleacc.dll#
      • C:\Windows\System32\omadmapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\OneDriveSetup.exe#
        • Windows App Layer Protocol Qakbot NamedPipe Splunk (inferred path)
        • Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
      • C:\Windows\System32\onex.dll#
      • C:\Windows\System32\OpcServices.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\OpenSSH#
        • Binary Proxy Execution via Windows OpenSSH Elastic (inferred branch)
        • Potential DLL Hijacking via Environment Paths Elastic (inferred branch)
        • Potential Privilege Escalation via Missing DLL Elastic (inferred branch)
        • Potential Protocol Tunneling via Legit Utilities Elastic (inferred branch)
        • C:\Windows\System32\OpenSSH\scp.exe#
          • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
          • Execution of a File Downloaded via Windows OpenSSH Elastic (inferred path)
          • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
          • WinRM Spawning a Process Splunk (inferred path)
        • C:\Windows\System32\OpenSSH\sftp.exe#
          • Binary Proxy Execution via Windows OpenSSH Elastic (inferred path)
          • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
          • Execution of a File Written by a Signed Binary Proxy Elastic (inferred path)
          • Execution of a Windows Script Downloaded via a LOLBIN Elastic (inferred path)
          • Indirect Command Execution via SFTP ProxyCommand Sigma (inferred path)
          • Ingress DLL Transfer followed by DLL SideLoading Elastic (inferred path)
          • Proxy Execution via Windows OpenSSH Elastic (inferred path)
          • Use Of The SFTP.EXE Binary As A LOLBIN Sigma (inferred path)
        • C:\Windows\System32\OpenSSH\ssh.exe#
          • Binary Proxy Execution via Windows OpenSSH Elastic (inferred path)
          • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
          • Execution of a File Downloaded via Windows OpenSSH Elastic (inferred path)
          • Port Forwarding Activity Via SSH.EXE Sigma (inferred path)
          • Potential RDP Tunneling Via SSH Sigma (inferred path)
          • Potential SSH Reverse Port Forwarding Elastic (inferred path)
          • Program Executed Using Proxy/Local Command Via SSH.EXE Sigma (inferred path)
          • Proxy Execution via Windows OpenSSH Elastic (inferred path)
          • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
          • Windows SSH Proxy Command Splunk (inferred path)
        • C:\Windows\System32\OpenSSH\sshd.exe#
          • Program Executed Using Proxy/Local Command Via SSH.EXE Sigma
      • C:\Windows\System32\OpenWith.exe#
        • OpenWith.exe Executes Specified Binary Sigma (inferred path)
      • C:\Windows\System32\osbaseln.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\osk.exe#
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\OskSupport.dll#
      • C:\Windows\System32\osuninst.dll#
      • C:\Windows\System32\p9np.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\PATHPING.EXE#
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
      • C:\Windows\System32\pcalua.exe#
        • Download Activity via a Headless Browser Elastic (inferred path)
        • Execution via Program Compatibility Assistant Elastic (inferred path)
        • Indirect Command Execution via Forfiles/Pcalua Elastic (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Potential File Download via a Headless Browser Elastic (inferred path)
        • Potential Remote Install via MsiExec Elastic (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Use of Pcalua For Execution Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\pcaui.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\pcwrun.exe#
        • Execute Pcwrun.EXE To Leverage Follina Sigma (inferred path)
        • Indirect Command Execution By Program Compatibility Wizard Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\pdh.dll#
      • C:\Windows\System32\PeerDistSh.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\PerceptionSimulation#
        • ImageLoad of a File dropped via SMB Elastic (inferred branch)
      • C:\Windows\System32\PING.EXE#
        • Delayed Execution via Ping Elastic (inferred path)
        • Obfuscated IP Via CLI Sigma (inferred path)
        • Ping Hex IP Sigma (inferred path)
        • Ping Sleep Batch Command Splunk (inferred path)
        • Qakbot Campaign Self Deletion Kusto (inferred path)
        • Qakbot Discovery Activies Kusto (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Remote Thread Creation In Uncommon Target Image Sigma (inferred path)
        • Suspicious Child Process Of SQL Server Sigma (inferred path)
        • Suspicious Child Process Of Veeam Dabatase Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious SYSTEM User Process Creation Sigma (inferred path)
        • Uncommon Process Access Rights For Target Image Sigma (inferred path)
        • Windows App Layer Protocol Qakbot NamedPipe Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Time Based Evasion Splunk (inferred path)
      • C:\Windows\System32\pkeyhelper.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\PkgMgr.exe#
        • UAC Bypass Using PkgMgr and DISM Sigma (inferred path)
        • Windows Bypass UAC via Pkgmgr Tool Splunk (inferred path)
        • Windows Handle Duplication in Known UAC-Bypass Binaries Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\PktMon.exe#
        • PktMon.EXE Execution Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
      • C:\Windows\System32\pla.dll#
      • C:\Windows\System32\PlaySndSrv.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\pnputil.exe#
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Driver Install by pnputil.exe Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\policymanager.dll#
      • C:\Windows\System32\polstore.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\powercfg.exe#
        • Suspicious Powercfg Execution To Change Lock Screen Timeout Sigma (inferred path)
      • C:\Windows\System32\powrprof.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\PresentationHost.exe#
        • Arbitrary File Download Via PresentationHost.EXE Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
        • XBAP Execution From Uncommon Locations Via PresentationHost.EXE Sigma (inferred path)
      • C:\Windows\System32\print.exe#
        • Abusing Print Executable Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Sensitive File Dump Via Print.EXE Sigma (inferred path)
      • C:\Windows\System32\PrintIsolationProxy.dll#
      • C:\Windows\System32\printui.dll#
      • C:\Windows\System32\prntvpt.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\profapi.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\propsys.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\provlaunch.exe#
        • Potential Provlaunch.EXE Binary Proxy Execution Abuse Sigma (inferred path)
        • Suspicious Provlaunch.EXE Child Process Sigma (inferred path)
      • C:\Windows\System32\provtool.exe#
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
      • C:\Windows\System32\ProximityCommon.dll#
      • C:\Windows\System32\ProximityServicePal.dll#
      • C:\Windows\System32\prvdmofcomp.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\psapi.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • Library Loaded from a Spoofed Call Stack Elastic (inferred path)
        • Module Stomping from a Copied Library Elastic (inferred path)
      • C:\Windows\System32\psr.exe#
        • Rename System Utilities Kusto (inferred path)
        • Screen Capture Activity Via Psr.EXE Sigma (inferred path)
      • C:\Windows\System32\puiapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\qprocess.exe#
        • Process Discovery Using Built-in Tools Elastic (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
      • C:\Windows\System32\query.exe#
        • Exploited CVE-2020-10189 Zoho ManageEngine Sigma (inferred path)
        • Process Discovery Using Built-in Tools Elastic (inferred path)
        • Query Usage To Exfil Data Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • System User Discovery With Query Splunk (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows System Remote Discovery With Query Splunk (inferred path)
      • C:\Windows\System32\quser.exe#
        • Local Accounts Discovery Chronicle (inferred path)
        • Local Accounts Discovery Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Account or Group Discovery Elastic (inferred path)
        • Windows System User Discovery Via Quser Splunk (inferred path)
      • C:\Windows\System32\qwinsta.exe#
        • Local Accounts Discovery Chronicle (inferred path)
        • Local Accounts Discovery Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Windows Account or Group Discovery Elastic (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows System Discovery Using Qwinsta Splunk (inferred path)
      • C:\Windows\System32\RADCUI.dll#
      • C:\Windows\System32\rasapi32.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\rasautou.exe#
        • DLL Execution via Rasautou.exe Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Windows Rasautou DLL Execution Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\rasdial.exe#
        • Suspicious RASdial Activity Sigma (inferred path)
      • C:\Windows\System32\rasdlg.dll#
      • C:\Windows\System32\rasgcw.dll#
      • C:\Windows\System32\rasman.dll#
      • C:\Windows\System32\rasmontr.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\rdpclip.exe#
        • Windows App Layer Protocol Qakbot NamedPipe Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
      • C:\Windows\System32\rdpendp.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\rdpinit.exe#
        • Potential APT FIN7 Exploitation Activity Sigma (inferred path)
      • C:\Windows\System32\RdpSaProxy.exe#
      • C:\Windows\System32\RdpSaUacHelper.exe#
        • Potential Remote Desktop Shadowing Activity Elastic (inferred path)
      • C:\Windows\System32\rdrleakdiag.exe#
        • Potential Credential Access via Windows Utilities Elastic (inferred path)
        • Process Memory Dump via RdrLeakDiag.exe Chronicle (inferred path)
        • Process Memory Dump via RdrLeakDiag.EXE Sigma (inferred path)
      • C:\Windows\System32\ReAgent.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\ReAgentc.exe#
        • Windows Recovery Environment Disabled Via Reagentc Sigma (inferred path)
      • C:\Windows\System32\recdisc.exe#
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\Recovery#
        • Windows File Without Extension In Critical Folder Splunk (inferred branch)
      • C:\Windows\System32\reg.exe#
        • Add SafeBoot Keys Via Reg Utility Sigma (inferred path)
        • Changing Existing Service ImagePath Value Via Reg.EXE Sigma (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Control Panel Items Sigma (inferred path)
        • Credential Acquisition via Registry Hive Dumping Elastic (inferred path)
        • Detected Windows Software Discovery Sigma (inferred path)
        • Direct Autorun Keys Modification Chronicle (inferred path)
        • Direct Autorun Keys Modification Sigma (inferred path)
        • Disabling Windows Defender WMI Autologger Session via Reg.exe Sigma (inferred path)
        • Dumping of Sensitive Hives Via Reg.EXE Sigma (inferred path)
        • Enumeration for Credentials in Registry Sigma (inferred path)
        • Exploited CVE-2020-10189 Zoho ManageEngine Sigma (inferred path)
        • File or Directory Deletion Command Elastic (inferred path)
        • Hiding User Account Via SpecialAccounts Registry Key - CommandLine Sigma (inferred path)
        • Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine Sigma (inferred path)
        • Kapeka Backdoor Persistence Activity Sigma (inferred path)
        • LaZagne Credential Theft Kusto (inferred path)
        • LSA PPL Protection Setting Modification via CommandLine Sigma (inferred path)
        • MMC Spawning Windows Shell Sigma (inferred path)
        • Modify Group Policy Settings Sigma (inferred path)
        • Potential Configuration And Service Reconnaissance Via Reg.EXE Sigma (inferred path)
        • Potential PendingFileRenameOperations Tampering Sigma (inferred path)
        • Potential Persistence Attempt Via Run Keys Using Reg.EXE Sigma (inferred path)
        • Potential Suspicious Registry File Imported Via Reg.EXE Sigma (inferred path)
        • Potential Tampering With RDP Related Registry Keys Via Reg.EXE Chronicle (inferred path)
        • Potential Tampering With RDP Related Registry Keys Via Reg.EXE Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Potentially Suspicious Desktop Background Change Using Reg.EXE Sigma (inferred path)
        • Reg Add Suspicious Paths Chronicle (inferred path)
        • Reg Add Suspicious Paths Sigma (inferred path)
        • Reg exe Manipulating Windows Services Registry Keys Splunk (inferred path)
        • Registry Export of Third-Party Credentials Sigma (inferred path)
        • Registry Modification of MS-settings Protocol Handler Sigma (inferred path)
        • Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • RunMRU Registry Key Deletion Sigma (inferred path)
        • SafeBoot Registry Key Deleted Via Reg.EXE Sigma (inferred path)
        • Security Event Logging Disabled via MiniNt Registry Key - Process Sigma (inferred path)
        • Service Registry Key Deleted Via Reg.EXE Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Execution via Microsoft Exchange Transport Agent Elastic (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious MSHTA Child Process Sigma (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Query of MachineGUID Sigma (inferred path)
        • Suspicious ScreenSave Change by Reg.exe Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE Sigma (inferred path)
        • Suspicious Windows Defender Registry Key Tampering Via Reg.EXE Sigma (inferred path)
        • System Information Discovery via Registry Queries Sigma (inferred path)
        • System Language Discovery via Reg.Exe Sigma (inferred path)
        • System Restore Registry Modification via CommandLine Sigma (inferred path)
        • System Utility Execution from Unbacked Memory Elastic (inferred path)
        • User Shell Folders Registry Modification via CommandLine Sigma (inferred path)
        • Vulnerable Driver Blocklist Registry Tampering Via CommandLine Sigma (inferred path)
        • Windows AMSI Related Registry Tampering Via CommandLine Sigma (inferred path)
        • Windows Cached Domain Credentials Reg Query Splunk (inferred path)
        • Windows Change File Association Command To Notepad Splunk (inferred path)
        • Windows COM Hijacking InprocServer32 Modification Splunk (inferred path)
        • Windows Credential Guard Registry Tampering Via CommandLine Sigma (inferred path)
        • Windows Credentials in Registry Reg Query Splunk (inferred path)
        • Windows Defender Context Menu Removed Sigma (inferred path)
        • Windows Defender Exclusions by Extension Elastic (inferred path)
        • Windows EventLog Autologger Session Registry Modification Via CommandLine Sigma (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Recall Feature Enabled Via Reg.EXE Sigma (inferred path)
        • Windows Registry Entries Exported Via Reg Splunk (inferred path)
        • Windows Registry Entries Restored Via Reg Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Security Support Provider Reg Query Splunk (inferred path)
        • Windows Sensitive Registry Hive Dump Via CommandLine Splunk (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
      • C:\Windows\System32\regapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\regini.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Regini.exe Execution (Sysmon) Splunk (inferred path)
        • Regini.exe Execution (Windows Event Log) Splunk (inferred path)
        • Registry Modification Via Regini.EXE Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Suspicious Registry Modification From ADS Via Regini.EXE Sigma (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
      • C:\Windows\System32\Register-CimProvider.exe#
        • DLL Execution Via Register-cimprovider.exe Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\regsvr32.exe#
        • Attempt to Disable Windows Defender Services Elastic (inferred path)
        • Backup Files Deleted Sigma (inferred path)
        • Bad Opsec Defaults Sacrificial Processes With Improper Arguments Sigma (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • Creation or Modification of Root Certificate Elastic (inferred path)
        • Detect Regsvr32 Application Control Bypass Splunk (inferred path)
        • DNS Query Request By Regsvr32.EXE Sigma (inferred path)
        • DotNet CLR DLL Loaded By Scripting Applications Sigma (inferred path)
        • Execution of a File Downloaded via Windows OpenSSH Elastic (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • LOLBIN Execution From Abnormal Drive Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • MMC Spawning Windows Shell Sigma (inferred path)
        • Mshta spawning Rundll32 OR Regsvr32 Process Splunk (inferred path)
        • Network Connection Initiated By Regsvr32.EXE Sigma (inferred path)
        • Network Connection via Registration Utility Elastic (inferred path)
        • NTDS.DIT Creation By Uncommon Process Sigma (inferred path)
        • Office Macro File Creation From Suspicious Process Sigma (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Pikabot Fake DLL Extension Execution Via Rundll32.EXE Sigma (inferred path)
        • Potential Command and Control via Internet Explorer Elastic (inferred path)
        • Potential CVE-2023-21554 QueueJumper Exploitation Sigma (inferred path)
        • Potential Dridex Activity Sigma (inferred path)
        • Potential Notepad++ CVE-2025-49144 Exploitation Sigma (inferred path)
        • Potential PowerShell Execution Via DLL Sigma (inferred path)
        • Potential Recon Activity Using DriverQuery.EXE Sigma (inferred path)
        • Potential Regsvr32 Commandline Flag Anomaly Sigma (inferred path)
        • Potential Suspicious Child Process Of 3CXDesktopApp Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of DiskShadow.EXE Sigma (inferred path)
        • Potentially Suspicious Child Process of KeyScrambler.exe Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Potentially Suspicious Child Process Of VsCode Sigma (inferred path)
        • Potentially Suspicious Child Process Of WinRAR.EXE Sigma (inferred path)
        • Potentially Suspicious Child Processes Spawned by ConHost Sigma (inferred path)
        • Potentially Suspicious Execution From Parent Process In Public Folder Sigma (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Potentially Suspicious Regsvr32 HTTP IP Pattern Sigma (inferred path)
        • Potentially Suspicious Regsvr32 HTTP/FTP Pattern Sigma (inferred path)
        • Potentially Suspicious Windows App Activity Sigma (inferred path)
        • Protected Process from Unusual Parent Elastic (inferred path)
        • Qakbot Regsvr32 Calc Pattern Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Raspberry Robin Subsequent Execution of Commands Sigma (inferred path)
        • Regsvr32 DLL Execution With Suspicious File Extension Sigma (inferred path)
        • Regsvr32 DLL Execution With Uncommon Extension Sigma (inferred path)
        • Regsvr32 Execution From Highly Suspicious Location Sigma (inferred path)
        • Regsvr32 Execution From Potential Suspicious Location Sigma (inferred path)
        • Regsvr32 Scriptlet Execution Elastic (inferred path)
        • Regsvr32 Silent and Install Param Dll Loading Splunk (inferred path)
        • Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly Sigma (inferred path)
        • Remote Thread Creation Via PowerShell In Uncommon Target Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • RunDLL32/Regsvr32 Loads a DLL Downloaded via BITS Elastic (inferred path)
        • Script Event Consumer Spawning Process Sigma (inferred path)
        • Scripting/CommandLine Process Spawned Regsvr32 Sigma (inferred path)
        • Sdiagnhost Calling Suspicious Child Process Sigma (inferred path)
        • Service Control Spawned via Script Interpreter Elastic (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Startup Persistence by a Suspicious Process Elastic (inferred path)
        • Sticky Key Like Backdoor Execution Sigma (inferred path)
        • Suspicious .NET Code Compilation Elastic (inferred path)
        • Suspicious ArcSOC.exe Child Process Sigma (inferred path)
        • Suspicious BitLocker Access Agent Update Utility Execution Sigma (inferred path)
        • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process of SAP NetWeaver Sigma (inferred path)
        • Suspicious Child Process Of SQL Server Sigma (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Chromium Browser Instance Executed With Custom Extension Sigma (inferred path)
        • Suspicious DNS Lookup for Microsoft Defender Definition Updates Elastic (inferred path)
        • Suspicious Electron Application Child Processes Sigma (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution via Compiled HTML File Elastic (inferred path)
        • Suspicious Explorer Child Process Elastic (inferred path)
        • Suspicious File Rename by an Unusual Process Elastic (inferred path)
        • Suspicious ImageLoad from an ISO Mounted Device Elastic (inferred path)
        • Suspicious Microsoft Diagnostics Wizard Execution Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious MSDT Parent Process Sigma (inferred path)
        • Suspicious MSHTA Child Process Sigma (inferred path)
        • Suspicious Mshta.EXE Execution Patterns Sigma (inferred path)
        • Suspicious Network Connection Binary No CommandLine Sigma (inferred path)
        • Suspicious NTDLL Image Load Elastic (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious PowerShell Console History Deletion Elastic (inferred path)
        • Suspicious PowerShell Parent Process Sigma (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Provlaunch.EXE Child Process Sigma (inferred path)
        • Suspicious Regsvr32 Execution From Remote Share Sigma (inferred path)
        • Suspicious Regsvr32 Register Suspicious Path Splunk (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious WindowsTerminal Child Processes Sigma (inferred path)
        • Suspicious WmiPrvSE Child Process Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Unsigned DLL Loaded by Windows Utility Sigma (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • VMToolsd Suspicious Child Process Sigma (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows Defender Exclusions by Extension Elastic (inferred path)
        • Windows IOBit Unlocker Extension DLL Registration via Regsvr32 Splunk (inferred path)
        • Windows Masquerading Explorer As Child Process Splunk (inferred path)
        • Windows Office Product Spawned Uncommon Process Splunk (inferred path)
        • Windows Process Injection into Commonly Abused Processes Splunk (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wscript Or Cscript Suspicious Child Process Splunk (inferred path)
        • WSL Child Process Anomaly Sigma (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\replace.exe#
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Replace.exe Usage Sigma (inferred path)
      • C:\Windows\System32\ResetEngine.dll#
      • C:\Windows\System32\resutils.dll#
      • C:\Windows\System32\rmclient.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\Robocopy.exe#
        • Copy From Or To Admin Share Or Sysvol Folder Chronicle (inferred path)
        • Copy From Or To Admin Share Or Sysvol Folder Sigma (inferred path)
        • LOL-Binary Copied From System Directory Sigma (inferred path)
        • Potential Browser Data Stealing Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Suspicious Copy From or To System Directory Sigma (inferred path)
      • C:\Windows\System32\ROUTE.EXE#
        • Network Discovery Using Route Windows App Splunk (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access Sigma (inferred path)
        • Potential Process Injection Via Msra.EXE Sigma (inferred path)
        • Windows Cmdline Tool Execution From Non-Shell Process Splunk (inferred path)
      • C:\Windows\System32\rpchttp.dll#
      • C:\Windows\System32\rpcnsh.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\RpcPing.exe#
        • Capture Credentials with Rpcping.exe Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
      • C:\Windows\System32\rsaenh.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\RstrtMgr.dll#
        • Load Of RstrtMgr.DLL By A Suspicious Process Sigma (inferred path)
        • Load Of RstrtMgr.DLL By An Uncommon Process Sigma (inferred path)
      • C:\Windows\System32\rstrui.exe#
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\rtutils.dll#
      • C:\Windows\System32\RTWorkQ.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\runas.exe#
        • Access Token Manipulation - Create Process with Token Kusto (inferred path)
        • Runas Execution in CommandLine Splunk (inferred path)
      • C:\Windows\System32\rundll32.exe#
        • Amsi.DLL Loaded Via LOLBIN Process Sigma (inferred path)
        • Anomalous usage of 7zip Splunk (inferred path)
        • Attempt to Disable Windows Defender Services Elastic (inferred path)
        • Backup Files Deleted Sigma (inferred path)
        • Bad Opsec Defaults Sacrificial Processes With Improper Arguments Sigma (inferred path)
        • Cloud Instance Metadata Credential Path HTTP Request Elastic (inferred path)
        • CobaltStrike Load by Rundll32 Sigma (inferred path)
        • Code Execution via Pcwutl.dll Sigma (inferred path)
        • COLDSTEEL RAT Cleanup Command Execution Sigma (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Command Shell Activity Started via RunDLL32 Elastic (inferred path)
        • Command Shell Activity Started via RunDLL32 Elastic (inferred path)
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • Creation or Modification of Root Certificate Elastic (inferred path)
        • Cscript/Wscript Potentially Suspicious Child Process Sigma (inferred path)
        • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
        • Detect Rundll32 Inline HTA Execution Splunk (inferred path)
        • DLL Call by Ordinal Via Rundll32.EXE Sigma (inferred path)
        • Download Activity via a Headless Browser Elastic (inferred path)
        • Dump LSASS via comsvcs DLL Splunk (inferred path)
        • Execution of a File Downloaded via Windows OpenSSH Elastic (inferred path)
        • Execution via Microsoft DotNet ClickOnce Host Elastic (inferred path)
        • Execution via MsiExec DownloadAndExecute CustomAction Elastic (inferred path)
        • Execution via OpenClaw Agent Elastic (inferred path)
        • File or Directory Deletion Command Elastic (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • HackTool - RedMimicry Winnti Playbook Execution Sigma (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32 Sigma (inferred path)
        • Injected Browser Process Spawning Rundll32 - GuLoader Activity Sigma (inferred path)
        • Kapeka Backdoor Execution Via RunDLL32.EXE Sigma (inferred path)
        • Kapeka Backdoor Loaded Via Rundll32.EXE Sigma (inferred path)
        • LOLBIN Execution From Abnormal Drive Sigma (inferred path)
        • LSASS credential dump with LSASSY (process) Sigma (inferred path)
        • Lsass Memory Dump via Comsvcs DLL Chronicle (inferred path)
        • Lsass Memory Dump via Comsvcs DLL Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Mshta spawning Rundll32 OR Regsvr32 Process Splunk (inferred path)
        • NotPetya Ransomware Activity Sigma (inferred path)
        • NTDS.DIT Creation By Uncommon Process Sigma (inferred path)
        • Office Macro File Creation From Suspicious Process Sigma (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Pikabot Fake DLL Extension Execution Via Rundll32.EXE Sigma (inferred path)
        • Potential Bumblebee Remote Thread Creation Sigma (inferred path)
        • Potential Command and Control via Internet Explorer Elastic (inferred path)
        • Potential Credential Access via Renamed COM+ Services DLL Elastic (inferred path)
        • Potential Credential Access via Windows Utilities Elastic (inferred path)
        • Potential CVE-2023-21554 QueueJumper Exploitation Sigma (inferred path)
        • Potential Emotet Rundll32 Execution Sigma (inferred path)
        • Potential File Download via a Headless Browser Elastic (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
        • Potential Local NTLM Relay via HTTP Elastic (inferred path)
        • Potential Obfuscated Ordinal Call Via Rundll32 Sigma (inferred path)
        • Potential Pikabot C2 Activity Sigma (inferred path)
        • Potential Pikabot Discovery Activity Sigma (inferred path)
        • Potential Pikabot Hollowing Activity Sigma (inferred path)
        • Potential PowerShell Execution Via DLL Sigma (inferred path)
        • Potential Protocol Tunneling via Yuze Elastic (inferred path)
        • Potential Qakbot Rundll32 Execution Sigma (inferred path)
        • Potential Raspberry Robin CPL Execution Activity Sigma (inferred path)
        • Potential Recon Activity Using DriverQuery.EXE Sigma (inferred path)
        • Potential Rundll32 Execution With DLL Stored In ADS Sigma (inferred path)
        • Potential SAP NetWeaver Exploitation Elastic (inferred path)
        • Potential ShellDispatch.DLL Functionality Abuse Sigma (inferred path)
        • Potential Suspicious Child Process Of 3CXDesktopApp Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of DiskShadow.EXE Sigma (inferred path)
        • Potentially Suspicious Child Process of KeyScrambler.exe Sigma (inferred path)
        • Potentially Suspicious Child Process Of VsCode Sigma (inferred path)
        • Potentially Suspicious Child Process Of WinRAR.EXE Sigma (inferred path)
        • Potentially Suspicious Execution From Parent Process In Public Folder Sigma (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Potentially Suspicious Rundll32.EXE Execution of UDL File Sigma (inferred path)
        • Potentially Suspicious Windows App Activity Sigma (inferred path)
        • Privilege Escalation via NTLMRelay2Self Elastic (inferred path)
        • Process Memory Dump Via Comsvcs.DLL Chronicle (inferred path)
        • Process Memory Dump Via Comsvcs.DLL Sigma (inferred path)
        • Protected Process from Unusual Parent Elastic (inferred path)
        • Qakbot Rundll32 Exports Execution Sigma (inferred path)
        • Qakbot Rundll32 Fake DLL Extension Execution Sigma (inferred path)
        • Rare Connection to WebDAV Target Elastic (inferred path)
        • Raspberry Robin Subsequent Execution of Commands Sigma (inferred path)
        • Remote Access Tool - Ammy Admin Agent Execution Sigma (inferred path)
        • Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution Sigma (inferred path)
        • Remote DLL Load Via Rundll32.EXE Sigma (inferred path)
        • Remote Thread Creation Via PowerShell In Uncommon Target Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Rhadamanthys Stealer Module Launch Via Rundll32.EXE Sigma (inferred path)
        • RunDLL Loading DLL By Ordinal Splunk (inferred path)
        • Rundll32 Control RunDLL Hunt Splunk (inferred path)
        • Rundll32 Control RunDLL World Writable Directory Splunk (inferred path)
        • Rundll32 Create Remote Thread To A Process Splunk (inferred path)
        • Rundll32 Execution With Uncommon DLL Extension Sigma (inferred path)
        • Rundll32 InstallScreenSaver Execution Sigma (inferred path)
        • Rundll32 Internet Connection Sigma (inferred path)
        • Rundll32 LockWorkStation Splunk (inferred path)
        • Rundll32 Process Creating Exe Dll Files Splunk (inferred path)
        • Rundll32 Registered COM Objects Sigma (inferred path)
        • Rundll32 Shimcache Flush Splunk (inferred path)
        • Rundll32 Spawned Via Explorer.EXE Sigma (inferred path)
        • RunDLL32 Spawning Explorer Sigma (inferred path)
        • Rundll32 UNC Path Execution Sigma (inferred path)
        • Rundll32 with no Command Line Arguments with Network Splunk (inferred path)
        • Rundll32.EXE Calling DllRegisterServer Export Function Explicitly Sigma (inferred path)
        • RunDLL32/Regsvr32 Loads a DLL Downloaded via BITS Elastic (inferred path)
        • ScreenSaver Registry Key Set Sigma (inferred path)
        • Script Event Consumer Spawning Process Sigma (inferred path)
        • Script Execution via Microsoft HTML Application Elastic (inferred path)
        • Sdiagnhost Calling Suspicious Child Process Sigma (inferred path)
        • Service Control Spawned via Script Interpreter Elastic (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Shell32 DLL Execution in Suspicious Directory Sigma (inferred path)
        • Sofacy Trojan Loader Activity Sigma (inferred path)
        • Spoolsv Spawning Rundll32 Splunk (inferred path)
        • Spoolsv Suspicious Process Access Splunk (inferred path)
        • Startup Persistence by a Suspicious Process Elastic (inferred path)
        • Sticky Key Like Backdoor Execution Sigma (inferred path)
        • Suspicious .NET Code Compilation Elastic (inferred path)
        • Suspicious Advpack Call Via Rundll32.EXE Sigma (inferred path)
        • Suspicious ArcSOC.exe Child Process Sigma (inferred path)
        • Suspicious BitLocker Access Agent Update Utility Execution Sigma (inferred path)
        • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process of SAP NetWeaver Sigma (inferred path)
        • Suspicious Child Process Of SQL Server Sigma (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Chromium Browser Instance Executed With Custom Extension Sigma (inferred path)
        • Suspicious Control Panel DLL Load Sigma (inferred path)
        • Suspicious DNS Lookup for Microsoft Defender Definition Updates Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution via Compiled HTML File Elastic (inferred path)
        • Suspicious Execution via Microsoft Exchange Transport Agent Elastic (inferred path)
        • Suspicious Explorer Child Process Elastic (inferred path)
        • Suspicious File Rename by an Unusual Process Elastic (inferred path)
        • Suspicious IcedID Rundll32 Cmdline Splunk (inferred path)
        • Suspicious ImageLoad from an ISO Mounted Device Elastic (inferred path)
        • Suspicious Key Manager Access Sigma (inferred path)
        • Suspicious Microsoft Diagnostics Wizard Execution Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MSDT Parent Process Sigma (inferred path)
        • Suspicious Mshta.EXE Execution Patterns Sigma (inferred path)
        • Suspicious Network Connection Binary No CommandLine Sigma (inferred path)
        • Suspicious NTDLL Image Load Elastic (inferred path)
        • Suspicious NTLM Authentication on the Printer Spooler Service Sigma (inferred path)
        • Suspicious PowerShell Console History Deletion Elastic (inferred path)
        • Suspicious PowerShell Parent Process Sigma (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Provlaunch.EXE Child Process Sigma (inferred path)
        • Suspicious Renamed Comsvcs DLL Loaded By Rundll32 Sigma (inferred path)
        • Suspicious Rundll32 dllregisterserver Splunk (inferred path)
        • Suspicious Rundll32 Execution With Image Extension Sigma (inferred path)
        • Suspicious Rundll32 no Command Line Arguments Splunk (inferred path)
        • Suspicious Rundll32 PluginInit Splunk (inferred path)
        • Suspicious Rundll32 Setupapi.dll Activity Sigma (inferred path)
        • Suspicious Rundll32 StartW Splunk (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious SolarWinds Web Help Desk Java Module Load or Child Process Elastic (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Suspicious WebDav Client Execution Via Rundll32.EXE Sigma (inferred path)
        • Suspicious WindowsTerminal Child Processes Sigma (inferred path)
        • Suspicious WmiPrvSE Child Process Sigma (inferred path)
        • Suspicious Workstation Locking via Rundll32 Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Trickbot Malware Activity Sigma (inferred path)
        • UNC2452 Process Creation Patterns Sigma (inferred path)
        • Unsigned DLL loaded by Rundll32 via COM Elastic (inferred path)
        • Unsigned DLL Loaded by Windows Utility Sigma (inferred path)
        • Unusual Child Processes of RunDLL32 Elastic (inferred path)
        • Unusual Network Connection via RunDLL32 Elastic (inferred path)
        • Unusual Network Connection via RunDLL32 Elastic (inferred path)
        • User Account Control Disabled via Registry Elastic (inferred path)
        • VMToolsd Suspicious Child Process Sigma (inferred path)
        • WebDav Client Execution Via Rundll32.EXE Sigma (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows Application Whitelisting Bypass Attempt via Rundll32 Splunk (inferred path)
        • Windows Binaries Write Suspicious Extensions Sigma (inferred path)
        • Windows Defender Exclusions by Extension Elastic (inferred path)
        • Windows Office Product Spawned Rundll32 With No DLL Splunk (inferred path)
        • Windows Office Product Spawned Uncommon Process Splunk (inferred path)
        • Windows PowGoop Beacon Decoding Splunk (inferred path)
        • Windows Rundll32 Apply User Settings Changes Splunk (inferred path)
        • Windows Rundll32 Execution With Log.DLL Splunk (inferred path)
        • Windows Rundll32 Load DLL in Temp Dir Splunk (inferred path)
        • Windows Rundll32 WebDAV Request Splunk (inferred path)
        • Windows Rundll32 WebDav With Network Connection Splunk (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Server Update Service Spawning Suspicious Processes Elastic (inferred path)
        • Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process of TieringEngineService.exe Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • Windows Uncommon Remote Thread Creation In Browser Process Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wscript Or Cscript Suspicious Child Process Splunk (inferred path)
        • WSL Child Process Anomaly Sigma (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
        • ZxShell Malware Sigma (inferred path)
      • C:\Windows\System32\runexehelper.exe#
        • Binary Proxy Execution via Runexehelper Elastic (inferred path)
        • Lolbin Runexehelper Use As Proxy Sigma (inferred path)
      • C:\Windows\System32\runonce.exe#
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Potential CobaltStrike Process Patterns Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Run Once Task Execution as Configured in Registry Sigma (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Rundll32 Setupapi.dll Activity Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\RuntimeBroker.exe#
        • .RDP File Created By Uncommon Application Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Office Macro File Download Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Windows Binaries Write Suspicious Extensions Sigma (inferred path)
      • C:\Windows\System32\samcli.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Windows Gather Victim Identity SAM Info Splunk (inferred path)
      • C:\Windows\System32\samlib.dll#
        • Potential Credential Access via Trusted Developer Utility Elastic (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Windows Gather Victim Identity SAM Info Splunk (inferred path)
        • Windows InstallUtil Credential Theft Splunk (inferred path)
      • C:\Windows\System32\sas.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\sc.exe#
        • Allow Service Access Using Security Descriptor Tampering Via Sc.EXE Sigma (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
        • Deny Service Access Using Security Descriptor Tampering Via Sc.EXE Sigma (inferred path)
        • Disable Windows Defender AV Security Monitoring Sigma (inferred path)
        • EAP service activation by Liontail framework for DLL sideloading (via command) Sigma (inferred path)
        • Excessive Attempt To Disable Services Splunk (inferred path)
        • Excessive number of service control start as disabled Splunk (inferred path)
        • Excessive Usage Of SC Service Utility Splunk (inferred path)
        • Interesting Service Enumeration Via Sc.EXE Sigma (inferred path)
        • New Kernel Driver Via SC.EXE Sigma (inferred path)
        • New Service Creation Using Sc.EXE Sigma (inferred path)
        • Possible impact of 'SMOKEDHAM backdoor' with MSDTC service privilege escalation via command line Sigma (inferred path)
        • Possible Privilege Escalation via Weak Service Permissions Sigma (inferred path)
        • Privilege Escalation via Named Pipe Impersonation Elastic (inferred path)
        • Recon Information for Export with Command Prompt Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • SC.EXE Query Execution Sigma (inferred path)
        • Service Command Lateral Movement Elastic (inferred path)
        • Service Control Spawned via Script Interpreter Elastic (inferred path)
        • Service DACL Abuse To Hide Services Via Sc.EXE Sigma (inferred path)
        • Service DACL Modification via sc.exe Elastic (inferred path)
        • Service Path Modification via sc.exe Elastic (inferred path)
        • Service Security Descriptor Tampering Via Sc.EXE Sigma (inferred path)
        • Service StartupType Change Via Sc.EXE Sigma (inferred path)
        • Stop Windows Service Via Sc.EXE Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious New Service Creation Sigma (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Service Path Modification Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Suspicious Windows Service Tampering Sigma (inferred path)
        • System Service Discovery through built-in Windows Utilities Elastic (inferred path)
        • System Utility Execution from Unbacked Memory Elastic (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows Attempt To Stop Security Service Splunk (inferred path)
        • Windows Excessive Service Stop Attempt Splunk (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows New Deny Permission Set On Service SD Via Sc.EXE Splunk (inferred path)
        • Windows New Service Security Descriptor Set Via Sc.EXE Splunk (inferred path)
        • Windows Remote Create Service Splunk (inferred path)
        • Windows ScManager Security Descriptor Tampering Via Sc.EXE Splunk (inferred path)
        • Windows Service Create Kernel Mode Driver Splunk (inferred path)
        • Windows Service Create with Tscon Splunk (inferred path)
        • Windows Service Creation on Remote Endpoint Splunk (inferred path)
        • Windows Service Initiation on Remote Endpoint Splunk (inferred path)
        • Windows Service Stop Attempt Splunk (inferred path)
        • Windows Service Stop By Deletion Splunk (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
      • C:\Windows\System32\scansetting.dll#
      • C:\Windows\System32\scecli.dll#
      • C:\Windows\System32\schedcli.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\schtasks.exe#
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Defrag Deactivation Sigma (inferred path)
        • Delete All Scheduled Tasks Sigma (inferred path)
        • Delete Important Scheduled Task Sigma (inferred path)
        • Disable Important Scheduled Task Sigma (inferred path)
        • Disable Schedule Task Splunk (inferred path)
        • Execution via stordiag.exe Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Forest Blizzard APT - Process Creation Activity Sigma (inferred path)
        • HackTool - Default PowerSploit/Empire Scheduled Task Creation Sigma (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • Kapeka Backdoor Persistence Activity Sigma (inferred path)
        • Local Scheduled Task Creation Elastic (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Potential BearLPE Exploitation Sigma (inferred path)
        • Potential CVE-2023-21554 QueueJumper Exploitation Sigma (inferred path)
        • Potential Devil Bait Related Indicator Sigma (inferred path)
        • Potential KamiKakaBot Activity - Shutdown Schedule Task Creation Sigma (inferred path)
        • Potential Persistence Via Microsoft Compatibility Appraiser Sigma (inferred path)
        • Potential Process Injection Via Msra.EXE Sigma (inferred path)
        • Potential SSH Tunnel Persistence Install Using A Scheduled Task Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Privilege Escalation via Named Pipe Impersonation Elastic (inferred path)
        • Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE Sigma (inferred path)
        • Scheduled Task Creation From Potential Suspicious Parent Location Sigma (inferred path)
        • Scheduled Task Creation from Suspicious Parent Elastic (inferred path)
        • Scheduled Task Creation Masquerading as System Processes Sigma (inferred path)
        • Scheduled Task Creation Via Schtasks.EXE Sigma (inferred path)
        • Scheduled Task Creation via Unsigned Parent Elastic (inferred path)
        • Scheduled Task Creation with Curl and PowerShell Execution Combo Sigma (inferred path)
        • Scheduled Task Deleted Or Created via CMD Splunk (inferred path)
        • Scheduled Task Executing Encoded Payload from Registry Sigma (inferred path)
        • Scheduled Task Executing Payload from Registry Sigma (inferred path)
        • Scheduled Task Initiation on Remote Endpoint Splunk (inferred path)
        • Schtasks Creation Or Modification With SYSTEM Privileges Sigma (inferred path)
        • Schtasks From Suspicious Folders Sigma (inferred path)
        • Schtasks Run Task On Demand Splunk (inferred path)
        • Schtasks scheduling job on remote system Splunk (inferred path)
        • Schtasks used for forcing a reboot Splunk (inferred path)
        • Script Event Consumer Spawning Process Sigma (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious BitLocker Access Agent Update Utility Execution Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Command Patterns In Scheduled Task Creation Sigma (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution via Compiled HTML File Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious Modification Of Scheduled Tasks Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious MSDT Parent Process Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Processes Spawned by WinRM Sigma (inferred path)
        • Suspicious Scheduled Task Creation Involving Temp Folder Sigma (inferred path)
        • Suspicious Scheduled Task Creation via Masqueraded XML File Sigma (inferred path)
        • Suspicious Scheduled Task from Public Directory Splunk (inferred path)
        • Suspicious Scheduled Task Name As GUID Sigma (inferred path)
        • Suspicious Schtasks Execution AppData Folder Sigma (inferred path)
        • Suspicious Schtasks Schedule Type With High Privileges Sigma (inferred path)
        • Suspicious Schtasks Schedule Types Sigma (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Suspicious Windows Sandbox Execution Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • System Utility Execution from Unbacked Memory Elastic (inferred path)
        • Uncommon One Time Only Scheduled Task At 00:00 Sigma (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Raccine Scheduled Task Deletion Splunk (inferred path)
        • Windows Scheduled Task Created Via XML Splunk (inferred path)
        • Windows Scheduled Task with Highest Privileges Splunk (inferred path)
        • Windows Schtasks Create Run As System Splunk (inferred path)
        • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
        • Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • WinRM Spawning a Process Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\ScriptRunner.exe#
        • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • System Binary Proxy Execution via ScriptRunner Elastic (inferred path)
        • Use of Scriptrunner.exe Sigma (inferred path)
        • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\scrobj.dll#
        • Script Execution via MSXSL Elastic (inferred path)
        • Scriptlet Execution via CMSTP Elastic (inferred path)
        • Scriptlet Execution via Rundll32 Elastic (inferred path)
        • Suspicious Script Object Execution Elastic (inferred path)
      • C:\Windows\System32\scrrun.dll#
        • WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load Sigma (inferred path)
      • C:\Windows\System32\sdbinst.exe#
        • Potential Application Shimming via Sdbinst Elastic (inferred path)
        • Potential Shim Database Persistence via Sdbinst.EXE Sigma (inferred path)
        • Shim Database Installation With Suspicious Parameters Splunk (inferred path)
        • Uncommon Extension Shim Database Installation Via Sdbinst.EXE Sigma (inferred path)
      • C:\Windows\System32\sdclt.exe#
        • Potential UAC Bypass Via Sdclt.EXE Sigma (inferred path)
        • Sdclt Child Processes Sigma (inferred path)
        • UAC Bypass via Sdclt Elastic (inferred path)
        • Windows Handle Duplication in Known UAC-Bypass Binaries Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\sdiageng.dll#
        • Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE Sigma (inferred path)
        • Potential Follina_DogWalk Activity - mdst.exe (Sysmon) Splunk (inferred path)
      • C:\Windows\System32\sdiagnhost.exe#
        • Sdiagnhost Calling Suspicious Child Process Sigma (inferred path)
      • C:\Windows\System32\SearchFilterHost.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Potential Pikabot C2 Activity Sigma (inferred path)
        • Potential Pikabot Discovery Activity Sigma (inferred path)
        • Potential Pikabot Hollowing Activity Sigma (inferred path)
        • Winnti Malware HK University Campaign Sigma (inferred path)
      • C:\Windows\System32\SearchIndexer.exe#
        • Abused Debug Privilege by Arbitrary Parent Processes Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • SearchIndexer suspicious process activity Sigma (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • Windows Process Injection In Non-Service SearchIndexer Splunk (inferred path)
      • C:\Windows\System32\SearchProtocolHost.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Potential Pikabot C2 Activity Sigma (inferred path)
        • Potential Pikabot Discovery Activity Sigma (inferred path)
        • Potential Pikabot Hollowing Activity Sigma (inferred path)
        • SearchProtocolHost with no Command Line with Network Splunk (inferred path)
        • Suspicious mshta child process Splunk (inferred path)
        • Suspicious SearchProtocolHost no Command Line Arguments Splunk (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • Windows Process Injection into Commonly Abused Processes Splunk (inferred path)
      • C:\Windows\System32\SecEdit.exe#
        • Potential Suspicious Activity Using SeCEdit Chronicle (inferred path)
        • Potential Suspicious Activity Using SeCEdit Sigma (inferred path)
      • C:\Windows\System32\secur32.dll#
        • Files With System DLL Name In Unsuspected Locations Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\security.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\SecurityHealthService.exe#
      • C:\Windows\System32\SecurityHealthSystray.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
      • C:\Windows\System32\SensApi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\system32\Service.exe#
        • OilRig APT Activity Sigma (inferred path)
      • C:\Windows\System32\services.exe#
        • Abused Debug Privilege by Arbitrary Parent Processes Sigma (inferred path)
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • DCOM Lateral Movement Kusto (inferred path)
        • Detect Path Interception By Creation Of program exe Splunk (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • HackTool - Potential Impacket Lateral Movement Activity Sigma (inferred path)
        • HAFNIUM Exchange Exploitation Activity Sigma (inferred path)
        • Possible Lateral Movement PowerShell Spawn Splunk (inferred path)
        • Potential Lateral Movement via MSI ODBC Driver Install over DCOM Kusto (inferred path)
        • Potential Lateral Movement via SMBExec Elastic (inferred path)
        • Potential Meterpreter/CobaltStrike Activity Sigma (inferred path)
        • Potential SNAKE Malware Persistence Service Execution Sigma (inferred path)
        • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
        • Rare Process as a Service Kusto (inferred path)
        • Remotely Started Services via RPC Elastic (inferred path)
        • Self Service Persistence by an Unsigned Process Elastic (inferred path)
        • Services Escalate Exe Splunk (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • SMB/Windows Admin Shares Kusto (inferred path)
        • Suspicious DNS Lookup by Remote Utilities RMM Elastic (inferred path)
        • Suspicious Execution via Windows Services Elastic (inferred path)
        • Suspicious PowerShell Parent Process Sigma (inferred path)
        • Suspicious Service Binary Directory Sigma (inferred path)
        • Suspicious Windows Service Execution Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • System Shells via Services Elastic (inferred path)
        • Untrusted DLL Loaded by a Persistent Program Elastic (inferred path)
        • Windows Processes Suspicious Parent Directory Sigma (inferred path)
        • Windows Service Configuration Hjack Elastic (inferred path)
      • C:\Windows\System32\sethc.exe#
        • Remote Thread Creation In Uncommon Target Image Sigma (inferred path)
        • Sticky key file created from CMD copy Sigma (inferred path)
        • Sticky key sethc file failed replacement Sigma (inferred path)
      • C:\Windows\System32\setspn.exe#
        • Potential SPN Enumeration Via Setspn.EXE Sigma (inferred path)
        • ServicePrincipalNames Discovery with SetSPN Splunk (inferred path)
      • C:\Windows\System32\shell32.dll#
        • Invoke-Obfuscation Via Use Rundll32 - Security Sigma (inferred path)
        • Invoke-Obfuscation Via Use Rundll32 - System Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\ShellAppRuntime.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
      • C:\Windows\System32\shellchromeapi.dll#
        • Creation Of Non-Existent System DLL Sigma (inferred path)
        • Potential DLL Sideloading Of Non-Existent DLLs From System Folders Sigma (inferred path)
        • Windows Phantom DLL Created on Disk Splunk (inferred path)
      • C:\Windows\System32\shfolder.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\shutdown.exe#
        • Suspicious Execution of Shutdown Sigma (inferred path)
        • Suspicious Execution of Shutdown to Log Out Sigma (inferred path)
        • Windows System LogOff Commandline Splunk (inferred path)
        • Windows System Reboot CommandLine Splunk (inferred path)
        • Windows System Shutdown CommandLine Splunk (inferred path)
      • C:\Windows\System32\sigverif.exe#
        • Uncommon Sigverif.EXE Child Process Sigma (inferred path)
      • C:\Windows\System32\SIHClient.exe#
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
      • C:\Windows\System32\sihost.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Potential Remote Install via MsiExec Elastic (inferred path)
        • Remote Management Access Launch After MSI Install Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • Windows Binaries Write Suspicious Extensions Sigma (inferred path)
      • C:\Windows\System32\slc.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\slui.exe#
        • Detecting UAC bypass - ChangePK and SLUI registry tampering Kusto (inferred path)
        • SLUI RunAs Elevated Splunk (inferred path)
        • SLUI Spawning a Process Splunk (inferred path)
        • UAC Bypass Using ChangePK and SLUI Sigma (inferred path)
        • UAC Bypass via Windows Activation Execution Hijack Elastic (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • Windows Handle Duplication in Known UAC-Bypass Binaries Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\smartscreen.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\smss.exe#
        • Abused Debug Privilege by Arbitrary Parent Processes Sigma (inferred path)
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Windows Binaries Write Suspicious Extensions Sigma (inferred path)
      • C:\Windows\System32\SndVol.exe#
        • Potential Pikabot C2 Activity Sigma (inferred path)
        • Potential Pikabot Hollowing Activity Sigma (inferred path)
        • Uncommon Child Processes Of SndVol.exe Sigma (inferred path)
      • C:\Windows\System32\snmpapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\Speech#
        • Process Execution from an Unusual Directory Elastic (inferred branch)
        • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • C:\Windows\System32\Speech_OneCore\common#
        • C:\Windows\System32\Speech_OneCore\common\sapi_onecore.dll#
          • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • C:\Windows\System32\Speech_OneCore\common\SpeechRuntime.exe#
          • Suspicious Speech Runtime Binary Child Process Sigma (inferred path)
          • Windows SpeechRuntime COM Hijacking DLL Load Splunk (inferred path)
          • Windows SpeechRuntime Suspicious Child Process Splunk (inferred path)
      • C:\Windows\System32\spool#
        • C:\Windows\System32\spool\drivers#
          • Shared printer creation (PrintNightmare vulnerability - CVE-2021-36958) Sigma (inferred branch)
          • C:\Windows\System32\spool\drivers\color#
            • Drop Binaries Into Spool Drivers Color Folder Sigma (inferred branch)
            • Execution from Suspicious Directory Elastic (inferred branch)
            • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
            • Windows Process Writing File to World Writable Path Splunk (inferred branch)
          • C:\Windows\System32\spool\drivers\x64#
            • Additional dll added to Spool Driver (Sysmon) Splunk (inferred branch)
            • Potential Privilege Escalation via Missing DLL Elastic (inferred branch)
            • Spoolsv Suspicious Loaded Modules Splunk (inferred branch)
            • Spoolsv Writing a DLL Splunk (inferred branch)
            • Spoolsv Writing a DLL - Sysmon Splunk (inferred branch)
            • C:\Windows\System32\spool\drivers\x64\3#
              • Potential PrintNightmare Exploitation Attempt Sigma (inferred branch)
              • Suspicious Print Spooler File Deletion Elastic (inferred branch)
              • Windows Spooler Service Suspicious Binary Load Sigma (inferred branch)
              • C:\Windows\System32\spool\drivers\x64\3\old\1\123#
                • CVE-2021-1675 Print Spooler Exploitation Filename Pattern Sigma (inferred branch)
            • C:\Windows\System32\spool\drivers\x64\4#
              • Windows Spooler Service Suspicious Binary Load Sigma (inferred branch)
        • C:\Windows\System32\spool\PRINTERS#
          • Suspicious Print Spooler SPL File Created Elastic (inferred branch)
          • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
          • Windows Process Writing File to World Writable Path Splunk (inferred branch)
        • C:\Windows\System32\spool\SERVERS#
          • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
          • Windows Process Writing File to World Writable Path Splunk (inferred branch)
        • C:\Windows\System32\spool\tools\PrintBrm.exe#
          • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
          • Execution of a File Written by a Signed Binary Proxy Elastic (inferred path)
          • Ingress DLL Transfer followed by DLL SideLoading Elastic (inferred path)
          • PrintBrm ZIP Creation of Extraction Chronicle (inferred path)
          • PrintBrm ZIP Creation of Extraction Sigma (inferred path)
      • C:\Windows\System32\spoolsv.exe#
        • Abused Debug Privilege by Arbitrary Parent Processes Sigma (inferred path)
        • Child Processes of Spoolsv exe Splunk (inferred path)
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Potential PrintNightmare Exploitation Attempt Sigma (inferred path)
        • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Remote Thread Creation In Uncommon Target Image Sigma (inferred path)
        • Spool process spawned a CMD shell (PrintNightmare vulnerability - CVE-2021-36958) Sigma (inferred path)
        • Spoolsv Spawning Rundll32 Splunk (inferred path)
        • Spoolsv Suspicious Loaded Modules Splunk (inferred path)
        • Spoolsv Suspicious Process Access Splunk (inferred path)
        • Spoolsv Writing a DLL Splunk (inferred path)
        • Suspicious Parent Process for spoolsv.exe (Sysmon) Splunk (inferred path)
        • Suspicious Parent Process for spoolsv.exe (Windows Event Log) Splunk (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • Unusual Print Spooler Child Process Elastic (inferred path)
        • Windows Process Injection into Commonly Abused Processes Splunk (inferred path)
        • Windows Spooler Service Suspicious Binary Load Sigma (inferred path)
      • C:\Windows\System32\spp.dll#
      • C:\Windows\System32\sppc.dll#
      • C:\Windows\System32\sppcext.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\sppsvc.exe#
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
      • C:\Windows\System32\srclient.dll#
      • C:\Windows\System32\srcore.dll#
      • C:\Windows\System32\srmtrace.dll#
      • C:\Windows\System32\srpapi.dll#
      • C:\Windows\System32\srvcli.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\sspicli.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\SSShim.dll#
      • C:\Windows\System32\StateRepository.Core.dll#
      • C:\Windows\System32\StorageUsage.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\stordiag.exe#
        • Execution via stordiag.exe Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\StructuredQuery.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\svchost.exe#
        • APT PRIVATELOG Image Load Pattern Sigma (inferred path)
        • APT27 - Emissary Panda Activity Sigma (inferred path)
        • COLDSTEEL Persistence Service Creation Sigma (inferred path)
        • COLDSTEEL RAT Cleanup Command Execution Sigma (inferred path)
        • COLDSTEEL RAT Service Persistence Execution Sigma (inferred path)
        • COM Event System Loading New DLL Kusto (inferred path)
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • Credential Dumping Attempt Via Svchost Sigma (inferred path)
        • DCOM Lateral Movement Kusto (inferred path)
        • Execution via Interactive Secondary Logon Elastic (inferred path)
        • Execution via Outlook Application COM Object Elastic (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • GetAsyncKeyState API Call from Suspicious Process Elastic (inferred path)
        • HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump Sigma (inferred path)
        • HAFNIUM Exchange Exploitation Activity Sigma (inferred path)
        • ImagingDevices Unusual Parent/Child Processes Sigma (inferred path)
        • Impacket DCOMexec process abuse via MMC Sigma (inferred path)
        • Ingress Transfer via Windows BITS Elastic (inferred path)
        • MMC20 Lateral Movement Sigma (inferred path)
        • Persistence via BITS Job Notify Cmdline Elastic (inferred path)
        • Persistence via BITS SetNotifyCmdLine Method Elastic (inferred path)
        • Persistence via Update Orchestrator Service Hijack Elastic (inferred path)
        • Possible Lateral Movement PowerShell Spawn Splunk (inferred path)
        • Potential COLDSTEEL Persistence Service DLL Load Sigma (inferred path)
        • Potential CVE-2022-26809 Exploitation Attempt Sigma
        • Potential CVE-2024-21412 Exploitation Elastic (inferred path)
        • Potential Dridex Activity Sigma (inferred path)
        • Potential Exploitation Attempt Of Undocumented WindowsServer RCE Sigma (inferred path)
        • Potential Exploitation via ComDotNet Exploit Elastic (inferred path)
        • Potential Kerberos Relaying Activity - MDE Kusto (inferred path)
        • Potential LethalHTA Technique Execution Sigma (inferred path)
        • Potential Persistence Via Powershell Search Order Hijacking - Task Sigma
        • Potential Privilege Escalation via RoguePlanet Windows Defender Exploit Elastic (inferred path)
        • Potential Remote Credential Access via Registry Elastic (inferred path)
        • Potential Remote Desktop Shadowing Activity Elastic (inferred path)
        • Potential SharpRDP Behavior Elastic (inferred path)
        • Potential Shellcode Injection via a WebShell Elastic (inferred path)
        • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
        • Process Creation via Secondary Logon Elastic (inferred path)
        • RDP Over Reverse SSH Tunnel Sigma (inferred path)
        • RDP to HTTP or HTTPS Target Ports Sigma (inferred path)
        • Remote Access to Sensitive Registry Keys Elastic (inferred path)
        • Remote Scheduled Task Creation Elastic (inferred path)
        • RunDLL32/Regsvr32 Loads a DLL Downloaded via BITS Elastic (inferred path)
        • Scheduled Task - Suspicious Network Connection Kusto (inferred path)
        • Scheduled Task by a Low Reputation Process Elastic (inferred path)
        • Scheduled Task from a Browser or Compression Utility Descendant Elastic (inferred path)
        • Scheduled Task from a Removable or Mounted ISO Device Elastic (inferred path)
        • Script Event Consumer Spawning Process Sigma (inferred path)
        • Service Communication via Mail Protocol Elastic (inferred path)
        • Suspect Svchost Activity Sigma (inferred path)
        • Suspicious .NET Code Compilation Elastic (inferred path)
        • Suspicious Antivirus Registration Elastic (inferred path)
        • Suspicious API from an Unsigned Service DLL Elastic (inferred path)
        • Suspicious Desktopimgdownldr Target File Sigma (inferred path)
        • Suspicious Execution via DCOM Elastic (inferred path)
        • Suspicious Execution via Scheduled Task Elastic (inferred path)
        • Suspicious LSASS Access via MalSecLogon Elastic (inferred path)
        • Suspicious LSASS Access Via MalSecLogon Sigma (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious mshta spawn Splunk (inferred path)
        • Suspicious New Instance Of An Office COM Object Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious Process Masquerading As SvcHost.EXE Sigma (inferred path)
        • Suspicious Remote Registry Modification Elastic (inferred path)
        • Suspicious Service Binary Directory Sigma (inferred path)
        • Suspicious Svchost Process Access Sigma (inferred path)
        • Suspicious WebDav Client Execution Via Rundll32.EXE Sigma (inferred path)
        • Suspicious Windows Schedule Child Process Elastic (inferred path)
        • Suspicious WSMAN Provider Image Loads Sigma (inferred path)
        • Svchost LOLBAS Execution Process Spawn Splunk (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Uncommon Svchost Command Line Parameter Sigma (inferred path)
        • Uncommon Svchost Parent Process Sigma (inferred path)
        • Unsigned DLL Loaded by Svchost Elastic (inferred path)
        • Untrusted DLL Loaded by a Persistent Program Elastic (inferred path)
        • Unusual Service Host Child Process - Childless Service Elastic (inferred path)
        • Wab/Wabmig Unusual Parent Or Child Processes Sigma (inferred path)
        • WebDav Client Execution Via Rundll32.EXE Sigma (inferred path)
        • Windows Binaries Write Suspicious Extensions Sigma (inferred path)
        • Windows Process Injection into Commonly Abused Processes Splunk (inferred path)
        • Windows Processes Suspicious Parent Directory Sigma (inferred path)
        • Windows Rundll32 WebDav With Network Connection Splunk (inferred path)
        • Windows Scheduled Task Service Spawned Shell Splunk (inferred path)
        • Windows Svchost.exe Parent Process Anomaly Splunk (inferred path)
        • WMI Incoming Lateral Movement Elastic (inferred path)
        • WMI Persistence - Script Event Consumer Sigma (inferred path)
      • C:\Windows\System32\sxshared.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\SyncAppvPublishingServer.exe#
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • SyncAppvPublishingServer Execute Arbitrary PowerShell Code Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\Sysprep#
        • C:\Windows\System32\Sysprep\Panther\unattend.xml#
          • Sensitive File Access - Unattended Panther Elastic (inferred path)
        • C:\Windows\System32\Sysprep\sysprep.exe#
          • Sysprep on AppData Folder Sigma (inferred path)
          • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
          • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
        • C:\Windows\System32\Sysprep\unattend.xml#
          • Sensitive File Access - Unattended Panther Elastic (inferred path)
      • C:\Windows\System32\systeminfo.exe#
        • Execution via stordiag.exe Sigma (inferred path)
        • Exploited CVE-2020-10189 Zoho ManageEngine Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process Of SQL Server Sigma (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Execution of Systeminfo Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Cmdline Tool Execution From Non-Shell Process Splunk (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows System Information Discovery Elastic (inferred path)
      • C:\Windows\System32\SystemPropertiesAdvanced.exe#
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\SystemResetPlatform\SystemResetPlatform.exe#
        • Potential RjvPlatform.DLL Sideloading From Default Location Sigma
      • C:\Windows\System32\SystemSettingsAdminFlows.exe#
        • Potential Signing Bypass Via Windows Developer Features Sigma (inferred path)
        • Windows Defender Disabled Via SystemSettingsAdminFlows.EXE Sigma (inferred path)
      • C:\Windows\System32\SystemSettingsBroker.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
      • C:\Windows\System32\SystemSettingsThresholdAdminFlowUI.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\takeown.exe#
        • File and Directory Permissions Modification Elastic (inferred path)
        • File or Folder Permissions Modifications Sigma (inferred path)
        • Permission Modification using Takeown App Splunk (inferred path)
        • Suspicious Recursive Takeown Sigma (inferred path)
        • System Boot Files Permission Change Elastic (inferred path)
        • System File Ownership Change Elastic (inferred path)
      • C:\Windows\System32\tapi32.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\tar.exe#
        • Compressed File Creation Via Tar.EXE Sigma (inferred path)
        • Compressed File Extraction Via Tar.EXE Sigma (inferred path)
        • Execution of a Binary Dropped via Microsoft BSDTAR Archive Tool Elastic (inferred path)
      • C:\Windows\System32\taskhostw.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • UAC Bypass Attempt via CDSSync Scheduled Task Hijack Elastic (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
      • C:\Windows\System32\taskkill.exe#
        • Excessive Usage Of Taskkill Splunk (inferred path)
        • Process Terminated Via Taskkill Sigma (inferred path)
        • Sdiagnhost Calling Suspicious Child Process Sigma (inferred path)
        • Stopping multiple processes using taskkill Kusto (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Windows Disable or Modify Tools Via Taskkill Splunk (inferred path)
      • C:\Windows\System32\tasklist.exe#
        • Loaded Module Enumeration Via Tasklist.EXE Sigma (inferred path)
        • Process Discovery Using Built-in Tools Elastic (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process Of SQL Server Sigma (inferred path)
        • Suspicious Child Process Of Veeam Dabatase Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Tasklist Discovery Command Sigma (inferred path)
        • System Service Discovery through built-in Windows Utilities Elastic (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
      • C:\Windows\System32\Taskmgr.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • LSASS credentials dump via Task Manager (file) Sigma (inferred path)
        • LSASS Process Memory Dump Creation Via Taskmgr.EXE Sigma (inferred path)
        • New Process Created Via Taskmgr.EXE Sigma (inferred path)
        • Potential SharpRDP Behavior Elastic (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Taskmgr as LOCAL_SYSTEM Sigma (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
      • C:\Windows\System32\Tasks#
        • Dual Persistence via Startup and Scheduled Task Elastic (inferred branch)
        • Execution from Suspicious Directory Elastic (inferred branch)
        • Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder Sigma (inferred branch)
        • Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location Sigma (inferred branch)
        • Persistence via a Windows Installer Elastic (inferred branch)
        • Potential UAC Bypass via IElevatedFactoryServer Elastic (inferred branch)
        • Process Execution From A Potentially Suspicious Folder Sigma (inferred branch)
        • Scheduled Task by a Low Reputation Process Elastic (inferred branch)
        • Scheduled Task Created - FileCreation Sigma (inferred branch)
        • Scheduled Task Creation by an Unusual Process Elastic (inferred branch)
        • Scheduled Task from a Browser or Compression Utility Descendant Elastic (inferred branch)
        • Scheduled Task from a Removable or Mounted ISO Device Elastic (inferred branch)
        • Self Extraction Directive File Created In Potentially Suspicious Location Sigma (inferred branch)
        • Suspicious Child Process of AspNetCompiler Sigma (inferred branch)
        • Suspicious Executable File Creation Elastic (inferred branch)
        • Suspicious Microsoft Office Child Process Sigma (inferred branch)
        • Suspicious Microsoft OneNote Child Process Elastic (inferred branch)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred branch)
        • Suspicious Process Start Locations Sigma (inferred branch)
        • Suspicious Provlaunch.EXE Child Process Sigma (inferred branch)
        • Suspicious Scheduled Task Write to System32 Tasks Sigma (inferred branch)
        • Suspicious Windows LUA Script Execution Elastic (inferred branch)
        • Suspicious Windows Schedule Child Process Elastic (inferred branch)
        • Suspicious Windows Script Interpreter Child Process Elastic (inferred branch)
        • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
        • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
        • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
        • Windows Process Writing File to World Writable Path Splunk (inferred branch)
        • C:\Windows\System32\Tasks\Microsoft\Windows#
          • DLL Load By System Process From Suspicious Locations Sigma (inferred branch)
          • Indirect Command Execution via ForFiles Elastic (inferred branch)
          • Ingress Tool Transfer via INET Cache Elastic (inferred branch)
          • Keystroke Input Capture via DirectInput Elastic (inferred branch)
          • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
          • Library Load of a File Written by a Signed Binary Proxy Elastic (inferred branch)
          • Potential Command Line Path Traversal Evasion Attempt Sigma (inferred branch)
          • Potential Privilege Escalation via LocalPotato Exploit Elastic (inferred branch)
          • Potential System Tampering via File Modification Elastic (inferred branch)
          • Registry Run Key Modified by Unusual Process Elastic (inferred branch)
          • Remote Memory Write to Trusted Target Process Elastic (inferred branch)
          • Startup Persistence via Unusual Process Elastic (inferred branch)
          • Suspicious DLL Loaded for Persistence or Privilege Escalation Elastic (inferred branch)
          • Suspicious PHP Script Execution Elastic (inferred branch)
          • Suspicious RDP ActiveX Client Loaded Elastic (inferred branch)
          • C:\Windows\System32\Tasks\Microsoft\Windows\CurrentVersion\Uninstall#
            • Windows Query Registry UnInstall Program List Splunk (inferred branch)
          • C:\Windows\System32\Tasks\Microsoft\Windows\Libraries#
            • Executables Or Script Creation In Suspicious Path Splunk (inferred branch)
          • C:\Windows\System32\Tasks\Microsoft\Windows\Recent#
            • ISO or Image Mount Indicator in Recent Files Sigma (inferred branch)
            • Windows ISO LNK File Creation Splunk (inferred branch)
          • C:\Windows\System32\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update#
            • Windows Process Writing File to World Writable Path Splunk (inferred branch)
          • C:\Windows\System32\Tasks\Microsoft\Windows\Servicing#
            • Windows Credentials Access via VaultCli Module Splunk (inferred branch)
            • Windows Potential AppDomainManager Hijack Artifacts Creation Splunk (inferred branch)
            • Windows Scheduled Task DLL Module Loaded Splunk (inferred branch)
          • C:\Windows\System32\Tasks\Microsoft\Windows\Setup\Scripts\ErrorHandler.cmd#
            • Potential Persistence Attempt Via ErrorHandler.Cmd Sigma (inferred path)
          • C:\Windows\System32\Tasks\Microsoft\Windows\Start Menu\Programs\Startup#
            • Dual Persistence via Startup and Scheduled Task Elastic (inferred branch)
            • Execution from Startup Folder (Sysmon) Splunk (inferred branch)
            • Execution from Startup Folder (Windows Event Log) Splunk (inferred branch)
            • Hijack Legit RDP Session to Move Laterally Sigma (inferred branch)
            • Persistence via a Process from a Removable or Mounted ISO Device Elastic (inferred branch)
            • Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader Sigma (inferred branch)
            • Potential RipZip Attack on Startup Folder Sigma (inferred branch)
            • Registry or File Modification from Suspicious Memory Elastic (inferred branch)
            • Script Interpreter Process Writing to Commonly Abused Persistence Locations Elastic (inferred branch)
            • Startup Folder File Write Sigma (inferred branch)
            • Startup Persistence by a Low Reputation Process Elastic (inferred branch)
            • Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred branch)
            • Startup Persistence from Backed RWX Memory Elastic (inferred branch)
            • Startup Persistence via Windows Script Interpreter Elastic (inferred branch)
            • Untrusted Process Writing to Commonly Abused Persistence Locations Elastic (inferred branch)
            • Windows Boot or Logon Autostart Execution In Startup Folder Splunk (inferred branch)
      • C:\Windows\System32\taskschd.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • Outbound Scheduled Task Activity via PowerShell Elastic (inferred path)
        • Scheduled Task Created by a Windows Script Elastic (inferred path)
        • Suspicious Image Load (taskschd.dll) from MS Office Elastic (inferred path)
        • Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location Sigma (inferred path)
        • Windows Office Product Loading Taskschd DLL Splunk (inferred path)
        • Windows Scheduled Task DLL Module Loaded Splunk (inferred path)
      • C:\Windows\System32\tbs.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\tdh.dll#
        • Files With System DLL Name In Unsuspected Locations Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\TextShaping.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\TieringEngineService.exe#
        • RedSun - Conhost.exe Spawned by TieringEngineService.exe Sigma (inferred path)
        • Windows Suspicious Child Process of TieringEngineService.exe Splunk (inferred path)
      • C:\Windows\System32\timesync.dll#
      • C:\Windows\System32\TpmCoreProvisioning.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\TpmInit.exe#
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\tpmvsc.dll#
        • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
      • C:\Windows\System32\tpmvscmgr.exe#
        • New Virtual Smart Card Created Via TpmVscMgr.EXE Sigma (inferred path)
      • C:\Windows\System32\tprtdll.dll#
        • API via Trusted App Runtime DLL Elastic (inferred path)
      • C:\Windows\System32\tquery.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\TRACERT.EXE#
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
      • C:\Windows\System32\tree.com#
        • Recon Information for Export with Command Prompt Sigma (inferred path)
      • C:\Windows\System32\tscon.exe#
        • Potential RDP Session Hijacking Activity Sigma (inferred path)
        • Suspicious TSCON Start as SYSTEM Sigma (inferred path)
      • C:\Windows\System32\TSMSISrv.dll#
        • Creation Of Non-Existent System DLL Sigma (inferred path)
        • Potential DLL Sideloading Of Non-Existent DLLs From System Folders Sigma (inferred path)
        • Windows Phantom DLL Created on Disk Splunk (inferred path)
      • C:\Windows\System32\TSTheme.exe#
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
      • C:\Windows\System32\TSVIPSrv.dll#
        • Creation Of Non-Existent System DLL Sigma (inferred path)
        • Potential DLL Sideloading Of Non-Existent DLLs From System Folders Sigma (inferred path)
        • Windows Phantom DLL Created on Disk Splunk (inferred path)
      • C:\Windows\System32\TSWorkspace.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\ttdinject.exe#
        • Binary Proxy Execution via TTDInject Elastic (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Remote Thread Creation Ttdinject.exe Proxy Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Use of TTDInject.exe Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\ttdloader.dll#
        • Time Travel Debugging Utility Usage - Image Sigma (inferred path)
      • C:\Windows\System32\ttdrecord.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Time Travel Debugging Utility Usage - Image Sigma (inferred path)
      • C:\Windows\System32\tttracer.exe#
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Potential Credential Access via Windows Utilities Elastic (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Time Travel Debugging Utility Usage Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\twext.dll#
      • C:\Windows\System32\twinapi.dll#
      • C:\Windows\System32\twinui.appcore.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\tzsync.exe#
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\tzutil.exe#
        • System Time Discovery Elastic (inferred path)
      • C:\Windows\System32\UIAnimation.dll#
      • C:\Windows\System32\UIAutomationCore.dll#
      • C:\Windows\System32\uireng.dll#
      • C:\Windows\System32\UIRibbon.dll#
      • C:\Windows\System32\umpdc.dll#
      • C:\Windows\System32\unattend.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\unregmp2.exe#
        • Lolbin Unregmp2.exe Use As Proxy Sigma (inferred path)
      • C:\Windows\System32\updatepolicy.dll#
      • C:\Windows\System32\upshared.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\urlmon.dll#
        • Library Load from a Truncated Stack Elastic (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\userenv.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\userinit.exe#
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • Execution of Persistent Suspicious Program Elastic (inferred path)
        • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Suspicious Userinit Child Process Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Uncommon Userinit Child Process Sigma (inferred path)
      • C:\Windows\System32\utcutil.dll#
      • C:\Windows\System32\utildll.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\Utilman.exe#
        • Potential Modification of Accessibility Binaries Elastic (inferred path)
      • C:\Windows\System32\UXInit.dll#
      • C:\Windows\System32\uxtheme.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\vaultcli.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • Module Stomping from a Copied Library Elastic (inferred path)
        • Potential Credential Access via Trusted Developer Utility Elastic (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Rundll32 or Regsvr32 Loaded a DLL from Unbacked Memory Elastic (inferred path)
        • Suspicious Vault Client Image Load Elastic (inferred path)
        • Windows Credentials Access via VaultCli Module Splunk (inferred path)
        • Windows InstallUtil Credential Theft Splunk (inferred path)
      • C:\Windows\System32\VaultCmd.exe#
        • Searching for Saved Credentials via VaultCmd Elastic (inferred path)
        • Visual Studio Code Tunnel Execution (Windows Event Log) Splunk (inferred path)
        • Windows Credential Manager Access via VaultCmd Sigma (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
      • C:\Windows\System32\vbscript.dll#
        • MMC Loading Script Engines DLLs Sigma (inferred path)
        • Script Execution via MSXSL Elastic (inferred path)
        • Suspicious WMIC XSL Script Execution Elastic (inferred path)
        • Suspicious WMIC XSL Script Execution Elastic (inferred path)
        • Windows MMC Loaded Script Engine DLL Splunk (inferred path)
        • WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load Sigma (inferred path)
        • WMIC Loading Scripting Libraries Sigma (inferred path)
      • C:\Windows\System32\vdsutil.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\verclsid.exe#
        • Malware Shellcode in Verclsid Target Process Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious WmiPrvSE Child Process Sigma (inferred path)
        • Verclsid CLSID Execution Splunk (inferred path)
        • Verclsid.exe Runs COM Object Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\version.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Windows Hijack Execution Flow Version Dll Side Load Splunk (inferred path)
      • C:\Windows\System32\virtdisk.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\vss_ps.dll#
        • Suspicious Volume Shadow Copy VSS_PS.dll Load Sigma (inferred path)
      • C:\Windows\System32\vssadmin.exe#
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Creation of Shadow Copy Splunk (inferred path)
        • Deleting Shadow Copies Splunk (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Resize ShadowStorage volume Splunk (inferred path)
        • Rorschach Ransomware Execution Activity Sigma (inferred path)
        • Shadow Copies Creation Using Operating Systems Utilities Sigma (inferred path)
        • Shadow Copies Deletion Using Operating Systems Utilities Sigma (inferred path)
        • Volume Shadow Copy Deleted or Resized via VssAdmin Elastic (inferred path)
        • Webshell Hacking Activity Patterns Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
      • C:\Windows\System32\vssapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Suspicious Volume Shadow Copy Vssapi.dll Load Sigma (inferred path)
      • C:\Windows\System32\vsstrace.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load Sigma (inferred path)
      • C:\Windows\System32\VSSVC.exe#
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Windows VSSVC Process Accessing Defender Engine Splunk (inferred path)
      • C:\Windows\System32\w32tm.exe#
        • Discovery of a System Time Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • System Time Discovery Elastic (inferred path)
        • Use of W32tm as Timer Sigma (inferred path)
        • Windows System Time Discovery W32tm Delay Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\wbadmin.exe#
        • All Backups Deleted Via Wbadmin.EXE Sigma (inferred path)
        • Backup Deletion with Wbadmin Elastic (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • File Recovery From Backup Via Wbadmin.EXE Sigma (inferred path)
        • NTDS Dump via Wbadmin Elastic (inferred path)
        • Sensitive File Dump Via Wbadmin.EXE Sigma (inferred path)
        • Sensitive File Recovery From Backup Via Wbadmin.EXE Sigma (inferred path)
        • Shadow Copies Deletion Using Operating Systems Utilities Sigma (inferred path)
        • WBAdmin Delete System Backups Splunk (inferred path)
        • Windows Backup Deleted Via Wbadmin.EXE Sigma (inferred path)
        • Windows WBAdmin File Recovery From Backup Splunk (inferred path)
      • C:\Windows\System32\wbem#
        • Potential DLL Hijacking via Environment Paths Elastic (inferred branch)
        • Potential Privilege Escalation via Missing DLL Elastic (inferred branch)
        • Unusual Process Execution on WBEM Path Elastic (inferred branch)
        • C:\Windows\System32\wbem\ATL.dll#
          • UAC Bypass via Hijacking WinMgmt MMC Elastic (inferred path)
        • C:\Windows\System32\wbem\fastprox.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • MS Scripting Process Loading WMI Module Splunk (inferred path)
          • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
          • Wbemprox COM Object Execution Splunk (inferred path)
          • WMI Image Load via Microsoft Office Elastic (inferred path)
          • WMI module loaded by suspicious process Sigma (inferred path)
          • WMI Module Loaded By Uncommon Process Sigma (inferred path)
        • C:\Windows\System32\wbem\mofcomp.exe#
          • Mofcomp Activity Elastic (inferred path)
          • Potentially Suspicious Mofcomp Execution Sigma (inferred path)
          • Windows MOF Event Triggered Execution via WMI Splunk (inferred path)
        • C:\Windows\System32\wbem\scrcons.exe#
          • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
          • Script Event Consumer Spawning Process Sigma (inferred path)
          • Script Execution via WMI Splunk (inferred path)
          • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
          • Suspicious Microsoft Office Child Process Sigma (inferred path)
          • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
          • Suspicious mshta child process Splunk (inferred path)
          • Suspicious Outlook Child Process Sigma (inferred path)
          • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
          • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
          • Windows Scheduled Task Service Spawned Shell Splunk (inferred path)
          • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
          • WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load Sigma (inferred path)
          • WMI Event Consumer Created Named Pipe Sigma (inferred path)
          • WMI Persistence - Script Event Consumer Sigma (inferred path)
          • WMI Persistence - Script Event Consumer File Write Sigma
        • C:\Windows\System32\wbem\unsecapp.exe#
          • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • C:\Windows\System32\wbem\wbemcomn.dll#
          • Creation Of Non-Existent System DLL Sigma (inferred path)
          • Potential DLL Sideloading Of Non-Existent DLLs From System Folders Sigma (inferred path)
          • Windows Phantom DLL Created on Disk Splunk (inferred path)
          • Wmiprvse Wbemcomn DLL Hijack Sigma (inferred path)
          • Wmiprvse Wbemcomn DLL Hijack - File Sigma (inferred path)
        • C:\Windows\System32\wbem\wbemcons.dll#
          • WMI Persistence - Command Line Event Consumer Sigma (inferred path)
        • C:\Windows\System32\wbem\wbemdisp.dll#
          • MS Scripting Process Loading WMI Module Splunk (inferred path)
          • WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load Sigma (inferred path)
        • C:\Windows\System32\wbem\wbemprox.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • MS Scripting Process Loading WMI Module Splunk (inferred path)
          • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
          • Suspicious WMI Library Load Elastic (inferred path)
          • Wbemprox COM Object Execution Splunk (inferred path)
          • WMI Image Load via Microsoft Office Elastic (inferred path)
          • WMI Module Loaded By Uncommon Process Sigma (inferred path)
        • C:\Windows\System32\wbem\wbemsvc.dll#
          • MS Scripting Process Loading WMI Module Splunk (inferred path)
          • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
          • WMI module loaded by suspicious process Sigma (inferred path)
          • WMI Module Loaded By Uncommon Process Sigma (inferred path)
        • C:\Windows\System32\wbem\wbemtest.exe#
          • WMI WBEMTEST Utility Execution Elastic (inferred path)
        • C:\Windows\System32\wbem\WmiApRpl.dll#
          • WMI module loaded by suspicious process Sigma (inferred path)
          • WMI Module Loaded By Uncommon Process Sigma (inferred path)
        • C:\Windows\System32\wbem\WmiApSrv.exe#
          • VMGuestLib DLL Sideload Sigma (inferred path)
        • C:\Windows\System32\wbem\WMIC.exe#
          • Suspicious WMIC Execution Via Office Process Sigma (inferred path)
        • C:\Windows\System32\wbem\wmiprov.dll#
          • WMI module loaded by suspicious process Sigma (inferred path)
          • WMI Module Loaded By Uncommon Process Sigma (inferred path)
        • C:\Windows\System32\wbem\WmiPrvSE.exe#
          • Creation or Modification of Root Certificate Elastic (inferred path)
          • Download Activity via a Headless Browser Elastic (inferred path)
          • Enumeration Command Spawned via WMIPrvSE Elastic (inferred path)
          • Execution via a Suspicious WMI Client Elastic (inferred path)
          • Execution via WMI CommandLine Event Consumer Elastic (inferred path)
          • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
          • HackTool - Potential Impacket Lateral Movement Activity Sigma (inferred path)
          • ImagingDevices Unusual Parent/Child Processes Sigma (inferred path)
          • Impacket Lateral Movement WMIExec Commandline Parameters Splunk (inferred path)
          • Microsoft Build Engine Started by a System Process Elastic (inferred path)
          • Microsoft Office File Execution via WMI Elastic (inferred path)
          • Persistence via WMI Standard Registry Provider Elastic (inferred path)
          • Possible Lateral Movement PowerShell Spawn Splunk (inferred path)
          • Potential File Download via a Headless Browser Elastic (inferred path)
          • Potential Remote Install via MsiExec Elastic (inferred path)
          • Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell Sigma (inferred path)
          • Process Execution via WMI Splunk (inferred path)
          • Process Execution with Unusual File Extension Elastic (inferred path)
          • QoS Policy Group Policy Registry Overwrite via WMI Elastic (inferred path)
          • Suspicious Autorun Registry Modified via WMI Sigma (inferred path)
          • Suspicious Cmd Execution via WMI Elastic (inferred path)
          • Suspicious Execution via Windows Management Instrumentation Elastic (inferred path)
          • Suspicious MSBuild Spawn Splunk (inferred path)
          • Suspicious mshta spawn Splunk (inferred path)
          • Suspicious Registry Modification via WMI Elastic (inferred path)
          • Suspicious WmiPrvSE Child Process Sigma (inferred path)
          • System crash behavior manipulation - WMImplant (registry) Sigma (inferred path)
          • Unusual Registry Modification via WMI Elastic (inferred path)
          • Wab/Wabmig Unusual Parent Or Child Processes Sigma (inferred path)
          • Windows Script Interpreter Executing Process via WMI Elastic (inferred path)
          • Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma (inferred path)
          • Windows WMI Impersonate Token Splunk (inferred path)
          • WMI Image Load via Microsoft Office Elastic (inferred path)
          • WMI Incoming Lateral Movement Elastic (inferred path)
          • WMI Persistence - Command Line Event Consumer Sigma
          • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
          • WMI spwaning PowerShell process - WMImplant Sigma (inferred path)
          • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
          • WmiPrvSE Spawned A Process Sigma (inferred path)
          • WmiPrvSE Suspicious Child Process (Sysmon) Splunk (inferred path)
          • WmiPrvSE Suspicious Child Process (Windows Event Log) Splunk (inferred path)
          • Wmiprvse Wbemcomn DLL Hijack Sigma (inferred path)
        • C:\Windows\System32\wbem\wmiutils.dll#
          • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
          • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
          • Library Loaded from a Spoofed Call Stack Elastic (inferred path)
          • MS Scripting Process Loading WMI Module Splunk (inferred path)
          • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
          • Suspicious WMI Image Load from MS Office Elastic (inferred path)
          • Windows Script Interpreter Executing Process via WMI Elastic (inferred path)
          • WMI Image Load via Microsoft Office Elastic (inferred path)
          • WMI module loaded by suspicious process Sigma (inferred path)
          • WMI Module Loaded By Uncommon Process Sigma (inferred path)
      • C:\Windows\System32\wbemcomn.dll#
        • MS Scripting Process Loading WMI Module Splunk (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Wbemprox COM Object Execution Splunk (inferred path)
        • WMI module loaded by suspicious process Sigma (inferred path)
        • WMI Module Loaded By Uncommon Process Sigma (inferred path)
      • C:\Windows\System32\wcmapi.dll#
      • C:\Windows\System32\WcnNetsh.dll#
      • C:\Windows\System32\wdi.dll#
      • C:\Windows\System32\wdscore.dll#
      • C:\Windows\System32\webservices.dll#
      • C:\Windows\System32\wecapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\wer.dll#
        • Creation of WerFault.exe/Wer.dll in Unusual Folder Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\WerFault.exe#
        • Bad Opsec Defaults Sacrificial Processes With Improper Arguments Sigma (inferred path)
        • Creation of WerFault.exe/Wer.dll in Unusual Folder Sigma (inferred path)
        • Credential Dumping Attempt Via WerFault Chronicle (inferred path)
        • Credential Dumping Attempt Via WerFault Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • LSA Dump via Windows Error Reporting Elastic (inferred path)
        • Potential Credential Dumping Via WER Sigma (inferred path)
        • Potential Masquerading as Windows Error Manager Elastic (inferred path)
        • Potential ReflectDebugger Content Execution Via WerFault.EXE Sigma (inferred path)
        • Potential SNAKE Malware Persistence Service Execution Sigma (inferred path)
        • Potential Windows Error Manager Masquerading Elastic (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Suspicious WerFault Child Process Elastic (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • UAC Bypass Using Consent and Comctl32 - Process Sigma (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • WerFault LSASS Process Memory Dump Sigma
        • Windows Error Manager/Reporting Masquerading Elastic (inferred path)
        • Windows Process Injection into Commonly Abused Processes Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\werFault.exe.local#
        • Potential DLL Sideloading Via comctl32.dll Sigma (inferred branch)
      • C:\Windows\System32\WerFaultSecure.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • LSA Dump via Windows Error Reporting Elastic (inferred path)
        • Potential EDR-Freeze via WerFaultSecure Abuse Elastic (inferred path)
        • Potential Masquerading as Windows Error Manager Elastic (inferred path)
        • PPL Tampering Via WerFaultSecure Sigma (inferred path)
        • Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze Sigma (inferred path)
      • C:\Windows\System32\wermgr.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution Sigma (inferred path)
        • Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation Sigma (inferred path)
        • Potential Masquerading as Windows Error Manager Elastic (inferred path)
        • Potential Pikabot C2 Activity Sigma (inferred path)
        • Potential Pikabot Hollowing Activity Sigma (inferred path)
        • Potential Privilege Escalation via RoguePlanet Windows Defender Exploit Elastic (inferred path)
        • Potential Windows Error Manager Masquerading Elastic (inferred path)
        • ShieldBreak: Defender AV Privilege Escalation Kusto (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious Execution Location Of Wermgr.EXE Sigma (inferred path)
        • Trickbot Malware Activity Sigma (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
        • Wermgr Process Spawned CMD Or Powershell Process Splunk (inferred path)
        • Windows App Layer Protocol Qakbot NamedPipe Splunk (inferred path)
        • Windows App Layer Protocol Wermgr Connect To NamedPipe Splunk (inferred path)
        • Windows Error Manager/Reporting Masquerading Elastic (inferred path)
        • Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
        • Windows Process Injection Wermgr Child Process Splunk (inferred path)
        • Windows Uncommon Remote Thread Creation In Browser Process Splunk (inferred path)
        • Windows Wermgr Spawning System Integrity Process Splunk (inferred path)
      • C:\Windows\System32\wermgr.exe.local#
        • Potential DLL Sideloading Via comctl32.dll Sigma (inferred branch)
      • C:\Windows\System32\wevtapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\wevtutil.exe#
        • Clearing Windows Event Logs Elastic (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Disable Logs Using WevtUtil Splunk (inferred path)
        • EventLog Query Requests By Builtin Utilities Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Potentially Suspicious EventLog Recon Activity Using Log Query Utilities Sigma (inferred path)
        • Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution Sigma (inferred path)
        • Rorschach Ransomware Execution Activity Sigma (inferred path)
        • Suspicious Eventlog Clearing or Configuration Change Activity Sigma (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Suspicious wevtutil Usage Splunk (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Windows Eventlog Cleared Via Wevtutil Splunk (inferred path)
        • Windows EventLog Recon Activity Using Log Query Utilities Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
      • C:\Windows\System32\where.exe#
        • Suspicious Where Execution Sigma (inferred path)
      • C:\Windows\System32\whhelper.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\whoami.exe#
        • Enumerate All Information With Whoami.EXE Sigma (inferred path)
        • Group Membership Reconnaissance Via Whoami.EXE Sigma (inferred path)
        • Local Accounts Discovery Chronicle (inferred path)
        • Local Accounts Discovery Sigma (inferred path)
        • Potential Dridex Activity Sigma (inferred path)
        • Potential Process Injection Via Msra.EXE Sigma (inferred path)
        • Qakbot Discovery Activies Kusto (inferred path)
        • Security Privileges Enumeration Via Whoami.EXE Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process Of Veeam Dabatase Sigma (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Electron Application Child Processes Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Processes Spawned by WinRM Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • System User Discovery With Whoami Splunk (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Whoami Process Activity Elastic (inferred path)
        • Whoami.EXE Execution Anomaly Sigma (inferred path)
        • Whoami.EXE Execution From Privileged Process Sigma (inferred path)
        • Whoami.EXE Execution With Output Option Sigma (inferred path)
        • Windows Account or Group Discovery Elastic (inferred path)
        • Windows Cmdline Tool Execution From Non-Shell Process Splunk (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows System User Privilege Discovery Splunk (inferred path)
        • WinRM Spawning a Process Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
      • C:\Windows\System32\wimgapi.dll#
      • C:\Windows\System32\winbio.dll#
      • C:\Windows\System32\winbrand.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\wincredui.dll#
        • CredUI.DLL Loaded By Uncommon Process Sigma (inferred path)
        • Windows Input Capture Using Credential UI Dll Splunk (inferred path)
      • C:\Windows\System32\windows.storage.dll#
      • C:\Windows\System32\Windows.Storage.Search.dll#
      • C:\Windows\System32\Windows.UI.Immersive.dll#
      • C:\Windows\System32\WindowsCodecs.dll#
      • C:\Windows\System32\WindowsCodecsExt.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\WindowsPowerShell#
        • Persistence via PowerShell profile Elastic (inferred branch)
        • C:\Windows\System32\WindowsPowerShell\profile.ps1#
          • PowerShell Profile Modification Sigma (inferred path)
        • C:\Windows\System32\WindowsPowerShell\v1.0#
          • Potential DLL Hijacking via Environment Paths Elastic (inferred branch)
          • Potential Privilege Escalation via Missing DLL Elastic (inferred branch)
          • C:\Windows\System32\WindowsPowerShell\v1.0\en-US\powershell.exe.mui#
            • Command-Line Interface Execution (Windows Event Log) Splunk (inferred path)
            • Copy From Or To Admin Share Or Sysvol Folder Chronicle (inferred path)
            • Copy From Or To Admin Share Or Sysvol Folder Sigma (inferred path)
            • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
          • C:\Windows\System32\WindowsPowerShell\v1.0\Examples\profile.ps1#
            • Persistence via PowerShell profile Elastic (inferred path)
          • C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Dism#
            • C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Dism\Dism.Format.ps1xml#
            • C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Dism\Dism.psd1#
            • C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Dism\Dism.psm1#
            • C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Dism\Dism.Types.ps1xml#
              • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
            • C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Dism\en\Microsoft.Dism.Powershell.Resources.dll#
              • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
            • C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Dism\Microsoft.Dism.PowerShell.dll#
              • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe#
            • AADInternals PowerShell Cmdlets Execution - ProccessCreation Sigma (inferred path)
            • Abused Debug Privilege by Arbitrary Parent Processes Sigma (inferred path)
            • Add Windows Capability Via PowerShell Cmdlet Sigma (inferred path)
            • Always Install Elevated MSI Spawned Cmd And Powershell Sigma (inferred path)
            • AMSI Bypass via PowerShell Elastic (inferred path)
            • Attempt to Disable Windows Defender Services Elastic (inferred path)
            • Axios NPM Compromise File Creation Indicators - Windows Sigma (inferred path)
            • Axios NPM Compromise Indicators - Windows Sigma (inferred path)
            • Azure Run Command Script Child Process Elastic (inferred path)
            • Backup Files Deleted Sigma (inferred path)
            • Binary Proxy Execution via Pester Elastic (inferred path)
            • Bitsadmin Activity Elastic (inferred path)
            • Change PowerShell Policies to an Insecure Level Sigma (inferred path)
            • ChromeLoader Malware Execution Sigma (inferred path)
            • Clearing Windows Console History Elastic (inferred path)
            • Clearing Windows Event Logs Elastic (inferred path)
            • Cloud Instance Metadata Credential Path HTTP Request Elastic (inferred path)
            • Command and Scripting Interpreter from Suspicious Parent Elastic (inferred path)
            • Command and Scripting Interpreter via Windows Scripts Elastic (inferred path)
            • Command Execution via SolarWinds Process Elastic (inferred path)
            • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
            • Command Shell Activity Started via RunDLL32 Elastic (inferred path)
            • Command-Line Interface Execution (Windows Event Log) Splunk (inferred path)
            • Computer Discovery And Export Via Get-ADComputer Cmdlet Sigma (inferred path)
            • Connection to a Suspicious URL Elastic (inferred path)
            • ConvertTo-SecureString Cmdlet Usage Via CommandLine Chronicle (inferred path)
            • ConvertTo-SecureString Cmdlet Usage Via CommandLine Sigma (inferred path)
            • Copy From Or To Admin Share Or Sysvol Folder Chronicle (inferred path)
            • Copy From Or To Admin Share Or Sysvol Folder Sigma (inferred path)
            • Create Remote Thread In Shell Application Splunk (inferred path)
            • Creation of Shadow Copy with wmic and powershell Splunk (inferred path)
            • Creation or Modification of Root Certificate Elastic (inferred path)
            • Csc.EXE Execution Form Potentially Suspicious Parent Sigma (inferred path)
            • Cscript/Wscript Potentially Suspicious Child Process Sigma (inferred path)
            • CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) Sigma (inferred path)
            • CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process Sigma (inferred path)
            • Deimos Component Execution Kusto (inferred path)
            • Detect Suspicious Commands Initiated by Webserver Processes Kusto (inferred path)
            • Dev-0270 Malicious Powershell usage Kusto (inferred path)
            • Disable Windows Defender AV Security Monitoring Sigma (inferred path)
            • Disable Windows Event and Security Logs Using Built-in Tools Elastic (inferred path)
            • Disabling Windows Defender Security Settings via PowerShell Elastic (inferred path)
            • Doppelpaymer Stop Services Kusto (inferred path)
            • Download Activity via a Headless Browser Elastic (inferred path)
            • Elevated System Shell Spawned Sigma (inferred path)
            • Elevated System Shell Spawned From Uncommon Parent Location Sigma (inferred path)
            • Email Exifiltration Via Powershell Sigma (inferred path)
            • Embedded Executable via Windows Shortcut File Elastic (inferred path)
            • Emotet Loader Execution Via .LNK File Sigma (inferred path)
            • Encoded Powershell Execution via MsiExec Elastic (inferred path)
            • Evasion via Device Credential Deployment Elastic (inferred path)
            • Exchange PowerShell Snap-Ins Usage Sigma (inferred path)
            • Execute Code with Pester.bat Sigma (inferred path)
            • Execute Code with Pester.bat as Parent Sigma (inferred path)
            • Execution from a Downloaded ISO File Elastic (inferred path)
            • Execution of a Downloaded Windows Script Elastic (inferred path)
            • Execution of Powershell Script in Public Folder Sigma (inferred path)
            • Execution via Obfuscated PowerShell Script Elastic (inferred path)
            • Execution via OpenClaw Agent Elastic (inferred path)
            • Execution via SyncAppvPublishingServer Elastic (inferred path)
            • Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process Sigma (inferred path)
            • Exploited CVE-2020-10189 Zoho ManageEngine Sigma (inferred path)
            • Exporting Exchange Mailbox via PowerShell Elastic (inferred path)
            • FakeUpdates/SocGholish Activity Sigma (inferred path)
            • File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell Sigma (inferred path)
            • File or Directory Deletion Command Elastic (inferred path)
            • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
            • GenAI Process Performing Encoding/Chunking Prior to Network Activity Elastic (inferred path)
            • Get ADDefaultDomainPasswordPolicy with Powershell Splunk (inferred path)
            • Get WMIObject Group Discovery Splunk (inferred path)
            • Get-ForestTrust with PowerShell Splunk (inferred path)
            • GetAdComputer with PowerShell Splunk (inferred path)
            • GetAdGroup with PowerShell Splunk (inferred path)
            • GetCurrent User with PowerShell Splunk (inferred path)
            • GetDomainComputer with PowerShell Splunk (inferred path)
            • GetDomainController with PowerShell Splunk (inferred path)
            • GetDomainGroup with PowerShell Splunk (inferred path)
            • GetLocalUser with PowerShell Splunk (inferred path)
            • GetNetTcpconnection with PowerShell Splunk (inferred path)
            • GetWmiObject Ds Computer with PowerShell Splunk (inferred path)
            • GetWmiObject Ds Group with PowerShell Splunk (inferred path)
            • GetWmiObject DS User with PowerShell Splunk (inferred path)
            • GetWmiObject User Account with PowerShell Splunk (inferred path)
            • HackTool - CrackMapExec PowerShell Obfuscation Sigma (inferred path)
            • HackTool - Default PowerSploit/Empire Scheduled Task Creation Sigma (inferred path)
            • HackTool - Powerup Write Hijack DLL Sigma (inferred path)
            • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
            • Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine Sigma (inferred path)
            • Identify Mango Sandstorm powershell commands Kusto (inferred path)
            • IIS WebServer Log Deletion via CommandLine Utilities Sigma (inferred path)
            • Import New Module Via PowerShell CommandLine Sigma (inferred path)
            • Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace Sigma (inferred path)
            • Keystrokes Input Capture via PowerShell Elastic (inferred path)
            • LOL-Binary Copied From System Directory Sigma (inferred path)
            • LSA PPL Protection Setting Modification via CommandLine Sigma (inferred path)
            • LSASS credential dump with LSASSY (process) Sigma (inferred path)
            • Malicious Base64 Encoded PowerShell Keywords in Command Lines Sigma (inferred path)
            • Malicious PowerShell Process - Encoded Command Splunk (inferred path)
            • Malicious PowerShell Process - Execution Policy Bypass Splunk (inferred path)
            • Malicious PowerShell Process With Obfuscation Techniques Splunk (inferred path)
            • Managed .NET Code Execution via PowerShell Elastic (inferred path)
            • Manual Execution of Script Inside of a Compressed File Sigma (inferred path)
            • Microsoft Exchange Worker Spawning Suspicious Processes Elastic (inferred path)
            • Microsoft Office File Execution via Script Interpreter Elastic (inferred path)
            • Mint Sandstorm - AsperaFaspex Suspicious Process Execution Sigma (inferred path)
            • Mint Sandstorm - ManageEngine Suspicious Process Execution Sigma (inferred path)
            • MMC Spawning Windows Shell Sigma (inferred path)
            • Net WebClient Casing Anomalies Sigma (inferred path)
            • Network Connection Initiated By PowerShell Process Sigma (inferred path)
            • Network Connection via Startup Item Elastic (inferred path)
            • New ActiveSyncAllowedDeviceID Added via PowerShell Elastic (inferred path)
            • New BITS Job Created Via PowerShell Sigma (inferred path)
            • New DMSA Service Account Created in Specific OUs Sigma (inferred path)
            • New User Account Creation Attempt Via ADSI in CommandLine Sigma (inferred path)
            • New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet Sigma (inferred path)
            • Nishang PowershellTCPOneLine Splunk (inferred path)
            • Non Interactive PowerShell Process Spawned Sigma (inferred path)
            • Nslookup PowerShell Download Cradle - ProcessCreation Sigma (inferred path)
            • NTDS or SAM Database File Copied Elastic (inferred path)
            • NTDS.DIT Creation By Uncommon Parent Process Sigma (inferred path)
            • NTDS.DIT Creation By Uncommon Process Sigma (inferred path)
            • Obfuscated PowerShell MSI Install via WindowsInstaller COM Sigma (inferred path)
            • Obfuscated PowerShell OneLiner Execution Sigma (inferred path)
            • OneNote.EXE Execution of Malicious Embedded Scripts Sigma (inferred path)
            • Outbound Scheduled Task Activity via PowerShell Elastic (inferred path)
            • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
            • Pikabot Fake DLL Extension Execution Via Rundll32.EXE Sigma (inferred path)
            • Possible Lateral Movement PowerShell Spawn Splunk (inferred path)
            • Potential Active Directory Enumeration Using AD Module - ProcCreation Sigma (inferred path)
            • Potential Binary Or Script Dropper Via PowerShell Sigma (inferred path)
            • Potential ClickFix Attack via Windows Terminal Elastic (inferred path)
            • Potential Command Shell via NetCat Elastic (inferred path)
            • Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image Sigma (inferred path)
            • Potential Credential Dumping Attempt Via PowerShell Sigma (inferred path)
            • Potential Credential Dumping Attempt Via PowerShell Remote Thread Sigma (inferred path)
            • Potential CVE-2021-41379 Exploitation Attempt Sigma (inferred path)
            • Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution Sigma (inferred path)
            • Potential CVE-2022-29072 Exploitation Attempt Sigma (inferred path)
            • Potential CVE-2023-21554 QueueJumper Exploitation Sigma (inferred path)
            • Potential Data Exfiltration Activity Via CommandLine Tools Sigma (inferred path)
            • Potential Encoded PowerShell Patterns In CommandLine Sigma (inferred path)
            • Potential Execution via VS Code Tasks Elastic (inferred path)
            • Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) Sigma (inferred path)
            • Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group Sigma (inferred path)
            • Potential Exploitation of GoAnywhere MFT Vulnerability Sigma (inferred path)
            • Potential Fake CAPTCHA Phishing Attack Elastic (inferred path)
            • Potential File Download via a Headless Browser Elastic (inferred path)
            • Potential File Transfer via Curl for Windows Elastic (inferred path)
            • Potential IIS Web Shell File Creation Elastic (inferred path)
            • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
            • Potential Initial Access via DLL Search Order Hijacking Sigma (inferred path)
            • Potential Payload Download via Finger LOLBin Elastic (inferred path)
            • Potential Pentesting PowerShell Script Elastic (inferred path)
            • Potential PowerShell Command Line Obfuscation Sigma (inferred path)
            • Potential PowerShell Downgrade Attack Sigma (inferred path)
            • Potential PowerShell Empire Execution Elastic (inferred path)
            • Potential PowerShell Obfuscation Via Reversed Commands Sigma (inferred path)
            • Potential Powershell ReverseShell Connection Sigma (inferred path)
            • Potential Proxy Execution Via Explorer.EXE From Shell Process Sigma (inferred path)
            • Potential Qakbot Rundll32 Execution Sigma (inferred path)
            • Potential Remote Install via MsiExec Elastic (inferred path)
            • Potential Reverse Shell via Java Elastic (inferred path)
            • Potential Reverse Shell via Powershell Elastic (inferred path)
            • Potential SAP NetWeaver Exploitation Elastic (inferred path)
            • Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 Sigma (inferred path)
            • Potential SharpRDP Behavior Elastic (inferred path)
            • Potential Shell Execution via NetCat Elastic (inferred path)
            • Potential Startup Shortcut Persistence Via PowerShell.EXE Sigma (inferred path)
            • Potential Suspicious Child Process Of 3CXDesktopApp Sigma (inferred path)
            • Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell Sigma (inferred path)
            • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
            • Potentially Suspicious Child Process Of DiskShadow.EXE Sigma (inferred path)
            • Potentially Suspicious Child Process of KeyScrambler.exe Sigma (inferred path)
            • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
            • Potentially Suspicious Child Process Of VsCode Sigma (inferred path)
            • Potentially Suspicious Child Process Of WinRAR.EXE Sigma (inferred path)
            • Potentially Suspicious Child Processes Spawned by ConHost Sigma (inferred path)
            • Potentially Suspicious DMP/HDMP File Creation Sigma (inferred path)
            • Potentially Suspicious Execution From Parent Process In Public Folder Sigma (inferred path)
            • Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE Sigma (inferred path)
            • Potentially Suspicious Mofcomp Execution Sigma (inferred path)
            • Potentially Suspicious NTFS Symlink Behavior Modification Sigma (inferred path)
            • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
            • Potentially Suspicious Powershell Script Execution From Temp Folder Sigma (inferred path)
            • Potentially Suspicious WebDAV LNK Execution Sigma (inferred path)
            • Potentially Suspicious Windows App Activity Sigma (inferred path)
            • PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy Sigma (inferred path)
            • PowerShell Base64 Encoded Invoke Keyword Sigma (inferred path)
            • PowerShell Base64 Encoded WMI Classes Sigma (inferred path)
            • Powershell Defender Threat Actions Set to Allow Splunk (inferred path)
            • Powershell Disable Security Monitoring Splunk (inferred path)
            • PowerShell Download Pattern Sigma (inferred path)
            • PowerShell Empire Script Execution Elastic (inferred path)
            • PowerShell Encoded Command Execution (Living off the Land) Kusto (inferred path)
            • Powershell Execution via Named Pipe Elastic (inferred path)
            • PowerShell Execution With Potential Decryption Capabilities Sigma (inferred path)
            • PowerShell Get LocalGroup Discovery Splunk (inferred path)
            • PowerShell Module File Created Sigma (inferred path)
            • PowerShell MSI Install via WindowsInstaller COM From Remote Location Sigma (inferred path)
            • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
            • PowerShell Script Change Permission Via Set-Acl Sigma (inferred path)
            • PowerShell Script Dropped Via PowerShell.EXE Sigma (inferred path)
            • PowerShell Script with Passwords Vault Access Capability Elastic (inferred path)
            • PowerShell Script with Screen Capture Capability Elastic (inferred path)
            • PowerShell Set-Acl On Windows Folder Sigma (inferred path)
            • PowerShell Start-BitsTransfer Splunk (inferred path)
            • Private Keys Reconnaissance Via CommandLine Tools Sigma (inferred path)
            • Privilege Escalation via Named Pipe Impersonation Elastic (inferred path)
            • Privilege Escalation via Named Pipe Impersonation Elastic (inferred path)
            • Privilege Escalation via Named Pipe Impersonation Sigma (inferred path)
            • Probable AdFind Recon Tool Usage Kusto (inferred path)
            • Process Activity via Compiled HTML File Elastic (inferred path)
            • Process Discovery Using Built-in Tools Elastic (inferred path)
            • Process Execution with Unusual File Extension Elastic (inferred path)
            • Protected Process from Unusual Parent Elastic (inferred path)
            • Qakbot Rundll32 Exports Execution Sigma (inferred path)
            • Qakbot Rundll32 Fake DLL Extension Execution Sigma (inferred path)
            • RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class Sigma (inferred path)
            • RedSun - Conhost.exe Spawned by TieringEngineService.exe Sigma (inferred path)
            • Registry Modification of MS-settings Protocol Handler Sigma (inferred path)
            • Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
            • Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions Sigma (inferred path)
            • Remote Access Tool - MeshAgent Command Execution via MeshCentral Sigma (inferred path)
            • Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution Sigma (inferred path)
            • Remote File Copy to a Hidden Share Elastic (inferred path)
            • Remote File Download via PowerShell Elastic (inferred path)
            • Remote Process Instantiation via DCOM and PowerShell Splunk (inferred path)
            • Remote Process Instantiation via WinRM and PowerShell Splunk (inferred path)
            • Remote Process Instantiation via WMI and PowerShell Splunk (inferred path)
            • Remote Thread Created In Shell Application Sigma (inferred path)
            • Remote Thread Creation Via PowerShell Sigma (inferred path)
            • Remote Thread Creation Via PowerShell In Uncommon Target Sigma (inferred path)
            • Resize ShadowStorage volume Splunk (inferred path)
            • Run PowerShell Script from ADS Sigma (inferred path)
            • Run PowerShell Script from Redirected Input Stream Sigma (inferred path)
            • Scheduled Task Created by a Windows Script Elastic (inferred path)
            • Scheduled Task Creation via Unsigned Parent Elastic (inferred path)
            • ScreenConnect Server Spawning Suspicious Processes Elastic (inferred path)
            • Script Event Consumer Spawning Process Sigma (inferred path)
            • Scripting or Unsigned Binary Performing DNS Lookups to Ethereum RPC Providers Elastic (inferred path)
            • Scripting/CommandLine Process Spawned Regsvr32 Sigma (inferred path)
            • Sdiagnhost Calling Suspicious Child Process Sigma (inferred path)
            • Security Event Logging Disabled via MiniNt Registry Key - Process Sigma (inferred path)
            • Serpent Backdoor Payload Execution Via Scheduled Task Sigma (inferred path)
            • Service Control Spawned via Script Interpreter Elastic (inferred path)
            • Service StartupType Change Via PowerShell Set-Service Sigma (inferred path)
            • Shadow Copies Creation Using Operating Systems Utilities Sigma (inferred path)
            • Shadow Copies Deletion Using Operating Systems Utilities Sigma (inferred path)
            • Shell Execution via Windows Shortcut File Elastic (inferred path)
            • Shell Process Spawned by Java.EXE Sigma (inferred path)
            • Shellcode Injection via PowerShell Elastic (inferred path)
            • Startup Persistence by a Suspicious Process Elastic (inferred path)
            • Sticky key file created from CMD copy Sigma (inferred path)
            • Sticky Key Like Backdoor Execution Sigma (inferred path)
            • Stop Windows Service Via PowerShell Stop-Service Sigma (inferred path)
            • Suspicious API Call from a PowerShell Script Elastic (inferred path)
            • Suspicious ArcSOC.exe Child Process Sigma (inferred path)
            • Suspicious BitLocker Access Agent Update Utility Execution Sigma (inferred path)
            • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
            • Suspicious Child Process Of BgInfo.EXE Sigma (inferred path)
            • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
            • Suspicious Child Process of Notepad++ Updater - GUP.Exe Sigma (inferred path)
            • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
            • Suspicious Child Process of SAP NetWeaver Sigma (inferred path)
            • Suspicious Child Process Of SQL Server Sigma (inferred path)
            • Suspicious Child Process Of Veeam Dabatase Sigma (inferred path)
            • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
            • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
            • Suspicious Chromium Browser Instance Executed With Custom Extension Sigma (inferred path)
            • Suspicious Copy From or To System Directory Sigma (inferred path)
            • Suspicious Copy on System32 Splunk (inferred path)
            • Suspicious CrushFTP Child Process Sigma (inferred path)
            • Suspicious Electron Application Child Processes Sigma (inferred path)
            • Suspicious Encoded PowerShell Command Line Sigma (inferred path)
            • Suspicious Eventlog Clearing or Configuration Change Activity Sigma (inferred path)
            • Suspicious Execution from a Mounted Device Elastic (inferred path)
            • Suspicious Execution from a Mounted Device Elastic (inferred path)
            • Suspicious Execution of Powershell with Base64 Sigma (inferred path)
            • Suspicious Execution via Compiled HTML File Elastic (inferred path)
            • Suspicious Execution via Microsoft Exchange Transport Agent Elastic (inferred path)
            • Suspicious Execution with NodeJS Elastic (inferred path)
            • Suspicious Explorer Child Process Elastic (inferred path)
            • Suspicious File Write to SharePoint Layouts Directory Sigma (inferred path)
            • Suspicious IIS Module Registration Sigma (inferred path)
            • Suspicious ImageLoad from an ISO Mounted Device Elastic (inferred path)
            • Suspicious Instance Metadata Service (IMDS) API Command Line Execution Elastic (inferred path)
            • Suspicious Invoke-WebRequest Execution Chronicle (inferred path)
            • Suspicious Invoke-WebRequest Execution Sigma (inferred path)
            • Suspicious Invoke-WebRequest Execution With DirectIP Sigma (inferred path)
            • Suspicious Kerberos Ticket Request via CLI Sigma (inferred path)
            • Suspicious Microsoft Diagnostics Wizard Execution Elastic (inferred path)
            • Suspicious Microsoft Office Child Process Sigma (inferred path)
            • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
            • Suspicious MS Outlook Child Process Elastic (inferred path)
            • Suspicious MSDT Parent Process Sigma (inferred path)
            • Suspicious MSHTA Child Process Sigma (inferred path)
            • Suspicious mshta child process Splunk (inferred path)
            • Suspicious Mshta.EXE Execution Patterns Sigma (inferred path)
            • Suspicious MsiExec Embedding Parent Sigma (inferred path)
            • Suspicious Outlook Child Process Sigma (inferred path)
            • Suspicious Oversized Script Execution Elastic (inferred path)
            • Suspicious PDF Reader Child Process Elastic (inferred path)
            • Suspicious PHP Script Execution Elastic (inferred path)
            • Suspicious PowerShell Console History Deletion Elastic (inferred path)
            • Suspicious PowerShell Download and Execution via Windows Terminal Elastic (inferred path)
            • Suspicious PowerShell Downloads Elastic (inferred path)
            • Suspicious PowerShell Encoded Command Patterns Sigma (inferred path)
            • Suspicious PowerShell Execution Elastic (inferred path)
            • Suspicious PowerShell Execution via Windows Scripts Elastic (inferred path)
            • Suspicious PowerShell IEX Execution Patterns Sigma (inferred path)
            • Suspicious PowerShell Invocation From Script Engines Sigma (inferred path)
            • Suspicious PowerShell Parameter Substring Sigma (inferred path)
            • Suspicious PowerShell Parent Process Sigma (inferred path)
            • Suspicious Powershell via Windows Power User Menu Elastic (inferred path)
            • Suspicious Process By Web Server Process Sigma (inferred path)
            • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
            • Suspicious Processes Spawned by WinRM Sigma (inferred path)
            • Suspicious Provlaunch.EXE Child Process Sigma (inferred path)
            • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
            • Suspicious Serv-U Process Pattern Sigma (inferred path)
            • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
            • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
            • Suspicious SolarWinds Web Help Desk Java Module Load or Child Process Elastic (inferred path)
            • Suspicious Spool Service Child Process Sigma (inferred path)
            • Suspicious Uninstall of Windows Defender Feature via PowerShell Sigma (inferred path)
            • Suspicious Use of CSharp Interactive Console Sigma (inferred path)
            • Suspicious Velociraptor Child Process Sigma (inferred path)
            • Suspicious Windows Defender Exclusions Added via PowerShell Elastic (inferred path)
            • Suspicious Windows Powershell Arguments Elastic (inferred path)
            • Suspicious Windows Service Tampering Sigma (inferred path)
            • Suspicious XOR Encoded PowerShell Command Sigma (inferred path)
            • Suspicious Zoom Child Process Elastic (inferred path)
            • Symbolic Link to Shadow Copy Created Elastic (inferred path)
            • System File Execution Location Anomaly Sigma (inferred path)
            • System Information Discovery via Registry Queries Sigma (inferred path)
            • System Restore Registry Modification via CommandLine Sigma (inferred path)
            • System Shells via Services Elastic (inferred path)
            • System Utility Execution from Unbacked Memory Elastic (inferred path)
            • Unsigned AppX Installation Attempt Using Add-AppxPackage Sigma (inferred path)
            • Unusual File Creation - Alternate Data Stream Elastic (inferred path)
            • Unusually Long PowerShell CommandLine Sigma (inferred path)
            • User Discovery And Export Via Get-ADUser Cmdlet Sigma (inferred path)
            • User Discovery With Env Vars PowerShell Splunk (inferred path)
            • User Shell Folders Registry Modification via CommandLine Sigma (inferred path)
            • Visual Studio Code Tunnel Shell Execution Sigma (inferred path)
            • VMToolsd Suspicious Child Process Sigma (inferred path)
            • Volume Shadow Copy Deletion via PowerShell Elastic (inferred path)
            • Vulnerable Driver Blocklist Registry Tampering Via CommandLine Sigma (inferred path)
            • Web or Application Server Spawning a Shell Splunk (inferred path)
            • Webshell Detection With Command Line Keywords Sigma (inferred path)
            • Wermgr Process Spawned CMD Or Powershell Process Splunk (inferred path)
            • Windows Account Access Removal via Logoff Exec Splunk (inferred path)
            • Windows Alternate DataStream - Process Execution Splunk (inferred path)
            • Windows AMSI Related Registry Tampering Via CommandLine Sigma (inferred path)
            • Windows Change File Association Command To Notepad Splunk (inferred path)
            • Windows Credential Guard Registry Tampering Via CommandLine Sigma (inferred path)
            • Windows Crowdstrike RTR Script Execution Splunk (inferred path)
            • Windows Defender Context Menu Removed Sigma (inferred path)
            • Windows Defender Exclusions Added via PowerShell Elastic (inferred path)
            • Windows Defender Exclusions by Extension Elastic (inferred path)
            • Windows DLL Search Order Hijacking with iscsicpl Splunk (inferred path)
            • Windows EventLog Autologger Session Registry Modification Via CommandLine Sigma (inferred path)
            • Windows EventLog Recon Activity Using Log Query Utilities Splunk (inferred path)
            • Windows Explorer LNK Exploit Process Launch With Padding Splunk (inferred path)
            • Windows Explorer.exe Spawning PowerShell or Cmd Splunk (inferred path)
            • Windows File Download Via PowerShell Splunk (inferred path)
            • Windows Firewall Disabled via PowerShell Elastic (inferred path)
            • Windows Firewall Disabled via PowerShell Sigma (inferred path)
            • Windows Impair Defense Add Xml Applocker Rules Splunk (inferred path)
            • Windows Masquerading Explorer As Child Process Splunk (inferred path)
            • Windows MOF Event Triggered Execution via WMI Splunk (inferred path)
            • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
            • Windows Office Product Spawned Uncommon Process Splunk (inferred path)
            • Windows PaperCut NG Spawn Shell Splunk (inferred path)
            • Windows PowerShell FakeCAPTCHA Clipboard Execution Splunk (inferred path)
            • Windows PowerShell Process Implementing Manual Base64 Decoder Splunk (inferred path)
            • Windows PowerShell Process With Malicious String Splunk (inferred path)
            • Windows Powershell RemoteSigned File Splunk (inferred path)
            • Windows PowerShell Script From WindowsApps Directory Splunk (inferred path)
            • Windows PowGoop Beacon Decoding Splunk (inferred path)
            • Windows Private Keys Discovery Splunk (inferred path)
            • Windows Process Injection Remote Thread Splunk (inferred path)
            • Windows Remote Assistance Spawning Process Splunk (inferred path)
            • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
            • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
            • Windows Scheduled Task Service Spawned Shell Splunk (inferred path)
            • Windows Script Executing PowerShell Elastic (inferred path)
            • Windows Script Execution from Archive File Elastic (inferred path)
            • Windows Server Update Service Spawning Suspicious Processes Elastic (inferred path)
            • Windows Shell or Script Execution From IIS Directory Splunk (inferred path)
            • Windows Shell Process from CrushFTP Splunk (inferred path)
            • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
            • Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma (inferred path)
            • Windows Sqlservr Spawning Shell Splunk (inferred path)
            • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
            • Windows Suspicious Child Process of TieringEngineService.exe Splunk (inferred path)
            • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
            • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
            • Windows Terminal Profile Settings Modification By Uncommon Process Sigma (inferred path)
            • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
            • Windows WSUS Spawning Shell Splunk (inferred path)
            • WinRAR Spawning Shell Application Splunk (inferred path)
            • WinRM Spawning a Process Splunk (inferred path)
            • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
            • WMI spwaning PowerShell process - WMImplant Sigma (inferred path)
            • WSL Child Process Anomaly Sigma (inferred path)
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config#
            • Command-Line Interface Execution (Windows Event Log) Splunk (inferred path)
            • Copy From Or To Admin Share Or Sysvol Folder Chronicle (inferred path)
            • Copy From Or To Admin Share Or Sysvol Folder Sigma (inferred path)
            • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe#
            • AADInternals PowerShell Cmdlets Execution - ProccessCreation Sigma (inferred path)
            • Change PowerShell Policies to an Insecure Level Sigma (inferred path)
            • Clearing Windows Console History Elastic (inferred path)
            • Clearing Windows Event Logs Elastic (inferred path)
            • Command and Scripting Interpreter via Windows Scripts Elastic (inferred path)
            • Copy From Or To Admin Share Or Sysvol Folder Sigma (inferred path)
            • Create Remote Thread In Shell Application Splunk (inferred path)
            • Creation of Shadow Copy with wmic and powershell Splunk (inferred path)
            • Disable Windows Event and Security Logs Using Built-in Tools Elastic (inferred path)
            • Disabling Windows Defender Security Settings via PowerShell Elastic (inferred path)
            • Elevated System Shell Spawned Sigma (inferred path)
            • Elevated System Shell Spawned From Uncommon Parent Location Sigma (inferred path)
            • Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process Sigma (inferred path)
            • Exporting Exchange Mailbox via PowerShell Elastic (inferred path)
            • Get ADDefaultDomainPasswordPolicy with Powershell Splunk (inferred path)
            • GetWmiObject Ds Computer with PowerShell Splunk (inferred path)
            • GetWmiObject Ds Group with PowerShell Splunk (inferred path)
            • GetWmiObject DS User with PowerShell Splunk (inferred path)
            • IIS WebServer Log Deletion via CommandLine Utilities Sigma (inferred path)
            • LSASS credential dump with LSASSY (process) Sigma (inferred path)
            • Malicious PowerShell Process - Encoded Command Splunk (inferred path)
            • Malicious PowerShell Process - Execution Policy Bypass Splunk (inferred path)
            • Malicious PowerShell Process With Obfuscation Techniques Splunk (inferred path)
            • Microsoft Exchange Worker Spawning Suspicious Processes Elastic (inferred path)
            • Mint Sandstorm - AsperaFaspex Suspicious Process Execution Sigma (inferred path)
            • Mint Sandstorm - ManageEngine Suspicious Process Execution Sigma (inferred path)
            • New ActiveSyncAllowedDeviceID Added via PowerShell Elastic (inferred path)
            • New DMSA Service Account Created in Specific OUs Sigma (inferred path)
            • New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet Sigma (inferred path)
            • Nishang PowershellTCPOneLine Splunk (inferred path)
            • Obfuscated PowerShell MSI Install via WindowsInstaller COM Sigma (inferred path)
            • Outbound Scheduled Task Activity via PowerShell Elastic (inferred path)
            • Potential Binary Or Script Dropper Via PowerShell Sigma (inferred path)
            • Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image Sigma (inferred path)
            • Potential Data Exfiltration Activity Via CommandLine Tools Sigma (inferred path)
            • Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) Sigma (inferred path)
            • Potential Exploitation of GoAnywhere MFT Vulnerability Sigma (inferred path)
            • Potentially Suspicious Child Processes Spawned by ConHost Sigma (inferred path)
            • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
            • Potentially Suspicious Windows App Activity Sigma (inferred path)
            • Powershell Defender Threat Actions Set to Allow Splunk (inferred path)
            • Powershell Disable Security Monitoring Splunk (inferred path)
            • PowerShell Download Pattern Sigma (inferred path)
            • PowerShell MSI Install via WindowsInstaller COM From Remote Location Sigma (inferred path)
            • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
            • PowerShell Start-BitsTransfer Splunk (inferred path)
            • Process Activity via Compiled HTML File Elastic (inferred path)
            • RedSun - Conhost.exe Spawned by TieringEngineService.exe Sigma (inferred path)
            • Remote File Download via PowerShell Elastic (inferred path)
            • Remote Process Instantiation via DCOM and PowerShell Splunk (inferred path)
            • Remote Process Instantiation via WinRM and PowerShell Splunk (inferred path)
            • Remote Process Instantiation via WMI and PowerShell Splunk (inferred path)
            • Resize ShadowStorage volume Splunk (inferred path)
            • Scheduled Task Created by a Windows Script Elastic (inferred path)
            • ScreenConnect Server Spawning Suspicious Processes Elastic (inferred path)
            • Scripting/CommandLine Process Spawned Regsvr32 Sigma (inferred path)
            • Security Event Logging Disabled via MiniNt Registry Key - Process Sigma (inferred path)
            • Shellcode Injection via PowerShell Elastic (inferred path)
            • Sticky key file created from CMD copy Sigma (inferred path)
            • Suspicious API Call from a PowerShell Script Elastic (inferred path)
            • Suspicious BitLocker Access Agent Update Utility Execution Sigma (inferred path)
            • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
            • Suspicious Child Process of SAP NetWeaver Sigma (inferred path)
            • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
            • Suspicious CrushFTP Child Process Sigma (inferred path)
            • Suspicious Eventlog Clearing or Configuration Change Activity Sigma (inferred path)
            • Suspicious File Write to SharePoint Layouts Directory Sigma (inferred path)
            • Suspicious Invoke-WebRequest Execution Sigma (inferred path)
            • Suspicious Invoke-WebRequest Execution With DirectIP Sigma (inferred path)
            • Suspicious Process By Web Server Process Sigma (inferred path)
            • Suspicious Uninstall of Windows Defender Feature via PowerShell Sigma (inferred path)
            • Suspicious Use of CSharp Interactive Console Sigma (inferred path)
            • Suspicious Velociraptor Child Process Sigma (inferred path)
            • Suspicious Windows Service Tampering Sigma (inferred path)
            • Suspicious Zoom Child Process Elastic (inferred path)
            • System File Execution Location Anomaly Sigma (inferred path)
            • System Shells via Services Elastic (inferred path)
            • Volume Shadow Copy Deletion via PowerShell Elastic (inferred path)
            • Web or Application Server Spawning a Shell Splunk (inferred path)
            • Wermgr Process Spawned CMD Or Powershell Process Splunk (inferred path)
            • Windows Alternate DataStream - Process Execution Splunk (inferred path)
            • Windows Change File Association Command To Notepad Splunk (inferred path)
            • Windows Defender Context Menu Removed Sigma (inferred path)
            • Windows Defender Exclusions Added via PowerShell Elastic (inferred path)
            • Windows DLL Search Order Hijacking with iscsicpl Splunk (inferred path)
            • Windows EventLog Recon Activity Using Log Query Utilities Splunk (inferred path)
            • Windows Explorer.exe Spawning PowerShell or Cmd Splunk (inferred path)
            • Windows File Download Via PowerShell Splunk (inferred path)
            • Windows Firewall Disabled via PowerShell Elastic (inferred path)
            • Windows Firewall Disabled via PowerShell Sigma (inferred path)
            • Windows Impair Defense Add Xml Applocker Rules Splunk (inferred path)
            • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
            • Windows PaperCut NG Spawn Shell Splunk (inferred path)
            • Windows PowerShell FakeCAPTCHA Clipboard Execution Splunk (inferred path)
            • Windows PowerShell Process Implementing Manual Base64 Decoder Splunk (inferred path)
            • Windows PowerShell Process With Malicious String Splunk (inferred path)
            • Windows Powershell RemoteSigned File Splunk (inferred path)
            • Windows PowerShell Script From WindowsApps Directory Splunk (inferred path)
            • Windows Remote Assistance Spawning Process Splunk (inferred path)
            • Windows Server Update Service Spawning Suspicious Processes Elastic (inferred path)
            • Windows Shell Process from CrushFTP Splunk (inferred path)
            • Windows Sqlservr Spawning Shell Splunk (inferred path)
            • Windows WSUS Spawning Shell Splunk (inferred path)
            • WinRAR Spawning Shell Application Splunk (inferred path)
            • WMI spwaning PowerShell process - WMImplant Sigma (inferred path)
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe.config#
            • Copy From Or To Admin Share Or Sysvol Folder Sigma (inferred path)
          • C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1#
            • PowerShell Profile Modification Sigma (inferred path)
          • C:\Windows\System32\WindowsPowerShell\v1.0\System.Memory.dll#
          • C:\Windows\System32\WindowsPowerShell\v1.0\System.Numerics.Vectors.dll#
          • C:\Windows\System32\WindowsPowerShell\v1.0\System.Runtime.CompilerServices.Unsafe.dll#
          • C:\Windows\System32\WindowsPowerShell\v1.0\System.Security.Principal.Windows.dll#
            • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
      • C:\Windows\System32\windowsudk.shellcommon.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\winevt\Logs#
        • EventLog EVTX File Deleted Sigma (inferred branch)
      • C:\Windows\System32\winhttp.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Load from a Truncated Stack Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • Library Loaded from a Spoofed Call Stack Elastic (inferred path)
        • Library Loaded via a Worker Callback Elastic (inferred path)
        • Network Activity from a Reflected Process Elastic (inferred path)
        • Network Activity from a Stomped Module Elastic (inferred path)
        • Network Activity from Modified Module Elastic (inferred path)
        • Network Library Load via LdrLoadDLL Elastic (inferred path)
        • Network Module Loaded from Suspicious Unbacked Memory Elastic (inferred path)
        • Potential Injection via Module Stomping Elastic (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Rundll32 or Regsvr32 Loaded a DLL from Unbacked Memory Elastic (inferred path)
        • Suspicious Activity from a Control Panel Applet Elastic (inferred path)
        • Suspicious Call Stack Trailing Bytes Elastic (inferred path)
        • Suspicious Network Library Load Elastic (inferred path)
        • Suspicious Network Module LoadLibrary Elastic (inferred path)
        • Suspicious Unsigned DLL Loaded by a Trusted Process Elastic (inferred path)
      • C:\Windows\System32\wininet.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Load from a Truncated Stack Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • Library Loaded from a Spoofed Call Stack Elastic (inferred path)
        • Library Loaded via a Worker Callback Elastic (inferred path)
        • Module Stomping from a Copied Library Elastic (inferred path)
        • Network Activity from a Reflected Process Elastic (inferred path)
        • Network Activity from a Stomped Module Elastic (inferred path)
        • Network Activity from Modified Module Elastic (inferred path)
        • Network Library Load via LdrLoadDLL Elastic (inferred path)
        • Network Module Loaded from Suspicious Unbacked Memory Elastic (inferred path)
        • Potential Injection via Module Stomping Elastic (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Rundll32 or Regsvr32 Loaded a DLL from Unbacked Memory Elastic (inferred path)
        • Suspicious Activity from a Control Panel Applet Elastic (inferred path)
        • Suspicious Call Stack Trailing Bytes Elastic (inferred path)
        • Suspicious Network Module LoadLibrary Elastic (inferred path)
        • Suspicious Unsigned DLL Loaded by a Trusted Process Elastic (inferred path)
      • C:\Windows\System32\wininit.exe#
        • Abused Debug Privilege by Arbitrary Parent Processes Sigma (inferred path)
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Windows Binaries Write Suspicious Extensions Sigma (inferred path)
        • Windows Processes Suspicious Parent Directory Sigma (inferred path)
      • C:\Windows\System32\winipsec.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\winload.efi#
      • C:\Windows\System32\winload.exe#
        • Suspicious Critical System Files Modification Elastic (inferred path)
      • C:\Windows\System32\winlogon.exe#
        • Abused Debug Privilege by Arbitrary Parent Processes Sigma (inferred path)
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • Execution of Persistent Suspicious Program Elastic (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Outbound Network Connection To Public IP Via Winlogon Sigma (inferred path)
        • Potential Modification of Accessibility Binaries Elastic (inferred path)
        • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
        • Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Stickey key called CMD via command execution Sigma (inferred path)
        • Stickey key called CMD via command execution (hash detection) Sigma (inferred path)
        • Sticky Key Like Backdoor Execution Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Windows Access Token Manipulation Winlogon Duplicate Token Handle Splunk (inferred path)
        • Windows Access Token Winlogon Duplicate Handle In Uncommon Path Splunk (inferred path)
        • Windows Binaries Write Suspicious Extensions Sigma (inferred path)
        • Windows Processes Suspicious Parent Directory Sigma (inferred path)
        • Windows WinLogon with Public Network Connection Splunk (inferred path)
        • Winlogon process contact to C2 - Blacklotus (Sysmon) Sigma (inferred path)
      • C:\Windows\System32\winmde.dll#
      • C:\Windows\System32\winmm.dll#
      • C:\Windows\System32\winnsi.dll#
      • C:\Windows\System32\winrnr.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\winrs.exe#
        • Remote Process Instantiation via WinRM and Winrs Splunk (inferred path)
        • Winrs Local Command Execution Sigma (inferred path)
      • C:\Windows\System32\winrshost.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Incoming Execution via WinRM Remote Shell Elastic (inferred path)
        • Potential Lateral Movement via Windows Remote Shell Sigma (inferred path)
        • Windows Remote Management Execute Shell Splunk (inferred path)
      • C:\Windows\System32\WinRTNetMUAHostServer.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
      • C:\Windows\System32\WinSCard.dll#
      • C:\Windows\System32\winsqlite3.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\winsta.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\WinSync.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\winver.exe#
        • Suspicious Process Parents Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
      • C:\Windows\System32\wkscli.dll#
      • C:\Windows\System32\wlanapi.dll#
      • C:\Windows\System32\wlancfg.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\wlanext.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
      • C:\Windows\System32\WLBSCTRL.dll#
        • Creation Of Non-Existent System DLL Sigma (inferred path)
        • Potential DLL Sideloading Of Non-Existent DLLs From System Folders Sigma (inferred path)
        • Windows Phantom DLL Created on Disk Splunk (inferred path)
      • C:\Windows\System32\Wldap32.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Load from a Truncated Stack Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • MS Scripting Process Loading Ldap Module Splunk (inferred path)
        • Suspicious Windows LDAP Image Load Elastic (inferred path)
        • Unusual Kerberos Client Process Elastic (inferred path)
      • C:\Windows\System32\wldp.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\wlidfdp.dll#
        • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
      • C:\Windows\System32\wlidprov.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\wlrmdr.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Wlrmdr.EXE Uncommon Argument Or Child Process Sigma (inferred path)
      • C:\Windows\System32\wmiclnt.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • WMI module loaded by suspicious process Sigma (inferred path)
        • WMI Module Loaded By Uncommon Process Sigma (inferred path)
      • C:\Windows\System32\wmidcom.dll#
      • C:\Windows\System32\WmpDui.dll#
      • C:\Windows\System32\wmsgapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\WMVDECOD.DLL#
      • C:\Windows\System32\WMVENCOD.DLL#
        • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
      • C:\Windows\System32\WofUtil.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\WorkFolders.exe#
        • Execution via WorkFolders.exe Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Signed Proxy Execution via MS Work Folders Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\wow64log.dll#
        • Creation Of Non-Existent System DLL Sigma (inferred path)
        • Potential DLL Sideloading Of Non-Existent DLLs From System Folders Sigma (inferred path)
        • Windows Phantom DLL Created on Disk Splunk (inferred path)
      • C:\Windows\System32\wpbbin.exe#
        • UEFI Persistence Via Wpbbin - FileCreation Sigma
        • UEFI Persistence Via Wpbbin - ProcessCreation Sigma (inferred path)
      • C:\Windows\System32\wpdshext.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\WptsExtensions.dll#
        • Creation Of Non-Existent System DLL Sigma (inferred path)
        • Potential DLL Sideloading Of Non-Existent DLLs From System Folders Sigma (inferred path)
        • Windows Phantom DLL Created on Disk Splunk (inferred path)
      • C:\Windows\System32\ws2_32.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Load from a Truncated Stack Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • Library Loaded from a Spoofed Call Stack Elastic (inferred path)
        • Library Loaded via a Worker Callback Elastic (inferred path)
        • Module Stomping from a Copied Library Elastic (inferred path)
        • Network Activity from a Reflected Process Elastic (inferred path)
        • Network Activity from a Stomped Module Elastic (inferred path)
        • Network Activity from Modified Module Elastic (inferred path)
        • Network Library Load via LdrLoadDLL Elastic (inferred path)
        • Network Module Loaded from Suspicious Unbacked Memory Elastic (inferred path)
        • Potential Injection via Module Stomping Elastic (inferred path)
        • Rundll32 or Regsvr32 Loaded a DLL from Unbacked Memory Elastic (inferred path)
        • Suspicious Activity from a Control Panel Applet Elastic (inferred path)
        • Suspicious Call Stack Trailing Bytes Elastic (inferred path)
        • Suspicious Network Library Load Elastic (inferred path)
        • Suspicious Network Module LoadLibrary Elastic (inferred path)
        • Suspicious Unsigned DLL Loaded by a Trusted Process Elastic (inferred path)
        • Windows Trojan Zloader Elastic (inferred path)
      • C:\Windows\System32\wscapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\wscript.exe#
        • Attempt to Disable Windows Defender Services Elastic (inferred path)
        • Command and Scripting Interpreter via Windows Scripts Elastic (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Connection to a Suspicious URL Elastic (inferred path)
        • Creation or Modification of Root Certificate Elastic (inferred path)
        • Csc.EXE Execution Form Potentially Suspicious Parent Sigma (inferred path)
        • Cscript/Wscript Potentially Suspicious Child Process Sigma (inferred path)
        • Cscript/Wscript Uncommon Script Extension Execution Sigma (inferred path)
        • CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process Sigma (inferred path)
        • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
        • Detect Use of cmd exe to Launch Script Interpreters Splunk (inferred path)
        • DotNet CLR DLL Loaded By Scripting Applications Sigma (inferred path)
        • Download Activity via a Headless Browser Elastic (inferred path)
        • Dynwrapx Image Load via Windows Scripts Elastic (inferred path)
        • Execution of a Downloaded Windows Script Elastic (inferred path)
        • Execution of a Downloaded Windows Script via Explorer Elastic (inferred path)
        • Execution of a File Downloaded via Windows OpenSSH Elastic (inferred path)
        • Execution of a File Written by Windows Script Host Elastic (inferred path)
        • Execution of a Windows Script Downloaded from the Internet Elastic (inferred path)
        • FakeUpdates/SocGholish Activity Sigma (inferred path)
        • HackTool - CACTUSTORCH Remote Thread Creation Sigma (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • Local Network Connection Initiated By Script Interpreter Sigma (inferred path)
        • LOLBIN Execution From Abnormal Drive Sigma (inferred path)
        • Manual Execution of Script Inside of a Compressed File Sigma (inferred path)
        • Microsoft Office File Execution via Script Interpreter Elastic (inferred path)
        • MMC Spawning Windows Shell Sigma (inferred path)
        • MS Scripting Process Loading Ldap Module Splunk (inferred path)
        • MS Scripting Process Loading WMI Module Splunk (inferred path)
        • MSBuild Suspicious Spawned By Script Process Splunk (inferred path)
        • Network Connection via Startup Item Elastic (inferred path)
        • NTDS.DIT Creation By Uncommon Parent Process Sigma (inferred path)
        • NTDS.DIT Creation By Uncommon Process Sigma (inferred path)
        • Office Apps Launching Wscipt Kusto (inferred path)
        • Office Macro File Creation From Suspicious Process Sigma (inferred path)
        • OneNote.EXE Execution of Malicious Embedded Scripts Sigma (inferred path)
        • Outbound Network Connection Initiated By Script Interpreter Sigma (inferred path)
        • Oversized Windows Script Execution Elastic (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Persistent Scripts in the Startup Directory Elastic (inferred path)
        • Pikabot Fake DLL Extension Execution Via Rundll32.EXE Sigma (inferred path)
        • Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image Sigma (inferred path)
        • Potential CVE-2023-21554 QueueJumper Exploitation Sigma (inferred path)
        • Potential Devil Bait Malware Reconnaissance Sigma (inferred path)
        • Potential Devil Bait Related Indicator Sigma (inferred path)
        • Potential Dropper Script Execution Via WScript/CScript/MSHTA Sigma (inferred path)
        • Potential Execution via VS Code Tasks Elastic (inferred path)
        • Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) Sigma (inferred path)
        • Potential File Download via a Headless Browser Elastic (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Sigma (inferred path)
        • Potential Manage-bde.wsf Abuse To Proxy Execution Sigma (inferred path)
        • Potential Qakbot Rundll32 Execution Sigma (inferred path)
        • Potential QBot Activity Sigma (inferred path)
        • Potential Recon Activity Using DriverQuery.EXE Sigma (inferred path)
        • Potential Reconnaissance Activity Via GatherNetworkInfo.VBS Sigma (inferred path)
        • Potential Register_App.Vbs LOLScript Abuse Sigma (inferred path)
        • Potential Remote Install via MsiExec Elastic (inferred path)
        • Potential SocGholish Second Stage C2 DNS Query Sigma (inferred path)
        • Potential Suspicious Child Process Of 3CXDesktopApp Sigma (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of DiskShadow.EXE Sigma (inferred path)
        • Potentially Suspicious Child Process of KeyScrambler.exe Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Potentially Suspicious Child Process Of VsCode Sigma (inferred path)
        • Potentially Suspicious Child Process Of WinRAR.EXE Sigma (inferred path)
        • Potentially Suspicious Child Processes Spawned by ConHost Sigma (inferred path)
        • Potentially Suspicious DMP/HDMP File Creation Sigma (inferred path)
        • Potentially Suspicious Execution From Parent Process In Public Folder Sigma (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Potentially Suspicious Mofcomp Execution Sigma (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Potentially Suspicious WebDAV LNK Execution Sigma (inferred path)
        • Potentially Suspicious Windows App Activity Sigma (inferred path)
        • Process Activity via Compiled HTML File Elastic (inferred path)
        • Process Execution with Unusual File Extension Elastic (inferred path)
        • Qakbot Rundll32 Exports Execution Sigma (inferred path)
        • Qakbot Rundll32 Fake DLL Extension Execution Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Registry Tampering by Potentially Suspicious Processes Sigma (inferred path)
        • Remote File Download via Script Interpreter Elastic (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Scheduled Task Created by a Windows Script Elastic (inferred path)
        • Script Event Consumer Spawning Process Sigma (inferred path)
        • Script Interpreter Execution From Suspicious Folder Sigma (inferred path)
        • Script Interpreter Loading DotNet Assembly From Memory Kusto (inferred path)
        • Scripting or Unsigned Binary Performing DNS Lookups to Ethereum RPC Providers Elastic (inferred path)
        • Scripting/CommandLine Process Spawned Regsvr32 Sigma (inferred path)
        • Sdiagnhost Calling Suspicious Child Process Sigma (inferred path)
        • Service Control Spawned via Script Interpreter Elastic (inferred path)
        • Startup Persistence by a Suspicious Process Elastic (inferred path)
        • Sticky Key Like Backdoor Execution Sigma (inferred path)
        • Suspicious .NET Code Compilation Elastic (inferred path)
        • Suspicious ArcSOC.exe Child Process Sigma (inferred path)
        • Suspicious BitLocker Access Agent Update Utility Execution Sigma (inferred path)
        • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
        • Suspicious Child Process Of BgInfo.EXE Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process of Notepad++ Updater - GUP.Exe Sigma (inferred path)
        • Suspicious Child Process of PaperCut Server Component Elastic (inferred path)
        • Suspicious Child Process of SAP NetWeaver Sigma (inferred path)
        • Suspicious Child Process Of Wermgr.EXE Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Chromium Browser Instance Executed With Custom Extension Sigma (inferred path)
        • Suspicious CrushFTP Child Process Sigma (inferred path)
        • Suspicious Electron Application Child Processes Sigma (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution from a Windows Script Elastic (inferred path)
        • Suspicious Execution via Compiled HTML File Elastic (inferred path)
        • Suspicious Execution via ShellBrowserWindow/ShellWindow COM Elastic (inferred path)
        • Suspicious Explorer Child Process Elastic (inferred path)
        • Suspicious Java Execution via a Windows Script Elastic (inferred path)
        • Suspicious Microsoft Diagnostics Wizard Execution Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious MSDT Parent Process Sigma (inferred path)
        • Suspicious MSHTA Child Process Sigma (inferred path)
        • Suspicious mshta child process Splunk (inferred path)
        • Suspicious Mshta.EXE Execution Patterns Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious Oversized Script Execution Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious PowerShell Console History Deletion Elastic (inferred path)
        • Suspicious PowerShell Invocation From Script Engines Sigma (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Provlaunch.EXE Child Process Sigma (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious SYSTEM User Process Creation Sigma (inferred path)
        • Suspicious Windows Script Base64 Encoding Elastic (inferred path)
        • Suspicious Windows Script Downloaded from the Internet Elastic (inferred path)
        • Suspicious WindowsTerminal Child Processes Sigma (inferred path)
        • Suspicious WMI Enumeration via Windows Scripts Elastic (inferred path)
        • Suspicious WmiPrvSE Child Process Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Unusual File Creation - Alternate Data Stream Elastic (inferred path)
        • User Account Control Disabled via Registry Elastic (inferred path)
        • Vbscript Execution Using Wscript App Splunk (inferred path)
        • VMToolsd Suspicious Child Process Sigma (inferred path)
        • Web or Application Server Spawning a Shell Splunk (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows DLL Search Order Hijacking with iscsicpl Splunk (inferred path)
        • Windows Office Product Spawned Uncommon Process Splunk (inferred path)
        • Windows Remote Assistance Spawning Process Splunk (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Scheduled Task Service Spawned Shell Splunk (inferred path)
        • Windows Script Executed From a Suspicious Path Elastic (inferred path)
        • Windows Script Execution from Archive Elastic (inferred path)
        • Windows Script Interpreter Executing Process via WMI Elastic (inferred path)
        • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
        • Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • Windows System Script Proxy Execution Syncappvpublishingserver Splunk (inferred path)
        • Windows Terminal Profile Settings Modification By Uncommon Process Sigma (inferred path)
        • WinRAR Spawning Shell Application Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • WScript or CScript Dropper - File Sigma (inferred path)
        • Wscript Or Cscript Suspicious Child Process Splunk (inferred path)
        • WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript Sigma (inferred path)
        • WSL Child Process Anomaly Sigma (inferred path)
      • C:\Windows\System32\WSDApi.dll#
      • C:\Windows\System32\wshbth.dll#
      • C:\Windows\System32\wshelper.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\wshom.ocx#
        • WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load Sigma (inferred path)
      • C:\Windows\System32\wsl.exe#
        • Arbitrary Command Execution Using WSL Sigma (inferred path)
        • Attempt to Install or Run Kali Linux via WSL Elastic (inferred path)
        • Execution via Windows Subsystem for Linux Elastic (inferred path)
        • Installation of WSL Kali-Linux Sigma (inferred path)
        • NTDS.DIT Creation By Uncommon Process Sigma (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Potential CVE-2023-21554 QueueJumper Exploitation Sigma (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Potentially Suspicious Mofcomp Execution Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
        • Suspicious Child Process Of SQL Server Sigma (inferred path)
        • Suspicious Child Process Of Veeam Dabatase Sigma (inferred path)
        • Suspicious MSDT Parent Process Sigma (inferred path)
        • Suspicious Processes Spawned by WinRM Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • Visual Studio Code Tunnel Shell Execution Sigma (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • WSL Child Process Anomaly Sigma (inferred path)
        • WSL Kali-Linux Usage Sigma (inferred path)
      • C:\Windows\System32\WsmAuto.dll#
        • Suspicious WSMAN Provider Image Loads Sigma (inferred path)
      • C:\Windows\System32\wsmprovhost.exe#
        • Detect Unknown process launched via WinRM Kusto (inferred path)
        • Incoming Execution via PowerShell Remoting Elastic (inferred path)
        • Possible Lateral Movement PowerShell Spawn Splunk (inferred path)
        • Remote LSASS Process Access Through Windows Remote Management Sigma (inferred path)
        • Remote PowerShell Session Host Process (WinRM) Sigma (inferred path)
        • Service Accounts Performing Remote PS Kusto (inferred path)
        • Suspicious Processes Spawned by WinRM Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • WinRM Plugin Lateral Movement Kusto (inferred path)
        • WinRM Spawning a Process Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\WsmPty.xsl#
        • AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File Sigma (inferred path)
      • C:\Windows\System32\WsmSvc.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
        • Suspicious WSMAN Provider Image Loads Sigma (inferred path)
      • C:\Windows\System32\WsmTxt.xsl#
        • AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File Sigma (inferred path)
      • C:\Windows\System32\WSReset.exe#
        • Bypass UAC via WSReset.exe Sigma (inferred path)
        • Detecting UAC bypass - modify Windows Store settings Kusto (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • UAC Bypass via WSReset Execution Hijack Elastic (inferred path)
        • UAC Bypass WSReset Sigma (inferred path)
        • Windows Handle Duplication in Known UAC-Bypass Binaries Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\System32\wtsapi32.dll#
        • Aruba Network Service Potential DLL Sideloading Sigma (inferred path)
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Library Load from a Truncated Stack Elastic (inferred path)
        • Library Loaded From a Potentially Altered Call Stack Elastic (inferred path)
        • Library Loaded from a Spoofed Call Stack Elastic (inferred path)
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\wuauclt.exe#
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • ImageLoad via Windows Update Auto Update Client Elastic (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Potential WSUS Abuse for Lateral Movement Elastic (inferred path)
        • Proxy Execution Via Wuauclt.EXE Sigma (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious ImageLoad via Windows Update Auto Update Client Elastic (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Suspicious Windows Update Agent Empty Cmdline Sigma (inferred path)
        • Windows Process Injection into Commonly Abused Processes Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\System32\WUDFHost.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Unusual Parent Process For Cmd.EXE Sigma (inferred path)
      • C:\Windows\System32\wusa.exe#
        • Cab File Extraction Via Wusa.EXE Sigma (inferred path)
        • Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths Sigma (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • UAC Bypass Attempt via DCCW DLL Search Order Hijacking Elastic (inferred path)
        • UAC Bypass Attempt via DismCore DLL Side-Loading Elastic (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
        • Wusa.EXE Executed By Parent Process Located In Suspicious Location Sigma (inferred path)
      • C:\Windows\System32\WWAHost.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • Potential Pikabot C2 Activity Sigma (inferred path)
        • Potential Pikabot Hollowing Activity Sigma (inferred path)
      • C:\Windows\System32\wwancfg.dll#
      • C:\Windows\System32\wwapi.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\xcopy.exe#
        • Copy From Or To Admin Share Or Sysvol Folder Chronicle (inferred path)
        • Copy From Or To Admin Share Or Sysvol Folder Sigma (inferred path)
        • Creation or Modification of Root Certificate Elastic (inferred path)
        • HackTool - Jlaive In-Memory Assembly Execution Sigma (inferred path)
        • LOL-Binary Copied From System Directory Sigma (inferred path)
        • NTDS or SAM Database File Copied Elastic (inferred path)
        • Potential Browser Data Stealing Sigma (inferred path)
        • Potential IIS Web Shell File Creation Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
        • Suspicious Copy From or To System Directory Sigma (inferred path)
        • Suspicious Copy on System32 Splunk (inferred path)
        • Windows File Collection Via Copy Utilities Splunk (inferred path)
      • C:\Windows\System32\xmllite.dll#
      • C:\Windows\System32\xolehlp.dll#
      • C:\Windows\System32\xpsservices.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\System32\xwizard.exe#
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Unusual Process Network Connection Elastic (inferred path)
        • Windows App Layer Protocol Qakbot NamedPipe Splunk (inferred path)
        • Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
        • Xwizard.EXE Execution From Non-Default Location Sigma (inferred path)
      • C:\Windows\System32\xwizards.dll#
      • C:\Windows\System32\xwtpw32.dll#
        • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
    • C:\Windows\SystemApps#
      • C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\Cortana.UI\cache#
        • C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop#
          • File Creation In Suspicious Directory By Msdt.EXE Sigma (inferred branch)
          • HackTool - LaZagne Execution Sigma (inferred branch)
          • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
          • Microsoft Excel Add-In Loaded From Uncommon Location Sigma (inferred branch)
          • PsExec Tool Execution From Suspicious Locations - PipeName Sigma (inferred branch)
          • Suspicious AddinUtil.EXE CommandLine Execution Sigma (inferred branch)
          • Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs Sigma (inferred branch)
          • Suspicious WindowsTerminal Child Processes Sigma (inferred branch)
          • Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location Sigma (inferred branch)
          • Windows Theme File Creation in Unusual Location Splunk (inferred branch)
          • WSL Child Process Anomaly Sigma (inferred branch)
        • C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop#
          • File Creation In Suspicious Directory By Msdt.EXE Sigma (inferred branch)
          • HackTool - LaZagne Execution Sigma (inferred branch)
          • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
          • Microsoft Excel Add-In Loaded From Uncommon Location Sigma (inferred branch)
          • PsExec Tool Execution From Suspicious Locations - PipeName Sigma (inferred branch)
          • Suspicious AddinUtil.EXE CommandLine Execution Sigma (inferred branch)
          • Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs Sigma (inferred branch)
          • Suspicious WindowsTerminal Child Processes Sigma (inferred branch)
          • Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location Sigma (inferred branch)
          • Windows Theme File Creation in Unusual Location Splunk (inferred branch)
          • WSL Child Process Anomaly Sigma (inferred branch)
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common#
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\editor\f12Nls.js#
          • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\Formatter#
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\Formatter\Html#
            • Potential Webshell Creation On Static Website Sigma (inferred branch)
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\Formatter\typescript\formatterTypescriptServices.nls.keys.js#
            • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\monaco-editor\min\vs#
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\monaco-editor\min\vs\editor\editor.main.nls.js#
            • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\monaco-editor\min\vs\language\html#
            • Potential Webshell Creation On Static Website Sigma (inferred branch)
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache#
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop#
          • File Creation In Suspicious Directory By Msdt.EXE Sigma (inferred branch)
          • HackTool - LaZagne Execution Sigma (inferred branch)
          • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
          • Microsoft Excel Add-In Loaded From Uncommon Location Sigma (inferred branch)
          • PsExec Tool Execution From Suspicious Locations - PipeName Sigma (inferred branch)
          • Suspicious AddinUtil.EXE CommandLine Execution Sigma (inferred branch)
          • Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs Sigma (inferred branch)
          • Suspicious WindowsTerminal Child Processes Sigma (inferred branch)
          • Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location Sigma (inferred branch)
          • Windows Theme File Creation in Unusual Location Splunk (inferred branch)
          • WSL Child Process Anomaly Sigma (inferred branch)
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop#
          • File Creation In Suspicious Directory By Msdt.EXE Sigma (inferred branch)
          • HackTool - LaZagne Execution Sigma (inferred branch)
          • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
          • Microsoft Excel Add-In Loaded From Uncommon Location Sigma (inferred branch)
          • PsExec Tool Execution From Suspicious Locations - PipeName Sigma (inferred branch)
          • Suspicious AddinUtil.EXE CommandLine Execution Sigma (inferred branch)
          • Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs Sigma (inferred branch)
          • Suspicious WindowsTerminal Child Processes Sigma (inferred branch)
          • Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location Sigma (inferred branch)
          • Windows Theme File Creation in Unusual Location Splunk (inferred branch)
          • WSL Child Process Anomaly Sigma (inferred branch)
      • C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public#
        • NTDS.DIT Creation By Uncommon Parent Process Sigma (inferred branch)
        • NTDS.DIT Creation By Uncommon Process Sigma (inferred branch)
        • Suspicious Process Patterns NTDS.DIT Exfil Sigma (inferred branch)
    • C:\Windows\SystemResources\shell32.dll.mun#
      • Invoke-Obfuscation Via Use Rundll32 - Security Sigma (inferred path)
      • Invoke-Obfuscation Via Use Rundll32 - System Sigma (inferred path)
    • C:\Windows\SysWOW64#
      • Batch File Write to System32 Splunk (inferred branch)
      • Connection to Commonly Abused Free SSL Certificate Providers Elastic (inferred branch)
      • Control Panel Process with Unusual Arguments Elastic (inferred branch)
      • HackTool - CACTUSTORCH Remote Thread Creation Sigma (inferred branch)
      • LSASS Access Attempt from Unbacked Memory Elastic (inferred branch)
      • Potential Image Load with a Spoofed Creation Time Elastic (inferred branch)
      • Potential Privilege Escalation via DLL Redirection Elastic (inferred branch)
      • Potential Privilege Escalation via Elevated IFileOperation Elastic (inferred branch)
      • Potential Privilege Escalation via File Redirection Elastic (inferred branch)
      • Potential Privilege Escalation via Missing DLL Elastic (inferred branch)
      • Potential Privilege Escalation via Token Impersonation Elastic (inferred branch)
      • Potential Process Injection from Malicious Document Elastic (inferred branch)
      • Potential Timestomp in Executable Files Elastic (inferred branch)
      • Suspicious NTDLL Image Load Elastic (inferred branch)
      • Suspicious Script Object Execution Elastic (inferred branch)
      • Suspicious System Path File Overwrite Elastic (inferred branch)
      • Suspicious Windows Explorer Execution Elastic (inferred branch)
      • Suspicious Windows Script Interpreter Child Process Elastic (inferred branch)
      • UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface Elastic (inferred branch)
      • UAC Bypass Using WOW64 Logger DLL Hijack Sigma (inferred branch)
      • Unsigned DLL Loaded from Fake Windows Directory Elastic (inferred branch)
      • Untrusted DLL Loaded by a System Windows Process Elastic (inferred branch)
      • Unusual LDAP Client Process Elastic (inferred branch)
      • Unusual PowerShell Engine ImageLoad Elastic (inferred branch)
      • Unusual Remote Desktop Client Process Elastic (inferred branch)
      • Windows Access Token Manipulation Winlogon Duplicate Token Handle Splunk (inferred branch)
      • Windows Access Token Winlogon Duplicate Handle In Uncommon Path Splunk (inferred branch)
      • Windows Unsigned DLL Side-Loading Splunk (inferred branch)
      • Windows Unusual SysWOW64 Process Run System32 Executable Splunk (inferred branch)
      • C:\Windows\SysWOW64\bash.exe#
        • Indirect Command Execution From Script File Via Bash.EXE Sigma (inferred path)
        • Indirect Inline Command Execution Via Bash.EXE Sigma (inferred path)
      • C:\Windows\SysWOW64\Com\dmp#
        • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
        • Windows Process Writing File to World Writable Path Splunk (inferred branch)
      • C:\Windows\SysWOW64\config\systemprofile#
        • Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder Sigma (inferred branch)
        • Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location Sigma (inferred branch)
        • Process Execution From A Potentially Suspicious Folder Sigma (inferred branch)
        • Suspicious Service Binary Directory Sigma (inferred branch)
      • C:\Windows\SysWOW64\curl.exe#
        • Ingress Tool Transfer via CURL Elastic (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
      • C:\Windows\SysWOW64\Drivers#
        • Windows File Without Extension In Critical Folder Splunk (inferred branch)
      • C:\Windows\SysWOW64\explorer.exe#
        • API Call from a Process with a Spoofed Parent Elastic (inferred path)
        • Arbitrary Binary Execution Using GUP Utility Sigma (inferred path)
        • Binary Proxy Execution via Windows OpenSSH Elastic (inferred path)
        • Command Shell Execution from Untrusted Origin Elastic (inferred path)
        • Conhost Spawned By Uncommon Parent Process Sigma (inferred path)
        • CVE-2023-40477 Potential Exploitation - .REV File Creation Sigma (inferred path)
        • Download Activity via a Headless Browser Elastic (inferred path)
        • Emotet Loader Execution Via .LNK File Sigma (inferred path)
        • Execution from a Downloaded ISO File Elastic (inferred path)
        • Execution from a Remote Working Directory Elastic (inferred path)
        • Execution of a Downloaded Windows Script Elastic (inferred path)
        • Execution of a Downloaded Windows Script via Explorer Elastic (inferred path)
        • Execution of Commonly Abused Utilities via Explorer Trampoline Elastic (inferred path)
        • Execution of Persistent Suspicious Program Elastic (inferred path)
        • Explorer NOUACCHECK Flag Sigma (inferred path)
        • File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell Sigma (inferred path)
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
        • HackTool - Potential Impacket Lateral Movement Activity Sigma (inferred path)
        • Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows Elastic (inferred path)
        • Malicious Reputation of Executable Download Elastic (inferred path)
        • Manual Execution of Script Inside of a Compressed File Sigma (inferred path)
        • Microsoft Build Engine Started by a System Process Elastic (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Notepad Password Files Discovery Sigma (inferred path)
        • Potential CVE-2024-21412 Exploitation Elastic (inferred path)
        • Potential Execution via LNK Stomping Elastic (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load Sigma (inferred path)
        • Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access Sigma (inferred path)
        • Potential Fake CAPTCHA Phishing Attack Elastic (inferred path)
        • Potential File Download via a Headless Browser Elastic (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred path)
        • Potential Payload Download via Finger LOLBin Elastic (inferred path)
        • Potential Proxy Execution Via Explorer.EXE From Shell Process Sigma (inferred path)
        • Potential Remote Install via MsiExec Elastic (inferred path)
        • Potential RipZip Attack on Startup Folder Sigma (inferred path)
        • Potential SharpRDP Behavior Elastic (inferred path)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred path)
        • Potentially Suspicious Child Process Of Regsvr32 Sigma (inferred path)
        • Potentially Suspicious Office Document Executed From Trusted Location Sigma (inferred path)
        • Potentially Suspicious Rundll32.EXE Execution of UDL File Sigma (inferred path)
        • Potentially Suspicious WebDAV LNK Execution Sigma (inferred path)
        • Powershell Remote Thread To Known Windows Process Splunk (inferred path)
        • Process from Archive or Removable Media via Unbacked Code Elastic (inferred path)
        • Protected Process from Unusual Parent Elastic (inferred path)
        • Qakbot Discovery Activies Kusto (inferred path)
        • Remote Management Access Launch After MSI Install Elastic (inferred path)
        • Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Rundll32 Spawned Via Explorer.EXE Sigma (inferred path)
        • RunDLL32 Spawning Explorer Sigma (inferred path)
        • Scheduled Task from a Browser or Compression Utility Descendant Elastic (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Shell Execution via Windows Shortcut File Elastic (inferred path)
        • Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred path)
        • Suspicious ClickFix/FileFix Execution Pattern Sigma (inferred path)
        • Suspicious Command Execution via Windows Run Elastic (inferred path)
        • Suspicious Control Panel DLL Loaded by Explorer Elastic (inferred path)
        • Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit Sigma (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution from INET Cache Elastic (inferred path)
        • Suspicious Execution from INET Cache Elastic (inferred path)
        • Suspicious Explorer Child Process Elastic (inferred path)
        • Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix Sigma (inferred path)
        • Suspicious File Delivery via HTML Smuggling Elastic (inferred path)
        • Suspicious ImageLoad from an ISO Mounted Device Elastic (inferred path)
        • Suspicious LNK Command-Line Padding with Whitespace Characters Sigma (inferred path)
        • Suspicious Microsoft Diagnostics Wizard Execution Elastic (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious Oversized Script Execution Elastic (inferred path)
        • Suspicious Powershell via Windows Power User Menu Elastic (inferred path)
        • Suspicious Shortcut File Overwrite Elastic (inferred path)
        • Suspicious Troubleshooting Pack Cabinet Execution Elastic (inferred path)
        • Ursnif Redirection Of Discovery Commands Sigma (inferred path)
        • Windows App Layer Protocol Qakbot NamedPipe Splunk (inferred path)
        • Windows Binary Execution from an Archive Splunk (inferred path)
        • Windows Explorer LNK Exploit Process Launch With Padding Splunk (inferred path)
        • Windows Explorer.exe Spawning PowerShell or Cmd Splunk (inferred path)
        • Windows Ingress Tool Transfer Using Explorer Splunk (inferred path)
        • Windows Masquerading Explorer As Child Process Splunk (inferred path)
        • Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
        • Windows Process Injection Remote Thread Splunk (inferred path)
        • Windows Script Executed From a Suspicious Path Elastic (inferred path)
        • Windows Script Execution from Archive Elastic (inferred path)
        • Windows Script Execution from Archive File Elastic (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\SysWOW64\hh.exe#
        • Detect HTML Help Spawn Child Process Splunk (inferred path)
        • Detect HTML Help URL in Command Line Splunk (inferred path)
        • Detect HTML Help Using InfoTech Storage Handlers Splunk (inferred path)
        • Download Activity via a Headless Browser Elastic (inferred path)
        • Execution of a Downloaded Windows Script via Explorer Elastic (inferred path)
        • File Execution via Microsoft HTML Help Elastic (inferred path)
        • HH.EXE Execution Sigma (inferred path)
        • HH.EXE Initiated HTTP Network Connection Sigma (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • Legitimate Application Dropped Archive Sigma (inferred path)
        • Legitimate Application Dropped Executable Sigma (inferred path)
        • Legitimate Application Dropped Script Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • Network Connection via Compiled HTML File Elastic (inferred path)
        • Potential File Download via a Headless Browser Elastic (inferred path)
        • Potential File Transfer via Curl for Windows Elastic (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Process Activity via Compiled HTML File Elastic (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Remote CHM File Download/Execution Via HH.EXE Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Suspicious Execution via ShellBrowserWindow/ShellWindow COM Elastic (inferred path)
        • Suspicious HH.EXE Execution Sigma (inferred path)
        • Suspicious Microsoft HTML Help Descendant Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious SYSTEM User Process Creation Sigma (inferred path)
        • Suspicious Windows Script Downloaded from the Internet Elastic (inferred path)
        • Windows Script Executed From a Suspicious Path Elastic (inferred path)
        • Windows System Binary Proxy Execution Compiled HTML File Decompile Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\SysWOW64\iscsicpl.exe#
        • UAC Bypass Using Iscsicpl - ImageLoad Sigma
      • C:\Windows\SysWOW64\LogFiles\SAM#
        • Sensitive File Access by an Unsigned Process Elastic (inferred path)
      • C:\Windows\SysWOW64\ntdll.dll#
        • Suspicious NTDLL Image Load Elastic (inferred path)
      • C:\Windows\SysWOW64\ole2nls.dll#
        • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
      • C:\Windows\SysWOW64\regedit.exe#
        • Exports Critical Registry Keys To a File Sigma (inferred path)
        • Exports Registry Key To a File Sigma (inferred path)
        • Exports Registry Key To an Alternate Data Stream Sigma (inferred path)
        • Imports Registry Key From a File Sigma (inferred path)
        • Imports Registry Key From an ADS Sigma (inferred path)
        • PDF File Created By RegEdit.EXE Sigma (inferred path)
        • Potential PendingFileRenameOperations Tampering Sigma (inferred path)
        • Regedit as Trusted Installer Sigma (inferred path)
        • Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Windows Modify Registry Regedit Silent Reg Import Splunk (inferred path)
        • Windows Sensitive Registry Hive Dump Via CommandLine Splunk (inferred path)
      • C:\Windows\SysWOW64\setup16.exe#
        • Setup16.EXE Execution With Custom .Lst File Sigma
      • C:\Windows\SysWOW64\svchost.exe#
        • Suspicious API from an Unsigned Service DLL Elastic (inferred path)
        • Unsigned DLL Loaded by Svchost Elastic (inferred path)
      • C:\Windows\SysWOW64\Taskmgr.exe#
        • LSASS Process Memory Dump Creation Via Taskmgr.EXE Sigma (inferred path)
      • C:\Windows\SysWOW64\Tasks#
        • Scheduled Task Created - FileCreation Sigma (inferred branch)
        • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
        • Windows Process Writing File to World Writable Path Splunk (inferred branch)
        • C:\Windows\SysWOW64\Tasks\Microsoft\Windows#
          • C:\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA#
            • Windows Process Writing File to World Writable Path Splunk (inferred branch)
            • C:\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System#
              • Windows Process Writing File to World Writable Path Splunk (inferred branch)
          • C:\Windows\SysWOW64\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update#
            • Windows Process Writing File to World Writable Path Splunk (inferred branch)
      • C:\Windows\SysWOW64\wbem#
        • Potential Privilege Escalation via Missing DLL Elastic (inferred branch)
        • Unusual Process Execution on WBEM Path Elastic (inferred branch)
        • C:\Windows\SysWOW64\wbem\wbemcomn.dll#
          • Wmiprvse Wbemcomn DLL Hijack Sigma (inferred path)
          • Wmiprvse Wbemcomn DLL Hijack - File Sigma (inferred path)
        • C:\Windows\SysWOW64\wbem\WMIC.exe#
          • Suspicious WMIC Execution Via Office Process Sigma (inferred path)
      • C:\Windows\SysWOW64\WindowsPowerShell\profile.ps1#
        • PowerShell Profile Modification Sigma (inferred path)
    • C:\Windows\Tasks#
      • Startup Folder Persistence via Unsigned Process Elastic (inferred branch)
      • Suspicious Process Start Locations Sigma (inferred branch)
    • C:\Windows\Temp#
      • Abusable DLL Potential Sideloading From Suspicious Location Sigma (inferred branch)
      • BaaUpdate.exe Suspicious DLL Load Sigma (inferred branch)
      • Clfs.SYS Loaded By Process Located In a Potential Suspicious Location Sigma (inferred branch)
      • Connection to Dynamic DNS Provider by an Unsigned Binary Elastic (inferred branch)
      • DLL Loaded From Suspicious Location Via Cmspt.EXE Sigma (inferred branch)
      • Driver Load From A Temporary Directory Sigma (inferred branch)
      • Excessive distinct processes from Windows Temp Splunk (inferred branch)
      • Executables Or Script Creation In Temp Path Splunk (inferred branch)
      • Execution from Suspicious Directory Elastic (inferred branch)
      • External IP Address Discovery via Untrusted Program Elastic (inferred branch)
      • Firewall Policy Changed by a Suspicious Process Elastic (inferred branch)
      • HackTool - CrackMapExec File Indicators Sigma (inferred branch)
      • HackTool - LaZagne Execution Sigma (inferred branch)
      • Java Drop followed by network activity Elastic (inferred branch)
      • Java Dropped and Executed With DNS Lookup Elastic (inferred branch)
      • LSASS Access From Program In Potentially Suspicious Folder Sigma (inferred branch)
      • Microsoft Excel Add-In Loaded From Uncommon Location Sigma (inferred branch)
      • Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder Sigma (inferred branch)
      • NTDS.DIT Creation By Uncommon Parent Process Sigma (inferred branch)
      • NTDS.DIT Creation By Uncommon Process Sigma (inferred branch)
      • OneNote Attachment File Dropped In Suspicious Location Sigma (inferred branch)
      • Parent Process PID Spoofing Elastic (inferred branch)
      • Potential Browser Information Discovery Elastic (inferred branch)
      • Potential Evasion via Oversized Image Load Elastic (inferred branch)
      • Potential Maze Ransomware Activity Sigma (inferred branch)
      • Potential Obfuscated Script Execution Elastic (inferred branch)
      • Potential Privilege Escalation via RoguePlanet Windows Defender Exploit Elastic (inferred branch)
      • Potential Raspberry Robin Registry Set Internet Settings ZoneMap Sigma (inferred branch)
      • Potential Recon Activity Using DriverQuery.EXE Sigma (inferred branch)
      • Potential Remote Credential Access via Registry Elastic (inferred branch)
      • Potential SMB Relay Attack Tool Execution Sigma (inferred branch)
      • Potentially Suspicious Child Process Of VsCode Sigma (inferred branch)
      • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred branch)
      • Process Creating LNK file in Suspicious Location Splunk (inferred branch)
      • PsExec Tool Execution From Suspicious Locations - PipeName Sigma (inferred branch)
      • Publisher Attachment File Dropped In Suspicious Location Sigma (inferred branch)
      • Remote Thread Creation In Mstsc.Exe From Suspicious Location Sigma (inferred branch)
      • Scheduled Task Creation From Potential Suspicious Parent Location Sigma (inferred branch)
      • ScreenConnect - SlashAndGrab Exploitation Indicators Sigma (inferred branch)
      • Self Extraction Directive File Created In Potentially Suspicious Location Sigma (inferred branch)
      • Self Service Persistence by an Unsigned Process Elastic (inferred branch)
      • Service Binary in Suspicious Folder Sigma (inferred branch)
      • Shell Execution via Windows Shortcut File Elastic (inferred branch)
      • Startup Folder Persistence via Unsigned Process Elastic (inferred branch)
      • Suspicious AddinUtil.EXE CommandLine Execution Sigma (inferred branch)
      • Suspicious Child Process of AspNetCompiler Sigma (inferred branch)
      • Suspicious Child Process Of BgInfo.EXE Sigma (inferred branch)
      • Suspicious Electron Application Child Processes Sigma (inferred branch)
      • Suspicious Execution from an Oversized Executable Elastic (inferred branch)
      • Suspicious Execution via DCOM Elastic (inferred branch)
      • Suspicious Microsoft Office Child Process Sigma (inferred branch)
      • Suspicious Microsoft OneNote Child Process Elastic (inferred branch)
      • Suspicious Microsoft OneNote Child Process Sigma (inferred branch)
      • Suspicious Oversized Script Execution Elastic (inferred branch)
      • Suspicious Parent-Child Relationship Elastic (inferred branch)
      • Suspicious PowerShell Console History Deletion Elastic (inferred branch)
      • Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs Sigma (inferred branch)
      • Suspicious Process DNS Query Known Abuse Web Services Splunk (inferred branch)
      • Suspicious Process Patterns NTDS.DIT Exfil Sigma (inferred branch)
      • Suspicious Provlaunch.EXE Child Process Sigma (inferred branch)
      • Suspicious Windows LUA Script Execution Elastic (inferred branch)
      • Suspicious Windows Schedule Child Process Elastic (inferred branch)
      • Suspicious WindowsTerminal Child Processes Sigma (inferred branch)
      • Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location Sigma (inferred branch)
      • Uncommon Service Installation Image Path Sigma (inferred branch)
      • Windows Archived Collected Data In TEMP Folder Splunk (inferred branch)
      • Windows Bluetooth Service Installed From Uncommon Location Splunk (inferred branch)
      • Windows Credentials Access via VaultCli Module Splunk (inferred branch)
      • Windows Credentials from Password Stores Chrome Copied in TEMP Dir Splunk (inferred branch)
      • Windows Credentials from Web Browsers Saved in TEMP Folder Splunk (inferred branch)
      • Windows DLL Module Loaded in Temp Dir Splunk (inferred branch)
      • Windows DNS Query Request To TinyUrl Splunk (inferred branch)
      • Windows FFmpeg Audio and Video Device Discovery Splunk (inferred branch)
      • Windows FFmpeg DirectShow Video Capture Splunk (inferred branch)
      • Windows Known Abused DLL Created Splunk (inferred branch)
      • Windows MSHTA Writing to World Writable Path Splunk (inferred branch)
      • Windows Potential AppDomainManager Hijack Artifacts Creation Splunk (inferred branch)
      • Windows Privilege Escalation Suspicious Process Elevation Splunk (inferred branch)
      • Windows Privilege Escalation User Process Spawn System Process Splunk (inferred branch)
      • Windows Process Execution in Temp Dir Splunk (inferred branch)
      • Windows Process Writing File to World Writable Path Splunk (inferred branch)
      • Windows Rundll32 with Non-Standard File Extension Splunk (inferred branch)
      • Windows Scheduled Task DLL Module Loaded Splunk (inferred branch)
      • Windows Screen Capture in TEMP folder Splunk (inferred branch)
      • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred branch)
      • Windows Suspicious Driver Loaded Path Splunk (inferred branch)
      • Windows Theme File Creation in Unusual Location Splunk (inferred branch)
      • Windows Wermgr Alternate Data Stream in Temp Dir Splunk (inferred branch)
      • Winnti Malware HK University Campaign Sigma (inferred branch)
      • WScript or CScript Dropper - File Sigma (inferred branch)
      • WSL Child Process Anomaly Sigma (inferred branch)
      • Wusa.EXE Executed By Parent Process Located In Suspicious Location Sigma (inferred branch)
      • C:\Windows\Temp\DB#
        • OilRig APT Activity Sigma (inferred branch)
      • C:\Windows\Temp\debug.bin#
        • HackTool - SafetyKatz Dump Indicator Sigma (inferred path)
      • C:\Windows\Temp\rot.exe#
        • HackTool - Generic Process Access Sigma (inferred path)
      • C:\windows\temp\sam#
        • HackTool - Typical HiveNightmare SAM File Export Sigma
        • Potential SAM Database Dump Sigma (inferred path)
      • C:\Windows\Temp\sam.tmp#
        • HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators Sigma (inferred path)
      • C:\Windows\Temp\ScreenConnect#
        • ScreenConnect - SlashAndGrab Exploitation Indicators Sigma (inferred branch)
      • C:\Windows\Temp\sec.tmp#
        • HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators Sigma (inferred path)
      • C:\Windows\Temp\sqlite32.dll#
      • C:\Windows\Temp\sqlite64.dll#
        • Sqlite Module In Temp Folder Splunk (inferred path)
      • C:\Windows\Temp\sys.tmp#
        • HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators Sigma (inferred path)
      • C:\Windows\Temp\tmp.bat#
        • Potential Winnti Dropper Activity Sigma (inferred path)
      • C:\Windows\Temp\winwsh.exe#
        • Mustang Panda Dropper Sigma (inferred path)
    • C:\Windows\twain_32#
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\Vss#
    • C:\Windows\WaaS#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Loaded by Svchost Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
    • C:\Windows\Web#
      • Process Execution from an Unusual Directory Elastic (inferred branch)
      • Unsigned DLL from Suspicious Directory Elastic (inferred branch)
      • Unsigned DLL Side-Loading from a Suspicious Folder Elastic (inferred branch)
      • C:\Windows\Web\4K\Wallpaper\Windows#
        • DLL Load By System Process From Suspicious Locations Sigma (inferred branch)
        • Indirect Command Execution via ForFiles Elastic (inferred branch)
        • Ingress Tool Transfer via INET Cache Elastic (inferred branch)
        • Keystroke Input Capture via DirectInput Elastic (inferred branch)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
        • Potential Command Line Path Traversal Evasion Attempt Sigma (inferred branch)
        • Potential Privilege Escalation via LocalPotato Exploit Elastic (inferred branch)
        • Potential System Tampering via File Modification Elastic (inferred branch)
        • Registry Run Key Modified by Unusual Process Elastic (inferred branch)
        • Remote Memory Write to Trusted Target Process Elastic (inferred branch)
        • Startup Persistence via Unusual Process Elastic (inferred branch)
        • Suspicious DLL Loaded for Persistence or Privilege Escalation Elastic (inferred branch)
        • Suspicious PHP Script Execution Elastic (inferred branch)
        • Suspicious RDP ActiveX Client Loaded Elastic (inferred branch)
      • C:\Windows\Web\Wallpaper\Windows#
        • DLL Load By System Process From Suspicious Locations Sigma (inferred branch)
        • Indirect Command Execution via ForFiles Elastic (inferred branch)
        • Ingress Tool Transfer via INET Cache Elastic (inferred branch)
        • Keystroke Input Capture via DirectInput Elastic (inferred branch)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
        • Potential Command Line Path Traversal Evasion Attempt Sigma (inferred branch)
        • Potential Privilege Escalation via LocalPotato Exploit Elastic (inferred branch)
        • Potential System Tampering via File Modification Elastic (inferred branch)
        • Registry Run Key Modified by Unusual Process Elastic (inferred branch)
        • Remote Memory Write to Trusted Target Process Elastic (inferred branch)
        • Startup Persistence via Unusual Process Elastic (inferred branch)
        • Suspicious DLL Loaded for Persistence or Privilege Escalation Elastic (inferred branch)
        • Suspicious PHP Script Execution Elastic (inferred branch)
        • Suspicious RDP ActiveX Client Loaded Elastic (inferred branch)
    • C:\Windows\winhlp32.exe#
      • Winhlp32 Spawning a Process Splunk (inferred path)
      • Wscript Or Cscript Suspicious Child Process Splunk (inferred path)
    • C:\Windows\WinSxS#
      • Potential SNAKE Malware Persistence Service Execution Sigma (inferred branch)
      • WinSxS Executable File Creation By Non-System Process Sigma (inferred branch)
      • C:\Windows\WinSxS\amd64_dual_wvkrnlintvsc.inf_31bf3856ad364e35_10.0.26100.1150_none_8fc7b2b3ba9d437a#
        • C:\Windows\WinSxS\amd64_dual_wvkrnlintvsc.inf_31bf3856ad364e35_10.0.26100.1150_none_8fc7b2b3ba9d437a\vkrnlintvsc.sys#
        • C:\Windows\WinSxS\amd64_dual_wvkrnlintvsc.inf_31bf3856ad364e35_10.0.26100.1150_none_8fc7b2b3ba9d437a\wvkrnlintvsc.inf#
          • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
      • C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515#
        • C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandbox.exe#
          • Suspicious Windows Sandbox Execution Elastic (inferred path)
        • C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandboxClient.exe#
          • Suspicious Windows Sandbox Execution Elastic (inferred path)
          • Windows Sandbox with Sensitive Configuration Elastic (inferred path)
      • C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_a6b1a99b83489282\calc.exe#
        • Windows DLL Side-Loading In Calc Splunk (inferred path)
      • C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.26100.1150_none_d80c883d2e0baae6\adamntds.dit#
        • NTDS.DIT Created Sigma (inferred path)
      • C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFault.exe#
        • SNAKE Malware Service Persistence Sigma (inferred path)
        • SNAKE Malware WerFault Persistence File Creation Sigma (inferred path)
        • Windows Snake Malware Service Create Splunk (inferred path)
      • C:\Windows\WinSxS\amd64_microsoft-windows-i..vercommon.resources_31bf3856ad364e35_10.0.26100.1_en-us_d01d06385cb60881\appcmd.exe.mui#
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
      • C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.26100.1591_none_239398876b1e5306\InetMgr.exe#
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Escalation Behavior Splunk (inferred path)
      • C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.26100.1150_none_db82af066c7c007e\bash.exe#
        • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
        • Execution via OpenClaw Agent Elastic (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • MMC Spawning Windows Shell Sigma (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Shell Process Spawned by Java.EXE Sigma (inferred path)
        • Suspicious Child Process from WinGet Configuration Remoting Server Elastic (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process Of SQL Server Sigma (inferred path)
        • Suspicious CrushFTP Child Process Sigma (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MSHTA Child Process Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Processes Spawned by WinRM Sigma (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Visual Studio Code Tunnel Shell Execution Sigma (inferred path)
        • Web or Application Server Spawning a Shell Splunk (inferred path)
        • Windows DLL Search Order Hijacking with iscsicpl Splunk (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Remote Assistance Spawning Process Splunk (inferred path)
        • Windows Scheduled Task Service Spawned Shell Splunk (inferred path)
        • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • Windows UAC Bypass Suspicious Child Process Splunk (inferred path)
        • WinRAR Spawning Shell Application Splunk (inferred path)
        • WinRM Spawning a Process Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
      • C:\Windows\WinSxS\amd64_microsoft-windows-lxss-manager_31bf3856ad364e35_10.0.26100.1_none_7b51f8fd334cdf4f\bsdtar#
        • Potential Execution via VS Code Tasks Elastic (inferred path)
      • C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1742_none_07d5a4b5643ebc7c\ntoskrnl.exe#
        • Suspicious Critical System Files Modification Elastic (inferred path)
      • C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.26100.1_none_a7c632dbdc1d61bb\w3wp.exe#
        • Chopper Webshell Process Pattern Sigma (inferred path)
        • Cloud Instance Metadata Credential Path HTTP Request Elastic (inferred path)
        • Detect Suspicious Commands Initiated by Webserver Processes Kusto (inferred path)
        • Exchange Worker Process Making Remote Call Kusto (inferred path)
        • Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process Sigma (inferred path)
        • Microsoft Exchange Worker Spawning Suspicious Processes Elastic (inferred path)
        • NTDS.DIT Creation By Uncommon Parent Process Sigma (inferred path)
        • Potential IIS Web Shell File Creation Elastic (inferred path)
        • Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE Sigma (inferred path)
        • Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators Sigma (inferred path)
        • Potential Shellcode Injection via a WebShell Elastic (inferred path)
        • Privilege Escalation via Microsoft Exchange DLL Hijacking Elastic (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • Suspicious ASPX File Drop by Exchange Sigma (inferred path)
        • Suspicious File Drop by Exchange Sigma (inferred path)
        • Suspicious File Write to SharePoint Layouts Directory Sigma (inferred path)
        • Suspicious File Write to Webapps Root Directory Sigma (inferred path)
        • Suspicious IIS Module Registration Sigma (inferred path)
        • Suspicious Microsoft IIS Child Process Elastic (inferred path)
        • Suspicious PowerShell Parent Process Sigma (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Process Spawned by CentreStack Portal AppPool Sigma (inferred path)
        • Suspicious Windows Server Update Service Child Process Elastic (inferred path)
        • Web or Application Server Spawning a Shell Splunk (inferred path)
        • Webshell Detection With Command Line Keywords Sigma (inferred path)
        • Webshell Hacking Activity Patterns Sigma (inferred path)
        • Webshell Tool Reconnaissance Activity Sigma (inferred path)
        • Windows Server Update Service Spawning Suspicious Processes Elastic (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
      • C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.26100.1_none_5bc14811ec1c13bc\TFTP.EXE#
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
      • C:\Windows\WinSxS\amd64_windows-defender-am-engine_31bf3856ad364e35_10.0.26100.1_none_fc1f03fc1ecd9d6b\MpEngine.dll#
        • Windows Suspicious Defender Engine or Signature Files Created Splunk (inferred path)
      • C:\Windows\WinSxS\amd64_windows-defender-am-sigs_31bf3856ad364e35_10.0.26100.1_none_b978666c842dd9eb#
        • C:\Windows\WinSxS\amd64_windows-defender-am-sigs_31bf3856ad364e35_10.0.26100.1_none_b978666c842dd9eb\MpAsBase.vdm#
        • C:\Windows\WinSxS\amd64_windows-defender-am-sigs_31bf3856ad364e35_10.0.26100.1_none_b978666c842dd9eb\MpAsDlta.vdm#
        • C:\Windows\WinSxS\amd64_windows-defender-am-sigs_31bf3856ad364e35_10.0.26100.1_none_b978666c842dd9eb\MpAvBase.vdm#
        • C:\Windows\WinSxS\amd64_windows-defender-am-sigs_31bf3856ad364e35_10.0.26100.1_none_b978666c842dd9eb\MpAvDlta.vdm#
          • Windows Suspicious Defender Engine or Signature Files Created Splunk (inferred path)
      • C:\Windows\WinSxS\amd64_wvkrnlintvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3fa1b7c3aa7920b3\wvkrnlintvsc.inf_loc#
        • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
      • C:\Windows\WinSxS\Backup#
        • C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_10.0.26100.1_en-us_66f0ef778e81c846_services.exe.mui_86ea5e71#
          • Rare Process as a Service Kusto (inferred path)
        • C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.26100.1591_none_07e92604c202c503_shell32.dll.mun_19f53887#
        • C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.26100.1591_none_07e92604c202c503_shell32.dll_0d29dca9#
          • Invoke-Obfuscation Via Use Rundll32 - Security Sigma (inferred path)
          • Invoke-Obfuscation Via Use Rundll32 - System Sigma (inferred path)
        • C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.26100.1_en-us_60b5c4eee368c62c_dsregcmd.exe.mui_8ce2c638#
        • C:\Windows\WinSxS\Backup\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77_mpdlpcmd.exe_f16d1925#
          • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
        • C:\Windows\WinSxS\Backup\wow64_microsoft-windows-shell32_31bf3856ad364e35_10.0.26100.1591_none_123dd056f66386fe_shell32.dll_0d29dca9#
          • Invoke-Obfuscation Via Use Rundll32 - Security Sigma (inferred path)
          • Invoke-Obfuscation Via Use Rundll32 - System Sigma (inferred path)
      • C:\Windows\WinSxS\FileMaps\$recycle.bin.cdf-ms#
        • HackTool - LaZagne Execution Sigma (inferred path)
        • Process Execution From A Potentially Suspicious Folder Sigma (inferred path)
        • Suspicious Service Binary Directory Sigma (inferred path)
        • Suspicious writes to windows Recycle Bin Splunk (inferred path)
        • Windows Credentials Access via VaultCli Module Splunk (inferred path)
        • Windows Scheduled Task DLL Module Loaded Splunk (inferred path)
        • Windows Suspicious Driver Loaded Path Splunk (inferred path)
      • C:\Windows\WinSxS\Manifests#
        • C:\Windows\WinSxS\Manifests\amd64_dual_tpmvsc.inf_31bf3856ad364e35_10.0.26100.1150_none_8cff5de9ab2b8eba.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_dual_wdmvsc.inf_31bf3856ad364e35_10.0.26100.1150_none_acc069c82be2b883.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_dual_wfcvsc.inf_31bf3856ad364e35_10.0.26100.1591_none_abab3289ad7fb20c.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_dual_wnetvsc.inf_31bf3856ad364e35_10.0.26100.1591_none_5bca0b386073758e.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_dual_wstorvsc.inf_31bf3856ad364e35_10.0.26100.1591_none_46cee6be48a5b81d.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_dual_wvkrnlintvsc.inf_31bf3856ad364e35_10.0.26100.1150_none_8fc7b2b3ba9d437a.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-i..ocale-nls.resources_31bf3856ad364e35_10.0.26100.1_en-us_d9f8791526ccd66d.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-wmvdecod.resources_31bf3856ad364e35_10.0.26100.1_en-us_63e5d4b91b9a7a4b.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-wmvencod.resources_31bf3856ad364e35_10.0.26100.1_en-us_79a2ee751b9a7a4b.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_tpmvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_59068a0f42e86d8f.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_wdmvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_19184e66d4d4edfe.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_wfcvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3ce678df40cdbba2.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_wnetvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_5d740456342cfa0e.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_wstorvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_55ff8386243169b1.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_wvkrnlintvsc.inf-languagepack_31bf3856ad364e35_10.0.26100.1_en-us_3efc8118261f7a58.manifest#
        • C:\Windows\WinSxS\Manifests\amd64_wvkrnlintvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3fa1b7c3aa7920b3.manifest#
          • Potential File Extension Spoofing Using Right-to-Left Override Sigma (inferred path)
      • C:\Windows\WinSxS\msil_system.servicemodel.install_b77a5c561934e089_10.0.26100.1_none_0fe1dd07ea672024\System.ServiceModel.Install.dll#
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
      • C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1_none_b0d3de420cfbf405\appcmd.exe#
        • Disable Windows IIS HTTP Logging Sigma (inferred path)
        • IIS Application Pool credential dumping Sigma (inferred path)
        • IIS HTTP Logging Disabled Elastic (inferred path)
        • IIS Native-Code Module Command Line Installation Sigma (inferred path)
        • Microsoft IIS Service Account Password Dumped Elastic (inferred path)
        • Microsoft IIS Service Account Password Dumped Sigma (inferred path)
        • Suspicious IIS URL GlobalRules Rewrite Via AppCmd Sigma (inferred path)
        • Visual Studio Code Tunnel Execution (Windows Event Log) Splunk (inferred path)
        • Windows Disable Windows Event Logging Disable HTTP Logging Splunk (inferred path)
        • Windows IIS Components Add New Module Splunk (inferred path)
        • Windows Rundll32 with Non-Standard File Extension Splunk (inferred path)
      • C:\Windows\WinSxS\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_a8f2281169c44e9b\WMIC.exe#
        • Application Removed Via Wmic.EXE Sigma (inferred path)
        • Application Termination Attempt via Wmic.EXE Sigma (inferred path)
        • Blue Mockingbird Sigma (inferred path)
        • Command Obfuscation via Unicode Modifier Letters Elastic (inferred path)
        • Computer System Reconnaissance Via Wmic.EXE Sigma (inferred path)
        • Creation of Shadow Copy Splunk (inferred path)
        • Creation of Shadow Copy with wmic and powershell Splunk (inferred path)
        • Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process Sigma (inferred path)
        • Deleting Shadow Copies Splunk (inferred path)
        • Domain Account Discovery with Wmic Splunk (inferred path)
        • Domain Controller Discovery with Wmic Splunk (inferred path)
        • Domain Group Discovery With Wmic Splunk (inferred path)
        • DotNet CLR DLL Loaded By Scripting Applications Sigma (inferred path)
        • Dynwrapx Image Load via Windows Scripts Elastic (inferred path)
        • Elevated Group Discovery With Wmic Splunk (inferred path)
        • Enumeration of Administrator Accounts Elastic (inferred path)
        • EventLog Query Requests By Builtin Utilities Sigma (inferred path)
        • Hardware Model Reconnaissance Via Wmic.EXE Sigma (inferred path)
        • HTML Help HH.EXE Suspicious Child Process Sigma (inferred path)
        • Local Account Discovery With Wmic Splunk (inferred path)
        • Local Accounts Discovery Chronicle (inferred path)
        • Local Accounts Discovery Sigma (inferred path)
        • Local Groups Reconnaissance Via Wmic.EXE Sigma (inferred path)
        • Mmc LOLBAS Execution Process Spawn Splunk (inferred path)
        • NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE Sigma (inferred path)
        • PaperCut MF/NG Potential Exploitation Sigma (inferred path)
        • Password Set to Never Expire via WMI Sigma (inferred path)
        • Persistence via WMI Event Subscription Elastic (inferred path)
        • Potential CVE-2023-21554 QueueJumper Exploitation Sigma (inferred path)
        • Potential Maze Ransomware Activity Sigma (inferred path)
        • Potential Process Reconnaissance via Wmic.EXE Sigma (inferred path)
        • Potential Product Class Reconnaissance Via Wmic.EXE Sigma (inferred path)
        • Potential Product Reconnaissance Via Wmic.EXE Sigma (inferred path)
        • Potential Remote SquiblyTwo Technique Execution Sigma (inferred path)
        • Potential Unquoted Service Path Reconnaissance Via Wmic.EXE Sigma (inferred path)
        • Potential Windows Defender Tampering Via Wmic.EXE Sigma (inferred path)
        • Potentially Suspicious EventLog Recon Activity Using Log Query Utilities Sigma (inferred path)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred path)
        • Potentially Suspicious PowerShell Child Processes Sigma (inferred path)
        • Process Creation Attempt via Wmic.EXE Sigma (inferred path)
        • Process Discovery Using Built-in Tools Elastic (inferred path)
        • Process Kill Base On File Path Splunk (inferred path)
        • Rare Remote Thread Creation By Uncommon Source Image Sigma (inferred path)
        • RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class Sigma (inferred path)
        • Recon Information for Export with Command Prompt Sigma (inferred path)
        • Registry Enumeration via WMI Stdregprov Sigma (inferred path)
        • Registry Manipulation via WMI Stdregprov Sigma (inferred path)
        • Remote Process Instantiation via WMI Splunk (inferred path)
        • Remote System Discovery with Wmic Splunk (inferred path)
        • Remote WMI Command Attempt Splunk (inferred path)
        • Rename System Utilities Kusto (inferred path)
        • Resize ShadowStorage volume Splunk (inferred path)
        • Security Software Discovery using WMIC Elastic (inferred path)
        • Service Control Spawned via Script Interpreter Elastic (inferred path)
        • Service Reconnaissance Via Wmic.EXE Sigma (inferred path)
        • Service Started/Stopped Via Wmic.EXE Sigma (inferred path)
        • Service Startup Type Change Via Wmic.EXE Sigma (inferred path)
        • Services LOLBAS Execution Process Spawn Splunk (inferred path)
        • Shadow Copies Creation Using Operating Systems Utilities Sigma (inferred path)
        • Shadow Copies Deletion Using Operating Systems Utilities Sigma (inferred path)
        • Shell Execution via Windows Shortcut File Elastic (inferred path)
        • Startup Persistence by a Suspicious Process Elastic (inferred path)
        • Suspicious .NET Code Compilation Elastic (inferred path)
        • Suspicious ArcSOC.exe Child Process Sigma (inferred path)
        • Suspicious Autorun Registry Modified via WMI Sigma (inferred path)
        • Suspicious BitLocker Access Agent Update Utility Execution Sigma (inferred path)
        • Suspicious Child Process Of Manage Engine ServiceDesk Sigma (inferred path)
        • Suspicious Child Process via Azure VM CustomScript Extension Elastic (inferred path)
        • Suspicious Eventlog Clearing or Configuration Change Activity Sigma (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Execution from a Mounted Device Elastic (inferred path)
        • Suspicious Microsoft Office Child Process Sigma (inferred path)
        • Suspicious Microsoft OneNote Child Process Sigma (inferred path)
        • Suspicious MS Outlook Child Process Elastic (inferred path)
        • Suspicious MSDT Parent Process Sigma (inferred path)
        • Suspicious Outlook Child Process Sigma (inferred path)
        • Suspicious PDF Reader Child Process Elastic (inferred path)
        • Suspicious Process By Web Server Process Sigma (inferred path)
        • Suspicious Process from FortiClient VPN Trace Script Elastic (inferred path)
        • Suspicious Processes Spawned by Java.EXE Sigma (inferred path)
        • Suspicious ScreenConnect Client Child Process Elastic (inferred path)
        • Suspicious Serv-U Process Pattern Sigma (inferred path)
        • Suspicious ShellExec_RunDLL Call Via Ordinal Sigma (inferred path)
        • Suspicious Shells Spawn by Java Utility Keytool Sigma (inferred path)
        • Suspicious Spool Service Child Process Sigma (inferred path)
        • Suspicious Windows Service Tampering Sigma (inferred path)
        • Suspicious WMIC XSL Script Execution Elastic (inferred path)
        • Suspicious WMIC XSL Script Execution Elastic (inferred path)
        • System Disk And Volume Reconnaissance Via Wmic.EXE Sigma (inferred path)
        • System File Execution Location Anomaly Sigma (inferred path)
        • System Information Discovery Via Wmic.EXE Sigma (inferred path)
        • Uncommon System Information Discovery Via Wmic.EXE Sigma (inferred path)
        • Volume Shadow Copy Deletion via WMIC Elastic (inferred path)
        • Windows Alternate DataStream - Process Execution Splunk (inferred path)
        • Windows EventLog Recon Activity Using Log Query Utilities Splunk (inferred path)
        • Windows Hotfix Updates Reconnaissance Via Wmic.EXE Sigma (inferred path)
        • Windows MSIExec Spawn Discovery Command Splunk (inferred path)
        • Windows Office Product Spawned Uncommon Process Splunk (inferred path)
        • Windows Process Commandline Discovery Splunk (inferred path)
        • Windows SCCM Smsexec Spawned a Suspicious Child Process Splunk (inferred path)
        • Windows Shell/Scripting Application File Write to Suspicious Folder Sigma (inferred path)
        • Windows Suspicious Child Process from Node.js - React2Shell Sigma (inferred path)
        • Windows Suspicious Child Process of TieringEngineService.exe Splunk (inferred path)
        • Windows Suspicious Child Process Spawned From WebServer Splunk (inferred path)
        • Windows Suspicious React or Next.js Child Process Splunk (inferred path)
        • Windows System Information Discovery Elastic (inferred path)
        • Windows WMI Process And Service List Splunk (inferred path)
        • Windows WMI Process Call Create Splunk (inferred path)
        • Windows WMI Reconnaissance Class Query Splunk (inferred path)
        • Windows Wmic CPU Discovery Splunk (inferred path)
        • Windows Wmic DiskDrive Discovery Splunk (inferred path)
        • Windows Wmic Memory Chip Discovery Splunk (inferred path)
        • Windows Wmic Network Discovery Splunk (inferred path)
        • Windows WMIC Shadowcopy Delete Splunk (inferred path)
        • Windows Wmic Systeminfo Discovery Splunk (inferred path)
        • WMI Spawning Suspicious Child Process (Living off the Land) Kusto (inferred path)
        • Wmic Group Discovery Splunk (inferred path)
        • WMIC Loading Scripting Libraries Sigma (inferred path)
        • Wmic NonInteractive App Uninstallation Splunk (inferred path)
        • WMIC Remote Command Elastic (inferred path)
        • WMIC Remote Command Execution Sigma (inferred path)
        • WMIC XSL Execution via URL Splunk (inferred path)
        • Wmiprvse LOLBAS Execution Process Spawn Splunk (inferred path)
        • Wscript Or Cscript Suspicious Child Process Splunk (inferred path)
        • Wsmprovhost LOLBAS Execution Process Spawn Splunk (inferred path)
        • XSL Script Execution Via WMIC.EXE Sigma (inferred path)
        • XSL Script Execution With WMIC Splunk (inferred path)
      • C:\Windows\WinSxS\x86_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1_none_fc13383492b3e3d6\csvde.exe#
        • Active Directory Structure Export Via Csvde.EXE Sigma (inferred path)
      • C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.26100.1_none_e9f03efdb03c43d2\dsacls.exe#
        • Potential Password Spraying Attempt Using Dsacls.EXE Sigma (inferred path)
        • Potentially Over Permissive Permissions Granted Using Dsacls.EXE Sigma (inferred path)
      • C:\Windows\WinSxS\x86_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1_none_c1bc4da0b901a509\ldifde.exe#
        • Active Directory Structure Export Via Ldifde.EXE Sigma (inferred path)
        • Import LDAP Data Interchange Format File Via Ldifde.EXE Sigma (inferred path)
        • Legitimate Application Writing Files In Uncommon Location Sigma (inferred path)
        • Webshell Hacking Activity Patterns Sigma (inferred path)
        • Windows Ldifde Directory Object Behavior Splunk (inferred path)
      • C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiWorker.exe#
        • Files With System Process Name In Unsuspected Locations Sigma (inferred path)
      • C:\Windows\WinSxS\x86_microsoft-windows-t..-tsappsrv-component_31bf3856ad364e35_10.0.26100.1_none_0fa97d4da2aeaff5#
        • C:\Windows\WinSxS\x86_microsoft-windows-t..-tsappsrv-component_31bf3856ad364e35_10.0.26100.1_none_0fa97d4da2aeaff5\TSMSISrv.dll#
        • C:\Windows\WinSxS\x86_microsoft-windows-t..-tsappsrv-component_31bf3856ad364e35_10.0.26100.1_none_0fa97d4da2aeaff5\TSVIPSrv.dll#
          • Potential System DLL Sideloading From Non System Locations Sigma (inferred path)
      • C:\Windows\WinSxS\x86_netfx-mscorwks_dll_b03f5f7f11d50a3a_10.0.27000.370_none_15541c2042bfa0c0\mscorwks.dll#
        • Delayed Common Language Runtime Load Elastic (inferred path)
        • Image Load via Synthetic Stack Spoofing Elastic (inferred path)
        • Potential Evasion via Inline Execute Assembly Elastic (inferred path)
  • C:\Windows #
    • DLL Search Order Hijackig Via Additional Space in Path Sigma (inferred branch)
    • C:\Windows \System32#
      • TrustedPath UAC Bypass Pattern Sigma (inferred branch)
      • Windows Mock Trusted Directory MSC File Creation Splunk (inferred branch)
      • C:\Windows \System32\de-DE#
      • C:\Windows \System32\en-US#
      • C:\Windows \System32\es-ES#
      • C:\Windows \System32\fr-FR#
      • C:\Windows \System32\it-IT#
      • C:\Windows \System32\ja-JP#
      • C:\Windows \System32\ko-KR#
      • C:\Windows \System32\zh-CN#
      • C:\Windows \System32\zh-TW#
        • Windows Mock Trusted Directory MSC File Creation Splunk (inferred branch)
    • C:\Windows \SysWOW64#
      • TrustedPath UAC Bypass Pattern Sigma (inferred branch)

• D:\ #

  • D:\ManagedTools\cmdlets#
    • Privilege Escalation via Microsoft Exchange DLL Hijacking Elastic (inferred branch)

• %USERPROFILE% #

  • %USERPROFILE%\AppData#
    • Chromium Extension Loaded from Unusual Parent Elastic (inferred branch)
    • COLDSTEEL RAT Anonymous User Process Execution Sigma (inferred branch)
    • Connection to a Suspicious URL Elastic (inferred branch)
    • Defense Evasion via Registry Modification Elastic (inferred branch)
    • Delayed Execution via Ping Elastic (inferred branch)
    • Execution from Suspicious Directory Elastic (inferred branch)
    • Execution of a Windows Script File Written by a Suspicious Process Elastic (inferred branch)
    • Execution via a Suspicious WMI Client Elastic (inferred branch)
    • HackTool - LaZagne Execution Sigma (inferred branch)
    • Indirect Command Execution via ForFiles Elastic (inferred branch)
    • Ingress Tool Transfer via CURL Elastic (inferred branch)
    • LSASS Access From Program In Potentially Suspicious Folder Sigma (inferred branch)
    • NTDS.DIT Creation By Uncommon Parent Process Sigma (inferred branch)
    • NTDS.DIT Creation By Uncommon Process Sigma (inferred branch)
    • Persistence via BITS SetNotifyCmdLine Method Elastic (inferred branch)
    • Service Installation in Suspicious Folder Sigma (inferred branch)
    • Suspicious Execution via MSIEXEC Elastic (inferred branch)
    • Suspicious Execution via Windows Management Instrumentation Elastic (inferred branch)
    • Suspicious Execution via Windows Services Elastic (inferred branch)
    • Suspicious File Creation In Uncommon AppData Folder Sigma (inferred branch)
    • Suspicious Microsoft Office Child Process Sigma (inferred branch)
    • Suspicious Microsoft OneNote Child Process Sigma (inferred branch)
    • Suspicious Parent-Child Relationship Elastic (inferred branch)
    • Suspicious PowerShell Execution via Windows Scripts Elastic (inferred branch)
    • Suspicious Process DNS Query Known Abuse Web Services Splunk (inferred branch)
    • Suspicious Process Patterns NTDS.DIT Exfil Sigma (inferred branch)
    • Suspicious Scheduled Task Write to System32 Tasks Sigma (inferred branch)
    • Suspicious Windows Defender Registry Modification Elastic (inferred branch)
    • Windows Bluetooth Service Installed From Uncommon Location Splunk (inferred branch)
    • Windows DNS Query Request To TinyUrl Splunk (inferred branch)
    • Windows Suspicious Driver Loaded Path Splunk (inferred branch)
    • %USERPROFILE%\AppData\license.dat#
      • Drop IcedID License dat Splunk (inferred path)
    • %USERPROFILE%\AppData\Local#
      • Control Panel Process with Unusual Arguments Elastic (inferred branch)
      • Detect Outlook exe writing a zip file Splunk (inferred branch)
      • Kapeka Backdoor Loaded Via Rundll32.EXE Sigma (inferred branch)
      • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
      • Potential Kapeka Decrypted Backdoor Indicator Sigma (inferred branch)
      • Potential Recon Activity Using DriverQuery.EXE Sigma (inferred branch)
      • Scheduled Task Creation From Potential Suspicious Parent Location Sigma (inferred branch)
      • Small Sieve Malware File Indicator Creation Sigma (inferred branch)
      • Suspicious Child Process Of BgInfo.EXE Sigma (inferred branch)
      • %USERPROFILE%\AppData\Local\Apps\2.0#
        • ClickOnce Deployment Execution - Dfsvc.EXE Child Process Sigma (inferred branch)
        • Potentially Suspicious Child Process Of ClickOnce Application Sigma (inferred branch)
        • Unsigned Module Loaded by ClickOnce Application Sigma (inferred branch)
      • %USERPROFILE%\AppData\Local\Comms#
        • %USERPROFILE%\AppData\Local\Comms\Unistore\data#
          • Access To Windows Outlook Mail Files By Uncommon Applications Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Comms\UnistoreDB\store.vol#
          • Access To Windows Outlook Mail Files By Uncommon Applications Sigma (inferred path)
      • %USERPROFILE%\AppData\Local\Discord#
        • Potential Execution via Shortcut Modification Elastic (inferred branch)
      • %USERPROFILE%\AppData\Local\Google\Chrome\User Data#
        • Access to Browser Credentials from Suspicious Memory Elastic (inferred branch)
        • Failed Access Attempt to Web Browser Files Elastic (inferred branch)
        • User browser credentials dump via network share (DonPapi, Lazagne) Sigma (inferred branch)
        • Web Browser Credential Access via Scripting Utility Elastic (inferred branch)
        • Web Browser Credential Access via Unsigned Process Elastic (inferred branch)
        • %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default#
          • Access to Browser Credentials from Suspicious Memory Elastic (inferred branch)
          • Failed Access Attempt to Web Browser Files Elastic (inferred branch)
          • Potential Browser Information Discovery Elastic (inferred branch)
          • Suspicious Browser Preferences File Modification Elastic (inferred branch)
          • Web Browser Credential Access via Scripting Utility Elastic (inferred branch)
          • Web Browser Credential Access via Unsigned Process Elastic (inferred branch)
          • %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings#
            • Windows Credentials from Password Stores Chrome Extension Access Splunk (inferred branch)
          • %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Login Data#
            • Windows Credentials from Password Stores Chrome Login Data Access Splunk (inferred path)
        • %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Local State#
          • Windows Credentials from Password Stores Chrome LocalState Access Splunk (inferred path)
      • %USERPROFILE%\AppData\Local\Microsoft#
        • Malicious DLL File Dropped in the Teams or OneDrive Folder Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Microsoft\Cache134.dat#
          • Octopus Scanner Malware Sigma (inferred path)
        • %USERPROFILE%\AppData\Local\Microsoft\Credentials#
          • Credential Manager Access By Uncommon Applications Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\microsoft\edge\user data#
          • Access to Browser Credentials from Suspicious Memory Elastic (inferred branch)
          • Failed Access Attempt to Web Browser Files Elastic (inferred branch)
          • Web Browser Credential Access via Scripting Utility Elastic (inferred branch)
          • Web Browser Credential Access via Unsigned Process Elastic (inferred branch)
          • %USERPROFILE%\AppData\Local\microsoft\edge\user data\default#
            • Access to Browser Credentials from Suspicious Memory Elastic (inferred branch)
            • Failed Access Attempt to Web Browser Files Elastic (inferred branch)
            • Potential Browser Information Discovery Elastic (inferred branch)
            • Suspicious Browser Preferences File Modification Elastic (inferred branch)
            • Web Browser Credential Access via Scripting Utility Elastic (inferred branch)
            • Web Browser Credential Access via Unsigned Process Elastic (inferred branch)
            • %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Default\Cookies#
            • %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data#
              • User browser credentials dump via network share (DonPapi, Lazagne) Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Microsoft\ExplorerSync.db#
          • Octopus Scanner Malware Sigma (inferred path)
        • %USERPROFILE%\AppData\Local\Microsoft\FORMS\IPM#
          • Potential Persistence Via Outlook Form Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Microsoft\Olk\Attachments#
          • Suspicious File Created in Outlook Temporary Directory Sigma (inferred branch)
          • Suspicious Run Key from Download Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Microsoft\Vault#
          • Credential Manager Access By Uncommon Applications Sigma (inferred branch)
          • Suspicious Vault Files Access via RPC Elastic (inferred branch)
        • %USERPROFILE%\AppData\Local\Microsoft\Windows#
          • %USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache#
            • Ingress Tool Transfer via INET Cache Elastic (inferred branch)
            • %USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook#
              • ISO File Created Within Temp Folders Sigma (inferred branch)
            • %USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache\IE#
              • File Executed from INetCache (Sysmon) Splunk (inferred branch)
              • File Executed from INetCache (Windows Event Log) Splunk (inferred branch)
              • Potential CVE-2024-21412 Exploitation Elastic (inferred branch)
              • Suspicious Execution from INET Cache Elastic (inferred branch)
              • Suspicious Execution from INET Cache Elastic (inferred branch)
              • Windows Script Execution via MMC Console File Elastic (inferred branch)
          • %USERPROFILE%\AppData\Local\Microsoft\Windows\INetCookies#
            • Remcos RAT INETCookies File Deletion Elastic (inferred branch)
          • %USERPROFILE%\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat#
            • Access To Browser Credential Files By Uncommon Applications Sigma (inferred path)
        • %USERPROFILE%\AppData\Local\Microsoft\WindowsApps#
          • Attempt to Install or Run Kali Linux via WSL Elastic (inferred branch)
          • Potential DLL Hijacking via Environment Paths Elastic (inferred branch)
          • UAC Bypass Attempt via SilentCleanup Task DLL Search Order Hijacking Elastic (inferred branch)
          • WSL Kali-Linux Usage Sigma (inferred branch)
          • %USERPROFILE%\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe#
            • Windows Get-Variable.EXE Execution from WindowsApps Folder Splunk (inferred path)
      • %USERPROFILE%\AppData\Local\MicrosoftWindowsOutlookDataPlus.txt#
        • Small Sieve Malware File Indicator Creation Sigma (inferred path)
      • %USERPROFILE%\AppData\Local\mRemoteNG#
        • User application credentials dump via network share (DonPapi, Lazagne) Sigma (inferred branch)
      • %USERPROFILE%\AppData\Local\packages#
        • Attempt to Install or Run Kali Linux via WSL Elastic (inferred branch)
        • Suspicious File Created in Outlook Temporary Directory Sigma (inferred branch)
        • Suspicious Run Key from Download Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\packages\KaliLinux#
          • WSL Kali-Linux Usage Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json#
          • Windows Terminal Profile Settings Modification By Uncommon Process Sigma (inferred path)
      • %USERPROFILE%\AppData\Local\Programs\Microsoft VS Code#
        • Known Desktop Application DLL Search Order Hijack Elastic (inferred branch)
        • Potential Initial Access via DLL Search Order Hijacking Elastic (inferred branch)
      • %USERPROFILE%\AppData\Local\Roaming#
        • Suspicious Child Process of AspNetCompiler Sigma (inferred branch)
      • %USERPROFILE%\AppData\Local\sam#
        • Potential SAM Database Dump Sigma (inferred path)
      • %USERPROFILE%\AppData\Local\slack#
        • Potential Execution via Shortcut Modification Elastic (inferred branch)
      • %USERPROFILE%\AppData\Local\Temp#
        • Axios NPM Compromise File Creation Indicators - Windows Sigma (inferred branch)
        • BaaUpdate.exe Suspicious DLL Load Sigma (inferred branch)
        • DarkSide Ransomware Pattern Sigma (inferred branch)
        • Executables Or Script Creation In Temp Path Splunk (inferred branch)
        • Execution from a Downloaded ISO File Elastic (inferred branch)
        • Execution from Suspicious Directory Elastic (inferred branch)
        • Malicious Reputation of Executable Download Elastic (inferred branch)
        • OneNote Attachment File Dropped In Suspicious Location Sigma (inferred branch)
        • Potential Evasion via Oversized Image Load Elastic (inferred branch)
        • Potential Execution via LNK Stomping Elastic (inferred branch)
        • Potential Raspberry Robin Registry Set Internet Settings ZoneMap Sigma (inferred branch)
        • Potential REMCOS Trojan Execution Elastic (inferred branch)
        • Potentially Suspicious Execution Of PDQDeployRunner Sigma (inferred branch)
        • PsExec Tool Execution From Suspicious Locations - PipeName Sigma (inferred branch)
        • Publisher Attachment File Dropped In Suspicious Location Sigma (inferred branch)
        • Remote Thread Creation In Mstsc.Exe From Suspicious Location Sigma (inferred branch)
        • Scheduled Task from a Browser or Compression Utility Descendant Elastic (inferred branch)
        • Self Extraction Directive File Created In Potentially Suspicious Location Sigma (inferred branch)
        • Shell Execution via Windows Shortcut File Elastic (inferred branch)
        • Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred branch)
        • Suspicious AddinUtil.EXE CommandLine Execution Sigma (inferred branch)
        • Suspicious Child Process of AspNetCompiler Sigma (inferred branch)
        • Suspicious Electron Application Child Processes Sigma (inferred branch)
        • Suspicious HTML File Creation Elastic (inferred branch)
        • Suspicious NTDLL Image Load Elastic (inferred branch)
        • Suspicious PROCEXP152.sys File Created In TMP Sigma (inferred branch)
        • Suspicious Registry Modification via WMI Elastic (inferred branch)
        • Suspicious Shortcut File Overwrite Elastic (inferred branch)
        • Suspicious Windows Defender Exclusions Added via PowerShell Elastic (inferred branch)
        • Suspicious WindowsTerminal Child Processes Sigma (inferred branch)
        • Suspicious Word Cab File Write CVE-2021-40444 Sigma (inferred branch)
        • Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location Sigma (inferred branch)
        • UAC Bypass Using DismHost Sigma (inferred branch)
        • UAC Bypass Using IEInstal - File Sigma (inferred branch)
        • UAC Bypass Using IEInstal - Process Sigma (inferred branch)
        • Windows Archived Collected Data In TEMP Folder Splunk (inferred branch)
        • Windows Binary Execution from an Archive Splunk (inferred branch)
        • Windows Credentials Access via VaultCli Module Splunk (inferred branch)
        • WScript or CScript Dropper - File Sigma (inferred branch)
        • WSL Child Process Anomaly Sigma (inferred branch)
        • Wusa.EXE Executed By Parent Process Located In Suspicious Location Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Temp\.net\devtunnel#
          • Windows Devtunnels Image Loaded Splunk (inferred branch)
        • %USERPROFILE%\AppData\Local\Temp\Advanced IP Scanner 2#
          • Advanced IP Scanner - File Event Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Temp\api-ms-win-core-kernel32-legacy-l1.DLL#
          • UAC Bypass Using NTFS Reparse Point - File Sigma (inferred path)
        • %USERPROFILE%\AppData\Local\Temp\ba9ea7344a4a5f591d6e5dc32a13494b#
          • PCRE.NET Package Image Load Sigma (inferred branch)
          • PCRE.NET Package Temp Files Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Temp\edge-cookies.json#
          • User browser credentials dump via network share (DonPapi, Lazagne) Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Expert#
          • GoToAssist Temporary Installation Artefact Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Temp\OneNote#
          • Suspicious File Created Via OneNote Application Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Temp\OskSupport.dll#
          • UAC Bypass Using Windows Media Player - File Sigma (inferred path)
        • %USERPROFILE%\AppData\Local\Temp\pe386.dll#
          • UAC Bypass Using .NET Code Profiler on MMC Sigma (inferred path)
        • %USERPROFILE%\AppData\Local\Temp\pkgmgr.exe#
          • UAC Bypass Using MSConfig Token Modification - File Sigma (inferred path)
          • UAC Bypass Using MSConfig Token Modification - Process Sigma (inferred path)
        • %USERPROFILE%\AppData\Local\Temp\Rar$#
          • CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Temp\received_dll.dll#
          • Katz Stealer DLL Loaded Sigma (inferred path)
        • %USERPROFILE%\AppData\Local\Temp\SAM-#
          • HackTool - QuarksPwDump Dump File Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Temp\system32#
          • %USERPROFILE%\AppData\Local\Temp\system32\winmm.dll#
            • UAC Bypass Abusing Winsat Path Parsing - File Sigma (inferred path)
          • %USERPROFILE%\AppData\Local\Temp\system32\winsat.exe#
            • UAC Bypass Abusing Winsat Path Parsing - File Sigma (inferred path)
            • UAC Bypass Abusing Winsat Path Parsing - Process Sigma (inferred path)
        • %USERPROFILE%\AppData\Local\Temp\TfsStore\Tfs_DAV#
          • WebDAV Temporary Local File Creation Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Temp\WinGet#
          • Potential Suspicious Winget Package Installation Sigma (inferred branch)
        • %USERPROFILE%\AppData\Local\Temp\wps\INetCache#
          • WPS Office Exploit via DLL Hijack Elastic (inferred branch)
          • WPS Office Exploitation via DLL Hijack Elastic (inferred branch)
    • %USERPROFILE%\AppData\Roaming#
      • APT27 - Emissary Panda Activity Sigma (inferred branch)
      • BaaUpdate.exe Suspicious DLL Load Sigma (inferred branch)
      • Execution from Suspicious Directory Elastic (inferred branch)
      • File Creation Related To RAT Clients Sigma (inferred branch)
      • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
      • Scheduled Task Creation From Potential Suspicious Parent Location Sigma (inferred branch)
      • Small Sieve Malware File Indicator Creation Sigma (inferred branch)
      • Suspicious Child Process Of BgInfo.EXE Sigma (inferred branch)
      • Suspicious Image Creation In Appdata Folder Splunk (inferred branch)
      • Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs Sigma (inferred branch)
      • Suspicious Registry Modification via WMI Elastic (inferred branch)
      • Suspicious WAV file in Appdata Folder Splunk (inferred branch)
      • Suspicious Windows Defender Exclusions Added via PowerShell Elastic (inferred branch)
      • %USERPROFILE%\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini#
        • User application credentials dump via network share (DonPapi, Lazagne) Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\AnyDesk#
        • Anydesk Temporary Artefact Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\Bitcoin\wallet.dat#
        • Access To Crypto Currency Wallets By Uncommon Applications Sigma (inferred path)
      • %USERPROFILE%\AppData\Roaming\BitcoinABC\wallet.dat#
        • Access To Crypto Currency Wallets By Uncommon Applications Sigma (inferred path)
      • %USERPROFILE%\AppData\Roaming\BitcoinSV\wallet.dat#
        • Access To Crypto Currency Wallets By Uncommon Applications Sigma (inferred path)
      • %USERPROFILE%\AppData\Roaming\Comodo\IceDragon\profiles.ini#
        • User application credentials dump via network share (DonPapi, Lazagne) Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\DashCore\wallet.dat#
        • Access To Crypto Currency Wallets By Uncommon Applications Sigma (inferred path)
      • %USERPROFILE%\AppData\Roaming\DogeCoin\wallet.dat#
        • Access To Crypto Currency Wallets By Uncommon Applications Sigma (inferred path)
      • %USERPROFILE%\AppData\Roaming\Ethereum\keystore#
        • Access To Crypto Currency Wallets By Uncommon Applications Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\EthereumClassic\keystore#
        • Access To Crypto Currency Wallets By Uncommon Applications Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\K-Meleon\profiles.ini#
        • User application credentials dump via network share (DonPapi, Lazagne) Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\KeePass#
        • Sensitive File Access - System Admin Utilities Elastic (inferred branch)
      • %USERPROFILE%\AppData\Roaming\Litecoin\wallet.dat#
        • Access To Crypto Currency Wallets By Uncommon Applications Sigma (inferred path)
      • %USERPROFILE%\AppData\Roaming\Microsoft#
        • Potential Devil Bait Related Indicator Sigma (inferred branch)
        • %USERPROFILE%\AppData\Roaming\Microsoft\AddIns#
          • Microsoft Office AddIn Loaded Elastic (inferred branch)
          • Persistence via Microsoft Office AddIns Elastic (inferred branch)
        • %USERPROFILE%\AppData\Roaming\Microsoft\Credentials#
          • Credential Manager Access By Uncommon Applications Sigma (inferred branch)
        • %USERPROFILE%\AppData\Roaming\Microsoft\Excel\XLSTART#
          • Microsoft Office AddIn Creation Elastic (inferred branch)
          • Microsoft Office AddIn Loaded Elastic (inferred branch)
          • Office Application Startup via Template File Modification Elastic (inferred branch)
          • Persistence via Microsoft Office AddIns Elastic (inferred branch)
        • %USERPROFILE%\AppData\Roaming\Microsoft\Office\Recent#
          • Potential CVE-2023-36884 Exploitation Dropped File Sigma (inferred branch)
        • %USERPROFILE%\AppData\Roaming\Microsoft\Outlook#
          • Persistence via Microsoft Outlook VBA Elastic (inferred branch)
          • %USERPROFILE%\AppData\Roaming\Microsoft\Outlook\VbaProject.OTM#
            • Windows Outlook Macro Created by Suspicious Process Splunk (inferred path)
        • %USERPROFILE%\AppData\Roaming\Microsoft\Templates#
          • Office Application Startup via Template File Modification Elastic (inferred branch)
        • %USERPROFILE%\AppData\Roaming\Microsoft\Windows#
          • Potential Command Line Path Traversal Evasion Attempt Sigma (inferred branch)
          • %USERPROFILE%\AppData\Roaming\Microsoft\Windows\CurrentVersion\Uninstall#
            • Windows Query Registry UnInstall Program List Splunk (inferred branch)
          • %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Libraries#
            • Executables Or Script Creation In Suspicious Path Splunk (inferred branch)
          • %USERPROFILE%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt#
            • Windows ConsoleHost History File Deletion Splunk (inferred path)
          • %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent#
            • ISO or Image Mount Indicator in Recent Files Sigma (inferred branch)
            • Suspicious Execution from a Mounted Device Elastic (inferred branch)
            • Windows ISO LNK File Creation Splunk (inferred branch)
          • %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs#
            • Suspicious Shortcut Modification Elastic (inferred branch)
            • %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup#
              • Dual Persistence via Startup and Scheduled Task Elastic (inferred branch)
              • Execution from Startup Folder (Sysmon) Splunk (inferred branch)
              • Execution from Startup Folder (Windows Event Log) Splunk (inferred branch)
              • File Creation In Suspicious Directory By Msdt.EXE Sigma (inferred branch)
              • Hijack Legit RDP Session to Move Laterally Sigma (inferred branch)
              • Lateral Movement via Startup Folder Elastic (inferred branch)
              • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
              • Microsoft Office Process Setting Persistence via Startup Elastic (inferred branch)
              • Network Connection via Startup Item Elastic (inferred branch)
              • Persistence via a Process from a Removable or Mounted ISO Device Elastic (inferred branch)
              • Persistence via a Windows Installer Elastic (inferred branch)
              • Persistent Scripts in the Startup Directory Elastic (inferred branch)
              • Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader Sigma (inferred branch)
              • Potential Execution via Archive Exploit Elastic (inferred branch)
              • Potential Initial Access via Rogue RDP Server Elastic (inferred branch)
              • Potential RipZip Attack on Startup Folder Sigma (inferred branch)
              • Potential Startup Shortcut Persistence Via PowerShell.EXE Sigma (inferred branch)
              • Potential Timestomp in Executable Files Elastic (inferred branch)
              • Registry or File Modification from Suspicious Memory Elastic (inferred branch)
              • Script File Written to Startup Folder Elastic (inferred branch)
              • Script Interpreter Process Writing to Commonly Abused Persistence Locations Elastic (inferred branch)
              • Shortcut File Written or Modified on Startup Folder Elastic (inferred branch)
              • Startup Folder File Write Sigma (inferred branch)
              • Startup Folder Persistence via Unsigned Process Elastic (inferred branch)
              • Startup Persistence by a Low Reputation Process Elastic (inferred branch)
              • Startup Persistence by a Suspicious Process Elastic (inferred branch)
              • Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred branch)
              • Startup Persistence from Backed RWX Memory Elastic (inferred branch)
              • Startup Persistence via Microsoft Office Descendant Process Elastic (inferred branch)
              • Startup Persistence via Unusual Process Elastic (inferred branch)
              • Startup Persistence via Windows Script Interpreter Elastic (inferred branch)
              • Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location Sigma (inferred branch)
              • Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs Sigma (inferred branch)
              • Suspicious Shortcut Modification Elastic (inferred branch)
              • Suspicious Startup Folder Persistence Sigma (inferred branch)
              • Suspicious Startup Persistence via a Windows Installer Elastic (inferred branch)
              • Untrusted Process Writing to Commonly Abused Persistence Locations Elastic (inferred branch)
              • Unusual File Written or Modified in Startup Folder Elastic (inferred branch)
              • Windows Boot or Logon Autostart Execution In Startup Folder Splunk (inferred branch)
              • WinRAR Creating Files in Startup Locations Sigma (inferred branch)
              • WScript or CScript Dropper - File Sigma (inferred branch)
          • %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper#
            • Windows Defacement Modify Transcodedwallpaper File Splunk (inferred path)
        • %USERPROFILE%\AppData\Roaming\Microsoft\Word\Startup#
          • Microsoft Office AddIn Creation Elastic (inferred branch)
          • Microsoft Office AddIn Loaded Elastic (inferred branch)
          • Persistence via Microsoft Office AddIns Elastic (inferred branch)
      • %USERPROFILE%\AppData\Roaming\monero\wallets#
        • Access To Crypto Currency Wallets By Uncommon Applications Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles#
        • User browser credentials dump via network share (DonPapi, Lazagne) Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\mRemoteNG#
        • User application credentials dump via network share (DonPapi, Lazagne) Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini#
        • User application credentials dump via network share (DonPapi, Lazagne) Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\newdev.dll#
        • Potential COLDSTEEL Persistence Service DLL Creation Sigma (inferred path)
        • Potential COLDSTEEL Persistence Service DLL Load Sigma (inferred path)
      • %USERPROFILE%\AppData\Roaming\Oracle\bin\java#
        • Adwind RAT / JRAT File Artifact Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\Raven#
        • Access Attempt to Non Existing Cryptocurrency Wallet Elastic (inferred branch)
        • Suspicious Access to Cryptocurrency Wallet Files Elastic (inferred branch)
      • %USERPROFILE%\AppData\Roaming\remcos#
        • Potential REMCOS Trojan Execution Elastic (inferred branch)
        • Remcos RAT Registry or File Modification Elastic (inferred branch)
      • %USERPROFILE%\AppData\Roaming\Ripple\wallet.dat#
        • Access To Crypto Currency Wallets By Uncommon Applications Sigma (inferred path)
      • %USERPROFILE%\AppData\Roaming\sam#
        • Potential SAM Database Dump Sigma (inferred path)
      • %USERPROFILE%\AppData\Roaming\Signal#
        • File Access Of Signal Desktop Sensitive Data Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\Temp#
        • WScript or CScript Dropper - File Sigma (inferred branch)
      • %USERPROFILE%\AppData\Roaming\Zcash\wallet.dat#
        • Access To Crypto Currency Wallets By Uncommon Applications Sigma (inferred path)
      • %USERPROFILE%\AppData\Roaming\Zoom\bin#
        • Potential Execution via Shortcut Modification Elastic (inferred branch)
  • %USERPROFILE%\Favorites#
    • Abusable DLL Potential Sideloading From Suspicious Location Sigma (inferred branch)
    • BaaUpdate.exe Suspicious DLL Load Sigma (inferred branch)
    • Clfs.SYS Loaded By Process Located In a Potential Suspicious Location Sigma (inferred branch)
    • HackTool - LaZagne Execution Sigma (inferred branch)
    • Legitimate Application Writing Files In Uncommon Location Sigma (inferred branch)
    • Load Of RstrtMgr.DLL By A Suspicious Process Sigma (inferred branch)
    • Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location Sigma (inferred branch)
    • Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location Sigma (inferred branch)
    • Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs Sigma (inferred branch)
    • Wusa.EXE Executed By Parent Process Located In Suspicious Location Sigma (inferred branch)
  • %USERPROFILE%\Links#
    • BaaUpdate.exe Suspicious DLL Load Sigma (inferred branch)
    • HackTool - LaZagne Execution Sigma (inferred branch)
  • %USERPROFILE%\Searches#
    • HackTool - LaZagne Execution Sigma (inferred branch)