Indicator catalog
3076 value patterns flagged by two or more production detection rules across Sigma, Elastic, and Splunk — process names, file paths, registry keys, and other tokens that rule authors treat as suspicious. 35 of these are flagged by rules from at least two vendors (high-confidence corpus consensus). Field names are unified across vendors (Image covers process.executable, NewProcessName, etc.); the eq: / match: / ends_with: prefix shows the operator a rule uses to check a value. Click any entry for the contributing rules and MITRE technique attribution.
3076 entries
CommandLine 882 entries
match: http 31 rules
Top techniques:Ingress Tool Transfer
T1105, System Binary Proxy Execution T1218, PowerShell T1059.001, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Hidden Window T1564.003Sample rules (showing 8 of 31):
- sigma File Download Via Bitsadmin
- sigma File Download with Headless Browser
- sigma File Download From Browser Process Via Inline URL
- sigma File Download via CertOC.EXE
- sigma Suspicious CertReq Command to Download
- sigma Suspicious Download Via Certutil.EXE
- sigma Curl Download And Execute Combination
- sigma Command Line Execution with Suspicious URL and AppData Strings
match: rundll32 19 rules
Top techniques:Windows Management Instrumentation
T1047, Windows Service T1543.003, Malicious File T1204.002, Regsvr32 T1218.010, Compromise Software Supply Chain T1195.002, Adversary-in-the-Middle T1557Sample rules (showing 8 of 19):
- sigma Suspicious Child Process of Notepad++ Updater - GUP.Exe
- sigma Potential Meterpreter/CobaltStrike Activity
- sigma Suspicious Child Process Of Veeam Dabatase
- sigma Suspicious Advpack Call Via Rundll32.EXE
- sigma Potential Obfuscated Ordinal Call Via Rundll32
- sigma Process Memory Dump Via Comsvcs.DLL
- sigma ShimCache Flush
- sigma Rundll32 UNC Path Execution
match: \Users\Public\ 17 rules
Top techniques:System Binary Proxy Execution
T1218, Ingress Tool Transfer T1105, Windows Management Instrumentation T1047, Rundll32 T1218.011, Trusted Developer Utilities Proxy Execution T1127, Hidden Files and Directories T1564.001Sample rules (showing 8 of 17):
- sigma Suspicious AddinUtil.EXE CommandLine Execution
- sigma Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
- sigma Set Suspicious Files as System Files Using Attrib.EXE
- sigma Suspicious DLL Loaded via CertOC.EXE
- sigma File In Suspicious Location Encoded To Base64 Via Certutil.EXE
- sigma Cmd Launched with Hidden Start Flags to Suspicious Targets
- sigma Suspicious Curl.EXE Download
- sigma Diskshadow Script Mode - Execution From Potential Suspicious Location
match: \AppData\Local\Temp\ 16 rules
Top techniques:System Binary Proxy Execution
T1218, Visual Basic T1059.005, JavaScript T1059.007, Regsvr32 T1218.010, Trusted Developer Utilities Proxy Execution T1127, Compile After Delivery T1027.004Sample rules (showing 8 of 16):
- sigma Suspicious AddinUtil.EXE CommandLine Execution
- sigma Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
- sigma Dynamic .NET Compilation Via Csc.EXE
- sigma Potentially Suspicious Cabinet File Expansion
- sigma File Encryption/Decryption Via Gpg4win From Suspicious Locations
- sigma Suspicious HH.EXE Execution
- sigma Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
- sigma Suspicious Mstsc.EXE Execution With Local RDP File
match: add 16 rules
Top techniques:Disable or Modify Tools
T1562.001, Modify Registry T1112, Local Account T1136.001, Indicator Blocking T1562.006, Control Panel T1218.002, Event Triggered Execution T1546Sample rules (showing 8 of 16):
- sigma Windows AMSI Related Registry Tampering Via CommandLine
- sigma Control Panel Items
- sigma New User Created Via Net.EXE
- sigma New User Created Via Net.EXE With Never Expire Option
- sigma Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
- sigma Potential Persistence Via Netsh Helper DLL
- sigma New Port Forwarding Rule Added Via Netsh.EXE
- sigma Suspicious PowerShell Invocations - Specific - ProcessCreation
match: powershell 16 rules
Top techniques:Scheduled Task
T1053.005, Windows Command Shell T1059.003, PowerShell T1059.001, Windows Service T1543.003, Windows Management Instrumentation T1047, SSH T1021.004Sample rules (showing 8 of 16):
- sigma OpenEDR Spawning Command Shell
- sigma Powershell Executed From Headless ConHost Process
- sigma Suspicious PowerShell Invocations - Specific - ProcessCreation
- sigma Suspicious Service Path Modification
- sigma Suspicious Modification Of Scheduled Tasks
- sigma Scheduled Task Creation with Curl and PowerShell Execution Combo
- sigma Schtasks From Suspicious Folders
- sigma Uncommon One Time Only Scheduled Task At 00:00
match: .dll 15 rules
Top techniques:Odbcconf
T1218.008, Ingress Tool Transfer T1105, Rundll32 T1218.011, Hidden Files and Directories T1564.001, Rename Legitimate Utilities T1036.003, BITS Jobs T1197Sample rules (showing 8 of 15):
- sigma Set Suspicious Files as System Files Using Attrib.EXE
- sigma File With Suspicious Extension Downloaded Via Bitsadmin
- sigma HackTool - F-Secure C3 Load by Rundll32
- sigma CobaltStrike Load by Rundll32
- sigma MSHTA Execution with Suspicious File Extensions
- sigma DllUnregisterServer Function Call Via Msiexec.EXE
- sigma Driver/DLL Installation Via Odbcconf.EXE
- sigma Suspicious Driver/DLL Installation Via Odbcconf.EXE
match: :\Windows\Temp\ 15 rules
Top techniques:System Binary Proxy Execution
T1218, Trusted Developer Utilities Proxy Execution T1127, Hidden Window T1564.003, Remote Desktop Software T1219.002, Disable or Modify System Firewall T1562.004, Odbcconf T1218.008Sample rules (showing 8 of 15):
- sigma Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
- sigma Cmd Launched with Hidden Start Flags to Suspicious Targets
- sigma Diskshadow Script Mode - Execution From Potential Suspicious Location
- sigma Potentially Suspicious Cabinet File Expansion
- sigma File Encryption/Decryption Via Gpg4win From Suspicious Locations
- sigma Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
- sigma Suspicious Mstsc.EXE Execution With Local RDP File
- sigma Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
match: http:// 15 rules
Top techniques:System Binary Proxy Execution
T1218, Ingress Tool Transfer T1105, Exfiltration Over Web Service T1567, Compiled HTML File T1218.001, Mshta T1218.005, Indirect Command Execution T1202Sample rules (showing 8 of 15):
- sigma Arbitrary File Download Via ConfigSecurityPolicy.EXE
- sigma Arbitrary File Download Via GfxDownloadWrapper.EXE
- sigma Remote CHM File Download/Execution Via HH.EXE
- sigma File Download And Execution Via IEExec.EXE
- sigma Arbitrary File Download Via IMEWDBLD.EXE
- sigma File Download Via InstallUtil.EXE
- sigma Arbitrary File Download Via MSEDGE_PROXY.EXE
- sigma Remotely Hosted HTA File Executed Via Mshta.EXE
match: /create 14 rules
Top techniques:Scheduled Task
T1053.005, Rename Legitimate Utilities T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, System Binary Proxy Execution T1218, Masquerade Task or Service T1036.004Sample rules (showing 8 of 14):
- sigma File Download Via Bitsadmin
- sigma Suspicious Download From Direct IP Via Bitsadmin
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma File With Suspicious Extension Downloaded Via Bitsadmin
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Renamed Schtasks Execution
- sigma Scheduled Task Creation Via Schtasks.EXE
- sigma Suspicious Scheduled Task Creation Involving Temp Folder
match: :\Temp\ 14 rules
Top techniques:System Binary Proxy Execution
T1218, Regsvr32 T1218.010, Trusted Developer Utilities Proxy Execution T1127, Rename Legitimate Utilities T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197Sample rules (showing 8 of 14):
- sigma Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Cmd Launched with Hidden Start Flags to Suspicious Targets
- sigma Diskshadow Script Mode - Execution From Potential Suspicious Location
- sigma File Encryption/Decryption Via Gpg4win From Suspicious Locations
- sigma Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
- sigma Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
- sigma Odbcconf.EXE Suspicious DLL Location
match: :\Users\Public\ 14 rules
Top techniques:Rename Legitimate Utilities
T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, Compile After Delivery T1027.004, System Binary Proxy Execution T1218, Remote Desktop Software T1219.002Sample rules (showing 8 of 14):
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Dynamic .NET Compilation Via Csc.EXE
- sigma Potentially Suspicious Cabinet File Expansion
- sigma File Encryption/Decryption Via Gpg4win From Suspicious Locations
- sigma Suspicious Mstsc.EXE Execution With Local RDP File
- sigma Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
- sigma Odbcconf.EXE Suspicious DLL Location
- sigma Root Certificate Installed From Susp Locations
match: https:// 14 rules
Top techniques:System Binary Proxy Execution
T1218, Ingress Tool Transfer T1105, Exfiltration Over Web Service T1567, Compiled HTML File T1218.001, Mshta T1218.005, Indirect Command Execution T1202Sample rules (showing 8 of 14):
- sigma Arbitrary File Download Via ConfigSecurityPolicy.EXE
- sigma Arbitrary File Download Via GfxDownloadWrapper.EXE
- sigma Remote CHM File Download/Execution Via HH.EXE
- sigma File Download And Execution Via IEExec.EXE
- sigma Arbitrary File Download Via IMEWDBLD.EXE
- sigma File Download Via InstallUtil.EXE
- sigma Arbitrary File Download Via MSEDGE_PROXY.EXE
- sigma Remotely Hosted HTA File Executed Via Mshta.EXE
match: \Downloads\ 12 rules
Top techniques:System Binary Proxy Execution
T1218, Windows Service T1543.003, Hidden Files and Directories T1564.001, Hidden Window T1564.003, Windows Management Instrumentation T1047, PowerShell T1059.001Sample rules (showing 8 of 12):
- sigma Suspicious AddinUtil.EXE CommandLine Execution
- sigma Set Suspicious Files as System Files Using Attrib.EXE
- sigma Suspicious DLL Loaded via CertOC.EXE
- sigma Cmd Launched with Hidden Start Flags to Suspicious Targets
- sigma Suspicious HH.EXE Execution
- sigma Suspicious Mstsc.EXE Execution With Local RDP File
- sigma Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
- sigma Root Certificate Installed From Susp Locations
match: cscript 12 rules
Top techniques:Scheduled Task
T1053.005, Windows Management Instrumentation T1047, Windows Service T1543.003, Malicious File T1204.002, Regsvr32 T1218.010, Command and Scripting Interpreter T1059Sample rules (showing 8 of 12):
- sigma Suspicious Child Process Of Veeam Dabatase
- sigma Suspicious Service Path Modification
- sigma Suspicious Modification Of Scheduled Tasks
- sigma Uncommon One Time Only Scheduled Task At 00:00
- sigma Suspicious Command Patterns In Scheduled Task Creation
- sigma Potentially Suspicious Execution From Parent Process In Public Folder
- sigma Suspicious FileFix Execution Pattern
- sigma Suspicious New Service Creation
match: wscript 12 rules
Top techniques:Scheduled Task
T1053.005, Windows Management Instrumentation T1047, Windows Service T1543.003, Malicious File T1204.002, Regsvr32 T1218.010, Command and Scripting Interpreter T1059Sample rules (showing 8 of 12):
- sigma Suspicious Child Process Of Veeam Dabatase
- sigma Suspicious Service Path Modification
- sigma Suspicious Modification Of Scheduled Tasks
- sigma Uncommon One Time Only Scheduled Task At 00:00
- sigma Suspicious Command Patterns In Scheduled Task Creation
- sigma Potentially Suspicious Execution From Parent Process In Public Folder
- sigma Suspicious FileFix Execution Pattern
- sigma Suspicious New Service Creation
match: -c 11 rules
Top techniques:System Binary Proxy Execution
T1218, Modify Registry T1112, LSASS Memory T1003.001, Indirect Command Execution T1202, Native API T1106, Trusted Developer Utilities Proxy Execution T1127Sample rules (showing 8 of 11):
- sigma Potential Adplus.EXE Abuse
- sigma Indirect Inline Command Execution Via Bash.EXE
- sigma Potential Binary Proxy Execution Via Cdb.EXE
- sigma Curl Download And Execute Combination
- sigma New Capture Session Launched Via DXCap.EXE
- sigma Forfiles Command Execution
- sigma File Encryption Using Gpg4win
- sigma HackTool - SOAPHound Execution
match: add 11 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001, Modify Registry T1112, Disable or Modify Tools T1562.001, Windows Management Instrumentation T1047, Disable Windows Event Logging T1562.002, Exploitation for Privilege Escalation T1068Sample rules (showing 8 of 11):
- sigma Suspicious Autorun Registry Modified via WMI
- sigma Security Event Logging Disabled via MiniNt Registry Key - Process
- sigma HKTL - SharpSuccessor Privilege Escalation Tool Execution
- sigma LSA PPL Protection Setting Modification via CommandLine
- sigma New Firewall Rule Added Via Netsh.EXE
- sigma Potential Persistence Attempt Via Run Keys Using Reg.EXE
- sigma Add SafeBoot Keys Via Reg Utility
- sigma Potential Tampering With RDP Related Registry Keys Via Reg.EXE
match: \Desktop\ 11 rules
Top techniques:Ingress Tool Transfer
T1105, System Binary Proxy Execution T1218, Windows Service T1543.003, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules (showing 8 of 11):
- sigma Suspicious AddinUtil.EXE CommandLine Execution
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Suspicious DLL Loaded via CertOC.EXE
- sigma File In Suspicious Location Encoded To Base64 Via Certutil.EXE
- sigma Suspicious Curl.EXE Download
- sigma Root Certificate Installed From Susp Locations
- sigma Suspicious Invoke-WebRequest Execution
- sigma Suspicious Usage Of ShellExec_RunDLL
match: copy 11 rules
Top techniques:Rename Legitimate Utilities
T1036.003, File Deletion T1070.004, Inhibit System Recovery T1490, Accessibility Features T1546.008, Credentials from Web Browsers T1555.003, SMB/Windows Admin Shares T1021.002Sample rules (showing 8 of 11):
- sigma Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE
- sigma Potentially Suspicious Ping/Copy Command Combination
- sigma Copy From VolumeShadowCopy Via Cmd.EXE
- sigma Persistence Via Sticky Key Backdoor
- sigma Suspicious Child Process Of Veeam Dabatase
- sigma Potential Browser Data Stealing
- sigma Copy From Or To Admin Share Or Sysvol Folder
- sigma Suspicious Copy From or To System Directory
match: mshta 11 rules
Top techniques:Windows Management Instrumentation
T1047, Windows Service T1543.003, Malicious File T1204.002, Regsvr32 T1218.010, Obfuscated Files or Information T1027, PowerShell T1059.001Sample rules (showing 8 of 11):
- sigma Invoke-Obfuscation Via Use MSHTA
- sigma Suspicious Child Process Of Veeam Dabatase
- sigma Suspicious Service Path Modification
- sigma Suspicious Modification Of Scheduled Tasks
- sigma Potentially Suspicious Execution From Parent Process In Public Folder
- sigma Suspicious FileFix Execution Pattern
- sigma Suspicious New Service Creation
- sigma Suspicious WMIC Execution Via Office Process
match: regsvr32 11 rules
Top techniques:Windows Management Instrumentation
T1047, Malicious File T1204.002, Regsvr32 T1218.010, Compromise Software Supply Chain T1195.002, Adversary-in-the-Middle T1557, Scheduled Task T1053.005Sample rules (showing 8 of 11):
- sigma Suspicious Child Process of Notepad++ Updater - GUP.Exe
- sigma Suspicious Child Process Of Veeam Dabatase
- sigma Suspicious Usage Of ShellExec_RunDLL
- sigma Suspicious Modification Of Scheduled Tasks
- sigma Potentially Suspicious Execution From Parent Process In Public Folder
- sigma Suspicious FileFix Execution Pattern
- sigma Potentially Suspicious Child Process Of VsCode
- sigma Suspicious WMIC Execution Via Office Process
match: \AppData\Roaming\ 10 rules
Top techniques:System Binary Proxy Execution
T1218, Scheduled Task T1053.005, Rename Legitimate Utilities T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules (showing 8 of 10):
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma File In Suspicious Location Encoded To Base64 Via Certutil.EXE
- sigma Cmd Launched with Hidden Start Flags to Suspicious Targets
- sigma Diskshadow Script Mode - Execution From Potential Suspicious Location
- sigma Potentially Suspicious Cabinet File Expansion
- sigma File Encryption/Decryption Via Gpg4win From Suspicious Locations
- sigma Odbcconf.EXE Suspicious DLL Location
- sigma Regsvr32 Execution From Potential Suspicious Location
match: \Windows\Temp\ 10 rules
Top techniques:System Binary Proxy Execution
T1218, Windows Management Instrumentation T1047, Hidden Files and Directories T1564.001, Obfuscated Files or Information T1027, Compile After Delivery T1027.004, PowerShell T1059.001Sample rules (showing 8 of 10):
- sigma Suspicious AddinUtil.EXE CommandLine Execution
- sigma Set Suspicious Files as System Files Using Attrib.EXE
- sigma File In Suspicious Location Encoded To Base64 Via Certutil.EXE
- sigma Dynamic .NET Compilation Via Csc.EXE
- sigma Suspicious HH.EXE Execution
- sigma HackTool - CrackMapExec Process Patterns
- sigma Potential Script Proxy Execution Via CL_Mutexverifiers.ps1
- sigma Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
ends_with: .dll 9 rules
Sample rules (showing 8 of 9):
- sigma File Download From Browser Process Via Inline URL
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Suspicious Curl.EXE Download
- sigma Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
- sigma Rundll32 Execution With Uncommon DLL Extension
- sigma Suspicious File Download From IP Via Wget.EXE
match: %tmp% 9 rules
Top techniques:Ingress Tool Transfer
T1105, Windows Management Instrumentation T1047, Registry Run Keys / Startup Folder T1547.001, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, System Binary Proxy Execution T1218Sample rules (showing 8 of 9):
- sigma Suspicious Autorun Registry Modified via WMI
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Suspicious Curl.EXE Download
- sigma Potential Suspicious Mofcomp Execution
- sigma Suspicious Invoke-WebRequest Execution
- sigma Potential Suspicious Registry File Imported Via Reg.EXE
- sigma Shell32 DLL Execution in Suspicious Directory
- sigma Suspicious Command Patterns In Scheduled Task Creation
match: add 9 rules
Top techniques:Disable or Modify Tools
T1562.001, Command and Scripting Interpreter T1059, Services Registry Permissions Weakness T1574.011, Disable or Modify System Firewall T1562.004, Windows Service T1543.003Sample rules (showing 8 of 9):
- sigma Windows Credential Guard Registry Tampering Via CommandLine
- sigma Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine
- sigma RDP Connection Allowed Via Netsh.EXE
- sigma Changing Existing Service ImagePath Value Via Reg.EXE
- sigma Potential Persistence Attempt Via Existing Service Tampering
- sigma Vulnerable Driver Blocklist Registry Tampering Via CommandLine
- sigma Add New Download Source To Winget
- sigma Add Insecure Download Source To Winget
match: \\\\ 8 rules
Top techniques:Ingress Tool Transfer
T1105, SMB/Windows Admin Shares T1021.002, System Binary Proxy Execution T1218, Regsvr32 T1218.010, Rundll32 T1218.011, Malware T1587.001Sample rules:
- sigma Potential NTLM Coercion Via Certutil.EXE
- sigma Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE
- sigma Suspicious Diantz Download and Compress Into a CAB File
- sigma Suspicious Extrac32 Execution
- sigma Windows Share Mount Via Net.EXE
- sigma Suspicious Regsvr32 Execution From Remote Share
- sigma Rundll32 UNC Path Execution
- sigma Potential PsExec Remote Execution
match: .bat 8 rules
Top techniques:Hidden Files and Directories
T1564.001, Rename Legitimate Utilities T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, Obfuscated Files or Information T1027, Hidden Window T1564.003Sample rules:
- sigma Set Suspicious Files as System Files Using Attrib.EXE
- sigma File With Suspicious Extension Downloaded Via Bitsadmin
- sigma Suspicious File Encoded To Base64 Via Certutil.EXE
- sigma Cmd Launched with Hidden Start Flags to Suspicious Targets
- sigma MSHTA Execution with Suspicious File Extensions
- sigma Suspicious Microsoft OneNote Child Process
- sigma Potential Persistence Attempt Via Existing Service Tampering
- sigma Writing Of Malicious Files To The Fonts Folder
match: \AppData\ 8 rules
Top techniques:Ingress Tool Transfer
T1105, Scheduled Task T1053.005, PowerShell T1059.001, Rundll32 T1218.011, Domain Groups T1069.002, Domain Account T1087.002Sample rules:
- sigma Suspicious Curl.EXE Download
- sigma Suspicious Invoke-WebRequest Execution
- sigma PowerShell Script Run in AppData
- sigma Shell32 DLL Execution in Suspicious Directory
- sigma Uncommon One Time Only Scheduled Task At 00:00
- sigma Suspicious Command Patterns In Scheduled Task Creation
- sigma Suspicious Active Directory Database Snapshot Via ADExplorer
- sigma Sysprep on AppData Folder
match: \AppData\Local\ 8 rules
Top techniques:System Binary Proxy Execution
T1218, Scheduled Task T1053.005, Hidden Files and Directories T1564.001, Rename Legitimate Utilities T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197Sample rules:
- sigma Set Suspicious Files as System Files Using Attrib.EXE
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Potentially Suspicious CMD Shell Output Redirect
- sigma Diskshadow Script Mode - Execution From Potential Suspicious Location
- sigma Suspicious Mshta.EXE Execution Patterns
- sigma Suspicious Schtasks Execution AppData Folder
- sigma Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
- sigma Suspicious Process Created Via Wmic.EXE
match: \AppData\Local\Temp 8 rules
Top techniques:Command and Scripting Interpreter
T1059, Windows Service T1543.003, Windows Management Instrumentation T1047, Registry Run Keys / Startup Folder T1547.001, System Binary Proxy Execution T1218, Scheduled Task T1053.005Sample rules:
- sigma Suspicious Autorun Registry Modified via WMI
- sigma Potential Suspicious Mofcomp Execution
- sigma Suspicious Service Path Modification
- sigma Suspicious Modification Of Scheduled Tasks
- sigma Script Interpreter Execution From Suspicious Folder
- sigma Suspicious Script Execution From Temp Folder
- sigma Suspicious New Service Creation
- sigma Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
match: config 8 rules
Top techniques:Disable or Modify Tools
T1562.001, Windows Service T1543.003, Disable Windows Event Logging T1562.002, Exfiltration to Cloud Storage T1567.002, Services Registry Permissions Weakness T1574.011, Service Stop T1489Sample rules:
- sigma Disable Windows IIS HTTP Logging
- sigma Suspicious IIS URL GlobalRules Rewrite Via AppCmd
- sigma Disable Windows Defender AV Security Monitoring
- sigma PUA - Rclone Execution
- sigma Possible Privilege Escalation via Weak Service Permissions
- sigma New Kernel Driver Via SC.EXE
- sigma Suspicious Service Path Modification
- sigma Suspicious Windows Service Tampering
match: create 8 rules
Top techniques:Windows Service
T1543.003, Windows Management Instrumentation T1047, OS Credential Dumping T1003, Security Account Manager T1003.002, NTDS T1003.003, Malicious File T1204.002Sample rules:
- sigma New Service Creation Using Sc.EXE
- sigma New Kernel Driver Via SC.EXE
- sigma Suspicious New Service Creation
- sigma Shadow Copies Creation Using Operating Systems Utilities
- sigma New Virtual Smart Card Created Via TpmVscMgr.EXE
- sigma New Process Created Via Wmic.EXE
- sigma Process Reconnaissance Via Wmic.EXE
- sigma Suspicious WMIC Execution Via Office Process
match: curl 8 rules
Top techniques:Ingress Tool Transfer
T1105, System Binary Proxy Execution T1218, PowerShell T1059.001, Scheduled Task T1053.005, Stage Capabilities T1608Sample rules:
- sigma Curl Download And Execute Combination
- sigma Suspicious Invoke-WebRequest Execution With DirectIP
- sigma Suspicious Invoke-WebRequest Execution
- sigma Scheduled Task Creation with Curl and PowerShell Execution Combo
- sigma Potential Data Exfiltration Activity Via CommandLine Tools
- sigma Suspicious Download from Office Domain
- sigma Obfuscated IP Download Activity
- sigma Usage Of Web Request Commands And Cmdlets
match: iwr 8 rules
Top techniques:Ingress Tool Transfer
T1105, PowerShell T1059.001, Command and Scripting Interpreter T1059, Stage Capabilities T1608Sample rules:
- sigma PowerShell Download and Execution Cradles
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious Invoke-WebRequest Execution With DirectIP
- sigma Suspicious Invoke-WebRequest Execution
- sigma Potential Data Exfiltration Activity Via CommandLine Tools
- sigma Suspicious Download from Office Domain
- sigma Obfuscated IP Download Activity
- sigma Usage Of Web Request Commands And Cmdlets
ends_with: .dat 7 rules
Sample rules:
- sigma File Download From Browser Process Via Inline URL
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Regsvr32 DLL Execution With Suspicious File Extension
- sigma Suspicious File Download From IP Via Wget.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
ends_with: .vbe 7 rules
Top techniques:Ingress Tool Transfer
T1105Sample rules:
- sigma File Download From Browser Process Via Inline URL
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Suspicious Curl.EXE Download
- sigma Suspicious File Download From IP Via Wget.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
ends_with: .vbs 7 rules
Top techniques:Ingress Tool Transfer
T1105Sample rules:
- sigma File Download From Browser Process Via Inline URL
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Suspicious Curl.EXE Download
- sigma Suspicious File Download From IP Via Wget.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: %AppData% 7 rules
Top techniques:Ingress Tool Transfer
T1105, Scheduled Task T1053.005, Windows Management Instrumentation T1047, Registry Run Keys / Startup Folder T1547.001, PowerShell T1059.001, Windows Command Shell T1059.003Sample rules:
- sigma Suspicious Autorun Registry Modified via WMI
- sigma Command Line Execution with Suspicious URL and AppData Strings
- sigma Suspicious Curl.EXE Download
- sigma Suspicious Invoke-WebRequest Execution
- sigma Shell32 DLL Execution in Suspicious Directory
- sigma Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
- sigma Suspicious Command Patterns In Scheduled Task Creation
match: .jpg 7 rules
Top techniques:Ingress Tool Transfer
T1105, JavaScript T1059.007, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027, Deobfuscate/Decode Files or Information T1140Sample rules:
- sigma File With Suspicious Extension Downloaded Via Bitsadmin
- sigma Suspicious File Encoded To Base64 Via Certutil.EXE
- sigma Suspicious Desktopimgdownldr Command
- sigma MSHTA Execution with Suspicious File Extensions
- sigma Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
- sigma Suspicious Rundll32 Execution With Image Extension
- sigma Cscript/Wscript Uncommon Script Extension Execution
match: .png 7 rules
Top techniques:Ingress Tool Transfer
T1105, JavaScript T1059.007, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027, Deobfuscate/Decode Files or Information T1140Sample rules:
- sigma File With Suspicious Extension Downloaded Via Bitsadmin
- sigma Suspicious File Encoded To Base64 Via Certutil.EXE
- sigma Suspicious Desktopimgdownldr Command
- sigma MSHTA Execution with Suspicious File Extensions
- sigma Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
- sigma Suspicious Rundll32 Execution With Image Extension
- sigma Cscript/Wscript Uncommon Script Extension Execution
match: .txt 7 rules
Top techniques:JavaScript
T1059.007, Rename Legitimate Utilities T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, System Binary Proxy Execution T1218, LSASS Memory T1003.001Sample rules:
- sigma File With Suspicious Extension Downloaded Via Bitsadmin
- sigma Diskshadow Script Mode - Uncommon Script Extension Execution
- sigma Suspicious DumpMinitool Execution
- sigma MSHTA Execution with Suspicious File Extensions
- sigma Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
- sigma Automated Collection Command Prompt
- sigma Cscript/Wscript Uncommon Script Extension Execution
match: /c 7 rules
Top techniques:Windows Command Shell
T1059.003, Obfuscated Files or Information T1027, PowerShell T1059.001, Distributed Component Object Model T1021.003, Windows Management Instrumentation T1047, Visual Basic T1059.005Sample rules:
- sigma Potential CommandLine Path Traversal Via Cmd.EXE
- sigma HackTool - Potential Impacket Lateral Movement Activity
- sigma Invoke-Obfuscation CLIP+ Launcher
- sigma Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
- sigma HackTool - Koadic Execution
- sigma Potential Meterpreter/CobaltStrike Activity
- sigma OpenWith.exe Executes Specified Binary
match: FromBase64String 7 rules
Top techniques:Scheduled Task
T1053.005, PowerShell T1059.001, Standard Encoding T1132.001, Rundll32 T1218.011, Remote System Discovery T1018, System Owner/User Discovery T1033Sample rules:
- sigma Potentially Suspicious Execution Of PDQDeployRunner
- sigma Suspicious FromBase64String Usage On Gzip Archive - Process Creation
- sigma Scheduled Task Executing Payload from Registry
- sigma Scheduled Task Executing Encoded Payload from Registry
- sigma Suspicious Command Patterns In Scheduled Task Creation
- sigma Potential PowerShell Execution Via DLL
- sigma Webshell Hacking Activity Patterns
match: \Temp\ 7 rules
Top techniques:Ingress Tool Transfer
T1105, Scheduled Task T1053.005, Rundll32 T1218.011, Rename Legitimate Utilities T1036.003Sample rules:
- sigma Suspicious Curl.EXE Download
- sigma Suspicious Invoke-WebRequest Execution
- sigma Shell32 DLL Execution in Suspicious Directory
- sigma Suspicious Usage Of ShellExec_RunDLL
- sigma Suspicious Scheduled Task Creation Involving Temp Folder
- sigma Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
- sigma Suspicious Copy From or To System Directory
match: \\\\ 7 rules
Top techniques:Ingress Tool Transfer
T1105, System Binary Proxy Execution T1218, Windows Management Instrumentation T1047, Visual Basic T1059.005, JavaScript T1059.007, XSL Script Processing T1220Sample rules:
- sigma Remote File Download Via Findstr.EXE
- sigma Remote CHM File Download/Execution Via HH.EXE
- sigma Suspicious Msiexec Quiet Install From Remote Location
- sigma Share And Session Enumeration Using Net.EXE
- sigma PowerShell MSI Install via WindowsInstaller COM From Remote Location
- sigma Potential Remote SquiblyTwo Technique Execution
- sigma XSL Script Execution Via WMIC.EXE
match: call 7 rules
Top techniques:Windows Management Instrumentation
T1047, Query Registry T1012, Modify Registry T1112, Malicious File T1204.002, Regsvr32 T1218.010, Disable or Modify Tools T1562.001Sample rules:
- sigma New Process Created Via Wmic.EXE
- sigma Process Reconnaissance Via Wmic.EXE
- sigma Registry Manipulation via WMI Stdregprov
- sigma Suspicious WMIC Execution Via Office Process
- sigma Application Terminated Via Wmic.EXE
- sigma Application Removed Via Wmic.EXE
- sigma Potential Tampering With Security Products Via WMIC
match: delete 7 rules
Top techniques:Disable or Modify Tools
T1562.001, Indicator Removal T1070, Inhibit System Recovery T1490, Bootkit T1542.003, Screen Capture T1113Sample rules:
- sigma Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE
- sigma Disable Windows Defender AV Security Monitoring
- sigma Windows Recall Feature Enabled Via Reg.EXE
- sigma Raccine Uninstall
- sigma Shadow Copies Deletion Using Operating Systems Utilities
- sigma All Backups Deleted Via Wbadmin.EXE
- sigma Potential Tampering With Security Products Via WMIC
match: ftp:// 7 rules
Top techniques:System Binary Proxy Execution
T1218, Exfiltration Over Web Service T1567, Mshta T1218.005Sample rules:
- sigma Arbitrary File Download Via ConfigSecurityPolicy.EXE
- sigma File Download Via InstallUtil.EXE
- sigma Remotely Hosted HTA File Executed Via Mshta.EXE
- sigma Arbitrary File Download Via MSOHTMED.EXE
- sigma Arbitrary File Download Via MSPUB.EXE
- sigma Arbitrary File Download Via PresentationHost.EXE
- sigma File Download Using ProtocolHandler.exe
match: set 7 rules
Top techniques:Disable or Modify System Firewall
T1562.004, Inhibit System Recovery T1490, Command and Scripting Interpreter T1059, Windows File and Directory Permissions Modification T1222.001, Obfuscated Files or Information T1027, PowerShell T1059.001Sample rules:
- sigma Boot Configuration Tampering Via Bcdedit.EXE
- sigma Potentially Suspicious NTFS Symlink Behavior Modification
- sigma Invoke-Obfuscation Via Use MSHTA
- sigma Disable Windows IIS HTTP Logging
- sigma Suspicious IIS URL GlobalRules Rewrite Via AppCmd
- sigma Firewall Disabled via Netsh.EXE
- sigma Netsh Allow Group Policy on Microsoft Defender Firewall
match: wget 7 rules
Sample rules:
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious Invoke-WebRequest Execution With DirectIP
- sigma Suspicious Invoke-WebRequest Execution
- sigma Potential Data Exfiltration Activity Via CommandLine Tools
- sigma Suspicious Download from Office Domain
- sigma Obfuscated IP Download Activity
- sigma Usage Of Web Request Commands And Cmdlets
ends_with: .dll" 6 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
- sigma Suspicious File Download From IP Via Wget.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
ends_with: .dll' 6 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
- sigma Suspicious File Download From IP Via Wget.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
ends_with: .exe 6 rules
Top techniques:Ingress Tool Transfer
T1105Sample rules:
- sigma File Download From Browser Process Via Inline URL
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Suspicious File Download From IP Via Wget.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
ends_with: .hta 6 rules
Top techniques:Ingress Tool Transfer
T1105Sample rules:
- sigma File Download From Browser Process Via Inline URL
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Suspicious File Download From IP Via Wget.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
ends_with: .ps1 6 rules
Top techniques:Ingress Tool Transfer
T1105Sample rules:
- sigma File Download From Browser Process Via Inline URL
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Suspicious File Download From IP Via Wget.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
ends_with: .psm1 6 rules
Top techniques:Ingress Tool Transfer
T1105Sample rules:
- sigma File Download From Browser Process Via Inline URL
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Suspicious File Download From IP Via Wget.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: -d 6 rules
match: -enc 6 rules
Top techniques:PowerShell
T1059.001, Obfuscated Files or Information T1027, Scheduled Task T1053.005, Remote System Discovery T1018, System Owner/User Discovery T1033, Account Discovery T1087Sample rules:
- sigma Potentially Suspicious Execution Of PDQDeployRunner
- sigma Suspicious PowerShell Encoded Command Patterns
- sigma Potential PowerShell Obfuscation Via Reversed Commands
- sigma Suspicious Execution of Powershell with Base64
- sigma Suspicious Command Patterns In Scheduled Task Creation
- sigma Webshell Detection With Command Line Keywords
match: use 6 rules
match: -i 6 rules
Top techniques:Msiexec
T1218.007, Ingress Tool Transfer T1105, System Binary Proxy Execution T1218, Boot or Logon Autostart Execution T1547, Scheduled Task T1053.005, Network Sniffing T1040Sample rules:
- sigma Import LDAP Data Interchange Format File Via Ldifde.EXE
- sigma Suspicious Driver Install by pnputil.exe
- sigma Msiexec Quiet Installation
- sigma Suspicious Msiexec Quiet Install From Remote Location
- sigma Potential SSH Tunnel Persistence Install Using A Scheduled Task
- sigma Potential Network Sniffing Activity Using Network Tools
match: .dmp 6 rules
match: .gif 6 rules
Top techniques:JavaScript
T1059.007, Rename Legitimate Utilities T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, Obfuscated Files or Information T1027, Deobfuscate/Decode Files or Information T1140Sample rules:
- sigma File With Suspicious Extension Downloaded Via Bitsadmin
- sigma Suspicious File Encoded To Base64 Via Certutil.EXE
- sigma MSHTA Execution with Suspicious File Extensions
- sigma Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
- sigma Suspicious Rundll32 Execution With Image Extension
- sigma Cscript/Wscript Uncommon Script Extension Execution
match: .jpeg 6 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027, Regsvcs/Regasm T1218.009, Rundll32 T1218.011Sample rules:
- sigma File With Suspicious Extension Downloaded Via Bitsadmin
- sigma Suspicious File Encoded To Base64 Via Certutil.EXE
- sigma Suspicious Desktopimgdownldr Command
- sigma Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
- sigma Suspicious Rundll32 Execution With Image Extension
- sigma Cscript/Wscript Uncommon Script Extension Execution
match: .js 6 rules
Top techniques:JavaScript
T1059.007, Hidden Window T1564.003, Phishing T1566, Spearphishing Attachment T1566.001, Windows Service T1543.003, Services Registry Permissions Weakness T1574.011Sample rules:
- sigma Cmd Launched with Hidden Start Flags to Suspicious Targets
- sigma Suspicious Microsoft OneNote Child Process
- sigma Potential Persistence Attempt Via Existing Service Tampering
- sigma NodeJS Execution of JavaScript File
- sigma Writing Of Malicious Files To The Fonts Folder
- sigma Potential Dropper Script Execution Via WScript/CScript
match: :\PerfLogs\ 6 rules
Sample rules:
- sigma File Encryption/Decryption Via Gpg4win From Suspicious Locations
- sigma Odbcconf.EXE Suspicious DLL Location
- sigma Regsvr32 Execution From Highly Suspicious Location
- sigma Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
- sigma Suspicious File Download From IP Via Wget.EXE - Paths
- sigma Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths
match: :\Users\ 6 rules
Top techniques:System Binary Proxy Execution
T1218, Windows Management Instrumentation T1047, Registry Run Keys / Startup Folder T1547.001, Compile After Delivery T1027.004, Command and Scripting Interpreter T1059Sample rules:
- sigma Suspicious Autorun Registry Modified via WMI
- sigma Dynamic .NET Compilation Via Csc.EXE
- sigma Potentially Suspicious Cabinet File Expansion
- sigma Process Proxy Execution Via Squirrel.EXE
- sigma Script Interpreter Execution From Suspicious Folder
- sigma Suspicious File Download From IP Via Wget.EXE - Paths
match: :\Windows\Tasks\ 6 rules
Top techniques:Trusted Developer Utilities Proxy Execution
T1127, System Binary Proxy Execution T1218, Remote Desktop Software T1219.002, Disable or Modify System Firewall T1562.004, Odbcconf T1218.008, Command and Scripting Interpreter T1059Sample rules:
- sigma Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
- sigma Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
- sigma Suspicious Mstsc.EXE Execution With Local RDP File
- sigma Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
- sigma Odbcconf.EXE Suspicious DLL Location
- sigma Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
match: C:\ProgramData\ 6 rules
match: Invoke-WebRequest 6 rules
Sample rules:
match: \Contacts\ 6 rules
Top techniques:Rename Legitimate Utilities
T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, Hidden Window T1564.003, Compile After Delivery T1027.004, System Binary Proxy Execution T1218Sample rules:
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Cmd Launched with Hidden Start Flags to Suspicious Targets
- sigma Dynamic .NET Compilation Via Csc.EXE
- sigma Potentially Suspicious Cabinet File Expansion
- sigma Script Interpreter Execution From Suspicious Folder
- sigma Suspicious File Download From IP Via Wget.EXE - Paths
match: \Favorites\ 6 rules
Top techniques:Rename Legitimate Utilities
T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, Hidden Window T1564.003, Compile After Delivery T1027.004, System Binary Proxy Execution T1218Sample rules:
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Cmd Launched with Hidden Start Flags to Suspicious Targets
- sigma Dynamic .NET Compilation Via Csc.EXE
- sigma Potentially Suspicious Cabinet File Expansion
- sigma Script Interpreter Execution From Suspicious Folder
- sigma Suspicious File Download From IP Via Wget.EXE - Paths
match: \Favourites\ 6 rules
Top techniques:Rename Legitimate Utilities
T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, Hidden Window T1564.003, Compile After Delivery T1027.004, System Binary Proxy Execution T1218Sample rules:
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Cmd Launched with Hidden Start Flags to Suspicious Targets
- sigma Dynamic .NET Compilation Via Csc.EXE
- sigma Potentially Suspicious Cabinet File Expansion
- sigma Script Interpreter Execution From Suspicious Folder
- sigma Suspicious File Download From IP Via Wget.EXE - Paths
match: \Temporary Internet 6 rules
Top techniques:Command and Scripting Interpreter
T1059, Compile After Delivery T1027.004, System Binary Proxy Execution T1218, Scheduled Task T1053.005Sample rules:
- sigma Dynamic .NET Compilation Via Csc.EXE
- sigma Potentially Suspicious Cabinet File Expansion
- sigma Suspicious Modification Of Scheduled Tasks
- sigma Script Interpreter Execution From Suspicious Folder
- sigma Suspicious Script Execution From Temp Folder
- sigma Suspicious File Download From IP Via Wget.EXE - Paths
match: cmd.exe /c 6 rules
Top techniques:Scheduled Task
T1053.005, PowerShell T1059.001, LSASS Memory T1003.001, Windows Management Instrumentation T1047Sample rules:
match: cmd.exe /k 6 rules
Top techniques:Scheduled Task
T1053.005, PowerShell T1059.001, LSASS Memory T1003.001, Windows Management Instrumentation T1047Sample rules:
match: cmd.exe /r 6 rules
Top techniques:Scheduled Task
T1053.005, PowerShell T1059.001, LSASS Memory T1003.001, Windows Management Instrumentation T1047Sample rules:
match: query 6 rules
Top techniques:System Information Discovery
T1082, System Network Configuration Discovery T1016, Domain Trust Discovery T1482, System Service Discovery T1007, Query Registry T1012, Software Discovery T1518Sample rules:
- sigma System Information Discovery via Registry Queries
- sigma Potential Recon Activity Via Nltest.EXE
- sigma Potential Configuration And Service Reconnaissance Via Reg.EXE
- sigma Detected Windows Software Discovery
- sigma System Language Discovery via Reg.Exe
- sigma Interesting Service Enumeration Via Sc.EXE
match: start 6 rules
Top techniques:System Binary Proxy Execution
T1218, Network Sniffing T1040, Disable or Modify Tools T1562.001, Exploitation for Privilege Escalation T1068, Exploitation for Client Execution T1203, NTDS T1003.003Sample rules:
- sigma Uncommon Assistive Technology Applications Execution Via AtBroker.EXE
- sigma New Network Trace Capture Started Via Netsh.EXE
- sigma Service StartupType Change Via Sc.EXE
- sigma Suspicious Spool Service Child Process
- sigma Potential Binary Proxy Execution Via VSDiagnostics.EXE
- sigma Sensitive File Dump Via Wbadmin.EXE
match: type 6 rules
Top techniques:PowerShell
T1059.001, Ingress Tool Transfer T1105, NTFS File Attributes T1564.004, DLL T1574.001Sample rules:
- sigma Potential Download/Upload Activity Using Type Command
- sigma PowerShell Execution With Potential Decryption Capabilities
- sigma Powershell Inline Execution From A File
- sigma Execute From Alternate Data Streams
- sigma Potential Data Exfiltration Activity Via CommandLine Tools
- sigma Tasks Folder Evasion
ends_with: .bat 5 rules
ends_with: .bat" 5 rules
ends_with: .bat' 5 rules
ends_with: .dat" 5 rules
ends_with: .dat' 5 rules
ends_with: .exe" 5 rules
ends_with: .exe' 5 rules
ends_with: .hta" 5 rules
ends_with: .hta' 5 rules
ends_with: .msi 5 rules
ends_with: .msi" 5 rules
ends_with: .msi' 5 rules
ends_with: .ps1" 5 rules
ends_with: .ps1' 5 rules
ends_with: .psm1" 5 rules
ends_with: .psm1' 5 rules
ends_with: .vbe" 5 rules
ends_with: .vbe' 5 rules
ends_with: .vbs" 5 rules
ends_with: .vbs' 5 rules
match: -e 5 rules
match: -f 5 rules
Top techniques:LSASS Memory
T1003.001, Masquerading T1036, Odbcconf T1218.008, File Deletion T1070.004match: -n 5 rules
match: -p 5 rules
match: /add 5 rules
match: /addfile 5 rules
match: /transfer 5 rules
match: > 5 rules
match: cp 5 rules
match: %temp% 5 rules
match: --headless 5 rules
match: -f 5 rules
match: .cab 5 rules
match: .cmd 5 rules
Top techniques:Rename Legitimate Utilities
T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, Hidden Window T1564.003, Phishing T1566, Spearphishing Attachment T1566.001Sample rules:
match: .hta 5 rules
match: .scr 5 rules
match: .vbs 5 rules
match: .xml 5 rules
match: :\ProgramData\ 5 rules
Top techniques:Rename Legitimate Utilities
T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, System Binary Proxy Execution T1218, Odbcconf T1218.008, Regsvr32 T1218.010Sample rules:
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
- sigma Odbcconf.EXE Suspicious DLL Location
- sigma Regsvr32 Execution From Potential Suspicious Location
- sigma Suspicious Command Patterns In Scheduled Task Creation
match: C:\Users\ 5 rules
match: DownloadString 5 rules
match: Invoke- 5 rules
Top techniques:Code Repositories
T1593.003match: anonfiles.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: bitsadmin 5 rules
match: cdn.discordapp.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: certutil 5 rules
match: cmd 5 rules
match: cmd /c 5 rules
match: cmd /k 5 rules
match: cmd /r 5 rules
match: ddns.net 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: del 5 rules
match: dl.dropboxusercontent.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: ghostbin.co 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: glitch.me 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: gofile.io 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: hastebin.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: mediafire.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: mega.nz 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: onrender.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: pages.dev 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: paste.ee 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: pastebin.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: pastebin.pl 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: pastetext.net 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: privatlab.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: privatlab.net 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: pwsh 5 rules
match: send.exploit.in 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: sendspace.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: storage.googleapis.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: storjshare.io 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: supabase.co 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: temp.sh 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: transfer.sh 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: trycloudflare.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: ufile.io 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: w3spaces.com 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
match: workers.dev 5 rules
Top techniques:Ingress Tool Transfer
T1105, Rename Legitimate Utilities T1036.003, BITS Jobs T1197, Obfuscated Files or Information T1027Sample rules:
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
regex_match: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} 5 rules
Top techniques:Ingress Tool Transfer
T1105ends_with: .gif 4 rules
ends_with: .jpeg 4 rules
ends_with: .png 4 rules
match: -R 4 rules
Top techniques:Remote Desktop Protocol
T1021.001, Protocol Tunneling T1572, Masquerading T1036, SSH T1021.004, Remote Services T1021Sample rules:
match: -a 4 rules
match: -c 4 rules
match: -decode 4 rules
match: -e 4 rules
match: -ma 4 rules
match: -u 4 rules
match: a 4 rules
match: copy 4 rules
Top techniques:Rename Legitimate Utilities
T1036.003, Exfiltration to Cloud Storage T1567.002, Disable or Modify Tools T1562.001Sample rules:
match: delete 4 rules
match: set 4 rules
match: %ProgramData% 4 rules
match: %Public% 4 rules
match: %Temp% 4 rules
match: %appdata% 4 rules
match: -a 4 rules
Top techniques:Msiexec
T1218.007, Ingress Tool Transfer T1105, Boot or Logon Autostart Execution T1547Sample rules:
match: .cpl 4 rules
match: .doc 4 rules
match: .exe 4 rules
match: .githubusercontent.com 4 rules
match: .ppt 4 rules
match: .vbe 4 rules
match: .xls 4 rules
match: .zip 4 rules
match: /Create 4 rules
match: /delete 4 rules
match: /v 4 rules
match: 0 4 rules
match: :// 4 rules
match: :\Perflogs\ 4 rules
match: C:\Windows\Temp\ 4 rules
match: Invoke-RestMethod 4 rules
match: Invoke-WebRequest 4 rules
match: NT AUT 4 rules
match: New-ItemProperty 4 rules
match: Set-ItemProperty 4 rules
match: backup 4 rules
Top techniques:Inhibit System Recovery
T1490, Exfiltration Over Alternative Protocol T1048, Exfiltration to Cloud Storage T1567.002, NTDS T1003.003Sample rules:
match: binPath 4 rules
match: cmd /c 4 rules
match: copy-item 4 rules
match: cpi 4 rules
match: delete 4 rules
match: dir 4 rules
match: firewall 4 rules
match: github.com 4 rules
match: install 4 rules
match: lsass 4 rules
match: msiexec 4 rules
match: ping 4 rules
match: reg 4 rules
match: rundll32.exe 4 rules
match: sdset 4 rules
match: si 4 rules
match: user 4 rules
Top techniques:Local Account
T1136.001, Exfiltration to Cloud Storage T1567.002, System Owner/User Discovery T1033, Local Account T1087.001Sample rules:
regex_match: :[^ \\] 4 rules
Top techniques:Modify Registry
T1112ends_with: .log 3 rules
Top techniques:Regsvr32
T1218.010ends_with: .txt 3 rules
match: -Group 3 rules
match: -O 3 rules
match: -en 3 rules
Top techniques:PowerShell
T1059.001match: -f 3 rules
Top techniques:File Deletion
T1070.004, Domain Account T1087.002, Ingress Tool Transfer T1105, NTFS File Attributes T1564.004Sample rules:
match: -hp 3 rules
match: -i 3 rules
match: -i 3 rules
match: -m 3 rules
match: -mp 3 rules
match: -w hidden 3 rules
match: /s 3 rules
match: 0 3 rules
match: administrateur 3 rules
match: stop 3 rules
Sample rules:
match: tunnel 3 rules
Sample rules:
match: user 3 rules
match: # 3 rules
match: #+ 3 rules
Sample rules:
match: #- 3 rules
Sample rules:
match: %comspec% 3 rules
match: --accept-server-license-terms 3 rules
Sample rules:
match: --healthcheck 3 rules
match: --level Full 3 rules
match: --no-enum-limit 3 rules
match: --output 3 rules
match: --output-document 3 rules
match: --remote-name 3 rules
match: --scanner aclcheck 3 rules
match: --scanner antivirus 3 rules
match: --scanner computerversion 3 rules
match: --scanner foreignusers 3 rules
match: --scanner laps_bitlocker 3 rules
match: --scanner localadmin 3 rules
match: --scanner nullsession 3 rules
match: --scanner nullsession-trust 3 rules
match: --scanner oxidbindings 3 rules
match: --scanner remote 3 rules
match: --scanner share 3 rules
match: --scanner smb 3 rules
match: --scanner smb3querynetwork 3 rules
match: --scanner spooler 3 rules
match: --scanner startup 3 rules
match: --scanner zerologon 3 rules
match: --server 3 rules
match: -config 3 rules
Sample rules:
match: -encode 3 rules
match: -r 3 rules
match: -s 3 rules
match: -u 3 rules
match: -u 3 rules
match: .DownloadFile( 3 rules
match: .DownloadString( 3 rules
match: .downloadfile( 3 rules
match: .downloadstring( 3 rules
match: .dump 3 rules
Top techniques:Archive via Utility
T1560.001Sample rules:
match: .hdmp 3 rules
Top techniques:Archive via Utility
T1560.001Sample rules:
match: .inf 3 rules
match: .pdf 3 rules
match: .ps 3 rules
match: .ps1 3 rules
match: .reg 3 rules
match: .tmp 3 rules
match: .vb 3 rules
match: /C 3 rules
match: /add 3 rules
match: /r 3 rules
match: /s 3 rules
Top techniques:File Deletion
T1070.004, Credentials in Registry T1552.002, CMSTP T1218.003, Bypass User Account Control T1548.002Sample rules:
match: /user: 3 rules
Sample rules:
match: ://1 3 rules
match: ://2 3 rules
match: ://3 3 rules
match: ://4 3 rules
match: ://5 3 rules
match: ://6 3 rules
match: ://7 3 rules
match: ://8 3 rules
match: ://9 3 rules
match: :3389 3 rules
Sample rules:
match: :\Perflogs 3 rules
match: :\Users\Default\ 3 rules
match: :\Windows\System32\Tasks\ 3 rules
match: > 3 rules
match: Add-LocalGroupMember 3 rules
match: Add-MpPreference 3 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
match: C:\Windows\TEMP\ 3 rules
Sample rules:
match: C:\windows\system32\davclnt.dll,DavSetCookie 3 rules
match: CATALINA_HOME 3 rules
match: ControlSet 3 rules
match: MSExchange 3 rules
match: MiniDump 3 rules
match: New-ItemProperty 3 rules
match: Out-File 3 rules
match: Remote Desktop Users 3 rules
match: Set-ItemProperty 3 rules
match: Set-MpPreference 3 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
match: URL 3 rules
match: Usuarios de escritorio remoto 3 rules
match: Utilisateurs du Bureau à distance 3 rules
match: \Microsoft\Windows\Start Menu\Programs\Startup\ 3 rules
match: \Pictures\ 3 rules
match: accepteula 3 rules
Top techniques:Malware
T1587.001Sample rules:
match: advfirewall 3 rules
match: catalina.jar 3 rules
match: cmd /k 3 rules
match: cmd /r 3 rules
match: cmd.exe /c 3 rules
Sample rules:
match: cmd.exe /k 3 rules
Sample rules:
match: cmd.exe /r 3 rules
Sample rules:
match: copy 3 rules
match: curl 3 rules
match: echo 3 rules
match: erase 3 rules
Sample rules:
match: findstr 3 rules
match: hkey_local_machine 3 rules
match: hklm 3 rules
match: iex 3 rules
match: irm 3 rules
match: localgroup 3 rules
match: new-object 3 rules
match: pixeldrain.com 3 rules
match: process 3 rules
Top techniques:Windows Management Instrumentation
T1047, Malicious File T1204.002, Regsvr32 T1218.010Sample rules:
match: reg 3 rules
match: schtasks 3 rules
Top techniques:Rename Legitimate Utilities
T1036.003, Scheduled Task T1053.005, Disable or Modify Tools T1562.001, Malicious Copy and Paste T1204.004Sample rules:
match: service 3 rules
match: snapshot 3 rules
match: source 3 rules
Top techniques:Command and Scripting Interpreter
T1059match: tunnel 3 rules
Sample rules:
match: urlcache 3 rules
match: verifyctl 3 rules
regex_match: \s-O\s 3 rules
ends_with: .cpl 2 rules
Sample rules:
ends_with: .exe tunnel 2 rules
Sample rules:
ends_with: .gif" 2 rules
Sample rules:
ends_with: .gif' 2 rules
Sample rules:
ends_with: .jpeg" 2 rules
Sample rules:
ends_with: .jpeg' 2 rules
Sample rules:
ends_with: .jpg 2 rules
Sample rules:
ends_with: .log" 2 rules
Sample rules:
ends_with: .log' 2 rules
Sample rules:
ends_with: .png" 2 rules
Sample rules:
ends_with: .png' 2 rules
Sample rules:
ends_with: .rdp 2 rules
Top techniques:Remote Desktop Software
T1219.002Sample rules:
ends_with: .rdp" 2 rules
Top techniques:Remote Desktop Software
T1219.002Sample rules:
ends_with: .temp 2 rules
Sample rules:
ends_with: .tmp 2 rules
Sample rules:
ends_with: \rundll32.exe 2 rules
Top techniques:Indirect Command Execution
T1202Sample rules:
ends_with: \sam 2 rules
Top techniques:Query Registry
T1012Sample rules:
ends_with: \security 2 rules
Top techniques:Query Registry
T1012Sample rules:
ends_with: \system 2 rules
Top techniques:Query Registry
T1012Sample rules:
ends_with: rundll32.exe 2 rules
match: --full 2 rules
Sample rules:
match: --install 2 rules
Sample rules:
match: --name 2 rules
Sample rules:
match: -E 2 rules
Top techniques:Query Registry
T1012Sample rules:
match: -EncodedCommand 2 rules
match: -Filter \* 2 rules
Top techniques:System Owner/User Discovery
T1033match: -LoadDLL 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
match: -NoP 2 rules
match: -P 2 rules
Sample rules:
match: -W Hidden 2 rules
match: -af 2 rules
Sample rules:
match: -clsid 2 rules
Top techniques:Kerberoasting
T1558.003Sample rules:
match: -ec 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
match: -enco 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
match: -g 2 rules
Top techniques:Cached Domain Credentials
T1003.005, Account Discovery T1087, Local Account T1087.001, Domain Account T1087.002Sample rules:
match: -i -s cmd 2 rules
Top techniques:Malware
T1587.001Sample rules:
match: -i -s powershell 2 rules
Top techniques:Malware
T1587.001Sample rules:
match: -i -s pwsh 2 rules
Top techniques:Malware
T1587.001Sample rules:
match: -o 2 rules
match: -p 2 rules
match: -powershell 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
match: -q 2 rules
Sample rules:
match: -r 2 rules
Top techniques:Command and Scripting Interpreter
T1059Sample rules:
match: -r 2 rules
match: -remediationScript 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
match: -s 2 rules
Top techniques:File Deletion
T1070.004, Account Discovery T1087, Local Account T1087.001, Domain Account T1087.002Sample rules:
- sigma File Deletion Via Del
- sigma Suspicious Use of PsLogList
match: -s 2 rules
match: -s -i cmd 2 rules
Top techniques:Malware
T1587.001Sample rules:
match: -s -i powershell 2 rules
Top techniques:Malware
T1587.001Sample rules:
match: -s -i pwsh 2 rules
Top techniques:Malware
T1587.001Sample rules:
match: -s cmd 2 rules
Top techniques:Malware
T1587.001Sample rules:
match: -s powershell 2 rules
Top techniques:Malware
T1587.001Sample rules:
match: -s pwsh 2 rules
Top techniques:Malware
T1587.001Sample rules:
match: -sc 2 rules
Sample rules:
match: -u -p 2 rules
Sample rules:
match: -ur 2 rules
Sample rules:
match: /c 2 rules
Top techniques:Dynamic-link Library Injection
T1055.001Sample rules:
match: /change 2 rules
Sample rules:
match: /d 2 rules
Sample rules:
match: /decode 2 rules
match: /delete 2 rules
Sample rules:
match: /f 2 rules
Sample rules:
match: /i 2 rules
Top techniques:Modify Registry
T1112Sample rules:
match: /o 2 rules
Sample rules:
match: /ticket: 2 rules
match: /y 2 rules
Sample rules:
match: 0x 2 rules
Sample rules:
match: > 2 rules
Sample rules:
match: C:\ 2 rules
match: C:\Windows\ 2 rules
match: Full 2 rules
Sample rules:
match: IAB 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
match: JAB 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
match: Mini 2 rules
Sample rules:
match: ONCE 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
match: ONIDLE 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
match: ONLOGON 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
match: ONSTART 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
match: SQBFAFgA 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
match: SUVYI 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
match: SYSTEM 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
match: SYSTEM 2 rules
Sample rules:
match: WithHeap 2 rules
Sample rules:
match: aQBlAHgA 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
match: aWV4I 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
match: administrator 2 rules
match: administrators 2 rules
match: exec 2 rules
Top techniques:Token Impersonation/Theft
T1134.001, Make and Impersonate Token T1134.003, Service Execution T1569.002Sample rules:
match: export 2 rules
match: firewall 2 rules
Top techniques:Disable or Modify System Firewall
T1562.004Sample rules:
match: gp 2 rules
Sample rules:
match: group 2 rules
match: i 2 rules
match: irm 2 rules
Sample rules:
match: list 2 rules
match: localgroup 2 rules
Top techniques:Local Account
T1087.001, Domain Account T1087.002, Remote System Discovery T1018, System Owner/User Discovery T1033, Account Discovery T1087, Web Shell T1505.003Sample rules:
match: mi 2 rules
match: msiexec 2 rules
match: mssql 2 rules
match: mv 2 rules
match: oudmp 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: p 2 rules
Sample rules:
match: recovery 2 rules
Sample rules:
match: relay 2 rules
Top techniques:Steal or Forge Authentication Certificates
T1649, Pass the Ticket T1550.003, Kerberoasting T1558.003Sample rules:
match: run 2 rules
Sample rules:
match: script 2 rules
match: smb 2 rules
match: start 2 rules
Sample rules:
match: | Select 2 rules
Top techniques:System Owner/User Discovery
T1033match: %2e 2 rules
Sample rules:
match: %COMSPEC% 2 rules
Top techniques:BITS Jobs
T1197, Token Impersonation/Theft T1134.001, Create Process with Token T1134.002Sample rules:
match: %TEMP% 2 rules
match: %TMP% 2 rules
match: %localappdata% 2 rules
Sample rules:
match: && 2 rules
Sample rules:
match: &cd&echo 2 rules
Top techniques:Remote System Discovery
T1018, System Owner/User Discovery T1033, Account Discovery T1087, Web Shell T1505.003Sample rules:
match: --load-extension= 2 rules
Top techniques:Browser Extensions
T1176.001match: --meshServiceName 2 rules
match: -AclObject 2 rules
Sample rules:
match: -AddInRoot: 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
match: -BinaryPathName 2 rules
Top techniques:Windows Service
T1543.003Sample rules:
match: -ComObject 2 rules
match: -GetCACAPS 2 rules
Top techniques:Ingress Tool Transfer
T1105Sample rules:
match: -PipelineRoot: 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
match: -SecurityDescriptorSddl 2 rules
match: -a 2 rules
Sample rules:
match: -c 2 rules
Top techniques:Disable or Modify Tools
T1562.001, Archive Collected Data T1560, Archive via Utility T1560.001Sample rules:
match: -connector-id 2 rules
Sample rules:
match: -credentials-contents 2 rules
Sample rules:
match: -credentials-file 2 rules
Sample rules:
match: -j 2 rules
Top techniques:Msiexec
T1218.007Sample rules:
match: -m 2 rules
Sample rules:
match: -o 2 rules
match: -p 2 rules
Sample rules:
match: -package 2 rules
Top techniques:Msiexec
T1218.007Sample rules:
match: -path 2 rules
Sample rules:
match: -q 2 rules
Top techniques:Msiexec
T1218.007Sample rules:
match: -s 2 rules
Sample rules:
match: -sc u: 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: -sd 2 rules
match: -subnets -f 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: -token 2 rules
Sample rules:
match: -url 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: .00x 2 rules
Sample rules:
match: .0x 2 rules
Sample rules:
match: .7z 2 rules
match: .DownloadFile 2 rules
Sample rules:
match: .DownloadString 2 rules
Sample rules:
match: .bmp 2 rules
match: .chm 2 rules
Top techniques:Rename Legitimate Utilities
T1036.003, Ingress Tool Transfer T1105, BITS Jobs T1197, Compiled HTML File T1218.001Sample rules:
match: .csv 2 rules
match: .dat 2 rules
match: .dll 2 rules
match: .dll" 2 rules
Sample rules:
match: .dmp 2 rules
Sample rules:
match: .exe tunnel 2 rules
Sample rules:
match: .jar 2 rules
match: .lnk 2 rules
match: .log 2 rules
match: .mp3 2 rules
match: .pl 2 rules
match: .rar 2 rules
match: .rsp 2 rules
Top techniques:Odbcconf
T1218.008Sample rules:
match: .rtf 2 rules
match: .sdb 2 rules
Top techniques:Application Shimming
T1546.011match: .sh 2 rules
match: .wsf 2 rules
match: .wsh 2 rules
match: .yml 2 rules
Top techniques:JavaScript
T1059.007, Deobfuscate/Decode Files or Information T1140, Mshta T1218.005, Protocol Tunneling T1572Sample rules:
match: /../../ 2 rules
Top techniques:Windows Command Shell
T1059.003Sample rules:
match: //0x 2 rules
Sample rules:
match: /Create 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
match: /TN TVInstallRestore 2 rules
Sample rules:
match: /c 2 rules
Sample rules:
match: /d 2 rules
match: /d /c 2 rules
Sample rules:
match: /d 0 2 rules
match: /d 1 2 rules
match: /disable 2 rules
Sample rules:
match: /f 2 rules
Sample rules:
match: /f 2 rules
Top techniques:Credentials in Registry
T1552.002, Windows File and Directory Permissions Modification T1222.001Sample rules:
match: /lng 2 rules
Sample rules:
match: /pass: 2 rules
Sample rules:
match: /portable 2 rules
Sample rules:
match: /q 2 rules
Top techniques:File Deletion
T1070.004, Windows Command Shell T1059.003, Visual Basic T1059.005, JavaScript T1059.007Sample rules:
match: /t 2 rules
match: /t REG_SZ 2 rules
match: /v 2 rules
Sample rules:
match: 127.0.0.1 2 rules
match: ://7- 2 rules
match: ::FromBase64String 2 rules
Sample rules:
match: :\Tmp\ 2 rules
match: :\Windows\ 2 rules
Sample rules:
match: :\Windows\Temp 2 rules
match: :\Windows\Tracing\ 2 rules
Sample rules:
match: :\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
match: :\Windows\UUS\amd64\UpdateDeploy.dll /ClassId 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
match: :\Windows\WinSxS\ 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
match: ; 2 rules
match: ;BA 2 rules
Top techniques:Windows Service
T1543.003match: ;IU 2 rules
Top techniques:Windows Service
T1543.003match: ;SU 2 rules
Top techniques:Windows Service
T1543.003match: ;SY 2 rules
Top techniques:Windows Service
T1543.003match: ;WD 2 rules
Top techniques:Windows Service
T1543.003match: Add-Content 2 rules
Top techniques:System Owner/User Discovery
T1033match: Add-PSSnapin 2 rules
Sample rules:
match: Allow 2 rules
Top techniques:Disable or Modify Tools
T1562.001match: Antivirus 2 rules
Sample rules:
match: Bookmarks 2 rules
match: Bypass 2 rules
Top techniques:PowerShell
T1059.001match: C:\ProgramData\Microsoft\WSL\wslg.rdp 2 rules
Sample rules:
match: C:\Users\Public 2 rules
Top techniques:Windows Service
T1543.003Sample rules:
match: Control_RunDLL 2 rules
Top techniques:Rundll32
T1218.011Sample rules:
match: Cookies 2 rules
match: DCLCWPDTSD 2 rules
Top techniques:Services Registry Permissions Weakness
T1574.011match: DownloadFile 2 rules
Sample rules:
match: EnableVirtualizationBasedSecurity 2 rules
match: Exchange Trusted Subsystem 2 rules
match: FailureCommand 2 rules
match: Find-GPOLocation 2 rules
match: Get-ChildItem 2 rules
Top techniques:Private Keys
T1552.004match: Get-Content 2 rules
Sample rules:
match: Get-ItemProperty 2 rules
Sample rules:
match: HIGHEST 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
match: HKCU: 2 rules
Sample rules:
match: HKEY_ 2 rules
Sample rules:
match: HKLM: 2 rules
Sample rules:
match: History 2 rules
match: INSTALLDRIVER 2 rules
Top techniques:Odbcconf
T1218.008Sample rules:
match: IWR 2 rules
Sample rules:
match: ImagePath 2 rules
match: Import-Module 2 rules
match: InstallProduct( 2 rules
match: Invoke-ACLScanner 2 rules
match: Invoke-Command 2 rules
Top techniques:Rundll32
T1218.011, Indirect Command Execution T1202, System Binary Proxy Execution T1218Sample rules:
match: Invoke-Expression 2 rules
Sample rules:
match: Invoke-Kerberoast 2 rules
match: Invoke-Nightmare 2 rules
match: Invoke-RestMethod 2 rules
match: Invoke-Tater 2 rules
match: Invoke-UserHunter 2 rules
match: LaunchApplication 2 rules
Top techniques:Rundll32
T1218.011Sample rules:
match: Login Data 2 rules
match: New-Service 2 rules
Top techniques:Windows Service
T1543.003Sample rules:
match: REGSVR 2 rules
Top techniques:Odbcconf
T1218.008Sample rules:
match: Set-Acl 2 rules
Sample rules:
match: Set-Content 2 rules
Top techniques:System Owner/User Discovery
T1033match: Set-Service 2 rules
match: Shell32.dll 2 rules
Top techniques:Rundll32
T1218.011Sample rules:
match: ShellExec_RunDLL 2 rules
Top techniques:Rundll32
T1218.011Sample rules:
match: Start-BitsTransfer 2 rules
Sample rules:
match: Stop-Service 2 rules
Sample rules:
match: Unrestricted 2 rules
Top techniques:PowerShell
T1059.001match: WinDefend 2 rules
Sample rules:
match: \AppData\Roaming\Temp 2 rules
Top techniques:Command and Scripting Interpreter
T1059Sample rules:
match: \Appdata\Local\Temp\ 2 rules
Top techniques:System Binary Proxy Execution
T1218match: \DavWWWRoot\ 2 rules
match: \Music\ 2 rules
match: \PerfLogs\ 2 rules
match: \ProgramData\ 2 rules
match: \SYSTEM\CurrentControlSet\Control\SafeBoot 2 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
match: \Software\Aerofox\FoxmailPreview 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\Aerofox\Foxmail\V3.1 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\DownloadManager\Passwords 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\FTPWare\COREFTP\Sites 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\IncrediMail\Identities 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\Martin Prikryl\WinSCP 2\Sessions 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 2 rules
match: \Software\ORL\WinVNC3\Password 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\OpenSSH\Agent\Keys 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\OpenVPN-GUI\configs 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\Qualcomm\Eudora\CommandLine 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\RealVNC\WinVNC4 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\RimArts\B2\Settings 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\SimonTatham\PuTTY\Sessions 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\Sota\FFFTP 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\TightVNC\Server 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 2 rules
match: \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: \System\CurrentControlSet\Control\Lsa 2 rules
Top techniques:Modify Registry
T1112Sample rules:
match: \UpdateDeploy.dll /ClassId 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
match: \Videos\ 2 rules
match: \WINDOWS\Temp\ 2 rules
Sample rules:
match: \Windows\BitLocker 2 rules
Top techniques:Service Stop
T1489Sample rules:
match: \Windows\ExploitGuard 2 rules
Top techniques:Service Stop
T1489Sample rules:
match: \Windows\NTDS\NTDS.dit 2 rules
Top techniques:NTDS
T1003.003Sample rules:
match: \Windows\SystemRestore\SR 2 rules
Top techniques:Service Stop
T1489Sample rules:
match: \Windows\Temp 2 rules
Top techniques:Command and Scripting Interpreter
T1059Sample rules:
match: \Windows\UpdateOrchestrator\ 2 rules
Top techniques:Service Stop
T1489Sample rules:
match: \Windows\Windows Defender\ 2 rules
Top techniques:Service Stop
T1489Sample rules:
match: \Windows\WindowsBackup\ 2 rules
Top techniques:Service Stop
T1489Sample rules:
match: \Windows\WindowsUpdate\ 2 rules
Top techniques:Service Stop
T1489Sample rules:
match: \\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy 2 rules
Top techniques:Inhibit System Recovery
T1490Sample rules:
match: \catalina_start.bat 2 rules
Sample rules:
match: \config\SAM 2 rules
Top techniques:NTDS
T1003.003Sample rules:
match: \config\SECURITY 2 rules
Top techniques:NTDS
T1003.003Sample rules:
match: \config\SYSTEM 2 rules
Top techniques:NTDS
T1003.003Sample rules:
match: \dismhost.exe { 2 rules
Sample rules:
match: \servers\Stable- 2 rules
Sample rules:
match: \software\ 2 rules
Top techniques:Software Discovery
T1518Sample rules:
match: \windows\ntds\ntds.dit 2 rules
Sample rules:
match: \xampp\ 2 rules
Sample rules:
match: account 2 rules
Sample rules:
match: adinfo 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: anti-bot 2 rules
Sample rules:
match: botcheck 2 rules
Sample rules:
match: bypass 2 rules
match: captcha 2 rules
Sample rules:
match: cat 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
match: challenge 2 rules
Sample rules:
match: cleanup 2 rules
Sample rules:
match: cmd 2 rules
Top techniques:Windows Service
T1543.003Sample rules:
match: cmd.exe 2 rules
match: code-server.cmd 2 rules
Sample rules:
match: collect 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
match: computer_pwdnotreqd 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: computers_active 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: computers_pwdnotreqd 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: comsvcs 2 rules
match: config 2 rules
match: confirmation 2 rules
Sample rules:
match: cookies.sqlite 2 rules
Top techniques:Data from Local System
T1005, Steal Web Session Cookie T1539, Browser Information Discovery T1217Sample rules:
match: dcmodes 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: diantz.exe 2 rules
match: disable 2 rules
Sample rules:
match: dllhost 2 rules
Top techniques:Windows Service
T1543.003Sample rules:
match: domain admins 2 rules
match: domainlist 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: domainncs 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: dompol 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: dpapi:: 2 rules
match: echo 2 rules
Sample rules:
match: encodedcommand 2 rules
Sample rules:
match: enterprise admins 2 rules
match: export 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: extrac32.exe 2 rules
Sample rules:
match: failure 2 rules
match: file createnew 2 rules
Top techniques:Command and Scripting Interpreter
T1059, Exploitation for Defense Evasion T1211, DLL T1574.001Sample rules:
match: finger 2 rules
match: firewall 2 rules
match: for 2 rules
match: forfiles 2 rules
match: fraud 2 rules
Sample rules:
match: fspdmp 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: ftp 2 rules
Sample rules:
match: gatherNetworkInfo.vbs 2 rules
match: gpodmp 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: http://% 2 rules
Sample rules:
match: human 2 rules
Sample rules:
match: identification 2 rules
Sample rules:
match: identificator 2 rules
Sample rules:
match: identity 2 rules
Sample rules:
match: iex 2 rules
Sample rules:
match: import 2 rules
match: interactive 2 rules
Sample rules:
match: internal-run 2 rules
Sample rules:
match: ipmo 2 rules
match: itemtype:File 2 rules
Sample rules:
match: keepVersions:0 2 rules
Top techniques:Inhibit System Recovery
T1490Sample rules:
match: kerberos:: 2 rules
match: lsadump:: 2 rules
match: mklink 2 rules
match: move 2 rules
match: name="Domain Admins" 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: ni 2 rules
match: nslookup 2 rules
Top techniques:System Information Discovery
T1082, Account Discovery T1087, Remote System Discovery T1018, Command and Scripting Interpreter T1059Sample rules:
match: objectcategory= 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: osk.exe 2 rules
Top techniques:Accessibility Features
T1546.008Sample rules:
match: paexec 2 rules
Top techniques:Malware
T1587.001Sample rules:
match: passphrase 2 rules
Sample rules:
match: path 2 rules
match: places.sqlite 2 rules
Top techniques:Data from Local System
T1005, Steal Web Session Cookie T1539, Browser Information Discovery T1217Sample rules:
match: powershell.exe 2 rules
Sample rules:
match: privilege:: 2 rules
match: process 2 rules
Sample rules:
match: pwsh.exe 2 rules
Sample rules:
match: recoveryTarget 2 rules
Sample rules:
match: registry:: 2 rules
Sample rules:
match: regsvr32.exe 2 rules
Sample rules:
match: robot 2 rules
Sample rules:
match: root 2 rules
Top techniques:Install Root Certificate
T1553.004Sample rules:
match: rpc:: 2 rules
match: rule 2 rules
match: save 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
match: sekurlsa:: 2 rules
match: sethc.exe 2 rules
Top techniques:Accessibility Features
T1546.008Sample rules:
match: shadow 2 rules
match: shell32.dll 2 rules
Top techniques:Rundll32
T1218.011Sample rules:
match: sp 2 rules
match: start=disabled 2 rules
Sample rules:
match: subnetdmp 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: svchost 2 rules
Top techniques:Windows Service
T1543.003Sample rules:
match: sysmon 2 rules
match: token:: 2 rules
match: trace 2 rules
Sample rules:
match: trustdmp 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: tunnel 2 rules
Sample rules:
match: tunnel-service.log 2 rules
Sample rules:
match: type 2 rules
Top techniques:Windows Service
T1543.003, Command and Scripting Interpreter T1059, Exploitation for Defense Evasion T1211Sample rules:
match: uninstall 2 rules
Sample rules:
match: unload 2 rules
Top techniques:Indicator Removal
T1070, Impair Defenses T1562, Disable Windows Event Logging T1562.002Sample rules:
match: update 2 rules
Top techniques:Network Service Discovery
T1046, Indicator Removal T1070, Indicator Blocking T1562.006Sample rules:
match: useraccount 2 rules
Top techniques:System Owner/User Discovery
T1033, Local Account T1087.001, Windows Management Instrumentation T1047, Account Manipulation T1098Sample rules:
match: users_noexpire 2 rules
Top techniques:Remote System Discovery
T1018, Domain Groups T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482Sample rules:
match: utilman.exe 2 rules
Top techniques:Accessibility Features
T1546.008Sample rules:
match: validation 2 rules
Sample rules:
match: vbscript 2 rules
match: verification 2 rules
Sample rules:
match: verify 2 rules
Sample rules:
match: wget 2 rules
match: winrm 2 rules
Top techniques:System Script Proxy Execution
T1216Sample rules:
match: wmic 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
match: wmic.exe 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
match: zzzzInvokeManagedCustomActionOutOfProc 2 rules
Sample rules:
match: ☂️ 2 rules
match: ♟ 2 rules
match: ❤️🔥 2 rules
match: ❤️🩹 2 rules
match: 😮💨 2 rules
match: 😵💫 2 rules
match: 😶🌫️ 2 rules
match: 🛝 2 rules
match: 🛞 2 rules
match: 🛟 2 rules
match: 🟰 2 rules
match: 🥹 2 rules
match: 🦴 2 rules
match: 🧌 2 rules
match: 🧔♀️ 2 rules
match: 🧔♂️ 2 rules
match: 🧔🏻♀️ 2 rules
match: 🧔🏻♂️ 2 rules
match: 🧔🏼♀️ 2 rules
match: 🧔🏼♂️ 2 rules
match: 🧔🏽♀️ 2 rules
match: 🧔🏽♂️ 2 rules
match: 🧔🏾♀️ 2 rules
match: 🧔🏾♂️ 2 rules
match: 🧔🏿♀️ 2 rules
match: 🧔🏿♂️ 2 rules
match: 🩰 2 rules
match: 🩸 2 rules
match: 🩻 2 rules
match: 🩼 2 rules
match: 🪩 2 rules
match: 🪪 2 rules
match: 🪫 2 rules
match: 🪬 2 rules
match: 🪷 2 rules
match: 🪸 2 rules
match: 🪹 2 rules
match: 🪺 2 rules
match: 🫃 2 rules
match: 🫃🏻 2 rules
match: 🫃🏼 2 rules
match: 🫃🏽 2 rules
match: 🫃🏾 2 rules
match: 🫃🏿 2 rules
match: 🫄 2 rules
match: 🫄🏻 2 rules
match: 🫄🏼 2 rules
match: 🫄🏽 2 rules
match: 🫄🏾 2 rules
match: 🫄🏿 2 rules
match: 🫅 2 rules
match: 🫅🏻 2 rules
match: 🫅🏼 2 rules
match: 🫅🏽 2 rules
match: 🫅🏾 2 rules
match: 🫅🏿 2 rules
match: 🫗 2 rules
match: 🫘 2 rules
match: 🫙 2 rules
match: 🫡 2 rules
match: 🫢 2 rules
match: 🫣 2 rules
match: 🫥 2 rules
match: 🫦 2 rules
match: 🫧 2 rules
match: 🫰 2 rules
match: 🫰🏻 2 rules
match: 🫰🏼 2 rules
match: 🫰🏽 2 rules
match: 🫰🏾 2 rules
match: 🫰🏿 2 rules
match: 🫱 2 rules
match: 🫱🏻 2 rules
match: 🫱🏼 2 rules
match: 🫱🏽 2 rules
match: 🫱🏾 2 rules
match: 🫱🏿 2 rules
match: 🫲 2 rules
match: 🫲🏻 2 rules
match: 🫲🏼 2 rules
match: 🫲🏽 2 rules
match: 🫲🏾 2 rules
match: 🫲🏿 2 rules
match: 🫳 2 rules
match: 🫳🏻 2 rules
match: 🫳🏼 2 rules
match: 🫳🏽 2 rules
match: 🫳🏾 2 rules
match: 🫳🏿 2 rules
match: 🫴 2 rules
match: 🫴🏻 2 rules
match: 🫴🏼 2 rules
match: 🫴🏽 2 rules
match: 🫴🏾 2 rules
match: 🫴🏿 2 rules
match: 🫵 2 rules
match: 🫵🏻 2 rules
match: 🫵🏼 2 rules
match: 🫵🏽 2 rules
match: 🫵🏾 2 rules
match: 🫵🏿 2 rules
match: 🫶 2 rules
match: 🫶🏻 2 rules
match: 🫶🏼 2 rules
match: 🫶🏽 2 rules
match: 🫶🏾 2 rules
match: 🫶🏿 2 rules
ne: unknown 2 rules
Sample rules:
regex_match: [0-7]{7,13} 2 rules
Sample rules:
regex_match: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 rules
regex_match: :[^\\] 2 rules
Top techniques:NTFS File Attributes
T1564.004Sample rules:
regex_match: https?://((25[0-5]|(2[0-4]|1\d|[1-9])?\d)(\.|\b)){4} 2 rules
Sample rules:
regex_match: https?://(0[0-9]{1,11}\.){3}0[0-9]{1,11} 2 rules
Sample rules:
regex_match: https?://0[0-9]{1,11} 2 rules
Sample rules:
regex_match: https?://0[0-9]{3,11} 2 rules
Sample rules:
regex_match: https?://[0-9]{1,3}\.0[0-9]{3,7} 2 rules
Sample rules:
regex_match: https?://[0-9]{1,3}\.[0-9]{1,3}\.0[0-9]{3,4} 2 rules
Sample rules:
Image 619 entries
ends_with: \powershell.exe 143 rules
Top techniques:PowerShell
T1059.001, System Binary Proxy Execution T1218, Disable or Modify Tools T1562.001, Command and Scripting Interpreter T1059, Obfuscated Files or Information T1027, Windows Management Instrumentation T1047Sample rules (showing 8 of 143):
- sigma Potential Credential Dumping Attempt Via PowerShell Remote Thread
- sigma Remote Thread Creation Via PowerShell In Uncommon Target
- sigma Backup Files Deleted
- sigma Potentially Suspicious DMP/HDMP File Creation
- sigma HackTool - Powerup Write Hijack DLL
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma NTDS.DIT Creation By Uncommon Process
- sigma Potential Binary Or Script Dropper Via PowerShell
ends_with: \pwsh.exe 140 rules
Top techniques:PowerShell
T1059.001, System Binary Proxy Execution T1218, Command and Scripting Interpreter T1059, Disable or Modify Tools T1562.001, Obfuscated Files or Information T1027, Windows Management Instrumentation T1047Sample rules (showing 8 of 140):
- sigma Potential Credential Dumping Attempt Via PowerShell Remote Thread
- sigma Remote Thread Creation Via PowerShell In Uncommon Target
- sigma Backup Files Deleted
- sigma Potentially Suspicious DMP/HDMP File Creation
- sigma HackTool - Powerup Write Hijack DLL
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma NTDS.DIT Creation By Uncommon Process
- sigma Potential Binary Or Script Dropper Via PowerShell
ends_with: \cmd.exe 92 rules
Top techniques:System Binary Proxy Execution
T1218, Windows Command Shell T1059.003, Command and Scripting Interpreter T1059, Exploit Public-Facing Application T1190, PowerShell T1059.001, Web Shell T1505.003Sample rules (showing 8 of 92):
- sigma Backup Files Deleted
- sigma Potentially Suspicious DMP/HDMP File Creation
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma NTDS.DIT Creation By Uncommon Process
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma Suspicious Creation TXT File in User Desktop
- sigma Suspicious File Write to SharePoint Layouts Directory
- sigma Windows Terminal Profile Settings Modification By Uncommon Process
ends_with: \rundll32.exe 76 rules
Top techniques:Rundll32
T1218.011, System Binary Proxy Execution T1218, Masquerading T1036, Regsvr32 T1218.010, Exploitation for Client Execution T1203, Windows Management Instrumentation T1047Sample rules (showing 8 of 76):
- sigma Backup Files Deleted
- sigma Suspicious DotNET CLR Usage Log Artifact
- sigma NTDS.DIT Creation By Uncommon Process
- sigma Office Macro File Creation From Suspicious Process
- sigma Windows Binaries Write Suspicious Extensions
- sigma Amsi.DLL Loaded Via LOLBIN Process
- sigma Suspicious Renamed Comsvcs DLL Loaded By Rundll32
- sigma Suspicious Volume Shadow Copy VSS_PS.dll Load
ends_with: \cscript.exe 64 rules
Top techniques:System Binary Proxy Execution
T1218, Visual Basic T1059.005, Command and Scripting Interpreter T1059, JavaScript T1059.007, Spearphishing Attachment T1566.001, Indirect Command Execution T1202Sample rules (showing 8 of 64):
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma WScript or CScript Dropper - File
- sigma Potentially Suspicious DMP/HDMP File Creation
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma NTDS.DIT Creation By Uncommon Process
- sigma Office Macro File Creation From Suspicious Process
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma Windows Terminal Profile Settings Modification By Uncommon Process
ends_with: \wscript.exe 64 rules
Top techniques:System Binary Proxy Execution
T1218, Visual Basic T1059.005, Command and Scripting Interpreter T1059, JavaScript T1059.007, Spearphishing Attachment T1566.001, Indirect Command Execution T1202Sample rules (showing 8 of 64):
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma WScript or CScript Dropper - File
- sigma Potentially Suspicious DMP/HDMP File Creation
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma NTDS.DIT Creation By Uncommon Process
- sigma Office Macro File Creation From Suspicious Process
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma Windows Terminal Profile Settings Modification By Uncommon Process
ends_with: \mshta.exe 57 rules
Top techniques:System Binary Proxy Execution
T1218, Command and Scripting Interpreter T1059, Mshta T1218.005, Process Injection T1055, Spearphishing Attachment T1566.001, Exploitation for Client Execution T1203Sample rules (showing 8 of 57):
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Potentially Suspicious DMP/HDMP File Creation
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma NTDS.DIT Creation By Uncommon Process
- sigma Office Macro File Creation From Suspicious Process
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma Legitimate Application Dropped Archive
- sigma Legitimate Application Dropped Executable
ends_with: \regsvr32.exe 57 rules
Top techniques:Regsvr32
T1218.010, System Binary Proxy Execution T1218, Rundll32 T1218.011, Windows Management Instrumentation T1047, Process Injection T1055, Spearphishing Attachment T1566.001Sample rules (showing 8 of 57):
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma DNS Query Request By Regsvr32.EXE
- sigma Backup Files Deleted
- sigma NTDS.DIT Creation By Uncommon Process
- sigma Office Macro File Creation From Suspicious Process
- sigma DotNet CLR DLL Loaded By Scripting Applications
- sigma Unsigned DLL Loaded by Windows Utility
- sigma Network Connection Initiated By Regsvr32.EXE
ends_with: \reg.exe 46 rules
Top techniques:Disable or Modify Tools
T1562.001, Modify Registry T1112, Registry Run Keys / Startup Folder T1547.001, System Information Discovery T1082, Credentials in Registry T1552.002, Rename Legitimate Utilities T1036.003Sample rules (showing 8 of 46):
- sigma Windows AMSI Related Registry Tampering Via CommandLine
- sigma Control Panel Items
- sigma Windows Credential Guard Registry Tampering Via CommandLine
- sigma Windows Defender Context Menu Removed
- sigma Potentially Suspicious Child Process Of ClickOnce Application
- sigma System Information Discovery via Registry Queries
- sigma Security Event Logging Disabled via MiniNt Registry Key - Process
- sigma Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine
ends_with: \schtasks.exe 45 rules
Top techniques:Scheduled Task
T1053.005, PowerShell T1059.001, System Binary Proxy Execution T1218, Windows Management Instrumentation T1047, Regsvr32 T1218.010, Service Stop T1489Sample rules (showing 8 of 45):
- sigma Remote Thread Creation By Uncommon Source Image
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma Suspicious BitLocker Access Agent Update Utility Execution
- sigma Potentially Suspicious Child Process Of ClickOnce Application
- sigma HTML Help HH.EXE Suspicious Child Process
- sigma HackTool - Default PowerSploit/Empire Scheduled Task Creation
- sigma Suspicious Shells Spawn by Java Utility Keytool
- sigma Suspicious Child Process Of Manage Engine ServiceDesk
ends_with: \wmic.exe 37 rules
Top techniques:Windows Management Instrumentation
T1047, XSL Script Processing T1220, Visual Basic T1059.005, JavaScript T1059.007, Process Injection T1055, Command and Scripting Interpreter T1059Sample rules (showing 8 of 37):
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma DotNet CLR DLL Loaded By Scripting Applications
- sigma WMIC Loading Scripting Libraries
- sigma Suspicious ArcSOC.exe Child Process
- sigma Suspicious Autorun Registry Modified via WMI
- sigma Suspicious BitLocker Access Agent Update Utility Execution
- sigma HTML Help HH.EXE Suspicious Child Process
ends_with: \certutil.exe 34 rules
Top techniques:Obfuscated Files or Information
T1027, System Binary Proxy Execution T1218, Ingress Tool Transfer T1105, Phishing T1566, Spearphishing Attachment T1566.001, Command and Scripting Interpreter T1059Sample rules (showing 8 of 34):
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma Legitimate Application Dropped Archive
- sigma Legitimate Application Dropped Executable
- sigma Legitimate Application Writing Files In Uncommon Location
- sigma Legitimate Application Dropped Script
- sigma Uncommon Network Connection Initiated By Certutil.EXE
- sigma New Root Certificate Installed Via Certutil.EXE
ends_with: \net.exe 27 rules
Top techniques:SMB/Windows Admin Shares
T1021.002, Process Injection T1055, Local Account T1087.001, Service Stop T1489, Local Account T1136.001, Web Service T1102Sample rules (showing 8 of 27):
- sigma Potentially Suspicious Child Process Of ClickOnce Application
- sigma Suspicious Child Process Of Manage Engine ServiceDesk
- sigma Suspicious Processes Spawned by Java.EXE
- sigma Potential Process Injection Via Msra.EXE
- sigma Suspicious Child Process Of Veeam Dabatase
- sigma Suspicious Group And Account Reconnaissance Activity Using Net.EXE
- sigma Unmount Share Via Net.EXE
- sigma Start Windows Service Via Net.EXE
ends_with: \powershell_ise.exe 27 rules
Top techniques:PowerShell
T1059.001, System Binary Proxy Execution T1218, Ingress Tool Transfer T1105, Exploit Public-Facing Application T1190, Web Shell T1505.003, Disable or Modify Tools T1562.001Sample rules (showing 8 of 27):
- sigma Potential Binary Or Script Dropper Via PowerShell
- sigma Suspicious File Write to SharePoint Layouts Directory
- sigma Suspicious BitLocker Access Agent Update Utility Execution
- sigma Potentially Suspicious Child Processes Spawned by ConHost
- sigma New DMSA Service Account Created in Specific OUs
- sigma Windows Defender Context Menu Removed
- sigma Security Event Logging Disabled via MiniNt Registry Key - Process
- sigma IIS WebServer Log Deletion via CommandLine Utilities
ends_with: \net1.exe 25 rules
Top techniques:SMB/Windows Admin Shares
T1021.002, Local Account T1087.001, Service Stop T1489, Local Account T1136.001, Web Service T1102, Domain Account T1087.002Sample rules (showing 8 of 25):
- sigma Potentially Suspicious Child Process Of ClickOnce Application
- sigma Suspicious Child Process Of Manage Engine ServiceDesk
- sigma Suspicious Processes Spawned by Java.EXE
- sigma Suspicious Child Process Of Veeam Dabatase
- sigma Suspicious Group And Account Reconnaissance Activity Using Net.EXE
- sigma Unmount Share Via Net.EXE
- sigma Start Windows Service Via Net.EXE
- sigma Stop Windows Service Via Net.EXE
ends_with: \bitsadmin.exe 23 rules
Top techniques:BITS Jobs
T1197, Ingress Tool Transfer T1105, Rename Legitimate Utilities T1036.003, System Binary Proxy Execution T1218, Exploit Public-Facing Application T1190, Web Shell T1505.003Sample rules (showing 8 of 23):
- sigma Legitimate Application Writing Files In Uncommon Location
- sigma Suspicious BitLocker Access Agent Update Utility Execution
- sigma File Download Via Bitsadmin
- sigma Suspicious Download From Direct IP Via Bitsadmin
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma File With Suspicious Extension Downloaded Via Bitsadmin
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Monitoring For Persistence Via BITS
ends_with: \msedge.exe 22 rules
Top techniques:Web Service
T1102, Ingress Tool Transfer T1105, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Hidden Window T1564.003, Browser Extensions T1176.001Sample rules (showing 8 of 22):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Office Macro File Download
- sigma .RDP File Created By Uncommon Application
- sigma VHD Image Download Via Browser
- sigma Potential Azure Browser SSO Abuse
ends_with: \msiexec.exe 21 rules
Top techniques:Windows Management Instrumentation
T1047, Msiexec T1218.007, Regsvr32 T1218.010, Malicious File T1204.002, Rundll32 T1218.011, Phishing T1566Sample rules (showing 8 of 21):
- sigma Remote Thread Creation By Uncommon Source Image
- sigma Suspicious Volume Shadow Copy VSS_PS.dll Load
- sigma Credential Dumping Attempt Via Svchost
- sigma HTML Help HH.EXE Suspicious Child Process
- sigma DllUnregisterServer Function Call Via Msiexec.EXE
- sigma Suspicious Msiexec Execute Arbitrary DLL
- sigma Msiexec Quiet Installation
- sigma Suspicious Msiexec Quiet Install From Remote Location
ends_with: \opera.exe 21 rules
Top techniques:Web Service
T1102, Ingress Tool Transfer T1105, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Hidden Window T1564.003, Browser Extensions T1176.001Sample rules (showing 8 of 21):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Server Discovery Via LDAP Query
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Office Macro File Download
- sigma VHD Image Download Via Browser
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
ends_with: \brave.exe 20 rules
Top techniques:Web Service
T1102, Ingress Tool Transfer T1105, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Hidden Window T1564.003, Browser Extensions T1176.001Sample rules (showing 8 of 20):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Office Macro File Download
- sigma .RDP File Created By Uncommon Application
- sigma VHD Image Download Via Browser
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
ends_with: \svchost.exe 20 rules
Top techniques:Match Legitimate Resource Name or Location
T1036.005, PowerShell T1059.001, Masquerading T1036, Remote Desktop Protocol T1021.001, Protocol Tunneling T1572, Malicious File T1204.002Sample rules (showing 8 of 20):
- sigma BloodHound Collection Files
- sigma HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
- sigma Windows Binaries Write Suspicious Extensions
- sigma Suspicious Desktopimgdownldr Target File
- sigma Suspicious Volume Shadow Copy VSS_PS.dll Load
- sigma Suspicious WSMAN Provider Image Loads
- sigma RDP Over Reverse SSH Tunnel
- sigma RDP to HTTP or HTTPS Target Ports
ends_with: \curl.exe 19 rules
Top techniques:Phishing
T1566, Spearphishing Attachment T1566.001, Ingress Tool Transfer T1105, Hijack Execution Flow T1574, DLL T1574.001, Web Service T1102Sample rules (showing 8 of 19):
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma Potential Cookies Session Hijacking
- sigma Curl Web Request With Potential Custom User-Agent
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Insecure Transfer Via Curl.EXE
- sigma Insecure Proxy/DOH Transfer Via Curl.EXE
ends_with: \vivaldi.exe 19 rules
Top techniques:Web Service
T1102, Ingress Tool Transfer T1105, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Hidden Window T1564.003, Browser Extensions T1176.001Sample rules (showing 8 of 19):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Office Macro File Download
- sigma VHD Image Download Via Browser
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
ends_with: \whoami.exe 18 rules
Top techniques:System Owner/User Discovery
T1033, Process Injection T1055, Web Service T1102, Exploitation for Privilege Escalation T1068, Exploitation for Client Execution T1203, Local Account T1087.001Sample rules (showing 8 of 18):
- sigma Suspicious Shells Spawn by Java Utility Keytool
- sigma Suspicious Child Process Of Manage Engine ServiceDesk
- sigma Suspicious Processes Spawned by Java.EXE
- sigma Potential Process Injection Via Msra.EXE
- sigma Suspicious Child Process Of Veeam Dabatase
- sigma Renamed Whoami Execution
- sigma Suspicious Spool Service Child Process
- sigma Suspicious Electron Application Child Processes
ends_with: \bash.exe 17 rules
Top techniques:Exploit Public-Facing Application
T1190, Web Shell T1505.003, Malicious File T1204.002, Process Injection T1055, Command and Scripting Interpreter T1059, Web Service T1102Sample rules (showing 8 of 17):
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma Suspicious Shells Spawn by Java Utility Keytool
- sigma Suspicious Child Process Of Manage Engine ServiceDesk
- sigma Shell Process Spawned by Java.EXE
- sigma MMC Spawning Windows Shell
- sigma Suspicious MSHTA Child Process
- sigma Suspicious Child Process Of SQL Server
ends_with: \sc.exe 17 rules
Top techniques:Windows Service
T1543.003, Disable or Modify Tools T1562.001, Services Registry Permissions Weakness T1574.011, Service Stop T1489, OS Credential Dumping T1003, Exploitation for Privilege Escalation T1068Sample rules (showing 8 of 17):
- sigma Disable Windows Defender AV Security Monitoring
- sigma Possible Privilege Escalation via Weak Service Permissions
- sigma New Service Creation Using Sc.EXE
- sigma Service StartupType Change Via Sc.EXE
- sigma New Kernel Driver Via SC.EXE
- sigma Interesting Service Enumeration Via Sc.EXE
- sigma Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
- sigma Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
ends_with: \winword.exe 17 rules
Top techniques:Malicious File
T1204.002, DLL T1574.001, Process Hollowing T1055.012, Visual Basic T1059.005, JavaScript T1059.007, Mshta T1218.005Sample rules (showing 8 of 17):
- sigma HackTool - CACTUSTORCH Remote Thread Creation
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma File With Uncommon Extension Created By An Office Application
- sigma Uncommon File Created In Office Startup Folder
- sigma Legitimate Application Dropped Archive
- sigma Suspicious LNK Double Extension File Created
- sigma DotNET Assembly DLL Loaded Via Office Application
ends_with: \excel.exe 16 rules
Top techniques:Malicious File
T1204.002, Process Hollowing T1055.012, Visual Basic T1059.005, JavaScript T1059.007, Mshta T1218.005, Process Injection T1055Sample rules (showing 8 of 16):
- sigma HackTool - CACTUSTORCH Remote Thread Creation
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma File With Uncommon Extension Created By An Office Application
- sigma Uncommon File Created In Office Startup Folder
- sigma Legitimate Application Dropped Archive
- sigma Suspicious LNK Double Extension File Created
- sigma DotNET Assembly DLL Loaded Via Office Application
ends_with: \netsh.exe 16 rules
Top techniques:Disable or Modify System Firewall
T1562.004, Network Sniffing T1040, Proxy T1090, System Network Configuration Discovery T1016, Netsh Helper DLL T1546.007, Rename Legitimate Utilities T1036.003Sample rules (showing 8 of 16):
- sigma New Firewall Rule Added Via Netsh.EXE
- sigma Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
- sigma RDP Connection Allowed Via Netsh.EXE
- sigma Firewall Rule Deleted Via Netsh.EXE
- sigma Firewall Disabled via Netsh.EXE
- sigma Netsh Allow Group Policy on Microsoft Defender Firewall
- sigma Firewall Configuration Discovery Via Netsh.EXE
- sigma Firewall Rule Update Via Netsh.EXE
ends_with: \outlook.exe 16 rules
Top techniques:Malicious File
T1204.002, Fallback Channels T1008, Office Application Startup T1137, Event Triggered Execution T1546, Process Injection T1055, Spearphishing Attachment T1566.001Sample rules (showing 8 of 16):
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Office Macro File Download
- sigma New Outlook Macro Created
- sigma Potential Persistence Via Outlook Form
- sigma Suspicious Outlook Macro Created
- sigma DotNET Assembly DLL Loaded Via Office Application
- sigma CLR DLL Loaded Via Office Applications
- sigma GAC DLL Loaded Via Office Applications
starts_with: C:\Windows\SysWOW64\ 16 rules
Top techniques:DLL
T1574.001, Inhibit System Recovery T1490, GUI Input Capture T1056.002, Regsvr32 T1218.010, Rundll32 T1218.011, Path Interception by Search Order Hijacking T1574.008Sample rules (showing 8 of 16):
- sigma WinSxS Executable File Creation By Non-System Process
- sigma UAC Bypass Using EventVwr
- sigma Potential Azure Browser SSO Abuse
- sigma CredUI.DLL Loaded By Uncommon Process
- sigma Suspicious Volume Shadow Copy Vssapi.dll Load
- sigma Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
- sigma Unsigned DLL Loaded by Windows Utility
- sigma Using SettingSyncHost.exe as LOLBin
starts_with: C:\Windows\System32\ 16 rules
Top techniques:DLL
T1574.001, Inhibit System Recovery T1490, GUI Input Capture T1056.002, Regsvr32 T1218.010, Rundll32 T1218.011, Path Interception by Search Order Hijacking T1574.008Sample rules (showing 8 of 16):
- sigma UAC Bypass Using EventVwr
- sigma Potential Azure Browser SSO Abuse
- sigma CredUI.DLL Loaded By Uncommon Process
- sigma Suspicious Volume Shadow Copy Vssapi.dll Load
- sigma Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
- sigma Unsigned DLL Loaded by Windows Utility
- sigma Using SettingSyncHost.exe as LOLBin
- sigma Suspicious Mshta.EXE Execution Patterns
ends_with: \msedgewebview2.exe 15 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Ingress Tool Transfer T1105, Gather Victim Network Information T1590, Spearphishing Attachment T1566.001Sample rules (showing 8 of 15):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Office Macro File Download
- sigma VHD Image Download Via Browser
- sigma Potential Azure Browser SSO Abuse
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
starts_with: C:\Program Files\ 15 rules
Top techniques:Inhibit System Recovery
T1490, Non-Standard Port T1571, Modify Registry T1112, Shortcut Modification T1547.009, GUI Input Capture T1056.002, DLL T1574.001Sample rules (showing 8 of 15):
- sigma Desktop.INI Created by Uncommon Process
- sigma CredUI.DLL Loaded By Uncommon Process
- sigma Suspicious Volume Shadow Copy VSS_PS.dll Load
- sigma Suspicious Volume Shadow Copy Vssapi.dll Load
- sigma Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
- sigma Potential 7za.DLL Sideloading
- sigma Python Image Load By Non-Python Process
- sigma Potentially Suspicious Malware Callback Communication
ends_with: \hh.exe 14 rules
Top techniques:System Binary Proxy Execution
T1218, Compiled HTML File T1218.001, Windows Management Instrumentation T1047, Regsvr32 T1218.010, Phishing T1566, Spearphishing Attachment T1566.001Sample rules (showing 8 of 14):
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Legitimate Application Dropped Archive
- sigma Legitimate Application Dropped Executable
- sigma Legitimate Application Writing Files In Uncommon Location
- sigma Legitimate Application Dropped Script
- sigma HH.EXE Execution
- sigma Remote CHM File Download/Execution Via HH.EXE
- sigma Suspicious HH.EXE Execution
match: :\Users\Public\ 14 rules
Top techniques:System Binary Proxy Execution
T1218, Disable or Modify Tools T1562.001, Ingress Tool Transfer T1105, Indirect Command Execution T1202, Command and Scripting Interpreter T1059, Data Encrypted for Impact T1486Sample rules (showing 8 of 14):
- sigma Remote Thread Creation In Mstsc.Exe From Suspicious Location
- sigma Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
- sigma Load Of RstrtMgr.DLL By A Suspicious Process
- sigma Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
- sigma Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
- sigma PsExec Tool Execution From Suspicious Locations - PipeName
- sigma Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
starts_with: C:\Program Files (x86)\ 14 rules
Top techniques:Inhibit System Recovery
T1490, Non-Standard Port T1571, Shortcut Modification T1547.009, GUI Input Capture T1056.002, DLL T1574.001, Software Packing T1027.002Sample rules (showing 8 of 14):
- sigma Desktop.INI Created by Uncommon Process
- sigma CredUI.DLL Loaded By Uncommon Process
- sigma Suspicious Volume Shadow Copy VSS_PS.dll Load
- sigma Suspicious Volume Shadow Copy Vssapi.dll Load
- sigma Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
- sigma Potential 7za.DLL Sideloading
- sigma Python Image Load By Non-Python Process
- sigma Potentially Suspicious Malware Callback Communication
ends_with: \MsMpEng.exe 13 rules
Top techniques:Remote Desktop Software
T1219.002, Web Service T1102, Dead Drop Resolver T1102.001, Disable or Modify Tools T1562.001, Impair Defenses T1562, Domain Trust Discovery T1482Sample rules (showing 8 of 13):
- sigma Windows Filtering Platform Blocked Connection From EDR Agent Binary
- sigma DNS Server Discovery Via LDAP Query
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma HackTool - SysmonEnte Execution
- sigma Potentially Suspicious GrantedAccess Flags On LSASS
ends_with: \calc.exe 13 rules
Top techniques:System Binary Proxy Execution
T1218, Indirect Command Execution T1202, Masquerading T1036, Trusted Developer Utilities Proxy Execution T1127, Visual Basic T1059.005, Web Service T1102Sample rules (showing 8 of 13):
- sigma Suspicious Child Process of AspNetCompiler
- sigma Suspicious Child Process Of BgInfo.EXE
- sigma Suspicious Calculator Usage
- sigma Potentially Suspicious Child Process Of ClickOnce Application
- sigma Suspicious Child Process Of Manage Engine ServiceDesk
- sigma Potential Provlaunch.EXE Binary Proxy Execution Abuse
- sigma Suspicious Provlaunch.EXE Child Process
- sigma Potentially Suspicious Child Process Of Regsvr32
ends_with: \maxthon.exe 13 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, Spearphishing Attachment T1566.001, Malware T1587.001Sample rules (showing 8 of 13):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Office Macro File Download
- sigma VHD Image Download Via Browser
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
ends_with: \powerpnt.exe 13 rules
Top techniques:Malicious File
T1204.002, Process Injection T1055, Phishing T1566, Spearphishing Attachment T1566.001, Hijack Execution Flow T1574, DLL T1574.001Sample rules (showing 8 of 13):
- sigma Remote Thread Creation By Uncommon Source Image
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma File With Uncommon Extension Created By An Office Application
- sigma Legitimate Application Dropped Archive
- sigma Suspicious LNK Double Extension File Created
- sigma DotNET Assembly DLL Loaded Via Office Application
- sigma CLR DLL Loaded Via Office Applications
- sigma GAC DLL Loaded Via Office Applications
ends_with: \seamonkey.exe 13 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, Spearphishing Attachment T1566.001, Malware T1587.001Sample rules (showing 8 of 13):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Office Macro File Download
- sigma VHD Image Download Via Browser
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
ends_with: \sh.exe 13 rules
Top techniques:Exploit Public-Facing Application
T1190, Web Shell T1505.003, Malicious File T1204.002, Command and Scripting Interpreter T1059, Web Service T1102, Distributed Component Object Model T1021.003Sample rules (showing 8 of 13):
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma Suspicious Shells Spawn by Java Utility Keytool
- sigma Suspicious Child Process Of Manage Engine ServiceDesk
- sigma Suspicious Processes Spawned by Java.EXE
- sigma MMC Spawning Windows Shell
- sigma Suspicious MSHTA Child Process
- sigma Suspicious Child Process Of SQL Server
- sigma Suspicious Microsoft OneNote Child Process
starts_with: C:\Windows\WinSxS\ 13 rules
Top techniques:DLL
T1574.001, Inhibit System Recovery T1490, Match Legitimate Resource Name or Location T1036.005, Masquerading T1036, Direct Volume Access T1006, Disable Windows Event Logging T1562.002Sample rules (showing 8 of 13):
- sigma WinSxS Executable File Creation By Non-System Process
- sigma Suspicious Volume Shadow Copy Vssapi.dll Load
- sigma Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
- sigma Potential Mpclient.DLL Sideloading
- sigma Potential Mpclient.DLL Sideloading Via Defender Binaries
- sigma Potential MsiExec Masquerading
- sigma System File Execution Location Anomaly
- sigma Wab Execution From Non Default Location
ends_with: \WMIC.exe 12 rules
Top techniques:Windows Management Instrumentation
T1047, System Information Discovery T1082, Automated Collection T1119, Impair Defenses T1562Sample rules (showing 8 of 12):
- sigma Recon Information for Export with Command Prompt
- sigma Potential Windows Defender Tampering Via Wmic.EXE
- sigma Windows Hotfix Updates Reconnaissance Via Wmic.EXE
- sigma Process Reconnaissance Via Wmic.EXE
- sigma Service Reconnaissance Via Wmic.EXE
- sigma Uncommon System Information Discovery Via Wmic.EXE
- sigma Potential Unquoted Service Path Reconnaissance Via Wmic.EXE
- sigma System Disk And Volume Reconnaissance Via Wmic.EXE
ends_with: \WindowsApps\MicrosoftEdge.exe 12 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, DLL T1574.001, System Network Configuration Discovery T1016Sample rules (showing 8 of 12):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Potential Azure Browser SSO Abuse
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Suspicious Network Connection to IP Lookup Service APIs
ends_with: \explorer.exe 12 rules
Top techniques:Process Injection
T1055, Boot or Logon Autostart Execution T1547, LSASS Memory T1003.001, Network Share Discovery T1135, Bypass User Account Control T1548.002, Phishing T1566Sample rules (showing 8 of 12):
- sigma Remote Thread Creation By Uncommon Source Image
- sigma Potential RipZip Attack on Startup Folder
- sigma Potentially Suspicious GrantedAccess Flags On LSASS
- sigma Potentially Suspicious Child Process Of ClickOnce Application
- sigma File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell
- sigma Explorer NOUACCHECK Flag
- sigma Arbitrary Binary Execution Using GUP Utility
- sigma Suspicious Microsoft OneNote Child Process
ends_with: \safari.exe 12 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, Spearphishing Attachment T1566.001, Malware T1587.001Sample rules (showing 8 of 12):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Office Macro File Download
- sigma VHD Image Download Via Browser
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
ends_with: \whale.exe 12 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, Spearphishing Attachment T1566.001, Malware T1587.001Sample rules (showing 8 of 12):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Office Macro File Download
- sigma VHD Image Download Via Browser
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
eq: C:\Program Files\Google\Chrome\Application\chrome.exe 12 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, File Deletion T1070.004, System Network Configuration Discovery T1016Sample rules (showing 8 of 12):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma ADS Zone.Identifier Deleted By Uncommon Application
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Suspicious Network Connection to IP Lookup Service APIs
eq: C:\Program Files\Mozilla Firefox\firefox.exe 12 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, File Deletion T1070.004, System Network Configuration Discovery T1016Sample rules (showing 8 of 12):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma ADS Zone.Identifier Deleted By Uncommon Application
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Suspicious Network Connection to IP Lookup Service APIs
match: :\Temp\ 12 rules
Top techniques:System Binary Proxy Execution
T1218, Disable or Modify Tools T1562.001, Ingress Tool Transfer T1105, Indirect Command Execution T1202, OS Credential Dumping T1003, LSASS Memory T1003.001Sample rules (showing 8 of 12):
- sigma Remote Thread Creation In Mstsc.Exe From Suspicious Location
- sigma Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
- sigma Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
- sigma Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
- sigma Suspicious Child Process of AspNetCompiler
- sigma Suspicious Child Process Of BgInfo.EXE
- sigma HackTool - LaZagne Execution
ends_with: \chrome.exe 11 rules
Top techniques:Ingress Tool Transfer
T1105, Hidden Window T1564.003, Browser Extensions T1176.001, Domain Trust Discovery T1482, Spearphishing Attachment T1566.001, Malware T1587.001Sample rules (showing 8 of 11):
- sigma DNS Server Discovery Via LDAP Query
- sigma Office Macro File Download
- sigma VHD Image Download Via Browser
- sigma Browser Execution In Headless Mode
- sigma File Download with Headless Browser
- sigma Chromium Browser Instance Executed With Custom Extension
- sigma Chromium Browser Headless Execution To Mockbin Like Site
- sigma Suspicious Chromium Browser Instance Executed With Custom Extension
ends_with: \findstr.exe 11 rules
Top techniques:Group Policy Preferences
T1552.006, Security Software Discovery T1518.001, Process Injection T1055, Ingress Tool Transfer T1105, System Binary Proxy Execution T1218, Steganography T1027.003Sample rules (showing 8 of 11):
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Legitimate Application Writing Files In Uncommon Location
- sigma Findstr GPP Passwords
- sigma Findstr Launching .lnk File
- sigma LSASS Process Reconnaissance Via Findstr.EXE
- sigma Permission Misconfiguration Reconnaissance Via Findstr.EXE
- sigma Security Tools Keyword Lookup Via Findstr.EXE
- sigma Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE
ends_with: \forfiles.exe 11 rules
Top techniques:Command and Scripting Interpreter
T1059, Malicious File T1204.002, Process Injection T1055, Web Service T1102, Phishing T1566, Spearphishing Attachment T1566.001Sample rules (showing 8 of 11):
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma Forfiles Command Execution
- sigma Suspicious Shells Spawn by Java Utility Keytool
- sigma Suspicious Child Process Of Manage Engine ServiceDesk
- sigma Suspicious Processes Spawned by Java.EXE
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Outlook Child Process
ends_with: \notepad.exe 11 rules
Top techniques:System Binary Proxy Execution
T1218, Process Injection T1055, Trusted Developer Utilities Proxy Execution T1127, Visual Basic T1059.005, Indirect Command Execution T1202, Web Service T1102Sample rules (showing 8 of 11):
- sigma Legitimate Application Dropped Archive
- sigma Network Connection Initiated Via Notepad.EXE
- sigma Suspicious Child Process of AspNetCompiler
- sigma Suspicious Child Process Of BgInfo.EXE
- sigma Potentially Suspicious Child Process Of ClickOnce Application
- sigma Suspicious Child Process Of Manage Engine ServiceDesk
- sigma Notepad Password Files Discovery
- sigma Potential Provlaunch.EXE Binary Proxy Execution Abuse
ends_with: \odbcconf.exe 11 rules
Top techniques:Odbcconf
T1218.008, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Malicious File T1204.002, Regsvr32 T1218.010Sample rules (showing 8 of 11):
- sigma Amsi.DLL Loaded Via LOLBIN Process
- sigma Driver/DLL Installation Via Odbcconf.EXE
- sigma Suspicious Driver/DLL Installation Via Odbcconf.EXE
- sigma Odbcconf.EXE Suspicious DLL Location
- sigma New DLL Registered Via Odbcconf.EXE
- sigma Potentially Suspicious DLL Registered Via Odbcconf.EXE
- sigma Response File Execution Via Odbcconf.EXE
- sigma Suspicious Response File Execution Via Odbcconf.EXE
eq: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 11 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, File Deletion T1070.004, System Network Configuration Discovery T1016Sample rules (showing 8 of 11):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma ADS Zone.Identifier Deleted By Uncommon Application
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Suspicious Network Connection to IP Lookup Service APIs
eq: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 11 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, File Deletion T1070.004, DLL T1574.001Sample rules (showing 8 of 11):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma ADS Zone.Identifier Deleted By Uncommon Application
- sigma Potential Azure Browser SSO Abuse
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
eq: C:\Program Files (x86)\Mozilla Firefox\firefox.exe 11 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, File Deletion T1070.004, System Network Configuration Discovery T1016Sample rules (showing 8 of 11):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma ADS Zone.Identifier Deleted By Uncommon Application
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Suspicious Network Connection to IP Lookup Service APIs
eq: C:\Program Files\Internet Explorer\iexplore.exe 11 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Process Injection T1055, Gather Victim Network Information T1590, DLL T1574.001Sample rules (showing 8 of 11):
- sigma Remote Thread Creation By Uncommon Source Image
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Potential Azure Browser SSO Abuse
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
eq: C:\Program Files\Microsoft\Edge\Application\msedge.exe 11 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, File Deletion T1070.004, DLL T1574.001Sample rules (showing 8 of 11):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma ADS Zone.Identifier Deleted By Uncommon Application
- sigma Potential Azure Browser SSO Abuse
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
starts_with: C:\Program Files (x86)\Microsoft\EdgeCore\ 11 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Ingress Tool Transfer T1105, Gather Victim Network Information T1590, DLL T1574.001Sample rules (showing 8 of 11):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Potential Azure Browser SSO Abuse
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Suspicious Network Connection to IP Lookup Service APIs
starts_with: C:\Program Files\Microsoft\EdgeCore\ 11 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Ingress Tool Transfer T1105, Gather Victim Network Information T1590, DLL T1574.001Sample rules (showing 8 of 11):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Potential Azure Browser SSO Abuse
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Suspicious Network Connection to IP Lookup Service APIs
ends_with: \OfficeClickToRun.exe 10 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001, Modify Registry T1112, Malware T1587.001, Add-ins T1137.006, Component Object Model Hijacking T1546.015Sample rules (showing 8 of 10):
- sigma Uncommon File Created In Office Startup Folder
- sigma Common Autorun Keys Modification
- sigma CurrentVersion Autorun Keys Modification
- sigma CurrentVersion NT Autorun Keys Modification
- sigma Office Autorun Keys Modification
- sigma Wow6432Node CurrentVersion Autorun Keys Modification
- sigma Uncommon Microsoft Office Trusted Location Added
- sigma Potential Persistence Via Visual Studio Tools for Office
ends_with: \certoc.exe 10 rules
Top techniques:System Binary Proxy Execution
T1218, Ingress Tool Transfer T1105, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Malicious File T1204.002Sample rules (showing 8 of 10):
- sigma Legitimate Application Dropped Archive
- sigma Legitimate Application Dropped Executable
- sigma Legitimate Application Writing Files In Uncommon Location
- sigma Legitimate Application Dropped Script
- sigma File Download via CertOC.EXE
- sigma File Download From IP Based URL Via CertOC.EXE
- sigma DLL Loaded via CertOC.EXE
- sigma Suspicious DLL Loaded via CertOC.EXE
ends_with: \msdt.exe 10 rules
Top techniques:Indirect Command Execution
T1202, System Binary Proxy Execution T1218, Malicious File T1204.002, Registry Run Keys / Startup Folder T1547.001, Masquerading T1036, Phishing T1566Sample rules (showing 8 of 10):
- sigma File Creation In Suspicious Directory By Msdt.EXE
- sigma Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
- sigma MSDT Execution Via Answer File
- sigma Potential Arbitrary Command Execution Using Msdt.EXE
- sigma Suspicious Cabinet File Execution Via Msdt.EXE
- sigma Suspicious MSDT Parent Process
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Outlook Child Process
eq: C:\Program Files (x86)\Internet Explorer\iexplore.exe 10 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, DLL T1574.001, System Network Configuration Discovery T1016Sample rules (showing 8 of 10):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Potential Azure Browser SSO Abuse
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Suspicious Network Connection to IP Lookup Service APIs
starts_with: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ 10 rules
Top techniques:Web Service
T1102, Remote Desktop Software T1219.002, Dead Drop Resolver T1102.001, Gather Victim Network Information T1590, DLL T1574.001, System Network Configuration Discovery T1016Sample rules (showing 8 of 10):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Suspicious DNS Query for IP Lookup Service APIs
- sigma Potential Azure Browser SSO Abuse
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Suspicious Network Connection to IP Lookup Service APIs
ends_with: \cmstp.exe 9 rules
Top techniques:CMSTP
T1218.003, Process Injection T1055, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Malicious File T1204.002Sample rules (showing 8 of 9):
- sigma DLL Loaded From Suspicious Location Via Cmspt.EXE
- sigma DotNet CLR DLL Loaded By Scripting Applications
- sigma Outbound Network Connection Initiated By Cmstp.EXE
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma Potential Defense Evasion Via Rename Of Highly Relevant Binaries
- sigma LOLBIN Execution From Abnormal Drive
- sigma System File Execution Location Anomaly
ends_with: \finger.exe 9 rules
Top techniques:System Binary Proxy Execution
T1218, Windows Command Shell T1059.003, DNS T1071.004, Ingress Tool Transfer T1105, Rename Legitimate Utilities T1036.003, Masquerading T1036Sample rules (showing 8 of 9):
- sigma DNS Query by Finger Utility
- sigma Legitimate Application Dropped Archive
- sigma Legitimate Application Dropped Executable
- sigma Legitimate Application Writing Files In Uncommon Location
- sigma Legitimate Application Dropped Script
- sigma Network Connection Initiated via Finger.EXE
- sigma Finger.EXE Execution
- sigma Potential Defense Evasion Via Rename Of Highly Relevant Binaries
ends_with: \nltest.exe 9 rules
Top techniques:Exploit Public-Facing Application
T1190, Web Shell T1505.003, System Network Configuration Discovery T1016, Domain Trust Discovery T1482, Remote System Discovery T1018, Regsvr32 T1218.010Sample rules (showing 8 of 9):
- sigma Potentially Suspicious Child Process Of ClickOnce Application
- sigma Suspicious Child Process Of SQL Server
- sigma Suspicious Child Process Of Veeam Dabatase
- sigma Nltest.EXE Execution
- sigma Potential Recon Activity Via Nltest.EXE
- sigma Potentially Suspicious Child Process Of Regsvr32
- sigma Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
- sigma Suspicious Spool Service Child Process
ends_with: \systeminfo.exe 9 rules
Top techniques:Web Shell
T1505.003, Web Service T1102, Exploit Public-Facing Application T1190, Exploitation for Privilege Escalation T1068, Exploitation for Client Execution T1203, System Binary Proxy Execution T1218Sample rules (showing 8 of 9):
- sigma Suspicious Shells Spawn by Java Utility Keytool
- sigma Suspicious Child Process Of Manage Engine ServiceDesk
- sigma Suspicious Processes Spawned by Java.EXE
- sigma Suspicious Child Process Of SQL Server
- sigma Suspicious Spool Service Child Process
- sigma Execution via stordiag.exe
- sigma Suspicious Execution of Systeminfo
- sigma Webshell Detection With Command Line Keywords
eq: C:\Windows\explorer.exe 9 rules
Top techniques:Inhibit System Recovery
T1490, Process Injection T1055, File Deletion T1070.004, GUI Input Capture T1056.002, System Script Proxy Execution T1216, Scheduled Task/Job T1053Sample rules (showing 8 of 9):
- sigma Remote Thread Creation By Uncommon Source Image
- sigma ADS Zone.Identifier Deleted By Uncommon Application
- sigma CredUI.DLL Loaded By Uncommon Process
- sigma Suspicious Volume Shadow Copy Vssapi.dll Load
- sigma Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
- sigma Suspicious CustomShellHost Execution
- sigma Internet Explorer DisableFirstRunCustomize Enabled
- sigma Potential Persistence Via TypedPaths
match: :\Windows\Temp\ 9 rules
Top techniques:Indirect Command Execution
T1202, System Binary Proxy Execution T1218, Ingress Tool Transfer T1105, Service Execution T1569.002, Trusted Developer Utilities Proxy Execution T1127, Visual Basic T1059.005Sample rules (showing 8 of 9):
- sigma Remote Thread Creation In Mstsc.Exe From Suspicious Location
- sigma Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
- sigma PsExec Tool Execution From Suspicious Locations - PipeName
- sigma Suspicious Child Process of AspNetCompiler
- sigma Suspicious Child Process Of BgInfo.EXE
- sigma HackTool - LaZagne Execution
- sigma Execution of Suspicious File Type Extension
- sigma Potentially Suspicious Child Process Of VsCode
match: \AppData\ 9 rules
Top techniques:NTDS
T1003.003, Security Account Manager T1003.002, Scheduled Task/Job T1053, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047Sample rules (showing 8 of 9):
- sigma NTDS.DIT Creation By Uncommon Process
- sigma Suspicious Scheduled Task Write to System32 Tasks
- sigma HackTool - LaZagne Execution
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma Remote Access Tool - Anydesk Execution From Suspicious Folder
- sigma Suspicious Process Patterns NTDS.DIT Exfil
- sigma Use Short Name Path in Image
match: \AppData\Local\Temp\ 9 rules
Top techniques:DLL
T1574.001, Service Execution T1569.002, Trusted Developer Utilities Proxy Execution T1127, Bypass User Account Control T1548.002, Indirect Command Execution T1202, System Binary Proxy Execution T1218Sample rules (showing 8 of 9):
- sigma Unsigned Binary Loaded From Suspicious Location
- sigma Remote Thread Creation In Mstsc.Exe From Suspicious Location
- sigma Potential Persistence Via Notepad++ Plugins
- sigma PsExec Tool Execution From Suspicious Locations - PipeName
- sigma Suspicious Child Process of AspNetCompiler
- sigma Suspicious Electron Application Child Processes
- sigma UAC Bypass Using IEInstal - Process
- sigma Suspicious WindowsTerminal Child Processes
ends_with: \WerFault.exe 8 rules
Top techniques:Masquerading
T1036, Windows Management Instrumentation T1047, LSASS Memory T1003.001, Rundll32 T1218.011, Abuse Elevation Control Mechanism T1548, Bypass User Account Control T1548.002Sample rules:
- sigma Credential Dumping Attempt Via WerFault
- sigma Bad Opsec Defaults Sacrificial Processes With Improper Arguments
- sigma Suspicious Process Parents
- sigma UAC Bypass via Windows Firewall Snap-In Hijack
- sigma UAC Bypass via ICMLuaUtil
- sigma Potential ReflectDebugger Content Execution Via WerFault.EXE
- sigma WmiPrvSE Spawned A Process
- sigma Suspicious WmiPrvSE Child Process
ends_with: \dllhost.exe 8 rules
Top techniques:Masquerading
T1036, Inhibit System Recovery T1490, Process Injection T1055, Remote Desktop Software T1219.002, Windows Management Instrumentation T1047Sample rules:
- sigma Windows Binaries Write Suspicious Extensions
- sigma Suspicious Volume Shadow Copy VSS_PS.dll Load
- sigma Suspicious Network Connection Binary No CommandLine
- sigma Dllhost.EXE Execution Anomaly
- sigma Potentially Suspicious Execution Of PDQDeployRunner
- sigma Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
- sigma Script Event Consumer Spawning Process
- sigma System File Execution Location Anomaly
ends_with: \esentutl.exe 8 rules
Top techniques:System Binary Proxy Execution
T1218, Process Injection T1055, Ingress Tool Transfer T1105, Security Account Manager T1003.002, NTDS T1003.003, Data from Local System T1005Sample rules:
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Legitimate Application Dropped Archive
- sigma Legitimate Application Dropped Executable
- sigma Legitimate Application Writing Files In Uncommon Location
- sigma Legitimate Application Dropped Script
- sigma Copying Sensitive Files with Credential Data
- sigma Esentutl Steals Browser Information
- sigma Potential Browser Data Stealing
ends_with: \find.exe 8 rules
Top techniques:Group Policy Preferences
T1552.006, Security Software Discovery T1518.001, Process Injection T1055, Steganography T1027.003, Masquerading T1036, Indirect Command Execution T1202Sample rules:
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Findstr GPP Passwords
- sigma Findstr Launching .lnk File
- sigma LSASS Process Reconnaissance Via Findstr.EXE
- sigma Permission Misconfiguration Reconnaissance Via Findstr.EXE
- sigma Security Tools Keyword Lookup Via Findstr.EXE
- sigma Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE
- sigma Webshell Detection With Command Line Keywords
ends_with: \regedit.exe 8 rules
Top techniques:Query Registry
T1012, Modify Registry T1112, NTFS File Attributes T1564.004, Abuse Elevation Control Mechanism T1548, Rename Legitimate Utilities T1036.003Sample rules:
- sigma Exports Registry Key To an Alternate Data Stream
- sigma PDF File Created By RegEdit.EXE
- sigma Exports Critical Registry Keys To a File
- sigma Exports Registry Key To a File
- sigma Imports Registry Key From a File
- sigma Imports Registry Key From an ADS
- sigma Regedit as Trusted Installer
- sigma Potential PendingFileRenameOperations Tampering
ends_with: \scrcons.exe 8 rules
Top techniques:Windows Management Instrumentation
T1047, Malicious File T1204.002, Windows Management Instrumentation Event Subscription T1546.003, Web Service T1102, Phishing T1566, Spearphishing Attachment T1566.001Sample rules:
- sigma WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
- sigma WMI Event Consumer Created Named Pipe
- sigma Suspicious Shells Spawn by Java Utility Keytool
- sigma Suspicious Child Process Of Manage Engine ServiceDesk
- sigma Suspicious Processes Spawned by Java.EXE
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Outlook Child Process
- sigma Suspicious Microsoft Office Child Process
ends_with: \scriptrunner.exe 8 rules
Top techniques:Malicious File
T1204.002, Command and Scripting Interpreter T1059, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Regsvr32 T1218.010Sample rules:
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma Suspicious Shells Spawn by Java Utility Keytool
- sigma Suspicious Processes Spawned by Java.EXE
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Outlook Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma Potentially Suspicious Execution Of PDQDeployRunner
- sigma Suspicious Serv-U Process Pattern
ends_with: \wsl.exe 8 rules
Top techniques:Exploit Public-Facing Application
T1190, Security Account Manager T1003.002, NTDS T1003.003, Web Shell T1505.003, Masquerading T1036, Web Protocols T1071.001Sample rules:
- sigma NTDS.DIT Creation By Uncommon Process
- sigma Suspicious Child Process Of SQL Server
- sigma Suspicious Child Process Of Veeam Dabatase
- sigma Potentially Suspicious Execution Of PDQDeployRunner
- sigma System File Execution Location Anomaly
- sigma Visual Studio Code Tunnel Shell Execution
- sigma Suspicious Processes Spawned by WinRM
- sigma Installation of WSL Kali-Linux
eq: System 8 rules
Top techniques:SMB/Windows Admin Shares
T1021.002, Distributed Component Object Model T1021.003, Web Shell T1505.003, Windows Management Instrumentation T1047, Direct Volume Access T1006, Scheduled Task/Job T1053Sample rules:
- sigma Potential DCOM InternetExplorer.Application DLL Hijack
- sigma Potentially Suspicious WDAC Policy File Creation
- sigma Potential Webshell Creation On Static Website
- sigma Wmiprvse Wbemcomn DLL Hijack - File
- sigma Execution Of Non-Existing File
- sigma Execution of Suspicious File Type Extension
- sigma Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
- sigma Scheduled TaskCache Change by Uncommon Program
match: \Downloads\ 8 rules
Top techniques:DLL
T1574.001, Service Execution T1569.002, LSASS Memory T1003.001, Disable or Modify Tools T1562.001, Python T1059.006, Indirect Command Execution T1202Sample rules:
- sigma Unsigned Binary Loaded From Suspicious Location
- sigma PsExec Tool Execution From Suspicious Locations - PipeName
- sigma Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
- sigma HackTool - LaZagne Execution
- sigma Suspicious File Characteristics Due to Missing Fields
- sigma Suspicious WindowsTerminal Child Processes
- sigma WSL Child Process Anomaly
- sigma Suspicious Run Key from Download
match: \Users\Public\ 8 rules
Top techniques:DLL
T1574.001, Trusted Developer Utilities Proxy Execution T1127, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Malicious File T1204.002Sample rules:
- sigma Unsigned Binary Loaded From Suspicious Location
- sigma Suspicious Child Process of AspNetCompiler
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma Suspicious Electron Application Child Processes
- sigma Suspicious Service Binary Directory
- sigma Service Binary in Suspicious Folder
- sigma Potential PendingFileRenameOperations Tampering
starts_with: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ 8 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001, Add-ins T1137.006, Modify Registry T1112, Component Object Model Hijacking T1546.015Sample rules:
- sigma Common Autorun Keys Modification
- sigma CurrentVersion Autorun Keys Modification
- sigma CurrentVersion NT Autorun Keys Modification
- sigma Office Autorun Keys Modification
- sigma Wow6432Node CurrentVersion Autorun Keys Modification
- sigma Potential Persistence Via Visual Studio Tools for Office
- sigma Potential Persistence Via Outlook Today Page
- sigma COM Hijacking via TreatAs
ends_with: \TiWorker.exe 7 rules
Top techniques:Disable Windows Event Logging
T1562.002, Screensaver T1546.002, Match Legitimate Resource Name or Location T1036.005, DLL T1574.001, Modify Registry T1112, Registry Run Keys / Startup Folder T1547.001Sample rules:
- sigma Suspicious Screensaver Binary File Creation
- sigma Files With System Process Name In Unsuspected Locations
- sigma Potential System DLL Sideloading From Non System Locations
- sigma Change Winevt Channel Access Permission Via Registry
- sigma Windows Event Log Access Tampering Via Registry
- sigma Disable Windows Event Logging Via Registry
- sigma Scheduled TaskCache Change by Uncommon Program
ends_with: \conhost.exe 7 rules
ends_with: \livekd.exe 7 rules
Top techniques:Tool
T1588.002, Match Legitimate Resource Name or Location T1036.005, Indirect Command Execution T1202, System Binary Proxy Execution T1218Sample rules:
- sigma LiveKD Driver Creation
- sigma LiveKD Driver Creation By Uncommon Process
- sigma Potential Memory Dumping Activity Via LiveKD
- sigma Kernel Memory Dump Via LiveKD
- sigma Potential Binary Impersonating Sysinternals Tools
- sigma Suspicious Execution Of Renamed Sysinternals Tools - Registry
- sigma Usage of Renamed Sysinternals Tools - RegistrySet
ends_with: \msbuild.exe 7 rules
Top techniques:Malicious File
T1204.002, Windows Management Instrumentation T1047, Process Injection T1055, Command and Scripting Interpreter T1059, MSBuild T1127.001, Phishing T1566Sample rules:
- sigma Rare Remote Thread Creation By Uncommon Source Image
- sigma Windows Shell/Scripting Application File Write to Suspicious Folder
- sigma Silenttrinity Stager Msbuild Activity
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Outlook Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma Script Event Consumer Spawning Process
ends_with: \mspub.exe 7 rules
Sample rules:
- sigma File With Uncommon Extension Created By An Office Application
- sigma Legitimate Application Dropped Archive
- sigma DotNET Assembly DLL Loaded Via Office Application
- sigma CLR DLL Loaded Via Office Applications
- sigma GAC DLL Loaded Via Office Applications
- sigma PowerShell Core DLL Loaded Via Office Application
- sigma VBA DLL Loaded Via Office Application
ends_with: \msxsl.exe 7 rules
Top techniques:XSL Script Processing
T1220, Process Injection T1055, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Malicious File T1204.002Sample rules:
- sigma DotNet CLR DLL Loaded By Scripting Applications
- sigma Msxsl.EXE Execution
- sigma Remote XSL Execution Via Msxsl.EXE
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma Potential Defense Evasion Via Rename Of Highly Relevant Binaries
- sigma Suspicious ShellExec_RunDLL Call Via Ordinal
ends_with: \thor.exe 7 rules
Top techniques:Remote Desktop Protocol
T1021.001, Internal Proxy T1090.001, External Proxy T1090.002, PowerShell T1059.001, Inhibit System Recovery T1490, DLL T1574.001Sample rules:
- sigma RDP over Reverse SSH Tunnel WFP
- sigma PowerShell Core DLL Loaded By Non PowerShell Process
- sigma Suspicious Volume Shadow Copy VSS_PS.dll Load
- sigma Suspicious Unsigned Thor Scanner Execution
- sigma Outbound RDP Connections Over Non-Standard Tools
- sigma Potentially Suspicious GrantedAccess Flags On LSASS
- sigma Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
eq: C:\Windows\System32\poqexec.exe 7 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001, Netsh Helper DLL T1546.007, OS Credential Dumping T1003, Windows Service T1543.003, SIP and Trust Provider Hijacking T1553.003Sample rules:
- sigma Common Autorun Keys Modification
- sigma CurrentControlSet Autorun Keys Modification
- sigma CurrentVersion NT Autorun Keys Modification
- sigma Potential Persistence Via Netsh Helper DLL - Registry
- sigma Potential Credential Dumping Attempt Using New NetworkProvider - REG
- sigma ServiceDll Hijack
- sigma Persistence Via New SIP Provider
match: :\Perflogs\ 7 rules
Top techniques:Disable or Modify Tools
T1562.001, Ingress Tool Transfer T1105, Command and Scripting Interpreter T1059, Data Encrypted for Impact T1486, OS Credential Dumping T1003, LSASS Memory T1003.001Sample rules:
- sigma Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
- sigma Load Of RstrtMgr.DLL By A Suspicious Process
- sigma Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
- sigma Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
- sigma Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
- sigma Process Execution From A Potentially Suspicious Folder
match: :\Windows\SysWOW64\ 7 rules
Top techniques:Masquerading
T1036, Disable Windows Event Logging T1562.002, LSASS Memory T1003.001, Native API T1106, Bypass User Account Control T1548.002Sample rules:
- sigma HackTool - SysmonEnte Execution
- sigma Potentially Suspicious GrantedAccess Flags On LSASS
- sigma Potential Direct Syscall of NtOpenProcess
- sigma UAC Bypass Using WOW64 Logger DLL Hijack
- sigma Suspicious Calculator Usage
- sigma Forfiles.EXE Child Process Masquerading
- sigma Potential PowerShell Execution Policy Tampering
match: \Windows\Temp\ 7 rules
Top techniques:System Binary Proxy Execution
T1218, Command and Scripting Interpreter T1059, LSASS Memory T1003.001, Disable or Modify Tools T1562.001, Phishing T1566, Spearphishing Attachment T1566.001Sample rules:
- sigma Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
- sigma Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma Potential Provlaunch.EXE Binary Proxy Execution Abuse
- sigma Suspicious Provlaunch.EXE Child Process
- sigma Suspicious Electron Application Child Processes
starts_with: C:\ProgramData\Microsoft\Windows Defender\Platform\ 7 rules
Sample rules:
- sigma Potential Mpclient.DLL Sideloading
- sigma Potential Mpclient.DLL Sideloading Via Defender Binaries
- sigma Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
- sigma Delete Defender Scan ShellEx Context Menu Registry Key
- sigma Removal Of AMSI Provider Registry Keys
- sigma Potential AutoLogger Sessions Tampering
- sigma Disable Tamper Protection on Windows Defender
starts_with: C:\Users\ 7 rules
Top techniques:Web Service
T1102, Dead Drop Resolver T1102.001, Shortcut Modification T1547.009, GUI Input Capture T1056.002, Data Encrypted for Impact T1486, Disable or Modify Tools T1562.001Sample rules:
- sigma Desktop.INI Created by Uncommon Process
- sigma Potential Persistence Via Notepad++ Plugins
- sigma CredUI.DLL Loaded By Uncommon Process
- sigma Load Of RstrtMgr.DLL By An Uncommon Process
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
ends_with: \ADExplorer.exe 6 rules
Top techniques:Domain Groups
T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482, Tool T1588.002, Match Legitimate Resource Name or Location T1036.005, Indirect Command Execution T1202Sample rules:
- sigma ADExplorer Writing Complete AD Snapshot Into .dat File
- sigma Active Directory Database Snapshot Via ADExplorer
- sigma Suspicious Active Directory Database Snapshot Via ADExplorer
- sigma Potential Binary Impersonating Sysinternals Tools
- sigma Suspicious Execution Of Renamed Sysinternals Tools - Registry
- sigma Usage of Renamed Sysinternals Tools - RegistrySet
ends_with: \ADExplorer64.exe 6 rules
Top techniques:Domain Groups
T1069.002, Domain Account T1087.002, Domain Trust Discovery T1482, Tool T1588.002, Match Legitimate Resource Name or Location T1036.005, Indirect Command Execution T1202Sample rules:
- sigma ADExplorer Writing Complete AD Snapshot Into .dat File
- sigma Active Directory Database Snapshot Via ADExplorer
- sigma Suspicious Active Directory Database Snapshot Via ADExplorer
- sigma Potential Binary Impersonating Sysinternals Tools
- sigma Suspicious Execution Of Renamed Sysinternals Tools - Registry
- sigma Usage of Renamed Sysinternals Tools - RegistrySet
ends_with: \AppVLP.exe 6 rules
Top techniques:Malicious File
T1204.002, Web Service T1102, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Regsvr32 T1218.010Sample rules:
ends_with: \firefox.exe 6 rules
ends_with: \mftrace.exe 6 rules
Top techniques:Malicious File
T1204.002, Web Service T1102, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Regsvr32 T1218.010Sample rules:
ends_with: \mmc.exe 6 rules
ends_with: \onenote.exe 6 rules
Top techniques:Malicious File
T1204.002Sample rules:
ends_with: \onenoteim.exe 6 rules
Top techniques:Malicious File
T1204.002Sample rules:
ends_with: \ping.exe 6 rules
ends_with: \procdump.exe 6 rules
ends_with: \procexp.exe 6 rules
Top techniques:Tool
T1588.002, Exploitation for Privilege Escalation T1068, GUI Input Capture T1056.002, Match Legitimate Resource Name or Location T1036.005, Indirect Command Execution T1202, System Binary Proxy Execution T1218Sample rules:
- sigma Process Explorer Driver Creation By Non-Sysinternals Binary
- sigma CredUI.DLL Loaded By Uncommon Process
- sigma Potential Binary Impersonating Sysinternals Tools
- sigma Suspicious Execution Of Renamed Sysinternals Tools - Registry
- sigma Usage of Renamed Sysinternals Tools - RegistrySet
- sigma Suspicious Service Installed
ends_with: \procexp64.exe 6 rules
Top techniques:Tool
T1588.002, Exploitation for Privilege Escalation T1068, GUI Input Capture T1056.002, Match Legitimate Resource Name or Location T1036.005, Indirect Command Execution T1202, System Binary Proxy Execution T1218Sample rules:
- sigma Process Explorer Driver Creation By Non-Sysinternals Binary
- sigma CredUI.DLL Loaded By Uncommon Process
- sigma Potential Binary Impersonating Sysinternals Tools
- sigma Suspicious Execution Of Renamed Sysinternals Tools - Registry
- sigma Usage of Renamed Sysinternals Tools - RegistrySet
- sigma Suspicious Service Installed
ends_with: \thor64.exe 6 rules
Top techniques:Remote Desktop Protocol
T1021.001, Internal Proxy T1090.001, External Proxy T1090.002, PowerShell T1059.001, Inhibit System Recovery T1490, DLL T1574.001Sample rules:
- sigma RDP over Reverse SSH Tunnel WFP
- sigma PowerShell Core DLL Loaded By Non PowerShell Process
- sigma Suspicious Volume Shadow Copy VSS_PS.dll Load
- sigma Suspicious Unsigned Thor Scanner Execution
- sigma Outbound RDP Connections Over Non-Standard Tools
- sigma Potentially Suspicious GrantedAccess Flags On LSASS
ends_with: \w3wp.exe 6 rules
ends_with: \wbadmin.exe 6 rules
Sample rules:
ends_with: \wevtutil.exe 6 rules
Top techniques:Account Discovery
T1087, Remote Desktop Software T1219.002, Rename Legitimate Utilities T1036.003, Exploitation for Privilege Escalation T1068, Exploitation for Client Execution T1203, Clear Windows Event Logs T1070.001Sample rules:
- sigma Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
- sigma Potential Defense Evasion Via Binary Rename
- sigma Suspicious Spool Service Child Process
- sigma Suspicious Eventlog Clearing or Configuration Change Activity
- sigma Potentially Suspicious EventLog Recon Activity Using Log Query Utilities
- sigma Webshell Detection With Command Line Keywords
ends_with: \wget.exe 6 rules
Top techniques:Exploitation for Privilege Escalation
T1068, Exploitation for Client Execution T1203, PowerShell T1059.001, Ingress Tool Transfer T1105, Stage Capabilities T1608Sample rules:
- sigma Suspicious Spool Service Child Process
- sigma Potential Data Exfiltration Activity Via CommandLine Tools
- sigma Suspicious Download from Office Domain
- sigma Suspicious File Download From IP Via Wget.EXE
- sigma Suspicious File Download From File Sharing Domain Via Wget.EXE
- sigma Suspicious File Download From IP Via Wget.EXE - Paths
ends_with: \wordview.exe 6 rules
Top techniques:System Binary Proxy Execution
T1218, Ingress Tool Transfer T1105, Exploitation for Client Execution T1203Sample rules:
- sigma Legitimate Application Dropped Archive
- sigma Legitimate Application Dropped Executable
- sigma Legitimate Application Writing Files In Uncommon Location
- sigma Legitimate Application Dropped Script
- sigma Office Application Initiated Network Connection To Non-Local IP
- sigma Office Application Initiated Network Connection Over Uncommon Ports
eq: C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe 6 rules
eq: C:\Program Files\Microsoft Office\root\integration\integrator.exe 6 rules
match: :\Program Files\ 6 rules
match: :\Windows\System32\ 6 rules
match: \Desktop\ 6 rules
match: \Favorites\ 6 rules
Top techniques:Disable or Modify Tools
T1562.001, Command and Scripting Interpreter T1059, Data Encrypted for Impact T1486, OS Credential Dumping T1003, Ingress Tool Transfer T1105, LSASS Memory T1003.001Sample rules:
- sigma Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
- sigma Load Of RstrtMgr.DLL By A Suspicious Process
- sigma Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
- sigma Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
- sigma HackTool - LaZagne Execution
ends_with: \AnyDesk.exe 5 rules
Top techniques:Remote Desktop Software
T1219.002Sample rules:
ends_with: \CertReq.exe 5 rules
ends_with: \InstallUtil.exe 5 rules
ends_with: \MpCmdRun.exe 5 rules
ends_with: \MsSense.exe 5 rules
Top techniques:Remote Desktop Software
T1219.002, Web Service T1102, Dead Drop Resolver T1102.001, Impair Defenses T1562Sample rules:
- sigma Windows Filtering Platform Blocked Connection From EDR Agent Binary
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
ends_with: \WINWORD.exe 5 rules
Top techniques:Indirect Command Execution
T1202, Office Application Startup T1137, Rename Legitimate Utilities T1036.003Sample rules:
ends_with: \csc.exe 5 rules
ends_with: \eqnedt32.exe 5 rules
ends_with: \gpg.exe 5 rules
Top techniques:Data Encrypted for Impact
T1486ends_with: \gpg2.exe 5 rules
Top techniques:Data Encrypted for Impact
T1486ends_with: \handle.exe 5 rules
ends_with: \handle64.exe 5 rules
ends_with: \installutil.exe 5 rules
ends_with: \livekd64.exe 5 rules
ends_with: \lsass.exe 5 rules
ends_with: \mstsc.exe 5 rules
ends_with: \netstat.exe 5 rules
ends_with: \procdump64.exe 5 rules
ends_with: \query.exe 5 rules
ends_with: \robocopy.exe 5 rules
ends_with: \vssadmin.exe 5 rules
ends_with: \winget.exe 5 rules
Top techniques:Command and Scripting Interpreter
T1059ends_with: \winlogon.exe 5 rules
ends_with: \wordpad.exe 5 rules
ends_with: \xcopy.exe 5 rules
eq: C:\Windows\system32\svchost.exe 5 rules
match: :\Windows\Tasks\ 5 rules
Top techniques:Ingress Tool Transfer
T1105, Trusted Developer Utilities Proxy Execution T1127, Masquerading T1036Sample rules:
- sigma Remote Thread Creation In Mstsc.Exe From Suspicious Location
- sigma Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
- sigma Suspicious Child Process of AspNetCompiler
- sigma Process Execution From A Potentially Suspicious Folder
match: \AppData\Local\Programs\Opera\ 5 rules
Top techniques:Remote Desktop Software
T1219.002, Web Service T1102, Dead Drop Resolver T1102.001, Process Hollowing T1055.012Sample rules:
- sigma DNS Query To AzureWebsites.NET By Non-Browser Process
- sigma DNS Query To Remote Access Software Domain From Non-Browser App
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Potential Process Hollowing Activity
match: \Contacts\ 5 rules
Top techniques:Disable or Modify Tools
T1562.001, Command and Scripting Interpreter T1059, Data Encrypted for Impact T1486, OS Credential Dumping T1003, Ingress Tool Transfer T1105, LSASS Memory T1003.001Sample rules:
- sigma Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
- sigma Load Of RstrtMgr.DLL By A Suspicious Process
- sigma Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
- sigma Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
match: \Favourites\ 5 rules
Top techniques:Disable or Modify Tools
T1562.001, Command and Scripting Interpreter T1059, Data Encrypted for Impact T1486, OS Credential Dumping T1003, Ingress Tool Transfer T1105, LSASS Memory T1003.001Sample rules:
- sigma Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
- sigma Load Of RstrtMgr.DLL By A Suspicious Process
- sigma Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
- sigma Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
match: \Pictures\ 5 rules
Top techniques:Disable or Modify Tools
T1562.001, Command and Scripting Interpreter T1059, OS Credential Dumping T1003, Ingress Tool Transfer T1105, LSASS Memory T1003.001Sample rules:
- sigma Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
- sigma Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
- sigma Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
- sigma HackTool - LaZagne Execution
match: \Temp\ 5 rules
starts_with: C:\Program Files (x86)\Windows Defender\ 5 rules
starts_with: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\ 5 rules
starts_with: C:\Program Files\Windows Defender\ 5 rules
ends_with: .exe 4 rules
ends_with: \ADExplorer64a.exe 4 rules
ends_with: \AnyDeskMSI.exe 4 rules
ends_with: \Desktopimgdownldr.exe 4 rules
ends_with: \Flock.exe 4 rules
ends_with: \POWERPNT.EXE 4 rules
ends_with: \Phoebe.exe 4 rules
ends_with: \RdrCEF.exe 4 rules
ends_with: \RuntimeBroker.exe 4 rules
ends_with: \Teams.exe 4 rules
ends_with: \Waterfox.exe 4 rules
ends_with: \addinutil.exe 4 rules
ends_with: \appcmd.exe 4 rules
ends_with: \avant.exe 4 rules
ends_with: \bcdedit.exe 4 rules
ends_with: \dism.exe 4 rules
Sample rules:
ends_with: \falkon.exe 4 rules
ends_with: \fsutil.exe 4 rules
ends_with: \iexplore.exe 4 rules
Sample rules:
ends_with: \nslookup.exe 4 rules
ends_with: \ntdsutil.exe 4 rules
ends_with: \psloglist.exe 4 rules
ends_with: \psloglist64.exe 4 rules
ends_with: \rar.exe 4 rules
ends_with: \regasm.exe 4 rules
ends_with: \runonce.exe 4 rules
Top techniques:Process Injection
T1055, Rundll32 T1218.011, Modify Registry T1112, Masquerading T1036ends_with: \slimbrowser.exe 4 rules
ends_with: \tasklist.exe 4 rules
ends_with: \verclsid.exe 4 rules
ends_with: \werfault.exe 4 rules
ends_with: \wt.exe 4 rules
Top techniques:Inhibit System Recovery
T1490, Security Account Manager T1003.002, NTDS T1003.003, Accessibility Features T1546.008Sample rules:
eq: C:\Program Files\PowerShell\7\pwsh.exe 4 rules
eq: C:\Windows\ImmersiveControlPanel\SystemSettings.exe 4 rules
eq: C:\Windows\SysWOW64\msiexec.exe 4 rules
eq: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 4 rules
eq: C:\Windows\System32\msiexec.exe 4 rules
eq: C:\Windows\System32\svchost.exe 4 rules
match: :\PerfLogs\ 4 rules
match: :\Program Files (x86)\ 4 rules
match: :\Program Files\Microsoft Office\ 4 rules
match: :\Windows\System32\Tasks\ 4 rules
Top techniques:Ingress Tool Transfer
T1105, Trusted Developer Utilities Proxy Execution T1127, Masquerading T1036Sample rules:
- sigma Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
- sigma Suspicious Child Process of AspNetCompiler
- sigma Process Execution From A Potentially Suspicious Folder
match: C:\Program Files\WindowsApps\Microsoft.PowerShellPreview 4 rules
match: \AppData\Local\Flock\ 4 rules
match: \AppData\Local\Maxthon\ 4 rules
match: \AppData\Local\Microsoft\OneDrive\ 4 rules
match: \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview 4 rules
match: \AppData\Local\Phoebe\ 4 rules
match: \AppData\Local\Vivaldi\ 4 rules
match: \Music\ 4 rules
match: \Users\Default\ 4 rules
match: \Videos\ 4 rules
match: \Windows\System32\Tasks\ 4 rules
match: \Windows\Tasks\ 4 rules
match: \Windows\addins\ 4 rules
match: \config\systemprofile\ 4 rules
Sample rules:
- sigma Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
- sigma Process Execution From A Potentially Suspicious Folder
- sigma Suspicious Service Binary Directory
starts_with: C:\Program Files (x86)\Avant Browser\ 4 rules
starts_with: C:\Program Files (x86)\Falkon\ 4 rules
starts_with: C:\Program Files (x86)\Naver\Naver Whale\ 4 rules
starts_with: C:\Program Files (x86)\SeaMonkey\ 4 rules
starts_with: C:\Program Files (x86)\SlimBrowser\ 4 rules
starts_with: C:\Program Files (x86)\Waterfox\ 4 rules
starts_with: C:\Program Files\Avant Browser\ 4 rules
starts_with: C:\Program Files\BraveSoftware\ 4 rules
starts_with: C:\Program Files\Falkon\ 4 rules
starts_with: C:\Program Files\Naver\Naver Whale\ 4 rules
starts_with: C:\Program Files\SeaMonkey\ 4 rules
starts_with: C:\Program Files\SlimBrowser\ 4 rules
starts_with: C:\Program Files\Waterfox\ 4 rules
starts_with: C:\Windows\ 4 rules
ends_with: :\Windows\System32\mmc.exe 3 rules
ends_with: \7z.exe 3 rules
ends_with: \7za.exe 3 rules
ends_with: \ADExp.exe 3 rules
ends_with: \AcroRd32.exe 3 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
ends_with: \Discord.exe 3 rules
ends_with: \MicrosoftEdge.exe 3 rules
Top techniques:Spearphishing Attachment
T1566.001, Malware T1587.001, Ingress Tool Transfer T1105, Hidden Window T1564.003Sample rules:
ends_with: \Midori Next Generation.exe 3 rules
ends_with: \ONENOTE.EXE 3 rules
Sample rules:
ends_with: \OUTLOOK.EXE 3 rules
ends_with: \PingCastle.exe 3 rules
ends_with: \PsService.exe 3 rules
ends_with: \PsService64.exe 3 rules
ends_with: \RegAsm.exe 3 rules
ends_with: \Sysmon.exe 3 rules
ends_with: \Sysmon64.exe 3 rules
ends_with: \WmiPrvSE.exe 3 rules
ends_with: \accesschk.exe 3 rules
ends_with: \arp.exe 3 rules
Top techniques:Process Injection
T1055, Exploit Public-Facing Application T1190, Web Shell T1505.003Sample rules:
ends_with: \aspnet_compiler.exe 3 rules
Top techniques:Trusted Developer Utilities Proxy Execution
T1127ends_with: \attrib.exe 3 rules
ends_with: \cloudflared.exe 3 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
ends_with: \cmdkey.exe 3 rules
ends_with: \code.exe 3 rules
ends_with: \control.exe 3 rules
ends_with: \csrss.exe 3 rules
ends_with: \diskshadow.exe 3 rules
ends_with: \expand.exe 3 rules
ends_with: \ftp.exe 3 rules
ends_with: \gup.exe 3 rules
ends_with: \ldifde.exe 3 rules
ends_with: \msteams.exe 3 rules
ends_with: \ngen.exe 3 rules
ends_with: \node.exe 3 rules
ends_with: \pcalua.exe 3 rules
ends_with: \pspasswd.exe 3 rules
ends_with: \pspasswd64.exe 3 rules
ends_with: \pssuspend.exe 3 rules
ends_with: \pssuspend64.exe 3 rules
ends_with: \python.exe 3 rules
ends_with: \regsvcs.exe 3 rules
ends_with: \sdelete.exe 3 rules
ends_with: \services.exe 3 rules
ends_with: \ssh.exe 3 rules
ends_with: \visio.exe 3 rules
ends_with: \vmmap.exe 3 rules
ends_with: \vmmap64.exe 3 rules
ends_with: \wermgr.exe 3 rules
ends_with: \wininit.exe 3 rules
ends_with: \wsmprovhost.exe 3 rules
ends_with: \wusa.exe 3 rules
ends_with: reg.exe 3 rules
Sample rules:
eq: C:\Program Files\AVG\Antivirus\RegSvr.exe 3 rules
eq: C:\Program Files\Avast Software\Avast\RegSvr.exe 3 rules
eq: C:\Program Files\PowerShell\7-preview\pwsh.exe 3 rules
eq: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 3 rules
eq: C:\Windows\SysWOW64\svchost.exe 3 rules
eq: C:\Windows\System32\ServerManager.exe 3 rules
eq: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe 3 rules
eq: C:\Windows\System32\cmd.exe 3 rules
eq: C:\Windows\System32\wuauclt.exe 3 rules
eq: C:\Windows\servicing\TrustedInstaller.exe 3 rules
eq: Registry 3 rules
Top techniques:Direct Volume Access
T1006in: "*\\ProgramData\\*" 3 rules
in: "*\\Temp\\*" 3 rules
match: :\ProgramData\ 3 rules
match: :\Users\ 3 rules
match: :\Users\Default\ 3 rules
match: :\Windows\Fonts\ 3 rules
match: :\Windows\IME\ 3 rules
match: :\Windows\Microsoft.NET\Framework64\ 3 rules
match: :\Windows\Microsoft.NET\FrameworkArm64\ 3 rules
match: :\Windows\Microsoft.NET\FrameworkArm\ 3 rules
match: :\Windows\Microsoft.NET\Framework\ 3 rules
match: :\Windows\WinSxS\ 3 rules
Sample rules:
match: \AppData\Local\Programs\midori-ng\ 3 rules
match: \AppData\Temp\ 3 rules
match: \PerfLogs\ 3 rules
match: \ntlmrelayx 3 rules
Sample rules:
match: \smbrelayx 3 rules
Sample rules:
starts_with: C:\Program Files (x86)\Microsoft Office\ 3 rules
Sample rules:
starts_with: C:\Program Files\Microsoft Office\ 3 rules
Sample rules:
starts_with: C:\Program Files\Microsoft\Exchange Server\ 3 rules
starts_with: C:\Windows\Installer\MSI 3 rules
starts_with: C:\Windows\Temp\asgard2-agent\ 3 rules
ends_with: .tmp 2 rules
Sample rules:
ends_with: :\Windows\SysWOW64\bash.exe 2 rules
Top techniques:Indirect Command Execution
T1202ends_with: :\Windows\System32\bash.exe 2 rules
Top techniques:Indirect Command Execution
T1202ends_with: :\Windows\System32\conhost.exe 2 rules
Sample rules:
ends_with: :\windows\system32\svchost.exe 2 rules
Sample rules:
ends_with: C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe 2 rules
ends_with: C:\Program Files\PRTG Network Monitor\PRTG Probe.exe 2 rules
ends_with: \7zr.exe 2 rules
Top techniques:Archive via Utility
T1560.001Sample rules:
ends_with: \AdFind.exe 2 rules
Top techniques:Domain Account
T1087.002, Remote System Discovery T1018, Domain Groups T1069.002, Domain Trust Discovery T1482Sample rules:
ends_with: \Akagi.exe 2 rules
Sample rules:
ends_with: \Akagi64.exe 2 rules
Sample rules:
ends_with: \AppData\Local\Google\Chrome\Application\chrome.exe 2 rules
ends_with: \AppData\Local\Microsoft\Teams\current\Teams.exe 2 rules
Sample rules:
ends_with: \AppData\Local\Mozilla Firefox\firefox.exe 2 rules
ends_with: \AppData\Local\Programs\Microsoft VS Code\Code.exe 2 rules
Sample rules:
ends_with: \AppData\Local\WebEx\WebexHost.exe 2 rules
Sample rules:
ends_with: \AppData\Roaming\Spotify\Spotify.exe 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
ends_with: \Certify.exe 2 rules
Sample rules:
ends_with: \Certipy.exe 2 rules
Sample rules:
ends_with: \CoercedPotato.exe 2 rules
Sample rules:
ends_with: \CreateMiniDump.exe 2 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
ends_with: \Dbgview.exe 2 rules
ends_with: \DismHost.exe 2 rules
Sample rules:
ends_with: \Dropbox.exe 2 rules
ends_with: \DumpMinitool.arm64.exe 2 rules
Sample rules:
ends_with: \DumpMinitool.exe 2 rules
Sample rules:
ends_with: \DumpMinitool.x86.exe 2 rules
Sample rules:
ends_with: \EXCEL.EXE 2 rules
Top techniques:Indirect Command Execution
T1202ends_with: \EXCEL.exe 2 rules
Sample rules:
ends_with: \GUP.exe 2 rules
Sample rules:
ends_with: \GetADUsers_windows.exe 2 rules
Sample rules:
ends_with: \GetNPUsers_windows.exe 2 rules
Sample rules:
ends_with: \GetUserSPNs_windows.exe 2 rules
Sample rules:
ends_with: \IMEWDBLD.exe 2 rules
Sample rules:
ends_with: \Inveigh.exe 2 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
ends_with: \LocalPotato.exe 2 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
ends_with: \MBAMInstallerService.exe 2 rules
Sample rules:
ends_with: \MSPUB.EXE 2 rules
ends_with: \Microsoft.Workflow.Compiler.exe 2 rules
ends_with: \Microsoft\Teams\current\Teams.exe 2 rules
ends_with: \NisSrv.exe 2 rules
Top techniques:DLL
T1574.001Sample rules:
ends_with: \PowerTool.exe 2 rules
Sample rules:
ends_with: \PowerTool64.exe 2 rules
Sample rules:
ends_with: \PsExec.exe 2 rules
Top techniques:Tool
T1588.002ends_with: \PsExec64.exe 2 rules
Top techniques:Tool
T1588.002ends_with: \QtWeb.exe 2 rules
ends_with: \QuarksPwDump.exe 2 rules
Sample rules:
ends_with: \QuickAssist.exe 2 rules
Top techniques:Web Protocols
T1071.001, Exploitation of Remote Services T1210, Remote Desktop Software T1219.002Sample rules:
ends_with: \RDCMan.exe 2 rules
ends_with: \RegSvcs.exe 2 rules
Sample rules:
ends_with: \Regasm.exe 2 rules
ends_with: \Regsvcs.exe 2 rules
ends_with: \Rubeus.exe 2 rules
Top techniques:LSASS Memory
T1003.001, OS Credential Dumping T1003, Pass the Ticket T1550.003, Kerberoasting T1558.003Sample rules:
ends_with: \SafetyKatz.exe 2 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
ends_with: \SelectMyParent.exe 2 rules
Sample rules:
ends_with: \SharPersist.exe 2 rules
Sample rules:
ends_with: \SharpChisel.exe 2 rules
Sample rules:
ends_with: \SharpEvtMute.exe 2 rules
Sample rules:
ends_with: \SharpImpersonation.exe 2 rules
Top techniques:LSASS Memory
T1003.001, Token Impersonation/Theft T1134.001, Make and Impersonate Token T1134.003Sample rules:
ends_with: \SharpLDAPmonitor.exe 2 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
ends_with: \SharpLdapWhoami.exe 2 rules
Sample rules:
ends_with: \SharpUp.exe 2 rules
ends_with: \SharpView.exe 2 rules
ends_with: \Stracciatella.exe 2 rules
Top techniques:LSASS Memory
T1003.001, Command and Scripting Interpreter T1059, Disable or Modify Tools T1562.001Sample rules:
ends_with: \SysmonEOP.exe 2 rules
Sample rules:
ends_with: \Tools\Binn\SQLPS.exe 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
ends_with: \TrolleyExpress.exe 2 rules
Sample rules:
ends_with: \TruffleSnout.exe 2 rules
Sample rules:
ends_with: \VMwareToolBoxCmd.exe 2 rules
ends_with: \VMwareXferlogs.exe 2 rules
Top techniques:DLL
T1574.001Sample rules:
ends_with: \WerFaultSecure.exe 2 rules
Sample rules:
ends_with: \WinRAR.exe 2 rules
Sample rules:
ends_with: \Windows\System32\lsass.exe 2 rules
Sample rules:
ends_with: \accesschk64.exe 2 rules
ends_with: \at.exe 2 rules
Sample rules:
ends_with: \atexec_windows.exe 2 rules
Sample rules:
ends_with: \aurora-agent-64.exe 2 rules
Sample rules:
ends_with: \aurora-agent.exe 2 rules
Sample rules:
ends_with: \certreq.exe 2 rules
Sample rules:
ends_with: \chcp.com 2 rules
Sample rules:
ends_with: \cipher.exe 2 rules
ends_with: \client32.exe 2 rules
Sample rules:
ends_with: \cloudflared-windows-386.exe 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
ends_with: \cloudflared-windows-amd64.exe 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
ends_with: \cmdl32.exe 2 rules
ends_with: \code-tunnel.exe 2 rules
Sample rules:
ends_with: \crackmapexec.exe 2 rules
ends_with: \createdump.exe 2 rules
Sample rules:
ends_with: \csi.exe 2 rules
ends_with: \cvtres.exe 2 rules
Sample rules:
ends_with: \dcomexec_windows.exe 2 rules
Sample rules:
ends_with: \dctask64.exe 2 rules
ends_with: \defrag.exe 2 rules
Sample rules:
ends_with: \dns.exe 2 rules
Top techniques:External Remote Services
T1133Sample rules:
ends_with: \dnscmd.exe 2 rules
Sample rules:
ends_with: \dnx.exe 2 rules
ends_with: \dotnet.exe 2 rules
ends_with: \dpapi_windows.exe 2 rules
Sample rules:
ends_with: \dsacls.exe 2 rules
Top techniques:System Binary Proxy Execution
T1218ends_with: \dsquery.exe 2 rules
ends_with: \dump64.exe 2 rules
Top techniques:LSASS Memory
T1003.001ends_with: \extrac32.exe 2 rules
Sample rules:
ends_with: \findDelegation_windows.exe 2 rules
Sample rules:
ends_with: \fltMC.exe 2 rules
Top techniques:Indicator Removal
T1070, Impair Defenses T1562, Disable Windows Event Logging T1562.002Sample rules:
ends_with: \getPac_windows.exe 2 rules
Sample rules:
ends_with: \getST_windows.exe 2 rules
Sample rules:
ends_with: \getTGT_windows.exe 2 rules
Sample rules:
ends_with: \gmer.exe 2 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
ends_with: \gpupdate.exe 2 rules
ends_with: \hashcat.exe 2 rules
Sample rules:
ends_with: \htran.exe 2 rules
Sample rules:
ends_with: \ie4uinit.exe 2 rules
ends_with: \ieexec.exe 2 rules
ends_with: \ifmap_windows.exe 2 rules
Sample rules:
ends_with: \ipconfig.exe 2 rules
ends_with: \javaw.exe 2 rules
ends_with: \ksetup.exe 2 rules
Sample rules:
ends_with: \livek64.exe 2 rules
Sample rules:
ends_with: \lsm.exe 2 rules
ends_with: \mimikatz_windows.exe 2 rules
Sample rules:
ends_with: \mobsync.exe 2 rules
Sample rules:
ends_with: \msaccess.exe 2 rules
Sample rules:
ends_with: \mscorsvw.exe 2 rules
Sample rules:
ends_with: \msedge_proxy.exe 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
ends_with: \msidb.exe 2 rules
ends_with: \netview_windows.exe 2 rules
Sample rules:
ends_with: \nmapAnswerMachine_windows.exe 2 rules
Sample rules:
ends_with: \opdump_windows.exe 2 rules
Sample rules:
ends_with: \plink.exe 2 rules
Sample rules:
ends_with: \presentationhost.exe 2 rules
Top techniques:System Binary Proxy Execution
T1218ends_with: \procmon.exe 2 rules
Sample rules:
ends_with: \procmon64.exe 2 rules
Sample rules:
ends_with: \psexec.exe 2 rules
Sample rules:
ends_with: \psexec_windows.exe 2 rules
Sample rules:
ends_with: \pypykatz.exe 2 rules
Sample rules:
ends_with: \quser.exe 2 rules
ends_with: \qwinsta.exe 2 rules
Top techniques:System Owner/User Discovery
T1033, Local Account T1087.001, Exploit Public-Facing Application T1190, Web Shell T1505.003Sample rules:
ends_with: \rdp_check_windows.exe 2 rules
Sample rules:
ends_with: \regini.exe 2 rules
Top techniques:Modify Registry
T1112Sample rules:
ends_with: \replace.exe 2 rules
Sample rules:
ends_with: \rfusclient.exe 2 rules
ends_with: \ruby.exe 2 rules
Sample rules:
ends_with: \rutserv.exe 2 rules
ends_with: \sambaPipe_windows.exe 2 rules
Sample rules:
ends_with: \sdbinst.exe 2 rules
Top techniques:Application Shimming
T1546.011ends_with: \sdelete64.exe 2 rules
ends_with: \shutdown.exe 2 rules
Top techniques:System Shutdown/Reboot
T1529Sample rules:
ends_with: \sihost.exe 2 rules
Top techniques:Masquerading
T1036Sample rules:
ends_with: \smartscreen.exe 2 rules
Sample rules:
ends_with: \smbclient_windows.exe 2 rules
Sample rules:
ends_with: \smbserver_windows.exe 2 rules
Sample rules:
ends_with: \smss.exe 2 rules
Top techniques:Masquerading
T1036Sample rules:
ends_with: \sniff_windows.exe 2 rules
Sample rules:
ends_with: \sniffer_windows.exe 2 rules
Sample rules:
ends_with: \split_windows.exe 2 rules
Sample rules:
ends_with: \spoolsv.exe 2 rules
Sample rules:
ends_with: \sqlcmd.exe 2 rules
Top techniques:Data from Local System
T1005Sample rules:
ends_with: \sqlite.exe 2 rules
Top techniques:Data from Local System
T1005, Steal Web Session Cookie T1539, Credentials from Web Browsers T1555.003Sample rules:
ends_with: \sqlite3.exe 2 rules
Top techniques:Data from Local System
T1005, Steal Web Session Cookie T1539, Credentials from Web Browsers T1555.003Sample rules:
ends_with: \squirrel.exe 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
ends_with: \tar.exe 2 rules
Sample rules:
ends_with: \taskhost.exe 2 rules
ends_with: \taskhostw.exe 2 rules
Sample rules:
ends_with: \taskkill.exe 2 rules
ends_with: \taskmgr.exe 2 rules
Top techniques:Exploitation for Privilege Escalation
T1068, Exploitation for Client Execution T1203, Masquerading T1036Sample rules:
ends_with: \teams.exe 2 rules
Sample rules:
ends_with: \thunderbird.exe 2 rules
Top techniques:Spearphishing Attachment
T1566.001, Exfiltration Over Unencrypted Non-C2 Protocol T1048.003Sample rules:
ends_with: \ticketer_windows.exe 2 rules
Sample rules:
ends_with: \tomcat\bin\tomcat8.exe 2 rules
Top techniques:Kerberoasting
T1558.003, Pass the Ticket T1550.003, Steal or Forge Kerberos Tickets T1558Sample rules:
ends_with: \tscon.exe 2 rules
Top techniques:Remote Desktop Software
T1219.002Sample rules:
ends_with: \update.exe 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
ends_with: \userinit.exe 2 rules
Sample rules:
ends_with: \vssvc.exe 2 rules
Sample rules:
ends_with: \w32tm.exe 2 rules
Top techniques:System Time Discovery
T1124Sample rules:
- sigma Discovery of a System Time
- sigma Use of W32tm as Timer
ends_with: \wab.exe 2 rules
Sample rules:
ends_with: \wabmig.exe 2 rules
Sample rules:
ends_with: \winPEASany.exe 2 rules
Top techniques:LSASS Memory
T1003.001, Network Service Discovery T1046, System Information Discovery T1082, Account Discovery T1087Sample rules:
ends_with: \winPEASany_ofs.exe 2 rules
Top techniques:LSASS Memory
T1003.001, Network Service Discovery T1046, System Information Discovery T1082, Account Discovery T1087Sample rules:
ends_with: \winPEASx64.exe 2 rules
Top techniques:LSASS Memory
T1003.001, Network Service Discovery T1046, System Information Discovery T1082, Account Discovery T1087Sample rules:
ends_with: \winPEASx64_ofs.exe 2 rules
Top techniques:LSASS Memory
T1003.001, Network Service Discovery T1046, System Information Discovery T1082, Account Discovery T1087Sample rules:
ends_with: \winPEASx86.exe 2 rules
Top techniques:LSASS Memory
T1003.001, Network Service Discovery T1046, System Information Discovery T1082, Account Discovery T1087Sample rules:
ends_with: \winPEASx86_ofs.exe 2 rules
Top techniques:LSASS Memory
T1003.001, Network Service Discovery T1046, System Information Discovery T1082, Account Discovery T1087Sample rules:
ends_with: \winrar.exe 2 rules
Top techniques:Archive via Utility
T1560.001Sample rules:
ends_with: \workfolders.exe 2 rules
ends_with: \wuauclt.exe 2 rules
ends_with: \wuaucltcore.exe 2 rules
ends_with: \xordump.exe 2 rules
Sample rules:
ends_with: driverquery.exe 2 rules
Sample rules:
ends_with: findstr.exe 2 rules
ends_with: python.exe 2 rules
Top techniques:Command and Scripting Interpreter
T1059Sample rules:
ends_with: python2.exe 2 rules
Top techniques:Command and Scripting Interpreter
T1059Sample rules:
ends_with: python3.exe 2 rules
Top techniques:Command and Scripting Interpreter
T1059Sample rules:
eq: "*\\appdata\\Roaming\\*" 2 rules
Top techniques:Screen Capture
T1113Sample rules:
eq: "*\\cmd.exe" 2 rules
Sample rules:
eq: "*\\rundll32.exe" 2 rules
Top techniques:Process Injection
T1055Sample rules:
eq: "*\\spoolsv.exe" 2 rules
Sample rules:
eq: "*\\wermgr.exe" 2 rules
eq: - 2 rules
Sample rules:
eq: <unknown process> 2 rules
Sample rules:
eq: C:\Program Files\AVG\Antivirus\x86\RegSvr.exe 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
eq: C:\Program Files\Avast Software\Avast\x86\RegSvr.exe 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
eq: C:\Program Files\Windows Defender\MsMpEng.exe 2 rules
Sample rules:
eq: C:\WINDOWS\system32\msiexec.exe 2 rules
eq: C:\WINDOWS\system32\svchost.exe 2 rules
eq: C:\WINDOWS\system32\wbem\scrcons.exe 2 rules
Sample rules:
eq: C:\Windows\PSEXESVC.exe 2 rules
Sample rules:
eq: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
eq: C:\Windows\SysWOW64\explorer.exe 2 rules
Top techniques:File Deletion
T1070.004Sample rules:
eq: C:\Windows\SysWOW64\regsvr32.exe 2 rules
Sample rules:
eq: C:\Windows\SysWOW64\schtasks.exe 2 rules
Sample rules:
eq: C:\Windows\System32\OpenWith.exe 2 rules
Sample rules:
eq: C:\Windows\System32\RuntimeBroker.exe 2 rules
eq: C:\Windows\System32\conhost.exe 2 rules
eq: C:\Windows\System32\dsac.exe 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
eq: C:\Windows\System32\regsvr32.exe 2 rules
Sample rules:
eq: C:\Windows\System32\schtasks.exe 2 rules
Sample rules:
eq: C:\Windows\System32\sdiagnhost.exe 2 rules
Sample rules:
eq: C:\Windows\System32\spoolsv.exe 2 rules
Sample rules:
eq: C:\Windows\System32\wsmprovhost.exe 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
eq: C:\Windows\UUS\arm64\wuaucltcore.exe 2 rules
Top techniques:Match Legitimate Resource Name or Location
T1036.005eq: C:\Windows\system32\lsass.exe 2 rules
Sample rules:
- sigma DLL Load via LSASS
- sigma ServiceDll Hijack
eq: C:\Windows\system32\msiexec.exe 2 rules
Sample rules:
eq: C:\Windows\system32\wevtutil.exe 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: C:\Windows\syswow64\MsiExec.exe 2 rules
eq: MemCompression 2 rules
Sample rules:
eq: vmmem 2 rules
Sample rules:
in: "*\\Users\\*" 2 rules
in: "*\\Windows\\Tasks\\*" 2 rules
Sample rules:
in: "*\\\\*" 2 rules
in: "*\\cscript.exe" 2 rules
Top techniques:JavaScript
T1059.007Sample rules:
in: "*\\program files*" 2 rules
Top techniques:CMSTP
T1218.003Sample rules:
in: "*\\temp\\*" 2 rules
Sample rules:
in: "*\\users\\public\\*" 2 rules
Sample rules:
in: "*\\windows\\*" 2 rules
Top techniques:CMSTP
T1218.003Sample rules:
in: "*\\wscript.exe" 2 rules
Top techniques:JavaScript
T1059.007Sample rules:
match: :\$Recycle.bin 2 rules
match: :\Program Files (x86)\Microsoft Office\ 2 rules
Sample rules:
match: :\Program Files\Common Files\Microsoft Shared\ClickToRun\ 2 rules
Sample rules:
match: :\ProgramData\Microsoft\Windows Defender\Platform\ 2 rules
Sample rules:
match: C:\Program Files (x86)\Safari\ 2 rules
match: C:\Program Files\Safari\ 2 rules
match: C:\Program Files\Windows Defender Advanced Threat Protection\ 2 rules
match: C:\Program Files\Windows Defender\ 2 rules
match: C:\ProgramData\Microsoft\Windows Defender\Platform\ 2 rules
match: C:\Users\Public\ 2 rules
Sample rules:
match: HotPotato 2 rules
Sample rules:
match: Juicy Potato 2 rules
Sample rules:
match: JuicyPotato 2 rules
Sample rules:
match: PetitPotam 2 rules
Sample rules:
match: RECYCLER.BIN\ 2 rules
match: RECYCLERS.BIN\ 2 rules
match: RottenPotato 2 rules
Sample rules:
match: \$Recycle.Bin\ 2 rules
match: \$Recycle.bin 2 rules
Top techniques:Indirect Command Execution
T1202Sample rules:
match: \AppData\Local\Discord\ 2 rules
match: \AppData\Local\Microsoft\WindowsApps\ 2 rules
Sample rules:
match: \AppData\Roaming\ 2 rules
match: \Documents\ 2 rules
match: \LocalPotato 2 rules
Sample rules:
match: \Microsoft Visual Studio\ 2 rules
Sample rules:
match: \ProgramData\ 2 rules
match: \Public\ 2 rules
Sample rules:
match: \Start Menu\Programs\Startup\ 2 rules
match: \Temporary Internet 2 rules
match: \Temporary Internet Files\Content.Outlook\ 2 rules
Sample rules:
match: \Tor Browser\ 2 rules
Top techniques:Remote Desktop Software
T1219.002match: \Users\Contacts\ 2 rules
Top techniques:Indirect Command Execution
T1202Sample rules:
match: \Users\Searches\ 2 rules
Top techniques:Indirect Command Execution
T1202Sample rules:
match: \Windows\Fonts\ 2 rules
Top techniques:Indirect Command Execution
T1202Sample rules:
match: \Windows\IME\ 2 rules
Top techniques:Indirect Command Execution
T1202Sample rules:
match: \avira_system_speedup.tmp 2 rules
Top techniques:Inhibit System Recovery
T1490match: \goldenPac 2 rules
Sample rules:
match: \inetpub\wwwroot\ 2 rules
match: \just_dce_ 2 rules
Sample rules:
match: \karmaSMB 2 rules
Sample rules:
match: \kintercept 2 rules
Sample rules:
match: \pwsh.exe 2 rules
match: \python 2 rules
Sample rules:
match: \rpcdump 2 rules
Sample rules:
match: \samrdump 2 rules
Sample rules:
match: \secretsdump 2 rules
Sample rules:
match: \setup.exe 2 rules
Sample rules:
match: \smbexec 2 rules
Sample rules:
match: \temp\is- 2 rules
Top techniques:Inhibit System Recovery
T1490match: \wmiexec 2 rules
Sample rules:
match: \wmipersist 2 rules
Sample rules:
starts_with: C:\$WINDOWS.~BT\ 2 rules
starts_with: C:\$WinREAgent\Scratch\ 2 rules
starts_with: C:\Program Files (x86)\CCleaner\ 2 rules
Top techniques:DLL
T1574.001Sample rules:
starts_with: C:\Program Files (x86)\Microsoft Visual Studio\ 2 rules
Sample rules:
starts_with: C:\Program Files (x86)\Microsoft\EdgeWebView\ 2 rules
Top techniques:Ingress Tool Transfer
T1105, Hidden Window T1564.003, Registry Run Keys / Startup Folder T1547.001Sample rules:
starts_with: C:\Program Files (x86)\QtWeb\ 2 rules
starts_with: C:\Program Files\CCleaner\ 2 rules
Top techniques:DLL
T1574.001Sample rules:
starts_with: C:\Program Files\Citrix\ 2 rules
Sample rules:
starts_with: C:\Program Files\Microsoft Security Client\ 2 rules
Top techniques:DLL
T1574.001Sample rules:
starts_with: C:\Program Files\Microsoft Visual Studio\ 2 rules
Sample rules:
starts_with: C:\Program Files\QtWeb\ 2 rules
starts_with: C:\Users\' 2 rules
Top techniques:Data Encrypted for Impact
T1486, Disable or Modify Tools T1562.001, Masquerading T1036Sample rules:
starts_with: C:\Windows\Microsoft.NET\Framework 2 rules
starts_with: C:\Windows\SoftwareDistribution\ 2 rules
starts_with: C:\Windows\SystemApps\ 2 rules
Sample rules:
starts_with: C:\Windows\Temp\ 2 rules
starts_with: C:\Windows\Temp\{ 2 rules
Top techniques:Inhibit System Recovery
T1490starts_with: C:\Windows\uus\ 2 rules
TargetFilename 169 entries
ends_with: .dll 21 rules
Top techniques:Ingress Tool Transfer
T1105, DLL T1574.001, Malicious File T1204.002, System Binary Proxy Execution T1218, Remote Desktop Software T1219.002, Trusted Developer Utilities Proxy Execution T1127Sample rules (showing 8 of 21):
- sigma Suspicious Binary Writes Via AnyDesk
- sigma Suspicious File Created by ArcSOC.exe
- sigma Potentially Suspicious File Creation by OpenEDR's ITSMService
- sigma DLL Search Order Hijackig Via Additional Space in Path
- sigma Suspicious File Drop by Exchange
- sigma Potential Initial Access via DLL Search Order Hijacking
- sigma Uncommon File Creation By Mysql Daemon Process
- sigma Suspicious File Creation In Uncommon AppData Folder
ends_with: .exe 18 rules
Top techniques:Ingress Tool Transfer
T1105, System Binary Proxy Execution T1218, Remote Desktop Software T1219.002, Trusted Developer Utilities Proxy Execution T1127, External Remote Services T1133, Remote Access Tools T1219Sample rules (showing 8 of 18):
- sigma Suspicious Binary Writes Via AnyDesk
- sigma Suspicious File Created by ArcSOC.exe
- sigma Potentially Suspicious File Creation by OpenEDR's ITSMService
- sigma Suspicious File Drop by Exchange
- sigma Uncommon File Creation By Mysql Daemon Process
- sigma Suspicious File Creation In Uncommon AppData Folder
- sigma Suspicious File Created Via OneNote Application
- sigma File With Uncommon Extension Created By An Office Application
ends_with: .vbs 16 rules
Top techniques:Ingress Tool Transfer
T1105, Exploit Public-Facing Application T1190, Web Shell T1505.003, Malicious File T1204.002, Trusted Developer Utilities Proxy Execution T1127, External Remote Services T1133Sample rules (showing 8 of 16):
- sigma Suspicious File Created by ArcSOC.exe
- sigma Potentially Suspicious File Creation by OpenEDR's ITSMService
- sigma WScript or CScript Dropper - File
- sigma Suspicious File Drop by Exchange
- sigma Uncommon File Creation By Mysql Daemon Process
- sigma Suspicious File Creation In Uncommon AppData Folder
- sigma Suspicious File Created Via OneNote Application
- sigma Suspicious File Created in Outlook Temporary Directory
ends_with: .bat 15 rules
Top techniques:Ingress Tool Transfer
T1105, Exploit Public-Facing Application T1190, Web Shell T1505.003, Malicious File T1204.002, Trusted Developer Utilities Proxy Execution T1127, External Remote Services T1133Sample rules (showing 8 of 15):
- sigma Suspicious File Created by ArcSOC.exe
- sigma Potentially Suspicious File Creation by OpenEDR's ITSMService
- sigma Suspicious File Drop by Exchange
- sigma HackTool - Powerup Write Hijack DLL
- sigma Uncommon File Creation By Mysql Daemon Process
- sigma Suspicious File Creation In Uncommon AppData Folder
- sigma Suspicious File Created Via OneNote Application
- sigma File With Uncommon Extension Created By An Office Application
ends_with: .ps1 15 rules
Top techniques:Ingress Tool Transfer
T1105, Exploit Public-Facing Application T1190, Web Shell T1505.003, Malicious File T1204.002, Trusted Developer Utilities Proxy Execution T1127, External Remote Services T1133Sample rules (showing 8 of 15):
- sigma Suspicious File Created by ArcSOC.exe
- sigma Potentially Suspicious File Creation by OpenEDR's ITSMService
- sigma Suspicious File Drop by Exchange
- sigma Uncommon File Creation By Mysql Daemon Process
- sigma Suspicious File Creation In Uncommon AppData Folder
- sigma Suspicious File Created Via OneNote Application
- sigma File With Uncommon Extension Created By An Office Application
- sigma Suspicious File Created In PerfLogs
ends_with: .vbe 13 rules
Top techniques:Ingress Tool Transfer
T1105, Malicious File T1204.002, Trusted Developer Utilities Proxy Execution T1127, External Remote Services T1133, Remote Access Tools T1219, Lateral Tool Transfer T1570Sample rules (showing 8 of 13):
- sigma Suspicious File Created by ArcSOC.exe
- sigma Potentially Suspicious File Creation by OpenEDR's ITSMService
- sigma WScript or CScript Dropper - File
- sigma Uncommon File Creation By Mysql Daemon Process
- sigma Suspicious File Creation In Uncommon AppData Folder
- sigma Suspicious File Created Via OneNote Application
- sigma Suspicious File Created in Outlook Temporary Directory
- sigma File With Uncommon Extension Created By An Office Application
ends_with: .hta 12 rules
Top techniques:Ingress Tool Transfer
T1105, Malicious File T1204.002, Trusted Developer Utilities Proxy Execution T1127, External Remote Services T1133, Remote Access Tools T1219, Lateral Tool Transfer T1570Sample rules (showing 8 of 12):
- sigma Suspicious File Created by ArcSOC.exe
- sigma Potentially Suspicious File Creation by OpenEDR's ITSMService
- sigma Suspicious File Creation In Uncommon AppData Folder
- sigma Suspicious File Created Via OneNote Application
- sigma Suspicious File Created in Outlook Temporary Directory
- sigma File With Uncommon Extension Created By An Office Application
- sigma Suspicious File Created In PerfLogs
- sigma Potential Binary Or Script Dropper Via PowerShell
starts_with: C:\Users\ 12 rules
Top techniques:Bypass User Account Control
T1548.002, Visual Basic T1059.005, JavaScript T1059.007, Compromise Software Supply Chain T1195.002, Adversary-in-the-Middle T1557Sample rules (showing 8 of 12):
- sigma Creation Of a Suspicious ADS File Outside a Browser Download
- sigma WScript or CScript Dropper - File
- sigma Uncommon File Created by Notepad++ Updater Gup.EXE
- sigma Suspicious File Creation In Uncommon AppData Folder
- sigma Potential Binary Or Script Dropper Via PowerShell
- sigma PowerShell Script Dropped Via PowerShell.EXE
- sigma UAC Bypass Using .NET Code Profiler on MMC
- sigma UAC Bypass Using IEInstal - File
match: \AppData\Local\Temp\ 11 rules
Top techniques:Compromise Software Supply Chain
T1195.002, Adversary-in-the-Middle T1557, Spearphishing Attachment T1566.001, System Binary Proxy Execution T1218, Disable or Modify Tools T1562.001, LSASS Memory T1003.001Sample rules (showing 8 of 11):
- sigma Uncommon File Created by Notepad++ Updater Gup.EXE
- sigma ISO File Created Within Temp Folders
- sigma OneNote Attachment File Dropped In Suspicious Location
- sigma Publisher Attachment File Dropped In Suspicious Location
- sigma Potential Binary Or Script Dropper Via PowerShell
- sigma PowerShell Script Dropped Via PowerShell.EXE
- sigma Self Extraction Directive File Created In Potentially Suspicious Location
- sigma Suspicious PROCEXP152.sys File Created In TMP
ends_with: .cmd 8 rules
Top techniques:Ingress Tool Transfer
T1105, Malicious File T1204.002, Trusted Developer Utilities Proxy Execution T1127, External Remote Services T1133, Remote Access Tools T1219, Lateral Tool Transfer T1570Sample rules:
- sigma Suspicious File Created by ArcSOC.exe
- sigma Potentially Suspicious File Creation by OpenEDR's ITSMService
- sigma Suspicious File Creation In Uncommon AppData Folder
- sigma Suspicious File Created Via OneNote Application
- sigma File With Uncommon Extension Created By An Office Application
- sigma Potential Binary Or Script Dropper Via PowerShell
- sigma Suspicious File Write to SharePoint Layouts Directory
- sigma Suspicious Startup Folder Persistence
ends_with: .js 8 rules
Top techniques:Ingress Tool Transfer
T1105, Trusted Developer Utilities Proxy Execution T1127, External Remote Services T1133, Remote Access Tools T1219, Lateral Tool Transfer T1570, Visual Basic T1059.005Sample rules:
- sigma Suspicious File Created by ArcSOC.exe
- sigma Potentially Suspicious File Creation by OpenEDR's ITSMService
- sigma WScript or CScript Dropper - File
- sigma Suspicious File Created Via OneNote Application
- sigma Potential Binary Or Script Dropper Via PowerShell
- sigma Suspicious File Write to SharePoint Layouts Directory
- sigma Suspicious Binaries and Scripts in Public Folder
- sigma Suspicious Startup Folder Persistence
ends_with: .scr 8 rules
Top techniques:Malicious File
T1204.002, Ingress Tool Transfer T1105, Remote Access Tools T1219, Lateral Tool Transfer T1570, Screensaver T1546.002, Rundll32 T1218.011Sample rules:
- sigma Potentially Suspicious File Creation by OpenEDR's ITSMService
- sigma Suspicious Screensaver Binary File Creation
- sigma Suspicious File Creation In Uncommon AppData Folder
- sigma SCR File Write Event
- sigma File With Uncommon Extension Created By An Office Application
- sigma Suspicious File Created In PerfLogs
- sigma Potential Binary Or Script Dropper Via PowerShell
- sigma Suspicious Startup Folder Persistence
ends_with: .sys 6 rules
Top techniques:Exploitation for Privilege Escalation
T1068, Malicious File T1204.002, Command and Scripting Interpreter T1059Sample rules:
- sigma File With Uncommon Extension Created By An Office Application
- sigma Suspicious File Created In PerfLogs
- sigma Potential Binary Or Script Dropper Via PowerShell
- sigma Drop Binaries Into Spool Drivers Color Folder
- sigma Process Explorer Driver Creation By Non-Sysinternals Binary
- sigma Process Monitor Driver Creation By Non-Sysinternals Binary
ends_with: .wsf 6 rules
Top techniques:Malicious File
T1204.002, Ingress Tool Transfer T1105, Trusted Developer Utilities Proxy Execution T1127, External Remote Services T1133, System Binary Proxy Execution T1218, Registry Run Keys / Startup Folder T1547.001Sample rules:
- sigma Suspicious File Created by ArcSOC.exe
- sigma Suspicious File Created Via OneNote Application
- sigma File With Uncommon Extension Created By An Office Application
- sigma Potential Binary Or Script Dropper Via PowerShell
- sigma Legitimate Application Dropped Script
- sigma Suspicious Startup Folder Persistence
ends_with: .aspx 5 rules
ends_with: .docm 5 rules
ends_with: .dotm 5 rules
ends_with: .iso 5 rules
ends_with: .lnk 5 rules
ends_with: .xlsm 5 rules
ends_with: .xltm 5 rules
ends_with: .asp 4 rules
ends_with: .psm1 4 rules
ends_with: .zip 4 rules
eq: "*\\temp\\*" 4 rules
starts_with: C:\Windows\Temp\ 4 rules
ends_with: .7z 3 rules
ends_with: .ashx 3 rules
Sample rules:
ends_with: .chm 3 rules
Top techniques:Command and Scripting Interpreter
T1059ends_with: .com 3 rules
ends_with: .dmp 3 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
ends_with: .ocx 3 rules
ends_with: .potm 3 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
ends_with: .pptm 3 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
ends_with: .rar 3 rules
ends_with: .vba 3 rules
Top techniques:Visual Basic
T1059.005, JavaScript T1059.007, Spearphishing Attachment T1566.001, Malicious File T1204.002, Registry Run Keys / Startup Folder T1547.001Sample rules:
ends_with: :Zone.Identifier 3 rules
Top techniques:File Deletion
T1070.004in: "*\\Windows\\Temp\\*" 3 rules
in: "*\\Windows\\servicing\\*" 3 rules
match: .bat:Zone 3 rules
match: .dll:Zone 3 rules
match: .exe 3 rules
match: .exe:Zone 3 rules
match: .hta:Zone 3 rules
match: .ps1:Zone 3 rules
match: .vbe:Zone 3 rules
match: .vbs:Zone 3 rules
match: .xll:Zone 3 rules
match: :\Temp\ 3 rules
match: :\Users\ 3 rules
match: \AppData\ 3 rules
match: \Desktop\ 3 rules
match: \Start Menu\Programs\Startup\ 3 rules
match: \WindowsPowerShell\Modules\ 3 rules
match: \Windows\Temp\ 3 rules
Top techniques:Web Shell
T1505.003match: \lsass 3 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
starts_with: C:\Windows\System32\ 3 rules
ends_with: .cer 2 rules
ends_with: .cpl 2 rules
Top techniques:Spearphishing Attachment
T1566.001ends_with: .dat 2 rules
Sample rules:
ends_with: .diagcab 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
ends_with: .docx 2 rules
ends_with: .evtx 2 rules
Sample rules:
ends_with: .jar 2 rules
Sample rules:
ends_with: .jse 2 rules
Top techniques:Visual Basic
T1059.005, JavaScript T1059.007, Malicious File T1204.002, Registry Run Keys / Startup Folder T1547.001Sample rules:
ends_with: .jsp 2 rules
Sample rules:
ends_with: .key 2 rules
ends_with: .log 2 rules
Sample rules:
ends_with: .msi 2 rules
Sample rules:
ends_with: .pdf 2 rules
Top techniques:Malware
T1587.001Sample rules:
ends_with: .py 2 rules
ends_with: .rdp 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
ends_with: .scf 2 rules
Sample rules:
ends_with: .sed 2 rules
ends_with: .svg 2 rules
Sample rules:
ends_with: .txt 2 rules
Sample rules:
ends_with: .wll 2 rules
Sample rules:
ends_with: .wsh 2 rules
Sample rules:
ends_with: .xll 2 rules
Sample rules:
ends_with: .xls 2 rules
ends_with: .xlsx 2 rules
ends_with: .xlt 2 rules
ends_with: \Microsoft\Outlook\VbaProject.OTM 2 rules
Top techniques:Fallback Channels
T1008, Office Application Startup T1137, Event Triggered Execution T1546Sample rules:
ends_with: \WerFault.exe 2 rules
ends_with: \comctl32.dll 2 rules
Top techniques:Bypass User Account Control
T1548.002ends_with: \dns.log 2 rules
Top techniques:External Remote Services
T1133Sample rules:
ends_with: \ntds.dit 2 rules
Sample rules:
eq: "*:Zone.Identifier" 2 rules
Sample rules:
eq: "*\\appdata\\Roaming\\*" 2 rules
Top techniques:Screen Capture
T1113Sample rules:
eq: "*\\spool\\drivers\\x64\\*" 2 rules
Top techniques:Print Processors
T1547.012Sample rules:
- splunk Spoolsv Writing a DLL
- splunk Spoolsv Writing a DLL - Sysmon
eq: C:\Windows\System32\drivers\LiveKdD.SYS 2 rules
Sample rules:
in: "*.dll" 2 rules
Sample rules:
in: "*.exe" 2 rules
Sample rules:
in: "*:\\Temp\\*" 2 rules
Sample rules:
in: "*:\\Windows\\Temp\\*" 2 rules
Sample rules:
in: "*Recycle.bin*" 2 rules
in: "*\\AppData\\Local\\Temp\\*" 2 rules
Sample rules:
in: "*\\HttpProxy\\OAB\\*" 2 rules
Top techniques:External Remote Services
T1133, Exploit Public-Facing Application T1190, Web Shell T1505.003Sample rules:
in: "*\\HttpProxy\\owa\\auth\\*" 2 rules
Top techniques:External Remote Services
T1133, Exploit Public-Facing Application T1190, Web Shell T1505.003Sample rules:
in: "*\\PerfLogs\\*" 2 rules
in: "*\\ScreenConnect\\App_Extensions\\*" 2 rules
Top techniques:Exploit Public-Facing Application
T1190Sample rules:
in: "*\\Terminal Server Client\\Cache\\*.bmc" 2 rules
Sample rules:
in: "*\\Terminal Server Client\\Cache\\cache*.bin" 2 rules
Sample rules:
in: "*\\Users\\Administrator\\Music\\*" 2 rules
in: "*\\Users\\Default\\*" 2 rules
in: "*\\Windows\\Media\\*" 2 rules
in: "*\\Windows\\PLA\\Reports\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\PLA\\Rules\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\PLA\\Templates\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\Registration\\CRMLog\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\SysWOW64\\Com\\dmp\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\SysWOW64\\Tasks\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\System32\\Com\\dmp\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\System32\\LogFiles\\WMI\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\System32\\Tasks\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\System32\\spool\\PRINTERS\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\System32\\spool\\SERVERS\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\System32\\spool\\drivers\\color\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\Tasks\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\Windows\\repair\\*" 2 rules
in: "*\\Windows\\tracing\\*" 2 rules
Top techniques:Mshta
T1218.005Sample rules:
in: "*\\inetpub\\wwwroot\\aspnet_client\\*" 2 rules
Top techniques:External Remote Services
T1133, Exploit Public-Facing Application T1190, Web Shell T1505.003Sample rules:
match: .cmd:Zone 2 rules
Top techniques:NTFS File Attributes
T1564.004match: .dmp 2 rules
Sample rules:
match: .doc. 2 rules
Top techniques:Double File Extension
T1036.007Sample rules:
match: .docm:Zone 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
match: .docx. 2 rules
Top techniques:Double File Extension
T1036.007Sample rules:
match: .jpg. 2 rules
Top techniques:Double File Extension
T1036.007Sample rules:
match: .lnk:Zone 2 rules
Top techniques:NTFS File Attributes
T1564.004match: .one:Zone 2 rules
Top techniques:NTFS File Attributes
T1564.004match: .pdf. 2 rules
Top techniques:Double File Extension
T1036.007Sample rules:
match: .ppt. 2 rules
Top techniques:Double File Extension
T1036.007Sample rules:
match: .pptm:Zone 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
match: .pptx. 2 rules
Top techniques:Double File Extension
T1036.007Sample rules:
match: .xls. 2 rules
Top techniques:Double File Extension
T1036.007Sample rules:
match: .xlsm:Zone 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
match: .xlsx. 2 rules
Top techniques:Double File Extension
T1036.007Sample rules:
match: :\ProgramData\ 2 rules
match: :\Users\Public\ 2 rules
match: C:\$WINDOWS.~BT\ 2 rules
Top techniques:Match Legitimate Resource Name or Location
T1036.005match: C:\$WinREAgent\ 2 rules
Top techniques:Match Legitimate Resource Name or Location
T1036.005match: C:\PerfLogs\ 2 rules
match: C:\Users\Public\ 2 rules
match: C:\Windows\SoftwareDistribution\ 2 rules
Top techniques:Match Legitimate Resource Name or Location
T1036.005match: C:\Windows\SysWOW64\ 2 rules
Top techniques:Match Legitimate Resource Name or Location
T1036.005match: C:\Windows\System32\ 2 rules
Top techniques:Match Legitimate Resource Name or Location
T1036.005match: C:\Windows\WinSxS\ 2 rules
Top techniques:Match Legitimate Resource Name or Location
T1036.005match: C:\Windows\uus\ 2 rules
Top techniques:Match Legitimate Resource Name or Location
T1036.005match: \AppData\Local\ 2 rules
match: \AppData\Roaming\ 2 rules
match: \Microsoft\Excel\XLSTART 2 rules
match: \Microsoft\Word\STARTUP 2 rules
match: \Office 2 rules
match: \PowerShell\7\Modules\ 2 rules
Sample rules:
match: \Program Files 2 rules
match: \STARTUP 2 rules
match: \Users\ 2 rules
match: \Users\Public\ 2 rules
match: \XLSTART 2 rules
match: \hive_sam_ 2 rules
Sample rules:
match: \inetpub\wwwroot\ 2 rules
match: __PSScriptPolicyTest_ 2 rules
Sample rules:
regex_match: "(?<!\/)\b\w+(\.\w+)?:\w+(\.\w+)?$" 2 rules
Top techniques:NTFS File Attributes
T1564.004Sample rules:
starts_with: C:\$WINDOWS.~BT\NewOS\ 2 rules
Sample rules:
starts_with: C:\PerfLogs\ 2 rules
Top techniques:Command and Scripting Interpreter
T1059starts_with: C:\Windows\SysWOW64\ 2 rules
starts_with: C:\Windows\System32\winevt\Logs\ 2 rules
Sample rules:
starts_with: C:\Windows\WinSxS\ 2 rules
Top techniques:DLL
T1574.001Hashes 142 entries
match: IMPHASH=0E2216679CA6E1094D63322E3412D650 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, LSASS Memory T1003.001Sample rules:
match: IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, Bypass User Account Control T1548.002Sample rules:
match: IMPHASH=330768A4F172E10ACB6287B87289D83B 3 rules
Top techniques:NTFS File Attributes
T1564.004, Disable Windows Event Logging T1562.002, OS Credential Dumping T1003, Tool T1588.002Sample rules:
match: IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, LSASS Memory T1003.001Sample rules:
match: IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, Bypass User Account Control T1548.002Sample rules:
match: IMPHASH=3DE09703C8E79ED2CA3F01074719906B 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, Bypass User Account Control T1548.002Sample rules:
match: IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, Bypass User Account Control T1548.002Sample rules:
match: IMPHASH=5834ED4291BDEB928270428EBBAF7604 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, Bypass User Account Control T1548.002Sample rules:
match: IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, Bypass User Account Control T1548.002Sample rules:
match: IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, Bypass User Account Control T1548.002Sample rules:
match: IMPHASH=767637C23BB42CD5D7397CF58B0BE688 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, Bypass User Account Control T1548.002Sample rules:
match: IMPHASH=7D010C6BB6A3726F327F7E239166D127 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, Bypass User Account Control T1548.002Sample rules:
match: IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, Bypass User Account Control T1548.002Sample rules:
match: IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, LSASS Memory T1003.001Sample rules:
match: IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, Bypass User Account Control T1548.002Sample rules:
match: IMPHASH=E96A73C7BF33A464C510EDE582318BF2 3 rules
Top techniques:NTFS File Attributes
T1564.004, OS Credential Dumping T1003, Tool T1588.002, LSASS Memory T1003.001Sample rules:
match: IMPHASH=021BCCA20BA3381B11BDDE26B4E62F20 2 rules
Sample rules:
match: IMPHASH=03866661686829d806989e2fc5a72606 2 rules
Sample rules:
match: IMPHASH=0588081AB0E63BA785938467E1B10CCA 2 rules
Sample rules:
match: IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 2 rules
Sample rules:
match: IMPHASH=09D278F9DE118EF09163C6140255C690 2 rules
Sample rules:
match: IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 2 rules
Sample rules:
match: IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 2 rules
Sample rules:
match: IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 2 rules
Sample rules:
match: IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C 2 rules
Sample rules:
match: IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 2 rules
Sample rules:
match: IMPHASH=12ce1c0f3f5837ecc18a3782408fa975 2 rules
Top techniques:Domain Account
T1087.002, Remote System Discovery T1018, Domain Groups T1069.002, Domain Trust Discovery T1482Sample rules:
match: IMPHASH=13F08707F759AF6003837A150A371BA1 2 rules
Sample rules:
match: IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00 2 rules
match: IMPHASH=17244E8B6B8227E57FE709CCAD421420 2 rules
Sample rules:
match: IMPHASH=1781F06048A7E58B323F0B9259BE798B 2 rules
Sample rules:
match: IMPHASH=17B461A082950FC6332228572138B80C 2 rules
Sample rules:
match: IMPHASH=19584675D94829987952432E018D5056 2 rules
Sample rules:
match: IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E 2 rules
match: IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA 2 rules
match: IMPHASH=21aa085d54992511b9f115355e468782 2 rules
Top techniques:Domain Account
T1087.002, Remote System Discovery T1018, Domain Groups T1069.002, Domain Trust Discovery T1482Sample rules:
match: IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC 2 rules
Sample rules:
match: IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 2 rules
Sample rules:
match: IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 2 rules
Sample rules:
match: IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D 2 rules
Sample rules:
match: IMPHASH=25CE42B079282632708FC846129E98A5 2 rules
Sample rules:
match: IMPHASH=28dc68bb6d6bf4f6b2db8dd7588b2511 2 rules
Sample rules:
- sigma Malicious Driver Load
- sigma Vulnerable Driver Load
match: IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 2 rules
Sample rules:
match: IMPHASH=32089B8851BBF8BC2D014E9F37288C83 2 rules
Sample rules:
match: IMPHASH=37777A96245A3C74EB217308F3546F4C 2 rules
match: IMPHASH=3A19059BD7688CB88E70005F18EFC439 2 rules
Sample rules:
match: IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E 2 rules
Sample rules:
match: IMPHASH=3AD59991CCF1D67339B319B15A41B35D 2 rules
Sample rules:
match: IMPHASH=40445337761D80CF465136FAFB1F63E6 2 rules
Sample rules:
match: IMPHASH=45bfe170e0cd654bc1e2ae3fca3ac3f4 2 rules
Sample rules:
- sigma Malicious Driver Load
- sigma Vulnerable Driver Load
match: IMPHASH=49b639b4acbecc49d72a01f357aa4930 2 rules
Top techniques:Domain Account
T1087.002, Remote System Discovery T1018, Domain Groups T1069.002, Domain Trust Discovery T1482Sample rules:
match: IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F 2 rules
Sample rules:
match: IMPHASH=4DA924CF622D039D58BCE71CDF05D242 2 rules
Sample rules:
match: IMPHASH=4fbf3f084fbbb2470b80b2013134df35 2 rules
Top techniques:Domain Account
T1087.002, Remote System Discovery T1018, Domain Groups T1069.002, Domain Trust Discovery T1482Sample rules:
match: IMPHASH=51791678F351C03A0EB4E2A7B05C6E17 2 rules
Sample rules:
match: IMPHASH=563233BFA169ACC7892451F71AD5850A 2 rules
Sample rules:
match: IMPHASH=59223B5F52D8799D38E0754855CBDF42 2 rules
Sample rules:
match: IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4 2 rules
Sample rules:
match: IMPHASH=6118619783FC175BC7EBECFF0769B46E 2 rules
Sample rules:
match: IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 2 rules
Sample rules:
match: IMPHASH=680dad9e300346e05a85023965867201 2 rules
Top techniques:Domain Account
T1087.002, Remote System Discovery T1018, Domain Groups T1069.002, Domain Trust Discovery T1482Sample rules:
match: IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD 2 rules
match: IMPHASH=713C29B396B907ED71A72482759ED757 2 rules
Sample rules:
match: IMPHASH=730073214094CD328547BF1F72289752 2 rules
Sample rules:
match: IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F 2 rules
Sample rules:
match: IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46 2 rules
Sample rules:
match: IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28 2 rules
Sample rules:
match: IMPHASH=819B19D53CA6736448F9325A85736792 2 rules
Sample rules:
match: IMPHASH=81E75D8F1D276C156653D3D8813E4A43 2 rules
Sample rules:
match: IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E 2 rules
Sample rules:
match: IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE 2 rules
Sample rules:
match: IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E 2 rules
Sample rules:
match: IMPHASH=87575CB7A0E0700EB37F2E3668671A08 2 rules
Sample rules:
match: IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313 2 rules
Sample rules:
match: IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6 2 rules
Sample rules:
match: IMPHASH=8B114550386E31895DFAB371E741123D 2 rules
Sample rules:
match: IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 2 rules
Sample rules:
match: IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA 2 rules
Sample rules:
match: IMPHASH=96DF3A3731912449521F6F8D183279B1 2 rules
Sample rules:
match: IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF 2 rules
Sample rules:
match: IMPHASH=9D68781980370E00E0BD939EE5E6C141 2 rules
Sample rules:
match: IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206 2 rules
match: IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 2 rules
Sample rules:
match: IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC 2 rules
Sample rules:
match: IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB 2 rules
Sample rules:
match: IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE 2 rules
Sample rules:
match: IMPHASH=B12619881D79C3ACADF45E752A58554A 2 rules
match: IMPHASH=B18A1401FF8F444056D29450FBC0A6CE 2 rules
Sample rules:
match: IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 2 rules
Sample rules:
match: IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 2 rules
Sample rules:
match: IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 2 rules
Sample rules:
match: IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C 2 rules
Sample rules:
match: IMPHASH=CB567F9498452721D77A451374955F5F 2 rules
Sample rules:
match: IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 2 rules
Sample rules:
match: IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 2 rules
Sample rules:
match: IMPHASH=E6F9D5152DA699934B30DAAB206471F6 2 rules
Sample rules:
match: IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 2 rules
Sample rules:
match: IMPHASH=F1039CED4B91572AB7847D26032E6BBF 2 rules
match: IMPHASH=F9A28C458284584A93B14216308D31BD 2 rules
Sample rules:
match: IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3 2 rules
match: IMPHASH=FFDD59E0318B85A3E480874D9796D872 2 rules
Sample rules:
match: IMPHASH=bf6223a49e45d99094406777eb6004ba 2 rules
Sample rules:
match: IMPHASH=d144de8117df2beceaba2201ad304764 2 rules
Top techniques:Domain Account
T1087.002, Remote System Discovery T1018, Domain Groups T1069.002, Domain Trust Discovery T1482Sample rules:
match: IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d 2 rules
Sample rules:
match: SHA256=0409c9b12f9d0eda86e461ed9bdabeefb00172b26322079681a0bdf48e68dc28 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=083150724b49604c8765c1ba19541fa260b133be0acb0647fcd936d81f054499 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=1293525a19cfe3bc8296b62fbfe19f083632ed644a1c18c10b045a1d3030d81a 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=19074674c6fbdaa573b3081745e5e26144fdf7a086d14e0e220d1814f1f13078 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=1fbd8362b2d2d2e6a5750ae3db69cd1815e6c1d31da48a98b796450971a8e039 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=2fb6c04c4f95fb8d158af94c137f90ac820716deaf88d8ebec956254e046cb29 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=2fbbfc8299537ff80cadf9d0e27c223fe0ccb9052bf9d8763ad717bbfa521c77 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=3153d2baa462978dd22ab33d1c2274ecc88c200225d6a3327f98d5b752d08f5c 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=39ddceb56a15798826a5fc4892fa2b474c444bb4d7a8bf2fa95e41cab10fa7a1 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=44303d6572956f28a0f2e4b188934fb9874f2584f5c81fa431a463cfbf28083b 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=53f8adbd76c0eb16f5e43cadde422474d8a06f9c8f959389c1930042ad8beaa5 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=5b3c2d846ab162dc6bc595cce3a49de5731afde5d6060be7066d21b013a28373 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=5d38c46032a58e28ae5f7d174d8761ec3d64d186677f3ec53af5f51afb9bfd2f 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=648c8d2f8001c113d2986dd00b7bbd181593d462bef73522cee212c4f71f95b3 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=7cfb411d04bac42ef93d1f0c93c0a481e38c6f4612b97ae89d4702595988edc7 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=9ec7e6c8e1bfd883663d8d9d62c9e4f9ae373b731407181e32491b27a7218a2c 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=ae047e2095e46c3f9c518b2be67ec753f4f0aad23b261a361fcb6144dcdb63b4 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=af2b9161cfcb654b16408cd6b098afe9d1fb61a037d18d7090a119d4c0c8e0f0 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=b34b3c3a91e3165d1481f0b3ec23eab93a1cfba94345a6cbfe5b18ddbd48eac7 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=b3d21940a10fdef5e415ad70331ce257c24fe3bcf7722262302e0421791f87e8 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=b3f9c06151e30ee43d39e788a79cd918a314f24e04fe87f3de8272a2057b624f 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=b6e5c5d2567ae8c69cc012ebcae30e6c9b5359d64a58d17ba75ec89f8bce71ac 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=b6fc9493778cbe3bfc062d73f5cc604bc0ff058bc5e5dc6aac87f3a4008b54b6 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=bb67c7623ba92fe64ffd9816b8d5b3b1ea3013960a30bd4cf6e295b3eb5b1bad 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=c01356092a365b84f84f0e66870bd1a05ba3feb53cafd973fa5fea2534bee234 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=c2cfd23fdc6c0e1b1ffa0e545cbe556f18d11b362b4a89ba0713f6ab01c4827f 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=ccd11f2328023a0e7929e845d5b6e7bc783fb4650d65faef3ae090239d4bbce2 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=cd81b2792f0739f473c31c9cb7cf2313154bfa28b839975802b90e8790bb5058 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=ce95df7f69664c3df19b76028e115931919a71517b776da7b42d353e2ff4a670 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=d14c52d9220b606f428a8fe9f7c108b0d6f14cf71e7384749e98e6a95962e68f 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=d2513e58bb03ccc83affde685c6ef987924c37ce6707d8e9857e2524b0d7e90f 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=d3a0e1a79158f3985cd49607ebe0cdfcc49cb9af96b8f43aefd0cdfe2f22e663 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=e1e70fa42059911bc6685fafef957f9a73fc66f214d0704a9b932683a5204032 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=f49cde976e628012c9db73e1c8d76081944ecf2297cdafeb78bb13290da274c4 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=f5c5e962577e2293c4ad10603816dce7cc273585969615fbf4e4bfa9eaff1688 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=f7848034e010d55f15e474ca998f96391e320ff29b00cfcc4c5e536529703e75 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=f813484ea441404f18caad96f28138e8aaf0cb256163c09c2ab8a3acab87f69f 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
match: SHA256=fc4a0802ab9c7409b892ca00636bec61e2acfc911bccfdeb9978b8ab5a2f828d 2 rules
Top techniques:Internal Proxy
T1090.001Sample rules:
OriginalFileName 130 entries
eq: pwsh.dll 72 rules
Top techniques:PowerShell
T1059.001, Disable or Modify Tools T1562.001, Obfuscated Files or Information T1027, Modify Registry T1112, Command and Scripting Interpreter T1059, Ingress Tool Transfer T1105Sample rules (showing 8 of 72):
- sigma Windows AMSI Related Registry Tampering Via CommandLine
- sigma Potentially Suspicious Child Processes Spawned by ConHost
- sigma New DMSA Service Account Created in Specific OUs
- sigma Windows Credential Guard Registry Tampering Via CommandLine
- sigma Windows Defender Context Menu Removed
- sigma Security Event Logging Disabled via MiniNt Registry Key - Process
- sigma Potentially Suspicious NTFS Symlink Behavior Modification
- sigma HackTool - CrackMapExec PowerShell Obfuscation
eq: PowerShell.EXE 64 rules
Top techniques:PowerShell
T1059.001, Disable or Modify Tools T1562.001, Obfuscated Files or Information T1027, Command and Scripting Interpreter T1059, Windows Management Instrumentation T1047, Ingress Tool Transfer T1105Sample rules (showing 8 of 64):
- sigma Windows AMSI Related Registry Tampering Via CommandLine
- sigma Windows Credential Guard Registry Tampering Via CommandLine
- sigma Windows Defender Context Menu Removed
- sigma Security Event Logging Disabled via MiniNt Registry Key - Process
- sigma Potentially Suspicious NTFS Symlink Behavior Modification
- sigma HackTool - CrackMapExec PowerShell Obfuscation
- sigma Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine
- sigma Potentially Suspicious Child Process of KeyScrambler.exe
eq: wmic.exe 33 rules
Top techniques:Windows Management Instrumentation
T1047, System Information Discovery T1082, Malicious File T1204.002, Regsvr32 T1218.010, Account Discovery T1087, Visual Basic T1059.005Sample rules (showing 8 of 33):
- sigma Suspicious Autorun Registry Modified via WMI
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class
- sigma Potential Defense Evasion Via Rename Of Highly Relevant Binaries
- sigma Potentially Suspicious EventLog Recon Activity Using Log Query Utilities
- sigma Recon Information for Export with Command Prompt
- sigma Suspicious Windows Service Tampering
eq: Cmd.Exe 32 rules
Top techniques:Windows Command Shell
T1059.003, File Deletion T1070.004, Command and Scripting Interpreter T1059, Change Default File Association T1546.001, Exploitation for Client Execution T1203, Malicious File T1204.002Sample rules (showing 8 of 32):
- sigma Change Default File Association Via Assoc
- sigma Change Default File Association To Executable Via Assoc
- sigma Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE
- sigma File Deletion Via Del
- sigma Greedy File Deletion Using Del
- sigma File And SubFolder Enumeration Via Dir Command
- sigma Cmd Launched with Hidden Start Flags to Suspicious Targets
- sigma Potential Privilege Escalation Using Symlink Between Osk and Cmd
eq: reg.exe 29 rules
Top techniques:Disable or Modify Tools
T1562.001, Modify Registry T1112, Registry Run Keys / Startup Folder T1547.001, Indicator Blocking T1562.006, Control Panel T1218.002, Event Triggered Execution T1546Sample rules (showing 8 of 29):
- sigma Windows AMSI Related Registry Tampering Via CommandLine
- sigma Control Panel Items
- sigma Windows Credential Guard Registry Tampering Via CommandLine
- sigma Windows Defender Context Menu Removed
- sigma Security Event Logging Disabled via MiniNt Registry Key - Process
- sigma Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine
- sigma LSA PPL Protection Setting Modification via CommandLine
- sigma Suspicious MSHTA Child Process
eq: RUNDLL32.EXE 28 rules
Top techniques:Rundll32
T1218.011, Exploitation for Client Execution T1203, Exfiltration Over Unencrypted Non-C2 Protocol T1048.003, DLL T1574.001, NTFS File Attributes T1564.004, Windows Credential Manager T1555.004Sample rules (showing 8 of 28):
- sigma CobaltStrike Load by Rundll32
- sigma Potentially Suspicious Child Process of KeyScrambler.exe
- sigma Code Execution via Pcwutl.dll
- sigma Potential Rundll32 Execution With DLL Stored In ADS
- sigma Suspicious Advpack Call Via Rundll32.EXE
- sigma Rundll32 InstallScreenSaver Execution
- sigma Suspicious Key Manager Access
- sigma Suspicious NTLM Authentication on the Printer Spooler Service
eq: net.exe 16 rules
Top techniques:SMB/Windows Admin Shares
T1021.002, Service Stop T1489, Local Account T1136.001, Remote System Discovery T1018, Local Account T1087.001, Domain Account T1087.002Sample rules (showing 8 of 16):
- sigma Suspicious Group And Account Reconnaissance Activity Using Net.EXE
- sigma Unmount Share Via Net.EXE
- sigma Start Windows Service Via Net.EXE
- sigma Stop Windows Service Via Net.EXE
- sigma Windows Admin Share Mount Via Net.EXE
- sigma Windows Internet Hosted WebDav Share Mount Via Net.EXE
- sigma Windows Share Mount Via Net.EXE
- sigma System Network Connections Discovery Via Net.EXE
eq: net1.exe 16 rules
Top techniques:SMB/Windows Admin Shares
T1021.002, Service Stop T1489, Local Account T1136.001, Remote System Discovery T1018, Local Account T1087.001, Domain Account T1087.002Sample rules (showing 8 of 16):
- sigma Suspicious Group And Account Reconnaissance Activity Using Net.EXE
- sigma Unmount Share Via Net.EXE
- sigma Start Windows Service Via Net.EXE
- sigma Stop Windows Service Via Net.EXE
- sigma Windows Admin Share Mount Via Net.EXE
- sigma Windows Internet Hosted WebDav Share Mount Via Net.EXE
- sigma Windows Share Mount Via Net.EXE
- sigma System Network Connections Discovery Via Net.EXE
eq: cscript.exe 15 rules
Top techniques:System Binary Proxy Execution
T1218, Exploitation for Client Execution T1203, Visual Basic T1059.005, Command and Scripting Interpreter T1059, Indirect Command Execution T1202, DLL T1574.001Sample rules (showing 8 of 15):
- sigma Potentially Suspicious Child Processes Spawned by ConHost
- sigma Potentially Suspicious Child Process of KeyScrambler.exe
- sigma Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
- sigma Potential Register_App.Vbs LOLScript Abuse
- sigma Suspicious MSHTA Child Process
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma Potential Defense Evasion Via Rename Of Highly Relevant Binaries
eq: wscript.exe 15 rules
Top techniques:System Binary Proxy Execution
T1218, Exploitation for Client Execution T1203, Visual Basic T1059.005, Command and Scripting Interpreter T1059, Indirect Command Execution T1202, DLL T1574.001Sample rules (showing 8 of 15):
- sigma Potentially Suspicious Child Processes Spawned by ConHost
- sigma Potentially Suspicious Child Process of KeyScrambler.exe
- sigma Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
- sigma Potential Manage-bde.wsf Abuse To Proxy Execution
- sigma Potential Register_App.Vbs LOLScript Abuse
- sigma Suspicious MSHTA Child Process
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Microsoft Office Child Process
eq: netsh.exe 14 rules
Top techniques:Disable or Modify System Firewall
T1562.004, Network Sniffing T1040, Proxy T1090, System Network Configuration Discovery T1016, Netsh Helper DLL T1546.007, Rename Legitimate Utilities T1036.003Sample rules (showing 8 of 14):
- sigma New Firewall Rule Added Via Netsh.EXE
- sigma Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
- sigma RDP Connection Allowed Via Netsh.EXE
- sigma Firewall Rule Deleted Via Netsh.EXE
- sigma Firewall Disabled via Netsh.EXE
- sigma Netsh Allow Group Policy on Microsoft Defender Firewall
- sigma Firewall Configuration Discovery Via Netsh.EXE
- sigma Firewall Rule Update Via Netsh.EXE
eq: schtasks.exe 14 rules
Top techniques:Scheduled Task
T1053.005, PowerShell T1059.001, Match Legitimate Resource Name or Location T1036.005, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047Sample rules (showing 8 of 14):
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma Renamed Schtasks Execution
- sigma Schtasks From Suspicious Folders
- sigma Uncommon One Time Only Scheduled Task At 00:00
- sigma Potential SSH Tunnel Persistence Install Using A Scheduled Task
- sigma Potential Persistence Via Microsoft Compatibility Appraiser
- sigma Scheduled Task Executing Payload from Registry
eq: CertUtil.exe 13 rules
Top techniques:Obfuscated Files or Information
T1027, Ingress Tool Transfer T1105, Install Root Certificate T1553.004, System Binary Proxy Execution T1218, Phishing T1566, Spearphishing Attachment T1566.001Sample rules (showing 8 of 13):
- sigma New Root Certificate Installed Via Certutil.EXE
- sigma File Decoded From Base64/Hex Via Certutil.EXE
- sigma Suspicious Download Via Certutil.EXE
- sigma Suspicious File Downloaded From Direct IP Via Certutil.EXE
- sigma Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
- sigma File Encoded To Base64 Via Certutil.EXE
- sigma Suspicious File Encoded To Base64 Via Certutil.EXE
- sigma File In Suspicious Location Encoded To Base64 Via Certutil.EXE
eq: curl.exe 11 rules
Top techniques:Phishing
T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Malicious File T1204.002, Regsvr32 T1218.010, Command and Scripting Interpreter T1059Sample rules (showing 8 of 11):
- sigma Potential Cookies Session Hijacking
- sigma Curl Web Request With Potential Custom User-Agent
- sigma File Download From IP URL Via Curl.EXE
- sigma Suspicious File Download From IP Via Curl.EXE
- sigma Suspicious File Download From File Sharing Domain Via Curl.EXE
- sigma Insecure Transfer Via Curl.EXE
- sigma Insecure Proxy/DOH Transfer Via Curl.EXE
- sigma Local File Read Using Curl.EXE
eq: FINDSTR.EXE 10 rules
Top techniques:Credentials In Files
T1552.001, Group Policy Preferences T1552.006, Ingress Tool Transfer T1105, System Binary Proxy Execution T1218, NTFS File Attributes T1564.004, Security Software Discovery T1518.001Sample rules (showing 8 of 10):
- sigma Remote File Download Via Findstr.EXE
- sigma Findstr GPP Passwords
- sigma Findstr Launching .lnk File
- sigma LSASS Process Reconnaissance Via Findstr.EXE
- sigma Permission Misconfiguration Reconnaissance Via Findstr.EXE
- sigma Security Tools Keyword Lookup Via Findstr.EXE
- sigma Insensitive Subfolder Search Via Findstr.EXE
- sigma Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE
eq: REGSVR32.EXE 10 rules
Top techniques:Regsvr32
T1218.010, Mshta T1218.005, Hijack Execution Flow T1574, Rundll32 T1218.011, Command and Scripting Interpreter T1059Sample rules (showing 8 of 10):
- sigma Suspicious MSHTA Child Process
- sigma Potentially Suspicious Regsvr32 HTTP IP Pattern
- sigma Potentially Suspicious Regsvr32 HTTP/FTP Pattern
- sigma Regsvr32 Execution From Potential Suspicious Location
- sigma Regsvr32 Execution From Highly Suspicious Location
- sigma Regsvr32 DLL Execution With Suspicious File Extension
- sigma Regsvr32 DLL Execution With Uncommon Extension
- sigma LOLBIN Execution From Abnormal Drive
eq: sc.exe 10 rules
Top techniques:Disable or Modify Tools
T1562.001, Windows Service T1543.003, Services Registry Permissions Weakness T1574.011, Service Stop T1489, OS Credential Dumping T1003, Automated Collection T1119Sample rules (showing 8 of 10):
- sigma Disable Windows Defender AV Security Monitoring
- sigma Service StartupType Change Via Sc.EXE
- sigma Interesting Service Enumeration Via Sc.EXE
- sigma Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
- sigma Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
- sigma Service DACL Abuse To Hide Services Via Sc.EXE
- sigma Service Security Descriptor Tampering Via Sc.EXE
- sigma Stop Windows Service Via Sc.EXE
eq: bitsadmin.exe 9 rules
Top techniques:BITS Jobs
T1197, Rename Legitimate Utilities T1036.003, Ingress Tool Transfer T1105, Mshta T1218.005, Phishing T1566, Spearphishing Attachment T1566.001Sample rules (showing 8 of 9):
- sigma File Download Via Bitsadmin
- sigma Suspicious Download From Direct IP Via Bitsadmin
- sigma Suspicious Download From File-Sharing Website Via Bitsadmin
- sigma File With Suspicious Extension Downloaded Via Bitsadmin
- sigma File Download Via Bitsadmin To A Suspicious Target Folder
- sigma Monitoring For Persistence Via BITS
- sigma Suspicious MSHTA Child Process
- sigma Suspicious Microsoft OneNote Child Process
eq: odbcconf.exe 9 rules
Top techniques:Odbcconf
T1218.008, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Malicious File T1204.002, Regsvr32 T1218.010Sample rules (showing 8 of 9):
- sigma Driver/DLL Installation Via Odbcconf.EXE
- sigma Suspicious Driver/DLL Installation Via Odbcconf.EXE
- sigma Odbcconf.EXE Suspicious DLL Location
- sigma New DLL Registered Via Odbcconf.EXE
- sigma Potentially Suspicious DLL Registered Via Odbcconf.EXE
- sigma Response File Execution Via Odbcconf.EXE
- sigma Suspicious Response File Execution Via Odbcconf.EXE
- sigma Suspicious Microsoft OneNote Child Process
eq: whoami.exe 9 rules
Top techniques:System Owner/User Discovery
T1033, Local Account T1087.001, Remote System Discovery T1018, Account Discovery T1087, Web Shell T1505.003Sample rules (showing 8 of 9):
- sigma Renamed Whoami Execution
- sigma Local Accounts Discovery
- sigma Webshell Detection With Command Line Keywords
- sigma Enumerate All Information With Whoami.EXE
- sigma Whoami.EXE Execution From Privileged Process
- sigma Group Membership Reconnaissance Via Whoami.EXE
- sigma Whoami.EXE Execution With Output Option
- sigma Whoami.EXE Execution Anomaly
eq: powershell_ise.EXE 8 rules
Top techniques:Ingress Tool Transfer
T1105, PowerShell T1059.001, Disable or Modify Tools T1562.001, Command and Scripting Interpreter T1059, Malicious File T1204.002, Rename Legitimate Utilities T1036.003Sample rules:
- sigma Windows Defender Context Menu Removed
- sigma Suspicious Invoke-WebRequest Execution With DirectIP
- sigma Suspicious Invoke-WebRequest Execution
- sigma Elevated System Shell Spawned From Uncommon Parent Location
- splunk Malicious PowerShell Process With Obfuscation Techniques
- splunk Windows Explorer.exe Spawning PowerShell or Cmd
- splunk Windows Renamed Powershell Execution
- splunk Windows Sqlservr Spawning Shell
eq: powershell.exe 8 rules
Top techniques:Modify Registry
T1112, Indirect Command Execution T1202, System Binary Proxy Execution T1218, Domain Accounts T1078.002, Account Manipulation T1098, Indicator Removal T1070Sample rules:
- sigma Potentially Suspicious Child Processes Spawned by ConHost
- sigma New DMSA Service Account Created in Specific OUs
- sigma IIS WebServer Log Deletion via CommandLine Utilities
- sigma LSA PPL Protection Setting Modification via CommandLine
- sigma Suspicious Kerberos Ticket Request via CLI
- sigma Potential Defense Evasion Via Rename Of Highly Relevant Binaries
- sigma Registry Modification of MS-settings Protocol Handler
- sigma User Shell Folders Registry Modification via CommandLine
eq: MSHTA.EXE 7 rules
Top techniques:Mshta
T1218.005, Native API T1106, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Malicious File T1204.002Sample rules:
- sigma Remotely Hosted HTA File Executed Via Mshta.EXE
- sigma Suspicious JavaScript Execution Via Mshta.EXE
- sigma Suspicious Mshta.EXE Execution Patterns
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma LOLBIN Execution From Abnormal Drive
- sigma VMToolsd Suspicious Child Process
eq: CertOC.exe 6 rules
eq: FIND.EXE 6 rules
Top techniques:Group Policy Preferences
T1552.006, Security Software Discovery T1518.001, Steganography T1027.003, Masquerading T1036, Indirect Command Execution T1202Sample rules:
eq: PowerShell_ISE.EXE 6 rules
Top techniques:PowerShell
T1059.001, Disable or Modify Tools T1562.001, Command Obfuscation T1027.010, Msiexec T1218.007, Ingress Tool Transfer T1105, System Binary Proxy Execution T1218Sample rules:
- sigma Obfuscated PowerShell MSI Install via WindowsInstaller COM
- sigma PowerShell MSI Install via WindowsInstaller COM From Remote Location
- sigma PowerShell Download Pattern
- sigma Suspicious Uninstall of Windows Defender Feature via PowerShell
- sigma Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
- sigma Suspicious Windows Service Tampering
eq: RegAsm.exe 6 rules
Top techniques:Regsvcs/Regasm
T1218.009, Phishing T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Malicious File T1204.002, Regsvr32 T1218.010Sample rules:
- sigma Suspicious Microsoft OneNote Child Process
- sigma Suspicious Microsoft Office Child Process
- sigma RegAsm.EXE Execution Without CommandLine Flags or Files
- sigma Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
- sigma Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
- sigma Potential PowerShell Execution Via DLL
eq: WBADMIN.EXE 6 rules
Sample rules:
eq: msdt.exe 6 rules
eq: mshta.exe 6 rules
Top techniques:Exploitation for Client Execution
T1203, Indirect Command Execution T1202, System Binary Proxy Execution T1218, DLL T1574.001, JavaScript T1059.007, Deobfuscate/Decode Files or Information T1140Sample rules:
- sigma Potentially Suspicious Child Processes Spawned by ConHost
- sigma Potentially Suspicious Child Process of KeyScrambler.exe
- sigma MSHTA Execution with Suspicious File Extensions
- sigma Potential Defense Evasion Via Rename Of Highly Relevant Binaries
- sigma Script Interpreter Execution From Suspicious Folder
- sigma Potentially Suspicious Child Process Of WinRAR.EXE
eq: powershell_ise.exe 6 rules
Top techniques:Indirect Command Execution
T1202, System Binary Proxy Execution T1218, Domain Accounts T1078.002, Account Manipulation T1098, Indicator Removal T1070, PowerShell T1059.001Sample rules:
- sigma Potentially Suspicious Child Processes Spawned by ConHost
- sigma New DMSA Service Account Created in Specific OUs
- sigma IIS WebServer Log Deletion via CommandLine Utilities
- sigma Change PowerShell Policies to an Insecure Level
- sigma Potential Defense Evasion Via Rename Of Highly Relevant Binaries
- sigma Copy From Or To Admin Share Or Sysvol Folder
eq: HH.exe 5 rules
eq: InstallUtil.exe 5 rules
eq: RegSvcs.exe 5 rules
eq: msiexec.exe 5 rules
eq: CMSTP.EXE 4 rules
Top techniques:Phishing
T1566, Spearphishing Attachment T1566.001, Windows Management Instrumentation T1047, Malicious File T1204.002, Regsvr32 T1218.010, CMSTP T1218.003Sample rules:
eq: REGEDIT.EXE 4 rules
Sample rules:
eq: WinWord.exe 4 rules
eq: XCOPY.EXE 4 rules
eq: appcmd.exe 4 rules
eq: mstsc.exe 4 rules
eq: regsvr32.exe 4 rules
eq: robocopy.exe 4 rules
eq: wevtutil.exe 4 rules
eq: winget.exe 4 rules
eq: 7z.exe 3 rules
eq: 7za.exe 3 rules
eq: AddInUtil.exe 3 rules
Top techniques:System Binary Proxy Execution
T1218eq: Bash.exe 3 rules
eq: CONHOST.EXE 3 rules
eq: Excel.exe 3 rules
eq: IEExec.exe 3 rules
eq: POWERPNT.EXE 3 rules
eq: PingCastle.exe 3 rules
eq: RUNDLL32.exe 3 rules
eq: ScriptRunner.exe 3 rules
eq: VSSADMIN.EXE 3 rules
eq: WerFault.exe 3 rules
Sample rules:
eq: cmd.exe 3 rules
eq: diskshadow.exe 3 rules
eq: psexesvc.exe 3 rules
Top techniques:Rename Legitimate Utilities
T1036.003Sample rules:
eq: wget.exe 3 rules
eq: ATTRIB.EXE 2 rules
Top techniques:Hidden Files and Directories
T1564.001Sample rules:
eq: AdExp 2 rules
eq: AdFind.exe 2 rules
Top techniques:Domain Account
T1087.002, Remote System Discovery T1018, Domain Groups T1069.002, Domain Trust Discovery T1482Sample rules:
eq: AgentExecutor.exe 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
eq: Cmd.EXE 2 rules
eq: DSACLS.EXE 2 rules
Top techniques:System Binary Proxy Execution
T1218eq: DumpMinitool.arm64.exe 2 rules
Sample rules:
eq: DumpMinitool.exe 2 rules
Sample rules:
eq: DumpMinitool.x86.exe 2 rules
Sample rules:
eq: FX_VER_INTERNALNAME_STR 2 rules
Sample rules:
eq: IE4UINIT.EXE 2 rules
eq: MMC.exe 2 rules
eq: Microsoft.Workflow.Compiler.exe 2 rules
eq: MpCmdRun.exe 2 rules
eq: Msxsl.exe 2 rules
eq: NirCmd.exe 2 rules
Top techniques:Service Execution
T1569.002, Command and Scripting Interpreter T1059, Indirect Command Execution T1202Sample rules:
eq: PowerShell.Exe 2 rules
Top techniques:PowerShell
T1059.001eq: PresentationHost.exe 2 rules
Top techniques:System Binary Proxy Execution
T1218eq: REGINI.EXE 2 rules
Top techniques:Modify Registry
T1112Sample rules:
eq: REGSVR32.exe 2 rules
eq: RstrtMgr.dll 2 rules
Sample rules:
eq: WorkFolders.exe 2 rules
eq: \msiexec.exe 2 rules
Sample rules:
eq: bcdedit.exe 2 rules
eq: bsdtar 2 rules
Sample rules:
eq: cmdkey.exe 2 rules
Top techniques:Cached Domain Credentials
T1003.005eq: csi.exe 2 rules
eq: drvqry.exe 2 rules
Sample rules:
eq: dsquery.exe 2 rules
eq: esentutl.exe 2 rules
Sample rules:
eq: finger.exe 2 rules
Sample rules:
eq: fltMC.exe 2 rules
Top techniques:Indicator Removal
T1070, Impair Defenses T1562, Disable Windows Event Logging T1562.002Sample rules:
eq: fsutil.exe 2 rules
Sample rules:
eq: ftp.exe 2 rules
Sample rules:
eq: gpg.exe 2 rules
Top techniques:Data Encrypted for Impact
T1486Sample rules:
eq: javaw.exe 2 rules
eq: ksetup.exe 2 rules
Sample rules:
eq: ldifde.exe 2 rules
eq: livekd.exe 2 rules
Sample rules:
eq: msedge_proxy.exe 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
eq: msteams.exe 2 rules
Sample rules:
eq: nltestrk.exe 2 rules
Top techniques:System Network Configuration Discovery
T1016, Domain Trust Discovery T1482, Remote System Discovery T1018Sample rules:
eq: node.exe 2 rules
Top techniques:JavaScript
T1059.007eq: pcalua.exe 2 rules
eq: procdump 2 rules
Sample rules:
eq: psexec.c 2 rules
Sample rules:
eq: psservice.exe 2 rules
Sample rules:
eq: pssuspend.exe 2 rules
Sample rules:
eq: quser.exe 2 rules
eq: sdbinst.exe 2 rules
Top techniques:Application Shimming
T1546.011eq: sdelete.exe 2 rules
Top techniques:Data Destruction
T1485Sample rules:
eq: sysinfo.exe 2 rules
eq: tasklist.exe 2 rules
eq: toolbox-cmd.exe 2 rules
in: "EQNEDT32.EXE" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "Excel.exe" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "Graph.exe" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "MSACCESS.EXE" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "MSPUB.EXE" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "OUTLOOK.EXE" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "OneNote.exe" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "OneNoteIm.exe" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "OneNoteM.exe" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "POWERPNT.EXE" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "VISIO.EXE" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "WinProj.exe" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "WinWord.exe" 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
match: client32.exe 2 rules
Sample rules:
ParentImage 113 entries
ends_with: \powershell.exe 16 rules
Top techniques:PowerShell
T1059.001, System Binary Proxy Execution T1218, Visual Basic T1059.005, System Script Proxy Execution T1216, NTDS T1003.003, Browser Extensions T1176.001Sample rules (showing 8 of 16):
- sigma NTDS.DIT Creation By Uncommon Parent Process
- sigma Suspicious Chromium Browser Instance Executed With Custom Extension
- sigma Csc.EXE Execution Form Potentially Suspicious Parent
- sigma Suspicious Use of CSharp Interactive Console
- sigma File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell
- sigma HackTool - Default PowerSploit/Empire Scheduled Task Creation
- sigma Execute Code with Pester.bat as Parent
- sigma Potential Suspicious Mofcomp Execution
ends_with: \pwsh.exe 16 rules
Top techniques:PowerShell
T1059.001, System Binary Proxy Execution T1218, Visual Basic T1059.005, System Script Proxy Execution T1216, NTDS T1003.003, Browser Extensions T1176.001Sample rules (showing 8 of 16):
- sigma NTDS.DIT Creation By Uncommon Parent Process
- sigma Suspicious Chromium Browser Instance Executed With Custom Extension
- sigma Csc.EXE Execution Form Potentially Suspicious Parent
- sigma Suspicious Use of CSharp Interactive Console
- sigma File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell
- sigma HackTool - Default PowerSploit/Empire Scheduled Task Creation
- sigma Execute Code with Pester.bat as Parent
- sigma Potential Suspicious Mofcomp Execution
ends_with: \cscript.exe 14 rules
Top techniques:System Binary Proxy Execution
T1218, Visual Basic T1059.005, PowerShell T1059.001, NTDS T1003.003, Spearphishing Attachment T1566.001, Browser Extensions T1176.001Sample rules (showing 8 of 14):
- sigma NTDS.DIT Creation By Uncommon Parent Process
- sigma Office Macro File Creation From Suspicious Process
- sigma Suspicious Chromium Browser Instance Executed With Custom Extension
- sigma Csc.EXE Execution Form Potentially Suspicious Parent
- sigma Potential Recon Activity Using DriverQuery.EXE
- sigma DriverQuery.EXE Execution
- sigma Potential Manage-bde.wsf Abuse To Proxy Execution
- sigma Potential Suspicious Mofcomp Execution
ends_with: \wscript.exe 14 rules
Top techniques:System Binary Proxy Execution
T1218, Visual Basic T1059.005, PowerShell T1059.001, NTDS T1003.003, Spearphishing Attachment T1566.001, Browser Extensions T1176.001Sample rules (showing 8 of 14):
- sigma NTDS.DIT Creation By Uncommon Parent Process
- sigma Office Macro File Creation From Suspicious Process
- sigma Suspicious Chromium Browser Instance Executed With Custom Extension
- sigma Csc.EXE Execution Form Potentially Suspicious Parent
- sigma Potential Recon Activity Using DriverQuery.EXE
- sigma DriverQuery.EXE Execution
- sigma Potential Manage-bde.wsf Abuse To Proxy Execution
- sigma Potential Suspicious Mofcomp Execution
ends_with: \cmd.exe 13 rules
Top techniques:Windows Command Shell
T1059.003, System Binary Proxy Execution T1218, Hidden Files and Directories T1564.001, Browser Extensions T1176.001, System Language Discovery T1614.001, Network Share Discovery T1135Sample rules (showing 8 of 13):
- sigma Hiding Files with Attrib.exe
- sigma Suspicious Chromium Browser Instance Executed With Custom Extension
- sigma Console CodePage Lookup Via CHCP
- sigma Potential CommandLine Path Traversal Via Cmd.EXE
- sigma File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell
- sigma HackTool - Jlaive In-Memory Assembly Execution
- sigma Potential Suspicious Mofcomp Execution
- sigma Suspicious Msbuild Execution By Uncommon Parent Process
ends_with: \rundll32.exe 12 rules
Top techniques:System Binary Proxy Execution
T1218, PowerShell T1059.001, Rundll32 T1218.011, Spearphishing Attachment T1566.001, Browser Extensions T1176.001, Command and Scripting Interpreter T1059Sample rules (showing 8 of 12):
- sigma Office Macro File Creation From Suspicious Process
- sigma Suspicious Chromium Browser Instance Executed With Custom Extension
- sigma Conhost Spawned By Uncommon Parent Process
- sigma Potential Recon Activity Using DriverQuery.EXE
- sigma DriverQuery.EXE Execution
- sigma Suspicious MSDT Parent Process
- sigma Suspicious Mshta.EXE Execution Patterns
- sigma Suspicious PowerShell Parent Process
ends_with: \explorer.exe 11 rules
Top techniques:Malicious Copy and Paste
T1204.004, Command and Scripting Interpreter T1059, Distributed Component Object Model T1021.003, Windows Management Instrumentation T1047, File and Directory Discovery T1083, Indirect Command Execution T1202Sample rules (showing 8 of 11):
- sigma Conhost Spawned By Uncommon Parent Process
- sigma HackTool - Potential Impacket Lateral Movement Activity
- sigma Suspicious Msbuild Execution By Uncommon Parent Process
- sigma Notepad Password Files Discovery
- sigma Potentially Suspicious Office Document Executed From Trusted Location
- sigma Rundll32 Spawned Via Explorer.EXE
- sigma Potentially Suspicious Rundll32.EXE Execution of UDL File
- sigma Suspicious ClickFix/FileFix Execution Pattern
ends_with: \regsvr32.exe 11 rules
Top techniques:Command and Scripting Interpreter
T1059, System Binary Proxy Execution T1218, PowerShell T1059.001, Spearphishing Attachment T1566.001, Browser Extensions T1176.001, Masquerading T1036Sample rules (showing 8 of 11):
- sigma Office Macro File Creation From Suspicious Process
- sigma Suspicious Chromium Browser Instance Executed With Custom Extension
- sigma Unusual Parent Process For Cmd.EXE
- sigma Conhost Spawned By Uncommon Parent Process
- sigma Potential Recon Activity Using DriverQuery.EXE
- sigma DriverQuery.EXE Execution
- sigma Suspicious MSDT Parent Process
- sigma Suspicious Mshta.EXE Execution Patterns
ends_with: \mshta.exe 10 rules
Top techniques:Visual Basic
T1059.005, Mshta T1218.005, System Binary Proxy Execution T1218, PowerShell T1059.001, Spearphishing Attachment T1566.001, Browser Extensions T1176.001Sample rules (showing 8 of 10):
- sigma Office Macro File Creation From Suspicious Process
- sigma Suspicious Chromium Browser Instance Executed With Custom Extension
- sigma Csc.EXE Execution Form Potentially Suspicious Parent
- sigma Potential Recon Activity Using DriverQuery.EXE
- sigma DriverQuery.EXE Execution
- sigma Suspicious MSDT Parent Process
- sigma Suspicious MSHTA Child Process
- sigma Suspicious PowerShell Parent Process
ends_with: \svchost.exe 8 rules
Top techniques:Exfiltration Over Unencrypted Non-C2 Protocol
T1048.003, Command and Scripting Interpreter T1059, Distributed Component Object Model T1021.003, Mshta T1218.005, Indirect Command Execution T1202Sample rules:
- sigma Conhost Spawned By Uncommon Parent Process
- sigma ImagingDevices Unusual Parent/Child Processes
- sigma MMC20 Lateral Movement
- sigma Potential LethalHTA Technique Execution
- sigma WebDav Client Execution Via Rundll32.EXE
- sigma Suspicious WebDav Client Execution Via Rundll32.EXE
- sigma Suspicious Service Binary Directory
- sigma Wab/Wabmig Unusual Parent Or Child Processes
ends_with: \w3wp.exe 8 rules
Top techniques:Web Shell
T1505.003, Remote System Discovery T1018, System Owner/User Discovery T1033, Account Discovery T1087, NTDS T1003.003, IIS Components T1505.004Sample rules:
- sigma NTDS.DIT Creation By Uncommon Parent Process
- sigma Suspicious IIS Module Registration
- sigma Suspicious PowerShell Parent Process
- sigma Chopper Webshell Process Pattern
- sigma Webshell Hacking Activity Patterns
- sigma Webshell Detection With Command Line Keywords
- sigma Suspicious Process By Web Server Process
- sigma Webshell Tool Reconnaissance Activity
ends_with: \java.exe 7 rules
Top techniques:Web Shell
T1505.003, Remote System Discovery T1018, System Owner/User Discovery T1033, Account Discovery T1087, Exploitation of Remote Services T1210, Exploit Public-Facing Application T1190Sample rules:
- sigma Suspicious Processes Spawned by Java.EXE
- sigma Shell Process Spawned by Java.EXE
- sigma Suspicious SysAidServer Child
- sigma Webshell Hacking Activity Patterns
- sigma Webshell Detection With Command Line Keywords
- sigma Suspicious Process By Web Server Process
- sigma Webshell Tool Reconnaissance Activity
ends_with: \services.exe 7 rules
Top techniques:Command and Scripting Interpreter
T1059, Distributed Component Object Model T1021.003, Windows Management Instrumentation T1047, Token Impersonation/Theft T1134.001, Create Process with Token T1134.002, PowerShell T1059.001Sample rules:
- sigma Conhost Spawned By Uncommon Parent Process
- sigma HackTool - Potential Impacket Lateral Movement Activity
- sigma Potential Meterpreter/CobaltStrike Activity
- sigma Suspicious PowerShell Parent Process
- sigma Abused Debug Privilege by Arbitrary Parent Processes
- sigma Suspicious Service Binary Directory
- sigma Uncommon Svchost Parent Process
ends_with: \httpd.exe 6 rules
ends_with: \nginx.exe 6 rules
ends_with: \php-cgi.exe 6 rules
match: \tomcat 6 rules
ends_with: \dllhost.exe 5 rules
ends_with: \javaw.exe 5 rules
eq: - 5 rules
ends_with: \caddy.exe 4 rules
ends_with: \chrome.exe 4 rules
ends_with: \outlook.exe 4 rules
ends_with: \spoolsv.exe 4 rules
ends_with: \wsl.exe 4 rules
Top techniques:System Binary Proxy Execution
T1218, Indirect Command Execution T1202, Masquerading T1036Sample rules:
match: -tomcat- 4 rules
match: :\Windows\Temp\ 4 rules
match: \AppData\Local\Temp\ 4 rules
Top techniques:Indicator Removal
T1070, Impair Defenses T1562, Disable Windows Event Logging T1562.002, Msiexec T1218.007, Scheduled Task T1053.005, PowerShell T1059.001Sample rules:
ends_with: \EXCEL.EXE 3 rules
ends_with: \MSPUB.exe 3 rules
ends_with: \MsMpEng.exe 3 rules
ends_with: \POWERPNT.exe 3 rules
ends_with: \VISIO.exe 3 rules
ends_with: \WINWORD.EXE 3 rules
ends_with: \WebEx\WebexHost.exe 3 rules
Top techniques:NTFS File Attributes
T1564.004Sample rules:
ends_with: \WindowsTerminal.exe 3 rules
Top techniques:PowerShell
T1059.001ends_with: \WmiPrvSE.exe 3 rules
ends_with: \csrss.exe 3 rules
ends_with: \firefox.exe 3 rules
Sample rules:
ends_with: \lsass.exe 3 rules
ends_with: \mmc.exe 3 rules
ends_with: \msedge.exe 3 rules
Top techniques:Malicious Copy and Paste
T1204.004Sample rules:
ends_with: \onenote.exe 3 rules
ends_with: \powershell_ise.exe 3 rules
ends_with: \smss.exe 3 rules
ends_with: \sqlservr.exe 3 rules
Sample rules:
ends_with: \thor\thor64.exe 3 rules
Top techniques:NTFS File Attributes
T1564.004Sample rules:
ends_with: \userinit.exe 3 rules
Top techniques:Command and Scripting Interpreter
T1059, Process Injection T1055, Logon Script (Windows) T1037.001Sample rules:
ends_with: \winlogon.exe 3 rules
ends_with: \wmiprvse.exe 3 rules
ends_with: \ws_tomcatservice.exe 3 rules
eq: C:\Windows\System32\msiexec.exe 3 rules
eq: C:\Windows\System32\svchost.exe 3 rules
match: \AppData\Local\ 3 rules
Top techniques:Indirect Command Execution
T1202Sample rules:
ends_with: \AppData\Local\Programs\Microsoft VS Code\Code.exe 2 rules
Sample rules:
ends_with: \DllHost.exe 2 rules
Sample rules:
ends_with: \Dropbox.exe 2 rules
Sample rules:
ends_with: \EQNEDT32.EXE 2 rules
Top techniques:Windows Management Instrumentation
T1047, Malicious File T1204.002, Regsvr32 T1218.010Sample rules:
ends_with: \GoogleUpdate.exe 2 rules
Top techniques:Command and Scripting Interpreter
T1059Sample rules:
ends_with: \MSACCESS.EXE 2 rules
Top techniques:Windows Management Instrumentation
T1047, Malicious File T1204.002, Regsvr32 T1218.010Sample rules:
ends_with: \Microsoft.Management.Services.IntuneWindowsAgent.exe 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
ends_with: \ONENOTE.EXE 2 rules
Top techniques:Windows Management Instrumentation
T1047, Malicious File T1204.002, Regsvr32 T1218.010Sample rules:
ends_with: \bginfo.exe 2 rules
Top techniques:Visual Basic
T1059.005, Indirect Command Execution T1202, System Binary Proxy Execution T1218Sample rules:
ends_with: \bginfo64.exe 2 rules
Top techniques:Visual Basic
T1059.005, Indirect Command Execution T1202, System Binary Proxy Execution T1218Sample rules:
ends_with: \brave.exe 2 rules
Top techniques:Malicious Copy and Paste
T1204.004Sample rules:
ends_with: \code.exe 2 rules
ends_with: \conhost.exe 2 rules
Sample rules:
ends_with: \eventvwr.exe 2 rules
Sample rules:
ends_with: \excel.exe 2 rules
ends_with: \gup.exe 2 rules
ends_with: \iexplore.exe 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
ends_with: \microsoftedge.exe 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
ends_with: \msiexec.exe 2 rules
Sample rules:
ends_with: \ngen.exe 2 rules
Top techniques:Match Legitimate Resource Name or Location
T1036.005, Rename Legitimate Utilities T1036.003Sample rules:
ends_with: \pcwrun.exe 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
ends_with: \provlaunch.exe 2 rules
Top techniques:System Binary Proxy Execution
T1218Sample rules:
ends_with: \python.exe 2 rules
Top techniques:Command and Scripting Interpreter
T1059Sample rules:
ends_with: \rpcnet.exe 2 rules
Sample rules:
ends_with: \slui.exe 2 rules
Sample rules:
ends_with: \sqlagent.exe 2 rules
Sample rules:
ends_with: \vivaldi.exe 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
ends_with: \wermgr.exe 2 rules
Sample rules:
ends_with: \wininit.exe 2 rules
ends_with: \wordpad.exe 2 rules
Top techniques:Windows Management Instrumentation
T1047, Malicious File T1204.002, Regsvr32 T1218.010Sample rules:
ends_with: \wordview.exe 2 rules
Top techniques:Windows Management Instrumentation
T1047, Malicious File T1204.002, Regsvr32 T1218.010Sample rules:
ends_with: \wslhost.exe 2 rules
Sample rules:
- sigma WSL Child Process Anomaly
- sigma WSL Kali-Linux Usage
ends_with: \wsmprovhost.exe 2 rules
eq: "*\\explorer.exe" 2 rules
Sample rules:
eq: C:\ProgramData\chocolatey\choco.exe 2 rules
Top techniques:Compile After Delivery
T1027.004, Visual Basic T1059.005, JavaScript T1059.007, Mshta T1218.005Sample rules:
eq: C:\Windows\SysWOW64\msiexec.exe 2 rules
eq: C:\Windows\System32\inetsrv\w3wp.exe 2 rules
Top techniques:Compile After Delivery
T1027.004, Visual Basic T1059.005, JavaScript T1059.007, Mshta T1218.005Sample rules:
eq: C:\Windows\System32\lxss\wslhost.exe 2 rules
Sample rules:
eq: C:\Windows\System32\sdiagnhost.exe 2 rules
Top techniques:Compile After Delivery
T1027.004, Visual Basic T1059.005, JavaScript T1059.007, Mshta T1218.005Sample rules:
eq: C:\Windows\System32\services.exe 2 rules
Top techniques:Bypass User Account Control
T1548.002Sample rules:
eq: C:\Windows\explorer.exe 2 rules
Sample rules:
in: "*\\ProgramData\\*" 2 rules
in: "*\\Temp\\*" 2 rules
in: "*\\Users\\*" 2 rules
in: "*\\\\*" 2 rules
match: :\Users\Public\ 2 rules
match: :\Windows\SysWOW64\ 2 rules
Sample rules:
match: :\Windows\System32\ 2 rules
Sample rules:
match: C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
match: \AppData\ 2 rules
Top techniques:NTDS
T1003.003Sample rules:
match: \PerfLogs\ 2 rules
Top techniques:NTDS
T1003.003Sample rules:
match: \Public\ 2 rules
Top techniques:NTDS
T1003.003Sample rules:
match: \Temp\ 2 rules
Top techniques:NTDS
T1003.003Sample rules:
match: \Users\Public\ 2 rules
Sample rules:
match: \Windows\Temp\ 2 rules
Sample rules:
match: \apache 2 rules
Top techniques:NTDS
T1003.003Sample rules:
match: \gc_worker.exe 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
starts_with: C:\Program Files (x86)\ 2 rules
Top techniques:Compile After Delivery
T1027.004, Visual Basic T1059.005, JavaScript T1059.007, Mshta T1218.005Sample rules:
starts_with: C:\Program Files\ 2 rules
Top techniques:Compile After Delivery
T1027.004, Visual Basic T1059.005, JavaScript T1059.007, Mshta T1218.005Sample rules:
Details 96 entries
eq: "0x00000001" 42 rules
Top techniques:Modify Registry
T1112, Disable or Modify Tools T1562.001, Office Application Startup T1137, Hidden Files and Directories T1564.001, Bypass User Account Control T1548.002, Inhibit System Recovery T1490Sample rules (showing 8 of 42):
- splunk Disable Registry Tool
- splunk Disable Show Hidden Files
- splunk Disable UAC Remote Restriction
- splunk Disable Windows Behavior Monitoring
- splunk Disabling CMD Application
- splunk Disabling ControlPanel
- splunk Disabling FolderOptions Windows Feature
- splunk Disabling NoRun Windows App
eq: DWORD (0x00000000) 38 rules
Top techniques:Disable or Modify Tools
T1562.001, Modify Registry T1112, Impair Defenses T1562, Disable or Modify System Firewall T1562.004, Hidden Files and Directories T1564.001, Bypass User Account Control T1548.002Sample rules (showing 8 of 38):
- sigma NetNTLM Downgrade Attack - Registry
- sigma AMSI Disabled via Registry Modification
- sigma IE Change Domain Zone
- sigma CrashControl CrashDump Disabled
- sigma Service Binary in Suspicious Folder
- sigma Windows Credential Guard Disabled - Registry
- sigma Antivirus Filter Driver Disallowed On Dev Drive - Registry
- sigma Windows Hypervisor Enforced Code Integrity Disabled
eq: DWORD (0x00000001) 37 rules
Top techniques:Modify Registry
T1112, Disable or Modify Tools T1562.001, Office Application Startup T1137, Registry Run Keys / Startup Folder T1547.001, Internal Defacement T1491.001, Inhibit System Recovery T1490Sample rules (showing 8 of 37):
- sigma NetNTLM Downgrade Attack - Registry
- sigma Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback
- sigma Allow RDP Remote Assistance Feature
- sigma CurrentVersion NT Autorun Keys Modification
- sigma IE Change Domain Zone
- sigma Service Binary in Suspicious Folder
- sigma Potentially Suspicious Desktop Background Change Via Registry
- sigma Hypervisor Enforced Paging Translation Disabled
eq: "0x00000000" 27 rules
Top techniques:Disable or Modify Tools
T1562.001, Modify Registry T1112, Abuse Elevation Control Mechanism T1548, Hidden Files and Directories T1564.001, Bypass User Account Control T1548.002, Data Destruction T1485Sample rules (showing 8 of 27):
- splunk Allow Operation with Consent Admin
- splunk Disable AMSI Through Registry
- splunk Disable ETW Through Registry
- splunk Disable Show Hidden Files
- splunk Disabling Remote User Account Control
- splunk Hide User Account From Sign-In Screen
- splunk Windows Disable Memory Crash Dump
- splunk Windows Disable Shutdown Button Through Registry
eq: (Empty) 24 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001, Modify Registry T1112, Bypass User Account Control T1548.002, AppInit DLLs T1546.010, Change Default File Association T1546.001, System Binary Proxy Execution T1218Sample rules (showing 8 of 24):
- sigma New DLL Added to AppInit_DLLs Registry Key
- sigma Shell Open Registry Keys Manipulation
- sigma Atbroker Registry Change
- sigma Classes Autorun Keys Modification
- sigma Common Autorun Keys Modification
- sigma CurrentControlSet Autorun Keys Modification
- sigma CurrentVersion Autorun Keys Modification
- sigma CurrentVersion NT Autorun Keys Modification
eq: 0x00000001 12 rules
Top techniques:Modify Registry
T1112, Disable or Modify Tools T1562.001, OS Credential Dumping T1003, Browser Session Hijacking T1185, Service Stop T1489Sample rules (showing 8 of 12):
- splunk Disable Defender AntiVirus Registry
- splunk Disable Defender BlockAtFirstSeen Feature
- splunk Disable Defender Enhanced Notification
- splunk Enable WDigest UseLogonCredential Registry
- splunk Windows Chrome Auto-Update Disabled via Registry
- splunk Windows Modify Registry Configure BitLocker
- splunk Windows Modify Registry DisableRemoteDesktopAntiAlias
- splunk Windows Modify Registry DisableSecuritySettings
eq: DWORD (0x00000002) 9 rules
Top techniques:Modify Registry
T1112, Disable or Modify Tools T1562.001, Office Application Startup T1137, LSASS Memory T1003.001, Dynamic Data Exchange T1559.002, Impair Defenses T1562Sample rules (showing 8 of 9):
- sigma NetNTLM Downgrade Attack - Registry
- sigma Service Binary in Suspicious Folder
- sigma Registry Modification to Hidden File Extension
- sigma Internet Explorer DisableFirstRunCustomize Enabled
- sigma Lsass Full Dump Request Via DumpType Registry Settings
- sigma Enable Microsoft Dynamic Data Exchange
- sigma Potential Attachment Manager Settings Attachments Tamper
- sigma ETW Logging Disabled For rpcrt4.dll
match: \AppData\Local\Temp\ 9 rules
Top techniques:Disable or Modify Tools
T1562.001, Registry Run Keys / Startup Folder T1547.001, Netsh Helper DLL T1546.007, OS Credential Dumping T1003, Image File Execution Options Injection T1546.012, Change Default File Association T1546.001Sample rules (showing 8 of 9):
- sigma Windows Defender Exploit Guard Tamper
- sigma Suspicious Path In Keyboard Layout IME File Registry Value
- sigma New Netsh Helper DLL Registered From A Suspicious Location
- sigma Potentially Suspicious ODBC Driver Registered
- sigma Potential Persistence Via App Paths Default Property
- sigma Registry Persistence via Explorer Run Key
- sigma New RUN Key Pointing to Suspicious Folder
- sigma Suspicious Shell Open Command Registry Modification
eq: 0x00000000 8 rules
Top techniques:Disable or Modify Tools
T1562.001, Modify Registry T1112, Trusted Developer Utilities Proxy Execution T1127, Indicator Blocking T1562.006, Browser Session Hijacking T1185, LSA Secrets T1003.004Sample rules:
- splunk Disable Defender MpEngine Registry
- splunk Disable Defender Spynet Reporting
- splunk Disable Defender Submit Samples Consent Feature
- splunk ETW Registry Disabled
- splunk Windows Chrome Auto-Update Disabled via Registry
- splunk Windows LSA Secrets NoLMhash Registry
- splunk Windows Modify Registry AuthenticationLevelOverride
- splunk Windows Modify Registry Disable Restricted Admin
match: powershell 8 rules
Top techniques:Service Execution
T1569.002, SMB/Windows Admin Shares T1021.002, Windows Service T1543.003, Indirect Command Execution T1202, Malicious Copy and Paste T1204.004, Malicious Link T1204.001Sample rules:
- sigma Potential CobaltStrike Service Installations - Registry
- sigma Custom File Open Handler Executes PowerShell
- sigma Persistence Via Disk Cleanup Handler - Autorun
- sigma FileFix - Command Evidence in TypedPaths
- sigma Potential ClickFix Execution Pattern - Registry
- sigma PowerShell as a Service in Registry
- sigma Suspicious PowerShell In Registry Run Keys
- sigma Potentially Suspicious Command Executed Via Run Dialog Box - Registry
match: \Users\Public\ 5 rules
eq: 0 4 rules
eq: Binary Data 4 rules
match: %tmp% 4 rules
match: :\Users\ 4 rules
match: :\Users\Public\ 4 rules
match: :\Windows\Temp\ 4 rules
match: \Contacts\ 4 rules
match: \Windows\Temp\ 4 rules
match: cscript 4 rules
match: mshta 4 rules
match: pwsh 4 rules
match: rundll32 4 rules
match: wscript 4 rules
ends_with: .dll 3 rules
Sample rules:
eq: "Binary Data" 3 rules
Top techniques:Modify Registry
T1112match: # 3 rules
match: %temp% 3 rules
match: .dll 3 rules
match: :\Perflogs\ 3 rules
match: \Desktop\ 3 rules
match: \Favorites\ 3 rules
match: \Favourites\ 3 rules
match: \Pictures\ 3 rules
match: \Temporary Internet 3 rules
match: cmd 3 rules
match: regsvr32 3 rules
ends_with: .exe" /burn.runonce 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
eq: %%systemroot%%\system32\ntdsa.dll 2 rules
Sample rules:
- sigma DLL Load via LSASS
- sigma ServiceDll Hijack
eq: 1 2 rules
Sample rules:
eq: DWORD (0x00000004) 2 rules
Sample rules:
eq: DWORD (0x00000009) 2 rules
eq: cpwmon64_v40.dll 2 rules
Sample rules:
eq: {472083B0-C522-11CF-8763-00608CC02F24} 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
eq: {472083B1-C522-11CF-8763-00608CC02F24} 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
eq: {807583E5-5146-11D5-A672-00B0D022E945} 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: 2 rules
match: %AppData% 2 rules
match: %comspec% 2 rules
Sample rules:
match: .bat 2 rules
match: .exe 2 rules
match: .hta 2 rules
match: 0x00000001 2 rules
match: :\ProgramData\ 2 rules
Sample rules:
match: :\Temp\ 2 rules
Sample rules:
match: Invoke- 2 rules
match: \AppData\Roaming\ 2 rules
match: \Downloads\ 2 rules
match: \Microsoft\Windows\Start Menu\Programs\Startup\ 2 rules
match: \PerfLogs\ 2 rules
match: account 2 rules
Sample rules:
match: anti-bot 2 rules
Sample rules:
match: bitsadmin 2 rules
Sample rules:
match: botcheck 2 rules
Sample rules:
match: captcha 2 rules
Sample rules:
match: certutil 2 rules
Sample rules:
match: challenge 2 rules
Sample rules:
match: confirmation 2 rules
Sample rules:
match: curl 2 rules
Sample rules:
match: finger 2 rules
Sample rules:
match: fraud 2 rules
Sample rules:
match: http 2 rules
match: human 2 rules
Sample rules:
match: identification 2 rules
Sample rules:
match: identificator 2 rules
Sample rules:
match: identity 2 rules
Sample rules:
match: iex 2 rules
match: robot 2 rules
Sample rules:
match: schtasks 2 rules
Sample rules:
match: validation 2 rules
Sample rules:
match: verification 2 rules
Sample rules:
match: verify 2 rules
Sample rules:
match: wget 2 rules
Sample rules:
match: 2 rules
match: 2 rules
match: 2 rules
match: 2 rules
match: 2 rules
match: 2 rules
match: 2 rules
match: 2 rules
match: 2 rules
match: 2 rules
match: 2 rules
match: 2 rules
starts_with: C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\ 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
TargetObject 73 entries
ends_with: \EulaAccepted 4 rules
match: \Active Directory Explorer 3 rules
Top techniques:Tool
T1588.002match: \Handle 3 rules
Top techniques:Tool
T1588.002match: \LiveKd 3 rules
Top techniques:Tool
T1588.002match: \ProcDump 3 rules
Top techniques:Tool
T1588.002match: \Process Explorer 3 rules
Top techniques:Tool
T1588.002match: \PsExec 3 rules
Top techniques:Tool
T1588.002match: \PsLoglist 3 rules
Top techniques:Tool
T1588.002match: \PsPasswd 3 rules
Top techniques:Tool
T1588.002match: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ 3 rules
Top techniques:Impair Defenses
T1562match: \Services\ 3 rules
Top techniques:Disable or Modify Tools
T1562.001, Service Execution T1569.002, Windows Service T1543.003Sample rules:
match: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 3 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Software\Microsoft\Windows\CurrentVersion\Run 3 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 3 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
ends_with: (Default) 2 rules
Top techniques:Image File Execution Options Injection
T1546.012ends_with: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel 2 rules
Top techniques:Modify Registry
T1112Sample rules:
ends_with: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun 2 rules
Top techniques:Modify Registry
T1112Sample rules:
ends_with: \(Default) 2 rules
Sample rules:
ends_with: \ChannelAccess 2 rules
ends_with: \DeviceGuard\EnableVirtualizationBasedSecurity 2 rules
Top techniques:Disable or Modify Tools
T1562.001ends_with: \DeviceGuard\LsaCfgFlags 2 rules
Top techniques:Disable or Modify Tools
T1562.001ends_with: \Driver 2 rules
Top techniques:OS Credential Dumping
T1003Sample rules:
ends_with: \Enabled 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
ends_with: \ImagePath 2 rules
Sample rules:
ends_with: \Lsa\LsaCfgFlags 2 rules
Top techniques:Disable or Modify Tools
T1562.001ends_with: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\url1 2 rules
ends_with: \Start 2 rules
Top techniques:Modify Registry
T1112Sample rules:
ends_with: \URL 2 rules
Top techniques:Modify Registry
T1112Sample rules:
match: ControlSet 2 rules
Sample rules:
match: Ime File 2 rules
Top techniques:Disable or Modify Tools
T1562.001match: Index 2 rules
Top techniques:Impair Defenses
T1562Sample rules:
match: SYSTEM\ 2 rules
Sample rules:
match: Software\Microsoft\Office\ 2 rules
Sample rules:
match: \CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Control\Keyboard Layouts\ 2 rules
Top techniques:Disable or Modify Tools
T1562.001match: \Directory\Shellex\CopyHookHandlers 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Directory\Shellex\DragDropHandlers 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Drivers32 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001match: \Explorer\Browser Helper Objects 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Explorer\SharedTaskScheduler 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Explorer\ShellExecuteHooks 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Explorer\ShellIconOverlayIdentifiers 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Explorer\ShellServiceObjects 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Folder\ShellEx\DragDropHandlers 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Folder\ShellEx\ExtShellFolderViews 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Image File Execution Options 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001match: \Image File Execution Options\ 2 rules
match: \Microsoft\Office\ 2 rules
Top techniques:Disable or Modify Tools
T1562.001match: \Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\ 2 rules
Sample rules:
match: \Microsoft\Office\Outlook\Addins\Avast.AsOutExt\ 2 rules
Sample rules:
match: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\ 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
match: \RunOnceEx\ 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \RunOnce\ 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \RunServicesOnce\ 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \RunServices\ 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Run\ 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \SDelete 2 rules
Top techniques:Tool
T1588.002match: \SOFTWARE\Microsoft\NetSh 2 rules
Top techniques:Netsh Helper DLL
T1546.007match: \SOFTWARE\Microsoft\Office\ 2 rules
Sample rules:
match: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\ 2 rules
Top techniques:Application Shimming
T1546.011Sample rules:
match: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\ 2 rules
Top techniques:Application Shimming
T1546.011match: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\ 2 rules
match: \SOFTWARE\ODBC\ODBCINST.INI\ 2 rules
Top techniques:OS Credential Dumping
T1003Sample rules:
match: \SYSTEM\CurrentControlSet\Services\EventLog\ 2 rules
match: \Security\Trusted Documents\TrustRecords 2 rules
Sample rules:
match: \ShellEx\ContextMenuHandlers 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \ShellEx\PropertySheetHandlers 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \ShellServiceObjectDelayLoad 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001Sample rules:
match: \Software\Winternals\BGInfo\UserFields\ 2 rules
Top techniques:Modify Registry
T1112match: \Windows\Appinit_Dlls 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001ScriptBlockText 67 entries
match: New-Object 6 rules
eq: "*[adsisearcher]*" 4 rules
Sample rules:
eq: "*-ComputerName*" 3 rules
eq: "*Get-DomainComputer*" 3 rules
Top techniques:Remote System Discovery
T1018eq: "*Get-NetComputer*" 3 rules
eq: "*Get-NetUser*" 3 rules
eq: "*SELECT*" 3 rules
Sample rules:
match: -Path 3 rules
match: Get-ChildItem 3 rules
match: Invoke-RestMethod 3 rules
match: Invoke-WebRequest 3 rules
match: Out-File 3 rules
match: Start-Process 3 rules
match: iwr 3 rules
match: powershell 3 rules
eq: "*Get-DomainUser*" 2 rules
Sample rules:
eq: "*findAll()*" 2 rules
Sample rules:
eq: "*namespace root\\directory\\ldap*" 2 rules
Sample rules:
eq: *Get-WmiObject* 2 rules
Sample rules:
in: "*pwdlastset*" 2 rules
Sample rules:
in: "*samaccountname*" 2 rules
Sample rules:
match: -Filter \* 2 rules
match: -Recurse 2 rules
Sample rules:
match: irm 2 rules
Sample rules:
match: | Select 2 rules
match: && 2 rules
Sample rules:
match: (Get-PSReadlineOption).HistorySavePath 2 rules
Sample rules:
match: (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1') 2 rules
Top techniques:PowerShell
T1059.001match: -AclObject 2 rules
Top techniques:File and Directory Permissions Modification
T1222match: -ComputerName 2 rules
Sample rules:
match: -FeatureName 2 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
match: -Filter 2 rules
match: -ImagePath 2 rules
Top techniques:Mark-of-the-Web Bypass
T1553.005Sample rules:
match: -Online 2 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
match: -SecurityDescriptorSddl 2 rules
match: -sd 2 rules
match: Add-Content 2 rules
match: AdjustTokenPrivileges 2 rules
Sample rules:
match: DumpCerts 2 rules
Sample rules:
match: DumpCreds 2 rules
Sample rules:
match: Find-GPOLocation 2 rules
match: Get-ADReplAccount 2 rules
Sample rules:
match: Get-Keystrokes 2 rules
match: Get-WmiObject 2 rules
match: Invoke-ACLScanner 2 rules
match: Invoke-DNSExfiltrator 2 rules
match: Invoke-UserHunter 2 rules
match: Microsoft.PowerShell.Core\Export-ModuleMember 2 rules
Sample rules:
match: Mount-DiskImage 2 rules
Top techniques:Mark-of-the-Web Bypass
T1553.005Sample rules:
match: New-LocalUser 2 rules
Sample rules:
match: Remove-Item 2 rules
Sample rules:
match: Remove-Update 2 rules
match: Set-Acl 2 rules
Top techniques:File and Directory Permissions Modification
T1222match: Set-Content 2 rules
match: Set-Service 2 rules
match: Win32_ShadowCopy 2 rules
match: bypass 2 rules
Top techniques:PowerShell
T1059.001match: foreach 2 rules
Sample rules:
match: gwmi 2 rules
match: gwmi 2 rules
Sample rules:
match: iex 2 rules
Sample rules:
match: ls 2 rules
Sample rules:
match: new-object 2 rules
Sample rules:
match: rm 2 rules
Sample rules:
match: rundll32 2 rules
Sample rules:
match: shell32.dll 2 rules
Sample rules:
match: shellexec_rundll 2 rules
Sample rules:
EventID 61 entries
eq: 4104 108 rules
Top techniques:PowerShell
T1059.001, Domain Account T1087.002, Remote System Discovery T1018, Domain Groups T1069.002, Steal or Forge Authentication Certificates T1649, AS-REP Roasting T1558.004Sample rules (showing 8 of 108):
- splunk AdsiSearcher Account Discovery
- splunk Allow Inbound Traffic In Firewall Rule
- splunk Delete ShadowCopy With PowerShell
- splunk Detect Certify With PowerShell Script Block Logging
- splunk Detect Copy of ShadowCopy with Script Block Logging
- splunk Detect Empire with PowerShell Script Block Logging
- splunk Detect Mimikatz With PowerShell Script Block Logging
- splunk Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
eq: 7 35 rules
Top techniques:DLL
T1574.001, CMSTP T1218.003, Spearphishing Attachment T1566.001, JavaScript T1059.007, Dynamic-link Library Injection T1055.001, Print Processors T1547.012Sample rules (showing 8 of 35):
- splunk CMLUA Or CMSTPLUA UAC Bypass
- splunk Loading Of Dynwrapx Module
- splunk MS Scripting Process Loading Ldap Module
- splunk MS Scripting Process Loading WMI Module
- splunk MSI Module Loaded by Non-System Binary
- splunk Spoolsv Suspicious Loaded Modules
- splunk Sunburst Correlation DLL and Network Event
- splunk UAC Bypass MMC Load Unsigned Dll
eq: 5136 22 rules
Top techniques:Windows File and Directory Permissions Modification
T1222.001, Domain or Tenant Policy Modification T1484, Group Policy Modification T1484.001, Account Manipulation T1098, Rogue Domain Controller T1207, Disable or Modify Tools T1562.001Sample rules (showing 8 of 22):
- splunk Windows AD AdminSDHolder ACL Modified
- splunk Windows AD Dangerous Deny ACL Modification
- splunk Windows AD Dangerous Group ACL Modification
- splunk Windows AD Dangerous User ACL Modification
- splunk Windows AD DCShadow Privileges ACL Addition
- splunk Windows AD Domain Replication ACL Addition
- splunk Windows AD Domain Root ACL Deletion
- splunk Windows AD Domain Root ACL Modification
eq: 4663 16 rules
Top techniques:Query Registry
T1012, Credentials from Web Browsers T1555.003, Credentials In Files T1552.001, Exploit Public-Facing Application T1190, Security Account Manager T1003.002, Unsecured Credentials T1552Sample rules (showing 8 of 16):
- splunk ConnectWise ScreenConnect Path Traversal Windows SACL
- splunk Non Chrome Process Accessing Chrome Default Dir
- splunk Non Firefox Process Access Firefox Profile Dir
- splunk SAM Database File Access Attempt
- splunk Windows Credential Access From Browser Password Store
- splunk Windows Credentials from Password Stores Chrome Extension Access
- splunk Windows Credentials from Password Stores Chrome LocalState Access
- splunk Windows Credentials from Password Stores Chrome Login Data Access
eq: 22 15 rules
Top techniques:DNS
T1071.004, Visual Basic T1059.005, IP Addresses T1590.005, Gather Victim Network Information T1590, Exploitation for Client Execution T1203, System Binary Proxy Execution T1218Sample rules (showing 8 of 15):
- splunk Local LLM Framework DNS Query
- splunk Sunburst Correlation DLL and Network Event
- splunk Windows AI Platform DNS Query
- splunk Windows BitLockerToGo with Network Activity
- splunk Windows DNS Query Request To TinyUrl
- splunk Windows Visual Basic Commandline Compiler DNSQuery
- splunk Rundll32 DNSQuery
- splunk Suspicious Process DNS Query Known Abuse Web Services
eq: 10 14 rules
Top techniques:LSASS Memory
T1003.001, Token Impersonation/Theft T1134.001, Portable Executable Injection T1055.002, Pass the Ticket T1550.003, Exploitation for Privilege Escalation T1068, Disable or Modify Tools T1562.001Sample rules (showing 8 of 14):
- splunk Access LSASS Memory for Dump Creation
- splunk Detect Credential Dumping through LSASS access
- splunk Rubeus Kerberos Ticket Exports Through Winlogon Access
- splunk Spoolsv Suspicious Process Access
- splunk Windows Access Token Manipulation Winlogon Duplicate Token Handle
- splunk Windows Access Token Winlogon Duplicate Handle In Uncommon Path
- splunk Windows Handle Duplication in Known UAC-Bypass Binaries
- splunk Windows Hunting System Account Targeting Lsass
eq: 7045 12 rules
Top techniques:Service Execution
T1569.002, Windows Service T1543.003, Create or Modify System Process T1543, Masquerading T1036, Rootkit T1014, Exploitation for Privilege Escalation T1068Sample rules (showing 8 of 12):
- splunk Clop Ransomware Known Service Name
- splunk Malicious Powershell Executed As A Service
- splunk Randomly Generated Windows Service Name
- splunk Windows Bluetooth Service Installed From Uncommon Location
- splunk Windows Driver Load Non-Standard Path
- splunk Windows KrbRelayUp Service Creation
- splunk Windows Service Create RemComSvc
- splunk Windows Service Create SliverC2
eq: 11 10 rules
Top techniques:LSASS Memory
T1003.001, Malicious File T1204.002, Data Encrypted for Impact T1486, Rundll32 T1218.011, Domain Account T1087.002, Print Processors T1547.012Sample rules (showing 8 of 10):
- splunk Creation of lsass Dump with Taskmgr
- splunk Drop IcedID License dat
- splunk Ransomware Notes bulk creation
- splunk Rundll32 Process Creating Exe Dll Files
- splunk SchCache Change By App Connect And Create ADSI Object
- splunk Spoolsv Writing a DLL - Sysmon
- splunk Sqlite Module In Temp Folder
- splunk Wermgr Process Create Executable File
eq: 4768 10 rules
Top techniques:Password Spraying
T1110.003, Use Alternate Authentication Material T1550, Email Addresses T1589.002, OS Credential Dumping T1003, Domain Accounts T1078.002, Steal or Forge Kerberos Tickets T1558Sample rules (showing 8 of 10):
- splunk Kerberos TGT Request Using RC4 Encryption
- splunk Kerberos User Enumeration
- splunk PetitPotam Suspicious Kerberos TGT Request
- splunk Suspicious Ticket Granting Ticket Request
- splunk Windows Computer Account Requesting Kerberos Ticket
- splunk Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
- splunk Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
- splunk Windows Steal Authentication Certificates - ESC1 Authentication
eq: 4698 8 rules
Sample rules:
- splunk Randomly Generated Scheduled Task Name
- splunk Schedule Task with HTTP Command Arguments
- splunk Schedule Task with Rundll32 Command Trigger
- splunk Short Lived Scheduled Task
- splunk Windows Hidden Schedule Task Settings
- splunk Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr
- splunk WinEvent Scheduled Task Created to Spawn Shell
- splunk WinEvent Scheduled Task Created Within Public Path
eq: 8 8 rules
Top techniques:Process Injection
T1055, Portable Executable Injection T1055.002, LSASS Memory T1003.001, Dynamic-link Library Injection T1055.001Sample rules:
- splunk Create Remote Thread In Shell Application
- splunk Create Remote Thread into LSASS
- splunk Powershell Remote Thread To Known Windows Process
- splunk Rundll32 Create Remote Thread To A Process
- splunk Rundll32 CreateRemoteThread In Browser
- splunk Windows Process Injection Of Wermgr to Known Browser
- splunk Windows Process Injection Remote Thread
- splunk Windows Process Injection With Public Source Path
eq: 4624 6 rules
Top techniques:Valid Accounts
T1078, Exploit Public-Facing Application T1190, Steal or Forge Kerberos Tickets T1558, Credential Stuffing T1110.004, Security Account Manager T1003.002, Remote Desktop Protocol T1021.001Sample rules:
- splunk Unusual Number of Remote Endpoint Authentication Events
- splunk Windows Identify PowerShell Web Access IIS Pool
- splunk Windows Kerberos Local Successful Logon
- splunk Windows Local Administrator Credential Stuffing
- splunk Windows Rapid Authentication On Multiple Hosts
- splunk Windows RDP Login Session Was Established
eq: 4625 6 rules
Top techniques:Password Spraying
T1110.003, Exploit Public-Facing Application T1190, Credential Stuffing T1110.004Sample rules:
- splunk Windows Identify PowerShell Web Access IIS Pool
- splunk Windows Local Administrator Credential Stuffing
- splunk Windows Multiple Users Failed To Authenticate From Process
- splunk Windows Multiple Users Remotely Failed To Authenticate From Host
- splunk Windows Unusual Count Of Users Failed To Authenticate From Process
- splunk Windows Unusual Count Of Users Remotely Failed To Auth From Host
eq: 4769 6 rules
Top techniques:Kerberoasting
T1558.003, Valid Accounts T1078, Golden Ticket T1558.001, Domain Accounts T1078.002, Network Share Discovery T1135Sample rules:
- splunk Kerberoasting spn request with RC4 encryption
- splunk Kerberos Service Ticket Request Using RC4 Encryption
- splunk Suspicious Kerberos Service Ticket Request
- splunk Unusual Number of Computer Service Tickets Requested
- splunk Unusual Number of Kerberos Service Tickets Requested
- splunk Windows Large Number of Computer Service Tickets Requested
in: "23" 6 rules
in: "26" 6 rules
in: 17 6 rules
in: 18 6 rules
eq: 3 4 rules
eq: 4662 4 rules
eq: 4742 4 rules
eq: 4776 4 rules
Top techniques:Password Spraying
T1110.003eq: 5145 4 rules
eq: 6 4 rules
Top techniques:Windows Service
T1543.003, Rootkit T1014, Exploitation for Privilege Escalation T1068Sample rules:
eq: 1 3 rules
eq: 15 3 rules
Sample rules:
eq: 15457 3 rules
Top techniques:SQL Stored Procedures
T1505.001Sample rules:
eq: 17 3 rules
Top techniques:SMB/Windows Admin Shares
T1021.002, Process Injection T1055, Inter-Process Communication T1559Sample rules:
- splunk Windows PUA Named Pipe
- splunk Windows RMM Named Pipe
- splunk Windows Suspicious C2 Named Pipe
eq: 18 3 rules
Top techniques:SMB/Windows Admin Shares
T1021.002, Process Injection T1055, Inter-Process Communication T1559Sample rules:
- splunk Windows PUA Named Pipe
- splunk Windows RMM Named Pipe
- splunk Windows Suspicious C2 Named Pipe
eq: 4648 3 rules
eq: 4738 3 rules
eq: 5137 3 rules
eq: 7040 3 rules
Sample rules:
in: 1126 3 rules
Top techniques:Command and Scripting Interpreter
T1059, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002Sample rules:
in: 4727 3 rules
in: 4728 3 rules
Sample rules:
in: 5007 3 rules
eq: 23 2 rules
Sample rules:
eq: 4719 2 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
eq: 4732 2 rules
Sample rules:
eq: 4741 2 rules
Top techniques:Steal or Forge Kerberos Tickets
T1558Sample rules:
eq: 4771 2 rules
Top techniques:Password Spraying
T1110.003eq: 4781 2 rules
Top techniques:Domain Accounts
T1078.002Sample rules:
eq: 5 2 rules
Sample rules:
eq: 5140 2 rules
Top techniques:Network Share Discovery
T1135Sample rules:
eq: 7036 2 rules
Sample rules:
eq: 9 2 rules
Top techniques:Disk Structure Wipe
T1561.002Sample rules:
in: 1121 2 rules
Top techniques:Command and Scripting Interpreter
T1059, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002Sample rules:
in: 1122 2 rules
Top techniques:Command and Scripting Interpreter
T1059, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002Sample rules:
in: 1125 2 rules
Top techniques:Command and Scripting Interpreter
T1059, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002Sample rules:
in: 1129 2 rules
Top techniques:Command and Scripting Interpreter
T1059, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002Sample rules:
in: 1131 2 rules
Top techniques:Command and Scripting Interpreter
T1059, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002Sample rules:
in: 1132 2 rules
Top techniques:Command and Scripting Interpreter
T1059, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002Sample rules:
in: 1133 2 rules
Top techniques:Command and Scripting Interpreter
T1059, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002Sample rules:
in: 1134 2 rules
Top techniques:Command and Scripting Interpreter
T1059, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002Sample rules:
in: 4698 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
in: 4700 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
in: 4702 2 rules
Top techniques:Scheduled Task
T1053.005Sample rules:
in: 4731 2 rules
Top techniques:Account Manipulation
T1098, Impair Defenses T1562, Local Account T1136.001, Domain Account T1136.002Sample rules:
in: 4738 2 rules
Sample rules:
in: 4887 2 rules
ImageLoaded 60 entries
starts_with: C:\Windows\WinSxS\ 9 rules
Top techniques:DLL
T1574.001Sample rules (showing 8 of 9):
- sigma Potential appverifUI.DLL Sideloading
- sigma Aruba Network Service Potential DLL Sideloading
- sigma System Control Panel Item Loaded From Uncommon Location
- sigma Potential DLL Sideloading Of DBGCORE.DLL
- sigma Potential DLL Sideloading Of DBGHELP.DLL
- sigma Potential DLL Sideloading Of DbgModel.DLL
- sigma Potential DLL Sideloading Of MpSvc.DLL
- sigma Potential DLL Sideloading Of MsCorSvc.DLL
starts_with: C:\Windows\SysWOW64\ 8 rules
Sample rules:
- sigma Potential appverifUI.DLL Sideloading
- sigma Aruba Network Service Potential DLL Sideloading
- sigma Potential DLL Sideloading Using Coregen.exe
- sigma System Control Panel Item Loaded From Uncommon Location
- sigma Potential DLL Sideloading Of DBGCORE.DLL
- sigma Potential DLL Sideloading Of DBGHELP.DLL
- sigma Potential DLL Sideloading Of DbgModel.DLL
- sigma Potential Edputil.DLL Sideloading
starts_with: C:\Windows\System32\ 8 rules
Sample rules:
- sigma Potential appverifUI.DLL Sideloading
- sigma Aruba Network Service Potential DLL Sideloading
- sigma Potential DLL Sideloading Using Coregen.exe
- sigma System Control Panel Item Loaded From Uncommon Location
- sigma Potential DLL Sideloading Of DBGCORE.DLL
- sigma Potential DLL Sideloading Of DBGHELP.DLL
- sigma Potential DLL Sideloading Of DbgModel.DLL
- sigma Potential Edputil.DLL Sideloading
starts_with: C:\Program Files (x86)\ 6 rules
Top techniques:DLL
T1574.001starts_with: C:\Program Files\ 6 rules
Top techniques:DLL
T1574.001ends_with: \dbgcore.dll 4 rules
ends_with: \dbghelp.dll 4 rules
ends_with: .dll 3 rules
Top techniques:CMSTP
T1218.003, Distributed Component Object Model T1021.003, System Binary Proxy Execution T1218, Regsvr32 T1218.010, Rundll32 T1218.011Sample rules:
ends_with: \vbscript.dll 3 rules
eq: "*.dll" 3 rules
Top techniques:Print Processors
T1547.012, MMC T1218.014, Bypass User Account Control T1548.002, Ingress Tool Transfer T1105Sample rules:
match: \ProgramData\ 3 rules
starts_with: C:\Program Files (x86)\Windows Kits\ 3 rules
Top techniques:DLL
T1574.001Sample rules:
ends_with: \RstrtMgr.dll 2 rules
Sample rules:
ends_with: \amsi.dll 2 rules
Top techniques:DLL
T1574.001Sample rules:
ends_with: \credui.dll 2 rules
Sample rules:
ends_with: \cryptbase.dll 2 rules
Top techniques:DLL
T1574.001ends_with: \cryptsp.dll 2 rules
Top techniques:DLL
T1574.001ends_with: \dismcore.dll 2 rules
Sample rules:
ends_with: \edputil.dll 2 rules
Top techniques:DLL
T1574.001Sample rules:
ends_with: \iphlpapi.dll 2 rules
Top techniques:DLL
T1574.001ends_with: \jscript.dll 2 rules
Sample rules:
ends_with: \kprocesshacker.sys 2 rules
Top techniques:Create or Modify System Process
T1543, Exploitation for Privilege Escalation T1068, Windows Service T1543.003Sample rules:
ends_with: \mfdetours.dll 2 rules
Top techniques:DLL
T1574.001Sample rules:
ends_with: \mscoree.dll 2 rules
ends_with: \profapi.dll 2 rules
Top techniques:DLL
T1574.001ends_with: \sspicli.dll 2 rules
Top techniques:DLL
T1574.001ends_with: \ttdrecord.dll 2 rules
ends_with: \version.dll 2 rules
Top techniques:DLL
T1574.001ends_with: \vssapi.dll 2 rules
ends_with: \vsstrace.dll 2 rules
ends_with: \wininet.dll 2 rules
Top techniques:DLL
T1574.001ends_with: \winsta.dll 2 rules
Top techniques:DLL
T1574.001ends_with: \wldp.dll 2 rules
Top techniques:DLL
T1574.001ends_with: \wtsapi32.dll 2 rules
Top techniques:DLL
T1574.001eq: "*\\taskschd.dll" 2 rules
Sample rules:
in: "*:\\windows\\system32\\*" 2 rules
Top techniques:DLL
T1574.001Sample rules:
in: "*:\\windows\\syswow64\\*" 2 rules
Top techniques:DLL
T1574.001Sample rules:
in: "*\\fastprox.dll" 2 rules
Sample rules:
in: "*\\wbemcomn.dll" 2 rules
Sample rules:
in: "*\\wbemprox.dll" 2 rules
Sample rules:
match: :\Perflogs\ 2 rules
match: :\Program Files (x86)\Windows Kits\10\bin\ 2 rules
Top techniques:DLL
T1574.001Sample rules:
match: :\Users\ 2 rules
Sample rules:
match: :\Users\Public\ 2 rules
match: :\Windows\Temp\ 2 rules
Top techniques:DLL
T1574.001, Distributed Component Object Model T1021.003, System Binary Proxy Execution T1218Sample rules:
match: C:\Debuggers\dbghelp.dll 2 rules
Top techniques:DLL
T1574.001Sample rules:
match: \AppData\Local\Temp\ 2 rules
Top techniques:DLL
T1574.001, Distributed Component Object Model T1021.003, System Binary Proxy Execution T1218Sample rules:
match: \AppData\local\Google\Chrome\Application\ 2 rules
Top techniques:DLL
T1574.001Sample rules:
match: \Contacts\ 2 rules
match: \Favorites\ 2 rules
match: \Favourites\ 2 rules
match: \Pictures\ 2 rules
match: \Temp\ 2 rules
Sample rules:
match: \Temporary Internet 2 rules
match: \Windows\Temp\ 2 rules
match: opera\Opera Installer Temp\opera_package 2 rules
Top techniques:DLL
T1574.001Sample rules:
starts_with: C:\Program Files\Windows Kits\ 2 rules
Top techniques:DLL
T1574.001Sample rules:
starts_with: C:\ProgramData\Microsoft\Windows Defender\Platform\ 2 rules
Top techniques:DLL
T1574.001Sample rules:
starts_with: C:\Windows\SoftwareDistribution\ 2 rules
Top techniques:DLL
T1574.001Sample rules:
starts_with: C:\Windows\SystemTemp\ 2 rules
Top techniques:DLL
T1574.001Sample rules:
QueryName 58 entries
ends_with: .hiddenservice.net 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.ca 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.cab 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.casa 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.city 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.direct 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.dog 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.glass 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.gq 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.ink 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.it 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.link 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.lt 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.lu 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.nu 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.pet 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.plus 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.rip 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.sh 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.to 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .onion.top 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .s1.tor-gateways.de 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .s2.tor-gateways.de 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .s3.tor-gateways.de 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .s4.tor-gateways.de 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .s5.tor-gateways.de 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .t2w.pw 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .tor2web.ae.org 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .tor2web.blutmagie.de 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .tor2web.com 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .tor2web.fi 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .tor2web.io 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .tor2web.org 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .tor2web.xyz 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: .torlink.co 2 rules
Top techniques:Multi-hop Proxy
T1090.003Sample rules:
ends_with: remoteassistance.support.services.microsoft.com 2 rules
in: "*api.ip.sb" 2 rules
Top techniques:IP Addresses
T1590.005in: "*api.ipify.org" 2 rules
Top techniques:IP Addresses
T1590.005in: "*b.barracudacentral.org" 2 rules
Top techniques:IP Addresses
T1590.005in: "*cbl.abuseat.org" 2 rules
Top techniques:IP Addresses
T1590.005in: "*discord*" 2 rules
Top techniques:Visual Basic
T1059.005Sample rules:
in: "*dnsbl-1.uceprotect.net" 2 rules
Top techniques:IP Addresses
T1590.005in: "*icanhazip.com" 2 rules
Top techniques:IP Addresses
T1590.005in: "*ip.anysrc.com" 2 rules
Top techniques:IP Addresses
T1590.005in: "*ipecho.net" 2 rules
Top techniques:IP Addresses
T1590.005in: "*ipinfo.io" 2 rules
Top techniques:IP Addresses
T1590.005in: "*spam.dnsbl.sorbs.net" 2 rules
Top techniques:IP Addresses
T1590.005in: "*wtfismyip.com" 2 rules
Top techniques:IP Addresses
T1590.005in: "*zen.spamhaus.org" 2 rules
Top techniques:IP Addresses
T1590.005in: "ident.me" 2 rules
Top techniques:IP Addresses
T1590.005in: "www.myexternalip.com" 2 rules
Top techniques:IP Addresses
T1590.005match: .anonfiles.com 2 rules
Top techniques:Exfiltration to Cloud Storage
T1567.002Sample rules:
match: .stage.123456. 2 rules
Top techniques:DNS
T1071.004Sample rules:
match: ufile.io 2 rules
Top techniques:Exfiltration to Cloud Storage
T1567.002Sample rules:
match: userstorage.mega.co.nz 2 rules
Top techniques:Exfiltration to Cloud Storage
T1567.002Sample rules:
starts_with: aaa.stage. 2 rules
Top techniques:DNS
T1071.004Sample rules:
starts_with: post.1 2 rules
Top techniques:DNS
T1071.004Sample rules:
process_name 51 entries
in: "EQNEDT32.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "Graph.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "excel.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "msaccess.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "mspub.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "onenote.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "onenoteim.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "onenotem.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "outlook.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "powerpnt.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "visio.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "winproj.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "winword.exe" 5 rules
Top techniques:Spearphishing Attachment
T1566.001in: "pwsh.exe" 4 rules
eq: C:\Windows\System32\svchost.exe 3 rules
eq: powershell.exe 3 rules
Sample rules:
eq: powershell_ise.exe 3 rules
Sample rules:
eq: pwsh.exe 3 rules
Sample rules:
eq: rundll32.exe 3 rules
in: "cacls.exe" 3 rules
in: "cmd.exe" 3 rules
Top techniques:External Remote Services
T1133, Exploit Public-Facing Application T1190, Windows Remote Management T1021.006, Visual Basic T1059.005Sample rules:
in: "cscript.exe" 3 rules
in: "icacls.exe" 3 rules
in: "wordpad.exe" 3 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "wordview.exe" 3 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
in: "wscript.exe" 3 rules
in: "xcacls.exe" 3 rules
ends_with: \procexp.exe 2 rules
ends_with: \procexp64.exe 2 rules
ends_with: \procmon.exe 2 rules
ends_with: \procmon64.exe 2 rules
ends_with: \thor.exe 2 rules
Top techniques:LSASS Memory
T1003.001ends_with: \thor64.exe 2 rules
Top techniques:LSASS Memory
T1003.001ends_with: \wmiprvse.exe 2 rules
eq: *.exe 2 rules
Top techniques:Screen Capture
T1113Sample rules:
eq: C:\Windows\System32\wbem\WmiPrvSE.exe 2 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
eq: cmd.exe 2 rules
Sample rules:
eq: outlook.exe 2 rules
Sample rules:
eq: spoolsv.exe 2 rules
Top techniques:Print Processors
T1547.012Sample rules:
- splunk Spoolsv Writing a DLL
- splunk Spoolsv Writing a DLL - Sysmon
in: "*powershell*" 2 rules
Sample rules:
in: "mshta.exe" 2 rules
in: "powershell.exe" 2 rules
in: "powershell_ise.exe" 2 rules
match: :\Program Files (x86)\ 2 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
match: :\Program Files\ 2 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
match: Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe 2 rules
Top techniques:Query Registry
T1012match: Microsoft.Identity.Health.Adfs.InsightsService.exe 2 rules
Top techniques:Query Registry
T1012match: Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe 2 rules
Top techniques:Query Registry
T1012match: Microsoft.Identity.Health.Adfs.PshSurrogate.exe 2 rules
Top techniques:Query Registry
T1012match: Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe 2 rules
Top techniques:Query Registry
T1012ne: "-" 2 rules
Top techniques:Password Spraying
T1110.003DestinationHostname 33 entries
ends_with: mega.co.nz 4 rules
Top techniques:Ingress Tool Transfer
T1105, Web Service T1102, Dead Drop Resolver T1102.001, Exfiltration to Cloud Storage T1567.002Sample rules:
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Network Connection Initiated To Mega.nz
- sigma Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
ends_with: mega.nz 4 rules
Top techniques:Ingress Tool Transfer
T1105, Web Service T1102, Dead Drop Resolver T1102.001, Exfiltration to Cloud Storage T1567.002Sample rules:
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Network Connection Initiated To Mega.nz
- sigma Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
ends_with: trycloudflare.com 4 rules
Top techniques:Ingress Tool Transfer
T1105, Exfiltration Over Web Service T1567, Protocol Tunneling T1572, Web Service T1102, Dead Drop Resolver T1102.001Sample rules:
- sigma Network Connection Initiated To Cloudflared Tunnels Domains
- sigma New Connection Initiated To Potential Dead Drop Resolver Domain
- sigma Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
- sigma Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
ends_with: anonfiles.com 3 rules
ends_with: cdn.discordapp.com 3 rules
ends_with: ddns.net 3 rules
ends_with: gofile.io 3 rules
ends_with: hastebin.com 3 rules
ends_with: mediafire.com 3 rules
ends_with: pages.dev 3 rules
ends_with: paste.ee 3 rules
ends_with: pastebin.com 3 rules
ends_with: pastebin.pl 3 rules
ends_with: pastetext.net 3 rules
ends_with: privatlab.com 3 rules
ends_with: privatlab.net 3 rules
ends_with: send.exploit.in 3 rules
ends_with: sendspace.com 3 rules
ends_with: storage.googleapis.com 3 rules
ends_with: temp.sh 3 rules
ends_with: transfer.sh 3 rules
ends_with: ufile.io 3 rules
ends_with: w3spaces.com 3 rules
ends_with: workers.dev 3 rules
ends_with: .githubusercontent.com 2 rules
ends_with: dl.dropboxusercontent.com 2 rules
ends_with: ghostbin.co 2 rules
ends_with: github.com 2 rules
ends_with: glitch.me 2 rules
ends_with: onrender.com 2 rules
ends_with: pixeldrain.com 2 rules
ends_with: storjshare.io 2 rules
ends_with: supabase.co 2 rules
GrantedAccess 33 entries
in: "0x1fffff" 4 rules
Top techniques:Portable Executable Injection
T1055.002, LSASS Memory T1003.001, Windows Management Instrumentation T1047Sample rules:
eq: 0x1fffff 3 rules
Top techniques:Native API
T1106, Disable or Modify Tools T1562.001, Bypass User Account Control T1548.002, Exploitation for Privilege Escalation T1068Sample rules:
ends_with: 0x14C2 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 18 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 1A 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 30 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 38 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 3A 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 50 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 58 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 5A 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 70 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 78 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 7A 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 90 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 98 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: 9A 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: B0 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: B8 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: BA 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: D0 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: D8 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: DA 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: F0 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: F8 3 rules
Top techniques:LSASS Memory
T1003.001ends_with: FA 3 rules
Top techniques:LSASS Memory
T1003.001eq: 0x1FFFFF 3 rules
in: "0x40" 3 rules
Sample rules:
eq: 0x14c0 2 rules
Sample rules:
eq: 0x40 2 rules
Sample rules:
ends_with: 10 2 rules
Top techniques:LSASS Memory
T1003.001ends_with: FF 2 rules
Top techniques:LSASS Memory
T1003.001eq: 0x1040 2 rules
Top techniques:Token Impersonation/Theft
T1134.001Contents 33 entries
match: .githubusercontent.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: anonfiles.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: cdn.discordapp.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: ddns.net 2 rules
Top techniques:NTFS File Attributes
T1564.004match: dl.dropboxusercontent.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: ghostbin.co 2 rules
Top techniques:NTFS File Attributes
T1564.004match: github.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: glitch.me 2 rules
Top techniques:NTFS File Attributes
T1564.004match: gofile.io 2 rules
Top techniques:NTFS File Attributes
T1564.004match: hastebin.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: mediafire.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: mega.nz 2 rules
Top techniques:NTFS File Attributes
T1564.004match: onrender.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: pages.dev 2 rules
Top techniques:NTFS File Attributes
T1564.004match: paste.ee 2 rules
Top techniques:NTFS File Attributes
T1564.004match: pastebin.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: pastebin.pl 2 rules
Top techniques:NTFS File Attributes
T1564.004match: pastetext.net 2 rules
Top techniques:NTFS File Attributes
T1564.004match: pixeldrain.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: privatlab.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: privatlab.net 2 rules
Top techniques:NTFS File Attributes
T1564.004match: send.exploit.in 2 rules
Top techniques:NTFS File Attributes
T1564.004match: sendspace.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: storage.googleapis.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: storjshare.io 2 rules
Top techniques:NTFS File Attributes
T1564.004match: supabase.co 2 rules
Top techniques:NTFS File Attributes
T1564.004match: temp.sh 2 rules
Top techniques:NTFS File Attributes
T1564.004match: transfer.sh 2 rules
Top techniques:NTFS File Attributes
T1564.004match: trycloudflare.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: ufile.io 2 rules
Top techniques:NTFS File Attributes
T1564.004match: w3spaces.com 2 rules
Top techniques:NTFS File Attributes
T1564.004match: workers.dev 2 rules
Top techniques:NTFS File Attributes
T1564.004starts_with: [ZoneTransfer] ZoneId=3 2 rules
TargetImage 29 entries
ends_with: \lsass.exe 13 rules
Top techniques:LSASS Memory
T1003.001, Native API T1106, Windows Remote Management T1021.006, PowerShell T1059.001, Disable or Modify Tools T1562.001Sample rules (showing 8 of 13):
- sigma Potential Credential Dumping Attempt Via PowerShell Remote Thread
- sigma Password Dumper Remote Thread in LSASS
- sigma HackTool - HandleKatz Duplicating LSASS Handle
- sigma Lsass Memory Dump via Comsvcs DLL
- sigma LSASS Memory Access by Tool With Dump Keyword In Name
- sigma Potential Credential Dumping Activity Via LSASS
- sigma Credential Dumping Activity By Python Based Tool
- sigma Remote LSASS Process Access Through Windows Remote Management
eq: *lsass.exe 6 rules
wildcard: ?:\WINDOWS\system32\lsass.exe 4 rules
Top techniques:OS Credential Dumping
T1003, LSASS Memory T1003.001, Native API T1106, Process Injection T1055Sample rules:
in: "*\\chrome.exe" 3 rules
in: "*\\firefox.exe" 3 rules
in: "*\\spoolsv.exe" 3 rules
ends_with: \calc.exe 2 rules
ends_with: \calculator.exe 2 rules
ends_with: \mspaint.exe 2 rules
ends_with: \notepad.exe 2 rules
ends_with: \ping.exe 2 rules
ends_with: \wordpad.exe 2 rules
ends_with: \write.exe 2 rules
eq: "*.exe" 2 rules
Sample rules:
eq: C:\Windows\System32\conhost.exe 2 rules
Top techniques:Process Injection
T1055Sample rules:
eq: System 2 rules
Top techniques:Process Injection
T1055Sample rules:
in: "*\\CalculatorApp.exe" 2 rules
Top techniques:Portable Executable Injection
T1055.002Sample rules:
in: "*\\SysWOW64\\winlogon.exe*" 2 rules
Top techniques:Token Impersonation/Theft
T1134.001in: "*\\calc.exe" 2 rules
Top techniques:Portable Executable Injection
T1055.002Sample rules:
in: "*\\cmd.exe" 2 rules
Sample rules:
in: "*\\explorer.exe" 2 rules
Sample rules:
in: "*\\iexplore.exe" 2 rules
Sample rules:
in: "*\\microsoftedgecp.exe" 2 rules
Sample rules:
in: "*\\notepad.exe" 2 rules
Top techniques:Portable Executable Injection
T1055.002Sample rules:
in: "*\\svchost.exe" 2 rules
Sample rules:
in: "*\\system32\\winlogon.exe*" 2 rules
Top techniques:Token Impersonation/Theft
T1134.001in: "*\\win32calc.exe" 2 rules
Top techniques:Portable Executable Injection
T1055.002Sample rules:
starts_with: C:\Program Files (x86)\ 2 rules
Top techniques:Process Injection
T1055Sample rules:
starts_with: C:\Program Files\ 2 rules
Top techniques:Process Injection
T1055Sample rules:
ServiceName 26 entries
ends_with: $ 2 rules
Top techniques:Kerberoasting
T1558.003Sample rules:
eq: "*$" 2 rules
eq: PSEXESVC 2 rules
Top techniques:Service Execution
T1569.002, SMB/Windows Admin Shares T1021.002, Lateral Tool Transfer T1570Sample rules:
match: AmmyyAdmin 2 rules
match: AnyDesk 2 rules
match: Atera 2 rules
match: BASupportExpressSrvcUpdater 2 rules
match: BASupportExpressStandaloneService 2 rules
match: GoToAssist 2 rules
match: GoToMyPC 2 rules
match: LMIGuardianSvc 2 rules
match: LogMeIn 2 rules
match: Parsec 2 rules
match: RManService 2 rules
match: RPCPerformanceService 2 rules
match: RPCService 2 rules
match: SSUService 2 rules
match: SplashtopRemoteService 2 rules
match: TeamViewer 2 rules
match: TightVNC 2 rules
match: Zoho 2 rules
match: chromoting 2 rules
match: jumpcloud 2 rules
match: monblanking 2 rules
match: vncserver 2 rules
ne: "*$" 2 rules
Top techniques:Kerberoasting
T1558.003Sample rules:
aceAccessRights 19 entries
in: "Full control" 4 rules
in: "All extended rights" 3 rules
in: "All validated writes" 3 rules
in: "Create all child objects" 3 rules
in: "Delete all child objects" 3 rules
in: "Delete subtree" 3 rules
in: "Delete" 3 rules
in: "Modify owner" 3 rules
in: "Modify permissions" 3 rules
in: "Write all properties" 3 rules
in: CC 3 rules
in: CR 3 rules
in: DC 3 rules
in: DT 3 rules
in: SD 3 rules
in: SW 3 rules
in: WD 3 rules
in: WO 3 rules
in: WP 3 rules
file_name 17 entries
in: "*.exe" 7 rules
Top techniques:Masquerading
T1036, Remote Access Tools T1219, Local Groups T1069.001, Spearphishing Attachment T1566.001, AppDomainManager T1574.014, Replication Through Removable Media T1091Sample rules:
- splunk Detect Remote Access Software Usage File
- splunk Executables Or Script Creation In Suspicious Path
- splunk Executables Or Script Creation In Temp Path
- splunk Windows Admin Permission Discovery
- splunk Windows Office Product Dropped Uncommon File
- splunk Windows Potential AppDomainManager Hijack Artifacts Creation
- splunk Windows Replication Through Removable Media
in: "*.dll" 6 rules
Top techniques:Masquerading
T1036, Local Groups T1069.001, Spearphishing Attachment T1566.001, AppDomainManager T1574.014, Replication Through Removable Media T1091Sample rules:
- splunk Executables Or Script Creation In Suspicious Path
- splunk Executables Or Script Creation In Temp Path
- splunk Windows Admin Permission Discovery
- splunk Windows Office Product Dropped Uncommon File
- splunk Windows Potential AppDomainManager Hijack Artifacts Creation
- splunk Windows Replication Through Removable Media
in: "*.js" 5 rules
in: "*.pif" 5 rules
in: "*.vbe" 5 rules
in: "*.vbs" 5 rules
in: "*.ashx" 4 rules
Top techniques:Exploit Public-Facing Application
T1190, External Remote Services T1133, Web Shell T1505.003Sample rules:
in: "*.bat" 4 rules
in: "*.cmd" 4 rules
in: "*.com" 4 rules
in: "*.sys" 4 rules
eq: "*.dll" 3 rules
Sample rules:
in: "*.aspx" 3 rules
Top techniques:Exploit Public-Facing Application
T1190, External Remote Services T1133, Web Shell T1505.003Sample rules:
in: "*.ps1" 3 rules
Sample rules:
in: "*.dat" 2 rules
Sample rules:
in: "*.lnk" 2 rules
Sample rules:
in: "*.msc" 2 rules
Top techniques:Masquerading
T1036Sample rules:
DestinationPort 16 entries
eq: 443 7 rules
Top techniques:Ingress Tool Transfer
T1105, Exploitation for Client Execution T1203, Remote Desktop Protocol T1021.001, Protocol Tunneling T1572, Rundll32 T1218.011, MSBuild T1127.001Sample rules:
- sigma Uncommon Network Connection Initiated By Certutil.EXE
- sigma Office Application Initiated Network Connection To Non-Local IP
- sigma Office Application Initiated Network Connection Over Uncommon Ports
- sigma RDP to HTTP or HTTPS Target Ports
- sigma Rundll32 Internet Connection
- sigma Silenttrinity Stager Msbuild Activity
- sigma Suspicious Wordpad Outbound Connections
eq: 80 6 rules
Top techniques:Ingress Tool Transfer
T1105, Exploitation for Client Execution T1203, Remote Desktop Protocol T1021.001, Protocol Tunneling T1572, MSBuild T1127.001Sample rules:
- sigma Uncommon Network Connection Initiated By Certutil.EXE
- sigma Office Application Initiated Network Connection To Non-Local IP
- sigma Office Application Initiated Network Connection Over Uncommon Ports
- sigma RDP to HTTP or HTTPS Target Ports
- sigma Silenttrinity Stager Msbuild Activity
- sigma Suspicious Wordpad Outbound Connections
ne: 0 6 rules
Top techniques:Process Injection
T1055, Rundll32 T1218.011, Exfiltration Over Unencrypted Non-C2 Protocol T1048.003, Bootkit T1542.003Sample rules:
- splunk DLLHost with no Command Line Arguments with Network
- splunk GPUpdate with no Command Line Arguments with Network
- splunk Rundll32 with no Command Line Arguments with Network
- splunk SearchProtocolHost with no Command Line with Network
- splunk Windows Rundll32 WebDav With Network Connection
- splunk Windows WinLogon with Public Network Connection
eq: 587 4 rules
eq: 3389 3 rules
eq: 88 3 rules
Top techniques:Kerberoasting
T1558.003, Pass the Ticket T1550.003, Steal or Forge Kerberos Tickets T1558, Use Alternate Authentication Material T1550Sample rules:
eq: 445 3 rules
eq: 465 3 rules
eq: 993 3 rules
eq: 995 3 rules
eq: 9389 2 rules
eq: 139 2 rules
eq: 143 2 rules
eq: 25 2 rules
eq: 5985 2 rules
Sample rules:
eq: 5986 2 rules
Sample rules:
Properties 15 entries
in: "*Manage Replication Topology*" 2 rules
Top techniques:DCSync
T1003.006in: "*Remove Replica In Domain*" 2 rules
Top techniques:DCSync
T1003.006in: "*Replicating Directory Changes All*" 2 rules
Top techniques:DCSync
T1003.006in: "*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*" 2 rules
Top techniques:DCSync
T1003.006in: "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*" 2 rules
Top techniques:DCSync
T1003.006in: "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*" 2 rules
Top techniques:DCSync
T1003.006match: 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 2 rules
Top techniques:DCSync
T1003.006Sample rules:
match: 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 2 rules
Top techniques:DCSync
T1003.006Sample rules:
match: 89e95b76-444d-4c62-991a-0facbeda640c 2 rules
Top techniques:DCSync
T1003.006Sample rules:
wildcard: *1131f6aa-9c07-11d1-f79f-00c04fc2dcd2* 2 rules
Top techniques:OS Credential Dumping
T1003, DCSync T1003.006, Valid Accounts T1078, Domain Accounts T1078.002Sample rules:
wildcard: *1131f6ad-9c07-11d1-f79f-00c04fc2dcd2* 2 rules
Top techniques:OS Credential Dumping
T1003, DCSync T1003.006, Valid Accounts T1078, Domain Accounts T1078.002Sample rules:
wildcard: *89e95b76-444d-4c62-991a-0facbeda640c* 2 rules
Top techniques:OS Credential Dumping
T1003, DCSync T1003.006, Valid Accounts T1078, Domain Accounts T1078.002Sample rules:
wildcard: *DS-Replication-Get-Changes* 2 rules
Top techniques:OS Credential Dumping
T1003, DCSync T1003.006, Valid Accounts T1078, Domain Accounts T1078.002Sample rules:
wildcard: *DS-Replication-Get-Changes-All* 2 rules
Top techniques:OS Credential Dumping
T1003, DCSync T1003.006, Valid Accounts T1078, Domain Accounts T1078.002Sample rules:
wildcard: *DS-Replication-Get-Changes-In-Filtered-Set* 2 rules
Top techniques:OS Credential Dumping
T1003, DCSync T1003.006, Valid Accounts T1078, Domain Accounts T1078.002Sample rules:
SubcategoryGuid 15 entries
eq: {0CCE9210-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE9211-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE9212-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE9215-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE9217-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE921B-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE922B-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE922F-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE9230-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE9235-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE9236-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE9237-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE923F-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE9240-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
eq: {0CCE9242-69AE-11D9-BED3-505054503030} 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
dest_ip 14 entries
cidr_match: 127.0.0.0/8 13 rules
Top techniques:Rundll32
T1218.011, Non-Standard Port T1571, System Binary Proxy Execution T1218, Ingress Tool Transfer T1105, CMSTP T1218.003, Web Protocols T1071.001Sample rules (showing 8 of 13):
- sigma Outbound Network Connection Initiated By Cmstp.EXE
- sigma Outbound Network Connection Initiated By Microsoft Dialer
- sigma Office Application Initiated Network Connection To Non-Local IP
- sigma RDP Over Reverse SSH Tunnel
- sigma RegAsm.EXE Initiating Network Connection To Public IP
- sigma Rundll32 Internet Connection
- sigma Potentially Suspicious Malware Callback Communication
- sigma Communication To Uncommon Destination Ports
cidr_match: ::1/128 13 rules
Top techniques:Rundll32
T1218.011, Non-Standard Port T1571, System Binary Proxy Execution T1218, Ingress Tool Transfer T1105, CMSTP T1218.003, Web Protocols T1071.001Sample rules (showing 8 of 13):
- sigma Outbound Network Connection Initiated By Cmstp.EXE
- sigma Outbound Network Connection Initiated By Microsoft Dialer
- sigma Office Application Initiated Network Connection To Non-Local IP
- sigma RDP Over Reverse SSH Tunnel
- sigma RegAsm.EXE Initiating Network Connection To Public IP
- sigma Rundll32 Internet Connection
- sigma Potentially Suspicious Malware Callback Communication
- sigma Communication To Uncommon Destination Ports
cidr_match: 10.0.0.0/8 12 rules
Top techniques:Rundll32
T1218.011, Non-Standard Port T1571, System Binary Proxy Execution T1218, Ingress Tool Transfer T1105, CMSTP T1218.003, Web Protocols T1071.001Sample rules (showing 8 of 12):
- sigma Outbound Network Connection Initiated By Cmstp.EXE
- sigma Outbound Network Connection Initiated By Microsoft Dialer
- sigma Office Application Initiated Network Connection To Non-Local IP
- sigma RegAsm.EXE Initiating Network Connection To Public IP
- sigma Rundll32 Internet Connection
- sigma Potentially Suspicious Malware Callback Communication
- sigma Communication To Uncommon Destination Ports
- sigma Microsoft Sync Center Suspicious Network Connections
cidr_match: 169.254.0.0/16 12 rules
Top techniques:Rundll32
T1218.011, Non-Standard Port T1571, System Binary Proxy Execution T1218, Ingress Tool Transfer T1105, CMSTP T1218.003, Web Protocols T1071.001Sample rules (showing 8 of 12):
- sigma Outbound Network Connection Initiated By Cmstp.EXE
- sigma Outbound Network Connection Initiated By Microsoft Dialer
- sigma Office Application Initiated Network Connection To Non-Local IP
- sigma RegAsm.EXE Initiating Network Connection To Public IP
- sigma Rundll32 Internet Connection
- sigma Potentially Suspicious Malware Callback Communication
- sigma Communication To Uncommon Destination Ports
- sigma Microsoft Sync Center Suspicious Network Connections
cidr_match: 172.16.0.0/12 12 rules
Top techniques:Rundll32
T1218.011, Non-Standard Port T1571, System Binary Proxy Execution T1218, Ingress Tool Transfer T1105, CMSTP T1218.003, Web Protocols T1071.001Sample rules (showing 8 of 12):
- sigma Outbound Network Connection Initiated By Cmstp.EXE
- sigma Outbound Network Connection Initiated By Microsoft Dialer
- sigma Office Application Initiated Network Connection To Non-Local IP
- sigma RegAsm.EXE Initiating Network Connection To Public IP
- sigma Rundll32 Internet Connection
- sigma Potentially Suspicious Malware Callback Communication
- sigma Communication To Uncommon Destination Ports
- sigma Microsoft Sync Center Suspicious Network Connections
cidr_match: 192.168.0.0/16 12 rules
Top techniques:Rundll32
T1218.011, Non-Standard Port T1571, System Binary Proxy Execution T1218, Ingress Tool Transfer T1105, CMSTP T1218.003, Web Protocols T1071.001Sample rules (showing 8 of 12):
- sigma Outbound Network Connection Initiated By Cmstp.EXE
- sigma Outbound Network Connection Initiated By Microsoft Dialer
- sigma Office Application Initiated Network Connection To Non-Local IP
- sigma RegAsm.EXE Initiating Network Connection To Public IP
- sigma Rundll32 Internet Connection
- sigma Potentially Suspicious Malware Callback Communication
- sigma Communication To Uncommon Destination Ports
- sigma Microsoft Sync Center Suspicious Network Connections
cidr_match: fc00::/7 12 rules
Top techniques:Rundll32
T1218.011, Non-Standard Port T1571, System Binary Proxy Execution T1218, Ingress Tool Transfer T1105, CMSTP T1218.003, Web Protocols T1071.001Sample rules (showing 8 of 12):
- sigma Outbound Network Connection Initiated By Cmstp.EXE
- sigma Outbound Network Connection Initiated By Microsoft Dialer
- sigma Office Application Initiated Network Connection To Non-Local IP
- sigma RegAsm.EXE Initiating Network Connection To Public IP
- sigma Rundll32 Internet Connection
- sigma Potentially Suspicious Malware Callback Communication
- sigma Communication To Uncommon Destination Ports
- sigma Microsoft Sync Center Suspicious Network Connections
cidr_match: fe80::/10 12 rules
Top techniques:Rundll32
T1218.011, Non-Standard Port T1571, System Binary Proxy Execution T1218, Ingress Tool Transfer T1105, CMSTP T1218.003, Web Protocols T1071.001Sample rules (showing 8 of 12):
- sigma Outbound Network Connection Initiated By Cmstp.EXE
- sigma Outbound Network Connection Initiated By Microsoft Dialer
- sigma Office Application Initiated Network Connection To Non-Local IP
- sigma RegAsm.EXE Initiating Network Connection To Public IP
- sigma Rundll32 Internet Connection
- sigma Potentially Suspicious Malware Callback Communication
- sigma Communication To Uncommon Destination Ports
- sigma Microsoft Sync Center Suspicious Network Connections
cidr_match: 51.103.0.0/16 3 rules
cidr_match: 20.184.0.0/13 2 rules
cidr_match: 20.192.0.0/10 2 rules
cidr_match: 51.10.0.0/15 2 rules
cidr_match: 51.104.0.0/15 2 rules
eq: 127.0.0.1 2 rules
Top techniques:Network Service Discovery
T1046, Windows Remote Management T1021.006, PowerShell T1059.001Sample rules:
ImagePath 14 entries
match: cmd 5 rules
match: powershell 5 rules
match: && 4 rules
match: /c 4 rules
match: rundll32 3 rules
match: %COMSPEC% 2 rules
match: -f 2 rules
Sample rules:
match: /r 2 rules
Sample rules:
match: input 2 rules
Sample rules:
match: invoke 2 rules
Sample rules:
match: mshta 2 rules
Top techniques:Obfuscated Files or Information
T1027, PowerShell T1059.001, Windows Service T1543.003Sample rules:
match: pwsh 2 rules
Sample rules:
match: shell32.dll 2 rules
Sample rules:
match: shellexec_rundll 2 rules
Sample rules:
ParentCommandLine 14 entries
match: :\Users\ 3 rules
ends_with: tunnel 2 rules
Sample rules:
eq: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule 2 rules
Top techniques:Bypass User Account Control
T1548.002Sample rules:
match: .lnk 2 rules
match: :\Users\Public\ 2 rules
match: :\Windows\Temp\ 2 rules
match: JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw 2 rules
Top techniques:Compile After Delivery
T1027.004, Visual Basic T1059.005, JavaScript T1059.007, Mshta T1218.005Sample rules:
match: \Contacts\ 2 rules
match: \Favorites\ 2 rules
match: \Favourites\ 2 rules
match: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection 2 rules
Top techniques:Compile After Delivery
T1027.004, Visual Basic T1059.005, JavaScript T1059.007, Mshta T1218.005Sample rules:
match: \Temporary Internet 2 rules
match: cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIAIgB9ACcA 2 rules
Top techniques:Compile After Delivery
T1027.004, Visual Basic T1059.005, JavaScript T1059.007, Mshta T1218.005Sample rules:
match: nAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnA 2 rules
Top techniques:Compile After Delivery
T1027.004, Visual Basic T1059.005, JavaScript T1059.007, Mshta T1218.005Sample rules:
file.name 14 entries
wildcard: FssagentRpc 2 rules
wildcard: Spoolss 2 rules
wildcard: WinsPipe 2 rules
wildcard: dhcpserver 2 rules
wildcard: dnsserver 2 rules
wildcard: efsrpc 2 rules
wildcard: eventlog 2 rules
wildcard: lsarpc 2 rules
wildcard: lsass 2 rules
wildcard: netdfs 2 rules
wildcard: netlogon 2 rules
wildcard: samr 2 rules
wildcard: srvsvc 2 rules
wildcard: winreg 2 rules
src_ip 12 entries
eq: 127.0.0.1 5 rules
eq: ::1 5 rules
cidr_match: 127.0.0.0/8 4 rules
cidr_match: 169.254.0.0/16 4 rules
cidr_match: ::1/128 4 rules
cidr_match: fc00::/7 4 rules
cidr_match: fe80::/10 4 rules
cidr_match: 10.0.0.0/8 3 rules
cidr_match: 172.16.0.0/12 3 rules
cidr_match: 192.168.0.0/16 3 rules
eq: - 2 rules
Sample rules:
ne: "-" 2 rules
Top techniques:Password Spraying
T1110.003registry_path 12 entries
eq: "*\\Microsoft\\Windows Defender\\SpyNet*" 3 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
eq: "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" 3 rules
Top techniques:Modify Registry
T1112eq: "*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" 2 rules
Top techniques:Registry Run Keys / Startup Folder
T1547.001, Image File Execution Options Injection T1546.012Sample rules:
eq: "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" 2 rules
Top techniques:Credentials in Registry
T1552.002Sample rules:
eq: "*USBSTOR*" 2 rules
eq: "*\\Control\\Terminal Server\\fDenyTSConnections*" 2 rules
Sample rules:
eq: "*\\InProcServer32\\*" 2 rules
Sample rules:
eq: "*\\Microsoft\\Terminal Server Client\\Servers\\*" 2 rules
Sample rules:
eq: "*\\SYSTEM\\CurrentControlSet\\Services*" 2 rules
Sample rules:
eq: "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" 2 rules
Sample rules:
in: "HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*" 2 rules
in: "HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*" 2 rules
EventType 11 entries
eq: deleted 8 rules
Top techniques:Modify Registry
T1112, Disable or Modify Tools T1562.001, Modify Authentication Process T1556, File Deletion T1070.004, Scheduled Task T1053.005, Impair Defenses T1562Sample rules:
- splunk Disabling Windows Local Security Authority Defences via Registry
- splunk Windows Deleted Registry By A Non Critical Process File Path
- splunk Windows Impair Defense Delete Win Defender Context Menu
- splunk Windows Impair Defense Delete Win Defender Profile Registry
- splunk Windows RDP Server Registry Deletion
- splunk Windows Registry Delete Task SD
- splunk Windows RunMRU Registry Key or Value Deleted
- splunk Windows Service Deletion In Registry
eq: logged-in 7 rules
Top techniques:Create or Modify System Process
T1543, Windows Service T1543.003, Valid Accounts T1078, Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003Sample rules:
- elastic Multiple Logon Failure Followed by Logon Success
- elastic Potential Pass-the-Hash (PtH) Attempt
- elastic Remote Windows Service Installed
- elastic Account Password Reset Remotely
- elastic Potential Account Takeover - Mixed Logon Types
- elastic Service Creation via Local Kerberos Authentication
- elastic Potential Account Takeover - Logon from New Source IP
eq: DeleteValue 5 rules
Top techniques:Modify Registry
T1112, Screen Capture T1113, Disable or Modify Tools T1562.001, Indicator Removal T1070, Registry Run Keys / Startup Folder T1547.001Sample rules:
- sigma Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted
- sigma Folder Removed From Exploit Guard ProtectedFolders List - Registry
- sigma Terminal Server Client Connection History Cleared - Registry
- sigma Narrator's Feedback-Hub Persistence
- splunk Windows Modify Registry Delete Firewall Rules
eq: modified 5 rules
Top techniques:Modify Registry
T1112, Modify Authentication Process T1556, Port Monitors T1547.010, Service Stop T1489Sample rules:
in: "ConnectPipe" 4 rules
in: "CreatePipe" 4 rules
eq: SetValue 3 rules
eq: logon-failed 3 rules
Sample rules:
eq: scheduled-task-created 3 rules
Sample rules:
eq: CreateKey 2 rules
eq: service-installed 2 rules
IntegrityLevel 10 entries
eq: S-1-16-16384 21 rules
Top techniques:Bypass User Account Control
T1548.002, Msiexec T1218.007, Match Legitimate Resource Name or Location T1036.005, Scheduled Task T1053.005, Exploitation for Privilege Escalation T1068, Exploitation for Client Execution T1203Sample rules (showing 8 of 21):
- sigma Msiexec Quiet Installation
- sigma Suspicious Scheduled Task Creation via Masqueraded XML File
- sigma Suspicious Spool Service Child Process
- sigma Always Install Elevated Windows Installer
- sigma Suspicious Child Process Created as System
- sigma Suspicious SYSTEM User Process Creation
- sigma Potential RDP Session Hijacking Activity
- sigma UAC Bypass Using ChangePK and SLUI
eq: System 21 rules
Top techniques:Bypass User Account Control
T1548.002, Msiexec T1218.007, Match Legitimate Resource Name or Location T1036.005, Scheduled Task T1053.005, Exploitation for Privilege Escalation T1068, Exploitation for Client Execution T1203Sample rules (showing 8 of 21):
- sigma Msiexec Quiet Installation
- sigma Suspicious Scheduled Task Creation via Masqueraded XML File
- sigma Suspicious Spool Service Child Process
- sigma Always Install Elevated Windows Installer
- sigma Suspicious Child Process Created as System
- sigma Suspicious SYSTEM User Process Creation
- sigma Potential RDP Session Hijacking Activity
- sigma UAC Bypass Using ChangePK and SLUI
eq: High 16 rules
Top techniques:Bypass User Account Control
T1548.002, Indirect Command Execution T1202, CMSTP T1218.003Sample rules (showing 8 of 16):
- sigma Suspicious High IntegrityLevel Conhost Legacy Option
- sigma UAC Bypass Using ChangePK and SLUI
- sigma UAC Bypass Using Disk Cleanup
- sigma CMSTP UAC Bypass via COM Object Access
- sigma UAC Bypass Tools Using ComputerDefaults
- sigma UAC Bypass Using Consent and Comctl32 - Process
- sigma UAC Bypass Using DismHost
- sigma UAC Bypass Using IDiagnostic Profile
eq: S-1-16-12288 16 rules
Top techniques:Bypass User Account Control
T1548.002, Indirect Command Execution T1202, CMSTP T1218.003Sample rules (showing 8 of 16):
- sigma Suspicious High IntegrityLevel Conhost Legacy Option
- sigma UAC Bypass Using ChangePK and SLUI
- sigma UAC Bypass Using Disk Cleanup
- sigma CMSTP UAC Bypass via COM Object Access
- sigma UAC Bypass Tools Using ComputerDefaults
- sigma UAC Bypass Using Consent and Comctl32 - Process
- sigma UAC Bypass Using DismHost
- sigma UAC Bypass Using IDiagnostic Profile
eq: Medium 3 rules
eq: S-1-16-8192 3 rules
in: "low" 3 rules
in: "medium" 3 rules
eq: "system" 2 rules
in: "high" 2 rules
user 10 entries
ends_with: $ 18 rules
Top techniques:SMB/Windows Admin Shares
T1021.002, Forced Authentication T1187, Adversary-in-the-Middle T1557, LLMNR/NBT-NS Poisoning and SMB Relay T1557.001, Domain Account T1087.002, DCSync T1003.006Sample rules (showing 8 of 18):
- sigma AD Privileged Users or Groups Reconnaissance
- sigma Active Directory Replication from Non Machine Account
- sigma Potential AD User Enumeration From Non-Machine Account
- sigma Access To ADMIN$ Network Share
- sigma DCOM InternetExplorer.Application Iertutil DLL Hijack - Security
- sigma Mimikatz DC Sync
- sigma Hidden Local User Creation
- sigma LSASS Access From Non System Account
match: AUTHORI 16 rules
Top techniques:LSASS Memory
T1003.001, File Deletion T1070.004, Scheduled Task T1053.005, Abuse Elevation Control Mechanism T1548, Bypass User Account Control T1548.002, Create Process with Token T1134.002Sample rules (showing 8 of 16):
- sigma Prefetch File Deleted
- sigma HackTool - CrackMapExec Process Patterns
- sigma Scheduled Task Creation Via Schtasks.EXE
- sigma Abused Debug Privilege by Arbitrary Parent Processes
- sigma Always Install Elevated Windows Installer
- sigma Suspicious Child Process Created as System
- sigma Elevated System Shell Spawned From Uncommon Parent Location
- sigma Suspicious SYSTEM User Process Creation
match: AUTORI 16 rules
Top techniques:LSASS Memory
T1003.001, File Deletion T1070.004, Scheduled Task T1053.005, Abuse Elevation Control Mechanism T1548, Bypass User Account Control T1548.002, Create Process with Token T1134.002Sample rules (showing 8 of 16):
- sigma Prefetch File Deleted
- sigma HackTool - CrackMapExec Process Patterns
- sigma Scheduled Task Creation Via Schtasks.EXE
- sigma Abused Debug Privilege by Arbitrary Parent Processes
- sigma Always Install Elevated Windows Installer
- sigma Suspicious Child Process Created as System
- sigma Elevated System Shell Spawned From Uncommon Parent Location
- sigma Suspicious SYSTEM User Process Creation
ne: *$ 10 rules
Top techniques:Password Spraying
T1110.003Sample rules (showing 8 of 10):
- splunk Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
- splunk Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
- splunk Windows Multiple Invalid Users Failed To Authenticate Using NTLM
- splunk Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials
- splunk Windows Multiple Users Failed To Authenticate From Host Using NTLM
- splunk Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos
- splunk Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos
- splunk Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM
ne: "*$" 7 rules
Top techniques:Valid Accounts
T1078, Password Spraying T1110.003, Email Addresses T1589.002, Domain Accounts T1078.002, Network Share Discovery T1135, Security Account Manager T1003.002Sample rules:
- splunk Kerberos User Enumeration
- splunk Suspicious Ticket Granting Ticket Request
- splunk Unusual Number of Remote Endpoint Authentication Events
- splunk Windows Large Number of Computer Service Tickets Requested
- splunk Windows Multiple Users Failed To Authenticate Using Kerberos
- splunk Windows Rapid Authentication On Multiple Hosts
- splunk Windows Unusual Count Of Users Failed To Auth Using Kerberos
eq: ANONYMOUS LOGON 3 rules
starts_with: MSOL_ 3 rules
Sample rules:
eq: "*$" 2 rules
eq: "ANONYMOUS LOGON" 2 rules
Sample rules:
eq: HomeGroupUser$ 2 rules
Sample rules:
ServiceFileName 10 entries
match: cmd 5 rules
Top techniques:Obfuscated Files or Information
T1027, PowerShell T1059.001, Token Impersonation/Theft T1134.001, Create Process with Token T1134.002Sample rules:
match: powershell 4 rules
match: && 3 rules
match: /c 3 rules
match: %COMSPEC% 2 rules
match: -f 2 rules
Sample rules:
match: invoke 2 rules
Sample rules:
match: rundll32 2 rules
match: shell32.dll 2 rules
Sample rules:
match: shellexec_rundll 2 rules
Sample rules:
Provider_Name 8 entries
eq: Service Control Manager 43 rules
Top techniques:Windows Service
T1543.003, Service Execution T1569.002, Obfuscated Files or Information T1027, PowerShell T1059.001, SMB/Windows Admin Shares T1021.002, Remote Desktop Software T1219.002Sample rules (showing 8 of 43):
- sigma CobaltStrike Service Installations - System
- sigma Windows Defender Threat Detection Service Disabled
- sigma smbexec.py Service Installation
- sigma Invoke-Obfuscation CLIP+ Launcher - System
- sigma Invoke-Obfuscation STDIN+ Launcher - System
- sigma Invoke-Obfuscation VAR+ Launcher - System
- sigma Invoke-Obfuscation COMPRESS OBFUSCATION - System
- sigma Invoke-Obfuscation RUNDLL LAUNCHER - System
eq: MsiInstaller 4 rules
Top techniques:Service Stop
T1489, System Binary Proxy Execution T1218, Msiexec T1218.007, Remote Desktop Software T1219.002Sample rules:
eq: Microsoft-Windows-Eventlog 3 rules
Top techniques:Clear Windows Event Logs
T1070.001Sample rules:
eq: Microsoft-Windows-Sysmon 3 rules
eq: Application Error 2 rules
Top techniques:LSASS Memory
T1003.001, Exploitation for Defense Evasion T1211, Disable or Modify Tools T1562.001Sample rules:
eq: ESENT 2 rules
Top techniques:NTDS
T1003.003Sample rules:
eq: Microsoft-Windows-DHCP-Server 2 rules
Top techniques:DLL
T1574.001Sample rules:
eq: ScreenConnect 2 rules
Top techniques:Windows Command Shell
T1059.003Sample rules:
Description 8 entries
eq: GnuPG’s OpenPGP tool 4 rules
Top techniques:Data Encrypted for Impact
T1486Sample rules:
eq: AnyDesk 3 rules
eq: Command line RAR 3 rules
Sample rules:
eq: Active Directory Editor 2 rules
eq: System activity monitor 2 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
eq: Windows PowerShell 2 rules
match: 7-Zip 2 rules
Top techniques:Archive via Utility
T1560.001Sample rules:
match: st2stager 2 rules
Top techniques:Application Layer Protocol
T1071Sample rules:
Product 8 entries
eq: AnyDesk 3 rules
eq: Node.js 2 rules
Top techniques:JavaScript
T1059.007eq: Ping Castle 2 rules
Top techniques:Active Scanning
T1595Sample rules:
eq: PowerShell Core 6 2 rules
eq: Remote Utilities 2 rules
eq: SQLite 2 rules
Top techniques:Data from Local System
T1005, Steal Web Session Cookie T1539, Credentials from Web Browsers T1555.003Sample rules:
eq: Sysinternals ADExplorer 2 rules
match: NetSupport Remote Control 2 rules
Sample rules:
LogonType 7 entries
eq: 3 12 rules
Top techniques:Valid Accounts
T1078, Steal or Forge Kerberos Tickets T1558, Password Spraying T1110.003, Pass the Hash T1550.002, Brute Force T1110, External Remote Services T1133Sample rules (showing 8 of 12):
- sigma Pass the Hash Activity 2
- sigma External Remote SMB Logon from Public IP
- sigma Potential Privilege Escalation via Local Kerberos Relay over LDAP
- sigma RottenPotato Like Attack Pattern
- sigma Metasploit SMB Authentication
- splunk Unusual Number of Remote Endpoint Authentication Events
- splunk Windows Domain Admin Impersonation Indicator
- splunk Windows Kerberos Local Successful Logon
eq: 9 5 rules
Top techniques:Pass the Hash
T1550.002, Token Impersonation/Theft T1134.001, Use Alternate Authentication Material T1550Sample rules:
eq: 10 4 rules
Top techniques:Remote Desktop Protocol
T1021.001, Default Accounts T1078.001, Domain Accounts T1078.002, Local Accounts T1078.003, Valid Accounts T1078, Brute Force T1110Sample rules:
eq: Network 4 rules
wildcard: Network 3 rules
eq: 2 2 rules
Top techniques:Password Spraying
T1110.003wildcard: network 2 rules
ObjectType 7 entries
eq: File 5 rules
eq: Key 3 rules
eq: SAM_GROUP 2 rules
Sample rules:
eq: SAM_USER 2 rules
Sample rules:
eq: SC_MANAGER OBJECT 2 rules
Sample rules:
in: "%{19195a5b-6da0-11d0-afd3-00c04fd930c9}" 2 rules
Top techniques:DCSync
T1003.006in: "domainDNS" 2 rules
Top techniques:DCSync
T1003.006AttributeLDAPDisplayName 6 entries
eq: servicePrincipalName 6 rules
Top techniques:Account Manipulation
T1098, Rogue Domain Controller T1207, Steal or Forge Kerberos Tickets T1558, Kerberoasting T1558.003Sample rules:
- sigma Active Directory User Backdoors
- sigma Possible DC Shadow Attack
- elastic User account exposed to Kerberoasting
- splunk Windows AD ServicePrincipalName Added To Domain Account
- splunk Windows AD Short Lived Domain Account ServicePrincipalName
- splunk Windows AD Short Lived Domain Controller SPN Attribute
eq: gPCMachineExtensionNames 4 rules
wildcard: gPCMachineExtensionNames 3 rules
eq: msDS-KeyCredentialLink 2 rules
Sample rules:
eq: gPCUserExtensionNames 2 rules
wildcard: gPCUserExtensionNames 2 rules
Channel 6 entries
eq: Microsoft-Windows-PowerShell/Operational 2 rules
Top techniques:Clear Windows Event Logs
T1070.001Sample rules:
eq: Microsoft-Windows-Sysmon/Operational 2 rules
Top techniques:Clear Windows Event Logs
T1070.001Sample rules:
eq: PowerShellCore/Operational 2 rules
Top techniques:Clear Windows Event Logs
T1070.001Sample rules:
eq: Security 2 rules
Top techniques:Clear Windows Event Logs
T1070.001Sample rules:
eq: System 2 rules
Top techniques:Clear Windows Event Logs
T1070.001Sample rules:
eq: Windows PowerShell 2 rules
Top techniques:Clear Windows Event Logs
T1070.001Sample rules:
Data 6 entries
match: EngineVersion=2. 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
match: MsMpEng.exe 2 rules
Sample rules:
match: \Desktop\ 2 rules
Sample rules:
match: \Users\Public\ 2 rules
Sample rules:
match: mpengine.dll 2 rules
Sample rules:
match: ntds.dit 2 rules
Top techniques:NTDS
T1003.003Sample rules:
TaskName 6 entries
match: \Windows\BitLocker 2 rules
Sample rules:
match: \Windows\ExploitGuard 2 rules
Sample rules:
match: \Windows\SystemRestore\SR 2 rules
Sample rules:
match: \Windows\Windows Defender\ 2 rules
Sample rules:
match: \Windows\WindowsBackup\ 2 rules
Sample rules:
match: \Windows\WindowsUpdate\ 2 rules
Sample rules:
ObjectClass 5 entries
eq: groupPolicyContainer 4 rules
Top techniques:Group Policy Modification
T1484.001, Windows File and Directory Permissions Modification T1222.001, Domain Accounts T1078.002Sample rules:
eq: user 4 rules
eq: domainDNS 4 rules
eq: dnsNode 3 rules
eq: "dnsNode" 2 rules
Top techniques:DNS
T1071.004, Forced Authentication T1187, LLMNR/NBT-NS Poisoning and SMB Relay T1557.001Sample rules:
RelativeTargetName 5 entries
eq: lsarpc 3 rules
Sample rules:
eq: atsvc 2 rules
Sample rules:
eq: protected_storage 2 rules
Top techniques:SMB/Windows Admin Shares
T1021.002Sample rules:
eq: spoolss 2 rules
Top techniques:SMB/Windows Admin Shares
T1021.002Sample rules:
eq: svcctl 2 rules
Top techniques:SMB/Windows Admin Shares
T1021.002Sample rules:
Status 5 entries
eq: 0x6 3 rules
eq: 0x12 2 rules
Top techniques:Password Spraying
T1110.003eq: 0x18 2 rules
Top techniques:Password Spraying
T1110.003eq: 0xC000006A 2 rules
Top techniques:Password Spraying
T1110.003eq: 0xc0000064 2 rules
Top techniques:Password Spraying
T1110.003AuditPolicyChanges 5 entries
in: "%%8448" 2 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
in: "%%8448, %%8450" 2 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
in: "%%8450" 2 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
match: %%8448 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
match: %%8450 2 rules
Top techniques:Disable Windows Event Logging
T1562.002Sample rules:
CallTrace 5 entries
match: UNKNOWN 2 rules
match: dbgcore.dll 2 rules
match: dbghelp.dll 2 rules
match: |UNKNOWN( 2 rules
Sample rules:
wildcard: *UNKNOWN* 2 rules
Top techniques:OS Credential Dumping
T1003, LSASS Memory T1003.001, Process Injection T1055, Process Hollowing T1055.012Sample rules:
AccessMask 4 entries
eq: 0x100 3 rules
Top techniques:DCSync
T1003.006, OS Credential Dumping T1003, Valid Accounts T1078, Domain Accounts T1078.002Sample rules:
eq: "0x100" 2 rules
Top techniques:DCSync
T1003.006eq: "0x2" 2 rules
Sample rules:
eq: 0x2 2 rules
Sample rules:
AuthenticationPackageName 4 entries
eq: Negotiate 3 rules
eq: Kerberos 2 rules
eq: NTLM 2 rules
wildcard: Kerberos 2 rules
ModifyingApplication 4 entries
ends_with: \MsMpEng.exe 2 rules
eq: C:\Windows\System32\svchost.exe 2 rules
starts_with: C:\ProgramData\Microsoft\Windows Defender\Platform\ 2 rules
starts_with: C:\Windows\WinSxS\ 2 rules
ObjectName 4 entries
ends_with: -500 2 rules
Sample rules:
ends_with: -512 2 rules
Sample rules:
ends_with: \lsass.exe 2 rules
Top techniques:LSASS Memory
T1003.001Sample rules:
match: \Microsoft\Windows Defender\Exclusions\ 2 rules
Top techniques:Disable or Modify Tools
T1562.001event.category 3 entries
eq: authentication 5 rules
eq: iam 2 rules
Sample rules:
eq: process 2 rules
AccessList 3 entries
match: WriteData 4 rules
match: %%4417 3 rules
wildcard: *%%4417* 2 rules
TicketOptions 3 entries
eq: 0x40810000 3 rules
eq: 0x40800000 2 rules
Sample rules:
eq: 0x40810010 2 rules
Sample rules:
Changes 3 entries
in: "Failure removed" 2 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
in: "Success removed" 2 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
in: "Success removed, Failure removed" 2 rules
Top techniques:Disable or Modify Tools
T1562.001Sample rules:
Payload 3 entries
match: && 2 rules
match: shell32.dll 2 rules
match: shellexec_rundll 2 rules
Signed 2 entries
eq: false 8 rules
Top techniques:DLL
T1574.001, LSASS Memory T1003.001, Match Legitimate Resource Name or Location T1036.005, Shared Modules T1129, MMC T1218.014, Bypass User Account Control T1548.002Sample rules:
- sigma Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded
- sigma Unsigned .node File Loaded
- sigma Unsigned Image Loaded Into LSASS Process
- sigma Unsigned Module Loaded by ClickOnce Application
- splunk UAC Bypass MMC Load Unsigned Dll
- splunk Windows Unsigned DLL Side-Loading
- splunk Windows Unsigned DLL Side-Loading In Same Process Path
- splunk Windows Unsigned MS DLL Side-Loading
eq: true 8 rules
Sample rules:
- sigma Potential JLI.dll Side-Loading
- sigma Potential DLL Sideloading Of Non-Existent DLLs From System Folders
- sigma Potential Python DLL SideLoading
- sigma VMGuestLib DLL Sideload
- sigma VMMap Signed Dbghelp.DLL Potential Sideloading
- sigma VMMap Unsigned Dbghelp.DLL Potential Sideloading
- sigma Unsigned DLL Loaded by Windows Utility
- sigma Suspicious Unsigned Thor Scanner Execution
source.ip 2 entries
ne: 127.0.0.1 8 rules
Top techniques:Forced Authentication
T1187, Adversary-in-the-Middle T1557, LLMNR/NBT-NS Poisoning and SMB Relay T1557.001, Remote Services T1021, SMB/Windows Admin Shares T1021.002, Brute Force T1110Sample rules:
- elastic Multiple Logon Failure Followed by Logon Success
- elastic Potential Computer Account NTLM Relay Activity
- elastic Potential Kerberos Relay Attack against a Computer Account
- elastic Potential NTLM Relay Attack against a Computer Account
- elastic Potential Machine Account Relay Attack via SMB
- elastic Remote Windows Service Installed
- elastic Account Password Reset Remotely
- elastic Potential Account Takeover - Logon from New Source IP
ne: ::1 7 rules
Top techniques:Forced Authentication
T1187, Adversary-in-the-Middle T1557, LLMNR/NBT-NS Poisoning and SMB Relay T1557.001, Remote Services T1021, SMB/Windows Admin Shares T1021.002, Brute Force T1110Sample rules:
- elastic Multiple Logon Failure Followed by Logon Success
- elastic Potential Computer Account NTLM Relay Activity
- elastic Potential Kerberos Relay Attack against a Computer Account
- elastic Potential NTLM Relay Attack against a Computer Account
- elastic Potential Machine Account Relay Attack via SMB
- elastic Remote Windows Service Installed
- elastic Account Password Reset Remotely
Esql.script_block_length 2 entries
gt: 500 6 rules
Top techniques:Obfuscated Files or Information
T1027, Command Obfuscation T1027.010, Command and Scripting Interpreter T1059, PowerShell T1059.001, Deobfuscate/Decode Files or Information T1140Sample rules:
- elastic Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- elastic Potential Dynamic IEX Reconstruction via Environment Variables
- elastic Dynamic IEX Reconstruction via Method String Access
- elastic PowerShell Obfuscation via Negative Index String Reversal
- elastic Potential PowerShell Obfuscation via String Concatenation
- elastic Potential PowerShell Obfuscation via String Reordering
Esql.script_block_pattern_count 2 entries
ge: 1 6 rules
Top techniques:Obfuscated Files or Information
T1027, Command Obfuscation T1027.010, Command and Scripting Interpreter T1059, PowerShell T1059.001, Deobfuscate/Decode Files or Information T1140Sample rules:
- elastic Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- elastic Potential PowerShell Obfuscation via Character Array Reconstruction
- elastic Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
- elastic Potential Dynamic IEX Reconstruction via Environment Variables
- elastic Dynamic IEX Reconstruction via Method String Access
- elastic PowerShell Obfuscation via Negative Index String Reversal
ge: 2 2 rules
OperationType 2 entries
eq: %%14674 4 rules
eq: "%%14674" 3 rules
SignatureStatus 2 entries
eq: Valid 4 rules
ne: Valid 2 rules
Sample rules:
Company 2 entries
eq: AnyDesk Software GmbH 3 rules
eq: LogMeIn, Inc. 2 rules
Top techniques:Remote Desktop Software
T1219.002Sample rules:
TargetName 2 entries
match: Microsoft_Windows_Shell_ZipFolder:filename 3 rules
match: \Temporary Internet Files\Content.Outlook 2 rules
Sample rules:
event_action 2 entries
eq: "created" 3 rules
eq: created 2 rules
Top techniques:Spearphishing Attachment
T1566.001Sample rules:
user.id 2 entries
wildcard: S-1-12-1-* 3 rules
wildcard: S-1-5-21-* 3 rules
Attributes 2 entries
eq: "*CertificateTemplate:*" 2 rules
eq: "*SAN:*upn*" 2 rules
LogonId 2 entries
eq: 0x3e4 2 rules
Sample rules:
eq: 0x3e7 2 rules
Sample rules:
ParentUser 2 entries
match: AUTHORI 2 rules
Sample rules:
match: AUTORI 2 rules
Sample rules:
Path 2 entries
match: \Desktop\ 2 rules
Top techniques:Scheduled Task
T1053.005match: \Downloads\ 2 rules
Top techniques:Scheduled Task
T1053.005TargetUserSid 2 entries
ends_with: -500 2 rules
Top techniques:Abuse Elevation Control Mechanism
T1548starts_with: S-1-5-21- 2 rules
Top techniques:Abuse Elevation Control Mechanism
T1548aceType 2 entries
in: "Access denied" 2 rules
Top techniques:Windows File and Directory Permissions Modification
T1222.001, Domain or Tenant Policy Modification T1484Sample rules:
in: D 2 rules
Top techniques:Windows File and Directory Permissions Modification
T1222.001, Domain or Tenant Policy Modification T1484Sample rules:
isutility 2 entries
eq: TRUE 2 rules
Top techniques:Remote Access Tools
T1219Sample rules:
eq: True 2 rules
Top techniques:Remote Access Tools
T1219Sample rules:
registry_value_name 2 entries
eq: "(Default)" 2 rules
Top techniques:Bypass User Account Control
T1548.002Sample rules:
- splunk Sdclt UAC Bypass
- splunk WSReset UAC Bypass
eq: "FriendlyName" 2 rules
Top techniques:Data from Removable Media
T1025, Replication Through Removable Media T1091, Hardware Additions T1200Sample rules:
Initiated 1 entries
eq: true 40 rules
Top techniques:Protocol Tunneling
T1572, Ingress Tool Transfer T1105, Web Service T1102, Exfiltration Over Web Service T1567, Remote Desktop Protocol T1021.001, Dead Drop Resolver T1102.001Sample rules (showing 8 of 40):
- sigma Network Connection Initiated By AddinUtil.EXE
- sigma Uncommon Connection to Active Directory Web Services
- sigma Uncommon Network Connection Initiated By Certutil.EXE
- sigma Outbound Network Connection Initiated By Cmstp.EXE
- sigma Outbound Network Connection Initiated By Microsoft Dialer
- sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
- sigma Network Connection Initiated To BTunnels Domains
- sigma Network Connection Initiated To Cloudflared Tunnels Domains
isOutlier 1 entries
eq: 1 16 rules
Top techniques:Password Spraying
T1110.003, Account Manipulation T1098, Impair Defenses T1562, Service Execution T1569.002, Transfer Data to Cloud Account T1537, Email Addresses T1589.002Sample rules (showing 8 of 16):
- splunk Detect Password Spray Attempts
- splunk Excessive Usage Of SC Service Utility
- splunk High Frequency Copy Of Files In Network Share
- splunk Kerberos User Enumeration
- splunk Spike in File Writes
- splunk Unusual Number of Kerberos Service Tickets Requested
- splunk Windows Increase in Group or Object Modification Activity
- splunk Windows Increase in User Modification Activity
event.outcome 1 entries
eq: success 8 rules
Top techniques:Create or Modify System Process
T1543, Windows Service T1543.003, Valid Accounts T1078, Access Token Manipulation T1134, Use Alternate Authentication Material T1550, Pass the Hash T1550.002Sample rules:
- elastic Potential Pass-the-Hash (PtH) Attempt
- elastic Remote Windows Service Installed
- elastic Account Password Reset Remotely
- elastic Potential Account Takeover - Mixed Logon Types
- elastic Process Creation via Secondary Logon
- elastic Service Creation via Local Kerberos Authentication
- elastic Potential Account Takeover - Logon from New Source IP
- elastic Suspicious SeIncreaseBasePriorityPrivilege Use
unique_accounts 1 entries
gt: 30 8 rules
Top techniques:Password Spraying
T1110.003Sample rules:
- splunk Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
- splunk Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
- splunk Windows Multiple Invalid Users Failed To Authenticate Using NTLM
- splunk Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials
- splunk Windows Multiple Users Failed To Authenticate From Host Using NTLM
- splunk Windows Multiple Users Failed To Authenticate From Process
- splunk Windows Multiple Users Failed To Authenticate Using Kerberos
- splunk Windows Multiple Users Remotely Failed To Authenticate From Host
TicketEncryptionType 1 entries
eq: 0x17 7 rules
Top techniques:Kerberoasting
T1558.003, Golden Ticket T1558.001, Use Alternate Authentication Material T1550Sample rules:
- sigma Kerberoasting Activity - Initial Query
- sigma Potential AS-REP Roasting via Kerberos TGT Requests
- sigma Suspicious Kerberos RC4 Ticket Encryption
- splunk Kerberoasting spn request with RC4 encryption
- splunk Kerberos Service Ticket Request Using RC4 Encryption
- splunk Kerberos TGT Request Using RC4 Encryption
- splunk Unusual Number of Kerberos Service Tickets Requested
unique_targets 1 entries
gt: 30 5 rules
short_lived 1 entries
eq: TRUE 4 rules
Top techniques:Scheduled Task
T1053.005, Domain Accounts T1078.002, Account Manipulation T1098, Rogue Domain Controller T1207Sample rules:
LogonProcessName 1 entries
eq: seclogo 3 rules
Sample rules:
SourcePort 1 entries
eq: 3389 3 rules
Top techniques:Remote Desktop Protocol
T1021.001, Protocol Tunneling T1572, Internal Proxy T1090.001, External Proxy T1090.002Sample rules:
admonEventType 1 entries
eq: Update 3 rules
Top techniques:Group Policy Modification
T1484.001, Disable or Modify Tools T1562.001, Windows File and Directory Permissions Modification T1222.001Sample rules:
- splunk Windows AD GPO Deleted
- splunk Windows AD GPO Disabled
- splunk Windows AD GPO New CSE Addition
dns.question.name 1 entries
eq: * 3 rules
objectCategory 1 entries
eq: "CN=Group-Policy-Container*" 3 rules
Top techniques:Group Policy Modification
T1484.001, Disable or Modify Tools T1562.001, Windows File and Directory Permissions Modification T1222.001Sample rules:
- splunk Windows AD GPO Deleted
- splunk Windows AD GPO Disabled
- splunk Windows AD GPO New CSE Addition
status 1 entries
eq: success 3 rules
Sample rules:
unique_users 1 entries
gt: 5 3 rules
Sample rules:
ClientProcessId 1 entries
eq: 0 2 rules
Sample rules:
parent_process_id 1 entries
eq: 0 2 rules
Sample rules:
process_id 1 entries
eq: 0 2 rules
Action 1 entries
eq: 2 2 rules
All_Changes.result_id 1 entries
eq: 4720 2 rules
Sample rules:
- splunk Short Lived Windows Accounts
- splunk Windows Create Local Account
ApplicationPath 1 entries
match: \AppData\Local\Temp\ 2 rules
Esql.max_logon 1 entries
ge: 1000 2 rules
Top techniques:Valid Accounts
T1078Sample rules:
Esql.min_logon 1 entries
ge: 1 2 rules
Top techniques:Valid Accounts
T1078Sample rules:
Esql.unique_host_count 1 entries
ge: 2 2 rules
Top techniques:Valid Accounts
T1078Sample rules:
NewTargetUserName 1 entries
ne: "*$" 2 rules
Top techniques:Domain Accounts
T1078.002Sample rules:
NewTemplateContent 1 entries
match: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT 2 rules
OldTargetUserName 1 entries
eq: "*$" 2 rules
Top techniques:Domain Accounts
T1078.002Sample rules:
PipeName 1 entries
starts_with: \PSHost 2 rules
Top techniques:PowerShell
T1059.001Sample rules:
ServiceType 1 entries
eq: "kernel mode driver" 2 rules
Top techniques:Rootkit
T1014, Exploitation for Privilege Escalation T1068, Windows Service T1543.003Sample rules:
SubjectUserSid 1 entries
eq: S-1-0-0 2 rules
Sample rules:
Target_User_Name 1 entries
ne: *$ 2 rules
Top techniques:Password Spraying
T1110.003TemplateContent 1 entries
match: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT 2 rules
count 1 entries
ge: 100 2 rules
Top techniques:Data Destruction
T1485Sample rules:
dropped_file_path_split_count 1 entries
eq: 2 2 rules
Sample rules:
is_driver 1 entries
eq: TRUE 2 rules
Top techniques:Windows Service
T1543.003Sample rules:
islibrary 1 entries
eq: TRUE 2 rules
Top techniques:DLL
T1574.001Sample rules:
parent_process_name 1 entries
in: "powershell.exe" 2 rules
Sample rules:
user.domain 1 entries
ne: NT AUTHORITY 2 rules
Sample rules:
ut_shannon 1 entries
gt: 3 2 rules
Sample rules: