ATT&CK Detection Rule Coverage
3297 catalog-relevant detection rules across Sigma, Elastic, Splunk, and Sentinel mapped to 349 MITRE ATT&CK techniques. Each technique lists the rules that target it — the unit of work for a detection engineer — grouped by vendor. Techniques with rule coverage from multiple vendors are higher confidence.
349 techniques
4 vendors 3 vendors 2 vendors 1 vendor
Reconnaissance (12 techniques)
T1590 Gather Victim Network Information 4 rules
T1590.001 Gather Victim Network Information: Domain Properties 1 rule
T1590.002 Gather Victim Network Information: DNS 1 rule
T1590.005 Gather Victim Network Information: IP Addresses 2 rules
T1592 Gather Victim Host Information 3 rules
T1592.001 Gather Victim Host Information: Hardware 1 rule
T1589.001 Gather Victim Identity Information: Credentials 1 rule
T1589.002 Gather Victim Identity Information: Email Addresses 2 rules
T1595 Active Scanning 2 rules
T1595.001 Active Scanning: Scanning IP Blocks 1 rule
T1595.002 Active Scanning: Vulnerability Scanning 1 rule
T1593.003 Search Open Websites/Domains: Code Repositories 1 rule
Initial Access (15 techniques)
T1078 Valid Accounts 35 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Account Tampering - Suspicious Failed Logon Reasons
- External Remote RDP Logon from Public IP
- External Remote SMB Logon from Public IP
- Failed Logon From Public IP
- Password Provided In Command Line Of Net.EXE
- Suspicious Computer Machine Password by PowerShell
- Suspicious Remote Logon with Explicit Credentials
- User Added to Local Administrator Group
Elastic
- Access to a Sensitive LDAP Attribute
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Delegated Managed Service Account Modification by an Unusual User
- dMSA Account Creation by an Unusual User
- FirstTime Seen Account Performing DCSync
- Kerberos Pre-authentication Disabled for User
- Potential Account Takeover - Logon from New Source IP
- Potential Account Takeover - Mixed Logon Types
- Potential Credential Access via DCSync
- Potential Privileged Escalation via SamAccountName Spoofing
- Remote Computer Account DnsHostName Update
Splunk
Kusto Query Language
- AdminSDHolder Modifications
- EatonForeseer - Unauthorized Logins
- Email access via active sync
- New user created and added to the built-in administrators group
- Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization)
- User account added to built in domain local or global group
- User account created and deleted within 10 mins
- User account enabled and disabled within 10 mins
- User login from different countries within 3 hours (Uses Authentication Normalization)
T1078.001 Valid Accounts: Default Accounts 1 rule
T1078.002 Valid Accounts: Domain Accounts 19 rules
Comparative authoring view → · attack.mitre.org
Sigma
Elastic
- Access to a Sensitive LDAP Attribute
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Delegated Managed Service Account Modification by an Unusual User
- dMSA Account Creation by an Unusual User
- FirstTime Seen Account Performing DCSync
- Kerberos Pre-authentication Disabled for User
- Potential Credential Access via DCSync
- Potential Privileged Escalation via SamAccountName Spoofing
- Remote Computer Account DnsHostName Update
Splunk
T1078.003 Valid Accounts: Local Accounts 2 rules
T1566 Phishing 8 rules
T1566.001 Phishing: Spearphishing Attachment 30 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Arbitrary Shell Command Execution Via Settingcontent-Ms
- HTML Help HH.EXE Suspicious Child Process
- ISO File Created Within Temp Folders
- ISO Image Mounted
- ISO or Image Mount Indicator in Recent Files
- Office Macro File Creation
- Office Macro File Creation From Suspicious Process
- Office Macro File Download
- Password Protected ZIP File Opened (Email Attachment)
- Potential Initial Access via DLL Search Order Hijacking
- Suspicious Double Extension File Execution
- Suspicious Execution From Outlook Temporary Folder
- Suspicious File Created in Outlook Temporary Directory
- Suspicious HH.EXE Execution
- Suspicious HWP Sub Processes
- Suspicious Microsoft OneNote Child Process
- Windows Registry Trust Record Modification
Splunk
- Detect Outlook exe writing a zip file
- Windows CAB File on Disk
- Windows Defender ASR Audit Events
- Windows Defender ASR Block Events
- Windows Defender ASR Rules Stacking
- Windows ISO LNK File Creation
- Windows Office Product Dropped Cab or Inf File
- Windows Office Product Dropped Uncommon File
- Windows Office Product Loaded MSHTML Module
- Windows Office Product Loading Taskschd DLL
- Windows Office Product Loading VBE7 DLL
- Windows Phishing Recent ISO Exec Registry
- Windows Spearphishing Attachment Connect To None MS Office Domain
T1566.002 Phishing: Spearphishing Link 6 rules
T1190 Exploit Public-Facing Application 24 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Failed Logon From Public IP
- Remote Access Tool - ScreenConnect Server Web Shell Execution
- Suspicious Child Process Of SQL Server
- Suspicious File Drop by Exchange
- Suspicious File Write to SharePoint Layouts Directory
- Suspicious File Write to Webapps Root Directory
- Suspicious MSExchangeMailboxReplication ASPX Write
- Suspicious Process By Web Server Process
- Suspicious Processes Spawned by WinRM
- Terminal Service Process Spawn
Splunk
- ConnectWise ScreenConnect Path Traversal
- ConnectWise ScreenConnect Path Traversal Windows SACL
- Detect Exchange Web Shell
- MS Exchange Mailbox Replication service writing Active Server Pages
- Outbound Network Connection from Java Using Default Ports
- Web or Application Server Spawning a Shell
- Windows Identify PowerShell Web Access IIS Pool
- Windows MOVEit Transfer Writing ASPX
- Windows SharePoint Spinstall0 Webshell File Creation
Kusto Query Language
- AV detections related to SpringShell Vulnerability
- Exchange OAB Virtual Directory Attribute Containing Potential Webshell
- Identify SysAid Server web shell creation
- Microsoft Defender for Endpoint (MDE) signatures for Azure Synapse pipelines and Azure Data Factory
- Silk Typhoon New UM Service Child Process
T1133 External Remote Services 17 rules
Comparative authoring view → · attack.mitre.org
Sigma
- External Remote RDP Logon from Public IP
- External Remote SMB Logon from Public IP
- Failed Logon From Public IP
- Remote Access Tool - ScreenConnect Installation Execution
- Remote Access Tool - Team Viewer Session Started On Windows Host
- Running Chrome VPN Extensions via the Registry 2 VPN Extension
- Suspicious File Created by ArcSOC.exe
- Unusual Child Process of dns.exe
- Unusual File Deletion by Dns.exe
- Unusual File Modification by dns.exe
- User Added to Remote Desktop Users Group
Splunk
T1195 Supply Chain Compromise 7 rules
T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools 1 rule
T1195.002 Supply Chain Compromise: Compromise Software Supply Chain 6 rules
T1200 Hardware Additions 6 rules
T1091 Replication Through Removable Media 5 rules
Execution (23 techniques)
T1059 Command and Scripting Interpreter 94 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Abusable DLL Potential Sideloading From Suspicious Location
- Add Insecure Download Source To Winget
- Add New Download Source To Winget
- Add Potential Suspicious New Download Source To Winget
- Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
- Conhost Spawned By Uncommon Parent Process
- Elevated System Shell Spawned From Uncommon Parent Location
- Forfiles Command Execution
- HackTool - Sliver C2 Implant Activity Pattern
- HackTool - Stracciatella Execution
- Hacktool Ruler
- Install New Package Via Winget Local Manifest
- Installation of WSL Kali-Linux
- Outlook EnableUnsafeClientMailRules Setting Enabled
- PCRE.NET Package Image Load
- PCRE.NET Package Temp Files
- Perl Inline Command Execution
- Php Inline Command Execution
- Potential Arbitrary Command Execution Via FTP.EXE
- Potential CobaltStrike Process Patterns
- Potential Dosfuscation Activity
- Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
- Potentially Suspicious Execution From Parent Process In Public Folder
- Potentially Suspicious NTFS Symlink Behavior Modification
- PowerShell Download and Execution Cradles
- PUA - Wsudo Suspicious Execution
- Python Inline Command Execution
- Python Spawning Pretty TTY on Windows
- Renamed CURL.EXE Execution
- Renamed FTP.EXE Execution
- Renamed NirCmd.EXE Execution
- Renamed PingCastle Binary Execution
- Ruby Inline Command Execution
- Run PowerShell Script from Redirected Input Stream
- Script Interpreter Execution From Suspicious Folder
- Suspicious ArcSOC.exe Child Process
- Suspicious File Created In PerfLogs
- Suspicious Greedy Compression Using Rar.EXE
- Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
- Suspicious Program Names
- Suspicious RASdial Activity
- Suspicious Remote Child Process From Outlook
- Suspicious Runscripthelper.exe
- Suspicious Scan Loop Network
- Suspicious Script Execution From Temp Folder
- Sysprep on AppData Folder
- Unusual Parent Process For Cmd.EXE
- Use of FSharp Interpreters
- Use of OpenConsole
- Use of Pcalua For Execution
- VMToolsd Suspicious Child Process
- Windows Defender AMSI Trigger Detected
- Windows Defender Exclusions Added - PowerShell
- Windows Defender Threat Detected
- Windows Shell/Scripting Application File Write to Suspicious Folder
- Writing Of Malicious Files To The Fonts Folder
- Wscript Shell Run In CommandLine
Elastic
- Dynamic IEX Reconstruction via Method String Access
- Potential Dynamic IEX Reconstruction via Environment Variables
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- Potential PowerShell Obfuscation via Character Array Reconstruction
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
- Potential PowerShell Obfuscation via High Numeric Character Proportion
- Potential PowerShell Obfuscation via Invalid Escape Sequences
- Potential PowerShell Obfuscation via Reverse Keywords
- Potential PowerShell Obfuscation via Special Character Overuse
- Potential PowerShell Obfuscation via String Concatenation
- Potential PowerShell Obfuscation via String Reordering
- PowerShell Obfuscation via Negative Index String Reversal
Splunk
Kusto Query Language
- Base64 encoded Windows process command-lines (Normalized Process Events)
- Deimos Component Execution
- Detect Suspicious Commands Initiated by Webserver Processes
- Doppelpaymer Stop Services
- Google Threat Intelligence - Threat Hunting Hash
- Java Executing cmd to run Powershell
- Midnight Blizzard - Script payload stored in Registry
- NRT Base64 Encoded Windows Process Command-lines
- NRT Process executed from binary hidden in Base64 encoded file
- Office Apps Launching Wscipt
- Powershell Empire Cmdlets Executed in Command Line
- Qakbot Discovery Activies
- RecordedFuture Threat Hunting Hash All Actors
- SUNBURST and SUPERNOVA backdoor hashes
- SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events)
- SUNBURST network beacons
- SUNBURST suspicious SolarWinds child processes (Normalized Process Events)
- Suspicious Powershell Commandlet Executed
- TEARDROP memory-only dropper
- Windows Binaries Executed from Non-Default Directory
- Windows Binaries Lolbins Renamed
T1059.001 Command and Scripting Interpreter: PowerShell 229 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Alternate PowerShell Hosts - PowerShell Module
- Alternate PowerShell Hosts Pipe
- AppLocker Prevented Application or Script from Running
- Bad Opsec Powershell Code Artifacts
- Base64 Encoded PowerShell Command Detected
- BloodHound Collection Files
- Certificate Exported Via PowerShell
- Change PowerShell Policies to an Insecure Level
- Change PowerShell Policies to an Insecure Level - PowerShell
- Cmd.EXE Missing Space Characters Execution Anomaly
- Command Line Execution with Suspicious URL and AppData Strings
- ConvertTo-SecureString Cmdlet Usage Via CommandLine
- Detection of PowerShell Execution via Sqlps.exe
- DSInternals Suspicious PowerShell Cmdlets
- DSInternals Suspicious PowerShell Cmdlets - ScriptBlock
- Exchange PowerShell Snap-Ins Usage
- Execute Code with Pester.bat
- Execute Code with Pester.bat as Parent
- Execution of Powershell Script in Public Folder
- HackTool - Bloodhound/Sharphound Execution
- HackTool - Covenant PowerShell Launcher
- HackTool - CrackMapExec Execution
- HackTool - CrackMapExec Execution Patterns
- HackTool - CrackMapExec PowerShell Obfuscation
- HackTool - Default PowerSploit/Empire Scheduled Task Creation
- HackTool - Empire PowerShell Launch Parameters
- Hidden Powershell in Link File Pattern
- HTML Help HH.EXE Suspicious Child Process
- Import PowerShell Modules From Suspicious Directories
- Import PowerShell Modules From Suspicious Directories - ProcCreation
- Invoke-Obfuscation CLIP+ Launcher
- Invoke-Obfuscation CLIP+ Launcher - PowerShell
- Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
- Invoke-Obfuscation CLIP+ Launcher - Security
- Invoke-Obfuscation CLIP+ Launcher - System
- Invoke-Obfuscation COMPRESS OBFUSCATION
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module
- Invoke-Obfuscation COMPRESS OBFUSCATION - Security
- Invoke-Obfuscation COMPRESS OBFUSCATION - System
- Invoke-Obfuscation Obfuscated IEX Invocation
- Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
- Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
- Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
- Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module
- Invoke-Obfuscation RUNDLL LAUNCHER - Security
- Invoke-Obfuscation RUNDLL LAUNCHER - System
- Invoke-Obfuscation STDIN+ Launcher
- Invoke-Obfuscation STDIN+ Launcher - Powershell
- Invoke-Obfuscation STDIN+ Launcher - PowerShell Module
- Invoke-Obfuscation STDIN+ Launcher - Security
- Invoke-Obfuscation STDIN+ Launcher - System
- Invoke-Obfuscation VAR+ Launcher
- Invoke-Obfuscation VAR+ Launcher - PowerShell
- Invoke-Obfuscation VAR+ Launcher - PowerShell Module
- Invoke-Obfuscation VAR+ Launcher - Security
- Invoke-Obfuscation VAR+ Launcher - System
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System
- Invoke-Obfuscation Via Stdin
- Invoke-Obfuscation Via Stdin - Powershell
- Invoke-Obfuscation Via Stdin - PowerShell Module
- Invoke-Obfuscation Via Stdin - Security
- Invoke-Obfuscation Via Stdin - System
- Invoke-Obfuscation Via Use Clip
- Invoke-Obfuscation Via Use Clip - Powershell
- Invoke-Obfuscation Via Use Clip - PowerShell Module
- Invoke-Obfuscation Via Use Clip - Security
- Invoke-Obfuscation Via Use Clip - System
- Invoke-Obfuscation Via Use MSHTA
- Invoke-Obfuscation Via Use MSHTA - PowerShell
- Invoke-Obfuscation Via Use MSHTA - PowerShell Module
- Invoke-Obfuscation Via Use MSHTA - Security
- Invoke-Obfuscation Via Use MSHTA - System
- Invoke-Obfuscation Via Use Rundll32 - PowerShell
- Invoke-Obfuscation Via Use Rundll32 - PowerShell Module
- Invoke-Obfuscation Via Use Rundll32 - Security
- Invoke-Obfuscation Via Use Rundll32 - System
- Malicious Base64 Encoded PowerShell Keywords in Command Lines
- Malicious Nishang PowerShell Commandlets
- Malicious PowerShell Commandlets - PoshModule
- Malicious PowerShell Commandlets - ProcessCreation
- Malicious PowerShell Commandlets - ScriptBlock
- Malicious PowerShell Keywords
- Malicious PowerShell Scripts - FileCreation
- Malicious PowerShell Scripts - PoshModule
- Malicious ShellIntel PowerShell Commandlets
- Net WebClient Casing Anomalies
- New PowerShell Instance Created
- Non Interactive PowerShell Process Spawned
- Nslookup PowerShell Download Cradle
- NTFS Alternate Data Stream
- Obfuscated PowerShell MSI Install via WindowsInstaller COM
- Obfuscated PowerShell OneLiner Execution
- Potential Data Exfiltration Activity Via CommandLine Tools
- Potential DLL File Download Via PowerShell Invoke-WebRequest
- Potential Encoded PowerShell Patterns In CommandLine
- Potential Persistence Via Powershell Search Order Hijacking - Task
- Potential PowerShell Command Line Obfuscation
- Potential PowerShell Downgrade Attack
- Potential PowerShell Obfuscation Using Alias Cmdlets
- Potential PowerShell Obfuscation Using Character Join
- Potential PowerShell Obfuscation Via Reversed Commands
- Potential PowerShell Obfuscation Via WCHAR/CHAR
- Potential Powershell ReverseShell Connection
- Potential Remote PowerShell Session Initiated
- Potential Suspicious PowerShell Keywords
- Potential WinAPI Calls Via PowerShell Scripts
- Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
- Potentially Suspicious Command Executed Via Run Dialog Box - Registry
- Potentially Suspicious WebDAV LNK Execution
- PowerShell ADRecon Execution
- PowerShell Base64 Encoded FromBase64String Cmdlet
- PowerShell Base64 Encoded IEX Cmdlet
- PowerShell Base64 Encoded Invoke Keyword
- PowerShell Base64 Encoded Reflective Assembly Load
- PowerShell Base64 Encoded WMI Classes
- PowerShell Called from an Executable Version Mismatch
- PowerShell Core DLL Loaded By Non PowerShell Process
- PowerShell Create Local User
- PowerShell Credential Prompt
- PowerShell Downgrade Attack - PowerShell
- PowerShell Download Pattern
- Powershell Executed From Headless ConHost Process
- Powershell Inline Execution From A File
- PowerShell MSI Install via WindowsInstaller COM From Remote Location
- Powershell MsXml COM Object
- PowerShell PSAttack
- PowerShell Remote Session Creation
- PowerShell Script Run in AppData
- PowerShell ShellCode
- PowerShell Web Access Installation - PsScript
- Powershell XML Execute Command
- PowerView PowerShell Cmdlets - ScriptBlock
- PSAsyncShell - Asynchronous TCP Reverse Shell
- Remote LSASS Process Access Through Windows Remote Management
- Remote PowerShell Session (PS Classic)
- Remote PowerShell Session (PS Module)
- Remote PowerShell Session Host Process (WinRM)
- Remote PowerShell Sessions Network Connections (WinRM)
- Remote Thread Creation Via PowerShell In Uncommon Target
- Renamed Powershell Under Powershell Channel
- Scheduled Task Executing Encoded Payload from Registry
- Scheduled Task Executing Payload from Registry
- Silence.EDA Detection
- SQL Client Tools PowerShell Session Detection
- Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
- Suspicious Encoded PowerShell Command Line
- Suspicious Execution of Powershell with Base64
- Suspicious File Execution From Internet Hosted WebDav Share
- Suspicious HH.EXE Execution
- Suspicious Interactive PowerShell as SYSTEM
- Suspicious PowerShell Download
- Suspicious PowerShell Download - PoshModule
- Suspicious PowerShell Download - Powershell Script
- Suspicious PowerShell Download and Execute Pattern
- Suspicious PowerShell Encoded Command Patterns
- Suspicious PowerShell IEX Execution Patterns
- Suspicious PowerShell Invocation From Script Engines
- Suspicious PowerShell Invocations - Generic
- Suspicious PowerShell Invocations - Generic - PowerShell Module
- Suspicious PowerShell Invocations - Specific
- Suspicious PowerShell Invocations - Specific - PowerShell Module
- Suspicious PowerShell Parameter Substring
- Suspicious PowerShell Parent Process
- Suspicious Schtasks Execution AppData Folder
- Suspicious WSMAN Provider Image Loads
- Suspicious XOR Encoded PowerShell Command
- Usage Of Web Request Commands And Cmdlets
- Usage Of Web Request Commands And Cmdlets - ScriptBlock
- Windows Shell/Scripting Processes Spawning Suspicious Programs
- WMImplant Hack Tool
Elastic
- Dynamic IEX Reconstruction via Method String Access
- Potential Dynamic IEX Reconstruction via Environment Variables
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- Potential PowerShell Obfuscation via Character Array Reconstruction
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
- Potential PowerShell Obfuscation via High Numeric Character Proportion
- Potential PowerShell Obfuscation via Invalid Escape Sequences
- Potential PowerShell Obfuscation via Reverse Keywords
- Potential PowerShell Obfuscation via Special Character Overuse
- Potential PowerShell Obfuscation via String Concatenation
- Potential PowerShell Obfuscation via String Reordering
- PowerShell Obfuscation via Negative Index String Reversal
Splunk
- Detect Certify With PowerShell Script Block Logging
- Detect Empire with PowerShell Script Block Logging
- Detect Mimikatz With PowerShell Script Block Logging
- Exchange PowerShell Module Usage
- Get-ForestTrust with PowerShell Script Block
- GetLocalUser with PowerShell Script Block
- GetWmiObject User Account with PowerShell Script Block
- Malicious PowerShell Process With Obfuscation Techniques
- PowerShell 4104 Hunting
- Powershell COM Hijacking InprocServer32 Modification
- Powershell Creating Thread Mutex
- PowerShell Domain Enumeration
- PowerShell Enable PowerShell Remoting
- Powershell Execute COM Object
- Powershell Fileless Process Injection via GetProcAddress
- Powershell Fileless Script Contains Base64 Encoded Content
- Powershell Load Module in Meterpreter
- PowerShell Loading DotNET into Memory via Reflection
- Powershell Processing Stream Of Data
- PowerShell Script Block With URL Chain
- PowerShell Start or Stop Service
- Powershell Using memory As Backing Store
- PowerShell WebRequest Using Memory Stream
- Recon Using WMI Class
- Set Default PowerShell Execution Policy To Unrestricted or Bypass
- Unloading AMSI via Reflection
- Windows Account Access Removal via Logoff Exec
- Windows Enable PowerShell Web Access
- Windows Explorer LNK Exploit Process Launch With Padding
- Windows Explorer.exe Spawning PowerShell or Cmd
- Windows Powershell Cryptography Namespace
- Windows PowerShell Get CIMInstance Remote Computer
- Windows Powershell Import Applocker Policy
- Windows PowerShell Invoke-RestMethod IP Information Collection
- Windows PowerShell Invoke-Sqlcmd Execution
- Windows Powershell Logoff User via Quser
- Windows PowerShell MSIX Package Installation
- Windows PowerShell ScheduleTask
- Windows PowerShell Script Block With Malicious String
- Windows PowerShell WMI Win32 ScheduledJob
Kusto Query Language
T1059.003 Command and Scripting Interpreter: Windows Command Shell 31 rules
Comparative authoring view → · attack.mitre.org
Sigma
- AppLocker Prevented Application or Script from Running
- Command Line Execution with Suspicious URL and AppData Strings
- Conhost.exe CommandLine Path Traversal
- DNS Query by Finger Utility
- HackTool - CrackMapExec Execution
- HackTool - CrackMapExec Execution Patterns
- HackTool - Jlaive In-Memory Assembly Execution
- HackTool - Koadic Execution
- HackTool - RedMimicry Winnti Playbook Execution
- HTML Help HH.EXE Suspicious Child Process
- Network Connection Initiated via Finger.EXE
- OpenEDR Spawning Command Shell
- Operator Bloopers Cobalt Strike Commands
- Operator Bloopers Cobalt Strike Modules
- Potential CommandLine Path Traversal Via Cmd.EXE
- Powershell Execute Batch Script
- Powershell Executed From Headless ConHost Process
- PUA - AdvancedRun Execution
- Read Contents From Stdin Via Cmd.EXE
- Remote Access Tool - ScreenConnect Command Execution
- Remote Access Tool - ScreenConnect File Transfer
- Remote Access Tool - ScreenConnect Remote Command Execution
- Remote Access Tool - ScreenConnect Temporary File
- Suspicious HH.EXE Execution
- Suspicious HWP Sub Processes
- Suspicious Usage of For Loop with Recursive Directory Search in CMD
Splunk
Kusto Query Language
T1059.005 Command and Scripting Interpreter: Visual Basic 26 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Adwind RAT / JRAT File Artifact
- AppLocker Prevented Application or Script from Running
- Csc.EXE Execution Form Potentially Suspicious Parent
- Cscript/Wscript Uncommon Script Extension Execution
- HackTool - CACTUSTORCH Remote Thread Creation
- HackTool - Koadic Execution
- HackTool - NetExec File Indicators
- HTML Help HH.EXE Suspicious Child Process
- MMC Loading Script Engines DLLs
- Potential Dropper Script Execution Via WScript/CScript
- Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
- Potential Remote SquiblyTwo Technique Execution
- Registry Modification Attempt Via VBScript
- Registry Modification Attempt Via VBScript - PowerShell
- Registry Tampering by Potentially Suspicious Processes
- Suspicious Child Process Of BgInfo.EXE
- Suspicious HH.EXE Execution
- Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS
- Suspicious Scripting in a WMI Consumer
- Uncommon Child Process Of BgInfo.EXE
- Windows Shell/Scripting Processes Spawning Suspicious Programs
- WScript or CScript Dropper - File
- XSL Script Execution Via WMIC.EXE
Splunk
T1059.006 Command and Scripting Interpreter: Python 3 rules
T1059.007 Command and Scripting Interpreter: JavaScript 20 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Adwind RAT / JRAT File Artifact
- AppLocker Prevented Application or Script from Running
- Csc.EXE Execution Form Potentially Suspicious Parent
- Cscript/Wscript Uncommon Script Extension Execution
- HackTool - CACTUSTORCH Remote Thread Creation
- HackTool - Koadic Execution
- HTML Help HH.EXE Suspicious Child Process
- MSHTA Execution with Suspicious File Extensions
- Node Process Executions
- NodeJS Execution of JavaScript File
- Potential Dropper Script Execution Via WScript/CScript
- Potential Remote SquiblyTwo Technique Execution
- Potentially Suspicious Inline JavaScript Execution via NodeJS Binary
- Script Interpreter Spawning Credential Scanner - Windows
- Suspicious Deno File Written from Remote Source
- Suspicious HH.EXE Execution
- WScript or CScript Dropper - File
- XSL Script Execution Via WMIC.EXE
Splunk
T1047 Windows Management Instrumentation 48 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Application Removed Via Wmic.EXE
- Application Terminated Via Wmic.EXE
- Computer System Reconnaissance Via Wmic.EXE
- HackTool - CrackMapExec Execution
- HackTool - CrackMapExec Execution Patterns
- HackTool - Potential Impacket Lateral Movement Activity
- Hardware Model Reconnaissance Via Wmic.EXE
- HTML Help HH.EXE Suspicious Child Process
- New Process Created Via Wmic.EXE
- Password Set to Never Expire via WMI
- Potential Product Class Reconnaissance Via Wmic.EXE
- Potential Product Reconnaissance Via Wmic.EXE
- Potential Remote SquiblyTwo Technique Execution
- Potential Unquoted Service Path Reconnaissance Via Wmic.EXE
- Potential Windows Defender Tampering Via Wmic.EXE
- Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
- Process Reconnaissance Via Wmic.EXE
- PSExec and WMI Process Creations Block
- RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class
- Registry Manipulation via WMI Stdregprov
- Script Event Consumer Spawning Process
- Service Reconnaissance Via Wmic.EXE
- Service Started/Stopped Via Wmic.EXE
- Successful Account Login Via WMI
- Suspicious Autorun Registry Modified via WMI
- Suspicious Encoded Scripts in a WMI Consumer
- Suspicious HH.EXE Execution
- Suspicious Microsoft Office Child Process
- Suspicious Process Created Via Wmic.EXE
- Suspicious WMIC Execution Via Office Process
- Suspicious WmiPrvSE Child Process
- System Disk And Volume Reconnaissance Via Wmic.EXE
- T1047 Wmiprvse Wbemcomn DLL Hijack
- Windows Hotfix Updates Reconnaissance Via Wmic.EXE
- WMI Event Consumer Created Named Pipe
- WMIC Remote Command Execution
- WMIC Unquoted Services Path Lookup - PowerShell
- Wmiexec Default Output File
- WMImplant Hack Tool
- WmiPrvSE Spawned A Process
- Wmiprvse Wbemcomn DLL Hijack
- Wmiprvse Wbemcomn DLL Hijack - File
- XSL Script Execution Via WMIC.EXE
Splunk
Kusto Query Language
T1053 Scheduled Task/Job 16 rules
T1053.002 Scheduled Task/Job: At 2 rules
T1053.005 Scheduled Task/Job: Scheduled Task 48 rules
Comparative authoring view → · attack.mitre.org
Sigma
- HackTool - Default PowerSploit/Empire Scheduled Task Creation
- Important Scheduled Task Deleted/Disabled
- Persistence and Execution at Scale via GPO Scheduled Task
- Potential Persistence Via Microsoft Compatibility Appraiser
- Potential Persistence Via Powershell Search Order Hijacking - Task
- Potential Registry Persistence Attempt Via Windows Telemetry
- Potential SSH Tunnel Persistence Install Using A Scheduled Task
- Powershell Create Scheduled Task
- Renamed Schtasks Execution
- Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
- Scheduled Task Creation Masquerading as System Processes
- Scheduled Task Creation Via Schtasks.EXE
- Scheduled Task Creation with Curl and PowerShell Execution Combo
- Scheduled Task Executed From A Suspicious Location
- Scheduled Task Executed Uncommon LOLBIN
- Scheduled Task Executing Encoded Payload from Registry
- Scheduled Task Executing Payload from Registry
- Scheduled TaskCache Change by Uncommon Program
- Schtasks Creation Or Modification With SYSTEM Privileges
- Schtasks From Suspicious Folders
- Suspicious Command Patterns In Scheduled Task Creation
- Suspicious Modification Of Scheduled Tasks
- Suspicious Scheduled Task Creation
- Suspicious Scheduled Task Creation Involving Temp Folder
- Suspicious Scheduled Task Creation via Masqueraded XML File
- Suspicious Scheduled Task Name As GUID
- Suspicious Scheduled Task Update
- Suspicious Schtasks Execution AppData Folder
- Suspicious Schtasks Schedule Type With High Privileges
- Suspicious Schtasks Schedule Types
- Uncommon One Time Only Scheduled Task At 00:00
Elastic
Splunk
- Randomly Generated Scheduled Task Name
- Short Lived Scheduled Task
- Windows Compatibility Telemetry Tampering Through Registry
- Windows Enable Win32 ScheduledJob via Registry
- Windows PowerShell ScheduleTask
- Windows Registry Delete Task SD
- Windows Scheduled Task with Suspicious Command
- Windows Scheduled Task with Suspicious Name
- WinEvent Scheduled Task Created to Spawn Shell
- WinEvent Scheduled Task Created Within Public Path
- WinEvent Windows Task Scheduler Event Action Started
Kusto Query Language
T1569 System Services 4 rules
T1569.002 System Services: Service Execution 45 rules
Comparative authoring view → · attack.mitre.org
Sigma
- CobaltStrike Service Installations - Security
- CobaltStrike Service Installations - System
- Credential Dumping Tools Service Execution - Security
- Credential Dumping Tools Service Execution - System
- CSExec Service File Creation
- CSExec Service Installation
- HackTool - SharpUp PrivEsc Tool Execution
- HackTool Service Registration or Execution
- Metasploit Or Impacket Service Installation Via SMB PsExec
- PAExec Service Installation
- Potential CobaltStrike Service Installations - Registry
- PowerShell as a Service in Registry
- PowerShell Scripts Installed as Services
- PowerShell Scripts Installed as Services - Security
- ProcessHacker Privilege Elevation
- PSExec and WMI Process Creations Block
- PsExec Service File Creation
- PsExec Service Installation
- PsExec Tool Execution From Suspicious Locations - PipeName
- PUA - CSExec Default Named Pipe
- PUA - CsExec Execution
- PUA - NirCmd Execution
- PUA - NirCmd Execution As LOCAL SYSTEM
- PUA - NSudo Execution
- PUA - PAExec Default Named Pipe
- PUA - RemCom Default Named Pipe
- PUA - RunXCmd Execution
- RemCom Service File Creation
- RemCom Service Installation
- Remote Access Tool Services Have Been Installed - Security
- Remote Access Tool Services Have Been Installed - System
- Rundll32 Execution Without Parameters
- Sliver C2 Default Service Installation
- smbexec.py Service Installation
- Start Windows Service Via Net.EXE
- WFP Filter Added via Registry
Elastic
Splunk
Kusto Query Language
T1204 User Execution 8 rules
T1204.001 User Execution: Malicious Link 3 rules
T1204.002 User Execution: Malicious File 34 rules
Comparative authoring view → · attack.mitre.org
Sigma
- AppLocker Prevented Application or Script from Running
- CLR DLL Loaded Via Office Applications
- DotNET Assembly DLL Loaded Via Office Application
- File With Uncommon Extension Created By An Office Application
- GAC DLL Loaded Via Office Applications
- HackTool - LittleCorporal Generated Maldoc Injection
- Microsoft Excel Add-In Loaded From Uncommon Location
- Microsoft VBA For Outlook Addin Loaded Via Outlook
- MMC Executing Files with Reversed Extensions Using RTLO Abuse
- New Application in AppCompat
- Potential Suspicious Browser Launch From Document Reader Process
- Remote DLL Load Via Rundll32.EXE
- Suspicious Binary In User Directory Spawned From Office Application
- Suspicious LNK Command-Line Padding with Whitespace Characters
- Suspicious Microsoft Office Child Process
- Suspicious Outlook Child Process
- Suspicious Startup Folder Persistence
- Suspicious WMIC Execution Via Office Process
- Suspicious WmiPrvSE Child Process
- VBA DLL Loaded Via Office Application
- Windows AppX Deployment Full Trust Package Installation
- Windows AppX Deployment Unsigned Package Installation
- Windows MSIX Package Support Framework AI_STUBS Execution
Splunk
- Batch File Write to System32
- Drop IcedID License dat
- Windows AppX Deployment Full Trust Package Installation
- Windows AppX Deployment Package Installation Success
- Windows AppX Deployment Unsigned Package Installation
- Windows Developer-Signed MSIX Package Installation
- Windows Explorer LNK Exploit Process Launch With Padding
- Windows Explorer.exe Spawning PowerShell or Cmd
- Windows MSIX Package Interaction
- Windows Suspect Process With Authentication Traffic
- Windows User Execution Malicious URL Shortcut File
T1204.004 User Execution: Malicious Copy and Paste 6 rules
Comparative authoring view → · attack.mitre.org
Sigma
- FileFix - Command Evidence in TypedPaths
- Suspicious ClickFix/FileFix Execution Pattern
- Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix
- Suspicious FileFix Execution Pattern
- Suspicious Space Characters in RunMRU Registry Path - ClickFix
- Suspicious Space Characters in TypedPaths Registry Path - FileFix
T1106 Native API 13 rules
Comparative authoring view → · attack.mitre.org
Sigma
- HackTool - CobaltStrike BOF Injection Pattern
- HackTool - HandleKatz Duplicating LSASS Handle
- HackTool - RedMimicry Winnti Playbook Execution
- HackTool - WinPwn Execution
- HackTool - WinPwn Execution - ScriptBlock
- Potential Binary Proxy Execution Via Cdb.EXE
- Potential Direct Syscall of NtOpenProcess
- Potential WinAPI Calls Via CommandLine
- Potential WinAPI Calls Via PowerShell Scripts
- Suspicious Mshta.EXE Execution Patterns
Elastic
Kusto Query Language
T1203 Exploitation for Client Execution 13 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Audit CVE Event
- Java Running with Remote Debugging
- Network Connection Initiated By Eqnedt32.EXE
- Office Application Initiated Network Connection To Non-Local IP
- Potentially Suspicious Child Process of KeyScrambler.exe
- Potentially Suspicious Child Process Of WinRAR.EXE
- Suspicious ArcSOC.exe Child Process
- Suspicious HWP Sub Processes
- Suspicious Spool Service Child Process
Splunk
Kusto Query Language
T1072 Software Deployment Tools 6 rules
T1559 Inter-Process Communication 6 rules
T1559.001 Inter-Process Communication: Component Object Model 4 rules
T1559.002 Inter-Process Communication: Dynamic Data Exchange 1 rule
Discovery (31 techniques)
T1087 Account Discovery 20 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Chopper Webshell Process Pattern
- HackTool - SOAPHound Execution
- HackTool - winPEAS Execution
- Hacktool Ruler
- Malicious PowerShell Commandlets - PoshModule
- Malicious PowerShell Commandlets - ProcessCreation
- Malicious PowerShell Commandlets - ScriptBlock
- Network Reconnaissance Activity
- Potentially Suspicious EventLog Recon Activity Using Log Query Utilities
- PUA - Seatbelt Execution
- Suspicious Use of PsLogList
- Uncommon Connection to Active Directory Web Services
- Webshell Detection With Command Line Keywords
- Webshell Hacking Activity Patterns
Elastic
Splunk
Kusto Query Language
T1087.001 Account Discovery: Local Account 16 rules
Comparative authoring view → · attack.mitre.org
Sigma
- BloodHound Collection Files
- HackTool - Bloodhound/Sharphound Execution
- Local Accounts Discovery
- Malicious PowerShell Commandlets - PoshModule
- Malicious PowerShell Commandlets - ProcessCreation
- Malicious PowerShell Commandlets - ScriptBlock
- Suspicious Group And Account Reconnaissance Activity Using Net.EXE
- Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet
- Suspicious Use of PsLogList
Splunk
Kusto Query Language
T1087.002 Account Discovery: Domain Account 41 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Active Directory Computers Enumeration With Get-AdComputer
- Active Directory Database Snapshot Via ADExplorer
- Active Directory Structure Export Via Csvde.EXE
- AD Privileged Users or Groups Reconnaissance
- ADExplorer Writing Complete AD Snapshot Into .dat File
- BloodHound Collection Files
- HackTool - Bloodhound/Sharphound Execution
- Malicious PowerShell Commandlets - PoshModule
- Malicious PowerShell Commandlets - ProcessCreation
- Malicious PowerShell Commandlets - ScriptBlock
- Potential Active Directory Reconnaissance/Enumeration Via LDAP
- Potential AD User Enumeration From Non-Machine Account
- PUA - AdFind Suspicious Execution
- PUA - AdFind.EXE Execution
- PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE
- Reconnaissance Activity
- Renamed AdFind Execution
- Suspicious Active Directory Database Snapshot Via ADExplorer
- Suspicious Group And Account Reconnaissance Activity Using Net.EXE
- Suspicious Use of PsLogList
Elastic
Splunk
- AdsiSearcher Account Discovery
- Detect AzureHound File Modifications
- Detect SharpHound File Modifications
- Get ADUser with PowerShell Script Block
- Get DomainUser with PowerShell Script Block
- GetWmiObject DS User with PowerShell Script Block
- Network Traffic to Active Directory Web Services Protocol
- SchCache Change By App Connect And Create ADSI Object
- Windows AD Abnormal Object Access Activity
- Windows AD Privileged Object Access Activity
- Windows Domain Account Discovery Via Get-NetComputer
- Windows Find Domain Organizational Units with GetDomainOU
- Windows Find Interesting ACL with FindInterestingDomainAcl
- Windows Forest Discovery with GetForestDomain
- Windows Get Local Admin with FindLocalAdminAccess
- Windows Linked Policies In ADSI Discovery
- Windows Root Domain linked policies Discovery
- Windows Suspect Process With Authentication Traffic
Kusto Query Language
T1482 Domain Trust Discovery 26 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Active Directory Database Snapshot Via ADExplorer
- ADExplorer Writing Complete AD Snapshot Into .dat File
- BloodHound Collection Files
- DNS Server Discovery Via LDAP Query
- Domain Trust Discovery Via Dsquery
- HackTool - Bloodhound/Sharphound Execution
- HackTool - SharpView Execution
- HackTool - TruffleSnout Execution
- Malicious PowerShell Commandlets - PoshModule
- Malicious PowerShell Commandlets - ProcessCreation
- Malicious PowerShell Commandlets - ScriptBlock
- Nltest.EXE Execution
- Potential Active Directory Reconnaissance/Enumeration Via LDAP
- Potential Recon Activity Via Nltest.EXE
- PUA - AdFind Suspicious Execution
- Renamed AdFind Execution
- Suspicious Active Directory Database Snapshot Via ADExplorer
Elastic
Splunk
Kusto Query Language
T1069 Permission Groups Discovery 5 rules
T1069.001 Permission Groups Discovery: Local Groups 19 rules
Comparative authoring view → · attack.mitre.org
Sigma
- AD Groups Or Users Enumeration Using PowerShell - PoshModule
- AD Groups Or Users Enumeration Using PowerShell - ScriptBlock
- BloodHound Collection Files
- HackTool - Bloodhound/Sharphound Execution
- Local Groups Reconnaissance Via Wmic.EXE
- Malicious PowerShell Commandlets - PoshModule
- Malicious PowerShell Commandlets - ProcessCreation
- Malicious PowerShell Commandlets - ScriptBlock
- Permission Check Via Accesschk.EXE
- Suspicious Get Information for SMB Share
- Suspicious Get Information for SMB Share - PowerShell Module
- Suspicious Get Local Groups Information
- Suspicious Get Local Groups Information - PowerShell
Splunk
T1069.002 Permission Groups Discovery: Domain Groups 24 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Active Directory Database Snapshot Via ADExplorer
- Active Directory Group Enumeration With Get-AdGroup
- ADExplorer Writing Complete AD Snapshot Into .dat File
- BloodHound Collection Files
- HackTool - Bloodhound/Sharphound Execution
- HackTool - SharpView Execution
- Malicious PowerShell Commandlets - PoshModule
- Malicious PowerShell Commandlets - ProcessCreation
- Malicious PowerShell Commandlets - ScriptBlock
- Potential Active Directory Reconnaissance/Enumeration Via LDAP
- PUA - AdFind Suspicious Execution
- Reconnaissance Activity
- Renamed AdFind Execution
- Suspicious Active Directory Database Snapshot Via ADExplorer
Elastic
Splunk
- Detect AzureHound File Modifications
- Detect SharpHound File Modifications
- Domain Group Discovery with Adsisearcher
- Elevated Group Discovery with PowerView
- GetAdGroup with PowerShell Script Block
- GetDomainGroup with PowerShell Script Block
- GetWmiObject Ds Group with PowerShell Script Block
- Network Traffic to Active Directory Web Services Protocol
Kusto Query Language
T1018 Remote System Discovery 23 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Active Directory Computers Enumeration With Get-AdComputer
- Chopper Webshell Process Pattern
- DirectorySearcher Powershell Exploitation
- HackTool - NetExec Execution
- Nltest.EXE Execution
- Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock
- PUA - AdFind Suspicious Execution
- PUA - Adidnsdump Execution
- Renamed AdFind Execution
- Share And Session Enumeration Using Net.EXE
- Suspicious Scan Loop Network
- Webshell Detection With Command Line Keywords
- Webshell Hacking Activity Patterns
Splunk
- GetAdComputer with PowerShell Script Block
- GetDomainComputer with PowerShell Script Block
- GetDomainController with PowerShell Script Block
- GetWmiObject Ds Computer with PowerShell Script Block
- Remote System Discovery with Adsisearcher
- Windows Get-AdComputer Unconstrained Delegation Discovery
- Windows PowerView Constrained Delegation Discovery
- Windows PowerView Unconstrained Delegation Discovery
Kusto Query Language
T1033 System Owner/User Discovery 22 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Chopper Webshell Process Pattern
- Computer Discovery And Export Via Get-ADComputer Cmdlet
- Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell
- Enumerate All Information With Whoami.EXE
- Get-ADUser Enumeration Using UserAccountControl Flags
- Group Membership Reconnaissance Via Whoami.EXE
- HackTool - SharpLdapWhoami Execution
- HackTool - SharpView Execution
- Local Accounts Discovery
- Renamed Whoami Execution
- Security Privileges Enumeration Via Whoami.EXE
- Suspicious PowerShell Get Current User
- User Discovery And Export Via Get-ADUser Cmdlet
- User Discovery And Export Via Get-ADUser Cmdlet - PowerShell
- Webshell Detection With Command Line Keywords
- Webshell Hacking Activity Patterns
- WhoAmI as Parameter
- Whoami.EXE Execution Anomaly
- Whoami.EXE Execution From Privileged Process
- Whoami.EXE Execution With Output Option
Splunk
T1012 Query Registry 19 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Azure AD Health Monitoring Agent Registry Keys Access
- Azure AD Health Service Agents Registry Keys Access
- Exports Critical Registry Keys To a File
- Exports Registry Key To a File
- HackTool - PCHunter Execution
- Potential Configuration And Service Reconnaissance Via Reg.EXE
- Registry Manipulation via WMI Stdregprov
- SAM Registry Hive Handle Request
- SysKey Registry Keys Access
Splunk
- Windows Credential Access From Browser Password Store
- Windows Credentials from Password Stores Chrome Extension Access
- Windows Credentials from Password Stores Chrome LocalState Access
- Windows Credentials from Password Stores Chrome Login Data Access
- Windows Hosts File Access
- Windows Non Discord App Access Discord LevelDB
- Windows Product Key Registry Query
- Windows Query Registry Browser List Application
- Windows Query Registry UnInstall Program List
Kusto Query Language
T1082 System Information Discovery 19 rules
Comparative authoring view → · attack.mitre.org
Sigma
- HackTool - PCHunter Execution
- HackTool - winPEAS Execution
- HackTool - WinPwn Execution
- HackTool - WinPwn Execution - ScriptBlock
- Network Reconnaissance Activity
- Potential Product Class Reconnaissance Via Wmic.EXE
- Potential Suspicious Activity Using SeCEdit
- PUA - System Informer Execution
- Suspicious Execution of Hostname
- Suspicious Execution of Systeminfo
- Suspicious Kernel Dump Using Dtrace
- Suspicious Query of MachineGUID
- System Disk And Volume Reconnaissance Via Wmic.EXE
- System Information Discovery via Registry Queries
- Uncommon System Information Discovery Via Wmic.EXE
Splunk
Kusto Query Language
T1046 Network Service Discovery 13 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Advanced IP Scanner - File Event
- HackTool - winPEAS Execution
- HackTool - WinPwn Execution
- HackTool - WinPwn Execution - ScriptBlock
- PUA - Advanced IP Scanner Execution
- PUA - Advanced Port Scanner Execution
- PUA - NimScan Execution
- PUA - Nmap/Zenmap Execution
- PUA - SoftPerfect Netscan Execution
- Python Initiated Connection
Kusto Query Language
T1135 Network Share Discovery 11 rules
T1016 System Network Configuration Discovery 8 rules
T1083 File and Directory Discovery 8 rules
T1040 Network Sniffing 7 rules
T1049 System Network Connections Discovery 6 rules
T1201 Password Policy Discovery 6 rules
T1615 Group Policy Discovery 6 rules
T1057 Process Discovery 4 rules
T1217 Browser Information Discovery 4 rules
T1518 Software Discovery 4 rules
T1518.001 Software Discovery: Security Software Discovery 4 rules
T1007 System Service Discovery 2 rules
T1010 Application Window Discovery 2 rules
T1120 Peripheral Device Discovery 2 rules
T1124 System Time Discovery 2 rules
T1614.001 System Location Discovery: System Language Discovery 2 rules
T1497.001 Virtualization/Sandbox Evasion: System Checks 1 rule
T1526 Cloud Service Discovery 1 rule
T1622 Debugger Evasion 1 rule
Credential Access (41 techniques)
T1003 OS Credential Dumping 46 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Capture Credentials with Rpcping.exe
- Esentutl Gather Credentials
- File Access Of Signal Desktop Sensitive Data
- HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
- HackTool - Rubeus Execution
- HackTool - Rubeus Execution - ScriptBlock
- Hacktool Execution - Imphash
- Hacktool Execution - PE Metadata
- Interesting Service Enumeration Via Sc.EXE
- Live Memory Dump Using Powershell
- Loaded Module Enumeration Via Tasklist.EXE
- Microsoft IIS Connection Strings Decryption
- Microsoft IIS Service Account Password Dumped
- Potential Credential Dumping Attempt Using New NetworkProvider - CLI
- Potential Credential Dumping Attempt Using New NetworkProvider - REG
- Potential Credential Dumping Via LSASS Process Clone
- Potential Invoke-Mimikatz PowerShell Script
- Potentially Suspicious ODBC Driver Registered
- Shadow Copies Creation Using Operating Systems Utilities
- Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
- Suspicious SYSTEM User Process Creation
- WCE wceaux.dll Access
Elastic
- Access to a Sensitive LDAP Attribute
- FirstTime Seen Account Performing DCSync
- LSASS Memory Dump Handle Access
- Multiple Vault Web Credentials Read
- Potential Active Directory Replication Account Backdoor
- Potential Credential Access via DCSync
- Potential Credential Access via DuplicateHandle in LSASS
- Potential Credential Access via LSASS Memory Dump
- Potential Credential Access via Renamed COM+ Services DLL
- Potential LSASS Clone Creation via PssCaptureSnapShot
- Potential LSASS Memory Dump via PssCaptureSnapShot
- Suspicious LSASS Access via MalSecLogon
- Suspicious Lsass Process Access
- Suspicious Remote Registry Access via SeBackupPrivilege
Splunk
Kusto Query Language
T1003.001 OS Credential Dumping: LSASS Memory 88 rules
Comparative authoring view → · attack.mitre.org
Sigma
- CreateDump Process Dump
- Cred Dump Tools Dropped Files
- Credential Dumping Activity By Python Based Tool
- Credential Dumping Attempt Via WerFault
- Credential Dumping Tools Service Execution - Security
- Credential Dumping Tools Service Execution - System
- Dumping Process via Sqldumper.exe
- DumpMinitool Execution
- HackTool - CrackMapExec File Indicators
- HackTool - CrackMapExec Process Patterns
- HackTool - CreateMiniDump Execution
- HackTool - Credential Dumping Tools Named Pipe Created
- HackTool - Doppelanger LSASS Dumper Execution
- HackTool - Dumpert Process Dumper Default File
- HackTool - Dumpert Process Dumper Execution
- HackTool - Generic Process Access
- HackTool - HandleKatz Duplicating LSASS Handle
- HackTool - HandleKatz LSASS Dumper Execution
- HackTool - Impacket File Indicators
- HackTool - Inveigh Execution
- HackTool - Mimikatz Execution
- HackTool - SafetyKatz Dump Indicator
- HackTool - SafetyKatz Execution
- HackTool - Windows Credential Editor (WCE) Execution
- HackTool - WSASS Execution
- HackTool - XORDump Execution
- LSASS Access Detected via Attack Surface Reduction
- LSASS Access From Non System Account
- LSASS Access From Potentially White-Listed Processes
- LSASS Dump Keyword In CommandLine
- Lsass Full Dump Request Via DumpType Registry Settings
- LSASS Memory Access by Tool With Dump Keyword In Name
- Lsass Memory Dump via Comsvcs DLL
- LSASS Process Crashed - Application
- LSASS Process Dump Artefact In CrashDumps Folder
- LSASS Process Memory Dump Creation Via Taskmgr.EXE
- LSASS Process Memory Dump Files
- Password Dumper Activity on LSASS
- Password Dumper Remote Thread in LSASS
- Potential Adplus.EXE Abuse
- Potential Credential Dumping Activity Via LSASS
- Potential Credential Dumping Attempt Via PowerShell Remote Thread
- Potential Credential Dumping Via LSASS Process Clone
- Potential Credential Dumping Via LSASS SilentProcessExit Technique
- Potential Credential Dumping Via WER
- Potential LSASS Process Dump Via Procdump
- Potential SysInternals ProcDump Evasion
- Potential Windows Defender AV Bypass Via Dump64.EXE Rename
- Potentially Suspicious AccessMask Requested From LSASS
- Potentially Suspicious GrantedAccess Flags On LSASS
- PowerShell Get-Process LSASS in ScriptBlock
- PPL Tampering Via WerFaultSecure
- Procdump Execution
- Process Access via TrolleyExpress Exclusion
- Process Memory Dump Via Comsvcs.DLL
- Process Memory Dump via RdrLeakDiag.EXE
- Remote LSASS Process Access Through Windows Remote Management
- Renamed CreateDump Utility Execution
- Suspicious DumpMinitool Execution
- Suspicious LSASS Access Via MalSecLogon
- Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
- Suspicious Renamed Comsvcs DLL Loaded By Rundll32
- Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded
- Time Travel Debugging Utility Usage
- Time Travel Debugging Utility Usage - Image
- Transferring Files with Credential Data via Network Shares
- Unsigned Image Loaded Into LSASS Process
- WerFault LSASS Process Memory Dump
- Windows Credential Editor Registry
Elastic
- LSASS Memory Dump Handle Access
- Potential Credential Access via DuplicateHandle in LSASS
- Potential Credential Access via LSASS Memory Dump
- Potential Credential Access via Renamed COM+ Services DLL
- Potential LSASS Clone Creation via PssCaptureSnapShot
- Potential LSASS Memory Dump via PssCaptureSnapShot
- Suspicious LSASS Access via MalSecLogon
- Suspicious Lsass Process Access
Splunk
Kusto Query Language
T1003.002 OS Credential Dumping: Security Account Manager 26 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Copying Sensitive Files with Credential Data
- Crash Dump Created By Operating System
- Cred Dump Tools Dropped Files
- Credential Dumping Tools Service Execution - Security
- Credential Dumping Tools Service Execution - System
- Critical Hive In Suspicious Location Access Bits Cleared
- Dumping of Sensitive Hives Via Reg.EXE
- Esentutl Volume Shadow Copy Service Keys
- HackTool - Credential Dumping Tools Named Pipe Created
- HackTool - Mimikatz Execution
- HackTool - Pypykatz Credentials Dumping Activity
- HackTool - Quarks PwDump Execution
- HackTool - QuarksPwDump Dump File
- NTDS.DIT Creation By Uncommon Process
- Possible Impacket SecretDump Remote Activity
- Potential SAM Database Dump
- PowerShell SAM Copy
- Shadow Copies Creation Using Operating Systems Utilities
- Transferring Files with Credential Data via Network Shares
- Volume Shadow Copy Mount
- VolumeShadowCopy Symlink Creation Via Mklink
- VSSAudit Security Event Source Registration
Elastic
Splunk
T1003.003 OS Credential Dumping: NTDS 20 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Copying Sensitive Files with Credential Data
- Create Volume Shadow Copy with Powershell
- Cred Dump Tools Dropped Files
- Esentutl Gather Credentials
- Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
- NTDS Exfiltration Filename Patterns
- NTDS.DIT Created
- NTDS.DIT Creation By Uncommon Parent Process
- NTDS.DIT Creation By Uncommon Process
- Ntdsutil Abuse
- Possible Impacket SecretDump Remote Activity
- PUA - DIT Snapshot Viewer
- Sensitive File Dump Via Wbadmin.EXE
- Sensitive File Recovery From Backup Via Wbadmin.EXE
- Shadow Copies Creation Using Operating Systems Utilities
- Suspicious Get-ADDBAccount Usage
- Suspicious Process Patterns NTDS.DIT Exfil
- Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)
- Transferring Files with Credential Data via Network Shares
- VolumeShadowCopy Symlink Creation Via Mklink
T1003.004 OS Credential Dumping: LSA Secrets 11 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Cred Dump Tools Dropped Files
- Credential Dumping Tools Service Execution - Security
- Credential Dumping Tools Service Execution - System
- DPAPI Domain Backup Key Extraction
- DPAPI Domain Master Key Backup Attempt
- Dumping of Sensitive Hives Via Reg.EXE
- HackTool - Credential Dumping Tools Named Pipe Created
- HackTool - Mimikatz Execution
- Possible Impacket SecretDump Remote Activity
Elastic
Splunk
T1003.005 OS Credential Dumping: Cached Domain Credentials 8 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Cred Dump Tools Dropped Files
- Credential Dumping Tools Service Execution - Security
- Credential Dumping Tools Service Execution - System
- Dumping of Sensitive Hives Via Reg.EXE
- HackTool - Credential Dumping Tools Named Pipe Created
- HackTool - Mimikatz Execution
- New Generic Credentials Added Via Cmdkey.EXE
- Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
T1003.006 OS Credential Dumping: DCSync 12 rules
T1110 Brute Force 13 rules
Comparative authoring view → · attack.mitre.org
Sigma
Elastic
Kusto Query Language
- Brute force attack against user credentials (Uses Authentication Normalization)
- Excessive Windows Logon Failures
- Failed logon attempts by valid accounts within 10 mins
- Potential Password Spray Attack (Uses Authentication Normalization)
- Remote Desktop Network Brute force (ASIM Network Session schema)
- SecurityEvent - Multiple authentication failures followed by a success
T1110.001 Brute Force: Password Guessing 6 rules
T1110.002 Brute Force: Password Cracking 1 rule
T1110.003 Brute Force: Password Spraying 23 rules
Comparative authoring view → · attack.mitre.org
Elastic
Splunk
- Detect Password Spray Attack Behavior From Source
- Detect Password Spray Attack Behavior On User
- Detect Password Spray Attempts
- Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
- Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
- Windows Multiple Invalid Users Failed To Authenticate Using NTLM
- Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials
- Windows Multiple Users Failed To Authenticate From Host Using NTLM
- Windows Multiple Users Failed To Authenticate From Process
- Windows Multiple Users Failed To Authenticate Using Kerberos
- Windows Multiple Users Remotely Failed To Authenticate From Host
- Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos
- Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos
- Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM
- Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials
- Windows Unusual Count Of Users Failed To Auth Using Kerberos
- Windows Unusual Count Of Users Failed To Authenticate From Process
- Windows Unusual Count Of Users Failed To Authenticate Using NTLM
- Windows Unusual Count Of Users Remotely Failed To Auth From Host
Kusto Query Language
T1110.004 Brute Force: Credential Stuffing 1 rule
T1558 Steal or Forge Kerberos Tickets 14 rules
T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket 1 rule
T1558.002 Steal or Forge Kerberos Tickets: Silver Ticket 1 rule
T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting 21 rules
Comparative authoring view → · attack.mitre.org
Sigma
- HackTool - KrbRelay Execution
- HackTool - KrbRelayUp Execution
- HackTool - RemoteKrbRelay Execution
- HackTool - Rubeus Execution
- HackTool - Rubeus Execution - ScriptBlock
- Kerberoasting Activity - Initial Query
- No Suitable Encryption Key Found For Generating Kerberos Ticket
- Potential SPN Enumeration Via Setspn.EXE
- Register new Logon Process by Rubeus
- Suspicious Kerberos RC4 Ticket Encryption
- Suspicious Kerberos Ticket Request via CLI
- Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock
- Uncommon Outbound Kerberos Connection - Security
- User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'
Elastic
Splunk
Kusto Query Language
T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting 5 rules
T1557 Adversary-in-the-Middle 14 rules
Comparative authoring view → · attack.mitre.org
Sigma
Elastic
- Creation of a DNS-Named Record
- Potential ADIDNS Poisoning via Wildcard Record Creation
- Potential Computer Account NTLM Relay Activity
- Potential Kerberos Coercion via DNS-Based SPN Spoofing
- Potential Kerberos Relay Attack against a Computer Account
- Potential Machine Account Relay Attack via SMB
- Potential NTLM Relay Attack against a Computer Account
- Potential WPAD Spoofing via DNS Record Creation
- Service Creation via Local Kerberos Authentication
T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay 19 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Attempts of Kerberos Coercion Via DNS SPN Spoofing
- HackTool - ADCSPwn Execution
- HackTool - Impacket Tools Execution
- Local Privilege Escalation Indicator TabTip
- Potential SMB Relay Attack Tool Execution
- RottenPotato Like Attack Pattern
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing
- WinDivert Driver Load
Elastic
Splunk
Kusto Query Language
T1557.003 Adversary-in-the-Middle: DHCP Spoofing 1 rule
T1649 Steal or Forge Authentication Certificates 17 rules
Comparative authoring view → · attack.mitre.org
Sigma
Elastic
Splunk
- Detect Certify With PowerShell Script Block Logging
- Detect Certipy File Modifications
- Windows Export Certificate
- Windows Mimikatz Crypto Export File Extensions
- Windows PowerShell Export Certificate
- Windows PowerShell Export PfxCertificate
- Windows Steal Authentication Certificates - ESC1 Abuse
- Windows Steal Authentication Certificates - ESC1 Authentication
- Windows Steal Authentication Certificates Certificate Issued
- Windows Steal Authentication Certificates Certificate Request
- Windows Steal Authentication Certificates CryptoAPI
- Windows Steal Authentication Certificates CS Backup
T1187 Forced Authentication 14 rules
T1552 Unsecured Credentials 4 rules
T1552.001 Unsecured Credentials: Credentials In Files 14 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Automated Collection Command Prompt
- Extracting Information with PowerShell
- HackTool - Typical HiveNightmare SAM File Export
- HackTool - WinPwn Execution
- HackTool - WinPwn Execution - ScriptBlock
- Insensitive Subfolder Search Via Findstr.EXE
- Potential PowerShell Console History Access Attempt via History File
- Potentially Suspicious JWT Token Search Via CLI
- PUA - TruffleHog Execution
- Remote File Download Via Findstr.EXE
Splunk
Kusto Query Language
T1552.002 Unsecured Credentials: Credentials in Registry 6 rules
T1552.004 Unsecured Credentials: Private Keys 10 rules
T1552.006 Unsecured Credentials: Group Policy Preferences 5 rules
T1555 Credentials from Password Stores 8 rules
Comparative authoring view → · attack.mitre.org
Sigma
- DPAPI Backup Keys And Certificate Export Activity IOC
- Dump Credentials from Windows Credential Manager With PowerShell
- Enumerate Credentials from Windows Credential Manager With PowerShell
- HackTool - SecurityXploded Execution
- HackTool - WinPwn Execution
- HackTool - WinPwn Execution - ScriptBlock
- Suspicious Serv-U Process Pattern
Elastic
T1555.003 Credentials from Password Stores: Credentials from Web Browsers 11 rules
T1555.004 Credentials from Password Stores: Windows Credential Manager 4 rules
T1555.005 Credentials from Password Stores: Password Managers 1 rule
T1040 Network Sniffing 7 rules
T1528 Steal Application Access Token 5 rules
T1556 Modify Authentication Process 4 rules
T1556.002 Modify Authentication Process: Password Filter DLL 3 rules
T1056 Input Capture 1 rule
T1056.001 Input Capture: Keylogging 3 rules
T1056.002 Input Capture: GUI Input Capture 3 rules
T1056.004 Input Capture: Credential API Hooking 1 rule
T1212 Exploitation for Credential Access 3 rules
T1539 Steal Web Session Cookie 2 rules
Privilege Escalation (67 techniques)
T1574 Hijack Execution Flow 7 rules
T1574.001 Hijack Execution Flow: DLL 91 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Aruba Network Service Potential DLL Sideloading
- Creation Of Non-Existent System DLL
- Creation of WerFault.exe/Wer.dll in Unusual Folder
- DHCP Callout DLL Installation
- DHCP Server Error Failed Loading the CallOut DLL
- DHCP Server Loaded the CallOut DLL
- DLL Search Order Hijackig Via Additional Space in Path
- DLL Sideloading by VMware Xfer Utility
- DLL Sideloading Of ShellChromeAPI.DLL
- DNS Server Error Failed Loading the ServerLevelPluginDLL
- Fax Service DLL Search Order Hijack
- HackTool - Powerup Write Hijack DLL
- Malicious DLL File Dropped in the Teams or OneDrive Folder
- Microsoft Defender Blocked from Loading Unsigned DLL
- Microsoft Office DLL Sideload
- New DNS ServerLevelPluginDll Installed
- New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
- Potential 7za.DLL Sideloading
- Potential Antivirus Software DLL Sideloading
- Potential appverifUI.DLL Sideloading
- Potential AVKkid.DLL Sideloading
- Potential Azure Browser SSO Abuse
- Potential CCleanerDU.DLL Sideloading
- Potential CCleanerReactivator.DLL Sideloading
- Potential Chrome Frame Helper DLL Sideloading
- Potential DLL Sideloading Of DBGCORE.DLL
- Potential DLL Sideloading Of DBGHELP.DLL
- Potential DLL Sideloading Of DbgModel.DLL
- Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
- Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE
- Potential DLL Sideloading Of MpSvc.DLL
- Potential DLL Sideloading Of MsCorSvc.DLL
- Potential DLL Sideloading Of Non-Existent DLLs From System Folders
- Potential DLL Sideloading Via ClassicExplorer32.dll
- Potential DLL Sideloading Via comctl32.dll
- Potential DLL Sideloading Via DeviceEnroller.EXE
- Potential DLL Sideloading Via JsSchHlp
- Potential DLL Sideloading Via VMware Xfer
- Potential EACore.DLL Sideloading
- Potential Edputil.DLL Sideloading
- Potential Goopdate.DLL Sideloading
- Potential Initial Access via DLL Search Order Hijacking
- Potential Iviewers.DLL Sideloading
- Potential JLI.dll Side-Loading
- Potential Libvlc.DLL Sideloading
- Potential Mfdetours.DLL Sideloading
- Potential Mpclient.DLL Sideloading
- Potential Mpclient.DLL Sideloading Via Defender Binaries
- Potential Python DLL SideLoading
- Potential Rcdll.DLL Sideloading
- Potential RjvPlatform.DLL Sideloading From Default Location
- Potential RjvPlatform.DLL Sideloading From Non-Default Location
- Potential RoboForm.DLL Sideloading
- Potential ShellDispatch.DLL Sideloading
- Potential SmadHook.DLL Sideloading
- Potential SolidPDFCreator.DLL Sideloading
- Potential System DLL Sideloading From Non System Locations
- Potential Vivaldi_elf.DLL Sideloading
- Potential Waveedit.DLL Sideloading
- Potential Wazuh Security Platform DLL Sideloading
- Potential WWlib.DLL Sideloading
- Potentially Suspicious Child Process of KeyScrambler.exe
- Registry Modification for OCI DLL Redirection
- Renamed Vmnat.exe Execution
- Suspicious GUP Usage
- Suspicious Unsigned Thor Scanner Execution
- System Control Panel Item Loaded From Uncommon Location
- Tasks Folder Evasion
- Third Party Software DLL Sideloading
- UAC Bypass With Fake DLL
- Unsigned .node File Loaded
- Unsigned Binary Loaded From Suspicious Location
- Unsigned Mfdetours.DLL Sideloading
- Unsigned Module Loaded by ClickOnce Application
- VMGuestLib DLL Sideload
- VMMap Signed Dbghelp.DLL Potential Sideloading
- VMMap Unsigned Dbghelp.DLL Potential Sideloading
- Xwizard.EXE Execution From Non-Default Location
Splunk
- MSI Module Loaded by Non-System Binary
- Msmpeng Application DLL Side Loading
- Windows DLL Search Order Hijacking Hunt with Sysmon
- Windows DLL Side-Loading In Calc
- Windows Hijack Execution Flow Version Dll Side Load
- Windows Known Abused DLL Created
- Windows Known Abused DLL Loaded Suspiciously
- Windows Known GraphicalProton Loaded Modules
- Windows SqlWriter SQLDumper DLL Sideload
- Windows Unsigned DLL Side-Loading
- Windows Unsigned DLL Side-Loading In Same Process Path
- Windows Unsigned MS DLL Side-Loading
Kusto Query Language
T1574.004 Hijack Execution Flow: Dylib Hijacking 1 rule
T1574.005 Hijack Execution Flow: Executable Installer File Permissions Weakness 2 rules
T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking 2 rules
T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable 3 rules
T1574.008 Hijack Execution Flow: Path Interception by Search Order Hijacking 2 rules
T1574.009 Hijack Execution Flow: Path Interception by Unquoted Path 1 rule
T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness 12 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Abuse of Service Permissions to Hide Services Via Set-Service
- Abuse of Service Permissions to Hide Services Via Set-Service - PS
- Changing Existing Service ImagePath Value Via Reg.EXE
- Possible Privilege Escalation via Weak Service Permissions
- Potential Persistence Attempt Via Existing Service Tampering
- Potential Privilege Escalation via Service Permissions Weakness
- Service DACL Abuse To Hide Services Via Sc.EXE
- Service Registry Key Read Access Request
- Service Registry Permissions Weakness Check
- Service Security Descriptor Tampering Via Sc.EXE
- Suspicious Service DACL Modification Via Set-Service Cmdlet - PS
Splunk
T1574.012 Hijack Execution Flow: COR_PROFILER 2 rules
T1574.014 Hijack Execution Flow: AppDomainManager 1 rule
T1548 Abuse Elevation Control Mechanism 11 rules
T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control 70 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Always Install Elevated MSI Spawned Cmd And Powershell
- Always Install Elevated Windows Installer
- Bypass UAC Using DelegateExecute
- Bypass UAC Using SilentCleanup Task
- Bypass UAC via CMSTP
- Bypass UAC via Fodhelper.exe
- Bypass UAC via WSReset.exe
- CMSTP UAC Bypass via COM Object Access
- Explorer NOUACCHECK Flag
- Function Call From Undocumented COM Interface EditionUpgradeManager
- HackTool - Empire PowerShell UAC Bypass
- HackTool - UACMe Akagi Execution
- HackTool - WinPwn Execution
- HackTool - WinPwn Execution - ScriptBlock
- Potential UAC Bypass Via Sdclt.EXE
- Potentially Suspicious Event Viewer Child Process
- PowerShell Web Access Feature Enabled Via DISM
- Registry Modification of MS-settings Protocol Handler
- Sdclt Child Processes
- Shell Open Registry Keys Manipulation
- Suspicious Shell Open Command Registry Modification
- Trusted Path Bypass via Windows Directory Spoofing
- TrustedPath UAC Bypass Pattern
- UAC Bypass Abusing Winsat Path Parsing - File
- UAC Bypass Abusing Winsat Path Parsing - Process
- UAC Bypass Abusing Winsat Path Parsing - Registry
- UAC Bypass Tools Using ComputerDefaults
- UAC Bypass Using .NET Code Profiler on MMC
- UAC Bypass Using ChangePK and SLUI
- UAC Bypass Using Consent and Comctl32 - File
- UAC Bypass Using Consent and Comctl32 - Process
- UAC Bypass Using Disk Cleanup
- UAC Bypass Using DismHost
- UAC Bypass Using IDiagnostic Profile
- UAC Bypass Using IDiagnostic Profile - File
- UAC Bypass Using IEInstal - File
- UAC Bypass Using IEInstal - Process
- UAC Bypass Using Iscsicpl - ImageLoad
- UAC Bypass Using MSConfig Token Modification - File
- UAC Bypass Using MSConfig Token Modification - Process
- UAC Bypass Using NTFS Reparse Point - File
- UAC Bypass Using NTFS Reparse Point - Process
- UAC Bypass Using PkgMgr and DISM
- UAC Bypass Using Windows Media Player - File
- UAC Bypass Using Windows Media Player - Process
- UAC Bypass Using Windows Media Player - Registry
- UAC Bypass Using WOW64 Logger DLL Hijack
- UAC Bypass via Event Viewer
- UAC Bypass via ICMLuaUtil
- UAC Bypass via Sdclt
- UAC Bypass Via Wsreset
- UAC Bypass With Fake DLL
- UAC Bypass WSReset
- UAC Disabled
- UAC Notification Disabled
- UAC Secure Desktop Prompt Disabled
Splunk
- Disable UAC Remote Restriction
- Disabling Remote User Account Control
- Eventvwr UAC Bypass
- NET Profiler UAC bypass
- Sdclt UAC Bypass
- SilentCleanup UAC Bypass
- UAC Bypass MMC Load Unsigned Dll
- Windows ComputerDefaults Spawning a Process
- Windows DISM Install PowerShell Web Access
- Windows UAC Bypass Suspicious Escalation Behavior
- WSReset UAC Bypass
Kusto Query Language
T1098 Account Manipulation 55 rules
Comparative authoring view → · attack.mitre.org
Sigma
- A Member Was Added to a Security-Enabled Global Group
- A Member Was Removed From a Security-Enabled Global Group
- A New Trust Was Created To A Domain
- A Security-Enabled Global Group Was Deleted
- Active Directory User Backdoors
- DMSA Link Attributes Modified
- DMSA Service Account Created in Specific OUs - PowerShell
- Enabled User Right in AD to Control User Objects
- New DMSA Service Account Created in Specific OUs
- Password Change on Directory Service Restore Mode (DSRM) Account
- Password Set to Never Expire via WMI
- Powershell LocalAccount Manipulation
- Powerview Add-DomainObjectAcl DCSync AD Extend Right
- User Added To Highly Privileged Group
- User Added to Local Administrator Group
- User Added to Local Administrators Group
Elastic
- Account Configured with Never-Expiring Password
- Account Password Reset Remotely
- Active Directory Group Modification by SYSTEM
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Delegated Managed Service Account Modification by an Unusual User
- dMSA Account Creation by an Unusual User
- Kerberos Pre-authentication Disabled for User
- KRBTGT Delegation Backdoor
- Modification of the msPKIAccountCredentials
- Potential Active Directory Replication Account Backdoor
- Potential Privileged Escalation via SamAccountName Spoofing
- Potential Shadow Credentials added to AD Object
- Remote Computer Account DnsHostName Update
- Sensitive Privilege SeEnableDelegationPrivilege assigned to a User
- User account exposed to Kerberoasting
- User Added to Privileged Group in Active Directory
Splunk
- Windows AD add Self to Group
- Windows AD DSRM Account Changes
- Windows AD DSRM Password Reset
- Windows AD Privileged Group Modification
- Windows AD Self DACL Assignment
- Windows AD ServicePrincipalName Added To Domain Account
- Windows AD Short Lived Domain Account ServicePrincipalName
- Windows DnsAdmins New Member Added
- Windows Increase in Group or Object Modification Activity
- Windows Increase in User Modification Activity
- Windows Multiple Account Passwords Changed
- Windows Multiple Accounts Deleted
- Windows Multiple Accounts Disabled
Kusto Query Language
- AD account with Don't Expire Password
- DEV-0270 New User Creation
- DSRM Account Abuse
- Local Admin Group Changes
- New user created and added to the built-in administrators group
- Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization)
- User account added to built in domain local or global group
- User account created and deleted within 10 mins
- User account enabled and disabled within 10 mins
T1098.007 Account Manipulation: Additional Local or Domain Groups 1 rule
T1543 Create or Modify System Process 18 rules
Comparative authoring view → · attack.mitre.org
Sigma
- CodeIntegrity - Blocked Driver Load With Revoked Certificate
- CodeIntegrity - Blocked Image/Driver Load For Policy Violation
- KrbRelayUp Service Installation
- PUA - Process Hacker Driver Load
- PUA - Process Hacker Execution
- PUA - System Informer Driver Load
- PUA - System Informer Execution
- Service Installed By Unusual Client - Security
- Service Installed By Unusual Client - System
Elastic
Splunk
Kusto Query Language
T1543.003 Create or Modify System Process: Windows Service 50 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
- CobaltStrike Service Installations - Security
- CobaltStrike Service Installations - System
- Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
- Devcon Execution Disabling VMware VMCI Device
- Driver Load From A Temporary Directory
- Malicious Driver Load
- Malicious Driver Load By Name
- Moriya Rootkit - System
- New Kernel Driver Via SC.EXE
- New PDQDeploy Service - Client Side
- New PDQDeploy Service - Server Side
- New Service Creation Using PowerShell
- New Service Creation Using Sc.EXE
- Potential CobaltStrike Service Installations - Registry
- Potential Persistence Attempt Via Existing Service Tampering
- ProcessHacker Privilege Elevation
- PSEXEC Remote Execution File Artefact
- PUA - Kernel Driver Utility (KDU) Execution
- Remote Access Tool Services Have Been Installed - Security
- Remote Access Tool Services Have Been Installed - System
- Service Installation in Suspicious Folder
- Service Installation with Suspicious Folder Pattern
- ServiceDll Hijack
- Sliver C2 Default Service Installation
- Suspicious New Service Creation
- Suspicious Service DACL Modification Via Set-Service Cmdlet
- Suspicious Service Installation
- Suspicious Service Installation Script
- Suspicious Service Path Modification
- Sysinternals PsService Execution
- Sysinternals PsSuspend Execution
- Uncommon Service Installation Image Path
- Vulnerable Driver Load
- Vulnerable Driver Load By Name
- Vulnerable HackSys Extreme Vulnerable Driver Load
- Vulnerable WinRing0 Driver Load
Elastic
Splunk
Kusto Query Language
T1053 Scheduled Task/Job 16 rules
T1053.002 Scheduled Task/Job: At 2 rules
T1053.005 Scheduled Task/Job: Scheduled Task 48 rules
Comparative authoring view → · attack.mitre.org
Sigma
- HackTool - Default PowerSploit/Empire Scheduled Task Creation
- Important Scheduled Task Deleted/Disabled
- Persistence and Execution at Scale via GPO Scheduled Task
- Potential Persistence Via Microsoft Compatibility Appraiser
- Potential Persistence Via Powershell Search Order Hijacking - Task
- Potential Registry Persistence Attempt Via Windows Telemetry
- Potential SSH Tunnel Persistence Install Using A Scheduled Task
- Powershell Create Scheduled Task
- Renamed Schtasks Execution
- Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
- Scheduled Task Creation Masquerading as System Processes
- Scheduled Task Creation Via Schtasks.EXE
- Scheduled Task Creation with Curl and PowerShell Execution Combo
- Scheduled Task Executed From A Suspicious Location
- Scheduled Task Executed Uncommon LOLBIN
- Scheduled Task Executing Encoded Payload from Registry
- Scheduled Task Executing Payload from Registry
- Scheduled TaskCache Change by Uncommon Program
- Schtasks Creation Or Modification With SYSTEM Privileges
- Schtasks From Suspicious Folders
- Suspicious Command Patterns In Scheduled Task Creation
- Suspicious Modification Of Scheduled Tasks
- Suspicious Scheduled Task Creation
- Suspicious Scheduled Task Creation Involving Temp Folder
- Suspicious Scheduled Task Creation via Masqueraded XML File
- Suspicious Scheduled Task Name As GUID
- Suspicious Scheduled Task Update
- Suspicious Schtasks Execution AppData Folder
- Suspicious Schtasks Schedule Type With High Privileges
- Suspicious Schtasks Schedule Types
- Uncommon One Time Only Scheduled Task At 00:00
Elastic
Splunk
- Randomly Generated Scheduled Task Name
- Short Lived Scheduled Task
- Windows Compatibility Telemetry Tampering Through Registry
- Windows Enable Win32 ScheduledJob via Registry
- Windows PowerShell ScheduleTask
- Windows Registry Delete Task SD
- Windows Scheduled Task with Suspicious Command
- Windows Scheduled Task with Suspicious Name
- WinEvent Scheduled Task Created to Spawn Shell
- WinEvent Scheduled Task Created Within Public Path
- WinEvent Windows Task Scheduler Event Action Started
Kusto Query Language
T1055 Process Injection 43 rules
Comparative authoring view → · attack.mitre.org
Sigma
- CobaltStrike Named Pipe
- CobaltStrike Named Pipe Pattern Regex
- CobaltStrike Named Pipe Patterns
- Created Files by Microsoft Sync Center
- Dllhost.EXE Execution Anomaly
- DotNet CLR DLL Loaded By Scripting Applications
- HackTool - CoercedPotato Execution
- HackTool - CoercedPotato Named Pipe Creation
- HackTool - DInjector PowerShell Cradle Execution
- HackTool - EfsPotato Named Pipe Creation
- Malicious Named Pipe Created
- Microsoft Sync Center Suspicious Network Connections
- Network Connection Initiated Via Notepad.EXE
- Potential DLL Sideloading Using Coregen.exe
- Potential Process Injection Via Msra.EXE
- PowerShell ShellCode
- Process Creation Using Sysnative Folder
- Rare Remote Thread Creation By Uncommon Source Image
- Remote Thread Creation By Uncommon Source Image
- Suspect Svchost Activity
- Suspicious Child Process Of Wermgr.EXE
- Suspicious Rundll32 Invoking Inline VBScript
- Suspicious Userinit Child Process
- Uncommon Svchost Command Line Parameter
Elastic
Splunk
- Create Remote Thread In Shell Application
- DLLHost with no Command Line Arguments with Network
- GPUpdate with no Command Line Arguments with Network
- Powershell Fileless Process Injection via GetProcAddress
- Powershell Remote Thread To Known Windows Process
- Rundll32 Create Remote Thread To A Process
- Rundll32 CreateRemoteThread In Browser
- SearchProtocolHost with no Command Line with Network
- Trickbot Named Pipe
- Windows PUA Named Pipe
- Windows RMM Named Pipe
- Windows Suspicious C2 Named Pipe
- Windows Suspicious Named Pipe
Kusto Query Language
T1055.001 Process Injection: Dynamic-link Library Injection 8 rules
T1055.002 Process Injection: Portable Executable Injection 4 rules
T1055.003 Process Injection: Thread Execution Hijacking 2 rules
T1055.011 Process Injection: Extra Window Memory Injection 1 rule
T1055.012 Process Injection: Process Hollowing 5 rules
T1547 Boot or Logon Autostart Execution 11 rules
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder 37 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Classes Autorun Keys Modification
- Common Autorun Keys Modification
- CurrentControlSet Autorun Keys Modification
- CurrentVersion Autorun Keys Modification
- CurrentVersion NT Autorun Keys Modification
- Direct Autorun Keys Modification
- File Creation In Suspicious Directory By Msdt.EXE
- Internet Explorer Autorun Keys Modification
- Modify User Shell Folders Startup Value
- Narrator's Feedback-Hub Persistence
- New RUN Key Pointing to Suspicious Folder
- Office Autorun Keys Modification
- Potential Persistence Attempt Via Run Keys Using Reg.EXE
- Potential Startup Shortcut Persistence Via PowerShell.EXE
- Potential Suspicious Activity Using SeCEdit
- Registry Persistence via Explorer Run Key
- Session Manager Autorun Keys Modification
- Startup Folder File Write
- Suspicious Autorun Registry Modified via WMI
- Suspicious PowerShell In Registry Run Keys
- Suspicious Run Key from Download
- Suspicious Startup Folder Persistence
- System Scripts Autorun Keys Modification
- User Shell Folders Registry Modification via CommandLine
- VBScript Payload Stored in Registry
- Windows Event Log Access Tampering Via Registry
- WinRAR Creating Files in Startup Locations
- WinSock2 Autorun Keys Modification
- Wow6432Node Classes Autorun Keys Modification
- Wow6432Node CurrentVersion Autorun Keys Modification
- Wow6432Node Windows NT CurrentVersion Autorun Keys Modification
Splunk
Kusto Query Language
T1547.002 Boot or Logon Autostart Execution: Authentication Package 1 rule
T1547.003 Boot or Logon Autostart Execution: Time Providers 2 rules
T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL 2 rules
T1547.005 Boot or Logon Autostart Execution: Security Support Provider 2 rules
T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions 2 rules
T1547.008 Boot or Logon Autostart Execution: LSASS Driver 2 rules
T1547.009 Boot or Logon Autostart Execution: Shortcut Modification 5 rules
T1547.010 Boot or Logon Autostart Execution: Port Monitors 5 rules
T1547.012 Boot or Logon Autostart Execution: Print Processors 6 rules
T1547.014 Boot or Logon Autostart Execution: Active Setup 3 rules
T1547.015 Boot or Logon Autostart Execution: Login Items 1 rule
T1078 Valid Accounts 35 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Account Tampering - Suspicious Failed Logon Reasons
- External Remote RDP Logon from Public IP
- External Remote SMB Logon from Public IP
- Failed Logon From Public IP
- Password Provided In Command Line Of Net.EXE
- Suspicious Computer Machine Password by PowerShell
- Suspicious Remote Logon with Explicit Credentials
- User Added to Local Administrator Group
Elastic
- Access to a Sensitive LDAP Attribute
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Delegated Managed Service Account Modification by an Unusual User
- dMSA Account Creation by an Unusual User
- FirstTime Seen Account Performing DCSync
- Kerberos Pre-authentication Disabled for User
- Potential Account Takeover - Logon from New Source IP
- Potential Account Takeover - Mixed Logon Types
- Potential Credential Access via DCSync
- Potential Privileged Escalation via SamAccountName Spoofing
- Remote Computer Account DnsHostName Update
Splunk
Kusto Query Language
- AdminSDHolder Modifications
- EatonForeseer - Unauthorized Logins
- Email access via active sync
- New user created and added to the built-in administrators group
- Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization)
- User account added to built in domain local or global group
- User account created and deleted within 10 mins
- User account enabled and disabled within 10 mins
- User login from different countries within 3 hours (Uses Authentication Normalization)
T1078.001 Valid Accounts: Default Accounts 1 rule
T1078.002 Valid Accounts: Domain Accounts 19 rules
Comparative authoring view → · attack.mitre.org
Sigma
Elastic
- Access to a Sensitive LDAP Attribute
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Delegated Managed Service Account Modification by an Unusual User
- dMSA Account Creation by an Unusual User
- FirstTime Seen Account Performing DCSync
- Kerberos Pre-authentication Disabled for User
- Potential Credential Access via DCSync
- Potential Privileged Escalation via SamAccountName Spoofing
- Remote Computer Account DnsHostName Update
Splunk
T1078.003 Valid Accounts: Local Accounts 2 rules
T1068 Exploitation for Privilege Escalation 22 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Audit CVE Event
- HackTool - SysmonEOP Execution
- HKTL - SharpSuccessor Privilege Escalation Tool Execution
- Malicious Driver Load
- Malicious Driver Load By Name
- Process Explorer Driver Creation By Non-Sysinternals Binary
- Process Monitor Driver Creation By Non-Sysinternals Binary
- Suspicious Spool Service Child Process
- Vulnerable Driver Load
- Vulnerable Driver Load By Name
Elastic
Splunk
- Spoolsv Suspicious Process Access
- Windows Driver Load Non-Standard Path
- Windows Drivers Loaded by Signature
- Windows Privilege Escalation Suspicious Process Elevation
- Windows Privilege Escalation System Process Without System Parent
- Windows Privilege Escalation User Process Spawn System Process
- Windows System File on Disk
Kusto Query Language
T1484 Domain or Tenant Policy Modification 14 rules
Comparative authoring view → · attack.mitre.org
Elastic
Splunk
- Windows AD Dangerous Deny ACL Modification
- Windows AD Dangerous Group ACL Modification
- Windows AD Dangerous User ACL Modification
- Windows AD DCShadow Privileges ACL Addition
- Windows AD Domain Replication ACL Addition
- Windows AD Domain Root ACL Deletion
- Windows AD Domain Root ACL Modification
- Windows AD Hidden OU Creation
- Windows AD Object Owner Updated
- Windows AD Self DACL Assignment
T1484.001 Domain or Tenant Policy Modification: Group Policy Modification 15 rules
T1546 Event Triggered Execution 15 rules
T1546.001 Event Triggered Execution: Change Default File Association 6 rules
T1546.002 Event Triggered Execution: Screensaver 5 rules
T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription 14 rules
Comparative authoring view → · attack.mitre.org
Sigma
- New ActiveScriptEventConsumer Created Via Wmic.EXE
- Powershell WMI Persistence
- Suspicious Encoded Scripts in a WMI Consumer
- WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
- WMI Backdoor Exchange Transport Agent
- WMI Event Subscription
- WMI Persistence
- WMI Persistence - Command Line Event Consumer
- WMI Persistence - Script Event Consumer
- WMI Persistence - Script Event Consumer File Write
- WMI Persistence - Security
Elastic
Splunk
T1546.007 Event Triggered Execution: Netsh Helper DLL 4 rules
T1546.008 Event Triggered Execution: Accessibility Features 9 rules
T1546.009 Event Triggered Execution: AppCert DLLs 3 rules
T1546.010 Event Triggered Execution: AppInit DLLs 2 rules
T1546.011 Event Triggered Execution: Application Shimming 8 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Potential Persistence Via AppCompat RegisterAppRestart Layer
- Potential Persistence Via Shim Database In Uncommon Location
- Potential Persistence Via Shim Database Modification
- Potential Shim Database Persistence via Sdbinst.EXE
- Suspicious Shim Database Patching Activity
- Uncommon Extension Shim Database Installation Via Sdbinst.EXE
Splunk
T1546.012 Event Triggered Execution: Image File Execution Options Injection 4 rules
T1546.013 Event Triggered Execution: PowerShell Profile 3 rules
T1546.015 Event Triggered Execution: Component Object Model Hijacking 11 rules
Comparative authoring view → · attack.mitre.org
Sigma
- COM Hijacking via TreatAs
- COM Object Hijacking Via Modification Of Default System CLSID Default Value
- Potential COM Object Hijacking Via TreatAs Subkey - Registry
- Potential Persistence Using DebugPath
- Potential Persistence Via Scrobj.dll COM Hijacking
- Potential PSFactoryBuffer COM Hijacking
- Rundll32 Registered COM Objects
- Suspicious GetTypeFromCLSID ShellExecute
Splunk
Kusto Query Language
T1134 Access Token Manipulation 12 rules
T1134.001 Access Token Manipulation: Token Impersonation/Theft 13 rules
Comparative authoring view → · attack.mitre.org
Sigma
- HackTool - Impersonate Execution
- HackTool - Koh Default Named Pipe
- HackTool - NoFilter Execution
- HackTool - SharpDPAPI Execution
- HackTool - SharpImpersonation Execution
- Meterpreter or Cobalt Strike Getsystem Service Installation - Security
- Meterpreter or Cobalt Strike Getsystem Service Installation - System
- Potential Access Token Abuse
- Potential Meterpreter/CobaltStrike Activity
Elastic
Splunk
T1134.002 Access Token Manipulation: Create Process with Token 9 rules
T1134.003 Access Token Manipulation: Make and Impersonate Token 4 rules
T1134.004 Access Token Manipulation: Parent PID Spoofing 1 rule
T1134.005 Access Token Manipulation: SID-History Injection 6 rules
T1037 Boot or Logon Initialization Scripts 1 rule
T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows) 4 rules
T1611 Escape to Host 1 rule
Lateral Movement (15 techniques)
T1021 Remote Services 11 rules
T1021.001 Remote Services: Remote Desktop Protocol 23 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Denied Access To Remote Desktop
- New Remote Desktop Connection Initiated Via Mstsc.EXE
- Outbound RDP Connections Over Non-Standard Tools
- Port Forwarding Activity Via SSH.EXE
- Potential Tampering With RDP Related Registry Keys Via Reg.EXE
- RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class
- RDP Login from Localhost
- RDP Over Reverse SSH Tunnel
- RDP over Reverse SSH Tunnel WFP
- RDP to HTTP or HTTPS Target Ports
- Suspicious Plink Port Forwarding
- Suspicious RDP Redirect Using TSCON
- User Added to Remote Desktop Users Group
Splunk
- Allow Inbound Traffic By Firewall Rule Registry
- Allow Inbound Traffic In Firewall Rule
- Windows Default RDP File Creation By Non MSTSC Process
- Windows Default Rdp File Unhidden
- Windows RDP Bitmap Cache File Creation
- Windows RDP Client Launched with Admin Session
- Windows RDP Login Session Was Established
- Windows RDP Server Registry Entry Created
- Windows Remote Services Allow Remote Assistance
- Windows Remote Services Rdp Enable
T1021.002 Remote Services: SMB/Windows Admin Shares 42 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Access To ADMIN$ Network Share
- CobaltStrike Service Installations - Security
- CobaltStrike Service Installations - System
- Copy From Or To Admin Share Or Sysvol Folder
- DCERPC SMB Spoolss Named Pipe
- DCOM InternetExplorer.Application Iertutil DLL Hijack - Security
- First Time Seen Remote Named Pipe
- HackTool - NetExec File Indicators
- HackTool - SharpMove Tool Execution
- Impacket PsExec Execution
- Metasploit Or Impacket Service Installation Via SMB PsExec
- Metasploit SMB Authentication
- Password Provided In Command Line Of Net.EXE
- Potential CobaltStrike Service Installations - Registry
- Potential DCOM InternetExplorer.Application DLL Hijack
- Potential DCOM InternetExplorer.Application DLL Hijack - Image Load
- Protected Storage Service Access
- PUA - CSExec Default Named Pipe
- PUA - RemCom Default Named Pipe
- Remote Service Activity via SVCCTL Named Pipe
- Rundll32 Execution Without Parameters
- Rundll32 UNC Path Execution
- SMB Create Remote File Admin Share
- smbexec.py Service Installation
- Suspicious New-PSDrive to Admin Share
- Suspicious PsExec Execution
- T1047 Wmiprvse Wbemcomn DLL Hijack
- Unsigned or Unencrypted SMB Connection to Share Established
- Windows Admin Share Mount Via Net.EXE
- Windows Internet Hosted WebDav Share Mount Via Net.EXE
- Windows Share Mount Via Net.EXE
- Wmiprvse Wbemcomn DLL Hijack
- Wmiprvse Wbemcomn DLL Hijack - File
Elastic
Splunk
T1021.003 Remote Services: Distributed Component Object Model 16 rules
Comparative authoring view → · attack.mitre.org
Sigma
- BaaUpdate.exe Suspicious DLL Load
- DCOM InternetExplorer.Application Iertutil DLL Hijack - Security
- HackTool - Potential Impacket Lateral Movement Activity
- MMC Spawning Windows Shell
- MMC20 Lateral Movement
- Potential DCOM InternetExplorer.Application DLL Hijack
- Potential DCOM InternetExplorer.Application DLL Hijack - Image Load
- Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp
- Suspicious BitLocker Access Agent Update Utility Execution
- Suspicious Speech Runtime Binary Child Process
- Suspicious WSMAN Provider Image Loads
Splunk
Kusto Query Language
T1021.004 Remote Services: SSH 4 rules
T1021.005 Remote Services: VNC 1 rule
T1021.006 Remote Services: Windows Remote Management 15 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Enable Windows Remote Management
- Execute Invoke-command on Remote Host
- HackTool - WinRM Access Via Evil-WinRM
- Potential Lateral Movement via Windows Remote Shell
- Potential Remote PowerShell Session Initiated
- Remote LSASS Process Access Through Windows Remote Management
- Remote PowerShell Session (PS Classic)
- Remote PowerShell Session (PS Module)
- Remote PowerShell Session Host Process (WinRM)
- Winrs Local Command Execution
Splunk
T1210 Exploitation of Remote Services 11 rules
T1570 Lateral Tool Transfer 9 rules
T1550 Use Alternate Authentication Material 7 rules
T1550.002 Use Alternate Authentication Material: Pass the Hash 7 rules
T1550.003 Use Alternate Authentication Material: Pass the Ticket 5 rules
T1072 Software Deployment Tools 6 rules
T1091 Replication Through Removable Media 5 rules
T1563.002 Remote Service Session Hijacking: RDP Hijacking 3 rules
Persistence (71 techniques)
T1112 Modify Registry 149 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Activate Suppression of Windows Security Center Notifications
- Add DisallowRun Execution to Registry
- Allow RDP Remote Assistance Feature
- Change the Fax Dll
- Change User Account Associated with the FAX Service
- ClickOnce Trust Prompt Tampering
- CrashControl CrashDump Disabled
- DHCP Callout DLL Installation
- Disable Internal Tools or Feature in Registry
- Disable Security Events Logging Adding Reg Key MiniNt
- Disable Windows Security Center Notifications
- DNS-over-HTTPS Enabled by Registry
- Enable LM Hash Storage
- Enable LM Hash Storage - ProcCreation
- ETW Logging Disabled For rpcrt4.dll
- ETW Logging Disabled For SCM
- ETW Logging Disabled In .NET Processes - Registry
- ETW Logging Disabled In .NET Processes - Sysmon Registry
- Imports Registry Key From a File
- Imports Registry Key From an ADS
- Macro Enabled In A Potentially Suspicious Document
- Modification of IE Registry Settings
- NET NGenAssemblyUsageLog Registry Key Tamper
- NetNTLM Downgrade Attack
- NetNTLM Downgrade Attack - Registry
- New BgInfo.EXE Custom DB Path Registry Configuration
- New BgInfo.EXE Custom VBScript Registry Configuration
- New BgInfo.EXE Custom WMI Query Registry Configuration
- New DNS ServerLevelPluginDll Installed
- New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
- Non-privileged Usage of Reg or Powershell
- Office Macros Warning Disabled
- Outlook EnableUnsafeClientMailRules Setting Enabled - Registry
- Potential Persistence Via Custom Protocol Handler
- Potential Persistence Via Event Viewer Events.asp
- Potential Persistence Via Outlook Home Page
- Potential Persistence Via Outlook Today Page
- Potential Qakbot Registry Activity
- Potential Suspicious Registry File Imported Via Reg.EXE
- Potential Tampering With RDP Related Registry Keys Via Reg.EXE
- Potentially Suspicious Desktop Background Change Using Reg.EXE
- Potentially Suspicious Desktop Background Change Via Registry
- PowerShell Logging Disabled Via Registry Key Tampering
- RDP Sensitive Settings Changed
- RDP Sensitive Settings Changed to Zero
- RedMimicry Winnti Playbook Registry Manipulation
- Reg Add Suspicious Paths
- Registry Entries For Azorult Malware
- Registry Explorer Policy Modification
- Registry Hide Function from User
- Registry Manipulation via WMI Stdregprov
- Registry Modification Attempt Via VBScript
- Registry Modification Attempt Via VBScript - PowerShell
- Registry Modification for OCI DLL Redirection
- Registry Modification of MS-settings Protocol Handler
- Registry Modification Via Regini.EXE
- Registry Tampering by Potentially Suspicious Processes
- Removal of Potential COM Hijacking Registry Keys
- RestrictedAdminMode Registry Value Tampering
- RestrictedAdminMode Registry Value Tampering - ProcCreation
- Run Once Task Configuration in Registry
- Run Once Task Execution as Configured in Registry
- Security Event Logging Disabled via MiniNt Registry Key - Process
- Security Event Logging Disabled via MiniNt Registry Key - Registry Set
- Service Binary in Suspicious Folder
- ShimCache Flush
- Suspicious Registry Modification From ADS Via Regini.EXE
- Suspicious VBoxDrvInst.exe Parameters
- Sysmon Channel Reference Deletion
- Terminal Server Client Connection History Cleared - Registry
- Trust Access Disable For VBApplications
- Uncommon Microsoft Office Trusted Location Added
- User Shell Folders Registry Modification via CommandLine
- Wdigest CredGuard Registry Modification
- Wdigest Enable UseLogonCredential
- Windows Event Log Access Tampering Via Registry
- Winlogon AllowMultipleTSSessions Enable
Splunk
- Disable Registry Tool
- Disable Security Logs Using MiniNt Registry
- Disable Show Hidden Files
- Disable Windows App Hotkeys
- Disabling CMD Application
- Disabling ControlPanel
- Disabling NoRun Windows App
- Enable WDigest UseLogonCredential Registry
- Malicious InProcServer32 Modification
- Remcos client registry install entry
- Revil Registry Entry
- Windows Defender ASR Registry Modification
- Windows Defender ASR Rule Disabled
- Windows Deleted Registry By A Non Critical Process File Path
- Windows Disable Change Password Through Registry
- Windows Disable Lock Workstation Feature Through Registry
- Windows Disable LogOff Button Through Registry
- Windows Disable Notification Center
- Windows Disable Shutdown Button Through Registry
- Windows Disable Windows Group Policy Features Through Registry
- Windows Hide Notification Features Through Registry
- Windows Impair Defenses Disable AV AutoStart via Registry
- Windows InProcServer32 New Outlook Form
- Windows Modify Registry AuthenticationLevelOverride
- Windows Modify Registry Auto Minor Updates
- Windows Modify Registry Auto Update Notif
- Windows Modify Registry Configure BitLocker
- Windows Modify Registry Default Icon Setting
- Windows Modify Registry Delete Firewall Rules
- Windows Modify Registry Disable RDP
- Windows Modify Registry Disable Restricted Admin
- Windows Modify Registry Disable Toast Notifications
- Windows Modify Registry Disable Win Defender Raw Write Notif
- Windows Modify Registry Disable WinDefender Notifications
- Windows Modify Registry Disable Windows Security Center Notif
- Windows Modify Registry DisableRemoteDesktopAntiAlias
- Windows Modify Registry DisableSecuritySettings
- Windows Modify Registry Disabling WER Settings
- Windows Modify Registry DisAllow Windows App
- Windows Modify Registry Do Not Connect To Win Update
- Windows Modify Registry DontShowUI
- Windows Modify Registry EnableLinkedConnections
- Windows Modify Registry LongPathsEnabled
- Windows Modify Registry MaxConnectionPerServer
- Windows Modify Registry No Auto Reboot With Logon User
- Windows Modify Registry No Auto Update
- Windows Modify Registry NoChangingWallPaper
- Windows Modify Registry on Smart Card Group Policy
- Windows Modify Registry ProxyEnable
- Windows Modify Registry ProxyServer
- Windows Modify Registry Qakbot Binary Data Registry
- Windows Modify Registry Suppress Win Defender Notif
- Windows Modify Registry Tamper Protection
- Windows Modify Registry to Add or Modify Firewall Rule
- Windows Modify Registry UpdateServiceUrlAlternate
- Windows Modify Registry USeWuServer
- Windows Modify Registry Utilize ProgIDs
- Windows Modify Registry ValleyRAT C2 Config
- Windows Modify Registry ValleyRat PWN Reg Entry
- Windows Modify Registry With MD5 Reg Key Name
- Windows Modify Registry WuServer
- Windows Modify Registry wuStatusServer
- Windows Modify Show Compress Color And Info Tip Registry
- Windows New InProcServer32 Added
- Windows Outlook Dialogs Disabled from Unusual Process
- Windows Outlook LoadMacroProviderOnBoot Persistence
- Windows Outlook WebView Registry Modification
- Windows Routing and Remote Access Service Registry Key Change
- Windows RunMRU Registry Key or Value Deleted
- Windows Set Network Profile Category to Private via Registry
- Windows Snake Malware Registry Modification wav OpenWithProgIds
- Windows SnappyBee Create Test Registry
T1574 Hijack Execution Flow 7 rules
T1574.001 Hijack Execution Flow: DLL 91 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Aruba Network Service Potential DLL Sideloading
- Creation Of Non-Existent System DLL
- Creation of WerFault.exe/Wer.dll in Unusual Folder
- DHCP Callout DLL Installation
- DHCP Server Error Failed Loading the CallOut DLL
- DHCP Server Loaded the CallOut DLL
- DLL Search Order Hijackig Via Additional Space in Path
- DLL Sideloading by VMware Xfer Utility
- DLL Sideloading Of ShellChromeAPI.DLL
- DNS Server Error Failed Loading the ServerLevelPluginDLL
- Fax Service DLL Search Order Hijack
- HackTool - Powerup Write Hijack DLL
- Malicious DLL File Dropped in the Teams or OneDrive Folder
- Microsoft Defender Blocked from Loading Unsigned DLL
- Microsoft Office DLL Sideload
- New DNS ServerLevelPluginDll Installed
- New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
- Potential 7za.DLL Sideloading
- Potential Antivirus Software DLL Sideloading
- Potential appverifUI.DLL Sideloading
- Potential AVKkid.DLL Sideloading
- Potential Azure Browser SSO Abuse
- Potential CCleanerDU.DLL Sideloading
- Potential CCleanerReactivator.DLL Sideloading
- Potential Chrome Frame Helper DLL Sideloading
- Potential DLL Sideloading Of DBGCORE.DLL
- Potential DLL Sideloading Of DBGHELP.DLL
- Potential DLL Sideloading Of DbgModel.DLL
- Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
- Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE
- Potential DLL Sideloading Of MpSvc.DLL
- Potential DLL Sideloading Of MsCorSvc.DLL
- Potential DLL Sideloading Of Non-Existent DLLs From System Folders
- Potential DLL Sideloading Via ClassicExplorer32.dll
- Potential DLL Sideloading Via comctl32.dll
- Potential DLL Sideloading Via DeviceEnroller.EXE
- Potential DLL Sideloading Via JsSchHlp
- Potential DLL Sideloading Via VMware Xfer
- Potential EACore.DLL Sideloading
- Potential Edputil.DLL Sideloading
- Potential Goopdate.DLL Sideloading
- Potential Initial Access via DLL Search Order Hijacking
- Potential Iviewers.DLL Sideloading
- Potential JLI.dll Side-Loading
- Potential Libvlc.DLL Sideloading
- Potential Mfdetours.DLL Sideloading
- Potential Mpclient.DLL Sideloading
- Potential Mpclient.DLL Sideloading Via Defender Binaries
- Potential Python DLL SideLoading
- Potential Rcdll.DLL Sideloading
- Potential RjvPlatform.DLL Sideloading From Default Location
- Potential RjvPlatform.DLL Sideloading From Non-Default Location
- Potential RoboForm.DLL Sideloading
- Potential ShellDispatch.DLL Sideloading
- Potential SmadHook.DLL Sideloading
- Potential SolidPDFCreator.DLL Sideloading
- Potential System DLL Sideloading From Non System Locations
- Potential Vivaldi_elf.DLL Sideloading
- Potential Waveedit.DLL Sideloading
- Potential Wazuh Security Platform DLL Sideloading
- Potential WWlib.DLL Sideloading
- Potentially Suspicious Child Process of KeyScrambler.exe
- Registry Modification for OCI DLL Redirection
- Renamed Vmnat.exe Execution
- Suspicious GUP Usage
- Suspicious Unsigned Thor Scanner Execution
- System Control Panel Item Loaded From Uncommon Location
- Tasks Folder Evasion
- Third Party Software DLL Sideloading
- UAC Bypass With Fake DLL
- Unsigned .node File Loaded
- Unsigned Binary Loaded From Suspicious Location
- Unsigned Mfdetours.DLL Sideloading
- Unsigned Module Loaded by ClickOnce Application
- VMGuestLib DLL Sideload
- VMMap Signed Dbghelp.DLL Potential Sideloading
- VMMap Unsigned Dbghelp.DLL Potential Sideloading
- Xwizard.EXE Execution From Non-Default Location
Splunk
- MSI Module Loaded by Non-System Binary
- Msmpeng Application DLL Side Loading
- Windows DLL Search Order Hijacking Hunt with Sysmon
- Windows DLL Side-Loading In Calc
- Windows Hijack Execution Flow Version Dll Side Load
- Windows Known Abused DLL Created
- Windows Known Abused DLL Loaded Suspiciously
- Windows Known GraphicalProton Loaded Modules
- Windows SqlWriter SQLDumper DLL Sideload
- Windows Unsigned DLL Side-Loading
- Windows Unsigned DLL Side-Loading In Same Process Path
- Windows Unsigned MS DLL Side-Loading
Kusto Query Language
T1574.004 Hijack Execution Flow: Dylib Hijacking 1 rule
T1574.005 Hijack Execution Flow: Executable Installer File Permissions Weakness 2 rules
T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking 2 rules
T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable 3 rules
T1574.008 Hijack Execution Flow: Path Interception by Search Order Hijacking 2 rules
T1574.009 Hijack Execution Flow: Path Interception by Unquoted Path 1 rule
T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness 12 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Abuse of Service Permissions to Hide Services Via Set-Service
- Abuse of Service Permissions to Hide Services Via Set-Service - PS
- Changing Existing Service ImagePath Value Via Reg.EXE
- Possible Privilege Escalation via Weak Service Permissions
- Potential Persistence Attempt Via Existing Service Tampering
- Potential Privilege Escalation via Service Permissions Weakness
- Service DACL Abuse To Hide Services Via Sc.EXE
- Service Registry Key Read Access Request
- Service Registry Permissions Weakness Check
- Service Security Descriptor Tampering Via Sc.EXE
- Suspicious Service DACL Modification Via Set-Service Cmdlet - PS
Splunk
T1574.012 Hijack Execution Flow: COR_PROFILER 2 rules
T1574.014 Hijack Execution Flow: AppDomainManager 1 rule
T1098 Account Manipulation 55 rules
Comparative authoring view → · attack.mitre.org
Sigma
- A Member Was Added to a Security-Enabled Global Group
- A Member Was Removed From a Security-Enabled Global Group
- A New Trust Was Created To A Domain
- A Security-Enabled Global Group Was Deleted
- Active Directory User Backdoors
- DMSA Link Attributes Modified
- DMSA Service Account Created in Specific OUs - PowerShell
- Enabled User Right in AD to Control User Objects
- New DMSA Service Account Created in Specific OUs
- Password Change on Directory Service Restore Mode (DSRM) Account
- Password Set to Never Expire via WMI
- Powershell LocalAccount Manipulation
- Powerview Add-DomainObjectAcl DCSync AD Extend Right
- User Added To Highly Privileged Group
- User Added to Local Administrator Group
- User Added to Local Administrators Group
Elastic
- Account Configured with Never-Expiring Password
- Account Password Reset Remotely
- Active Directory Group Modification by SYSTEM
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Delegated Managed Service Account Modification by an Unusual User
- dMSA Account Creation by an Unusual User
- Kerberos Pre-authentication Disabled for User
- KRBTGT Delegation Backdoor
- Modification of the msPKIAccountCredentials
- Potential Active Directory Replication Account Backdoor
- Potential Privileged Escalation via SamAccountName Spoofing
- Potential Shadow Credentials added to AD Object
- Remote Computer Account DnsHostName Update
- Sensitive Privilege SeEnableDelegationPrivilege assigned to a User
- User account exposed to Kerberoasting
- User Added to Privileged Group in Active Directory
Splunk
- Windows AD add Self to Group
- Windows AD DSRM Account Changes
- Windows AD DSRM Password Reset
- Windows AD Privileged Group Modification
- Windows AD Self DACL Assignment
- Windows AD ServicePrincipalName Added To Domain Account
- Windows AD Short Lived Domain Account ServicePrincipalName
- Windows DnsAdmins New Member Added
- Windows Increase in Group or Object Modification Activity
- Windows Increase in User Modification Activity
- Windows Multiple Account Passwords Changed
- Windows Multiple Accounts Deleted
- Windows Multiple Accounts Disabled
Kusto Query Language
- AD account with Don't Expire Password
- DEV-0270 New User Creation
- DSRM Account Abuse
- Local Admin Group Changes
- New user created and added to the built-in administrators group
- Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization)
- User account added to built in domain local or global group
- User account created and deleted within 10 mins
- User account enabled and disabled within 10 mins
T1098.007 Account Manipulation: Additional Local or Domain Groups 1 rule
T1543 Create or Modify System Process 18 rules
Comparative authoring view → · attack.mitre.org
Sigma
- CodeIntegrity - Blocked Driver Load With Revoked Certificate
- CodeIntegrity - Blocked Image/Driver Load For Policy Violation
- KrbRelayUp Service Installation
- PUA - Process Hacker Driver Load
- PUA - Process Hacker Execution
- PUA - System Informer Driver Load
- PUA - System Informer Execution
- Service Installed By Unusual Client - Security
- Service Installed By Unusual Client - System
Elastic
Splunk
Kusto Query Language
T1543.003 Create or Modify System Process: Windows Service 50 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
- CobaltStrike Service Installations - Security
- CobaltStrike Service Installations - System
- Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
- Devcon Execution Disabling VMware VMCI Device
- Driver Load From A Temporary Directory
- Malicious Driver Load
- Malicious Driver Load By Name
- Moriya Rootkit - System
- New Kernel Driver Via SC.EXE
- New PDQDeploy Service - Client Side
- New PDQDeploy Service - Server Side
- New Service Creation Using PowerShell
- New Service Creation Using Sc.EXE
- Potential CobaltStrike Service Installations - Registry
- Potential Persistence Attempt Via Existing Service Tampering
- ProcessHacker Privilege Elevation
- PSEXEC Remote Execution File Artefact
- PUA - Kernel Driver Utility (KDU) Execution
- Remote Access Tool Services Have Been Installed - Security
- Remote Access Tool Services Have Been Installed - System
- Service Installation in Suspicious Folder
- Service Installation with Suspicious Folder Pattern
- ServiceDll Hijack
- Sliver C2 Default Service Installation
- Suspicious New Service Creation
- Suspicious Service DACL Modification Via Set-Service Cmdlet
- Suspicious Service Installation
- Suspicious Service Installation Script
- Suspicious Service Path Modification
- Sysinternals PsService Execution
- Sysinternals PsSuspend Execution
- Uncommon Service Installation Image Path
- Vulnerable Driver Load
- Vulnerable Driver Load By Name
- Vulnerable HackSys Extreme Vulnerable Driver Load
- Vulnerable WinRing0 Driver Load
Elastic
Splunk
Kusto Query Language
T1053 Scheduled Task/Job 16 rules
T1053.002 Scheduled Task/Job: At 2 rules
T1053.005 Scheduled Task/Job: Scheduled Task 48 rules
Comparative authoring view → · attack.mitre.org
Sigma
- HackTool - Default PowerSploit/Empire Scheduled Task Creation
- Important Scheduled Task Deleted/Disabled
- Persistence and Execution at Scale via GPO Scheduled Task
- Potential Persistence Via Microsoft Compatibility Appraiser
- Potential Persistence Via Powershell Search Order Hijacking - Task
- Potential Registry Persistence Attempt Via Windows Telemetry
- Potential SSH Tunnel Persistence Install Using A Scheduled Task
- Powershell Create Scheduled Task
- Renamed Schtasks Execution
- Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
- Scheduled Task Creation Masquerading as System Processes
- Scheduled Task Creation Via Schtasks.EXE
- Scheduled Task Creation with Curl and PowerShell Execution Combo
- Scheduled Task Executed From A Suspicious Location
- Scheduled Task Executed Uncommon LOLBIN
- Scheduled Task Executing Encoded Payload from Registry
- Scheduled Task Executing Payload from Registry
- Scheduled TaskCache Change by Uncommon Program
- Schtasks Creation Or Modification With SYSTEM Privileges
- Schtasks From Suspicious Folders
- Suspicious Command Patterns In Scheduled Task Creation
- Suspicious Modification Of Scheduled Tasks
- Suspicious Scheduled Task Creation
- Suspicious Scheduled Task Creation Involving Temp Folder
- Suspicious Scheduled Task Creation via Masqueraded XML File
- Suspicious Scheduled Task Name As GUID
- Suspicious Scheduled Task Update
- Suspicious Schtasks Execution AppData Folder
- Suspicious Schtasks Schedule Type With High Privileges
- Suspicious Schtasks Schedule Types
- Uncommon One Time Only Scheduled Task At 00:00
Elastic
Splunk
- Randomly Generated Scheduled Task Name
- Short Lived Scheduled Task
- Windows Compatibility Telemetry Tampering Through Registry
- Windows Enable Win32 ScheduledJob via Registry
- Windows PowerShell ScheduleTask
- Windows Registry Delete Task SD
- Windows Scheduled Task with Suspicious Command
- Windows Scheduled Task with Suspicious Name
- WinEvent Scheduled Task Created to Spawn Shell
- WinEvent Scheduled Task Created Within Public Path
- WinEvent Windows Task Scheduler Event Action Started
Kusto Query Language
T1547 Boot or Logon Autostart Execution 11 rules
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder 37 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Classes Autorun Keys Modification
- Common Autorun Keys Modification
- CurrentControlSet Autorun Keys Modification
- CurrentVersion Autorun Keys Modification
- CurrentVersion NT Autorun Keys Modification
- Direct Autorun Keys Modification
- File Creation In Suspicious Directory By Msdt.EXE
- Internet Explorer Autorun Keys Modification
- Modify User Shell Folders Startup Value
- Narrator's Feedback-Hub Persistence
- New RUN Key Pointing to Suspicious Folder
- Office Autorun Keys Modification
- Potential Persistence Attempt Via Run Keys Using Reg.EXE
- Potential Startup Shortcut Persistence Via PowerShell.EXE
- Potential Suspicious Activity Using SeCEdit
- Registry Persistence via Explorer Run Key
- Session Manager Autorun Keys Modification
- Startup Folder File Write
- Suspicious Autorun Registry Modified via WMI
- Suspicious PowerShell In Registry Run Keys
- Suspicious Run Key from Download
- Suspicious Startup Folder Persistence
- System Scripts Autorun Keys Modification
- User Shell Folders Registry Modification via CommandLine
- VBScript Payload Stored in Registry
- Windows Event Log Access Tampering Via Registry
- WinRAR Creating Files in Startup Locations
- WinSock2 Autorun Keys Modification
- Wow6432Node Classes Autorun Keys Modification
- Wow6432Node CurrentVersion Autorun Keys Modification
- Wow6432Node Windows NT CurrentVersion Autorun Keys Modification
Splunk
Kusto Query Language
T1547.002 Boot or Logon Autostart Execution: Authentication Package 1 rule
T1547.003 Boot or Logon Autostart Execution: Time Providers 2 rules
T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL 2 rules
T1547.005 Boot or Logon Autostart Execution: Security Support Provider 2 rules
T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions 2 rules
T1547.008 Boot or Logon Autostart Execution: LSASS Driver 2 rules
T1547.009 Boot or Logon Autostart Execution: Shortcut Modification 5 rules
T1547.010 Boot or Logon Autostart Execution: Port Monitors 5 rules
T1547.012 Boot or Logon Autostart Execution: Print Processors 6 rules
T1547.014 Boot or Logon Autostart Execution: Active Setup 3 rules
T1547.015 Boot or Logon Autostart Execution: Login Items 1 rule
T1078 Valid Accounts 35 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Account Tampering - Suspicious Failed Logon Reasons
- External Remote RDP Logon from Public IP
- External Remote SMB Logon from Public IP
- Failed Logon From Public IP
- Password Provided In Command Line Of Net.EXE
- Suspicious Computer Machine Password by PowerShell
- Suspicious Remote Logon with Explicit Credentials
- User Added to Local Administrator Group
Elastic
- Access to a Sensitive LDAP Attribute
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Delegated Managed Service Account Modification by an Unusual User
- dMSA Account Creation by an Unusual User
- FirstTime Seen Account Performing DCSync
- Kerberos Pre-authentication Disabled for User
- Potential Account Takeover - Logon from New Source IP
- Potential Account Takeover - Mixed Logon Types
- Potential Credential Access via DCSync
- Potential Privileged Escalation via SamAccountName Spoofing
- Remote Computer Account DnsHostName Update
Splunk
Kusto Query Language
- AdminSDHolder Modifications
- EatonForeseer - Unauthorized Logins
- Email access via active sync
- New user created and added to the built-in administrators group
- Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization)
- User account added to built in domain local or global group
- User account created and deleted within 10 mins
- User account enabled and disabled within 10 mins
- User login from different countries within 3 hours (Uses Authentication Normalization)
T1078.001 Valid Accounts: Default Accounts 1 rule
T1078.002 Valid Accounts: Domain Accounts 19 rules
Comparative authoring view → · attack.mitre.org
Sigma
Elastic
- Access to a Sensitive LDAP Attribute
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Delegated Managed Service Account Modification by an Unusual User
- dMSA Account Creation by an Unusual User
- FirstTime Seen Account Performing DCSync
- Kerberos Pre-authentication Disabled for User
- Potential Credential Access via DCSync
- Potential Privileged Escalation via SamAccountName Spoofing
- Remote Computer Account DnsHostName Update
Splunk
T1078.003 Valid Accounts: Local Accounts 2 rules
T1133 External Remote Services 17 rules
Comparative authoring view → · attack.mitre.org
Sigma
- External Remote RDP Logon from Public IP
- External Remote SMB Logon from Public IP
- Failed Logon From Public IP
- Remote Access Tool - ScreenConnect Installation Execution
- Remote Access Tool - Team Viewer Session Started On Windows Host
- Running Chrome VPN Extensions via the Registry 2 VPN Extension
- Suspicious File Created by ArcSOC.exe
- Unusual Child Process of dns.exe
- Unusual File Deletion by Dns.exe
- Unusual File Modification by dns.exe
- User Added to Remote Desktop Users Group
Splunk
T1505.001 Server Software Component: SQL Stored Procedures 4 rules
T1505.002 Server Software Component: Transport Agent 1 rule
T1505.003 Server Software Component: Web Shell 16 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Chopper Webshell Process Pattern
- IIS Native-Code Module Command Line Installation
- Potential Webshell Creation On Static Website
- Suspicious ASPX File Drop by Exchange
- Suspicious Child Process Of SQL Server
- Suspicious File Drop by Exchange
- Suspicious File Write to SharePoint Layouts Directory
- Suspicious File Write to Webapps Root Directory
- Suspicious MSExchangeMailboxReplication ASPX Write
- Suspicious Process By Web Server Process
- Webshell Detection With Command Line Keywords
- Webshell Hacking Activity Patterns
- Webshell Tool Reconnaissance Activity
Splunk
T1505.004 Server Software Component: IIS Components 9 rules
T1505.005 Server Software Component: Terminal Services DLL 1 rule
T1136 Create Account 3 rules
T1136.001 Create Account: Local Account 15 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Creation of a Local Hidden User Account by Registry
- Hidden Local User Creation
- Local User Creation
- New User Created Via Net.EXE
- New User Created Via Net.EXE With Never Expire Option
- PowerShell Create Local User
- Suspicious Windows ANONYMOUS LOGON Local Account Created
- User Added to Remote Desktop Users Group
Splunk
Kusto Query Language
T1136.002 Create Account: Domain Account 8 rules
T1546 Event Triggered Execution 15 rules
T1546.001 Event Triggered Execution: Change Default File Association 6 rules
T1546.002 Event Triggered Execution: Screensaver 5 rules
T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription 14 rules
Comparative authoring view → · attack.mitre.org
Sigma
- New ActiveScriptEventConsumer Created Via Wmic.EXE
- Powershell WMI Persistence
- Suspicious Encoded Scripts in a WMI Consumer
- WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
- WMI Backdoor Exchange Transport Agent
- WMI Event Subscription
- WMI Persistence
- WMI Persistence - Command Line Event Consumer
- WMI Persistence - Script Event Consumer
- WMI Persistence - Script Event Consumer File Write
- WMI Persistence - Security
Elastic
Splunk
T1546.007 Event Triggered Execution: Netsh Helper DLL 4 rules
T1546.008 Event Triggered Execution: Accessibility Features 9 rules
T1546.009 Event Triggered Execution: AppCert DLLs 3 rules
T1546.010 Event Triggered Execution: AppInit DLLs 2 rules
T1546.011 Event Triggered Execution: Application Shimming 8 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Potential Persistence Via AppCompat RegisterAppRestart Layer
- Potential Persistence Via Shim Database In Uncommon Location
- Potential Persistence Via Shim Database Modification
- Potential Shim Database Persistence via Sdbinst.EXE
- Suspicious Shim Database Patching Activity
- Uncommon Extension Shim Database Installation Via Sdbinst.EXE
Splunk
T1546.012 Event Triggered Execution: Image File Execution Options Injection 4 rules
T1546.013 Event Triggered Execution: PowerShell Profile 3 rules
T1546.015 Event Triggered Execution: Component Object Model Hijacking 11 rules
Comparative authoring view → · attack.mitre.org
Sigma
- COM Hijacking via TreatAs
- COM Object Hijacking Via Modification Of Default System CLSID Default Value
- Potential COM Object Hijacking Via TreatAs Subkey - Registry
- Potential Persistence Using DebugPath
- Potential Persistence Via Scrobj.dll COM Hijacking
- Potential PSFactoryBuffer COM Hijacking
- Rundll32 Registered COM Objects
- Suspicious GetTypeFromCLSID ShellExecute
Splunk
Kusto Query Language
T1197 BITS Jobs 14 rules
Comparative authoring view → · attack.mitre.org
Sigma
- BITS Transfer Job Download From Direct IP
- BITS Transfer Job Download From File Sharing Domains
- BITS Transfer Job Download To Potential Suspicious Folder
- BITS Transfer Job Downloading File Potential Suspicious Extension
- BITS Transfer Job With Uncommon Or Suspicious Remote TLD
- File Download Via Bitsadmin
- File Download Via Bitsadmin To A Suspicious Target Folder
- File With Suspicious Extension Downloaded Via Bitsadmin
- Monitoring For Persistence Via BITS
- New BITS Job Created Via Bitsadmin
- New BITS Job Created Via PowerShell
- Suspicious Download From Direct IP Via Bitsadmin
- Suspicious Download From File-Sharing Website Via Bitsadmin
Kusto Query Language
T1137 Office Application Startup 11 rules
Comparative authoring view → · attack.mitre.org
Sigma
- IE Change Domain Zone
- New Outlook Macro Created
- Outlook Macro Execution Without Warning Setting Enabled
- Outlook Security Settings Updated - Registry
- Potential Persistence Via Microsoft Office Startup Folder
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
- Registry Modification to Hidden File Extension
- Suspicious Outlook Macro Created
Splunk
T1137.002 Office Application Startup: Office Test 1 rule
T1137.003 Office Application Startup: Outlook Forms 1 rule
T1137.006 Office Application Startup: Add-ins 4 rules
T1554 Compromise Host Software Binary 8 rules
T1037 Boot or Logon Initialization Scripts 1 rule
T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows) 4 rules
T1556 Modify Authentication Process 4 rules
T1556.002 Modify Authentication Process: Password Filter DLL 3 rules
T1176.001 Software Extensions: Browser Extensions 2 rules
T1542 Pre-OS Boot 1 rule
T1542.001 Pre-OS Boot: System Firmware 2 rules
Defense Evasion (112 techniques)
T1562 Impair Defenses 35 rules
Comparative authoring view → · attack.mitre.org
Sigma
- ETW Logging Disabled For rpcrt4.dll
- ETW Logging Disabled For SCM
- ETW Logging Disabled In .NET Processes - Registry
- ETW Logging Disabled In .NET Processes - Sysmon Registry
- ETW Logging Tamper In .NET Processes Via CommandLine
- Filter Driver Unloaded Via Fltmc.EXE
- HackTool - EDRSilencer Execution
- HackTool - EDRSilencer Execution - Filter Added
- Hide Schedule Task Via Index Value Tamper
- Potential Suspicious Activity Using SeCEdit
- Potential Windows Defender Tampering Via Wmic.EXE
- Removal Of Index Value to Hide Schedule Task - Registry
- Removal Of SD Value to Hide Schedule Task - Registry
- Sysmon Application Crashed
- Sysmon Driver Unloaded Via Fltmc.EXE
- WFP Filter Added via Registry
- Windows Defender Exclusions Added - PowerShell
- Windows Filtering Platform Blocked Connection From EDR Agent Binary
- Windows Firewall Disabled via PowerShell
- Write Protect For Storage Disabled
Elastic
Splunk
Kusto Query Language
T1562.001 Impair Defenses: Disable or Modify Tools 171 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Add SafeBoot Keys Via Reg Utility
- AMSI Bypass Pattern Assembly GetType
- AMSI Disabled via Registry Modification
- Antivirus Filter Driver Disallowed On Dev Drive - Registry
- Devcon Execution Disabling VMware VMCI Device
- Disable Exploit Guard Network Protection on Windows Defender
- Disable Privacy Settings Experience in Registry
- Disable PUA Protection on Windows Defender
- Disable Tamper Protection on Windows Defender
- Disable Windows Defender AV Security Monitoring
- Disable Windows Defender Functionalities Via Registry Keys
- Disable-WindowsOptionalFeature Command PowerShell
- Disabled IE Security Features
- Disabled Volume Snapshots
- Disabled Windows Defender Eventlog
- Disabling Windows Defender WMI Autologger Session via Reg.exe
- Dism Remove Online Package
- Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback
- Folder Removed From Exploit Guard ProtectedFolders List - Registry
- HackTool - CobaltStrike BOF Injection Pattern
- Hacktool - EDR-Freeze Execution
- HackTool - PowerTool Execution
- HackTool - Stracciatella Execution
- Hypervisor Enforced Paging Translation Disabled
- Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine
- Load Of RstrtMgr.DLL By A Suspicious Process
- Load Of RstrtMgr.DLL By An Uncommon Process
- Microsoft Defender Tamper Protection Trigger
- Microsoft Malware Protection Engine Crash
- Microsoft Malware Protection Engine Crash - WER
- Microsoft Office Protected View Disabled
- NetNTLM Downgrade Attack
- NetNTLM Downgrade Attack - Registry
- Obfuscated PowerShell OneLiner Execution
- Potential AMSI Bypass Script Using NULL Bits
- Potential AMSI Bypass Using NULL Bits
- Potential AMSI Bypass Via .NET Reflection
- Potential AMSI COM Server Hijacking
- Potential Privileged System Service Operation - SeLoadDriverPrivilege
- Potential Tampering With Security Products Via WMIC
- Powershell Base64 Encoded MpPreference Cmdlet
- Powershell Defender Disable Scan Feature
- Powershell Defender Exclusion
- PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'
- PPL Tampering Via WerFaultSecure
- PUA - CleanWipe Execution
- Python Function Execution Security Warning Disabled In Excel
- Python Function Execution Security Warning Disabled In Excel - Registry
- Raccine Uninstall
- Reg Add Suspicious Paths
- Removal Of AMSI Provider Registry Keys
- SafeBoot Registry Key Deleted Via Reg.EXE
- Scripted Diagnostics Turn Off Check Enabled - Registry
- Security Service Disabled Via Reg.EXE
- Service Registry Key Deleted Via Reg.EXE
- Service StartupType Change Via PowerShell Set-Service
- Service StartupType Change Via Sc.EXE
- Suspicious Application Allowed Through Exploit Guard
- Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
- Suspicious Path In Keyboard Layout IME File Registry Value
- Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze
- Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
- Suspicious PROCEXP152.sys File Created In TMP
- Suspicious Service Installed
- Suspicious Uninstall of Windows Defender Feature via PowerShell
- Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE
- Suspicious Windows Defender Registry Key Tampering Via Reg.EXE
- Suspicious Windows Service Tampering
- Suspicious Windows Trace ETW Session Tamper Via Logman.EXE
- Sysinternals PsSuspend Suspicious Execution
- Sysmon Configuration Update
- Sysmon Driver Altitude Change
- Tamper Windows Defender - PSClassic
- Tamper Windows Defender - ScriptBlockLogging
- Tamper Windows Defender Remove-MpPreference
- Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging
- Tamper With Sophos AV Registry Keys
- Taskkill Symantec Endpoint Protection
- Uncommon Extension In Keyboard Layout IME File Registry Value
- Uninstall Crowdstrike Falcon Sensor
- Uninstall Sysinternals Sysmon
- Vulnerable Driver Blocklist Registry Tampering Via CommandLine
- Weak Encryption Enabled and Kerberoast
- Win Defender Restored Quarantine File
- Windows AMSI Related Registry Tampering Via CommandLine
- Windows Credential Guard Disabled - Registry
- Windows Credential Guard Registry Tampering Via CommandLine
- Windows Credential Guard Related Registry Value Deleted - Registry
- Windows Defender Configuration Changes
- Windows Defender Context Menu Removed
- Windows Defender Definition Files Removed
- Windows Defender Exclusion List Modified
- Windows Defender Exclusion Registry Key - Write Access Requested
- Windows Defender Exclusions Added
- Windows Defender Exclusions Added - Registry
- Windows Defender Exploit Guard Tamper
- Windows Defender Grace Period Expired
- Windows Defender Malware And PUA Scanning Disabled
- Windows Defender Real-time Protection Disabled
- Windows Defender Real-Time Protection Failure/Restart
- Windows Defender Service Disabled - Registry
- Windows Defender Submit Sample Feature Disabled
- Windows Defender Threat Detection Service Disabled
- Windows Defender Threat Severity Default Action Modified
- Windows Defender Virus Scanning Feature Disabled
- Windows Hypervisor Enforced Code Integrity Disabled
- Windows Vulnerable Driver Blocklist Disabled
Elastic
Splunk
- Disable AMSI Through Registry
- Disable Defender AntiVirus Registry
- Disable Defender BlockAtFirstSeen Feature
- Disable Defender Enhanced Notification
- Disable Defender MpEngine Registry
- Disable Defender Spynet Reporting
- Disable Defender Submit Samples Consent Feature
- Disable ETW Through Registry
- Disable Registry Tool
- Disable Show Hidden Files
- Disable Windows App Hotkeys
- Disable Windows Behavior Monitoring
- Disable Windows SmartScreen Protection
- Disabling CMD Application
- Disabling ControlPanel
- Disabling Defender Services
- Disabling FolderOptions Windows Feature
- Disabling NoRun Windows App
- Disabling Task Manager
- Hide User Account From Sign-In Screen
- Powershell Remove Windows Defender Directory
- Powershell Windows Defender Exclusion Commands
- Windows AD Domain Controller Audit Policy Disabled
- Windows AD GPO Deleted
- Windows AD GPO Disabled
- Windows Defender Exclusion Registry Entry
- Windows Disable or Stop Browser Process
- Windows DisableAntiSpyware Registry
- Windows Event For Service Disabled
- Windows Excessive Disabled Services Event
- Windows Impair Defense Change Win Defender Health Check Intervals
- Windows Impair Defense Change Win Defender Quick Scan Interval
- Windows Impair Defense Change Win Defender Throttle Rate
- Windows Impair Defense Change Win Defender Tracing Level
- Windows Impair Defense Configure App Install Control
- Windows Impair Defense Define Win Defender Threat Action
- Windows Impair Defense Delete Win Defender Context Menu
- Windows Impair Defense Delete Win Defender Profile Registry
- Windows Impair Defense Deny Security Software With Applocker
- Windows Impair Defense Disable Controlled Folder Access
- Windows Impair Defense Disable Defender Firewall And Network
- Windows Impair Defense Disable Defender Protocol Recognition
- Windows Impair Defense Disable PUA Protection
- Windows Impair Defense Disable Realtime Signature Delivery
- Windows Impair Defense Disable Web Evaluation
- Windows Impair Defense Disable Win Defender App Guard
- Windows Impair Defense Disable Win Defender Compute File Hashes
- Windows Impair Defense Disable Win Defender Gen reports
- Windows Impair Defense Disable Win Defender Network Protection
- Windows Impair Defense Disable Win Defender Report Infection
- Windows Impair Defense Disable Win Defender Scan On Update
- Windows Impair Defense Disable Win Defender Signature Retirement
- Windows Impair Defense Overide Win Defender Phishing Filter
- Windows Impair Defense Override SmartScreen Prompt
- Windows Impair Defense Set Win Defender Smart Screen Level To Warn
- Windows Impair Defenses Disable Auto Logger Session
- Windows Impair Defenses Disable HVCI
- Windows Impair Defenses Disable Win Defender Auto Logging
- Windows Important Audit Policy Disabled
- Windows Powershell Import Applocker Policy
- Windows Terminating Lsass Process
Kusto Query Language
T1562.002 Impair Defenses: Disable Windows Event Logging 28 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Audit Policy Tampering Via Auditpol
- Audit Policy Tampering Via NT Resource Kit Auditpol
- Change Winevt Channel Access Permission Via Registry
- Disable Security Events Logging Adding Reg Key MiniNt
- Disable Windows Event Logging Via Registry
- Disable Windows IIS HTTP Logging
- ETW Logging/Processing Option Disabled On IIS Server
- EVTX Created In Uncommon Location
- Filter Driver Unloaded Via Fltmc.EXE
- HackTool - SharpEvtMute DLL Load
- HackTool - SharpEvtMute Execution
- HackTool - SysmonEnte Execution
- HTTP Logging Disabled On IIS Server
- Important Windows Event Auditing Disabled
- New Module Module Added To IIS Server
- Potential EventLog File Location Tampering
- Potential Suspicious Activity Using SeCEdit
- Previously Installed IIS Module Was Removed
- Security Event Logging Disabled via MiniNt Registry Key - Process
- Security Event Logging Disabled via MiniNt Registry Key - Registry Set
- Suspicious Eventlog Clearing or Configuration Change Activity
- Suspicious Svchost Process Access
- Sysmon Driver Unloaded Via Fltmc.EXE
- Windows Event Auditing Disabled
Elastic
Splunk
T1562.004 Impair Defenses: Disable or Modify System Firewall 21 rules
Comparative authoring view → · attack.mitre.org
Sigma
- A Rule Has Been Deleted From The Windows Firewall Exception List
- All Rules Have Been Deleted From The Windows Firewall Configuration
- Disable Microsoft Defender Firewall via Registry
- Disable Windows Firewall by Registry
- Firewall Disabled via Netsh.EXE
- Firewall Rule Deleted Via Netsh.EXE
- Netsh Allow Group Policy on Microsoft Defender Firewall
- New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application
- New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE
- New Firewall Rule Added Via Netsh.EXE
- RDP Connection Allowed Via Netsh.EXE
- Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
- The Windows Defender Firewall Service Failed To Load Group Policy
- Uncommon New Firewall Rule Added In Windows Firewall Exception List
- Windows Defender Firewall Has Been Reset To Its Default Configuration
- Windows Firewall Profile Disabled
- Windows Firewall Settings Have Been Changed
Elastic
Splunk
T1562.006 Impair Defenses: Indicator Blocking 7 rules
T1562.010 Impair Defenses: Downgrade Attack 1 rule
T1112 Modify Registry 149 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Activate Suppression of Windows Security Center Notifications
- Add DisallowRun Execution to Registry
- Allow RDP Remote Assistance Feature
- Change the Fax Dll
- Change User Account Associated with the FAX Service
- ClickOnce Trust Prompt Tampering
- CrashControl CrashDump Disabled
- DHCP Callout DLL Installation
- Disable Internal Tools or Feature in Registry
- Disable Security Events Logging Adding Reg Key MiniNt
- Disable Windows Security Center Notifications
- DNS-over-HTTPS Enabled by Registry
- Enable LM Hash Storage
- Enable LM Hash Storage - ProcCreation
- ETW Logging Disabled For rpcrt4.dll
- ETW Logging Disabled For SCM
- ETW Logging Disabled In .NET Processes - Registry
- ETW Logging Disabled In .NET Processes - Sysmon Registry
- Imports Registry Key From a File
- Imports Registry Key From an ADS
- Macro Enabled In A Potentially Suspicious Document
- Modification of IE Registry Settings
- NET NGenAssemblyUsageLog Registry Key Tamper
- NetNTLM Downgrade Attack
- NetNTLM Downgrade Attack - Registry
- New BgInfo.EXE Custom DB Path Registry Configuration
- New BgInfo.EXE Custom VBScript Registry Configuration
- New BgInfo.EXE Custom WMI Query Registry Configuration
- New DNS ServerLevelPluginDll Installed
- New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
- Non-privileged Usage of Reg or Powershell
- Office Macros Warning Disabled
- Outlook EnableUnsafeClientMailRules Setting Enabled - Registry
- Potential Persistence Via Custom Protocol Handler
- Potential Persistence Via Event Viewer Events.asp
- Potential Persistence Via Outlook Home Page
- Potential Persistence Via Outlook Today Page
- Potential Qakbot Registry Activity
- Potential Suspicious Registry File Imported Via Reg.EXE
- Potential Tampering With RDP Related Registry Keys Via Reg.EXE
- Potentially Suspicious Desktop Background Change Using Reg.EXE
- Potentially Suspicious Desktop Background Change Via Registry
- PowerShell Logging Disabled Via Registry Key Tampering
- RDP Sensitive Settings Changed
- RDP Sensitive Settings Changed to Zero
- RedMimicry Winnti Playbook Registry Manipulation
- Reg Add Suspicious Paths
- Registry Entries For Azorult Malware
- Registry Explorer Policy Modification
- Registry Hide Function from User
- Registry Manipulation via WMI Stdregprov
- Registry Modification Attempt Via VBScript
- Registry Modification Attempt Via VBScript - PowerShell
- Registry Modification for OCI DLL Redirection
- Registry Modification of MS-settings Protocol Handler
- Registry Modification Via Regini.EXE
- Registry Tampering by Potentially Suspicious Processes
- Removal of Potential COM Hijacking Registry Keys
- RestrictedAdminMode Registry Value Tampering
- RestrictedAdminMode Registry Value Tampering - ProcCreation
- Run Once Task Configuration in Registry
- Run Once Task Execution as Configured in Registry
- Security Event Logging Disabled via MiniNt Registry Key - Process
- Security Event Logging Disabled via MiniNt Registry Key - Registry Set
- Service Binary in Suspicious Folder
- ShimCache Flush
- Suspicious Registry Modification From ADS Via Regini.EXE
- Suspicious VBoxDrvInst.exe Parameters
- Sysmon Channel Reference Deletion
- Terminal Server Client Connection History Cleared - Registry
- Trust Access Disable For VBApplications
- Uncommon Microsoft Office Trusted Location Added
- User Shell Folders Registry Modification via CommandLine
- Wdigest CredGuard Registry Modification
- Wdigest Enable UseLogonCredential
- Windows Event Log Access Tampering Via Registry
- Winlogon AllowMultipleTSSessions Enable
Splunk
- Disable Registry Tool
- Disable Security Logs Using MiniNt Registry
- Disable Show Hidden Files
- Disable Windows App Hotkeys
- Disabling CMD Application
- Disabling ControlPanel
- Disabling NoRun Windows App
- Enable WDigest UseLogonCredential Registry
- Malicious InProcServer32 Modification
- Remcos client registry install entry
- Revil Registry Entry
- Windows Defender ASR Registry Modification
- Windows Defender ASR Rule Disabled
- Windows Deleted Registry By A Non Critical Process File Path
- Windows Disable Change Password Through Registry
- Windows Disable Lock Workstation Feature Through Registry
- Windows Disable LogOff Button Through Registry
- Windows Disable Notification Center
- Windows Disable Shutdown Button Through Registry
- Windows Disable Windows Group Policy Features Through Registry
- Windows Hide Notification Features Through Registry
- Windows Impair Defenses Disable AV AutoStart via Registry
- Windows InProcServer32 New Outlook Form
- Windows Modify Registry AuthenticationLevelOverride
- Windows Modify Registry Auto Minor Updates
- Windows Modify Registry Auto Update Notif
- Windows Modify Registry Configure BitLocker
- Windows Modify Registry Default Icon Setting
- Windows Modify Registry Delete Firewall Rules
- Windows Modify Registry Disable RDP
- Windows Modify Registry Disable Restricted Admin
- Windows Modify Registry Disable Toast Notifications
- Windows Modify Registry Disable Win Defender Raw Write Notif
- Windows Modify Registry Disable WinDefender Notifications
- Windows Modify Registry Disable Windows Security Center Notif
- Windows Modify Registry DisableRemoteDesktopAntiAlias
- Windows Modify Registry DisableSecuritySettings
- Windows Modify Registry Disabling WER Settings
- Windows Modify Registry DisAllow Windows App
- Windows Modify Registry Do Not Connect To Win Update
- Windows Modify Registry DontShowUI
- Windows Modify Registry EnableLinkedConnections
- Windows Modify Registry LongPathsEnabled
- Windows Modify Registry MaxConnectionPerServer
- Windows Modify Registry No Auto Reboot With Logon User
- Windows Modify Registry No Auto Update
- Windows Modify Registry NoChangingWallPaper
- Windows Modify Registry on Smart Card Group Policy
- Windows Modify Registry ProxyEnable
- Windows Modify Registry ProxyServer
- Windows Modify Registry Qakbot Binary Data Registry
- Windows Modify Registry Suppress Win Defender Notif
- Windows Modify Registry Tamper Protection
- Windows Modify Registry to Add or Modify Firewall Rule
- Windows Modify Registry UpdateServiceUrlAlternate
- Windows Modify Registry USeWuServer
- Windows Modify Registry Utilize ProgIDs
- Windows Modify Registry ValleyRAT C2 Config
- Windows Modify Registry ValleyRat PWN Reg Entry
- Windows Modify Registry With MD5 Reg Key Name
- Windows Modify Registry WuServer
- Windows Modify Registry wuStatusServer
- Windows Modify Show Compress Color And Info Tip Registry
- Windows New InProcServer32 Added
- Windows Outlook Dialogs Disabled from Unusual Process
- Windows Outlook LoadMacroProviderOnBoot Persistence
- Windows Outlook WebView Registry Modification
- Windows Routing and Remote Access Service Registry Key Change
- Windows RunMRU Registry Key or Value Deleted
- Windows Set Network Profile Category to Private via Registry
- Windows Snake Malware Registry Modification wav OpenWithProgIds
- Windows SnappyBee Create Test Registry
T1218 System Binary Proxy Execution 136 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Abusing Print Executable
- AddinUtil.EXE Execution From Uncommon Directory
- AgentExecutor PowerShell Execution
- Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
- Arbitrary File Download Via IMEWDBLD.EXE
- Arbitrary File Download Via MSEDGE_PROXY.EXE
- Arbitrary File Download Via MSOHTMED.EXE
- Arbitrary File Download Via MSPUB.EXE
- Arbitrary File Download Via PresentationHost.EXE
- Arbitrary File Download Via Squirrel.EXE
- Arbitrary MSI Download Via Devinit.EXE
- Atbroker Registry Change
- BaaUpdate.exe Suspicious DLL Load
- Binary Proxy Execution Via Dotnet-Trace.EXE
- BitLockerTogo.EXE Execution
- COM Object Execution via Xwizard.EXE
- Created Files by Microsoft Sync Center
- Curl Download And Execute Combination
- DeviceCredentialDeployment Execution
- Devtoolslauncher.exe Executes Specified Binary
- Diskshadow Script Mode - Execution From Potential Suspicious Location
- Diskshadow Script Mode - Uncommon Script Extension Execution
- DLL Execution via Rasautou.exe
- DLL Loaded via CertOC.EXE
- Execute Files with Msdeploy.exe
- Execute Pcwrun.EXE To Leverage Follina
- Execution DLL of Choice Using WAB.EXE
- Execution via stordiag.exe
- Execution via WorkFolders.exe
- File Download Using ProtocolHandler.exe
- File Download Via InstallUtil.EXE
- File Download Via Windows Defender MpCmpRun.EXE
- Gpscript Execution
- HTML Help HH.EXE Suspicious Child Process
- Ie4uinit Lolbin Use From Invalid Path
- Import LDAP Data Interchange Format File Via Ldifde.EXE
- Indirect Command Execution By Program Compatibility Wizard
- InfDefaultInstall.exe .inf Execution
- Insensitive Subfolder Search Via Findstr.EXE
- Legitimate Application Dropped Archive
- Legitimate Application Dropped Executable
- Legitimate Application Dropped Script
- Legitimate Application Writing Files In Uncommon Location
- Lolbin Runexehelper Use As Proxy
- Lolbin Unregmp2.exe Use As Proxy
- Malicious PE Execution by Microsoft Visual Studio Debugger
- Malicious Windows Script Components File Execution by TAEF Detection
- Microsoft Sync Center Suspicious Network Connections
- MpiExec Lolbin
- MSDT Execution Via Answer File
- MSI Installation From Web
- Network Connection Initiated By AddinUtil.EXE
- New Capture Session Launched Via DXCap.EXE
- OpenWith.exe Executes Specified Binary
- Potential Application Whitelisting Bypass via Dnx.EXE
- Potential Arbitrary File Download Via Cmdl32.EXE
- Potential Binary Impersonating Sysinternals Tools
- Potential Binary Proxy Execution Via Cdb.EXE
- Potential Binary Proxy Execution Via VSDiagnostics.EXE
- Potential DLL Sideloading Using Coregen.exe
- Potential File Download Via MS-AppInstaller Protocol Handler
- Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution
- Potential NTLM Coercion Via Certutil.EXE
- Potential Password Spraying Attempt Using Dsacls.EXE
- Potential Provisioning Registry Key Abuse For Binary Proxy Execution
- Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
- Potential Provlaunch.EXE Binary Proxy Execution Abuse
- Potential Register_App.Vbs LOLScript Abuse
- Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module
- Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock
- Potential Suspicious Mofcomp Execution
- Potentially Over Permissive Permissions Granted Using Dsacls.EXE
- Potentially Suspicious Cabinet File Expansion
- Potentially Suspicious Child Process Of DiskShadow.EXE
- Potentially Suspicious Child Process Of VsCode
- Potentially Suspicious Child Processes Spawned by ConHost
- Potentially Suspicious CMD Shell Output Redirect
- Potentially Suspicious Self Extraction Directive File Created
- Potentially Suspicious Wuauclt Network Connection
- PowerShell MSI Install via WindowsInstaller COM From Remote Location
- Process Memory Dump Via Dotnet-Dump
- Process Proxy Execution Via Squirrel.EXE
- Program Executed Using Proxy/Local Command Via SSH.EXE
- Proxy Execution Via Wuauclt.EXE
- REGISTER_APP.VBS Proxy Execution
- Remote File Download Via Findstr.EXE
- RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses
- Renamed MegaSync Execution
- Renamed ZOHO Dctask64 Execution
- Scheduled Task Creation with Curl and PowerShell Execution Combo
- Sdiagnhost Calling Suspicious Child Process
- Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
- Self Extraction Directive File Created In Potentially Suspicious Location
- Suspicious AddinUtil.EXE CommandLine Execution
- Suspicious AgentExecutor PowerShell Execution
- Suspicious BitLocker Access Agent Update Utility Execution
- Suspicious Child Process Of BgInfo.EXE
- Suspicious Csi.exe Usage
- Suspicious DLL Loaded via CertOC.EXE
- Suspicious DotNET CLR Usage Log Artifact
- Suspicious HH.EXE Execution
- Suspicious MSDT Parent Process
- Suspicious Provlaunch.EXE Child Process
- Suspicious Speech Runtime Binary Child Process
- Suspicious Vsls-Agent Command With AgentExtensionPath Load
- Suspicious ZipExec Execution
- SyncAppvPublishingServer Bypass Powershell Restriction - PS Module
- SyncAppvPublishingServer Execute Arbitrary PowerShell Code
- SyncAppvPublishingServer Execution to Bypass Powershell Restriction
- SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code
- Time Travel Debugging Utility Usage
- Time Travel Debugging Utility Usage - Image
- Uncommon Assistive Technology Applications Execution Via AtBroker.EXE
- Uncommon AddinUtil.EXE CommandLine Execution
- Uncommon Child Process Of AddinUtil.EXE
- Uncommon Child Process Of Appvlp.EXE
- Uncommon Child Process Of BgInfo.EXE
- Uncommon Child Process Of Defaultpack.EXE
- Uncommon Child Process Of Setres.EXE
- Uncommon Link.EXE Parent Process
- Use of Scriptrunner.exe
- Use Of The SFTP.EXE Binary As A LOLBIN
- Use of VisualUiaVerifyNative.exe
- Verclsid.exe Runs COM Object
- Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution
- Visual Studio NodejsTools PressAnyKey Renamed Execution
- Windows MSIX Package Support Framework AI_STUBS Execution
- Windows Shell/Scripting Processes Spawning Suspicious Programs
- Winrs Local Command Execution
- Wlrmdr.EXE Uncommon Argument Or Child Process
- WSL Child Process Anomaly
- XBAP Execution From Uncommon Locations Via PresentationHost.EXE
Elastic
Splunk
T1218.001 System Binary Proxy Execution: Compiled HTML File 5 rules
T1218.002 System Binary Proxy Execution: Control Panel 1 rule
T1218.003 System Binary Proxy Execution: CMSTP 11 rules
T1218.004 System Binary Proxy Execution: InstallUtil 1 rule
T1218.005 System Binary Proxy Execution: Mshta 10 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Csc.EXE Execution Form Potentially Suspicious Parent
- HackTool - CACTUSTORCH Remote Thread Creation
- MSHTA Execution with Suspicious File Extensions
- Potential LethalHTA Technique Execution
- Remotely Hosted HTA File Executed Via Mshta.EXE
- Suspicious JavaScript Execution Via Mshta.EXE
- Suspicious MSHTA Child Process
Splunk
T1218.007 System Binary Proxy Execution: Msiexec 9 rules
Comparative authoring view → · attack.mitre.org
Sigma
- DllUnregisterServer Function Call Via Msiexec.EXE
- MSI Installation From Web
- Msiexec Quiet Installation
- MsiExec Web Install
- Obfuscated PowerShell MSI Install via WindowsInstaller COM
- PowerShell WMI Win32_Product Install MSI
- Suspicious MsiExec Embedding Parent
- Suspicious Msiexec Execute Arbitrary DLL
- Suspicious Msiexec Quiet Install From Remote Location
T1218.008 System Binary Proxy Execution: Odbcconf 8 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Driver/DLL Installation Via Odbcconf.EXE
- New DLL Registered Via Odbcconf.EXE
- Odbcconf.EXE Suspicious DLL Location
- Potentially Suspicious DLL Registered Via Odbcconf.EXE
- Response File Execution Via Odbcconf.EXE
- Suspicious Driver/DLL Installation Via Odbcconf.EXE
- Suspicious Response File Execution Via Odbcconf.EXE
- Uncommon Child Process Spawned By Odbcconf.EXE
T1218.009 System Binary Proxy Execution: Regsvcs/Regasm 6 rules
T1218.010 System Binary Proxy Execution: Regsvr32 20 rules
Comparative authoring view → · attack.mitre.org
Sigma
- DNS Query Request By Regsvr32.EXE
- HTML Help HH.EXE Suspicious Child Process
- Network Connection Initiated By Regsvr32.EXE
- Potential Regsvr32 Commandline Flag Anomaly
- Potentially Suspicious Child Process Of Regsvr32
- Potentially Suspicious Regsvr32 HTTP IP Pattern
- Potentially Suspicious Regsvr32 HTTP/FTP Pattern
- Regsvr32 DLL Execution With Suspicious File Extension
- Regsvr32 Execution From Highly Suspicious Location
- Regsvr32 Execution From Potential Suspicious Location
- Scripting/CommandLine Process Spawned Regsvr32
- Suspicious HH.EXE Execution
- Suspicious Microsoft Office Child Process
- Suspicious Regsvr32 Execution From Remote Share
- Suspicious WMIC Execution Via Office Process
- Suspicious WmiPrvSE Child Process
- Unsigned DLL Loaded by Windows Utility
Splunk
Kusto Query Language
T1218.011 System Binary Proxy Execution: Rundll32 35 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Bad Opsec Defaults Sacrificial Processes With Improper Arguments
- CobaltStrike Load by Rundll32
- Code Execution via Pcwutl.dll
- HackTool - F-Secure C3 Load by Rundll32
- HackTool - RedMimicry Winnti Playbook Execution
- HTML Help HH.EXE Suspicious Child Process
- Outbound Network Connection To Public IP Via Winlogon
- Potential PowerShell Execution Via DLL
- Potentially Suspicious Rundll32 Activity
- Potentially Suspicious Rundll32.EXE Execution of UDL File
- Process Access via TrolleyExpress Exclusion
- Remote Thread Creation Via PowerShell In Uncommon Target
- Rundll32 Execution With Uncommon DLL Extension
- Rundll32 InstallScreenSaver Execution
- Rundll32 Internet Connection
- RunDLL32 Spawning Explorer
- Rundll32 UNC Path Execution
- SCR File Write Event
- ScreenSaver Registry Key Set
- Shell32 DLL Execution in Suspicious Directory
- Suspicious Control Panel DLL Load
- Suspicious HH.EXE Execution
- Suspicious Rundll32 Activity Invoking Sys File
- Suspicious Rundll32 Execution With Image Extension
- Suspicious Rundll32 Setupapi.dll Activity
- Suspicious ShellExec_RunDLL Call Via Ordinal
- Unsigned DLL Loaded by Windows Utility
Elastic
Splunk
Kusto Query Language
T1218.013 System Binary Proxy Execution: Mavinject 2 rules
T1218.014 System Binary Proxy Execution: MMC 3 rules
T1027 Obfuscated Files or Information 106 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Base64 Encoded PowerShell Command Detected
- Certificate Exported Via Certutil.EXE
- ConvertTo-SecureString Cmdlet Usage Via CommandLine
- File Decoded From Base64/Hex Via Certutil.EXE
- File Encoded To Base64 Via Certutil.EXE
- File In Suspicious Location Encoded To Base64 Via Certutil.EXE
- Invoke-Obfuscation CLIP+ Launcher
- Invoke-Obfuscation CLIP+ Launcher - PowerShell
- Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
- Invoke-Obfuscation CLIP+ Launcher - Security
- Invoke-Obfuscation CLIP+ Launcher - System
- Invoke-Obfuscation COMPRESS OBFUSCATION
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module
- Invoke-Obfuscation COMPRESS OBFUSCATION - Security
- Invoke-Obfuscation COMPRESS OBFUSCATION - System
- Invoke-Obfuscation Obfuscated IEX Invocation
- Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
- Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
- Invoke-Obfuscation Obfuscated IEX Invocation - Security
- Invoke-Obfuscation Obfuscated IEX Invocation - System
- Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
- Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module
- Invoke-Obfuscation RUNDLL LAUNCHER - Security
- Invoke-Obfuscation RUNDLL LAUNCHER - System
- Invoke-Obfuscation STDIN+ Launcher
- Invoke-Obfuscation STDIN+ Launcher - Powershell
- Invoke-Obfuscation STDIN+ Launcher - PowerShell Module
- Invoke-Obfuscation STDIN+ Launcher - Security
- Invoke-Obfuscation STDIN+ Launcher - System
- Invoke-Obfuscation VAR+ Launcher
- Invoke-Obfuscation VAR+ Launcher - PowerShell
- Invoke-Obfuscation VAR+ Launcher - PowerShell Module
- Invoke-Obfuscation VAR+ Launcher - Security
- Invoke-Obfuscation VAR+ Launcher - System
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System
- Invoke-Obfuscation Via Stdin
- Invoke-Obfuscation Via Stdin - Powershell
- Invoke-Obfuscation Via Stdin - PowerShell Module
- Invoke-Obfuscation Via Stdin - Security
- Invoke-Obfuscation Via Stdin - System
- Invoke-Obfuscation Via Use Clip
- Invoke-Obfuscation Via Use Clip - Powershell
- Invoke-Obfuscation Via Use Clip - PowerShell Module
- Invoke-Obfuscation Via Use Clip - Security
- Invoke-Obfuscation Via Use Clip - System
- Invoke-Obfuscation Via Use MSHTA
- Invoke-Obfuscation Via Use MSHTA - PowerShell
- Invoke-Obfuscation Via Use MSHTA - PowerShell Module
- Invoke-Obfuscation Via Use MSHTA - Security
- Invoke-Obfuscation Via Use MSHTA - System
- Invoke-Obfuscation Via Use Rundll32 - PowerShell
- Invoke-Obfuscation Via Use Rundll32 - PowerShell Module
- Invoke-Obfuscation Via Use Rundll32 - Security
- Invoke-Obfuscation Via Use Rundll32 - System
- Password Protected ZIP File Opened
- Password Protected ZIP File Opened (Email Attachment)
- Password Protected ZIP File Opened (Suspicious Filenames)
- Ping Hex IP
- Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
- Potential Encoded PowerShell Patterns In CommandLine
- Potential PowerShell Command Line Obfuscation
- Potential PowerShell Obfuscation Using Alias Cmdlets
- Potential PowerShell Obfuscation Using Character Join
- Potential PowerShell Obfuscation Via Reversed Commands
- Potential PowerShell Obfuscation Via WCHAR/CHAR
- Potential Winnti Dropper Activity
- PowerShell Base64 Encoded Invoke Keyword
- PowerShell Base64 Encoded Reflective Assembly Load
- PowerShell Base64 Encoded WMI Classes
- PUA - Potential PE Metadata Tamper Using Rcedit
- Renamed AutoIt Execution
- Suspicious Download Via Certutil.EXE
- Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
- Suspicious File Downloaded From Direct IP Via Certutil.EXE
- Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- Suspicious File Encoded To Base64 Via Certutil.EXE
- Suspicious Get-Variable.exe Creation
- Suspicious SYSTEM User Process Creation
- Suspicious XOR Encoded PowerShell Command
Elastic
- Dynamic IEX Reconstruction via Method String Access
- Potential Dynamic IEX Reconstruction via Environment Variables
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- Potential PowerShell Obfuscation via Character Array Reconstruction
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
- Potential PowerShell Obfuscation via High Numeric Character Proportion
- Potential PowerShell Obfuscation via Invalid Escape Sequences
- Potential PowerShell Obfuscation via Reverse Keywords
- Potential PowerShell Obfuscation via Special Character Overuse
- Potential PowerShell Obfuscation via String Concatenation
- Potential PowerShell Obfuscation via String Reordering
- PowerShell Obfuscation via Negative Index String Reversal
Splunk
Kusto Query Language
T1027.001 Obfuscated Files or Information: Binary Padding 1 rule
T1027.002 Obfuscated Files or Information: Software Packing 1 rule
T1027.003 Obfuscated Files or Information: Steganography 1 rule
T1027.004 Obfuscated Files or Information: Compile After Delivery 5 rules
T1027.005 Obfuscated Files or Information: Indicator Removal from Tools 6 rules
T1027.009 Obfuscated Files or Information: Embedded Payloads 1 rule
T1027.010 Obfuscated Files or Information: Command Obfuscation 19 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Obfuscated PowerShell MSI Install via WindowsInstaller COM
- Potential Obfuscated Ordinal Call Via Rundll32
- Python One-Liners with Base64 Decoding
- Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix
- Suspicious Space Characters in RunMRU Registry Path - ClickFix
- Suspicious Space Characters in TypedPaths Registry Path - FileFix
- Suspicious Usage of For Loop with Recursive Directory Search in CMD
Elastic
- Dynamic IEX Reconstruction via Method String Access
- Potential Dynamic IEX Reconstruction via Environment Variables
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- Potential PowerShell Obfuscation via Character Array Reconstruction
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
- Potential PowerShell Obfuscation via High Numeric Character Proportion
- Potential PowerShell Obfuscation via Invalid Escape Sequences
- Potential PowerShell Obfuscation via Reverse Keywords
- Potential PowerShell Obfuscation via Special Character Overuse
- Potential PowerShell Obfuscation via String Concatenation
- Potential PowerShell Obfuscation via String Reordering
- PowerShell Obfuscation via Negative Index String Reversal
T1027.011 Obfuscated Files or Information: Fileless Storage 3 rules
T1027.013 Obfuscated Files or Information: Encrypted/Encoded File 1 rule
T1574 Hijack Execution Flow 7 rules
T1574.001 Hijack Execution Flow: DLL 91 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Aruba Network Service Potential DLL Sideloading
- Creation Of Non-Existent System DLL
- Creation of WerFault.exe/Wer.dll in Unusual Folder
- DHCP Callout DLL Installation
- DHCP Server Error Failed Loading the CallOut DLL
- DHCP Server Loaded the CallOut DLL
- DLL Search Order Hijackig Via Additional Space in Path
- DLL Sideloading by VMware Xfer Utility
- DLL Sideloading Of ShellChromeAPI.DLL
- DNS Server Error Failed Loading the ServerLevelPluginDLL
- Fax Service DLL Search Order Hijack
- HackTool - Powerup Write Hijack DLL
- Malicious DLL File Dropped in the Teams or OneDrive Folder
- Microsoft Defender Blocked from Loading Unsigned DLL
- Microsoft Office DLL Sideload
- New DNS ServerLevelPluginDll Installed
- New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
- Potential 7za.DLL Sideloading
- Potential Antivirus Software DLL Sideloading
- Potential appverifUI.DLL Sideloading
- Potential AVKkid.DLL Sideloading
- Potential Azure Browser SSO Abuse
- Potential CCleanerDU.DLL Sideloading
- Potential CCleanerReactivator.DLL Sideloading
- Potential Chrome Frame Helper DLL Sideloading
- Potential DLL Sideloading Of DBGCORE.DLL
- Potential DLL Sideloading Of DBGHELP.DLL
- Potential DLL Sideloading Of DbgModel.DLL
- Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
- Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE
- Potential DLL Sideloading Of MpSvc.DLL
- Potential DLL Sideloading Of MsCorSvc.DLL
- Potential DLL Sideloading Of Non-Existent DLLs From System Folders
- Potential DLL Sideloading Via ClassicExplorer32.dll
- Potential DLL Sideloading Via comctl32.dll
- Potential DLL Sideloading Via DeviceEnroller.EXE
- Potential DLL Sideloading Via JsSchHlp
- Potential DLL Sideloading Via VMware Xfer
- Potential EACore.DLL Sideloading
- Potential Edputil.DLL Sideloading
- Potential Goopdate.DLL Sideloading
- Potential Initial Access via DLL Search Order Hijacking
- Potential Iviewers.DLL Sideloading
- Potential JLI.dll Side-Loading
- Potential Libvlc.DLL Sideloading
- Potential Mfdetours.DLL Sideloading
- Potential Mpclient.DLL Sideloading
- Potential Mpclient.DLL Sideloading Via Defender Binaries
- Potential Python DLL SideLoading
- Potential Rcdll.DLL Sideloading
- Potential RjvPlatform.DLL Sideloading From Default Location
- Potential RjvPlatform.DLL Sideloading From Non-Default Location
- Potential RoboForm.DLL Sideloading
- Potential ShellDispatch.DLL Sideloading
- Potential SmadHook.DLL Sideloading
- Potential SolidPDFCreator.DLL Sideloading
- Potential System DLL Sideloading From Non System Locations
- Potential Vivaldi_elf.DLL Sideloading
- Potential Waveedit.DLL Sideloading
- Potential Wazuh Security Platform DLL Sideloading
- Potential WWlib.DLL Sideloading
- Potentially Suspicious Child Process of KeyScrambler.exe
- Registry Modification for OCI DLL Redirection
- Renamed Vmnat.exe Execution
- Suspicious GUP Usage
- Suspicious Unsigned Thor Scanner Execution
- System Control Panel Item Loaded From Uncommon Location
- Tasks Folder Evasion
- Third Party Software DLL Sideloading
- UAC Bypass With Fake DLL
- Unsigned .node File Loaded
- Unsigned Binary Loaded From Suspicious Location
- Unsigned Mfdetours.DLL Sideloading
- Unsigned Module Loaded by ClickOnce Application
- VMGuestLib DLL Sideload
- VMMap Signed Dbghelp.DLL Potential Sideloading
- VMMap Unsigned Dbghelp.DLL Potential Sideloading
- Xwizard.EXE Execution From Non-Default Location
Splunk
- MSI Module Loaded by Non-System Binary
- Msmpeng Application DLL Side Loading
- Windows DLL Search Order Hijacking Hunt with Sysmon
- Windows DLL Side-Loading In Calc
- Windows Hijack Execution Flow Version Dll Side Load
- Windows Known Abused DLL Created
- Windows Known Abused DLL Loaded Suspiciously
- Windows Known GraphicalProton Loaded Modules
- Windows SqlWriter SQLDumper DLL Sideload
- Windows Unsigned DLL Side-Loading
- Windows Unsigned DLL Side-Loading In Same Process Path
- Windows Unsigned MS DLL Side-Loading
Kusto Query Language
T1574.004 Hijack Execution Flow: Dylib Hijacking 1 rule
T1574.005 Hijack Execution Flow: Executable Installer File Permissions Weakness 2 rules
T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking 2 rules
T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable 3 rules
T1574.008 Hijack Execution Flow: Path Interception by Search Order Hijacking 2 rules
T1574.009 Hijack Execution Flow: Path Interception by Unquoted Path 1 rule
T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness 12 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Abuse of Service Permissions to Hide Services Via Set-Service
- Abuse of Service Permissions to Hide Services Via Set-Service - PS
- Changing Existing Service ImagePath Value Via Reg.EXE
- Possible Privilege Escalation via Weak Service Permissions
- Potential Persistence Attempt Via Existing Service Tampering
- Potential Privilege Escalation via Service Permissions Weakness
- Service DACL Abuse To Hide Services Via Sc.EXE
- Service Registry Key Read Access Request
- Service Registry Permissions Weakness Check
- Service Security Descriptor Tampering Via Sc.EXE
- Suspicious Service DACL Modification Via Set-Service Cmdlet - PS
Splunk
T1574.012 Hijack Execution Flow: COR_PROFILER 2 rules
T1574.014 Hijack Execution Flow: AppDomainManager 1 rule
T1548 Abuse Elevation Control Mechanism 11 rules
T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control 70 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Always Install Elevated MSI Spawned Cmd And Powershell
- Always Install Elevated Windows Installer
- Bypass UAC Using DelegateExecute
- Bypass UAC Using SilentCleanup Task
- Bypass UAC via CMSTP
- Bypass UAC via Fodhelper.exe
- Bypass UAC via WSReset.exe
- CMSTP UAC Bypass via COM Object Access
- Explorer NOUACCHECK Flag
- Function Call From Undocumented COM Interface EditionUpgradeManager
- HackTool - Empire PowerShell UAC Bypass
- HackTool - UACMe Akagi Execution
- HackTool - WinPwn Execution
- HackTool - WinPwn Execution - ScriptBlock
- Potential UAC Bypass Via Sdclt.EXE
- Potentially Suspicious Event Viewer Child Process
- PowerShell Web Access Feature Enabled Via DISM
- Registry Modification of MS-settings Protocol Handler
- Sdclt Child Processes
- Shell Open Registry Keys Manipulation
- Suspicious Shell Open Command Registry Modification
- Trusted Path Bypass via Windows Directory Spoofing
- TrustedPath UAC Bypass Pattern
- UAC Bypass Abusing Winsat Path Parsing - File
- UAC Bypass Abusing Winsat Path Parsing - Process
- UAC Bypass Abusing Winsat Path Parsing - Registry
- UAC Bypass Tools Using ComputerDefaults
- UAC Bypass Using .NET Code Profiler on MMC
- UAC Bypass Using ChangePK and SLUI
- UAC Bypass Using Consent and Comctl32 - File
- UAC Bypass Using Consent and Comctl32 - Process
- UAC Bypass Using Disk Cleanup
- UAC Bypass Using DismHost
- UAC Bypass Using IDiagnostic Profile
- UAC Bypass Using IDiagnostic Profile - File
- UAC Bypass Using IEInstal - File
- UAC Bypass Using IEInstal - Process
- UAC Bypass Using Iscsicpl - ImageLoad
- UAC Bypass Using MSConfig Token Modification - File
- UAC Bypass Using MSConfig Token Modification - Process
- UAC Bypass Using NTFS Reparse Point - File
- UAC Bypass Using NTFS Reparse Point - Process
- UAC Bypass Using PkgMgr and DISM
- UAC Bypass Using Windows Media Player - File
- UAC Bypass Using Windows Media Player - Process
- UAC Bypass Using Windows Media Player - Registry
- UAC Bypass Using WOW64 Logger DLL Hijack
- UAC Bypass via Event Viewer
- UAC Bypass via ICMLuaUtil
- UAC Bypass via Sdclt
- UAC Bypass Via Wsreset
- UAC Bypass With Fake DLL
- UAC Bypass WSReset
- UAC Disabled
- UAC Notification Disabled
- UAC Secure Desktop Prompt Disabled
Splunk
- Disable UAC Remote Restriction
- Disabling Remote User Account Control
- Eventvwr UAC Bypass
- NET Profiler UAC bypass
- Sdclt UAC Bypass
- SilentCleanup UAC Bypass
- UAC Bypass MMC Load Unsigned Dll
- Windows ComputerDefaults Spawning a Process
- Windows DISM Install PowerShell Web Access
- Windows UAC Bypass Suspicious Escalation Behavior
- WSReset UAC Bypass
Kusto Query Language
T1036 Masquerading 49 rules
Comparative authoring view → · attack.mitre.org
Sigma
- CodePage Modification Via MODE.COM To Russian Language
- CreateDump Process Dump
- DumpMinitool Execution
- Explorer Process Tree Break
- Findstr Launching .lnk File
- Forfiles.EXE Child Process Masquerading
- HackTool - XORDump Execution
- New or Renamed User Account with '$' Character
- New Process Created Via Taskmgr.EXE
- Password Protected ZIP File Opened (Suspicious Filenames)
- Potential Command Line Path Traversal Evasion Attempt
- Potential Fake Instance Of Hxtsr.EXE Executed
- Potential Homoglyph Attack Using Lookalike Characters
- Potential Homoglyph Attack Using Lookalike Characters in Filename
- Potential LSASS Process Dump Via Procdump
- Potential ReflectDebugger Content Execution Via WerFault.EXE
- Potential SysInternals ProcDump Evasion
- Procdump Execution
- Process Execution From A Potentially Suspicious Folder
- Process Memory Dump Via Comsvcs.DLL
- PUA - Potential PE Metadata Tamper Using Rcedit
- Renamed CreateDump Utility Execution
- Renamed Plink Execution
- Renamed ZOHO Dctask64 Execution
- Sdiagnhost Calling Suspicious Child Process
- Suspicious Calculator Usage
- Suspicious Child Process Of Wermgr.EXE
- Suspicious CodePage Switch Via CHCP
- Suspicious DumpMinitool Execution
- Suspicious MSDT Parent Process
- Suspicious Process Parents
- Suspicious Process Start Locations
- Suspicious Windows Update Agent Empty Cmdline
- System File Execution Location Anomaly
- Taskmgr as LOCAL_SYSTEM
- Windows Binaries Write Suspicious Extensions
Elastic
Splunk
Kusto Query Language
T1036.002 Masquerading: Right-to-Left Override 4 rules
T1036.003 Masquerading: Rename Legitimate Utilities 26 rules
Comparative authoring view → · attack.mitre.org
Sigma
- File Download Via Bitsadmin
- File Download Via Bitsadmin To A Suspicious Target Folder
- File With Suspicious Extension Downloaded Via Bitsadmin
- LOL-Binary Copied From System Directory
- Potential Defense Evasion Via Binary Rename
- Potential Defense Evasion Via Rename Of Highly Relevant Binaries
- Potential Homoglyph Attack Using Lookalike Characters
- Potential Homoglyph Attack Using Lookalike Characters in Filename
- Potential PendingFileRenameOperations Tampering
- Potential WerFault ReflectDebugger Registry Value Abuse
- PUA - Potential PE Metadata Tamper Using Rcedit
- Remote Access Tool - Renamed MeshAgent Execution - Windows
- Renamed BrowserCore.EXE Execution
- Renamed Jusched.EXE Execution
- Renamed Msdt.EXE Execution
- Renamed Office Binary Execution
- Renamed Powershell Under Powershell Channel
- Renamed ProcDump Execution
- Renamed Schtasks Execution
- Suspicious Copy From or To System Directory
- Suspicious Download From Direct IP Via Bitsadmin
- Suspicious Download From File-Sharing Website Via Bitsadmin
- Suspicious Start-Process PassThru
- Windows Processes Suspicious Parent Directory
Elastic
Splunk
T1036.004 Masquerading: Masquerade Task or Service 1 rule
T1036.005 Masquerading: Match Legitimate Resource Name or Location 14 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Files With System DLL Name In Unsuspected Locations
- Files With System Process Name In Unsuspected Locations
- Potential Binary Impersonating Sysinternals Tools
- Potential MsiExec Masquerading
- Scheduled Task Creation Masquerading as System Processes
- Suspicious Files in Default GPO Folder
- Suspicious Process Masquerading As SvcHost.EXE
- Suspicious Scheduled Task Creation via Masqueraded XML File
- Uncommon Svchost Command Line Parameter
- Uncommon Svchost Parent Process
- Unsigned .node File Loaded
- Windows Processes Suspicious Parent Directory
Splunk
Kusto Query Language
T1036.007 Masquerading: Double File Extension 3 rules
T1036.008 Masquerading: Masquerade File Type 1 rule
T1036.009 Masquerading: Break Process Trees 2 rules
T1055 Process Injection 43 rules
Comparative authoring view → · attack.mitre.org
Sigma
- CobaltStrike Named Pipe
- CobaltStrike Named Pipe Pattern Regex
- CobaltStrike Named Pipe Patterns
- Created Files by Microsoft Sync Center
- Dllhost.EXE Execution Anomaly
- DotNet CLR DLL Loaded By Scripting Applications
- HackTool - CoercedPotato Execution
- HackTool - CoercedPotato Named Pipe Creation
- HackTool - DInjector PowerShell Cradle Execution
- HackTool - EfsPotato Named Pipe Creation
- Malicious Named Pipe Created
- Microsoft Sync Center Suspicious Network Connections
- Network Connection Initiated Via Notepad.EXE
- Potential DLL Sideloading Using Coregen.exe
- Potential Process Injection Via Msra.EXE
- PowerShell ShellCode
- Process Creation Using Sysnative Folder
- Rare Remote Thread Creation By Uncommon Source Image
- Remote Thread Creation By Uncommon Source Image
- Suspect Svchost Activity
- Suspicious Child Process Of Wermgr.EXE
- Suspicious Rundll32 Invoking Inline VBScript
- Suspicious Userinit Child Process
- Uncommon Svchost Command Line Parameter
Elastic
Splunk
- Create Remote Thread In Shell Application
- DLLHost with no Command Line Arguments with Network
- GPUpdate with no Command Line Arguments with Network
- Powershell Fileless Process Injection via GetProcAddress
- Powershell Remote Thread To Known Windows Process
- Rundll32 Create Remote Thread To A Process
- Rundll32 CreateRemoteThread In Browser
- SearchProtocolHost with no Command Line with Network
- Trickbot Named Pipe
- Windows PUA Named Pipe
- Windows RMM Named Pipe
- Windows Suspicious C2 Named Pipe
- Windows Suspicious Named Pipe
Kusto Query Language
T1055.001 Process Injection: Dynamic-link Library Injection 8 rules
T1055.002 Process Injection: Portable Executable Injection 4 rules
T1055.003 Process Injection: Thread Execution Hijacking 2 rules
T1055.011 Process Injection: Extra Window Memory Injection 1 rule
T1055.012 Process Injection: Process Hollowing 5 rules
T1202 Indirect Command Execution 39 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Custom File Open Handler Executes PowerShell
- Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
- Findstr Launching .lnk File
- Indirect Command Execution From Script File Via Bash.EXE
- Indirect Inline Command Execution Via Bash.EXE
- Outlook EnableUnsafeClientMailRules Setting Enabled
- Potential Arbitrary Command Execution Using Msdt.EXE
- Potential Arbitrary Command Execution Via FTP.EXE
- Potential Arbitrary DLL Load Using Winword
- Potential Arbitrary File Download Using Office Application
- Potential Arbitrary File Download Via Cmdl32.EXE
- Potential Binary Impersonating Sysinternals Tools
- Potentially Suspicious Child Process Of VsCode
- Potentially Suspicious Child Processes Spawned by ConHost
- Potentially Suspicious Office Document Executed From Trusted Location
- Proxy Execution via Vshadow
- Renamed CURL.EXE Execution
- Renamed FTP.EXE Execution
- Renamed NirCmd.EXE Execution
- Renamed PAExec Execution
- Renamed PingCastle Binary Execution
- Renamed ZOHO Dctask64 Execution
- Rundll32 Execution Without CommandLine Parameters
- Suspicious Cabinet File Execution Via Msdt.EXE
- Suspicious Child Process Of BgInfo.EXE
- Suspicious High IntegrityLevel Conhost Legacy Option
- Suspicious Remote Child Process From Outlook
- Suspicious Runscripthelper.exe
- Suspicious Service Binary Directory
- Suspicious Splwow64 Without Params
- Suspicious ZipExec Execution
- Troubleshooting Pack Cmdlet Execution
- Uncommon Child Process Of BgInfo.EXE
- Uncommon Child Process Of Conhost.EXE
- Uncommon Child Process Of Setres.EXE
- Windows Binary Executed From WSL
- WSL Child Process Anomaly
- WSL Kali-Linux Usage
Splunk
T1078 Valid Accounts 35 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Account Tampering - Suspicious Failed Logon Reasons
- External Remote RDP Logon from Public IP
- External Remote SMB Logon from Public IP
- Failed Logon From Public IP
- Password Provided In Command Line Of Net.EXE
- Suspicious Computer Machine Password by PowerShell
- Suspicious Remote Logon with Explicit Credentials
- User Added to Local Administrator Group
Elastic
- Access to a Sensitive LDAP Attribute
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Delegated Managed Service Account Modification by an Unusual User
- dMSA Account Creation by an Unusual User
- FirstTime Seen Account Performing DCSync
- Kerberos Pre-authentication Disabled for User
- Potential Account Takeover - Logon from New Source IP
- Potential Account Takeover - Mixed Logon Types
- Potential Credential Access via DCSync
- Potential Privileged Escalation via SamAccountName Spoofing
- Remote Computer Account DnsHostName Update
Splunk
Kusto Query Language
- AdminSDHolder Modifications
- EatonForeseer - Unauthorized Logins
- Email access via active sync
- New user created and added to the built-in administrators group
- Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization)
- User account added to built in domain local or global group
- User account created and deleted within 10 mins
- User account enabled and disabled within 10 mins
- User login from different countries within 3 hours (Uses Authentication Normalization)
T1078.001 Valid Accounts: Default Accounts 1 rule
T1078.002 Valid Accounts: Domain Accounts 19 rules
Comparative authoring view → · attack.mitre.org
Sigma
Elastic
- Access to a Sensitive LDAP Attribute
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Delegated Managed Service Account Modification by an Unusual User
- dMSA Account Creation by an Unusual User
- FirstTime Seen Account Performing DCSync
- Kerberos Pre-authentication Disabled for User
- Potential Credential Access via DCSync
- Potential Privileged Escalation via SamAccountName Spoofing
- Remote Computer Account DnsHostName Update
Splunk
T1078.003 Valid Accounts: Local Accounts 2 rules
T1140 Deobfuscate/Decode Files or Information 25 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Base64 Encoded PowerShell Command Detected
- DNS-over-HTTPS Enabled by Registry
- MSHTA Execution with Suspicious File Extensions
- Ping Hex IP
- Potential Commandline Obfuscation Using Escape Characters
- PowerShell Base64 Encoded FromBase64String Cmdlet
- PowerShell Decompress Commands
- Suspicious XOR Encoded PowerShell Command
Elastic
- Dynamic IEX Reconstruction via Method String Access
- Potential Dynamic IEX Reconstruction via Environment Variables
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- Potential PowerShell Obfuscation via Character Array Reconstruction
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
- Potential PowerShell Obfuscation via High Numeric Character Proportion
- Potential PowerShell Obfuscation via Invalid Escape Sequences
- Potential PowerShell Obfuscation via Reverse Keywords
- Potential PowerShell Obfuscation via Special Character Overuse
- Potential PowerShell Obfuscation via String Concatenation
- Potential PowerShell Obfuscation via String Reordering
- PowerShell Obfuscation via Negative Index String Reversal
Kusto Query Language
T1564 Hide Artifacts 11 rules
Comparative authoring view → · attack.mitre.org
Sigma
- CrashControl CrashDump Disabled
- Potentially Suspicious Execution From Parent Process In Public Folder
- PUA - Process Hacker Execution
- PUA - System Informer Execution
- Suspicious Creation with Colorcpl
- Suspicious Executable File Creation
- Sysmon Configuration Error
- Sysmon Configuration Modification
- Virtualbox Driver Installation or Starting of VMs
Kusto Query Language
T1564.001 Hide Artifacts: Hidden Files and Directories 7 rules
T1564.002 Hide Artifacts: Hidden Users 3 rules
T1564.003 Hide Artifacts: Hidden Window 8 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Browser Execution In Headless Mode
- Cmd Launched with Hidden Start Flags to Suspicious Targets
- File Download with Headless Browser
- HackTool - Covenant PowerShell Launcher
- Potential Data Stealing Via Chromium Headless Debugging
- Powershell Executed From Headless ConHost Process
- PUA - AdvancedRun Execution
- Suspicious PowerShell WindowStyle Option
T1564.004 Hide Artifacts: NTFS File Attributes 25 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Execute From Alternate Data Streams
- Exports Registry Key To an Alternate Data Stream
- HackTool Named File Stream Created
- Hidden Executable In NTFS Alternate Data Stream
- Insensitive Subfolder Search Via Findstr.EXE
- NTFS Alternate Data Stream
- Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream
- Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI
- Potential Rundll32 Execution With DLL Stored In ADS
- Powershell Store File In Alternate Data Stream
- PrintBrm ZIP Creation of Extraction
- Remote File Download Via Findstr.EXE
- Run PowerShell Script from ADS
- Suspicious Diantz Alternate Data Stream Execution
- Suspicious Extrac32 Alternate Data Stream Execution
- Suspicious File Download From File Sharing Websites - File Stream
- Unusual File Download from Direct IP Address
- Unusual File Download From File Sharing Websites - File Stream
- Use NTFS Short Name in Command Line
- Use NTFS Short Name in Image
- Use Short Name Path in Image
Splunk
Kusto Query Language
T1564.006 Hide Artifacts: Run Virtual Instance 2 rules
T1070 Indicator Removal 24 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Clearing Windows Console History
- Disable of ETW Trace - Powershell
- DLL Load By System Process From Suspicious Locations
- ETW Trace Evasion Activity
- EventLog EVTX File Deleted
- Exchange PowerShell Cmdlet History Deleted
- Filter Driver Unloaded Via Fltmc.EXE
- Fsutil Suspicious Invocation
- IIS WebServer Access Logs Deleted
- IIS WebServer Log Deletion via CommandLine Utilities
- Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE
- PowerShell Console History Logs Deleted
- Shadow Copies Deletion Using Operating Systems Utilities
- Sysmon Driver Unloaded Via Fltmc.EXE
- Terminal Server Client Connection History Cleared - Registry
- Tomcat WebServer Logs Deleted
Elastic
Splunk
Kusto Query Language
T1070.001 Indicator Removal: Clear Windows Event Logs 10 rules
T1070.003 Indicator Removal: Clear Command History 9 rules
T1070.004 Indicator Removal: File Deletion 15 rules
Comparative authoring view → · attack.mitre.org
Sigma
- ADS Zone.Identifier Deleted By Uncommon Application
- Backup Catalog Deleted
- Directory Removal Via Rmdir
- File Deleted Via Sysinternals SDelete
- File Deletion Via Del
- Greedy File Deletion Using Del
- Potential Secure Deletion with SDelete
- Potentially Suspicious Ping/Copy Command Combination
- Prefetch File Deleted
- Suspicious Ping/Del Command Combination
- TeamViewer Log File Deleted
Splunk
T1070.005 Indicator Removal: Network Share Connection Removal 4 rules
T1070.006 Indicator Removal: Timestomp 4 rules
T1127 Trusted Developer Utilities Proxy Execution 22 rules
Comparative authoring view → · attack.mitre.org
Sigma
- AspNetCompiler Execution
- C# IL Code Compilation Via Ilasm.EXE
- Detection of PowerShell Execution via Sqlps.exe
- JScript Compiler Execution
- Kavremover Dropped Binary LOLBIN Usage
- Node Process Executions
- Potential Arbitrary Code Execution Via Node.EXE
- Potential Binary Proxy Execution Via Cdb.EXE
- Potential Mftrace.EXE Abuse
- Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
- Remote Thread Creation Ttdinject.exe Proxy
- SQL Client Tools PowerShell Session Detection
- Suspicious Child Process of AspNetCompiler
- Suspicious File Created by ArcSOC.exe
- Suspicious Use of CSharp Interactive Console
- Use of Remote.exe
- Use of TTDInject.exe
- Use of VSIISExeLauncher.exe
- Use of Wfc.exe
Elastic
Splunk
Kusto Query Language
T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild 3 rules
T1222 File and Directory Permissions Modification 2 rules
T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification 16 rules
Comparative authoring view → · attack.mitre.org
Sigma
Splunk
- Windows AD Dangerous Deny ACL Modification
- Windows AD Dangerous Group ACL Modification
- Windows AD Dangerous User ACL Modification
- Windows AD DCShadow Privileges ACL Addition
- Windows AD Domain Root ACL Deletion
- Windows AD Domain Root ACL Modification
- Windows AD GPO New CSE Addition
- Windows AD Hidden OU Creation
- Windows AD Object Owner Updated
- Windows AD Suspicious Attribute Modification
- Windows File and Directory Enable ReadOnly Permissions
- Windows File and Directory Permissions Enable Inheritance
- Windows File and Directory Permissions Remove Inheritance
T1484 Domain or Tenant Policy Modification 14 rules
Comparative authoring view → · attack.mitre.org
Elastic
Splunk
- Windows AD Dangerous Deny ACL Modification
- Windows AD Dangerous Group ACL Modification
- Windows AD Dangerous User ACL Modification
- Windows AD DCShadow Privileges ACL Addition
- Windows AD Domain Replication ACL Addition
- Windows AD Domain Root ACL Deletion
- Windows AD Domain Root ACL Modification
- Windows AD Hidden OU Creation
- Windows AD Object Owner Updated
- Windows AD Self DACL Assignment
T1484.001 Domain or Tenant Policy Modification: Group Policy Modification 15 rules
T1197 BITS Jobs 14 rules
Comparative authoring view → · attack.mitre.org
Sigma
- BITS Transfer Job Download From Direct IP
- BITS Transfer Job Download From File Sharing Domains
- BITS Transfer Job Download To Potential Suspicious Folder
- BITS Transfer Job Downloading File Potential Suspicious Extension
- BITS Transfer Job With Uncommon Or Suspicious Remote TLD
- File Download Via Bitsadmin
- File Download Via Bitsadmin To A Suspicious Target Folder
- File With Suspicious Extension Downloaded Via Bitsadmin
- Monitoring For Persistence Via BITS
- New BITS Job Created Via Bitsadmin
- New BITS Job Created Via PowerShell
- Suspicious Download From Direct IP Via Bitsadmin
- Suspicious Download From File-Sharing Website Via Bitsadmin
Kusto Query Language
T1134 Access Token Manipulation 12 rules
T1134.001 Access Token Manipulation: Token Impersonation/Theft 13 rules
Comparative authoring view → · attack.mitre.org
Sigma
- HackTool - Impersonate Execution
- HackTool - Koh Default Named Pipe
- HackTool - NoFilter Execution
- HackTool - SharpDPAPI Execution
- HackTool - SharpImpersonation Execution
- Meterpreter or Cobalt Strike Getsystem Service Installation - Security
- Meterpreter or Cobalt Strike Getsystem Service Installation - System
- Potential Access Token Abuse
- Potential Meterpreter/CobaltStrike Activity
Elastic
Splunk
T1134.002 Access Token Manipulation: Create Process with Token 9 rules
T1134.003 Access Token Manipulation: Make and Impersonate Token 4 rules
T1134.004 Access Token Manipulation: Parent PID Spoofing 1 rule
T1134.005 Access Token Manipulation: SID-History Injection 6 rules
T1216 System Script Proxy Execution 13 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Assembly Loading Via CL_LoadAssembly.ps1
- AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl
- AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File
- Execute Code with Pester.bat
- Execute Code with Pester.bat as Parent
- Potential Manage-bde.wsf Abuse To Proxy Execution
- Potential Process Execution Proxy Via CL_Invocation.ps1
- Potential Script Proxy Execution Via CL_Mutexverifiers.ps1
- Remote Code Execute via Winrm.vbs
- Suspicious CustomShellHost Execution
- SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code
- Uncommon Sigverif.EXE Child Process
- UtilityFunctions.ps1 Proxy Dll
T1216.001 System Script Proxy Execution: PubPrn 2 rules
T1553 Subvert Trust Controls 1 rule
T1553.002 Subvert Trust Controls: Code Signing 1 rule
T1553.003 Subvert Trust Controls: SIP and Trust Provider Hijacking 3 rules
T1553.004 Subvert Trust Controls: Install Root Certificate 8 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Active Directory Certificate Services Denied Certificate Enrollment Request
- New Root Certificate Installed Via CertMgr.EXE
- New Root Certificate Installed Via Certutil.EXE
- Root Certificate Installed - PowerShell
- Root Certificate Installed From Susp Locations
- Suspicious X509Enrollment - Process Creation
- Suspicious X509Enrollment - Ps Script
Splunk
T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass 10 rules
T1550 Use Alternate Authentication Material 7 rules
T1550.002 Use Alternate Authentication Material: Pass the Hash 7 rules
T1550.003 Use Alternate Authentication Material: Pass the Ticket 5 rules
T1207 Rogue Domain Controller 6 rules
T1211 Exploitation for Defense Evasion 5 rules
T1220 XSL Script Processing 5 rules
T1556 Modify Authentication Process 4 rules
T1556.002 Modify Authentication Process: Password Filter DLL 3 rules
T1620 Reflective Code Loading 3 rules
T1014 Rootkit 2 rules
T1542 Pre-OS Boot 1 rule
T1542.001 Pre-OS Boot: System Firmware 2 rules
T1542.003 Pre-OS Boot: Bootkit 2 rules
T1006 Direct Volume Access 1 rule
T1497.001 Virtualization/Sandbox Evasion: System Checks 1 rule
T1599.001 Network Boundary Bridging: Network Address Translation Traversal 1 rule
T1622 Debugger Evasion 1 rule
Collection (22 techniques)
T1557 Adversary-in-the-Middle 14 rules
Comparative authoring view → · attack.mitre.org
Sigma
Elastic
- Creation of a DNS-Named Record
- Potential ADIDNS Poisoning via Wildcard Record Creation
- Potential Computer Account NTLM Relay Activity
- Potential Kerberos Coercion via DNS-Based SPN Spoofing
- Potential Kerberos Relay Attack against a Computer Account
- Potential Machine Account Relay Attack via SMB
- Potential NTLM Relay Attack against a Computer Account
- Potential WPAD Spoofing via DNS Record Creation
- Service Creation via Local Kerberos Authentication
T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay 19 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Attempts of Kerberos Coercion Via DNS SPN Spoofing
- HackTool - ADCSPwn Execution
- HackTool - Impacket Tools Execution
- Local Privilege Escalation Indicator TabTip
- Potential SMB Relay Attack Tool Execution
- RottenPotato Like Attack Pattern
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing
- WinDivert Driver Load
Elastic
Splunk
Kusto Query Language
T1557.003 Adversary-in-the-Middle: DHCP Spoofing 1 rule
T1005 Data from Local System 16 rules
Comparative authoring view → · attack.mitre.org
Sigma
- ADFS Database Named Pipe Connection By Uncommon Tool
- Crash Dump Created By Operating System
- Esentutl Steals Browser Information
- Script Interpreter Spawning Credential Scanner - Windows
- SQLite Chromium Profile Data DB Access
- SQLite Firefox Profile Data DB Access
- Veeam Backup Database Suspicious Query
- VeeamBackup Database Credentials Dump Via Sqlcmd.EXE
Splunk
Kusto Query Language
T1113 Screen Capture 12 rules
T1560 Archive Collected Data 6 rules
T1560.001 Archive Collected Data: Archive via Utility 11 rules
Comparative authoring view → · attack.mitre.org
Sigma
- 7Zip Compressing Dump Files
- Compress Data and Lock With Password for Exfiltration With 7-ZIP
- Compress Data and Lock With Password for Exfiltration With WINZIP
- Compressed File Creation Via Tar.EXE
- Compressed File Extraction Via Tar.EXE
- Files Added To An Archive Using Rar.EXE
- Rar Usage with Password and Compression Level
- Suspicious Manipulation Of Default Accounts Via Net.EXE
- Winrar Compressing Dump Files
- WinRAR Execution in Non-Standard Folder
Splunk
T1115 Clipboard Data 5 rules
T1185 Browser Session Hijacking 5 rules
T1074.001 Data Staged: Local Data Staging 4 rules
T1114 Email Collection 2 rules
T1114.001 Email Collection: Local Email Collection 4 rules
T1119 Automated Collection 4 rules
T1123 Audio Capture 4 rules
T1025 Data from Removable Media 3 rules
T1039 Data from Network Shared Drive 3 rules
T1056 Input Capture 1 rule
T1056.001 Input Capture: Keylogging 3 rules
T1056.002 Input Capture: GUI Input Capture 3 rules
T1056.004 Input Capture: Credential API Hooking 1 rule
T1125 Video Capture 2 rules
T1213 Data from Information Repositories 1 rule
Command & Control (24 techniques)
T1105 Ingress Tool Transfer 69 rules
Comparative authoring view → · attack.mitre.org
Sigma
- AppX Package Installation Attempts Via AppInstaller.EXE
- Arbitrary File Download Via GfxDownloadWrapper.EXE
- Browser Execution In Headless Mode
- Command Line Execution with Suspicious URL and AppData Strings
- Curl Download And Execute Combination
- File Download And Execution Via IEExec.EXE
- File Download From Browser Process Via Inline URL
- File Download From IP Based URL Via CertOC.EXE
- File Download Using Notepad++ GUP Utility
- File Download Via Bitsadmin
- File Download Via Bitsadmin To A Suspicious Target Folder
- File Download via CertOC.EXE
- File Download Via Windows Defender MpCmpRun.EXE
- File Download with Headless Browser
- File With Suspicious Extension Downloaded Via Bitsadmin
- Finger.EXE Execution
- Import LDAP Data Interchange Format File Via Ldifde.EXE
- Insensitive Subfolder Search Via Findstr.EXE
- Legitimate Application Writing Files In Uncommon Location
- Local Network Connection Initiated By Script Interpreter
- Lolbas OneDriveStandaloneUpdater.exe Proxy Download
- MsiExec Web Install
- Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
- Network Connection Initiated By IMEWDBLD.EXE
- Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
- Outbound Network Connection Initiated By Script Interpreter
- Password Protected ZIP File Opened (Suspicious Filenames)
- Potential COM Objects Download Cradles Usage - Process Creation
- Potential COM Objects Download Cradles Usage - PS Script
- Potential DLL File Download Via PowerShell Invoke-WebRequest
- Potential Download/Upload Activity Using Type Command
- Potentially Suspicious File Creation by OpenEDR's ITSMService
- PowerShell MSI Install via WindowsInstaller COM From Remote Location
- PrintBrm ZIP Creation of Extraction
- PUA - Nimgrab Execution
- Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server
- Remote File Download Via Desktopimgdownldr Utility
- Remote File Download Via Findstr.EXE
- Replace.exe Usage
- Scheduled Task Creation with Curl and PowerShell Execution Combo
- Suspicious CertReq Command to Download
- Suspicious Curl.EXE Download
- Suspicious Deno File Written from Remote Source
- Suspicious Desktopimgdownldr Command
- Suspicious Desktopimgdownldr Target File
- Suspicious Diantz Download and Compress Into a CAB File
- Suspicious Download From File-Sharing Website Via Bitsadmin
- Suspicious Download from Office Domain
- Suspicious Download Via Certutil.EXE
- Suspicious Dropbox API Usage
- Suspicious Extrac32 Execution
- Suspicious File Created by ArcSOC.exe
- Suspicious File Downloaded From Direct IP Via Certutil.EXE
- Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- Suspicious Invoke-WebRequest Execution
- Suspicious Invoke-WebRequest Execution With DirectIP
- Suspicious Non-Browser Network Communication With Telegram API
- Uncommon Network Connection Initiated By Certutil.EXE
Splunk
Kusto Query Language
T1219 Remote Access Tools 12 rules
T1219.002 Remote Access Tools: Remote Desktop Software 37 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Anydesk Temporary Artefact
- Atera Agent Installation
- DNS Query To AzureWebsites.NET By Non-Browser Process
- DNS Query To Remote Access Software Domain From Non-Browser App
- GoToAssist Temporary Installation Artefact
- HackTool - Inveigh Execution Artefacts
- HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators
- Hijack Legit RDP Session to Move Laterally
- Installation of TeamViewer Desktop
- Mesh Agent Service Installation
- Mstsc.EXE Execution With Local RDP File
- Potential Amazon SSM Agent Hijacking
- Potential Remote Desktop Connection to Non-Domain Host
- QuickAssist Execution
- Remote Access Tool - AnyDesk Execution
- Remote Access Tool - Anydesk Execution From Suspicious Folder
- Remote Access Tool - AnyDesk Incoming Connection
- Remote Access Tool - AnyDesk Piped Password Via CLI
- Remote Access Tool - AnyDesk Silent Installation
- Remote Access Tool - GoToAssist Execution
- Remote Access Tool - LogMeIn Execution
- Remote Access Tool - MeshAgent Command Execution via MeshCentral
- Remote Access Tool - NetSupport Execution
- Remote Access Tool - Potential MeshAgent Execution - Windows
- Remote Access Tool - Renamed MeshAgent Execution - Windows
- Remote Access Tool - ScreenConnect Execution
- Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
- Remote Access Tool - Simple Help Execution
- Remote Access Tool - UltraViewer Execution
- ScreenConnect Temporary Installation Artefact
- Suspicious Binary Writes Via AnyDesk
- Suspicious Mstsc.EXE Execution With Local RDP File
- Suspicious TSCON Start as SYSTEM
- TacticalRMM Service Installation
- TeamViewer Domain Query By Non-TeamViewer Application
- TeamViewer Remote Session
- Use of UltraVNC Remote Access Software
T1572 Protocol Tunneling 24 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Cloudflared Tunnel Connections Cleanup
- Cloudflared Tunnel Execution
- Cloudflared Tunnels Related DNS Requests
- Communication To LocaltoNet Tunneling Service Initiated
- Communication To Ngrok Tunneling Service Initiated
- DNS Query To Devtunnels Domain
- Network Connection Initiated To BTunnels Domains
- Network Connection Initiated To Cloudflared Tunnels Domains
- Network Connection Initiated To DevTunnels Domain
- Network Connection Initiated To Visual Studio Code Tunnels Domain
- Port Forwarding Activity Via SSH.EXE
- Potential RDP Tunneling Via Plink
- Potential RDP Tunneling Via SSH
- Potentially Suspicious Usage Of Qemu
- Process Initiated Network Connection To Ngrok Domain
- PUA - 3Proxy Execution
- PUA - Ngrok Execution
- RDP Over Reverse SSH Tunnel
- RDP to HTTP or HTTPS Target Ports
- Silence.EDA Detection
- Suspicious Plink Port Forwarding
Splunk
Kusto Query Language
T1090 Proxy 16 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Cloudflared Tunnel Connections Cleanup
- Cloudflared Tunnel Execution
- Communication To LocaltoNet Tunneling Service Initiated
- Communication To Ngrok Tunneling Service Initiated
- HackTool - Htran/NATBypass Execution
- New Port Forwarding Rule Added Via Netsh.EXE
- New PortProxy Registry Entry Added
- Ngrok Usage with Remote Desktop Service
- Potentially Suspicious Usage Of Qemu
- PUA - Fast Reverse Proxy (FRP) Execution
- PUA - NPS Tunneling Tool Execution
- PUA- IOX Tunneling Tool Execution
- RDP Port Forwarding Rule Added Via Netsh.EXE
- Suspicious TCP Tunnel Via PowerShell Script
Splunk
Kusto Query Language
T1090.001 Proxy: Internal Proxy 7 rules
T1090.002 Proxy: External Proxy 2 rules
T1090.003 Proxy: Multi-hop Proxy 3 rules
T1071 Application Layer Protocol 10 rules
T1071.001 Application Layer Protocol: Web Protocols 12 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Change User Agents with WebRequest
- Cloudflared Tunnels Related DNS Requests
- DNS Query Request By QuickAssist.EXE
- DNS Query To Devtunnels Domain
- DNS Query To Visual Studio Code Tunnels Domain
- Outbound Network Connection Initiated By Microsoft Dialer
- Renamed Visual Studio Code Tunnel Execution
- Visual Studio Code Tunnel Execution
- Visual Studio Code Tunnel Service Installation
- Visual Studio Code Tunnel Shell Execution
Kusto Query Language
T1071.003 Application Layer Protocol: Mail Protocols 3 rules
T1071.004 Application Layer Protocol: DNS 14 rules
T1102 Web Service 14 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Cloudflared Tunnel Connections Cleanup
- Cloudflared Tunnel Execution
- Communication To LocaltoNet Tunneling Service Initiated
- Communication To Ngrok Tunneling Service Initiated
- Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- New Connection Initiated To Potential Dead Drop Resolver Domain
- Potentially Suspicious Network Connection To Notion API
- Process Initiated Network Connection To Ngrok Domain
- Suspicious Child Process Of Manage Engine ServiceDesk
- Suspicious Non-Browser Network Communication With Google API
- Suspicious Non-Browser Network Communication With Telegram API
Splunk
Kusto Query Language
T1102.001 Web Service: Dead Drop Resolver 2 rules
T1102.002 Web Service: Bidirectional Communication 3 rules
T1008 Fallback Channels 8 rules
T1568 Dynamic Resolution 5 rules
Comparative authoring view → · attack.mitre.org
Kusto Query Language
- Detect DNS queries reporting multiple errors from different clients - Static threshold based (ASIM DNS Solution)
- Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution)
- Excessive NXDOMAIN DNS Queries (ASIM DNS Schema)
- RecordedFuture Threat Hunting Domain All Actors
- RecordedFuture Threat Hunting IP All Actors
T1568.002 Dynamic Resolution: Domain Generation Algorithms 1 rule
T1132.001 Data Encoding: Standard Encoding 4 rules
T1571 Non-Standard Port 4 rules
T1001.003 Data Obfuscation: Protocol or Service Impersonation 2 rules
T1095 Non-Application Layer Protocol 2 rules
T1573 Encrypted Channel 2 rules
T1573.002 Encrypted Channel: Asymmetric Cryptography 1 rule
Exfiltration (9 techniques)
T1567 Exfiltration Over Web Service 9 rules
Comparative authoring view → · attack.mitre.org
Sigma
- Arbitrary File Download Via ConfigSecurityPolicy.EXE
- Communication To Ngrok Tunneling Service Initiated
- LOLBAS Data Exfiltration by DataSvcUtil.exe
- Network Connection Initiated To BTunnels Domains
- Network Connection Initiated To Cloudflared Tunnels Domains
- Network Connection Initiated To Visual Studio Code Tunnels Domain
- Process Initiated Network Connection To Ngrok Domain
- Suspicious Non-Browser Network Communication With Telegram API
Splunk
T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository 2 rules
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage 12 rules
Comparative authoring view → · attack.mitre.org
Sigma
- DNS Query for Anonfiles.com Domain - DNS Client
- DNS Query for Anonfiles.com Domain - Sysmon
- DNS Query To MEGA Hosting Website
- DNS Query To MEGA Hosting Website - DNS Client
- DNS Query To Ufile.io
- DNS Query To Ufile.io - DNS Client
- Network Connection Initiated To Mega.nz
- PUA - Rclone Execution
- PUA - Restic Backup Tool Execution
- Rclone Config File Creation
- Suspicious Dropbox API Usage
Kusto Query Language
T1048 Exfiltration Over Alternative Protocol 11 rules
T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol 1 rule
T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol 6 rules
T1041 Exfiltration Over C2 Channel 6 rules
T1020 Automated Exfiltration 3 rules
T1537 Transfer Data to Cloud Account 1 rule
Impact (14 techniques)
T1490 Inhibit System Recovery 26 rules
Comparative authoring view → · attack.mitre.org
Sigma
- All Backups Deleted Via Wbadmin.EXE
- Backup Files Deleted
- Boot Configuration Tampering Via Bcdedit.EXE
- Copy From VolumeShadowCopy Via Cmd.EXE
- Delete Volume Shadow Copies Via WMI With PowerShell
- Deletion of Volume Shadow Copies via WMI with PowerShell
- Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script
- File Recovery From Backup Via Wbadmin.EXE
- New Root or CA or AuthRoot Certificate to Store
- Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
- Registry Disable System Restore
- Sensitive File Access Via Volume Shadow Copy Backup
- Shadow Copies Deletion Using Operating Systems Utilities
- Suspicious Volume Shadow Copy VSS_PS.dll Load
- Suspicious Volume Shadow Copy Vssapi.dll Load
- Windows Backup Deleted Via Wbadmin.EXE
- Windows Recovery Environment Disabled Via Reagentc
Splunk
Kusto Query Language
T1485 Data Destruction 18 rules
Comparative authoring view → · attack.mitre.org
Sigma
Splunk
- Common Ransomware Extensions
- Common Ransomware Notes
- Detect DNS Query to Decommissioned S3 Bucket
- Excessive File Deletion In WinDefender Folder
- Windows Data Destruction Recursive Exec Files Deletion
- Windows Disable Memory Crash Dump
- Windows File Without Extension In Critical Folder
- Windows High File Deletion Frequency