SentinelOne
Telemetry Evidence
These values show how indexed rules identify SentinelOne telemetry.Elastic
logs-sentinel_one.alert-* logs-sentinel_one.threat-* logs-sentinel_one_cloud_funnel.* sentinel_one sentinel_one_cloud_funnel Kusto
SentinelOne Panther
SentinelOne.Activity sentinelone YARA-L
crowdstrike, sentinelone, microsoft sysmon, microsoft defender atp sentinelone
Detection Rules
Elastic #
- Access Control List Modification via setfacl source low: This rule detects Linux Access Control List (ACL) modification via the setfacl command. Attackers may use the setfacl utility to modify file and directory permissions in order to evade detection and maintain persistence on a compromised system.
T1222,T1222.002 - Active Directory Discovery using AdExplorer source low: This rule detects the use of ADExplorer utility. Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. AD Explorer also includes the ability to save snapshots of an AD database for off-line viewing and comparisons. Adversaries may abuse this utility to perform domain reconnaissance.
T1016,T1018,T1069,T1069.002,T1087,T1087.002 - Adding Hidden File Attribute via Attrib source low: Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection.
T1222,T1222.001,T1564,T1564.001 - AdFind Command Activity source low: This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon.
T1016,T1018,T1069,T1069.002,T1087,T1087.002 - Alternate Data Stream Creation/Execution at Volume Root Directory source medium: Identifies the creation of an Alternate Data Stream (ADS) at a volume root directory, which can indicate the attempt to hide tools and malware, as ADSs created in this directory are not displayed by system utilities.
T1564,T1564.004 - AppArmor Profile Compilation via apparmor_parser source low: Detects the execution of "apparmor_parser" using the "-o" option to write a compiled AppArmor profile to an output file. This functionality is normally used by system administration tools or package installation scripts when building or loading AppArmor policies. In adversarial scenarios, attackers may use "apparmor_parser" to compile custom AppArmor profiles that can later be loaded into the kernel through AppArmor policy management interfaces. Malicious profiles may weaken security controls, alter the behavior of privileged programs, or assist in exploitation chains involving AppArmor policy manipulation.
T1685 - Attempt to Clear Kernel Ring Buffer source high: Monitors for the deletion of the kernel ring buffer events through dmesg. Attackers may clear kernel ring buffer events to evade detection after installing a Linux kernel module (LKM). This activity is commonly observed by intrusions that leverage kernel-level rootkits to maintain persistence on a compromised host.
T1070,T1685,T1685.006 - Attempt to Clear Logs via Journalctl source medium: This rule monitors for attempts to clear logs using the "journalctl" command on Linux systems. Adversaries may use this technique to cover their tracks by deleting or truncating log files, making it harder for defenders to investigate their activities. The rule looks for the execution of "journalctl" with arguments that indicate log clearing actions, such as "--vacuum-time", "--vacuum-size", or "--vacuum-files".
T1070,T1685,T1685.006 - Attempt to Disable Auditd Service source medium: Adversaries may attempt to disable the Auditd service to evade detection. Auditd is a Linux service that provides system auditing and logging. Disabling the Auditd service can prevent the system from logging important security events, which can be used to detect malicious activity.
T1489,T1685 - Attempt to Disable IPTables or Firewall source medium: Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to receive or send network traffic.
T1489,T1685,T1686
Show 424 more
- Attempt to Disable Syslog Service source medium: Syslog is a critical component in Linux environments, responsible for logging system events and activities. Adversaries may attempt to disable the syslog service to disrupt event logging and evade detection by security controls.
T1489,T1685 - Attempt to Establish VScode Remote Tunnel source medium: Detects the execution of the VScode portable binary with the tunnel command line option indicating an attempt to establish a remote tunnel session to Github or a remote VScode instance.
T1219 - Attempt to Install or Run Kali Linux via WSL source high: Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.
T1059,T1059.004,T1202 - AWS CLI Command with Custom Endpoint URL source medium: Detects the use of the AWS CLI with the "--endpoint-url" argument, which allows users to specify a custom endpoint URL for AWS services. This can be leveraged by adversaries to redirect API requests to non-standard or malicious endpoints, potentially bypassing typical security controls and logging mechanisms. This behavior may indicate an attempt to interact with unauthorized or compromised infrastructure, exfiltrate data, or perform other malicious activities under the guise of legitimate AWS operations.
T1102,T1102.002 - AWS SSM Session Manager Child Process Execution source medium: Identifies process start events where the parent process is the AWS Systems Manager (SSM) Session Manager worker. Session Manager provides interactive shell access to EC2 instances and hybrid nodes without bastion hosts or open inbound ports. Adversaries abuse it for remote execution and lateral movement using legitimate AWS credentials and IAM permissions. This rule surfaces endpoint execution occurring under that worker for visibility and hunting. Expect noise from authorized administrative sessions.
T1059,T1059.001,T1059.004,T1651 - Backup Deletion with Wbadmin source low: Detects use of wbadmin.exe to delete backup catalogs, system state backups, or other backup data. Ransomware and other malware may do this to prevent system recovery.
T1485,T1490 - Base16 or Base32 Encoding/Decoding Activity source medium: Base16 and Base32 are encoding schemes that convert binary data into text, making it easier to transmit and store. This rule monitors for Base16 or Base32 encoding and decoding activity on Linux systems. Attackers may use these encoding schemes to obfuscate malicious payloads, evade detection, and facilitate data exfiltration.
T1027,T1132,T1132.001,T1140 - Boot File Copy source low: This rule detects the process of copying or moving files from or to the "/boot" directory on Linux systems. The "/boot" directory contains files that are essential for the system to boot, such as the kernel and initramfs images. Attackers may copy or move files to the "/boot" directory to modify the boot process, which can be leveraged to maintain access to the system.
T1059,T1059.004,T1542,T1543,T1574 - BPF filter applied using TC source high: Detects when the tc (transmission control) binary is utilized to set a BPF (Berkeley Packet Filter) on a network interface. Tc is used to configure Traffic Control in the Linux kernel. It can shape, schedule, police and drop traffic. A threat actor can utilize tc to set a bpf filter on an interface for the purpose of manipulating the incoming traffic. This technique is not at all common and should indicate abnormal, suspicious or malicious activity.
T1059,T1059.004,T1685 - BPF Program or Map Load via bpftool source medium: Detects execution of bpftool commands used to load, attach, run, or pin eBPF programs, as well as create or update eBPF maps and links. These operations interact directly with the Linux eBPF subsystem and can modify kernel-level behavior. While commonly used by legitimate networking or observability tooling, unexpected or interactive usage may indicate eBPF-based rootkit activity, policy tampering, or unauthorized kernel instrumentation.
T1014,T1547,T1547.006 - BPF Program Tampering via bpftool source medium: Detects execution of bpftool commands used to detach eBPF programs or links, or to delete or modify eBPF maps. These actions can disable, alter, or interfere with kernel-level instrumentation and enforcement mechanisms implemented through eBPF. In environments relying on eBPF-based networking, observability, or security controls, unexpected use of these operations may indicate defense evasion or runtime tampering.
T1014,T1685 - Browser Extension Install source low: Identifies the install of browser extensions. Malicious browser extensions can be installed via app store downloads masquerading as legitimate extensions, social engineering, or by an adversary that has already compromised a system.
T1176,T1176.001 - Browser Process Spawned from an Unusual Parent source high: Identifies instances where a browser is launched with remote debugging, headless automation, or minimal arguments from an unusual parent process. This may indicate an attempt to broker or tamper with a browser session for credential theft.
T1185,T1539,T1555,T1555.003 - Bypass UAC via Event Viewer source high: Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.
T1548,T1548.002 - Chkconfig Service Add source medium: Detects the use of the chkconfig binary to manually add a service for management by chkconfig. Threat actors may utilize this technique to maintain persistence on a system. When a new service is added, chkconfig ensures that the service has either a start or a kill entry in every runlevel and when the system is rebooted the service file added will run providing long-term persistence.
T1037,T1543 - Clearing Windows Console History source medium: Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
T1059,T1059.001,T1070,T1070.003 - Clearing Windows Event Logs source low: Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.
T1070,T1685,T1685.001,T1685.005 - Code Signing Policy Modification Through Built-in tools source medium: Identifies attempts to disable/modify the code signing policy through system native utilities. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code.
T1553,T1553.006 - Code Signing Policy Modification Through Registry source medium: Identifies attempts to disable the code signing policy through the registry. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code.
T1112,T1553,T1553.006 - Command and Scripting Interpreter via Windows Scripts source high: Identifies PowerShell, PowerShell ISE, or Cmd execution spawned from Windows Script Host or MSHTA.
T1059,T1059.001,T1059.003,T1059.005,T1059.007,T1218 - Command Execution via ForFiles source medium: Detects attempts to execute a command via the forfiles Windows utility. Adversaries may use this utility to proxy execution via a trusted parent process.
T1202 - Command Execution via SolarWinds Process source medium: A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected.
T1059,T1059.001,T1059.003,T1195,T1195.002 - Command Line Obfuscation via Whitespace Padding source medium: Identifies process execution events where the command line value contains a long sequence of whitespace characters or multiple occurrences of contiguous whitespace. Attackers may attempt to evade signature-based detections by padding their malicious command with unnecessary whitespace characters. These observations should be investigated for malicious behavior.
T1027,T1027.010,T1059,T1059.001,T1140 - Command Obfuscation via Unicode Modifier Letters source high: Identifies the presence of Unicode modifier letters in the process command_line. Adversaries sometimes replace ASCII characters with visually similar Unicode modifier letters to evade simple string-based detections.
T1027,T1027.010 - Command Shell Activity Started via RunDLL32 source low: Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code.
T1059,T1059.001,T1059.003,T1218,T1218.011,T1552 - Conhost Spawned By Suspicious Parent Process source high: Detects when the Console Window Host (conhost.exe) process is spawned by a suspicious parent process, which could be indicative of code injection.
T1036,T1055,T1059 - Connection to Common Large Language Model Endpoints source medium: Identifies DNS queries to known Large Language Model domains by unsigned binaries or common Windows scripting utilities. Malwares may leverage the capabilities of LLM to perform actions in the affected system in a dynamic way.
T1102,T1102.002 - Connection to Commonly Abused Web Services source low: Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in.
T1071,T1071.001,T1090,T1090.002,T1102,T1102.001 - Connection to External Network via Telnet source medium: Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to publicly routable IP addresses.
T1021,T1071 - Connection to Internal Network via Telnet source medium: Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to non-publicly routable IP addresses.
T1021 - Control Panel Process with Unusual Arguments source high: Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code.
T1218,T1218.002 - Creation of a Hidden Local User Account source high: Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command.
T1136,T1136.001,T1564,T1564.002 - Creation of Hidden Shared Object File source medium: Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion.
T1564,T1564.001 - Creation or Modification of a new GPO Scheduled Task or Service source low: Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a malicious payload remotely on all or a subset of the domain joined machines.
T1053,T1053.005,T1484,T1484.001,T1543,T1543.003 - Creation or Modification of Domain Backup DPAPI private key source high: Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file.
T1003,T1003.003,T1552,T1552.004,T1555 - Creation or Modification of Root Certificate source low: Identifies the creation or modification of a local trusted root certificate in Windows. The install of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic.
T1553,T1553.004,T1557 - Credential Access via TruffleHog Execution source medium: This rule detects the execution of TruffleHog, a tool used to search for high-entropy strings and secrets in code repositories, which may indicate an attempt to access credentials. This tool was abused by the Shai-Hulud worm to search for credentials in code repositories.
T1003,T1005,T1552,T1552.001,T1555 - Credential Acquisition via Registry Hive Dumping source high: Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool.
T1003,T1003.002,T1003.004 - Cupsd or Foomatic-rip Shell Execution source high: This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the foomatic-rip parent process. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
T1059,T1059.004,T1203 - Curl or Wget Spawned via Node.js source medium: This rule detects when Node.js, directly or via a shell, spawns the curl or wget command. This may indicate command and control behavior. Adversaries may use Node.js to download additional tools or payloads onto the system.
T1071,T1071.001,T1105 - D-Bus Service Created source low: This rule detects the creation of D-Bus service files on Linux systems. D-Bus is a message bus system that provides a way for applications to talk to one another. D-Bus services are defined in service files that are typically located in default directories. The rule looks for the creation of service files that are not associated with known package managers or system services. Attackers may create malicious D-Bus services to establish persistence or escalate privileges on a system.
T1543,T1546 - Data Encrypted via OpenSSL Utility source low: Identifies the execution of the OpenSSL utility to encrypt data. Adversaries may use OpenSSL to encrypt data to disrupt the availability of their target's data and may attempt to hold the organization's data to ransom for the purposes of extortion.
T1027,T1027.013,T1074,T1074.001 - Delete Volume USN Journal with Fsutil source low: Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.
T1070,T1070.004 - Direct Process Execution via Background Utility source low: This is a New Terms rule that identifies the first occurrence of setsid or nohup being used to directly execute a process on a host. Attackers may leverage these tools to execute commands in a new session and/or to ignore signals.
T1036,T1036.009,T1059,T1059.004,T1564 - Directory Creation in /bin directory source low: This rule identifies the creation of directories in the /bin directory. The /bin directory contains essential binary files that are required for the system to function properly. The creation of directories in this location could be an attempt to hide malicious files or executables, as these /bin directories usually just contain binaries.
T1036,T1036.005,T1564,T1564.001 - Disable Windows Event and Security Logs Using Built-in Tools source low: Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system.
T1070,T1685,T1685.001,T1685.005 - Disable Windows Firewall Rules via Netsh source medium: Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility.
T1685,T1686 - Disabling Lsa Protection via Registry Modification source high: LSA protecton is provided to prevent nonprotected processes from reading memory and injecting code. This feature provides added security for the credentials that LSA stores and manages. Adversaries may modify the RunAsPPL registry and wait or initiate a system restart to enable Lsass credentials access.
T1003,T1003.001,T1112,T1685 - Disabling User Account Control via Registry Modification source medium: User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control (UAC) protection.
T1112,T1548,T1548.002,T1685 - Disabling Windows Defender Security Settings via PowerShell source medium: Identifies use of the Set-MpPreference or Add-MpPreference PowerShell commands to disable or weaken certain Windows Defender settings, including detection of base64-encoded variants used to bypass command-line inspection.
T1059,T1059.001,T1685 - DNF Package Manager Plugin File Creation source low: Detects file creation events in the plugin directories for the Yum package manager. In Linux, DNF (Dandified YUM) is a command-line utility used for handling packages on Fedora-based systems, providing functions for installing, updating, upgrading, and removing software along with managing package repositories. Attackers can backdoor DNF to gain persistence by injecting malicious code into plugins that DNF runs, thereby ensuring continued unauthorized access or control each time DNF is used for package management.
T1543,T1546,T1546.016,T1574 - DNS Global Query Block List Modified or Disabled source medium: Identifies changes to the DNS Global Query Block List (GQBL), a security feature that prevents the resolution of certain DNS names often exploited in attacks like WPAD spoofing. Attackers with certain privileges, such as DNSAdmins, can modify or disable the GQBL, allowing exploitation of hosts running WPAD with default settings for privilege escalation and lateral movement.
T1112,T1557,T1685 - DNS-over-HTTPS Enabled via Registry source low: Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet activity or the process of exfiltrating data. With this enabled, an organization will lose visibility into data such as query type, response, and originating IP, which are used to determine bad actors.
T1112,T1685 - Docker Socket Enumeration source medium: This rule detects potential Docker socket enumeration activity by monitoring processes that attempt to interact with the Docker socket file (/var/run/docker.sock). Docker socket enumeration is a common technique used by attackers to interact with the Docker daemon and perform various operations, such as creating, starting, stopping, and removing containers. Attackers may abuse Docker socket enumeration to gain unauthorized access to the host system, escalate privileges, or move laterally within the environment.
T1609,T1613 - Dracut Module Creation source low: This rule detects the creation of Dracut module files on Linux systems. Dracut is a tool used to generate an initramfs image that is used to boot the system. Dracut modules are scripts that are executed during the initramfs image generation process. Attackers may create malicious Dracut modules to execute arbitrary code at boot time, which can be leveraged to maintain persistence on a Linux system.
T1059,T1059.004,T1542,T1543,T1574 - Dynamic Linker (ld.so) Creation source medium: This rule detects the creation of the dynamic linker (ld.so). The dynamic linker is used to load shared libraries needed by an executable. Attackers may attempt to replace the dynamic linker with a malicious version to execute arbitrary code.
T1059,T1059.004,T1218,T1574,T1574.006 - Dynamic Linker Copy source high: Detects the copying of the Linux dynamic loader binary and subsequent file creation for the purpose of creating a backup copy. This technique was seen recently being utilized by Linux malware prior to patching the dynamic loader in order to inject and preload a malicious shared object file. This activity should never occur and if it does then it should be considered highly suspicious or malicious.
T1574,T1574.006 - Enable Host Network Discovery via Netsh source medium: Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings.
T1685,T1686 - Encrypting Files with WinRar or 7z source medium: Identifies the use of WinRAR or 7-Zip to create encrypted archives. Adversaries often compress and encrypt data in preparation for exfiltration.
T1005,T1560,T1560.001 - Enumerating Domain Trusts via DSQUERY.EXE source low: Identifies the use of dsquery.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate trust relationships that may be used for Lateral Movement opportunities in Windows multi-domain forest environments.
T1018,T1482 - Enumeration Command Spawned via WMIPrvSE source low: Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE).
T1007,T1012,T1016,T1016.001,T1018,T1033 - ESXI Discovery via Find source medium: Identifies instances where the 'find' command is started on a Linux system with arguments targeting specific VM-related paths, such as "/etc/vmware/", "/usr/lib/vmware/", or "/vmfs/*". These paths are associated with VMware virtualization software, and their presence in the find command arguments may indicate that a threat actor is attempting to search for, analyze, or manipulate VM-related files and configurations on the system.
T1083,T1518 - ESXI Discovery via Grep source medium: Identifies instances where a process named 'grep', 'egrep', or 'pgrep' is started on a Linux system with arguments related to virtual machine (VM) files, such as "vmdk", "vmx", "vmxf", "vmsd", "vmsn", "vswp", "vmss", "nvram", or "vmem". These file extensions are associated with VM-related file formats, and their presence in grep command arguments may indicate that a threat actor is attempting to search for, analyze, or manipulate VM files on the system.
T1083,T1518 - ESXI Timestomping using Touch Command source medium: Identifies instances where the 'touch' command is executed on a Linux system with the "-r" flag, which is used to modify the timestamp of a file based on another file's timestamp. The rule targets specific VM-related paths, such as "/etc/vmware/", "/usr/lib/vmware/", or "/vmfs/*". These paths are associated with VMware virtualization software, and their presence in the touch command arguments may indicate that a threat actor is attempting to tamper with timestamps of VM-related files and configurations on the system.
T1070,T1070.006 - Executable Bit Set for Potential Persistence Script source medium: This rule monitors for the addition of an executable bit for scripts that are located in directories which are commonly abused for persistence. An alert of this rule is an indicator that a persistence mechanism is being set up within your environment. Adversaries may create these scripts to execute malicious code at start-up, or at a set interval to gain persistence onto the system.
T1037,T1037.004,T1053,T1053.003,T1222,T1222.002 - Executable File Creation with Multiple Extensions source medium: Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a benign file type but is actually executable code.
T1036,T1036.007,T1204,T1204.002 - Executable Masquerading as Kernel Process source high: Monitors for kernel processes with associated process executable fields that are not empty. Unix kernel processes such as kthreadd and kworker typically do not have process.executable fields associated to them. Attackers may attempt to hide their malicious programs by masquerading as legitimate kernel processes.
T1036,T1036.004,T1036.005,T1564 - Execution from Unusual Directory - Command Line source medium: Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths.
T1036,T1036.005,T1059,T1059.001,T1059.003,T1218 - Execution of COM object via Xwizard source medium: Windows Component Object Model (COM) is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects or executable code. Xwizard can be used to run a COM object created in registry to evade defensive counter measures.
T1218,T1559,T1559.001 - Execution via GitHub Actions Runner source medium: This rule detects potentially dangerous commands spawned by the GitHub Actions Runner.Worker process or by shell interpreters launched via a runner entrypoint script on self-hosted runner machines. Adversaries who gain the ability to modify or trigger workflows in a linked GitHub repository can execute arbitrary commands on the runner host. This behavior may indicate malicious or unexpected workflow activity, including code execution, reconnaissance, credential harvesting, or network exfiltration initiated through a compromised repository or unauthorized workflow.
T1059,T1059.001,T1059.002,T1059.003,T1059.004,T1059.006 - Execution via local SxS Shared Module source medium: Identifies the creation, change, or deletion of a DLL module within a Windows SxS local folder. Adversaries may abuse shared modules to execute malicious payloads by instructing the Windows module loader to load DLLs from arbitrary local paths.
T1129,T1574,T1574.001 - Execution via MSSQL xp_cmdshell Stored Procedure source medium: Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use.
T1059,T1059.003,T1505,T1505.001 - Execution via TSClient Mountpoint source high: Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint tsclient on the target host. This may indicate a lateral movement attempt.
T1021,T1021.001,T1570 - Execution via Windows Command Debugging Utility source medium: An adversary can use the Windows command line debugging utility cdb.exe to execute commands or shellcode. This rule looks for those instances and where the cdb.exe binary is outside of the normal WindowsKit installation paths.
T1036,T1036.005,T1218 - Execution via Windows Subsystem for Linux source medium: Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.
T1059,T1059.004,T1202 - Exporting Exchange Mailbox via PowerShell source medium: Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information.
T1005,T1059,T1059.001,T1114,T1114.001,T1114.002 - File Creation by Cups or Foomatic-rip Child source medium: This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects suspicious file creation events executed by child processes of foomatic-rip. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
T1059,T1059.004,T1203 - File Creation in /var/log via Suspicious Process source medium: This rule detects the creation of files in the /var/log/ directory via process executables located in world-writeable locations or via hidden processes. Attackers may attempt to hide their activities by creating files in the /var/log/ directory, which is commonly used for logging system events.
T1059,T1059.004,T1070,T1564,T1564.001,T1685.006 - File Creation in World-Writable Directory by Unusual Process source medium: This rule detects the creation of files in world-writable directories by an unusual process. Attackers may attempt to hide their activities by creating files in world-writable directories, which are commonly used for temporary file storage. This behavior is often associated with lateral movement and can be an indicator of an attacker attempting to move laterally within a network.
T1222,T1222.002 - File Deletion via Shred source medium: Malware or other files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.
T1070,T1070.004,T1485 - File made Immutable by Chattr source medium: Detects a file being made immutable using the chattr binary. Making a file immutable means it cannot be deleted or renamed, no link can be created to this file, most of the file's metadata can not be modified, and the file can not be opened in write mode. Threat actors will commonly utilize this to prevent tampering or modification of their malicious files or any system files they have modified for purposes of persistence (e.g .ssh, /etc/passwd, etc.).
T1222,T1222.002 - File Transfer or Listener Established via Netcat source medium: A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration.
T1048,T1048.003,T1059,T1059.004,T1095 - File with Right-to-Left Override Character (RTLO) Created/Executed source medium: Identifies the creation or execution of files or processes with names containing the Right-to-Left Override (RTLO) character, which can be used to disguise the file extension and trick users into executing malicious files.
T1036,T1036.002,T1204,T1204.002 - First Time Seen Removable Device source low: Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices.
T1052,T1052.001,T1091 - GenAI or MCP Server Child Process Execution source low: Detects child process execution from GenAI tools or MCP (Model Context Protocol) servers. Adversaries exploit AI agents to execute system commands, exfiltrate data, or establish persistence. MCP servers provide LLMs direct access to execute shell commands, read files, and interact with external services. This building block provides visibility into AI-initiated process execution for correlation with other suspicious activity.
T1059 - GenAI Process Compiling or Generating Executables source medium: Detects when GenAI tools spawn compilers or packaging tools to generate executables. Attackers leverage local LLMs to autonomously generate and compile malware, droppers, or implants. Python packaging tools (pyinstaller, nuitka, pyarmor) are particularly high-risk as they create standalone executables that can be deployed without dependencies. This rule focuses on compilation activity that produces output binaries, filtering out inspection-only operations.
T1027,T1027.004,T1587,T1587.001 - GenAI Process Performing Encoding/Chunking Prior to Network Activity source medium: Detects when GenAI processes perform encoding or chunking (base64, gzip, tar, zip) followed by outbound network activity. This sequence indicates data preparation for exfiltration. Attackers encode or compress sensitive data before transmission to obfuscate contents and evade detection. Legitimate GenAI workflows rarely encode data before network communications.
T1027,T1030,T1560,T1560.001,T1560.002 - Git Hook Child Process source low: This rule detects child processes spawned by Git hooks. Git hooks are scripts that Git executes before or after events such as commit, push, and receive. The rule identifies child processes spawned by Git hooks that are not typically spawned by the Git process itself. This behavior may indicate an attacker attempting to hide malicious activity by leveraging the legitimate Git process to execute unauthorized commands.
T1059,T1059.004,T1543,T1546,T1574 - Git Hook Command Execution source low: This rule detects the execution of a potentially malicious process from a Git hook. Git hooks are scripts that Git executes before or after events such as: commit, push, and receive. An attacker can abuse Git hooks to execute arbitrary commands on the system and establish persistence.
T1059,T1059.004,T1543,T1546,T1574 - Git Hook Created or Modified source low: This rule detects the creation or modification of a Git hook file on a Linux system. Git hooks are scripts that Git executes before or after events such as commit, push, and receive. They are used to automate tasks, enforce policies, and customize Git's behavior. Attackers can abuse Git hooks to maintain persistence on a system by executing malicious code whenever a specific Git event occurs.
T1059,T1059.004,T1543,T1546,T1574 - Group Policy Discovery via Microsoft GPResult Utility source low: Detects the usage of gpresult.exe to query group policy objects. Attackers may query group policy objects during the reconnaissance phase after compromising a system to gain a better understanding of the active directory environment and possible methods to escalate privileges or move laterally.
T1615 - GRUB Configuration File Creation source low: This rule detects the creation of GRUB configuration files on Linux systems. The GRUB configuration file is used to configure the boot loader, which is responsible for loading the operating system. Attackers may create malicious GRUB configuration files to execute arbitrary code or escalate privileges during the boot process, which can be leveraged to maintain persistence on the system.
T1542,T1543,T1574 - GRUB Configuration Generation through Built-in Utilities source low: This rule detects the generation of a new GRUB configuration file using built-in Linux commands. The GRUB configuration file is used to configure the GRUB bootloader, which is responsible for loading the Linux kernel and initramfs image during the boot process. Attackers may use these built-in utilities to generate a new GRUB configuration file that includes malicious kernel parameters or boot options, which can be leveraged to maintain persistence on the system.
T1542,T1543,T1574 - Hidden Directory Creation via Unusual Parent source low: This rule detects the creation of a hidden directory via an unusual parent executable. Hidden directories are directories that are not visible to the user by default. They are often used by attackers to hide malicious files or tools.
T1564,T1564.001 - Hidden Files and Directories via Hidden Flag source medium: Identify activity related where adversaries can add the 'hidden' flag to files to hide them from the user in an attempt to evade detection. This behavior is often observed in attempts to conceal malicious files or maintain persistence on a compromised system.
T1564,T1564.001 - Host File System Changes via Windows Subsystem for Linux source medium: Detects file creation and modification on the host system from the Windows Subsystem for Linux. Adversaries may enable and use WSL to avoid detection.
T1059,T1059.004,T1202 - Hping Process Activity source medium: Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing.
T1046,T1082 - IIS HTTP Logging Disabled source high: Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure.
T1685,T1685.001 - Image File Execution Options Injection source medium: The Debugger and SilentProcessExit registry keys can allow an adversary to intercept the execution of files, causing a different process to be executed. This functionality can be abused by an adversary to establish persistence.
T1112,T1546,T1546.012 - ImageLoad via Windows Update Auto Update Client source medium: Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.
T1129,T1218 - Incoming Execution via PowerShell Remoting source medium: Identifies remote execution via Windows PowerShell remoting. Windows PowerShell remoting allows a user to run any Windows PowerShell command on one or more remote computers. This could be an indication of lateral movement.
T1021,T1021.006,T1059,T1059.001 - Incoming Execution via WinRM Remote Shell source medium: Identifies remote execution via Windows Remote Management (WinRM) remote shell on a target host. This could be an indication of lateral movement.
T1021,T1021.006 - Initramfs Extraction via CPIO source low: This rule detects the extraction of an initramfs image using the "cpio" command on Linux systems. The "cpio" command is used to create or extract cpio archives. Attackers may extract the initramfs image to modify the contents or add malicious files, which can be leveraged to maintain persistence on the system.
T1542,T1543,T1574 - Initramfs Unpacking via unmkinitramfs source low: This rule detects the unpacking of an initramfs image using the "unmkinitramfs" command on Linux systems. The "unmkinitramfs" command is used to extract the contents of an initramfs image, which is used to boot the system. Attackers may use "unmkinitramfs" to unpack an initramfs image and modify its contents to include malicious code or backdoors, allowing them to maintain persistence on the system.
T1059,T1059.004,T1542,T1542.003,T1543,T1574 - Installation of Custom Shim Databases source medium: Identifies the installation of custom Application Compatibility Shim databases. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.
T1546,T1546.011 - Installation of Security Support Provider source medium: Identifies registry modifications related to the Windows Security Support Provider (SSP) configuration. Adversaries may abuse this to establish persistence in an environment.
T1112,T1547,T1547.005 - InstallUtil Process Making Network Connections source medium: Identifies InstallUtil.exe making outbound network connections. This may indicate adversarial activity as InstallUtil is often leveraged by adversaries to execute code and evade detection.
T1218,T1218.004 - Interactive Terminal Spawned via Perl source high: Identifies when a terminal (tty) is spawned via Perl. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host.
T1059,T1059.004 - Interactive Terminal Spawned via Python source high: Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host.
T1059,T1059.004,T1059.006 - IPv4/IPv6 Forwarding Activity source low: This rule monitors for the execution of commands that enable IPv4 and IPv6 forwarding on Linux systems. Enabling IP forwarding can be used to route network traffic between different network interfaces, potentially allowing attackers to pivot between networks, exfiltrate data, or establish command and control channels.
T1090,T1090.001,T1572 - KDE AutoStart Script or Desktop File Creation source medium: Identifies the creation or modification of a K Desktop Environment (KDE) AutoStart script or desktop file that will execute upon each user logon. Adversaries may abuse this method for persistence.
T1547,T1547.013 - Kerberos Traffic from Unusual Process source medium: Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only process that normally performs Kerberos traffic from a domain joined host is lsass.exe.
T1550,T1550.003,T1558,T1558.003 - Kernel Instrumentation Discovery via kprobes and tracefs source low: Detects common utilities accessing kprobes and tracing-related paths in debugfs/tracefs, which may indicate discovery of kernel instrumentation hooks. Adversaries can enumerate these locations to understand or prepare for eBPF, kprobe, or tracepoint-based activity. This behavior can also be benign during troubleshooting, performance analysis, or observability tooling validation.
T1014,T1082,T1083 - Kernel Load or Unload via Kexec Detected source medium: This detection rule identifies the usage of kexec, helping to uncover unauthorized kernel replacements and potential compromise of the system's integrity. Kexec is a Linux feature that enables the loading and execution of a different kernel without going through the typical boot process. Malicious actors can abuse kexec to bypass security measures, escalate privileges, establish persistence or hide their activities by loading a malicious kernel, enabling them to tamper with the system's trusted state, allowing e.g. a VM Escape.
T1014,T1547,T1547.006,T1601,T1601.001,T1611 - Kernel Module Removal source low: Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This rule identifies attempts to remove a kernel module.
T1547,T1547.006,T1685 - Kirbi File Creation source high: Identifies the creation of .kirbi files, a suspicious Kerberos ticket artifact often produced by ticket export or dumping tools such as Rubeus or Mimikatz. This can indicate preparation for Kerberos ticket theft or later abuse, including Pass-The-Ticket (PTT), and should be validated with writer process and follow-on activity.
T1003,T1558 - Kubectl Apply Pod from URL source low: This rule detects the execution of the "kubectl apply" command with a URL argument. This command is often used to apply configurations or deploy resources in a Kubernetes cluster. Attackers may use this command to deploy malicious pods or modify existing ones, potentially leading to unauthorized access or data exfiltration.
T1609,T1610 - Kubectl Network Configuration Modification source low: This rule detects potential kubectl network configuration modification activity by monitoring for process events where the kubectl command is executed with arguments that suggest an attempt to modify network configurations in Kubernetes. This could indicate an adversary trying to manipulate network settings for malicious purposes, such as establishing unauthorized access or exfiltrating data.
T1090,T1572 - Kubectl Permission Discovery source medium: This rule detects the use of the "kubectl auth --can-i" command, which is used to check permissions in Kubernetes clusters. Attackers may use this command to enumerate permissions and discover potential misconfigurations in the cluster, allowing them to gain unauthorized access or escalate privileges.
T1069,T1613 - Kubectl Secrets Enumeration Across All Namespaces source high: This rule detects the use of the "kubectl get secrets --all-namespaces" command, which enumerates secret resources across the entire Kubernetes cluster. Attackers may use this command to identify accessible secrets in multiple namespaces, aiding credential discovery, privilege escalation, or lateral movement.
T1552,T1613 - Kubernetes Direct API Request via Curl or Wget source medium: This rule monitors for the execution of curl or wget commands that directly access Kubernetes API endpoints, which may indicate an attempt to interact with Kubernetes resources in a potentially unauthorized manner. This technique is often used by adversaries to gather information about the Kubernetes environment, such as secrets, config maps, and other sensitive data, without using the official Kubernetes client tools such as "kubectl".
T1059,T1059.004,T1069,T1552,T1552.007,T1613 - Lateral Movement via Startup Folder source high: Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon.
T1021,T1021.001,T1021.002,T1547,T1547.001,T1570 - Linux Audio Recording Activity Detected source low: This rule monitors for the usage of the most common audio recording utilities on unix systems by an uncommon process parent. Adversaries may collect audio data from users or systems for a variety of reasons including espionage, credential theft, or reconnaissance.
T1123 - Linux Clipboard Activity Detected source low: This rule monitors for the usage of the most common clipboard utilities on unix systems by an uncommon process parent. Adversaries may collect data stored in the clipboard from users copying information within or between applications.
T1115 - Linux External IP Address Discovery via Curl source low: Detects applications making a curl request to a known public IP address lookup web service. Malware tends to perform this action to assess potential targets.
T1016 - Linux init (PID 1) Secret Dump via GDB source high: This rule monitors for the potential memory dump of the init process (PID 1) through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include "truffleproc" and "bash-memory-dump". This behavior should not happen by default, and should be investigated thoroughly.
T1003,T1003.007,T1005 - Linux Process Hooking via GDB source low: This rule monitors for potential memory dumping through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include "truffleproc" and "bash-memory-dump". This behavior should not happen by default, and should be investigated thoroughly.
T1003,T1003.007,T1055,T1055.008 - Linux SSH X11 Forwarding source low: This rule monitors for X11 forwarding via SSH. X11 forwarding is a feature that allows users to run graphical applications on a remote server and display the application's graphical user interface on their local machine. Attackers can abuse X11 forwarding for tunneling their GUI-based tools, pivot through compromised systems, and create covert communication channels, enabling lateral movement and facilitating remote control of systems within a network.
T1021,T1021.004,T1572 - Linux System Information Discovery source low: This rule identifies Linux system information discovery activity via built-in commands that read common system files. Adversaries may use these commands to gather information about the operating system, installed services, and hardware configuration to aid in further exploration and exploitation of the system.
T1082 - Linux Telegram API Request source medium: This rule detects when a process executes the curl or wget command with an argument that includes the api.telegram.org domain. This may indicate command and control behavior.
T1071,T1071.001,T1102,T1102.002 - Linux User Added to Privileged Group source low: Identifies attempts to add a user to a privileged group. Attackers may add users to a privileged group in order to establish persistence on a system.
T1098,T1098.007,T1136,T1136.001 - Linux Video Recording or Screenshot Activity Detected source low: This rule monitors for the usage of the most common video recording or screenshot utilities on unix systems by an uncommon process parent. Adversaries may collect video or screenshot data from users or systems for a variety of reasons including espionage, credential theft, or reconnaissance.
T1113,T1125 - Local Account TokenFilter Policy Disabled source medium: Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If this value exists (which doesn't by default) and is set to 1, then remote connections from all local members of Administrators are granted full high-integrity tokens during negotiation.
T1112,T1548,T1548.002,T1550,T1550.002,T1685 - LSASS Memory Dump Creation source high: Identifies creation of LSASS memory dump artifacts with filenames matching LSASS dumps or common dumping-tool outputs, including dumpert.dmp, Andrew.dmp, SQLDmpr*.mdmp, and Coredump.dmp. This can indicate credential access through trusted utilities such as Task Manager or SQLDumper, or known tooling such as Dumpert and AndrewSpecial.
T1003,T1003.001 - Manual Dracut Execution source low: This rule detects manual execution of the "dracut" command on Linux systems. Dracut is a tool used to generate an initramfs image that is used to boot the system. Attackers may use "dracut" to create a custom initramfs image that includes malicious code or backdoors, allowing them to maintain persistence on the system.
T1059,T1059.004,T1542 - Manual Memory Dumping via Proc Filesystem source high: This rule monitors for manual memory dumping via the proc filesystem. The proc filesystem in Linux provides a virtual filesystem that contains information about system processes and their memory mappings. Attackers may use this technique to dump the memory of a process, potentially extracting sensitive information such as credentials or encryption keys.
T1003,T1003.007,T1005,T1212 - Manual Mount Discovery via /etc/exports or /etc/fstab source medium: This rule detects manual mount discovery via the /etc/exports or /etc/fstab file on Linux systems. These files are used by NFS (Network File System) to define which directories are shared with remote hosts. Attackers may access this file to gather information about shared directories and potential targets for further exploitation.
T1082,T1135 - Memory Swap Modification source medium: This rule detects memory swap modification events on Linux systems. Memory swap modification can be used to manipulate the system's memory and potentially impact the system's performance. This behavior is commonly observed in malware that deploys miner software such as XMRig.
T1059,T1059.004,T1496,T1496.001 - Microsoft Build Engine Started by a System Process source medium: An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.
T1047,T1127,T1127.001 - Microsoft Build Engine Started by an Office Application source high: An instance of MSBuild, the Microsoft Build Engine, was started by an Office application. This is unusual behavior for the Build Engine and could have been caused by a malicious document executing a script payload.
T1127,T1127.001,T1204,T1204.002 - Microsoft Exchange Server UM Spawning Suspicious Processes source medium: Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857.
T1190,T1210 - Microsoft Exchange Server UM Writing Suspicious Files source medium: Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858.
T1190,T1210,T1505,T1505.003 - Microsoft Exchange Worker Spawning Suspicious Processes source high: Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor.
T1059,T1059.001,T1059.003,T1190,T1505,T1505.003 - Microsoft IIS Connection Strings Decryption source high: Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or similar access can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using the aspnet_regiis command.
T1003,T1552,T1552.001 - Microsoft IIS Service Account Password Dumped source low: Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to dump sensitive configuration data such as application pool credentials. An attacker with IIS web server access via a web shell can extract service account passwords by requesting full configuration output or targeting credential-related fields.
T1003,T1552,T1552.001 - Microsoft Management Console File from Unusual Path source medium: Identifies attempts to open a Microsoft Management Console File from untrusted paths. Adversaries may use MSC files for initial access and execution.
T1059,T1059.005,T1059.007,T1204,T1204.002,T1218 - Microsoft Windows Defender Tampering source medium: Identifies when one or more features on Microsoft Defender are disabled. Adversaries may disable or tamper with Microsoft Defender features to evade detection and conceal malicious behavior.
T1112,T1685 - Mimikatz Memssp Log File Detected source high: Identifies the default Mimikatz MemSSP credential log file, mimilsa.log. This file is created after the misc::memssp module injects a malicious Security Support Provider into LSASS and can contain credentials from subsequent logons to the host.
T1003,T1547,T1547.005,T1556 - Modification of AmsiEnable Registry Key source high: Identifies modifications of the AmsiEnable registry key to 0, which disables Windows Script AMSI scanning for the affected user. Adversaries can modify this key to bypass AMSI protections for Windows Script Host or JScript execution.
T1112,T1685 - Modification of Boot Configuration source low: Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.
T1490 - Mounting Hidden or WebDav Remote Shares source medium: Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or preparation for data exfiltration.
T1021,T1021.002,T1078,T1078.003,T1087,T1087.001 - MS Office Macro Security Registry Modifications source medium: Microsoft Office Products offer options for users and developers to control the security settings for running and using Macros. Adversaries may abuse these security settings to modify the default behavior of the Office Application to trust future macros and/or disable security warnings, which could increase their chances of establishing persistence.
T1112,T1204,T1204.002 - Mshta Making Network Connections source medium: Identifies Mshta.exe making outbound network connections. This may indicate adversarial activity, as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection.
T1218,T1218.005 - MsiExec Service Child Process With Network Connection source medium: Identifies the execution of an MsiExec service child process followed by network or dns lookup activity. Adversaries may abuse Windows Installers for initial access and delivery of malware.
T1218,T1218.007 - Multiple Remote Management Tool Vendors on Same Host source medium: Identifies a Windows host where two or more distinct remote monitoring and management (RMM) or remote-access tool vendors are observed starting processes within the same eight-minute window. Legitimate MSP environments may run multiple tools, but this pattern can also indicate compromise, shadow IT, or attacker staging of redundant access. Processes are mapped to a single vendor label so multiple binaries from the same vendor do not inflate the count.
T1219,T1219.002 - Namespace Manipulation Using Unshare source medium: Identifies suspicious usage of unshare to manipulate system namespaces. Unshare can be utilized to escalate privileges or escape container security boundaries. Threat actors have utilized this binary to allow themselves to escape to the host and access other resources or escalate privileges.
T1543,T1611 - Netcat Listener Established via rlwrap source medium: Monitors for the execution of a netcat listener via rlwrap. rlwrap is a 'readline wrapper', a small utility that uses the GNU Readline library to allow the editing of keyboard input for any command. This utility can be used in conjunction with netcat to gain a more stable reverse shell.
T1059,T1059.004,T1095 - Netsh Helper DLL source low: Identifies the addition of a Netsh Helper DLL, netsh.exe supports the addition of these DLLs to extend its functionality. Attackers may abuse this mechanism to execute malicious payloads every time the utility is executed, which can be done by administrators or a scheduled task.
T1112,T1546,T1546.007 - NetSupport Manager Execution from an Unusual Path source high: Identifies execution of the NetSupport remote access software from non-default paths. Adversaries may abuse NetSupport Manager to control a victim machine.
T1219 - Network Activity to a Suspicious Top Level Domain source high: Identifies DNS queries to commonly abused Top Level Domains by common LOLBINs or executables running from world writable directories or unsigned binaries. This behavior matches on common malware C2 abusing less formal domain names.
T1071,T1071.004,T1127,T1127.001,T1218 - Network Connection via Compiled HTML File source low: Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).
T1071,T1204,T1204.002,T1218,T1218.001 - Network Connection via MsXsl source low: Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection.
T1105,T1220 - Network Connection via Signed Binary source low: Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application allowlists and signature validation.
T1218 - Network-Level Authentication (NLA) Disabled source low: Identifies the attempt to disable Network-Level Authentication (NLA) via registry modification. Network Level Authentication (NLA) is a feature on Windows that provides an extra layer of security for Remote Desktop (RDP) connections, as it requires users to authenticate before allowing a full RDP session. Attackers can disable NLA to enable persistence methods that require access to the Windows sign-in screen without authenticating, such as Accessibility Features persistence methods, like Sticky Keys.
T1021,T1021.001,T1112,T1685,T1689 - NetworkManager Dispatcher Script Creation source low: This rule detects the creation of a NetworkManager dispatcher script on a Linux system. NetworkManager dispatcher scripts are shell scripts that NetworkManager executes when network interfaces change state. Attackers can abuse NetworkManager dispatcher scripts to maintain persistence on a system by executing malicious code whenever a network event occurs.
T1059,T1059.004,T1543,T1546,T1574 - New ActiveSyncAllowedDeviceID Added via PowerShell source medium: Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information.
T1059,T1059.001,T1098,T1098.002,T1114,T1114.002 - Node.js Pre or Post-Install Script Execution source medium: This rule detects the execution of Node.js pre or post-install scripts. These scripts are executed by the Node.js package manager (npm) during the installation of packages. Adversaries may abuse this technique to execute arbitrary commands on the system and establish persistence. This activity was observed in the wild as part of the Shai-Hulud worm.
T1059,T1059.004,T1059.007,T1195,T1195.001,T1204 - Nping Process Activity source medium: Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the ability to construct raw packets for a wide variety of security testing applications, including denial of service testing.
T1046,T1498 - NTDS Dump via Wbadmin source medium: Identifies the execution of wbadmin to access the NTDS.dit file in a domain controller. Attackers with privileges from groups like Backup Operators can abuse the utility to perform credential access and compromise the domain.
T1003,T1003.002,T1003.003,T1006 - NTDS or SAM Database File Copied source high: Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials.
T1003,T1003.002,T1003.003 - NullSessionPipe Registry Modification source medium: Identifies NullSessionPipe registry modifications that specify which pipes can be accessed anonymously. This could be indicative of adversary lateral movement preparation by making the added pipe available to everyone.
T1021,T1021.002,T1112 - Office Test Registry Persistence source low: Identifies the modification of the Microsoft Office "Office Test" Registry key, a registry location that can be used to specify a DLL which will be executed every time an MS Office application is started. Attackers can abuse this to gain persistence on a compromised host.
T1112,T1137,T1137.002 - Openssl Client or Server Activity source medium: This rule identifies when the openssl client or server is used to establish a connection. Attackers may use openssl to establish a secure connection to a remote server or to create a secure server to receive connections. This activity may be used to exfiltrate data or establish a command and control channel.
T1059,T1059.004,T1071,T1573,T1573.002 - OpenSSL Password Hash Generation source medium: This rule detects the usage of the "openssl" binary to generate password hashes on Linux systems. The "openssl" command is a cryptographic utility that can be used to generate password hashes. Attackers may use "openssl" to generate password hashes for new user accounts or to change the password of existing accounts, which can be leveraged to maintain persistence on a Linux system.
T1098,T1136,T1136.001 - Outlook Home Page Registry Modification source high: Identifies modifications in registry keys associated with abuse of the Outlook Home Page functionality for command and control or persistence.
T1071,T1071.001,T1112,T1137,T1137.004 - Passwordless Sudo Probing source low: This rule detects passwordless sudo probing activity on Linux systems. Passwordless sudo probing can be an indication of an attacker attempting to enumerate it's allowed commands and potential privilege escalation.
T1033,T1082 - Peripheral Device Discovery source low: Identifies use of the Windows file system utility (fsutil.exe) to gather information about attached peripheral devices and components connected to a computer system.
T1120 - Persistence via BITS Job Notify Cmdline source medium: An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a system.
T1197 - Persistence via Hidden Run Key Detected source high: Identifies a persistence mechanism that utilizes the NtSetValueKey native API to create a hidden (null terminated) registry key. An adversary may use this method to hide from system utilities such as the Registry Editor (regedit).
T1106,T1112,T1547,T1547.001,T1564 - Persistence via Microsoft Office AddIns source high: Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins.
T1137,T1137.006 - Persistence via Microsoft Outlook VBA source medium: Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template.
T1137,T1137.001 - Persistence via PowerShell profile source medium: Identifies the creation or modification of a PowerShell profile. PowerShell profile is a script that is executed when PowerShell starts to customize the user environment, which can be abused by attackers to persist in a environment where PowerShell is common.
T1546,T1546.013 - Persistence via Scheduled Job Creation source medium: A job can be used to schedule programs or scripts to be executed at a specified date and time. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.
T1053,T1053.005 - Persistence via TelemetryController Scheduled Task Hijack source high: Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an integrity level of system.
T1053,T1053.005,T1574 - Persistence via Update Orchestrator Service Hijack source high: Identifies potential hijacking of the Microsoft Update Orchestrator Service to establish persistence with an integrity level of SYSTEM.
T1068,T1543,T1543.003,T1574,T1574.011 - Persistence via WMI Event Subscription source low: An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.
T1047,T1546,T1546.003 - Persistent Scripts in the Startup Directory source medium: Identifies script engines creating files in the Startup folder, or the creation of script files in the Startup folder. Adversaries may abuse this technique to maintain persistence in an environment.
T1547,T1547.001,T1547.009 - Pluggable Authentication Module (PAM) Creation in Unusual Directory source low: This rule detects the creation of Pluggable Authentication Module (PAM) shared object files in unusual directories. Attackers may compile PAM shared object files in temporary directories, to move them to system directories later, potentially allowing them to maintain persistence on a compromised system, or harvest account credentials.
T1543,T1556,T1556.003 - Pluggable Authentication Module (PAM) Version Discovery source low: This rule detects PAM version discovery activity on Linux systems. PAM version discovery can be an indication of an attacker attempting to backdoor the authentication process through malicious PAM modules.
T1082,T1518,T1543,T1556 - Pod or Container Creation with Suspicious Command-Line source medium: This rule detects the creation of pods or containers that execute suspicious commands often associated with persistence or privilege escalation techniques. Attackers may use container orchestration tools like kubectl or container runtimes like docker to create pods or containers that run shell commands with arguments that indicate attempts to establish persistence (e.g., modifying startup scripts, creating backdoors).
T1037,T1037.004,T1053,T1053.002,T1053.003,T1059 - Polkit Policy Creation source low: This rule monitors for the creation of Polkit policy files on Linux systems. Polkit policy files are used to define the permissions for system-wide services and applications. The creation of new Polkit policy files may indicate an attempt to modify the authentication process, which could be used for persistence by an adversary.
T1543,T1556 - Polkit Version Discovery source low: This rule detects Polkit version discovery activity on Linux systems. Polkit version discovery can be an indication of an attacker attempting to exploit misconfigurations or vulnerabilities in the Polkit service.
T1082,T1518 - Port Forwarding Rule Addition source medium: Identifies the creation of a new port forwarding rule. An adversary may abuse this technique to bypass network segmentation restrictions.
T1090,T1090.001,T1112,T1572 - Potential Application Shimming via Sdbinst source low: The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.
T1546,T1546.011 - Potential Chroot Container Escape via Mount source high: Monitors for the execution of a file system mount followed by a chroot execution. Given enough permissions, a user within a container is capable of mounting the root file system of the host, and leveraging chroot to escape its containarized environment. This behavior pattern is very uncommon and should be investigated.
T1611 - Potential Container Escape via Kernel core_pattern Modification source medium: The Linux kernel invokes the program named in "/proc/sys/kernel/core_pattern" whenever a process core-dumps. When that value begins with a pipe (|), the kernel runs the handler from the host's initial namespace as root, regardless of where the crashing process lived. Because the core-dump up-call is not namespaced, a process inside a container that can write core_pattern can register an attacker-controlled handler and then deliberately crash a process to have it execute on the host as root, resulting in a full container-to-host escape.
T1611 - Potential Credential Access via Windows Utilities source high: Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access.
T1003,T1003.001,T1003.003,T1218,T1218.011 - Potential CVE-2025-32463 Nsswitch File Creation source high: Detects suspicious creation of the nsswitch.conf file, outside of the regular /etc/nsswitch.conf path, consistent with attempts to exploit CVE-2025-32463 (the "sudo chroot" privilege escalation), where an attacker tricks sudo into using attacker-controlled NSS files or libraries to gain root.
T1068,T1574,T1574.006 - Potential CVE-2025-32463 Sudo Chroot Execution Attempt source high: Detects suspicious use of sudo's --chroot / -R option consistent with attempts to exploit CVE-2025-32463 (the "sudo chroot" privilege escalation), where an attacker tricks sudo into using attacker-controlled NSS files or libraries to gain root.
T1068,T1548,T1548.003 - Potential CVE-2025-33053 Exploitation source high: Identifies Internet Explorer Diagnostics launching a helper name from a non-System32 path, which may indicate CVE-2025-33053 exploitation.
T1036,T1036.005,T1203,T1218,T1566,T1566.001 - Potential Data Exfiltration Through Curl source medium: Detects the use of curl to upload files to an internet server. Threat actors often will collect and exfiltrate data on a system to their C2 server for review. Many threat actors have been observed using curl to upload the collected data. Use of curl in this way, while not inherently malicious, should be considered highly abnormal and suspicious activity.
T1048,T1048.001,T1048.003 - Potential Data Exfiltration Through Wget source medium: Detects the use of wget to upload files to an internet server. Threat actors often will collect data on a system and attempt to exfiltrate it back to their command and control servers. Use of wget in this way, while not inherently malicious, should be considered highly abnormal and suspicious activity.
T1005,T1048 - Potential Data Exfiltration via Rclone source medium: Identifies abuse of rclone (or a renamed copy, e.g. disguised as a security or backup utility) to exfiltrate data to cloud storage or remote endpoints. Rclone is a legitimate file sync tool; threat actors rename it to blend with administrative traffic and use copy/sync with cloud backends (e.g. :s3:) and include filters to exfiltrate specific file types.
T1036,T1036.003,T1048,T1567,T1567.002 - Potential Data Splitting Detected source medium: This rule looks for the usage of common data splitting utilities with specific arguments that indicate data splitting for exfiltration on Linux systems. Data splitting is a technique used by adversaries to split data into smaller parts to avoid detection and exfiltrate data.
T1030 - Potential Database Dumping Activity source low: This rule detects the use of database dumping utilities to exfiltrate data from a database. Attackers may attempt to dump the database to a file on the system and then exfiltrate the file to a remote server.
T1048,T1119,T1213 - Potential Defense Evasion via Doas source medium: This rule detects the creation or rename of the Doas configuration file on a Linux system. Adversaries may create or modify the Doas configuration file to elevate privileges and execute commands as other users while attempting to evade detection.
T1548,T1548.003 - Potential Defense Evasion via PRoot source high: Identifies the execution of the PRoot utility, an open-source tool for user-space implementation of chroot, mount --bind, and binfmt_misc. Adversaries can leverage an open-source tool PRoot to expand the scope of their operations to multiple Linux distributions and simplify their necessary efforts. In a normal threat scenario, the scope of an attack is limited by the varying configurations of each Linux distribution. With PRoot, it provides an attacker with a consistent operational environment across different Linux distributions, such as Ubuntu, Fedora, and Alpine. PRoot also provides emulation capabilities that allow for malware built on other architectures, such as ARM, to be run.The post-exploitation technique called bring your own filesystem (BYOF), can be used by the threat actors to execute malicious payload or elevate privileges or perform network scans or orchestrate another attack on the environment. Although PRoot was originally not developed with malicious intent it can be easily tuned to work for one.
T1211 - Potential Disabling of AppArmor source high: This rule monitors for potential attempts to disable AppArmor. AppArmor is a Linux security module that enforces fine-grained access control policies to restrict the actions and resources that specific applications and processes can access. Adversaries may disable security tools to avoid possible detection of their tools and activities.
T1685 - Potential Disabling of SELinux source high: Identifies potential attempts to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and activities.
T1685 - Potential DLL Side-Loading via Trusted Microsoft Programs source medium: Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes.
T1036,T1574,T1574.001 - Potential DNS Tunneling via NsLookup source medium: This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol.
T1071,T1071.004,T1572 - Potential EDR-Freeze via WerFaultSecure Abuse source high: Identifies the Windows Error Reporting Protected Process Light (PPL) binary WerFaultSecure.exe being started by a process other than the Windows Error Reporting service, with command-line arguments used to take a secure memory dump of a target process. Because MiniDumpWriteDump suspends all threads of the target while the dump is produced, an attacker can suspend WerFaultSecure.exe mid-dump to leave the targeted EDR or antivirus suspended ("frozen") without ever terminating it, a defense-evasion technique publicly known as EDR-Freeze.
T1685 - Potential Escalation via Vulnerable MSI Repair source high: Identifies when a browser process navigates to the Microsoft Help page followed by spawning an elevated process. This may indicate a successful exploitation for privilege escalation abusing a vulnerable Windows Installer repair setup.
T1068,T1218,T1218.007 - Potential Evasion via Filter Manager source medium: The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses.
T1685 - Potential Execution via FileFix Phishing Attack source high: Identifies the execution of Windows commands or downloaded files via the browser's dialog box. Adversaries may use phishing to instruct the victim to copy and paste malicious commands for execution via crafted phishing web pages.
T1059,T1059.001,T1059.003,T1204,T1204.002,T1204.004 - Potential Exploitation of an Unquoted Service Path Vulnerability source low: Adversaries may leverage unquoted service path vulnerabilities to escalate privileges. By placing an executable in a higher-level directory within the path of an unquoted service executable, Windows will natively launch this executable from its defined path variable instead of the benign one in a deeper directory, thus leading to code execution.
T1574,T1574.009 - Potential Fake CAPTCHA Phishing Attack source high: Identifies potential fake CAPTCHA phishing attacks based on PowerShell, Cmd, or Mshta command-line values. Adversaries employ this technique via compromised websites with browser injects, posing either as fake CAPTCHAs to access the site or as a page loading error requiring a fix to display the page. The victim is instructed to copy and paste a malicious command to the Windows Run dialog box.
T1059,T1059.001,T1059.003,T1189,T1204,T1204.004 - Potential File Download via a Headless Browser source high: Identifies headless browser execution from a suspicious parent process with arguments consistent with scripted retrieval. Adversaries use browsers because they are trusted, signed binaries that proxy and application-control policies allow through, bypassing restrictions on direct download tools.
T1105 - Potential File Transfer via Certreq source medium: Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to download files or upload data to a remote URL.
T1071,T1071.001,T1105,T1218,T1567 - Potential File Transfer via Curl for Windows source low: Identifies Curl for Windows making an HTTP request. Adversaries could abuse Curl to download files or upload data to a remote URL.
T1071,T1071.001,T1105,T1567 - Potential Foxmail Exploitation source high: Identifies the Foxmail client spawning a child process with arguments pointing to user-profile AppData paths or remote shares. This may indicate exploitation of a Foxmail vulnerability for initial access and execution via a malicious email.
T1203,T1566,T1566.001 - Potential Git CVE-2025-48384 Exploitation source high: This rule detects potential exploitation of CVE-2025-48384 via Git. This vulnerability allows attackers to execute arbitrary code by leveraging Git's recursive clone feature to fetch and execute malicious scripts from a remote repository.
T1059,T1059.004,T1105,T1203 - Potential Hex Payload Execution via Command-Line source low: This rule detects when a process executes a command line containing hexadecimal characters. Malware authors may use hexadecimal encoding to obfuscate their payload and evade detection.
T1027,T1027.010,T1059,T1059.004,T1140,T1204 - Potential Hex Payload Execution via Common Utility source low: This rule detects potential hex payload execution on Linux systems. Adversaries may use hex encoding to obfuscate payloads and evade detection mechanisms.
T1027,T1059,T1059.004,T1059.006,T1059.011,T1140 - Potential Hidden Process via Mount Hidepid source high: Identifies the execution of mount process with hidepid parameter, which can make processes invisible to other users from the system. Adversaries using Linux kernel version 3.2+ (or RHEL/CentOS v6.5+ above) can hide the process from other users. When hidepid=2 option is executed to mount the /proc filesystem, only the root user can see all processes and the logged-in user can only see their own process. This provides a defense evasion mechanism for the adversaries to hide their process executions from all other commands such as ps, top, pgrep and more. With the Linux kernel hardening hidepid option all the user has to do is remount the /proc filesystem with the option, which can now be monitored and detected.
T1564,T1564.001 - Potential IIS Web Shell File Creation source high: Identifies the creation of ASPX/ASHX/ASMX files in specific directories that are commonly targeted by attackers to deploy web shells.
T1505,T1505.003 - Potential Impersonation Attempt via Kubectl source medium: This rule detects potential impersonation attempts via the "kubectl" command in Linux and macOS environments. It identifies process events where "kubectl" is executed with arguments that suggest an attempt to impersonate another user or group, such as using "--kubeconfig", "--token", "--as", or "--as-group". This could indicate an adversary trying to gain unauthorized access or escalate privileges within a Kubernetes cluster. If this rule is triggered, in conjunction with rules related to secret access or kubeconfig file discovery, it may indicate a potential impersonation attempt.
T1078,T1528,T1550,T1550.001,T1552 - Potential Kerberos SPN Spoofing via Suspicious DNS Query source high: Identifies queries for a DNS name containing a base64-encoded blob matching the pattern "UWhRCA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, commonly used in Kerberos coercion attacks. It is associated with tools and techniques that exploit SPN spoofing via DNS. Adversaries may abuse such names to coerce victim systems into authenticating to attacker-controlled hosts while requesting Kerberos tickets for legitimate services (often the victim's own identity). Depending on the coerced service and negotiated authentication, this can support Kerberos relay or NTLM reflection/relay paths without relying on normal NTLM fallback behavior.
T1187,T1557,T1557.001 - Potential Kubectl Masquerading via Unexpected Process source medium: This rule detects potential kubectl masquerading activity by monitoring for process events where the process name is not "kubectl" but the command line arguments include kubectl-related commands. This could indicate an adversary attempting to masquerade as legitimate kubectl activity to evade detection. This rule covers evasion gaps introduced by renaming the kubectl binary, or placing it in an unusual directory.
T1036,T1036.003,T1564,T1564.001,T1609,T1610 - Potential Linux Backdoor User Account Creation source high: Identifies the attempt to create a new backdoor user by setting the user's UID to 0. Attackers may alter a user's UID to 0 to establish persistence on a system.
T1098,T1136,T1136.001 - Potential Linux Credential Dumping via Proc Filesystem source high: Identifies the execution of the mimipenguin exploit script which is linux adaptation of Windows tool mimikatz. Mimipenguin exploit script is used to dump clear text passwords from a currently logged-in user. The tool exploits a known vulnerability CVE-2018-20781. Malicious actors can exploit the cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords.
T1003,T1003.007,T1057,T1212 - Potential Linux Credential Dumping via Unshadow source high: Identifies the execution of the unshadow utility which is part of John the Ripper, a password-cracking tool on the host machine. Malicious actors can use the utility to retrieve the combined contents of the '/etc/shadow' and '/etc/password' files. Using the combined file generated from the utility, the malicious threat actors can use them as input for password-cracking utilities or prepare themselves for future operations by gathering credential information of the victim.
T1003,T1003.008,T1005 - Potential Linux Hack Tool Launched source medium: Monitors for the execution of different processes that might be used by attackers for malicious intent. An alert from this rule should be investigated further, as hack tools are commonly used by blue teamers and system administrators as well.
T1046,T1057,T1082,T1110,T1110.001,T1110.002 - Potential Linux Tunneling and/or Port Forwarding source medium: This rule monitors for a set of Linux utilities that can be used for tunneling and port forwarding. Attackers can leverage tunneling and port forwarding techniques to bypass network defenses, establish hidden communication channels, and gain unauthorized access to internal resources, facilitating data exfiltration, lateral movement, and remote control.
T1071,T1090,T1572 - Potential Linux Tunneling and/or Port Forwarding via Command Line source medium: This rule monitors for potential tunneling and/or port forwarding activity on Linux systems via command line utilities. Attackers may use various tools to create covert communication channels, allowing them to bypass network security measures and maintain persistent access to compromised systems. By leveraging these utilities, attackers can tunnel traffic through legitimate protocols, making detection more challenging.
T1090,T1572 - Potential Linux Tunneling and/or Port Forwarding via SSH Option source low: This rule detects the use of SSH options that may indicate tunneling or port forwarding on Linux systems. This behavior is commonly associated with malicious activity, such as establishing a port forward, proxy or an encrypted tunnel to exfiltrate data.
T1090,T1572 - Potential Local NTLM Relay via HTTP source high: Identifies attempts to coerce local NTLM authentication over HTTP through WebDAV named-pipe paths such as Print Spooler or SRVSVC. Adversaries can combine this primitive with relay tooling to elevate privileges.
T1187,T1212,T1218,T1218.011,T1557 - Potential Masquerading as Communication Apps source medium: Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware.
T1036,T1036.001,T1036.005,T1554 - Potential NetNTLMv1 Downgrade Attack source medium: Identifies registry modification to force the system to fall back to NTLMv1 for authentication. This modification is possible with local administrator privileges and is commonly referred to as a
NetNTLMv1 downgrade attack.T1112,T1685,T1689 - Potential Network Scan Executed From Host source medium: This threshold rule monitors for the rapid execution of unix utilities that are capable of conducting network scans. Adversaries may leverage built-in tools such as ping, netcat or socat to execute ping sweeps across the network while attempting to evade detection or due to the lack of network mapping tools available on the compromised host.
T1018,T1046 - Potential Notepad Markdown RCE Exploitation source high: Identifies a process started by Notepad after opening a Markdown file. This may indicate successful exploitation of a Notepad markdown parsing vulnerability (CVE-2026-20841) that can lead to arbitrary code execution.
T1203,T1204,T1204.002 - Potential OpenSSH Backdoor Logging Activity source low: Identifies a Secure Shell (SSH) client or server process creating a known SSH backdoor log file. Adversaries may modify SSH related binaries for persistence or credential access via patching sensitive functions to enable unauthorized access or to log SSH credentials for exfiltration.
T1074,T1074.001,T1554,T1556 - Potential Persistence via Time Provider Modification source medium: Identifies modification of the Time Provider. Adversaries may establish persistence by registering and enabling a malicious DLL as a time provider. Windows uses the time provider architecture to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in the System32 folder. The service W32Time initiates during the startup of Windows and loads w32time.dll.
T1547,T1547.003 - Potential privilege escalation via CVE-2022-38028 source high: Identifies a potential privilege escalation attempt via CVE-2022-38028 through modification of the protected Print to PDF MPDW constraints script.
T1036,T1068,T1574,T1574.010 - Potential Privilege Escalation via PKEXEC source high: Identifies an attempt to exploit a local privilege escalation in polkit pkexec (CVE-2021-4034) via unsecure environment variable injection. Successful exploitation allows an unprivileged user to escalate to the root user.
T1068,T1574,T1574.006,T1574.007 - Potential Privilege Escalation via Service ImagePath Modification source medium: Identifies registry modifications to default services that could enable privilege escalation to SYSTEM. Attackers with privileges from groups like Server Operators may change the ImagePath of services to executables under their control or to execute commands.
T1112,T1543,T1543.003,T1569,T1569.002,T1574 - Potential Protocol Tunneling via Cloudflared source medium: Identifies the use of Cloudflare Tunnel (cloudflared) to expose a local service or create an outbound tunnel. Adversaries may abuse quick tunnels (e.g. tunnel --url http://127.0.0.1:80) or named tunnels to proxy C2 traffic or exfiltrate data through Cloudflare's edge while evading direct connection blocking.
T1090,T1090.002,T1572 - Potential Protocol Tunneling via EarthWorm source high: Identifies the execution of the EarthWorm tunneler. Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection and network filtering, or to enable access to otherwise unreachable systems.
T1090,T1572 - Potential Protocol Tunneling via Yuze source medium: Identifies execution of Yuze, a lightweight open-source tunneling tool used for intranet penetration. Yuze supports forward and reverse SOCKS5 proxy tunneling and is typically executed via rundll32 loading yuze.dll with the RunYuze export. Threat actors may use it to proxy C2 or pivot traffic.
T1090,T1218,T1218.011,T1572 - Potential Proxy Execution via Systemd-run source low: This rule detects the execution of a command or binary through the systemd-run binary. Systemd-run can schedule commands to be executed in the background through systemd. Attackers may use this technique to execute commands while attempting to evade detection.
T1059,T1059.004,T1218,T1574 - Potential REMCOS Trojan Execution source high: Identifies known file and registry traces of the REMCOS Remote Access Trojan, including log files, persistence values, and cleanup artifacts. Adversaries use Remcos to maintain persistent remote access to compromised hosts.
T1070,T1070.004,T1219,T1547,T1547.001 - Potential Remote Desktop Shadowing Activity source high: Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry or the execution of processes indicative of an active RDP shadowing session. An adversary may abuse the RDP Shadowing feature to spy on or control other users active RDP sessions.
T1021,T1021.001,T1113,T1563,T1563.002 - Potential Remote Desktop Tunneling Detected source high: Identifies potential use of an SSH utility to establish RDP over an SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
T1021,T1021.001,T1021.004,T1572 - Potential Remote Install via MsiExec source high: Identifies attempts to install a file from a remote server using MsiExec. Adversaries may abuse Windows Installers for initial access and delivery of malware.
T1105,T1218,T1218.007 - Potential RemoteMonologue Attack source medium: Identifies attempt to perform session hijack via COM object registry modification by setting the RunAs value to Interactive User.
T1112,T1546,T1546.015,T1685 - Potential Reverse Shell via Background Process source high: Monitors for the execution of background processes with process arguments capable of opening a socket in the /dev/tcp channel. This may indicate the creation of a backdoor reverse connection, and should be investigated further.
T1059,T1059.004,T1071,T1095 - Potential Secret Scanning via Gitleaks source medium: This rule detects the execution of Gitleaks, a tool used to search for high-entropy strings and secrets in code repositories, which may indicate an attempt to access credentials.
T1003,T1213,T1213.003,T1552,T1552.001,T1555 - Potential Secure File Deletion via SDelete Utility source low: Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple file overwrite and rename operations.
T1070,T1070.004,T1485 - Potential Shell via Wildcard Injection Detected source medium: This rule monitors for the execution of a set of linux binaries, that are potentially vulnerable to wildcard injection, with suspicious command line flags followed by a shell spawn event. Linux wildcard injection is a type of security vulnerability where attackers manipulate commands or input containing wildcards (e.g., *, ?, []) to execute unintended operations or access sensitive data by tricking the system into interpreting the wildcard characters in unexpected ways.
T1059,T1059.004,T1068,T1203 - Potential SSH Reverse Port Forwarding source low: Identifies the use of Windows OpenSSH or Plink to create a reverse SSH port forward or reverse dynamic SOCKS proxy. Adversaries may abuse reverse forwarding to expose an internal service or proxy listener through an external SSH server, establishing an outbound tunnel that bypasses direct inbound connectivity controls.
T1021,T1021.004,T1090,T1090.002,T1572 - Potential Sudo Privilege Escalation via CVE-2019-14287 source high: This rule monitors for the execution of a suspicious sudo command that is leveraged in CVE-2019-14287 to escalate privileges to root. Sudo does not verify the presence of the designated user ID and proceeds to execute using a user ID that can be chosen arbitrarily. By using the sudo privileges, the command "sudo -u#-1" translates to an ID of 0, representing the root user. This exploit may work for sudo versions prior to v1.28.
T1068,T1548,T1548.003 - Potential Suspicious File Edit source low: This rule monitors for the potential edit of a suspicious file. In Linux, when editing a file through an editor, a temporary .swp file is created. By monitoring for the creation of this .swp file, we can detect potential file edits of suspicious files. The execution of this rule is not a clear sign of the file being edited, as just opening the file through an editor will trigger this event. Attackers may alter any of the files added in this rule to establish persistence, escalate privileges or perform reconnaisance on the system.
T1003,T1003.008,T1037,T1037.004,T1098,T1543 - Potential System Tampering via File Modification source high: Identifies attempts to delete or modify critical files used during the boot process to prevent the system from booting. This may indicate a destructive attack behavior.
T1485,T1490 - Potential Telnet Authentication Bypass (CVE-2026-24061) source critical: Identifies potential exploitation of a Telnet remote authentication bypass vulnerability (CVE-2026-24061) in GNU Inetutils telnetd. The vulnerability allows unauthenticated access by supplying a crafted
-f <username>value via theUSERenvironment variable, resulting in a login process spawned with elevated privileges.T1068,T1190,T1210 - Potential THC Tool Downloaded source high: Identifies processes that are capable of downloading files with command line arguments containing URLs to SSH-IT's autonomous SSH worm. This worm intercepts outgoing SSH connections every time a user uses ssh.
T1021,T1021.004,T1105,T1563,T1563.001 - Potential Traffic Tunneling using QEMU source medium: Identifies the use of the QEMU hardware emulator to potentially tunnel network traffic between Virtual machines. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
T1090,T1219,T1572 - Potential Tunneling via Tailscaled source medium: Identifies the use of Tailscaled to potentially tunnel network traffic. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination, or to bypass network restrictions and/or hide traffic from network monitoring.
T1090,T1219,T1572 - Potential Unauthorized Access via Wildcard Injection Detected source medium: This rule monitors for the execution of the "chown" and "chmod" commands with command line flags that could indicate a wildcard injection attack. Linux wildcard injection is a type of security vulnerability where attackers manipulate commands or input containing wildcards (e.g., *, ?, []) to execute unintended operations or access sensitive data by tricking the system into interpreting the wildcard characters in unexpected ways.
T1003,T1003.008,T1068,T1222,T1222.002 - Potential Upgrade of Non-interactive Shell source medium: Identifies when a non-interactive terminal (tty) is being upgraded to a fully interactive shell. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host, in order to obtain a more stable connection.
T1059,T1059.004 - Potential Veeam Credential Access Command source medium: Identifies commands that can access and decrypt Veeam credentials stored in MSSQL databases. Attackers can use Veeam Credentials to target backups as part of destructive operations such as Ransomware attacks.
T1003,T1059,T1059.001,T1213,T1555 - Potential WSUS Abuse for Lateral Movement source medium: Identifies a potential Windows Server Update Services (WSUS) abuse to execute psexec to enable for lateral movement. WSUS is limited to executing Microsoft signed binaries, which limits the executables that can be used to tools published by Microsoft.
T1072,T1210 - Potentially Suspicious Process Started via tmux or screen source medium: This rule monitors for the execution of suspicious commands via screen and tmux. When launching a command and detaching directly, the commands will be executed in the background via its parent process. Attackers may leverage screen or tmux to execute commands while attempting to evade detection.
T1033,T1046,T1059,T1105,T1218 - PowerShell Script Block Logging Disabled source medium: Detects registry changes that disable PowerShell Script Block Logging. Attackers may disable this logging to conceal their activities in the host and evade detection.
T1112,T1685,T1685.001 - Printer User (lp) Shell Execution source high: This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the foomatic-rip parent process through the default printer user (lp). These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
T1059,T1059.004,T1203 - Private Key Searching Activity source high: This rule detects private key searching activity on Linux systems. Searching for private keys can be an indication of an attacker attempting to escalate privileges or exfiltrate sensitive information.
T1083,T1552,T1552.001,T1552.004 - Privilege Escalation via Named Pipe Impersonation source high: Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework such as Metasploit's meterpreter getsystem command.
T1134,T1134.001 - Privilege Escalation via Windir Environment Variable source high: Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges.
T1112,T1574,T1574.007 - Privileged Container Creation with Host Directory Mount source high: This rule detects the creation of privileged containers that mount host directories into the container's filesystem. Such configurations can be exploited by attackers to escape the container isolation and gain access to the host system, potentially leading to privilege escalation and lateral movement within the environment.
T1059,T1059.004,T1609,T1610,T1611 - Privileged Docker Container Creation source medium: This rule leverages the new_terms rule type to identify the creation of a potentially unsafe docker container from an unusual parent process. Attackers can use the "--privileged" flag to create containers with escalated privileges, which can lead to trivial privilege escalation, docker escaping and persistence. access.
T1059,T1059.004,T1609,T1610,T1611 - Process Activity via Compiled HTML File source medium: Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).
T1059,T1059.001,T1059.003,T1204,T1204.002,T1218 - Process Backgrounded by Unusual Parent source low: This rule identifies processes that are backgrounded by an unusual parent process. This behavior may indicate a process attempting to evade detection by hiding its parent process.
T1036,T1036.009,T1059,T1059.004,T1564 - Process Capability Set via setcap Utility source low: This rule detects the use of the setcap utility to set capabilities on a process. The setcap utility is used to set the capabilities of a binary to allow it to perform privileged operations without needing to run as root. This can be used by attackers to establish persistence by creating a backdoor, or escalate privileges by abusing a misconfiguration on a system.
T1548 - Process Execution from an Unusual Directory source medium: Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths.
T1036,T1036.005 - Process Spawned from Message-of-the-Day (MOTD) source high: Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the "/etc/update-motd.d/" directory. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the execution of potentially malicious processes through the MOTD utility.
T1037,T1059,T1059.004,T1059.006,T1059.011 - Program Files Directory Masquerading source medium: Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders.
T1036,T1036.005 - Proxy Execution via Console Window Host source high: Identifies abuse of the Console Window Host (conhost.exe) to execute commands via proxy. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.
T1059,T1059.001,T1059.003,T1202 - Proxy Execution via Windows OpenSSH source high: Identifies attempts to execute commands via proxy using the Windows OpenSSH client. This may indicate an attempt to bypass application control via trusted Windows binaries.
T1202 - ProxyChains Activity source medium: This rule monitors for the execution of the ProxyChains utility. ProxyChains is a command-line tool that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection, and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions.
T1090,T1090.003,T1572 - PsExec Network Connection source low: Identifies use of the SysInternals tool PsExec.exe making a network connection. This could be an indication of lateral movement.
T1021,T1021.002,T1569,T1569.002,T1570 - Rare SMB Connection to the Internet source medium: This rule detects rare internet network connections via the SMB protocol. SMB is commonly used to leak NTLM credentials via rogue UNC path injection.
T1048,T1187 - RDP Enabled via Registry source medium: Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation.
T1021,T1021.001,T1112 - Registry Persistence via AppCert DLL source medium: Detects attempts to maintain persistence by creating registry keys using AppCert DLLs. AppCert DLLs are loaded by every process using the common API functions to create processes.
T1546,T1546.009 - Registry Persistence via AppInit DLL source medium: AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads user32.dll) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications. Attackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine.
T1112,T1546,T1546.010 - Remote Desktop Enabled in Windows Firewall by Netsh source medium: Identifies use of the network shell utility (netsh.exe) to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall.
T1021,T1021.001,T1685,T1686 - Remote Desktop File Opened from Suspicious Path source medium: Identifies attempts to open a remote desktop file from suspicious paths. Adversaries may abuse RDP files for initial access.
T1204,T1204.002,T1566,T1566.001 - Remote File Copy to a Hidden Share source medium: Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.
T1021,T1021.002,T1074,T1074.002,T1570 - Remote File Copy via TeamViewer source medium: Identifies an executable or script file remotely downloaded via a TeamViewer transfer session.
T1105,T1219 - Remote File Download via Desktopimgdownldr Utility source medium: Identifies the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
T1105 - Remote File Download via MpCmdRun source medium: Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file.
T1105 - Remote GitHub Actions Runner Registration source medium: This rule detects the configuration of a GitHub Actions self-hosted runner using the Runner.Listener binary. When a machine is registered to a remote repository, its owner gains the ability to execute arbitrary workflow commands on that host. Unexpected or unauthorized runner registration may indicate adversarial activity aimed at establishing remote code execution via malicious GitHub workflows.
T1059,T1195,T1195.002,T1219 - Remote Management Access Launch After MSI Install source medium: Detects an MSI installer execution followed by the execution of commonly abused Remote Management Software like ScreenConnect. This behavior may indicate abuse where an attacker triggers an MSI install then connects via a guest link with a known session key.
T1219,T1219.002 - Remote Scheduled Task Creation source medium: Identifies remote scheduled task creations on a target host. This could be indicative of adversary lateral movement.
T1021,T1053,T1053.005 - Root Certificate Installation source medium: This rule detects the installation of root certificates on a Linux system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to their command and control servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.
T1553,T1553.004 - Scheduled Tasks AT Command Enabled source medium: Identifies attempts to enable the Windows scheduled tasks AT command via the registry. Attackers may use this method to move laterally or persist locally. The AT command has been deprecated since Windows 8 and Windows Server 2012, but still exists for backwards compatibility.
T1053,T1053.002,T1685 - ScreenConnect Server Spawning Suspicious Processes source high: Identifies suspicious processes being spawned by the ScreenConnect server process (ScreenConnect.Service.exe). This activity may indicate exploitation activity or access to an existing web shell backdoor.
T1059,T1059.001,T1059.003,T1190,T1505,T1505.003 - Script Execution via Microsoft HTML Application source high: Identifies the execution of scripts via HTML applications using Windows utilities rundll32.exe or mshta.exe. Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed binaries.
T1059,T1059.005,T1059.007,T1218,T1218.005,T1218.011 - Searching for Saved Credentials via VaultCmd source medium: Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement.
T1003,T1555,T1555.004 - Security File Access via Common Utilities source low: This rule detects sensitive security file access via common utilities on Linux systems. Adversaries may attempt to read from sensitive files using common utilities to gather information about the system and its security configuration.
T1083,T1552,T1552.001 - SELinux Configuration Creation or Renaming source low: This rule detects the creation or renaming of the SELinux configuration file. SELinux is a security module that provides access control security policies. Modifications to the SELinux configuration file may indicate an attempt to impair defenses by disabling or modifying security tools.
T1685 - Sensitive Files Compression source medium: Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations.
T1005,T1552,T1552.001,T1560,T1560.001 - SentinelOne Alert External Alerts source medium: Generates a detection alert for each SentinelOne alert written to the configured indices. Enabling this rule allows you to immediately begin investigating SentinelOne alerts in the app.
- Service DACL Modification via sc.exe source medium: Identifies DACL modifications to deny access to a service, making it unstoppable, or hide it from system and users.
T1543,T1543.003,T1564 - Setcap setuid/setgid Capability Set source high: This rule monitors for the addition of the cap_setuid+ep or cap_setgid+ep capabilities via setcap. Setuid (Set User ID) and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated privileges, based on the file owner or group. Threat actors can exploit these attributes to achieve persistence by creating malicious binaries, allowing them to maintain control over a compromised system with elevated permissions.
T1548,T1548.001 - Shared Object Load via LoLBin source medium: This rule detects when a process not commonly used to load shared objects, is executed with arguments that load a shared object file. This technique can load a malicious shared object into memory while attempting to evade detection.
T1059,T1059.004,T1218,T1574 - Shell Execution via Elastic Endpoint source low: This rule detects shell executions via Elastic Endpoint. Elastic Endpoint has a built-in response action console that can be used to execute shell commands on compromised systems.
T1059,T1059.004,T1218,T1219 - Signed Proxy Execution via MS Work Folders source medium: Identifies the use of Windows Work Folders to execute a potentially masqueraded control.exe file in the current working directory. Misuse of Windows Work Folders could indicate malicious activity.
T1036,T1036.005,T1218,T1574,T1574.008 - Simple HTTP Web Server Creation source low: This rule detects the creation of a simple HTTP web server using PHP or Python built-in modules. Adversaries may create simple HTTP web servers to establish persistence on a compromised system by uploading a reverse or command shell payload to the server web root, allowing them to regain remote access to the system if lost.
T1059,T1059.004,T1059.006,T1071,T1071.001,T1505 - SIP Provider Modification source medium: Identifies modifications to the registered Subject Interface Package (SIP) providers. SIP providers are used by the Windows cryptographic system to validate file signatures on the system. This may be an attempt to bypass signature validation checks or inject code into critical processes.
T1553,T1553.003 - SolarWinds Process Disabling Services via Registry source medium: Identifies a SolarWinds binary modifying the start type of a service to be disabled. An adversary may abuse this technique to manipulate relevant security services.
T1112,T1195,T1195.002,T1685 - SSH Key Generated via ssh-keygen source low: This rule identifies the creation of SSH keys using the ssh-keygen tool, which is the standard utility for generating SSH keys. Users often create SSH keys for authentication with remote services. However, threat actors can exploit this tool to move laterally across a network or maintain persistence by generating unauthorized SSH keys, granting them SSH access to systems.
T1021,T1021.004,T1098,T1098.004,T1563,T1563.001 - SSL Certificate Deletion source low: This rule detects the deletion of SSL certificates on a Linux system. Adversaries may delete SSL certificates to subvert trust controls and negatively impact the system.
T1070,T1070.004,T1485,T1553 - Startup Persistence by a Suspicious Process source medium: Identifies files written to or modified in the startup folder by commonly abused processes. Adversaries may use this technique to maintain persistence.
T1547,T1547.001 - Sudo Command Enumeration Detected source low: This rule monitors for the usage of the sudo -l command, which is used to list the allowed and forbidden commands for the invoking user. Attackers may execute this command to enumerate commands allowed to be executed with sudo permissions, potentially allowing to escalate privileges to root.
T1033,T1069,T1069.001,T1548,T1548.003 - Suspicious .NET Code Compilation source medium: Identifies executions of .NET compilers with suspicious parent processes, which can indicate an attacker's attempt to compile code after delivery in order to bypass security mechanisms.
T1027,T1027.004,T1047,T1059,T1059.005,T1059.007 - Suspicious /proc/maps Discovery source high: Monitors for /proc//maps file reads. The /proc//maps file in Linux provides a memory map for a specific process, detailing the memory segments, permissions, and what files are mapped to these segments. Attackers may read a process's memory map to identify memory addresses for code injection or process hijacking.
T1003,T1003.007,T1057 - Suspicious Antimalware Scan Interface DLL source high: Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one.
T1574,T1574.001,T1685 - Suspicious APT Package Manager Execution source low: Detects suspicious process events executed by the APT package manager, potentially indicating persistence through an APT backdoor. In Linux, APT (Advanced Package Tool) is a command-line utility used for handling packages on Debian-based systems, providing functions for installing, updating, upgrading, and removing software along with managing package repositories. Attackers can backdoor APT to gain persistence by injecting malicious code into scripts that APT runs, thereby ensuring continued unauthorized access or control each time APT is used for package management.
T1059,T1059.004,T1059.006,T1543,T1546,T1546.016 - Suspicious CertUtil Commands source medium: Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration.
T1105,T1140,T1552,T1552.004 - Suspicious Cmd Execution via WMI source high: Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement.
T1021,T1021.003,T1047,T1059,T1059.003 - Suspicious Command Execution via Busybox Proxy source low: This rule detects the execution of command line arguments capable of spawning shells or establishing network connections through Busybox. This technique can be used to execute commands while attempting to evade detection.
T1059,T1059.004,T1071,T1218 - Suspicious Command Prompt Network Connection source low: Identifies a network connection by the command prompt (cmd.exe) when it is executed with specific arguments, such as a script or a URL, or when it is spawned by Microsoft Office applications. Adversaries often abuse cmd.exe to download malicious payloads or establish command and control channels from a remote source.
T1059,T1059.003,T1071,T1105 - Suspicious Communication App Child Process source medium: Identifies suspicious child processes of communications apps, which can indicate a potential masquerading as the communication app or the exploitation of a vulnerability on the application causing it to execute code.
T1036,T1036.001,T1036.005,T1055,T1203,T1554 - Suspicious Content Extracted or Decompressed via Funzip source medium: Identifies when suspicious content is extracted from a file and subsequently decompressed using the funzip utility. Malware may execute the tail utility using the "-c" option to read a sequence of bytes from the end of a file. The output from tail can be piped to funzip in order to decompress malicious code before it is executed. This behavior is consistent with malware families such as Bundlore.
T1027,T1027.015,T1059,T1059.004,T1140 - Suspicious Dynamic Linker Discovery via od source high: Monitors for dynamic linker discovery via the od utility. od (octal dump) is a command-line utility in Unix operating systems used for displaying data in various formats, including octal, hexadecimal, decimal, and ASCII, primarily used for examining and debugging binary files or data streams. Attackers can leverage od to analyze the dynamic linker by identifying injection points and craft exploits based on the observed behaviors and structures within these files.
T1057,T1083,T1574,T1574.006 - Suspicious Endpoint Security Parent Process source medium: A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection.
T1036,T1036.005,T1055,T1055.012 - Suspicious Execution from a WebDav Share source high: Identifies attempts to execute or invoke content from remote WebDAV shares. Adversaries may abuse WebDAV paths, public tunnels, or host@port UNC paths to run tools or scripts while reducing local staging on the victim file system.
T1021,T1021.002,T1071,T1071.001,T1105,T1204 - Suspicious Execution from Foomatic-rip or Cupsd Parent source high: This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects suspicious process command lines executed by child processes of foomatic-rip and cupsd. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
T1003,T1003.008,T1053,T1053.003,T1105,T1129 - Suspicious Execution from INET Cache source high: Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access.
T1105,T1204,T1204.002,T1566,T1566.001 - Suspicious Execution via Microsoft Office Add-Ins source medium: Identifies execution of common Microsoft Office applications to launch an Office Add-In from a suspicious path or with an unusual parent process. This may indicate an attempt to get initial access via a malicious phishing MS Office Add-In.
T1129,T1137,T1137.006,T1204,T1204.002,T1566 - Suspicious Execution via Windows Subsystem for Linux source low: Detects Linux Bash commands from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.
T1003,T1003.008,T1059,T1059.004,T1202 - Suspicious Execution with NodeJS source high: Identifies suspicious Node.js execution patterns, including PowerShell-launched module preloads and inline eval, decode, or child-process usage.
T1027,T1027.010,T1059,T1059.007 - Suspicious Explorer Child Process source medium: Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or executables from a trusted parent process.
T1059,T1059.001,T1059.003,T1059.005,T1218,T1218.005 - Suspicious File Creation via Kworker source medium: This rule monitors for a file creation event originating from a kworker parent process. kworker, or kernel worker, processes are part of the kernel's workqueue mechanism. They are responsible for executing work that has been scheduled to be done in kernel space, which might include tasks like handling interrupts, background activities, and other kernel-related tasks. Attackers may attempt to evade detection by masquerading as a kernel worker process.
T1014,T1036,T1036.005,T1547 - Suspicious ImagePath Service Creation source high: Identifies the creation of a suspicious ImagePath value. This could be an indication of an adversary attempting to stealthily persist or escalate privileges through abnormal service creation.
T1112,T1543,T1543.003 - Suspicious Instance Metadata Service (IMDS) API Command Line Execution source medium: This rule identifies various tools/scripts performing command line execution attempting to access the cloud service provider's instance metadata service (IMDS) API endpoint, which can be used to retrieve sensitive instance-specific information such as instance ID, public IP address, and even temporary security credentials if roles are assumed by that instance.
T1016,T1082,T1552,T1552.005,T1580 - Suspicious JavaScript Execution via Deno source high: Detects execution of JavaScript via Deno with suspicious command-line patterns (base64, eval, http, or import in a javascript context). Adversaries may abuse Deno to run malicious JavaScript for execution or staging.
T1027,T1059,T1059.007,T1105 - Suspicious JetBrains TeamCity Child Process source medium: Identifies suspicious processes being spawned by the JetBrain TeamCity process. This activity could be related to JetBrains remote code execution vulnerabilities.
T1016,T1033,T1049,T1057,T1059,T1059.001 - Suspicious Managed Code Hosting Process source high: Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious code execution.
T1047,T1055,T1218,T1218.003,T1218.005,T1218.010 - Suspicious Memory grep Activity source high: Monitors for grep activity related to memory mapping. The /proc/*/maps file in Linux provides a memory map for a specific process, detailing the memory segments, permissions, and what files are mapped to these segments. Attackers may read a process's memory map to identify memory addresses for code injection or process hijacking.
T1057,T1083 - Suspicious Microsoft Diagnostics Wizard Execution source high: Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments.
T1036,T1036.003,T1218 - Suspicious Microsoft HTML Application Child Process source high: Identifies Mshta.exe spawning a suspicious child process. This may indicate adversarial activity, as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection.
T1059,T1059.001,T1059.003,T1218,T1218.005,T1218.007 - Suspicious Mining Process Creation Event source medium: Identifies service creation events of common mining services, possibly indicating the infection of a system with a cryptominer.
T1059,T1059.004,T1496,T1543,T1543.002 - Suspicious MS Office Child Process source medium: Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.
T1016,T1033,T1049,T1057,T1059,T1059.001 - Suspicious MS Outlook Child Process source low: Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity.
T1059,T1059.001,T1059.003,T1204,T1204.002,T1218 - Suspicious Named Pipe Creation source high: This rule detects the creation of unusually labeled named pipes (FIFOs) by the mkfifo command, which is often used by attackers to establish persistence on a target system or to execute commands in the background. Through the new_terms rule type, this rule can identify uncommon process command lines that may indicate the presence of a malicious named pipe.
T1059,T1059.004,T1071 - Suspicious PDF Reader Child Process source low: Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering.
T1016,T1016.001,T1033,T1057,T1082,T1203 - Suspicious Print Spooler File Deletion source medium: Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities.
T1068,T1070,T1070.004 - Suspicious Print Spooler Point and Print DLL source high: Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030) related to the print spooler service. Exploitation involves chaining multiple primitives to load an arbitrary DLL into the print spooler process running as SYSTEM.
T1068,T1112,T1574 - Suspicious React Server Child Process source high: This rule detects suspicious child process activity from a React server application. This could be related to successful exploitation of CVE-2025-55182 or CVE-2025-66478. These vulnerabilities allow attackers to execute remote code due to insecure deserialization of React Server Components (RSC) Flight payloads, leading to unauthenticated RCE on servers running React 19.x or Next.js 14.3.0-canary+, 15.x, and 16.x with the App Router enabled
T1033,T1059,T1059.001,T1059.003,T1059.004,T1059.006 - Suspicious Reading of procfs Syscall File source medium: This rule detects command lines that reference another process or thread's procfs syscall file. The "/proc/<pid>/syscall" interface exposes the current syscall arguments, stack pointer, and instruction pointer, which can support process discovery and preparation for process injection. Self and thread-self aliases are excluded.
T1057 - Suspicious ScreenConnect Client Child Process source medium: Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate execution abusing unauthorized access to the ScreenConnect remote access software.
T1047,T1053,T1053.005,T1059,T1059.001,T1059.003 - Suspicious Shell Execution via Velociraptor source medium: Detects shell executions (cmd, PowerShell, rundll32) spawned by Velociraptor. Threat actors have been observed installing Velociraptor to execute shell commands on compromised systems, blending in with legitimate system processes.
T1059,T1059.001,T1059.003,T1218,T1218.011,T1219 - Suspicious SolarWinds Child Process source medium: A suspicious SolarWinds child process was detected, which may indicate an attempt to execute malicious programs.
T1106,T1195,T1195.002 - Suspicious Startup Shell Folder Modification source high: Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder.
T1112,T1547,T1547.001 - Suspicious Utility Launched via ProxyChains source medium: This rule monitors for the execution of suspicious linux tools through ProxyChains. ProxyChains is a command-line tool that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection, and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions.
T1090,T1090.003,T1572 - Suspicious WerFault Child Process source medium: A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit registry key manipulation. Verify process details such as command line, network connections and file writes.
T1036,T1546,T1546.012 - Suspicious which Enumeration source low: This rule monitors for the usage of the which command with an unusual amount of process arguments. Attackers may leverage the which command to enumerate the system for useful installed utilities that may be used after compromising a system to escalate privileges or move latteraly across the network.
T1082,T1083,T1518 - Suspicious Windows Command Shell Arguments source high: Identifies the execution of the Windows Command Shell process (cmd.exe) with suspicious argument values. This behavior is often observed during malware installation.
T1027,T1059,T1059.003,T1105,T1218,T1218.005 - Suspicious Windows Powershell Arguments source medium: Identifies the execution of PowerShell with suspicious argument values. This behavior is often observed during malware installation leveraging PowerShell.
T1027,T1027.010,T1059,T1059.001,T1105,T1140 - Suspicious Write Attempt to AppArmor Policy Management Files source medium: Detects processes attempting to write to AppArmor policy management pseudo-files located under "/sys/kernel/security/apparmor/". These special kernel interfaces are used to load, replace, or remove AppArmor profiles (".load", ".replace", ".remove"). In normal environments, AppArmor policy management is typically performed by administrative tools such as "apparmor_parser" during system initialization or package installation. Direct interaction with these pseudo-files from shell utilities, interpreters, or scripting environments is uncommon and may indicate attempts to modify security policy at runtime. Adversaries may abuse these interfaces to weaken or disable AppArmor protections, introduce malicious profiles, or exploit vulnerabilities in the AppArmor policy parser as part of local privilege escalation chains.
T1685 - Suspicious Zoom Child Process source medium: A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and associated file signature details as well.
T1036,T1055,T1059,T1059.001,T1059.003,T1203 - Svchost spawning Cmd source low: Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe
T1059,T1569,T1569.002 - Symbolic Link to Shadow Copy Created source medium: Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials.
T1003,T1003.002,T1003.003,T1006 - System File Ownership Change source medium: Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files.
T1222,T1222.001 - System Information Discovery via dmidecode from Parent Shell source low: This rule detects the use of dmidecode to gather system information from a Linux host when executed from a parent shell process. Adversaries may use dmidecode to collect detailed hardware and system information, which can aid in further exploitation or lateral movement within a network, or be used as a fingerprint for a compromised system.
T1082 - System Log File Deletion source medium: Identifies the deletion of sensitive Linux system logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system.
T1070,T1070.004,T1685.006 - System Owner/User Discovery Linux source low: Identifies the use of built-in tools which adversaries may use to enumerate the system owner/user of a compromised system.
T1033,T1069 - System Public IP Discovery via DNS Query source high: Identifies DNS queries to known public IP address lookup web services from suspicious Windows processes, which can reveal external IP or internet-connectivity discovery before follow-on activity.
T1016,T1016.001,T1071,T1071.004 - System Shells via Services source medium: Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions.
T1059,T1059.001,T1059.003,T1543,T1543.003,T1569 - System V Init Script Created source low: Files that are placed in the "/etc/init.d/" directory in Unix can be used to start custom applications, services, scripts or commands during start-up. Init.d has been mostly replaced in favor of Systemd. However, the "systemd-sysv-generator" can convert init.d files to service unit files that run at boot. Adversaries may add or alter files located in the "/etc/init.d/" directory to execute malicious code upon boot in order to gain persistence on the system.
T1037,T1037.004 - Third-party Backup Files Deleted via Unexpected Process source medium: Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a ransomware attack is less likely.
T1485,T1490 - UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer source medium: Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
T1218,T1548,T1548.002,T1559,T1559.001 - UAC Bypass Attempt via Privileged IFileOperation COM Interface source high: Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
T1548,T1548.002,T1574,T1574.001 - UAC Bypass Attempt via Windows Directory Masquerading source high: Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
T1036,T1036.005,T1548,T1548.002 - UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface source high: Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
T1548,T1548.002,T1559,T1559.001 - UAC Bypass via DiskCleanup Scheduled Task Hijack source medium: Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled Task. Attackers bypass UAC to stealthily execute code with elevated permissions.
T1053,T1053.005,T1548,T1548.002 - UAC Bypass via Windows Firewall Snap-In Hijack source medium: Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
T1218,T1218.014,T1548,T1548.002 - Unix Socket Connection source low: This rule monitors for inter-process communication via Unix sockets. Adversaries may attempt to communicate with local Unix sockets to enumerate application details, find vulnerabilities/configuration mistakes and potentially escalate privileges or set up malicious communication channels via Unix sockets for inter-process communication to attempt to evade detection.
T1559 - Unusual Child Process from a System Virtual Process source high: Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection.
T1055 - Unusual Child Process of dns.exe source high: Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation.
T1190,T1210 - Unusual D-Bus Daemon Child Process source low: This rule detects when an unusual child process is spawned from the
dbus-daemonparent process. Thedbus-daemonprocess is a message bus system that provides a way for applications to talk to each other. Attackers may abuse this process to execute malicious code or escalate privileges.T1059,T1059.004,T1543,T1559 - Unusual Executable File Creation by a System Critical Process source high: Identifies an unexpected executable file being created or modified by a Windows system critical process, which may indicate activity related to remote code execution or other forms of exploitation.
T1068,T1203,T1211 - Unusual Execution via Microsoft Common Console File source high: Identifies the execution of a child process from a Microsoft Common Console file. Adversaries may embed a malicious command in an MSC file in order to trick victims into executing malicious commands.
T1204,T1204.002,T1218,T1218.014,T1566,T1566.001 - Unusual File Creation - Alternate Data Stream source high: Identifies suspicious creation of Alternate Data Streams on highly targeted files using a script or command interpreter. This is uncommon for legitimate files and sometimes done by adversaries to hide malware.
T1564,T1564.004 - Unusual Network Connection via DllHost source medium: Identifies unusual instances of dllhost.exe making outbound network connections. This may indicate adversarial Command and Control activity.
T1071,T1218 - Unusual Network Connection via RunDLL32 source medium: Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial Command and Control activity.
T1071,T1071.001,T1218,T1218.011 - Unusual Parent Process for cmd.exe source medium: Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process.
T1059 - Unusual Parent-Child Relationship source medium: Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system.
T1036,T1036.009,T1055,T1055.012,T1134,T1134.004 - Unusual Persistence via Services Registry source low: Identifies processes modifying the services registry key directly, instead of through the expected Windows APIs. This could be an indication of an adversary attempting to stealthily persist through abnormal service creation or modification of an existing service.
T1112,T1543,T1543.003,T1574,T1574.011 - Unusual Pkexec Execution source high: This rule detects the execution of the
pkexeccommand by a shell process. Thepkexeccommand is used to execute programs as another user, typically as the superuser. Through thenew_termsrule type, unusual executions ofpkexecare identified, and may indicate an attempt to escalate privileges or perform unauthorized actions on the system.T1059,T1059.004,T1543,T1548,T1548.001 - Unusual Print Spooler Child Process source medium: Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows.
T1068 - Unusual Process Execution Path - Alternate Data Stream source medium: Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware.
T1564,T1564.004 - Unusual Process Network Connection source low: Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection.
T1127,T1218,T1218.003,T1218.008 - Unusual Service Host Child Process - Childless Service source medium: Identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn any child processes. This may indicate a code injection or an equivalent form of exploitation.
T1055,T1055.012 - User Account Creation source low: Identifies attempts to create new users. This is sometimes done by attackers to increase access or establish persistence on a system or domain.
T1136,T1136.001,T1136.002 - Virtual Machine Fingerprinting source high: An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware.
T1082,T1497,T1497.001 - Volume Shadow Copy Deleted or Resized via VssAdmin source high: Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.
T1490 - Volume Shadow Copy Deletion via PowerShell source high: Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks.
T1047,T1059,T1059.001,T1490 - Volume Shadow Copy Deletion via WMIC source high: Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.
T1047,T1490 - WDAC Policy File by an Unusual Process source high: Identifies the creation of a Windows Defender Application Control (WDAC) policy file by an unusual process. Adversaries may use a specially crafted WDAC policy to restrict the execution of security products.
T1685 - Web Server Spawned via Python source medium: This rule identifies when a web server is spawned via Python. Attackers may use Python to spawn a web server to exfiltrate/infiltrate data or to move laterally within a network.
T1059,T1059.006,T1570 - Web Shell Detection: Script Process Child of Common Web Processes source high: Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.
T1047,T1059,T1059.001,T1059.003,T1059.005,T1059.007 - Werfault ReflectDebugger Persistence source low: Identifies the registration of a Werfault Debugger. Attackers may abuse this mechanism to execute malicious payloads every time the utility is executed with the "-pr" parameter.
T1112,T1546,T1546.012 - Windows Defender Exclusions Added via PowerShell source medium: Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level.
T1059,T1059.001,T1685 - Windows Firewall Disabled via PowerShell source medium: Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions.
T1059,T1059.001,T1685,T1686 - Windows Sandbox with Sensitive Configuration source medium: Identifies Windows sanfbox processes indicating the start of a new container with sensitive configurations like write access to the host file system, network connection and automatic execution via logon command. Malware may abuse the sandbox feature to evade detection.
T1564,T1564.006 - Windows Script Executing PowerShell source low: Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.
T1059,T1059.001,T1059.005,T1059.007,T1566,T1566.001 - Windows Script Execution from Archive source medium: Identifies attempts to execute Jscript/Vbscript files from an archive file. The use of archives is a common delivery method of malicious scripts.
T1059,T1059.005,T1059.007,T1204,T1204.002 - Windows Server Update Service Spawning Suspicious Processes source high: Identifies suspicious processes being spawned by the Windows Server Update Service. This activity may indicate exploitation activity or access to an existing web shell backdoor.
T1059,T1059.001,T1059.003,T1190,T1218,T1218.011 - Windows Subsystem for Linux Distribution Installed source medium: Detects changes to the registry that indicates the install of a new Windows Subsystem for Linux distribution by name. Adversaries may enable and use WSL for Linux to avoid detection.
T1059,T1059.004,T1112,T1202 - Windows Subsystem for Linux Enabled via Dism Utility source medium: Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection.
T1202 - Wireless Credential Dumping using Netsh Command source high: Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh.
T1003,T1016,T1082,T1552,T1552.001,T1555 - XDG-Open Command Execution source medium: This rule monitors for the execution of the xdg-open process that is typically used to open documents and URLs in the user's preferred desktop application. Attackers may use this command to trick users into opening malicious documents or URLs to gain access to the target system.
T1204,T1204.001,T1204.002,T1204.004 - Yum/DNF Plugin Status Discovery source low: This rule detects the execution of the
grepcommand with thepluginsargument on Linux systems. This command is used to search for YUM/DNF configurations and/or plugins with an enabled state. This behavior may indicate an attacker is attempting to establish persistence in a YUM or DNF plugin.T1082,T1083,T1518
Kusto #
- Sentinel One - Admin login from new location source high: 'Detects admin user login from new location (IP address).'
T1078 - Sentinel One - Agent uninstalled from multiple hosts source high: 'Detects when agent was uninstalled from multiple hosts.'
T1070 - Sentinel One - Alert from custom rule source high: 'Detects when alert from custom rule received.'
T1190 - Sentinel One - Blacklist hash deleted source medium: 'Detects when blacklist hash was deleted.'
T1070 - Sentinel One - Exclusion added source medium: 'Detects when new exclusion added.'
T1070 - Sentinel One - Multiple alerts on host source high: 'Detects when multiple alerts received from same host.'
T1190 - Sentinel One - New admin created source medium: 'Detects when new admin user is created.'
T1078 - Sentinel One - Rule deleted source medium: 'Detects when a rule was deleted.'
T1070 - Sentinel One - Rule disabled source medium: 'Detects when a rule was disabled.'
T1070 - Sentinel One - Same custom rule triggered on different hosts source high: 'Detects when same custom rule was triggered on different hosts.'
T1190,T1210
Show 1 more
- Sentinel One - User viewed agent's passphrase source medium: 'Detects when a user viewed agent's passphrase.'
T1555
Panther #
- SentinelOne Threats source medium: Passthrough SentinelOne Threats
YARA-L #
- Hash Prevalence source low: Correlate process events with hashes that have a low rolling max over the past 10 days
- MITRE ATT&CK T1053.005 Windows Creation Of Scheduled Task source info: Creation of scheduled task using command line
T1053,T1053.005 - MITRE ATT&CK T1570 Suspicious Command PSExec source info: Command-line execution of the PsExec tool on Windows
T1570
Other Index Content
This content is indexed for research but excluded from the detection-rule headline.Elastic #
Panther #
Compatible Rules
These rules declare SentinelOne connector or schema compatibility without a product-specific query filter.Kusto #
T1490T1547T1112, T1547T1685T1685T1027, T1059