Event ID 4688 — A new process has been created.

Provider: Microsoft-Windows-Security-Auditing
Channel: Security
Audit Policy: Detailed Tracking → Process Creation
Collection Priority: Recommended (Yamato Security, others)
Opcode: Info

Description

A new process has been created.

Message #

A new process has been created.

Subject:
	Security ID: %1
	Account Name: %2
	Account Domain: %3
	Logon ID: %4

Process Information:
	New Process ID: %5
	New Process Name: %6
	Token Elevation Type: %7
	Creator Process ID: %8

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.

Fields #

Name	Description
`SubjectUserSid` SID	[Creator Subject] Security ID.
`SubjectUserName` UnicodeString	[Creator Subject] Account Name.
`SubjectDomainName` UnicodeString	[Creator Subject] Account Domain.
`SubjectLogonId` HexInt64	[Creator Subject] Logon ID.
`NewProcessId` Pointer	[Process Information] New Process ID.
`NewProcessName` UnicodeString	[Process Information] New Process Name.
`TokenElevationType` UnicodeString	[Process Information] Token Elevation Type. Known values `%%1936` TokenElevationTypeDefault (1) `%%1937` TokenElevationTypeFull (2) `%%1938` TokenElevationTypeLimited (3) `1` TokenElevationTypeDefault `2` TokenElevationTypeFull `3` TokenElevationTypeLimited
`ProcessId` Pointer	[Process Information] Creator Process ID.
`CommandLine` UnicodeString	[Process Information] Process Command Line.
`TargetUserSid` SID	[Target Subject] Security ID.
`TargetUserName` UnicodeString	[Target Subject] Account Name.
`TargetDomainName` UnicodeString	[Target Subject] Account Domain.
`TargetLogonId` HexInt64	[Target Subject] Logon ID.
`ParentProcessName` UnicodeString	[Process Information] Creator Process Name.
`MandatoryLabel` SID	[Process Information] Mandatory Label.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 4688,
    "version": 2,
    "level": 0,
    "task": 13312,
    "opcode": 0,
    "keywords": 9232379236109516800,
    "time_created": "2023-11-06T06:25:27.153945+00:00",
    "event_record_id": 2753,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 336
    },
    "channel": "Security",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SubjectUserSid": "S-1-5-18",
    "SubjectUserName": "-",
    "SubjectDomainName": "-",
    "SubjectLogonId": "0x3e7",
    "NewProcessId": "0x328",
    "NewProcessName": "C:\\Windows\\System32\\lsass.exe",
    "TokenElevationType": "%%1936",
    "ProcessId": "0x27c",
    "CommandLine": "",
    "TargetUserSid": "S-1-0-0",
    "TargetUserName": "-",
    "TargetDomainName": "-",
    "TargetLogonId": "0x0",
    "ParentProcessName": "C:\\Windows\\System32\\wininit.exe",
    "MandatoryLabel": "S-1-16-16384"
  },
  "message": ""
}

Detection Patterns #

Security-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation

429 rules

Sigma

PsExec/PAExec Escalation to LOCAL SYSTEM (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Potential PsExec Remote Execution (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Potential Privilege Escalation To LOCAL SYSTEM (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Show 411 more (414 total)

Suspicious Download from Office Domain (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Suspicious Child Process Of SQL Server (source)

FPT.EagleEye Team, wagga

Remote Access Tool - ScreenConnect Server Web Shell Execution (source)

Jason Rathbun (Blackpoint Cyber)

Suspicious Processes Spawned by WinRM (source)

Andreas Hunkeler (@Karneades), Markus Neis

HTML Help HH.EXE Suspicious Child Process (source)

Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)

Phishing Pattern ISO in Archive (source)

Florian Roth (Nextron Systems)

Suspicious HWP Sub Processes (source)

Florian Roth (Nextron Systems)

Suspicious Execution From Outlook Temporary Folder (source)

Florian Roth (Nextron Systems)

Arbitrary Shell Command Execution Via Settingcontent-Ms (source)

Sreeman

Suspicious Double Extension File Execution (source)

Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems)

HackTool - CrackMapExec Execution (source)

Florian Roth (Nextron Systems)

HackTool - CrackMapExec Execution Patterns (source)

Thomas Patzke

Script Event Consumer Spawning Process (source)

Sittikorn S

Suspicious Process Created Via Wmic.EXE (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

WmiPrvSE Spawned A Process (source)

Roberto Rodriguez @Cyb3rWard0g

Suspicious WmiPrvSE Child Process (source)

Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)

HackTool - Default PowerSploit/Empire Scheduled Task Creation (source)

Markus Neis, @Karneades

Suspicious Schtasks Execution AppData Folder (source)

pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Suspicious Modification Of Scheduled Tasks (source)

Nasreddine Bencherchali (Nextron Systems)

Scheduled Task Creation Via Schtasks.EXE (source)

Florian Roth (Nextron Systems)

Suspicious Scheduled Task Creation Involving Temp Folder (source)

Florian Roth (Nextron Systems)

Scheduled Task Creation with Curl and PowerShell Execution Combo (source)

Swachchhanda Shrawan Poudel (Nextron Systems)

Suspicious Scheduled Task Name As GUID (source)

Nasreddine Bencherchali (Nextron Systems)

Suspicious Command Patterns In Scheduled Task Creation (source)

Florian Roth (Nextron Systems)

Schtasks Creation Or Modification With SYSTEM Privileges (source)

Nasreddine Bencherchali (Nextron Systems)

Suspicious ArcSOC.exe Child Process (source)

Micah Babinski

Potential Dosfuscation Activity (source)

frack113, Nasreddine Bencherchali (Nextron Systems)

Unusual Parent Process For Cmd.EXE (source)

Tim Rauch, Elastic (idea)

HackTool - Sliver C2 Implant Activity Pattern (source)

Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)

Use of Pcalua For Execution (source)

Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

Suspicious Runscripthelper.exe (source)

Victor Sergeev, oscd.community

Wscript Shell Run In CommandLine (source)

Nasreddine Bencherchali (Nextron Systems)

Outlook EnableUnsafeClientMailRules Setting Enabled (source)

Markus Neis, Nasreddine Bencherchali (Nextron Systems)

Suspicious Remote Child Process From Outlook (source)

Markus Neis, Nasreddine Bencherchali (Nextron Systems)

PowerShell Download and Execution Cradles (source)

Florian Roth (Nextron Systems)

Run PowerShell Script from Redirected Input Stream (source)

Moriarty Meng (idea), Anton Kutepov (rule), oscd.community

Python Spawning Pretty TTY on Windows (source)

Nextron Systems

Suspicious RASdial Activity (source)

juju4

Potentially Suspicious Execution From Parent Process In Public Folder (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Writing Of Malicious Files To The Fonts Folder (source)

Sreeman

Suspicious Scan Loop Network (source)

frack113

Suspicious Program Names (source)

Florian Roth (Nextron Systems)

Suspicious Script Execution From Temp Folder (source)

Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton

Sysprep on AppData Folder (source)

Florian Roth (Nextron Systems)

Command Line Execution with Suspicious URL and AppData Strings (source)

Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community

Cmd.EXE Missing Space Characters Execution Anomaly (source)

Florian Roth (Nextron Systems)

HackTool - Covenant PowerShell Launcher (source)

Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community

HackTool - Empire PowerShell Launch Parameters (source)

Florian Roth (Nextron Systems)

Invoke-Obfuscation CLIP+ Launcher (source)

Jonathan Cheong, oscd.community

Invoke-Obfuscation Obfuscated IEX Invocation (source)

Daniel Bohannon (@Mandiant/@FireEye), oscd.community

Invoke-Obfuscation STDIN+ Launcher (source)

Jonathan Cheong, oscd.community

Invoke-Obfuscation VAR+ Launcher (source)

Jonathan Cheong, oscd.community

Invoke-Obfuscation COMPRESS OBFUSCATION (source)

Timur Zinniatullin, oscd.community

Invoke-Obfuscation Via Stdin (source)

Nikita Nazarov, oscd.community

Invoke-Obfuscation Via Use Clip (source)

Nikita Nazarov, oscd.community

Invoke-Obfuscation Via Use MSHTA (source)

Nikita Nazarov, oscd.community

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION (source)

Timur Zinniatullin, oscd.community

Execute Code with Pester.bat (source)

Julia Fomina, oscd.community

PowerShell Base64 Encoded FromBase64String Cmdlet (source)

Florian Roth (Nextron Systems)

PowerShell Base64 Encoded IEX Cmdlet (source)

Florian Roth (Nextron Systems)

PowerShell Base64 Encoded Reflective Assembly Load (source)

Christian Burkard (Nextron Systems), pH-T (Nextron Systems)

Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call (source)

pH-T (Nextron Systems)

Potential PowerShell Downgrade Attack (source)

Harish Segar (rule)

Obfuscated PowerShell OneLiner Execution (source)

@Kostastsale, TheDFIRReport

Potential DLL File Download Via PowerShell Invoke-WebRequest (source)

Florian Roth (Nextron Systems), Hieu Tran

DSInternals Suspicious PowerShell Cmdlets (source)

Nasreddine Bencherchali (Nextron Systems), Nounou Mbeiri

Suspicious Execution of Powershell with Base64 (source)

frack113

Powershell Inline Execution From A File (source)

frack113

Certificate Exported Via PowerShell (source)

Nasreddine Bencherchali (Nextron Systems)

Base64 Encoded PowerShell Command Detected (source)

Florian Roth (Nextron Systems)

Suspicious PowerShell IEX Execution Patterns (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Import PowerShell Modules From Suspicious Directories - ProcCreation (source)

Nasreddine Bencherchali (Nextron Systems)

Malicious PowerShell Commandlets - ProcessCreation (source)

Nasreddine Bencherchali (Nextron Systems)

Potential PowerShell Obfuscation Via WCHAR/CHAR (source)

Florian Roth (Nextron Systems)

Execution of Powershell Script in Public Folder (source)

Max Altgelt (Nextron Systems)

Suspicious PowerShell Download and Execute Pattern (source)

Florian Roth (Nextron Systems)

Suspicious PowerShell Parameter Substring (source)

Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix)

PowerShell Script Run in AppData (source)

Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community

Potential Data Exfiltration Activity Via CommandLine Tools (source)

Nasreddine Bencherchali (Nextron Systems)

Hidden Powershell in Link File Pattern (source)

frack113

Usage Of Web Request Commands And Cmdlets (source)

James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger

Potentially Suspicious WebDAV LNK Execution (source)

Micah Babinski

Remote PowerShell Session Host Process (WinRM) (source)

Roberto Rodriguez @Cyb3rWard0g

OpenEDR Spawning Command Shell (source)

@kostastsale

HackTool - RedMimicry Winnti Playbook Execution (source)

Alexander Rausch

Suspicious Child Process Of BgInfo.EXE (source)

Nasreddine Bencherchali (Nextron Systems)

Uncommon Child Process Of BgInfo.EXE (source)

Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community

Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS (source)

Nasreddine Bencherchali (Nextron Systems)

Registry Modification Attempt Via VBScript (source)

Swachchhanda Shrawan Poudel (Nextron Systems)

Potential Dropper Script Execution Via WScript/CScript (source)

Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)

Node Process Executions (source)

Max Altgelt (Nextron Systems)

Script Interpreter Spawning Credential Scanner - Windows (source)

Swachchhanda Shrawan Poudel (Nextron Systems)

HackTool - WinPwn Execution (source)

Swachchhanda Shrawan Poudel

Potential WinAPI Calls Via CommandLine (source)

Nasreddine Bencherchali (Nextron Systems)

Java Running with Remote Debugging (source)

Florian Roth (Nextron Systems)

Suspicious Outlook Child Process (source)

Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team

Suspicious Binary In User Directory Spawned From Office Application (source)

Jason Lynch

Potential Suspicious Browser Launch From Document Reader Process (source)

Joseph Kamau

Suspicious ClickFix/FileFix Execution Pattern (source)

montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)

Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix (source)

Swachchhanda Shrawan Poudel (Nextron Systems)

Suspicious FileFix Execution Pattern (source)

0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems)

PUA - NirCmd Execution As LOCAL SYSTEM (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

PUA - RunXCmd Execution (source)

Florian Roth (Nextron Systems)

Rundll32 Execution Without Parameters (source)

Bartlomiej Czyz, Relativity

Potential Persistence Via Logon Scripts - CommandLine (source)

Tom Ueltschi (@c_APT_ure)

Uncommon Userinit Child Process (source)

Tom Ueltschi (@c_APT_ure), Tim Shelton

User Added to Local Administrators Group (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

User Added To Highly Privileged Group (source)

Nasreddine Bencherchali (Nextron Systems)

Unusual Child Process of dns.exe (source)

Tim Rauch, Elastic (idea)

Remote Access Tool - ScreenConnect Installation Execution (source)

Florian Roth (Nextron Systems)

Remote Access Tool - Team Viewer Session Started On Windows Host (source)

Josh Nickels, Qi Nan

User Added to Remote Desktop Users Group (source)

Florian Roth (Nextron Systems)

Chromium Browser Instance Executed With Custom Extension (source)

Aedan Russell, frack113, X__Junior (Nextron Systems)

Suspicious Chromium Browser Instance Executed With Custom Extension (source)

Aedan Russell, frack113, X__Junior (Nextron Systems)

Chopper Webshell Process Pattern (source)

Florian Roth (Nextron Systems), MSTI (query)

Webshell Hacking Activity Patterns (source)

Florian Roth (Nextron Systems)

Webshell Tool Reconnaissance Activity (source)

Cian Heasley, Florian Roth (Nextron Systems)

New Service Creation Using PowerShell (source)

Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

New Service Creation Using Sc.EXE (source)

Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

New Kernel Driver Via SC.EXE (source)

Nasreddine Bencherchali (Nextron Systems)

Suspicious Service Path Modification (source)

Victor Sergeev, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Potential Persistence Attempt Via Existing Service Tampering (source)

Sreeman

Suspicious New Service Creation (source)

Nasreddine Bencherchali (Nextron Systems)

Suspicious Driver Install by pnputil.exe (source)

Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger

Suspicious GrpConv Execution (source)

Florian Roth (Nextron Systems)

Potential Persistence Attempt Via Run Keys Using Reg.EXE (source)

Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)

DLL Execution Via Register-cimprovider.exe (source)

Ivan Dyachkov, Yulia Fomina, oscd.community

DLL Sideloading by VMware Xfer Utility (source)

Nasreddine Bencherchali (Nextron Systems)

New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE (source)

Florian Roth (Nextron Systems)

Suspicious GUP Usage (source)

Florian Roth (Nextron Systems)

Potential Mpclient.DLL Sideloading Via Defender Binaries (source)

Bhabesh Raj

Tasks Folder Evasion (source)

Sreeman

Changing Existing Service ImagePath Value Via Reg.EXE (source)

frack113

Potential Privilege Escalation via Service Permissions Weakness (source)

Teymur Kheirkhabarov

Possible Privilege Escalation via Weak Service Permissions (source)

Teymur Kheirkhabarov

Suspicious ScreenSave Change by Reg.exe (source)

frack113

WMI Backdoor Exchange Transport Agent (source)

Florian Roth (Nextron Systems)

WMI Persistence - Script Event Consumer (source)

Thomas Patzke

New ActiveScriptEventConsumer Created Via Wmic.EXE (source)

Florian Roth (Nextron Systems)

Sticky Key Like Backdoor Execution (source)

Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community

Persistence Via Sticky Key Backdoor (source)

Sreeman

Suspicious Debugger Registration Cmdline (source)

Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro

Potentially Suspicious Event Viewer Child Process (source)

Florian Roth (Nextron Systems)

HackTool - Empire PowerShell UAC Bypass (source)

Ecco

Sdclt Child Processes (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

UAC Bypass Using ChangePK and SLUI (source)

Christian Burkard (Nextron Systems)

UAC Bypass Tools Using ComputerDefaults (source)

Christian Burkard (Nextron Systems)

UAC Bypass Using Consent and Comctl32 - Process (source)

Christian Burkard (Nextron Systems)

UAC Bypass Using DismHost (source)

Christian Burkard (Nextron Systems)

Bypass UAC via Fodhelper.exe (source)

E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community

UAC Bypass Using IEInstal - Process (source)

Christian Burkard (Nextron Systems)

UAC Bypass Using MSConfig Token Modification - Process (source)

Christian Burkard (Nextron Systems)

UAC Bypass Using PkgMgr and DISM (source)

Christian Burkard (Nextron Systems)

Potential UAC Bypass Via Sdclt.EXE (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

TrustedPath UAC Bypass Pattern (source)

Florian Roth (Nextron Systems)

UAC Bypass WSReset (source)

Christian Burkard (Nextron Systems)

Ping Hex IP (source)

Florian Roth (Nextron Systems)

Potential Application Whitelisting Bypass via Dnx.EXE (source)

Beyu Denis, oscd.community

Visual Basic Command Line Compiler Usage (source)

Ensar Şamil, @sblmsrsn, @oscd_initiative

Suspicious Calculator Usage (source)

Florian Roth (Nextron Systems)

Suspicious CodePage Switch Via CHCP (source)

Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community

Explorer Process Tree Break (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber

HackTool - XORDump Execution (source)

Florian Roth (Nextron Systems)

Potential Fake Instance Of Hxtsr.EXE Executed (source)

Sreeman

Suspicious Process Start Locations (source)

juju4, Jonhnathan Ribeiro, oscd.community

Sdiagnhost Calling Suspicious Child Process (source)

Nextron Systems, @Kostastsale

Potential Command Line Path Traversal Evasion Attempt (source)

Christian Burkard (Nextron Systems)

Process Execution From A Potentially Suspicious Folder (source)

Florian Roth (Nextron Systems), Tim Shelton

Potential Homoglyph Attack Using Lookalike Characters (source)

Micah Babinski, @micahbabinski

Suspicious Process Parents (source)

Florian Roth (Nextron Systems)

System File Execution Location Anomaly (source)

Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Procdump Execution (source)

Florian Roth (Nextron Systems)

Potential SysInternals ProcDump Evasion (source)

Florian Roth (Nextron Systems)

Potential LSASS Process Dump Via Procdump (source)

Florian Roth (Nextron Systems)

Taskmgr as LOCAL_SYSTEM (source)

Florian Roth (Nextron Systems)

New Process Created Via Taskmgr.EXE (source)

Florian Roth (Nextron Systems)

Suspicious Child Process Of Wermgr.EXE (source)

Florian Roth (Nextron Systems)

Windows Processes Suspicious Parent Directory (source)

vburov

Uncommon Svchost Command Line Parameter (source)

Liran Ravich

Uncommon Svchost Parent Process (source)

Florian Roth (Nextron Systems)

Dllhost.EXE Execution Anomaly (source)

Nasreddine Bencherchali (Nextron Systems)

HackTool - DInjector PowerShell Cradle Execution (source)

Florian Roth (Nextron Systems)

Suspicious Rundll32 Invoking Inline VBScript (source)

Florian Roth (Nextron Systems)

Process Creation Using Sysnative Folder (source)

Max Altgelt (Nextron Systems)

Suspect Svchost Activity (source)

David Burkett, @signalblur

HackTool - HollowReaper Execution (source)

Swachchhanda Shrawan Poudel (Nextron Systems)

ETW Trace Evasion Activity (source)

@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community

Suspicious Ping/Del Command Combination (source)

Ilya Krestinichev

RestrictedAdminMode Registry Value Tampering - ProcCreation (source)

frack113

Enable LM Hash Storage - ProcCreation (source)

Nasreddine Bencherchali (Nextron Systems)

ShimCache Flush (source)

Florian Roth (Nextron Systems)

Non-privileged Usage of Reg or Powershell (source)

Teymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community

Suspicious VBoxDrvInst.exe Parameters (source)

Konstantin Grishchenko, oscd.community

AspNetCompiler Execution (source)

frack113

Suspicious Child Process of AspNetCompiler (source)

Nasreddine Bencherchali (Nextron Systems)

Potentially Suspicious ASP.NET Compilation Via AspNetCompiler (source)

Nasreddine Bencherchali (Nextron Systems)

Kavremover Dropped Binary LOLBIN Usage (source)

Nasreddine Bencherchali (Nextron Systems)

Potential Mftrace.EXE Abuse (source)

Nasreddine Bencherchali (Nextron Systems)

Potential Arbitrary Code Execution Via Node.EXE (source)

Nasreddine Bencherchali (Nextron Systems)

Potential Meterpreter/CobaltStrike Activity (source)

Teymur Kheirkhabarov, Ecco, Florian Roth

PUA - AdvancedRun Suspicious Execution (source)

Florian Roth (Nextron Systems)

Potential Commandline Obfuscation Using Escape Characters (source)

juju4

Suspicious High IntegrityLevel Conhost Legacy Option (source)

frack113

Uncommon Child Process Of Conhost.EXE (source)

omkar72

Suspicious ZipExec Execution (source)

frack113

Rundll32 Execution Without CommandLine Parameters (source)

Florian Roth (Nextron Systems)

Uncommon Child Process Of Setres.EXE (source)

@gott_cyber, Nasreddine Bencherchali (Nextron Systems)

Suspicious Splwow64 Without Params (source)

Florian Roth (Nextron Systems)

Suspicious Service Binary Directory (source)

Florian Roth (Nextron Systems)

Potentially Suspicious Child Process Of VsCode (source)

Nasreddine Bencherchali (Nextron Systems)

WSL Child Process Anomaly (source)

Nasreddine Bencherchali (Nextron Systems)

WSL Kali-Linux Usage (source)

Swachchhanda Shrawan Poudel (Nextron Systems)

Suspicious CustomShellHost Execution (source)

Nasreddine Bencherchali (Nextron Systems)

SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code (source)

frack113

UtilityFunctions.ps1 Proxy Dll (source)

frack113

Potential Process Execution Proxy Via CL_Invocation.ps1 (source)

Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova

Assembly Loading Via CL_LoadAssembly.ps1 (source)

frack113, Nasreddine Bencherchali (Nextron Systems)

Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 (source)

Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova, frack113

Uncommon Sigverif.EXE Child Process (source)

Nasreddine Bencherchali (Nextron Systems)

AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl (source)

Julia Fomina, oscd.community

Launch-VsDevShell.PS1 Proxy Execution (source)

Nasreddine Bencherchali (Nextron Systems)

Pubprn.vbs Proxy Execution (source)

frack113

Uncommon Child Process Of AddinUtil.EXE (source)

Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)

Uncommon Child Process Of Appvlp.EXE (source)

Sreeman

Suspicious BitLocker Access Agent Update Utility Execution (source)

andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)

BitLockerTogo.EXE Execution (source)

Josh Nickels, mttaggart

Curl Download And Execute Combination (source)

Sreeman, Nasreddine Bencherchali (Nextron Systems)

Uncommon Child Process Of Defaultpack.EXE (source)

frack113

DeviceCredentialDeployment Execution (source)

Nasreddine Bencherchali (Nextron Systems)

Arbitrary MSI Download Via Devinit.EXE (source)

Florian Roth (Nextron Systems)

Potentially Suspicious Child Process Of DiskShadow.EXE (source)

Nasreddine Bencherchali (Nextron Systems)

Potentially Suspicious Cabinet File Expansion (source)

Bhabesh Raj, X__Junior (Nextron Systems)

InfDefaultInstall.exe .inf Execution (source)

frack113

Uncommon Link.EXE Parent Process (source)

Nasreddine Bencherchali (Nextron Systems)

Devtoolslauncher.exe Executes Specified Binary (source)

Beyu Denis, oscd.community (rule), @_felamos (idea)

Execute Files with Msdeploy.exe (source)

Beyu Denis, oscd.community

OpenWith.exe Executes Specified Binary (source)

Beyu Denis, oscd.community (rule), @harr0ey (idea)

Indirect Command Execution By Program Compatibility Wizard (source)

A. Sungurov , oscd.community

Execute Pcwrun.EXE To Leverage Follina (source)

Nasreddine Bencherchali (Nextron Systems)

REGISTER_APP.VBS Proxy Execution (source)

Nasreddine Bencherchali (Nextron Systems)

Lolbin Runexehelper Use As Proxy (source)

frack113

Use Of The SFTP.EXE Binary As A LOLBIN (source)

Nasreddine Bencherchali (Nextron Systems)

Time Travel Debugging Utility Usage (source)

Ensar Şamil, @sblmsrsn, @oscd_initiative

MSDT Execution Via Answer File (source)

Nasreddine Bencherchali (Nextron Systems)

RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses (source)

frack113

Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Abusing Print Executable (source)

Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative

Potential Provlaunch.EXE Binary Proxy Execution Abuse (source)

Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel

Suspicious Provlaunch.EXE Child Process (source)

Nasreddine Bencherchali (Nextron Systems)

Potential Provisioning Registry Key Abuse For Binary Proxy Execution (source)

Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel

Suspicious Speech Runtime Binary Child Process (source)

andrewdanis

Arbitrary File Download Via Squirrel.EXE (source)

Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community

Process Proxy Execution Via Squirrel.EXE (source)

Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community

Execution via stordiag.exe (source)

Austin Songer (@austinsonger)

Potential File Download Via MS-AppInstaller Protocol Handler (source)

Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel

Malicious PE Execution by Microsoft Visual Studio Debugger (source)

Agro (@agro_sev), Ensar Şamil (@sblmsrsn), oscd.community

Execution via WorkFolders.exe (source)

Maxime Thiebaut (@0xThiebaut)

Suspicious Vsls-Agent Command With AgentExtensionPath Load (source)

bohops

COM Object Execution via Xwizard.EXE (source)

Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)

OneNote.EXE Execution of Malicious Embedded Scripts (source)

@kostastsale

CMSTP Execution Process Creation (source)

Nik Seetharaman

Suspicious Msiexec Execute Arbitrary DLL (source)

frack113

MsiExec Web Install (source)

Florian Roth (Nextron Systems)

Potential Regsvr32 Commandline Flag Anomaly (source)

Florian Roth (Nextron Systems)

Potentially Suspicious Child Process Of Regsvr32 (source)

elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Scripting/CommandLine Process Spawned Regsvr32 (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

HackTool - F-Secure C3 Load by Rundll32 (source)

Alfie Champion (ajpc500)

Suspicious Rundll32 Activity Invoking Sys File (source)

Florian Roth (Nextron Systems)

Msxsl.EXE Execution (source)

Timur Zinniatullin, oscd.community

Remote XSL Execution Via Msxsl.EXE (source)

Swachchhanda Shrawan Poudel

Suspicious Recursive Takeown (source)

frack113

Root Certificate Installed From Susp Locations (source)

Nasreddine Bencherchali (Nextron Systems)

Suspicious X509Enrollment - Process Creation (source)

frack113

Write Protect For Storage Disabled (source)

Sreeman

ETW Logging Tamper In .NET Processes Via CommandLine (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' (source)

Matt Anderson (Huntress)

Potential AMSI Bypass Via .NET Reflection (source)

Markus Neis, @Kostastsale

Potential AMSI Bypass Using NULL Bits (source)

Nasreddine Bencherchali (Nextron Systems)

Powershell Base64 Encoded MpPreference Cmdlet (source)

Florian Roth (Nextron Systems)

Powershell Defender Disable Scan Feature (source)

Florian Roth (Nextron Systems)

Powershell Defender Exclusion (source)

Florian Roth (Nextron Systems)

Disabled IE Security Features (source)

Florian Roth (Nextron Systems)

Tamper Windows Defender Remove-MpPreference (source)

Nasreddine Bencherchali (Nextron Systems)

PUA - CleanWipe Execution (source)

Nasreddine Bencherchali (Nextron Systems)

Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE (source)

frack113

Security Service Disabled Via Reg.EXE (source)

Florian Roth (Nextron Systems), John Lambert (idea), elhoim

Disabled Volume Snapshots (source)

Florian Roth (Nextron Systems)

Python Function Execution Security Warning Disabled In Excel (source)

@Kostastsale

Raccine Uninstall (source)

Florian Roth (Nextron Systems)

Taskkill Symantec Endpoint Protection (source)

Ilya Krestinichev, Florian Roth (Nextron Systems)

Uninstall Crowdstrike Falcon Sensor (source)

frack113

Potential Tampering With Security Products Via WMIC (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Audit Policy Tampering Via NT Resource Kit Auditpol (source)

Nasreddine Bencherchali (Nextron Systems)

Virtualbox Driver Installation or Starting of VMs (source)

Janantha Marasinghe

Potential Data Stealing Via Chromium Headless Debugging (source)

Nasreddine Bencherchali (Nextron Systems)

Browser Execution In Headless Mode (source)

Nasreddine Bencherchali (Nextron Systems)

File Download with Headless Browser (source)

Sreeman, Florian Roth (Nextron Systems)

Suspicious Diantz Alternate Data Stream Execution (source)

frack113

Suspicious Extrac32 Alternate Data Stream Execution (source)

frack113

PrintBrm ZIP Creation of Extraction (source)

frack113

Run PowerShell Script from ADS (source)

Sergey Soldatov, Kaspersky Lab, oscd.community

Execute From Alternate Data Streams (source)

frack113

Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI (source)

Nasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl)

Use NTFS Short Name in Command Line (source)

frack113, Nasreddine Bencherchali (Nextron Systems)

Use NTFS Short Name in Image (source)

frack113, Nasreddine Bencherchali (Nextron Systems)

Esentutl Gather Credentials (source)

sam0x90

Potential Credential Dumping Via LSASS Process Clone (source)

Florian Roth (Nextron Systems), Samir Bousseaden

Potential Credential Dumping Attempt Using New NetworkProvider - CLI (source)

Nasreddine Bencherchali (Nextron Systems)

HackTool - CrackMapExec Process Patterns (source)

Florian Roth (Nextron Systems)

HackTool - Mimikatz Execution (source)

Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Dumping Process via Sqldumper.exe (source)

Kirill Kiryanov, oscd.community

LSASS Dump Keyword In CommandLine (source)

E.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems)

VolumeShadowCopy Symlink Creation Via Mklink (source)

Teymur Kheirkhabarov, oscd.community

HackTool - Pypykatz Credentials Dumping Activity (source)

frack113

HackTool - Quarks PwDump Execution (source)

Nasreddine Bencherchali (Nextron Systems)

PowerShell SAM Copy (source)

Florian Roth (Nextron Systems)

Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) (source)

Thomas Patzke

PUA - DIT Snapshot Viewer (source)

Furkan Caliskan (@caliskanfurkan_)

Suspicious Process Patterns NTDS.DIT Exfil (source)

Florian Roth (Nextron Systems)

HackTool - Hydra Password Bruteforce Execution (source)

Vasiliy Burov

Attempts of Kerberos Coercion Via DNS SPN Spoofing (source)

Swachchhanda Shrawan Poudel (Nextron Systems)

Potentially Suspicious JWT Token Search Via CLI (source)

Nasreddine Bencherchali (Nextron Systems), kagebunsher

Potentially Suspicious Command Targeting Teams Sensitive Files (source)

@SerkinValery

Potential PowerShell Console History Access Attempt via History File (source)

Luc Génaux

PUA - TruffleHog Execution (source)

Swachchhanda Shrawan Poudel (Nextron Systems)

Enumeration for Credentials in Registry (source)

frack113

Enumeration for 3rd Party Creds From CLI (source)

Nasreddine Bencherchali (Nextron Systems)

PowerShell Get-Process LSASS (source)

Florian Roth (Nextron Systems)

Suspicious Serv-U Process Pattern (source)

Florian Roth (Nextron Systems)

Suspicious Child Process of Notepad++ Updater - GUP.Exe (source)

Swachchhanda Shrawan Poudel (Nextron Systems)

HackTool - ADCSPwn Execution (source)

Florian Roth (Nextron Systems)

HackTool - Impacket Tools Execution (source)

Florian Roth (Nextron Systems)

Potential SMB Relay Attack Tool Execution (source)

Florian Roth (Nextron Systems)

Suspicious Network Command (source)

frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'

HackTool - NetExec Execution (source)

Chirag Damani

PUA - AdFind Suspicious Execution (source)

Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community

PUA - Adidnsdump Execution (source)

frack113

WhoAmI as Parameter (source)

Florian Roth (Nextron Systems)

System Information Discovery via Registry Queries (source)

lazarg

Suspicious Kernel Dump Using Dtrace (source)

Florian Roth (Nextron Systems)

Suspicious Execution of Hostname (source)

frack113

Network Reconnaissance Activity (source)

Florian Roth (Nextron Systems)

Suspicious Query of MachineGUID (source)

frack113

Notepad Password Files Discovery (source)

The DFIR Report

HackTool - SOAPHound Execution (source)

@kostastsale

Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet (source)

Nasreddine Bencherchali (Nextron Systems)

PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE (source)

frack113

File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell (source)

@Kostastsale

Detected Windows Software Discovery (source)

Nikita Nazarov, oscd.community

Gpresult Display Group Policy Information (source)

frack113

Potential Remote Desktop Tunneling (source)

Tim Rauch, Elastic (idea)

Port Forwarding Activity Via SSH.EXE (source)

Nasreddine Bencherchali (Nextron Systems)

Suspicious RDP Redirect Using TSCON (source)

Florian Roth (Nextron Systems)

MMC20 Lateral Movement (source)

@2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea)

MMC Spawning Windows Shell (source)

Karneades, Swisscom CSIRT

HackTool - WinRM Access Via Evil-WinRM (source)

frack113

Potential Lateral Movement via Windows Remote Shell (source)

Liran Ravich

HackTool - SharpWSUS/WSUSpendu Execution (source)

@Kostastsale, Nasreddine Bencherchali (Nextron Systems)

Potential MSTSC Shadowing Activity (source)

Florian Roth (Nextron Systems)

Veeam Backup Database Suspicious Query (source)

Nasreddine Bencherchali (Nextron Systems)

VeeamBackup Database Credentials Dump Via Sqlcmd.EXE (source)

frack113

Screen Capture Activity Via Psr.EXE (source)

Beyu Denis, oscd.community

Audio Capture via PowerShell (source)

E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)

Audio Capture via SoundRecorder (source)

E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

Browser Started with Remote Debugging (source)

pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Files Added To An Archive Using Rar.EXE (source)

Timur Zinniatullin, E.M. Anhaus, oscd.community

Rar Usage with Password and Compression Level (source)

@ROxPinTeddy

Compress Data and Lock With Password for Exfiltration With WINZIP (source)

frack113

DNS Exfiltration and Tunneling Tools Execution (source)

Daniil Yugoslavskiy, oscd.community

Cloudflared Tunnel Connections Cleanup (source)

Nasreddine Bencherchali (Nextron Systems)

Cloudflared Tunnel Execution (source)

Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)

HackTool - Htran/NATBypass Execution (source)

Florian Roth (Nextron Systems)

Potentially Suspicious Usage Of Qemu (source)

Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)

Cloudflared Portable Execution (source)

Nasreddine Bencherchali (Nextron Systems)

PUA - Chisel Tunneling Tool Execution (source)

Florian Roth (Nextron Systems)

Suspicious Child Process Of Manage Engine ServiceDesk (source)

Florian Roth (Nextron Systems)

File Download From Browser Process Via Inline URL (source)

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Potential Download/Upload Activity Using Type Command (source)

Nasreddine Bencherchali (Nextron Systems)

Remote File Download Via Desktopimgdownldr Utility (source)

Tim Rauch, Elastic (idea)

Suspicious Desktopimgdownldr Command (source)

Florian Roth (Nextron Systems)

Arbitrary File Download Via GfxDownloadWrapper.EXE (source)

Victor Sergeev, oscd.community

Suspicious Diantz Download and Compress Into a CAB File (source)

frack113

Replace.exe Usage (source)

frack113

Potential COM Objects Download Cradles Usage - Process Creation (source)

frack113

Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server (source)

Ahmed Nosir (@egycondor)

Gzip Archive Decode Via PowerShell (source)

Hieu Tran

Suspicious FromBase64String Usage On Gzip Archive - Process Creation (source)

frack113

Suspicious Velociraptor Child Process (source)

Swachchhanda Shrawan Poudel (Nextron Systems)

QuickAssist Execution (source)

Muhammad Faisal (@faisalusuf)

Remote Access Tool - AnyDesk Piped Password Via CLI (source)

Nasreddine Bencherchali (Nextron Systems)

Remote Access Tool - AnyDesk Silent Installation (source)

Ján Trenčanský

Remote Access Tool - Potential MeshAgent Execution - Windows (source)

Norbert Jaśniewicz (AlphaSOC)

Remote Access Tool - MeshAgent Command Execution via MeshCentral (source)

@Kostastsale

Remote Access Tool - Simple Help Execution (source)

Nasreddine Bencherchali (Nextron Systems)

Potential Amazon SSM Agent Hijacking (source)

Muhammad Faisal

Suspicious TSCON Start as SYSTEM (source)

Florian Roth (Nextron Systems)

Potential RDP Tunneling Via Plink (source)

Florian Roth (Nextron Systems)

PUA - Ngrok Execution (source)

Florian Roth (Nextron Systems)

Potential RDP Tunneling Via SSH (source)

Nasreddine Bencherchali (Nextron Systems)

PUA - Restic Backup Tool Execution (source)

Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems)

Suspicious Redirection to Local Admin Share (source)

Florian Roth (Nextron Systems)

Tap Installer Execution (source)

Daniil Yugoslavskiy, Ian Davis, oscd.community

Suspicious Reg Add BitLocker (source)

frack113

Delete Important Scheduled Task (source)

Nasreddine Bencherchali (Nextron Systems)

Delete All Scheduled Tasks (source)

Nasreddine Bencherchali (Nextron Systems)

Disable Important Scheduled Task (source)

frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior

Copy From VolumeShadowCopy Via Cmd.EXE (source)

Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)

Deletion of Volume Shadow Copies via WMI with PowerShell (source)

Tim Rauch, Elastic (idea)

Sensitive File Access Via Volume Shadow Copy Backup (source)

Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)

Suspicious Execution of Shutdown (source)

frack113

Suspicious Execution of Shutdown to Log Out (source)

frack113

Splunk

Windows Explorer.exe Spawning PowerShell or Cmd (source)

Michael Haag, AJ King, Splunk, Jesse Hunter, Splunk Community Contributor

Windows Explorer LNK Exploit Process Launch With Padding (source)

Michael Haag, AJ King, Splunk, Jesse Hunter, Splunk Community Contributor

Windows TinyCC Shellcode Execution (source)

Michael Haag, Splunk

Show 11 more (14 total)

Windows DISM Install PowerShell Web Access (source)

Michael Haag, Splunk

Windows LOLBAS Executed Outside Expected Path (source)

Steven Dick

Windows Svchost.exe Parent Process Anomaly (source)

Teoderick Contreras, Splunk

Windows Unusual SysWOW64 Process Run System32 Executable (source)

Teoderick Contreras, Splunk

Windows BitLockerToGo Process Execution (source)

Michael Haag, Nasreddine Bencherchali, Splunk

Windows File and Directory Enable ReadOnly Permissions (source)

Teoderick Contreras, Splunk

Windows File and Directory Permissions Enable Inheritance (source)

Teoderick Contreras, Splunk

Windows File and Directory Permissions Remove Inheritance (source)

Teoderick Contreras, Splunk

Windows Alternate DataStream - Process Execution (source)

Steven Dick

Windows Remote Host Computer Management Access (source)

Teoderick Contreras, Splunk

Windows Remote Management Execute Shell (source)

Teoderick Contreras, Splunk

Kusto Query Language

Email access via active sync (source)

Microsoft Security Research

Defender-DeviceProcessEvents Event ID 9001000: Process activityORSecurity-Auditing Event ID 4688: A new process has been created.ORSysmon Event ID 1: Process creation

26 rules

Kusto Query Language

Suspicious parentprocess relationship - Office child processes. (source)

Exchange Worker Process Making Remote Call (source)

Microsoft Security Community

Java Executing cmd to run Powershell (source)

Show 23 more (26 total)

Doppelpaymer Stop Services (source)

Detect Suspicious Commands Initiated by Webserver Processes (source)

Office Apps Launching Wscipt (source)

Qakbot Discovery Activies (source)

Execution of software vulnerable to webp buffer overflow of CVE-2023-4863 (source)

Ingress Tool Transfer - Certutil (source)

Qakbot Campaign Self Deletion (source)

Clearing of forensic evidence from event logs using wevtutil (source)

Trusted Developer Utilities Proxy Execution (source)

Disable or Modify Windows Defender (source)

Disabling Security Services via Registry (source)

Stopping multiple processes using taskkill (source)

Dev-0228 File Path Hashes November 2021 (source)

Microsoft Security Research

DopplePaymer Procdump (source)

LSASS Credential Dumping with Procdump (source)

LaZagne Credential Theft (source)

Probable AdFind Recon Tool Usage (source)

Oracle suspicious command execution (source)

Bitsadmin Activity (source)

Detecting UAC bypass - elevated COM interface (source)

Detecting UAC bypass - modify Windows Store settings (source)

Detecting UAC bypass - ChangePK and SLUI registry tampering (source)

Shadow Copy Deletions (source)

Defender-DeviceProcessEvents Event ID 9001000: Process activityANDSecurity-Auditing Event ID 4688: A new process has been created.ANDSysmon Event ID 1: Process creation

14 rules

Normalized Process Events

Security-Auditing Event ID 4688: A new process has been created.OREvent ID 4689: A process has exited.ORSysmon Event ID 1: Process creationOREvent ID 5: Process terminated

7 rules

Kusto Query Language

SUNBURST suspicious SolarWinds child processes (Normalized Process Events) (source)

Yuval Naor

Base64 encoded Windows process command-lines (Normalized Process Events) (source)

Yuval Naor

Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events) (source)

Yuval Naor

Show 4 more (7 total)

Potential re-named sdelete usage (ASIM Version) (source)

Microsoft Security Research

Malware in the recycle bin (Normalized Process Events) (source)

Yuval Naor

Probable AdFind Recon Tool Usage (Normalized Process Events) (source)

Yuval Naor

Sdelete deployed via GPO and run recursively (ASIM Version) (source)

Microsoft Security Research

Defender-DeviceProcessEvents Event ID 9001000: Process activity→Security-Auditing Event ID 4688: A new process has been created.→Sysmon Event ID 1: Process creation

7 rules

Kusto Query Language

Dev-0228 File Path Hashes November 2021 (source)

Microsoft Security Research

Potential Build Process Compromise - MDE (source)

Match Legitimate Name or Location - 2 (source)

Show 4 more (7 total)

Regsvr32 Rundll32 with Anomalous Parent Process (source)

DopplePaymer Procdump (source)

LSASS Credential Dumping with Procdump (source)

LaZagne Credential Theft (source)

(Security-Auditing Event ID 4688: A new process has been created.ANDSysmon Event ID 11: FileCreate)OR(Event ID 1: Process creationANDEvent ID 11: FileCreate)

7 rules

Splunk

Windows Office Product Dropped Cab or Inf File (source)

Michael Haag, Splunk

Detect Outlook exe writing a zip file (source)

Bhavin Patel, Splunk

Windows Office Product Dropped Uncommon File (source)

Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github

Show 4 more (7 total)

Windows Phishing Outlook Drop Dll In FORM Dir (source)

Teoderick Contreras, Splunk

Spoolsv Writing a DLL (source)

Mauricio Velazco, Michael Haag, Splunk

Suspicious WAV file in Appdata Folder (source)

Teoderick Contreras, Splunk

Suspicious Image Creation In Appdata Folder (source)

Teoderick Contreras, Splunk

Normalized Process Events

Security-Auditing Event ID 4688: A new process has been created.ANDEvent ID 4689: A process has exited.ANDSysmon Event ID 1: Process creationANDEvent ID 5: Process terminated

3 rules

Kusto Query Language

SUNBURST suspicious SolarWinds child processes (Normalized Process Events) (source)

Yuval Naor

Base64 encoded Windows process command-lines (Normalized Process Events) (source)

Yuval Naor

New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version) (source)

Microsoft Security Community

Asim Version

Security-Auditing Event ID 4688: A new process has been created.→Event ID 4689: A process has exited.→Sysmon Event ID 1: Process creation→Event ID 5: Process terminated

3 rules

Kusto Query Language

Dev-0228 File Path Hashes November 2021 (ASIM Version) (source)

Microsoft Security Research

Potential re-named sdelete usage (ASIM Version) (source)

Microsoft Security Research

Sdelete deployed via GPO and run recursively (ASIM Version) (source)

Microsoft Security Research

Security-Auditing Event ID 4663: An attempt was made to access an object.OREvent ID 4688: A new process has been created.

2 rules

Kusto Query Language

Identify SysAid Server web shell creation (source)

Microsoft Security Research

Potential Build Process Compromise (source)

Microsoft Security Research

Privilege Escalation: Bypass User Account Control

Security-Auditing Event ID 4657: A registry value was modified.→Event ID 4688: A new process has been created.

1 rule

Kusto Query Language

Potential Fodhelper UAC Bypass (source)

Defense Evasion: Impair Defenses

Security-Auditing Event ID 4670: Permissions on an object were changed.OREvent ID 4688: A new process has been created.

1 rule

Kusto Query Language

Security Service Registry ACL Modification (source)

Microsoft Security Research

Lateral Movement: Exploitation of Remote Services

Security-Auditing Event ID 4624: An account was successfully logged on.OREvent ID 4688: A new process has been created.ORSysmon Event ID 1: Process creationOREvent ID 19: WmiEventOREvent ID 20: WmiEventOREvent ID 21: WmiEvent

1 rule

Kusto Query Language

Gain Code Execution on ADFS Server via Remote WMI Execution (source)

Microsoft Security Research

Lateral Movement: Exploitation of Remote Services

Security-Auditing Event ID 4624: An account was successfully logged on.→Event ID 4688: A new process has been created.→Event ID 4697: A service was installed in the system.→Event ID 4698: A scheduled task was created.→Event ID 4699: A scheduled task was deleted.→Event ID 4700: A scheduled task was enabled.→Event ID 4701: A scheduled task was disabled.→Event ID 4702: A scheduled task was updated.→Event ID 5145: A network share object was checked to see whether client can be granted desired access.

1 rule

Kusto Query Language

Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task (source)

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

Chromium Browser Headless Execution To Mockbin Like Site source high: Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).
NtdllPipe Like Activity Execution source high: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe
Potentially Suspicious Child Process Of ClickOnce Application source medium: Detects potentially suspicious child processes of a ClickOnce deployment application

Show 17 more (55 total)

Potential Discovery Activity Via Dnscmd.EXE source medium: Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.
Uncommon FileSystem Load Attempt By Format.com source high: Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.
Potentially Suspicious GoogleUpdate Child Process source high: Detects potentially suspicious child processes of "GoogleUpdate.exe"
Arbitrary Binary Execution Using GUP Utility source medium: Detects execution of the Notepad++ updater (gup) to launch other commands or executables
HackTool - LaZagne Execution source medium: Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged multiple times by threat actors in order to dump credentials.
HackTool - Wmiexec Default Powershell Command source high: Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script
ImagingDevices Unusual Parent/Child Processes source high: Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity
Suspicious Execution of InstallUtil Without Log source medium: Uses the .NET InstallUtil.exe application in order to execute image without log
Suspicious Shells Spawn by Java Utility Keytool source high: Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)
Suspicious Processes Spawned by Java.EXE source high: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)
Shell Process Spawned by Java.EXE source medium: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)
Potentially Suspicious Execution Of PDQDeployRunner source medium: Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines
Suspicious Obfuscated PowerShell Code source high: Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines
Email Exifiltration Via Powershell source high: Detects email exfiltration via powershell cmdlets
Potential Suspicious Windows Feature Enabled - ProcCreation source medium: Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
Suspicious PowerShell Invocations - Specific - ProcessCreation source medium: Detects suspicious PowerShell invocation command parameters
Suspicious PowerShell Mailbox Export to Share source critical: Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Elastic # view in reference

Potential LSASS Clone Creation via PssCaptureSnapShot source high: Identifies the creation of an LSASS process clone via PssCaptureSnapShot where the parent process is the initial LSASS process instance. This may indicate an attempt to evade detection and dump LSASS memory for credential access.

Kusto Query Language # view in reference

SUNBURST suspicious SolarWinds child processes source medium: Identifies suspicious child processes of SolarWinds.Orion.Core.BusinessLayer.dll that may be evidence of the SUNBURST backdoor References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f
Unusual identity creation using exchange powershell source high: ' The query below identifies creation of unusual identity by the Europium actor to mimic Microsoft Exchange Health Manager Service account using Exchange PowerShell commands Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/'
Identify Mango Sandstorm powershell commands source high: 'The query below identifies powershell commands used by the threat actor Mango Sandstorm. Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/'

Show 16 more (19 total)

Midnight Blizzard - suspicious rundll32.exe execution of vbscript source medium: 'This query idenifies when rundll32.exe executes a specific set of inline VBScript commands References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/'
Midnight Blizzard - Script payload stored in Registry source medium: 'This query identifies when a process execution command-line indicates that a registry value is written to allow for later execution a malicious script References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/'
Silk Typhoon New UM Service Child Process source medium: 'This query looks for new processes being spawned by the Exchange UM service where that process has not previously been observed before. Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
Powershell Empire Cmdlets Executed in Command Line source medium: 'This query identifies use of PowerShell Empire's cmdlets within the command line data of the PowerShell process, indicating potential use of the post-exploitation tool.'
DEV-0270 New User Creation source high: 'The following query tries to detect creation of a new user using a known DEV-0270 username/password schema'
Dev-0270 Malicious Powershell usage source high: 'DEV-0270 heavily uses powershell to achieve their objective at various stages of their attack. To locate powershell related activity tied to the actor, Microsoft Sentinel customers can run the following query.'
Dev-0270 Registry IOC - September 2022 source high: 'The query below identifies modification of registry by Dev-0270 actor to disable security feature as well as to add ransom notes'
Dev-0270 WMIC Discovery source high: 'The query below identifies dllhost.exe using WMIC to discover additional hosts and associated domains in the environment.'
Windows Binaries Executed from Non-Default Directory source medium: 'The query detects Windows binaries, that can be executed from a non-default directory (e.g. C:\Windows\, C:\Windows\System32 etc.). Ref: https://lolbas-project.github.io/'
Caramel Tsunami Actor IOC - July 2021 source high: 'Identifies a match across IOC's related to an actor tracked by Microsoft as Caramel Tsunami'
Chia_Crypto_Mining IOC - June 2021 source low: 'Identifies a match across IOC's related to Chia cryptocurrency farming/plotting activity'
NRT Base64 Encoded Windows Process Command-lines source medium: 'This detection identifies instances of a base64 encoded PE file header seen in the process command line parameter.'
NRT Process executed from binary hidden in Base64 encoded file source medium: 'Encoding malicious software is a technique used to obfuscate files from detection. The first CommandLine component is looking for Python decoding base64. The second CommandLine component is looking for Bash/sh command line base64 decoding. The third one is looking for Ruby decoding base64.'
New EXE deployed via Default Domain or Default Domain Controller Policies source high: 'This detection highlights executables deployed to hosts via either the Default Domain or Default Domain Controller Policies. These policies apply to all hosts or Domain Controllers and best practice is that these policies should not be used for deployment of files. A threat actor may use these policies to deploy files or scripts to all hosts in a domain.'
Potential re-named sdelete usage source low: 'This detection looks for command line parameters associated with the use of Sysinternals sdelete (https://docs.microsoft.com/sysinternals/downloads/sdelete) to delete multiple files on a host's C drive. A threat actor may re-name the tool to avoid detection and then use it for destructive attacks on a host.'
Sdelete deployed via GPO and run recursively source medium: 'This query looks for the Sdelete process being run recursively after being deployed to a host via GPO. Attackers could use this technique to deploy Sdelete to multiple host and delete data on them.'

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
Microsoft Learn Audit Policy https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-process-creation
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4688
Example event sourced from https://github.com/NextronSystems/evtx-baseline
Windows Forensic Artifacts https://github.com/Psmths/windows-forensic-artifacts/blob/main/execution/evtx-4688-process-created.md

Event ID 4688 — A new process has been created.

Description

Message #

Fields #

Example Event #

Detection Patterns #

Sigma

Splunk

Kusto Query Language

Kusto Query Language

Kusto Query Language

Normalized Process Events

Kusto Query Language

Kusto Query Language

Splunk

Normalized Process Events

Kusto Query Language

Asim Version

Kusto Query Language

Kusto Query Language

Privilege Escalation: Bypass User Account Control

Kusto Query Language

Defense Evasion: Impair Defenses

Kusto Query Language

Lateral Movement: Exploitation of Remote Services

Kusto Query Language

Lateral Movement: Exploitation of Remote Services

Kusto Query Language

Detection Rules #

Sigma # view in reference

Elastic # view in reference

Kusto Query Language # view in reference

Related Events #

References #