detection.wiki

Elastic Inferred Detection Coverage

954 inferred rule mappings across 46 events and 2 providers, covering 398 unique Elastic detection rules.

Most Elastic detection rules don't explicitly filter by Windows event ID. Instead, they query using EQL event categories (like process where or file where) or match on fields that only appear in specific event types. This embeds the connection between a rule and the Windows events it operates on in the query logic rather than stating it directly.

To surface these relationships, this analysis parses each rule's query into an abstract syntax tree and extracts the EQL categories and field names it references. Where a category or field maps to a known set of Windows events, the mappings below link the rule to those events — answering the question: if I collect this Windows event, which Elastic rules could use it as a data source?

For rules that do explicitly reference event IDs, see the Elastic Detection Rules Reference.

Confidence levels

Rules group by inference method so you can see exactly which EQL category or field name links each rule to the event.

Microsoft-Windows-Security-Auditing (32 events, 264 rules) #

Channel: Security Event ID 4610: An authentication package has been loaded by the Local Security Authority. (4 low)

Shared field: AuthenticationPackageNamelow confidence — 4 rules
Potential Computer Account NTLM Relay ActivitymediumRelated:
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Potential Kerberos Relay Attack against a Computer AccounthighRelated:
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Potential NTLM Relay Attack against a Computer AccounthighRelated:
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Service Creation via Local Kerberos AuthenticationhighRelated:
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.

Channel: Security Event ID 4611: A trusted logon process has been registered with the Local Security Authority. (4 low)

Shared field: LogonProcessNamelow confidence — 4 rules
Potential Pass-the-Hash (PtH) AttemptmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4649: A replay attack was detected.
Process Creation via Secondary LogonmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4688: A new process has been created.
  • Security-Auditing 4649: A replay attack was detected.
Interactive Logon by an Unusual ProcesshighRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4649: A replay attack was detected.
First Time Seen NewCredentials Logon ProcessmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4649: A replay attack was detected.

Channel: Security Event ID 4624: An account was successfully logged on. (6 medium, 2 low)

EQL category authentication wheremedium confidence — 6 rules
Multiple Logon Failure Followed by Logon SuccessmediumRelated:
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Suspicious Kerberos Authentication Ticket RequesthighRelated:
  • Sysmon 3: Network connection
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Remote Windows Service InstalledmediumRelated:
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Account Password Reset RemotelymediumRelated:
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Process Creation via Secondary LogonmediumRelated:
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4688: A new process has been created.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.
Interactive Logon by an Unusual ProcesshighRelated:
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.
Shared field: LogonProcessNamelow confidence — 2 rules
Potential Pass-the-Hash (PtH) AttemptmediumRelated:
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.
First Time Seen NewCredentials Logon ProcessmediumRelated:
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.

Channel: Security Event ID 4625: An account failed to log on. (7 medium)

EQL category authentication wheremedium confidence — 7 rules
Multiple Logon Failure Followed by Logon SuccessmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Suspicious Kerberos Authentication Ticket RequesthighRelated:
  • Sysmon 3: Network connection
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Remote Windows Service InstalledmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Account Password Reset RemotelymediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Process Creation via Secondary LogonmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4688: A new process has been created.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.
Service Creation via Local Kerberos AuthenticationhighRelated:
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Interactive Logon by an Unusual ProcesshighRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.

Channel: Security Event ID 4634: An account was logged off. (10 medium)

EQL category authentication wheremedium confidence — 10 rules
Multiple Logon Failure Followed by Logon SuccessmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Potential Computer Account NTLM Relay ActivitymediumRelated:
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Potential Kerberos Relay Attack against a Computer AccounthighRelated:
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Potential NTLM Relay Attack against a Computer AccounthighRelated:
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Suspicious Kerberos Authentication Ticket RequesthighRelated:
  • Sysmon 3: Network connection
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Remote Windows Service InstalledmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Account Password Reset RemotelymediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Process Creation via Secondary LogonmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4688: A new process has been created.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.
Service Creation via Local Kerberos AuthenticationhighRelated:
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Interactive Logon by an Unusual ProcesshighRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.

Channel: Security Event ID 4647: User initiated logoff. (10 medium)

EQL category authentication wheremedium confidence — 10 rules
Multiple Logon Failure Followed by Logon SuccessmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Potential Computer Account NTLM Relay ActivitymediumRelated:
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Potential Kerberos Relay Attack against a Computer AccounthighRelated:
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Potential NTLM Relay Attack against a Computer AccounthighRelated:
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Suspicious Kerberos Authentication Ticket RequesthighRelated:
  • Sysmon 3: Network connection
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Remote Windows Service InstalledmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Account Password Reset RemotelymediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
Process Creation via Secondary LogonmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4688: A new process has been created.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.
Service Creation via Local Kerberos AuthenticationhighRelated:
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Interactive Logon by an Unusual ProcesshighRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.

Channel: Security Event ID 4648: A logon was attempted using explicit credentials. (10 medium)

EQL category authentication wheremedium confidence — 10 rules
Multiple Logon Failure Followed by Logon SuccessmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
Potential Computer Account NTLM Relay ActivitymediumRelated:
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Potential Kerberos Relay Attack against a Computer AccounthighRelated:
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Potential NTLM Relay Attack against a Computer AccounthighRelated:
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Suspicious Kerberos Authentication Ticket RequesthighRelated:
  • Sysmon 3: Network connection
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
Remote Windows Service InstalledmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
Account Password Reset RemotelymediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
Process Creation via Secondary LogonmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4688: A new process has been created.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.
Service Creation via Local Kerberos AuthenticationhighRelated:
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4610: An authentication package has been loaded by the Local Security Authority.
Interactive Logon by an Unusual ProcesshighRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.

Channel: Security Event ID 4649: A replay attack was detected. (4 low)

Shared field: LogonProcessNamelow confidence — 4 rules
Potential Pass-the-Hash (PtH) AttemptmediumRelated:
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4624: An account was successfully logged on.
Process Creation via Secondary LogonmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4688: A new process has been created.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
Interactive Logon by an Unusual ProcesshighRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
First Time Seen NewCredentials Logon ProcessmediumRelated:
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4624: An account was successfully logged on.

Channel: Security Event ID 4657: A registry value was modified. (3 low)

Shared field: OperationTypelow confidence — 3 rules
User account exposed to KerberoastingmediumRelated:
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Account Configured with Never-Expiring PasswordmediumRelated:
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
  • Security-Auditing 5137: A directory service object was created.
  • Security-Auditing 5141: A directory service object was deleted.
Modification of the msPKIAccountCredentialsmediumRelated:
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 4659: A handle to an object was requested with intent to delete. (2 low)

Shared field: AccessListlow confidence — 2 rules
Startup/Logon Script added to Group Policy ObjectmediumRelated:
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPOmediumRelated:
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 4661: A handle to an object was requested. (4 low)

Shared field: Propertieslow confidence — 4 rules
FirstTime Seen Account Performing DCSynchigh
Potential Credential Access via DCSyncmedium
Access to a Sensitive LDAP Attributemedium
Suspicious Access to LDAP Attributeslow

Channel: Security Event ID 4663: An attempt was made to access an object. (2 low)

Shared field: AccessListlow confidence — 2 rules
Startup/Logon Script added to Group Policy ObjectmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPOmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 4688: A new process has been created. (133 medium)

EQL category process where → start medium confidence — 133 rules
Curl or Wget Spawned via Node.jsmediumRelated:
  • Sysmon 1: Process creation
Potential Traffic Tunneling using QEMUmediumRelated:
  • Sysmon 1: Process creation
Potential Secret Scanning via GitleaksmediumRelated:
  • Sysmon 1: Process creation
Credential Access via TruffleHog ExecutionmediumRelated:
  • Sysmon 1: Process creation
Data Encrypted via OpenSSL UtilitylowRelated:
  • Sysmon 1: Process creation
Kubernetes Direct API Request via Curl or WgetmediumRelated:
  • Sysmon 1: Process creation
Remote GitHub Actions Runner RegistrationmediumRelated:
  • Sysmon 1: Process creation
Execution via GitHub Actions RunnermediumRelated:
  • Sysmon 1: Process creation
Potential Data Exfiltration Through CurlmediumRelated:
  • Sysmon 1: Process creation
Exporting Exchange Mailbox via PowerShellmediumRelated:
  • Sysmon 1: Process creation
Potential File Transfer via CertreqmediumRelated:
  • Sysmon 1: Process creation
Potential DNS Tunneling via NsLookupmediumRelated:
  • Sysmon 1: Process creation
Potential File Download via a Headless BrowserhighRelated:
  • Sysmon 1: Process creation
Potential Remote Desktop Tunneling DetectedhighRelated:
  • Sysmon 1: Process creation
Remote File Download via Desktopimgdownldr UtilitymediumRelated:
  • Sysmon 1: Process creation
Show all 133 rules (118 more)
Remote File Download via MpCmdRunmediumRelated:
  • Sysmon 1: Process creation
Remote Management Access Launch After MSI InstallmediumRelated:
  • Sysmon 1: Process creation
NetSupport Manager Execution from an Unusual PathhighRelated:
  • Sysmon 1: Process creation
Suspicious ScreenConnect Client Child ProcessmediumRelated:
  • Sysmon 1: Process creation
Potential File Transfer via Curl for Windowslow
Potential Protocol Tunneling via CloudflaredmediumRelated:
  • Sysmon 1: Process creation
Attempt to Establish VScode Remote TunnelmediumRelated:
  • Sysmon 1: Process creation
Potential Protocol Tunneling via YuzemediumRelated:
  • Sysmon 1: Process creation
Suspicious Shell Execution via VelociraptormediumRelated:
  • Sysmon 1: Process creation
Browser Process Spawned from an Unusual ParenthighRelated:
  • Sysmon 1: Process creation
Potential Credential Access via Windows UtilitieshighRelated:
  • Sysmon 1: Process creation
NTDS or SAM Database File CopiedhighRelated:
  • Sysmon 1: Process creation
Credential Acquisition via Registry Hive DumpinghighRelated:
  • Sysmon 1: Process creation
Microsoft IIS Connection Strings DecryptionhighRelated:
  • Sysmon 1: Process creation
Potential Local NTLM Relay via HTTPhighRelated:
  • Sysmon 1: Process creation
Searching for Saved Credentials via VaultCmdmediumRelated:
  • Sysmon 1: Process creation
Symbolic Link to Shadow Copy CreatedmediumRelated:
  • Sysmon 1: Process creation
Potential Veeam Credential Access CommandmediumRelated:
  • Sysmon 1: Process creation
NTDS Dump via WbadminmediumRelated:
  • Sysmon 1: Process creation
Wireless Credential Dumping using Netsh CommandhighRelated:
  • Sysmon 1: Process creation
Adding Hidden File Attribute via AttriblowRelated:
  • Sysmon 1: Process creation
Clearing Windows Console HistorymediumRelated:
  • Sysmon 1: Process creation
Clearing Windows Event LogslowRelated:
  • Sysmon 1: Process creation
Code Signing Policy Modification Through Built-in toolsmediumRelated:
  • Sysmon 1: Process creation
Windows Defender Exclusions Added via PowerShellmediumRelated:
  • Sysmon 1: Process creation
Delete Volume USN Journal with FsutillowRelated:
  • Sysmon 1: Process creation
Disable Windows Firewall Rules via NetshmediumRelated:
  • Sysmon 1: Process creation
Disabling Windows Defender Security Settings via PowerShellmediumRelated:
  • Sysmon 1: Process creation
Disable Windows Event and Security Logs Using Built-in ToolslowRelated:
  • Sysmon 1: Process creation
Suspicious .NET Code CompilationmediumRelated:
  • Sysmon 1: Process creation
Remote Desktop Enabled in Windows Firewall by NetshmediumRelated:
  • Sysmon 1: Process creation
Enable Host Network Discovery via NetshmediumRelated:
  • Sysmon 1: Process creation
Control Panel Process with Unusual ArgumentshighRelated:
  • Sysmon 1: Process creation
ImageLoad via Windows Update Auto Update ClientmediumRelated:
  • Sysmon 1: Process creation
Microsoft Build Engine Started by an Office ApplicationhighRelated:
  • Sysmon 1: Process creation
Microsoft Build Engine Started by a System ProcessmediumRelated:
  • Sysmon 1: Process creation
Process Execution from an Unusual DirectorymediumRelated:
  • Sysmon 1: Process creation
IIS HTTP Logging DisabledhighRelated:
  • Sysmon 1: Process creation
Proxy Execution via Console Window HosthighRelated:
  • Sysmon 1: Process creation
Command Execution via ForFilesmediumRelated:
  • Sysmon 1: Process creation
Proxy Execution via Windows OpenSSHhighRelated:
  • Sysmon 1: Process creation
Execution via Windows Command Debugging UtilitymediumRelated:
  • Sysmon 1: Process creation
Suspicious Endpoint Security Parent ProcessmediumRelated:
  • Sysmon 1: Process creation
Program Files Directory MasqueradingmediumRelated:
  • Sysmon 1: Process creation
System File Ownership ChangemediumRelated:
  • Sysmon 1: Process creation
Suspicious Microsoft HTML Application Child ProcesshighRelated:
  • Sysmon 1: Process creation
Potential Remote Install via MsiExechighRelated:
  • Sysmon 1: Process creation
Command Obfuscation via Unicode Modifier LettershighRelated:
  • Sysmon 1: Process creation
Windows Firewall Disabled via PowerShellmediumRelated:
  • Sysmon 1: Process creation
Script Execution via Microsoft HTML ApplicationhighRelated:
  • Sysmon 1: Process creation
Suspicious CertUtil CommandsmediumRelated:
  • Sysmon 1: Process creation
Suspicious Zoom Child ProcessmediumRelated:
  • Sysmon 1: Process creation
Unusual Child Process from a System Virtual ProcesshighRelated:
  • Sysmon 1: Process creation
Potential Evasion via Filter ManagermediumRelated:
  • Sysmon 1: Process creation
Signed Proxy Execution via MS Work FoldersmediumRelated:
  • Sysmon 1: Process creation
Execution via Windows Subsystem for LinuxmediumRelated:
  • Sysmon 1: Process creation
Windows Subsystem for Linux Enabled via Dism UtilitymediumRelated:
  • Sysmon 1: Process creation
Attempt to Install Kali Linux via WSLhighRelated:
  • Sysmon 1: Process creation
Active Directory Discovery using AdExplorerlowRelated:
  • Sysmon 1: Process creation
AdFind Command ActivitylowRelated:
  • Sysmon 1: Process creation
Enumeration of Administrator Accountslow
Enumerating Domain Trusts via DSQUERY.EXElowRelated:
  • Sysmon 1: Process creation
Enumerating Domain Trusts via NLTEST.EXElowRelated:
  • Sysmon 1: Process creation
Group Policy Discovery via Microsoft GPResult UtilitylowRelated:
  • Sysmon 1: Process creation
Peripheral Device DiscoverylowRelated:
  • Sysmon 1: Process creation
Whoami Process Activitylow
Command Execution via SolarWinds ProcessmediumRelated:
  • Sysmon 1: Process creation
Execution of COM object via XwizardmediumRelated:
  • Sysmon 1: Process creation
Enumeration Command Spawned via WMIPrvSElowRelated:
  • Sysmon 1: Process creation
Execution from Unusual Directory - Command LinemediumRelated:
  • Sysmon 1: Process creation
Potential Foxmail ExploitationhighRelated:
  • Sysmon 1: Process creation
Mofcomp Activitylow
Suspicious Execution with NodeJShighRelated:
  • Sysmon 1: Process creation
Command and Scripting Interpreter via Windows ScriptshighRelated:
  • Sysmon 1: Process creation
Suspicious Execution from a WebDav SharehighRelated:
  • Sysmon 1: Process creation
Windows Script Execution from ArchivemediumRelated:
  • Sysmon 1: Process creation
Suspicious JavaScript Execution via DenohighRelated:
  • Sysmon 1: Process creation
Suspicious Cmd Execution via WMIhighRelated:
  • Sysmon 1: Process creation
Suspicious PDF Reader Child ProcesslowRelated:
  • Sysmon 1: Process creation
Process Activity via Compiled HTML FilemediumRelated:
  • Sysmon 1: Process creation
Microsoft Management Console File from Unusual PathmediumRelated:
  • Sysmon 1: Process creation
Suspicious Windows Command Shell ArgumentshighRelated:
  • Sysmon 1: Process creation
Potential Fake CAPTCHA Phishing AttackhighRelated:
  • Sysmon 1: Process creation
Suspicious Windows Powershell ArgumentsmediumRelated:
  • Sysmon 1: Process creation
Potential Data Exfiltration via RclonemediumRelated:
  • Sysmon 1: Process creation
Backup Deletion with WbadminlowRelated:
  • Sysmon 1: Process creation
Modification of Boot ConfigurationlowRelated:
  • Sysmon 1: Process creation
Volume Shadow Copy Deleted or Resized via VssAdminhighRelated:
  • Sysmon 1: Process creation
Volume Shadow Copy Deletion via PowerShellhighRelated:
  • Sysmon 1: Process creation
Volume Shadow Copy Deletion via WMIChighRelated:
  • Sysmon 1: Process creation
Suspicious Execution from INET CachehighRelated:
  • Sysmon 1: Process creation
Suspicious JetBrains TeamCity Child ProcessmediumRelated:
  • Sysmon 1: Process creation
Remote Desktop File Opened from Suspicious PathmediumRelated:
  • Sysmon 1: Process creation
Microsoft Exchange Server UM Spawning Suspicious ProcessesmediumRelated:
  • Sysmon 1: Process creation
Suspicious MS Office Child ProcessmediumRelated:
  • Sysmon 1: Process creation
Suspicious MS Outlook Child ProcesslowRelated:
  • Sysmon 1: Process creation
ScreenConnect Server Spawning Suspicious ProcesseshighRelated:
  • Sysmon 1: Process creation
Execution via TSClient MountpointhighRelated:
  • Sysmon 1: Process creation
Mounting Hidden or WebDav Remote SharesmediumRelated:
  • Sysmon 1: Process creation
Remote File Copy to a Hidden SharemediumRelated:
  • Sysmon 1: Process creation
Unusual Child Process of dns.exehighRelated:
  • Sysmon 1: Process creation
Potential WSUS Abuse for Lateral MovementmediumRelated:
  • Sysmon 1: Process creation
New ActiveSyncAllowedDeviceID Added via PowerShellmediumRelated:
  • Sysmon 1: Process creation
System Shells via ServicesmediumRelated:
  • Sysmon 1: Process creation
User Account CreationlowRelated:
  • Sysmon 1: Process creation
Potential Application Shimming via SdbinstlowRelated:
  • Sysmon 1: Process creation
Persistence via TelemetryController Scheduled Task HijackhighRelated:
  • Sysmon 1: Process creation
Persistence via Update Orchestrator Service HijackhighRelated:
  • Sysmon 1: Process creation
Persistence via WMI Event SubscriptionlowRelated:
  • Sysmon 1: Process creation
Process Creation via Secondary LogonmediumRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
  • Security-Auditing 4611: A trusted logon process has been registered with the Local Security Authority.
  • Security-Auditing 4649: A replay attack was detected.
Privilege Escalation via Named Pipe ImpersonationhighRelated:
  • Sysmon 1: Process creation
Service Control Spawned via Script Interpreterlow
UAC Bypass via DiskCleanup Scheduled Task HijackmediumRelated:
  • Sysmon 1: Process creation
Bypass UAC via Event ViewerhighRelated:
  • Sysmon 1: Process creation
UAC Bypass Attempt via Windows Directory MasqueradinghighRelated:
  • Sysmon 1: Process creation
Potential Exploitation of an Unquoted Service Path VulnerabilitylowRelated:
  • Sysmon 1: Process creation
Unusual Parent-Child RelationshipmediumRelated:
  • Sysmon 1: Process creation
Unusual Print Spooler Child Processmedium

Channel: Security Event ID 4691: Indirect access to an object was requested. (2 low)

Shared field: AccessListlow confidence — 2 rules
Startup/Logon Script added to Group Policy ObjectmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPOmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 4700: A scheduled task was enabled. (4 low)

Shared field: RpcCallClientLocalitylow confidence — 1 rule
Remote Scheduled Task Creation via RPCmediumRelated:
  • Security-Auditing 4701: A scheduled task was disabled.
Shared field: TaskNamelow confidence — 2 rules
A scheduled task was createdlowRelated:
  • Security-Auditing 4701: A scheduled task was disabled.
Temporarily Scheduled Task CreationmediumRelated:
  • Security-Auditing 4701: A scheduled task was disabled.
Shared field: ParentProcessIdlow confidence — 1 rule
Windows Service Installed via an Unusual ClienthighRelated:
  • Security-Auditing 4701: A scheduled task was disabled.
  • Sysmon 1: Process creation

Channel: Security Event ID 4701: A scheduled task was disabled. (4 low)

Shared field: RpcCallClientLocalitylow confidence — 1 rule
Remote Scheduled Task Creation via RPCmediumRelated:
  • Security-Auditing 4700: A scheduled task was enabled.
Shared field: TaskNamelow confidence — 2 rules
A scheduled task was createdlowRelated:
  • Security-Auditing 4700: A scheduled task was enabled.
Temporarily Scheduled Task CreationmediumRelated:
  • Security-Auditing 4700: A scheduled task was enabled.
Shared field: ParentProcessIdlow confidence — 1 rule
Windows Service Installed via an Unusual ClienthighRelated:
  • Security-Auditing 4700: A scheduled task was enabled.
  • Sysmon 1: Process creation

Channel: Security Event ID 4720: A user account was created. (1 low)

Shared field: AllowedToDelegateTolow confidence — 1 rule
KRBTGT Delegation BackdoorhighRelated:
  • Security-Auditing 4741: A computer account was created.
  • Security-Auditing 4742: A computer account was changed.

Channel: Security Event ID 4741: A computer account was created. (1 low)

Shared field: AllowedToDelegateTolow confidence — 1 rule
KRBTGT Delegation BackdoorhighRelated:
  • Security-Auditing 4720: A user account was created.
  • Security-Auditing 4742: A computer account was changed.

Channel: Security Event ID 4742: A computer account was changed. (1 low)

Shared field: AllowedToDelegateTolow confidence — 1 rule
KRBTGT Delegation BackdoorhighRelated:
  • Security-Auditing 4720: A user account was created.
  • Security-Auditing 4741: A computer account was created.

Channel: Security Event ID 4798: A user's local group membership was enumerated. (1 low)

Shared field: CallerProcessNamelow confidence — 1 rule
Enumeration of Privileged Local Groups MembershipmediumRelated:
  • Security-Auditing 4799: A security-enabled local group membership was enumerated.
  • Security-Auditing 5050: An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE) interface was rejected.

Channel: Security Event ID 4799: A security-enabled local group membership was enumerated. (1 low)

Shared field: CallerProcessNamelow confidence — 1 rule
Enumeration of Privileged Local Groups MembershipmediumRelated:
  • Security-Auditing 4798: A user's local group membership was enumerated.
  • Security-Auditing 5050: An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE) interface was rejected.

Channel: Security Event ID 5050: An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE) interface was rejected. (1 low)

Shared field: CallerProcessNamelow confidence — 1 rule
Enumeration of Privileged Local Groups MembershipmediumRelated:
  • Security-Auditing 4798: A user's local group membership was enumerated.
  • Security-Auditing 4799: A security-enabled local group membership was enumerated.

Channel: Security Event ID 5136: A directory service object was modified. (3 low)

Shared field: ObjectDNlow confidence — 3 rules
Potential ADIDNS Poisoning via Wildcard Record CreationhighRelated:
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Potential WPAD Spoofing via DNS Record CreationmediumRelated:
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Potential Kerberos Coercion via DNS-Based SPN SpoofinghighRelated:
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5137: A directory service object was created. (2 low)

Shared field: ObjectDNlow confidence — 2 rules
AdminSDHolder BackdoorhighRelated:
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Account Configured with Never-Expiring PasswordmediumRelated:
  • Security-Auditing 4657: A registry value was modified.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
  • Security-Auditing 5141: A directory service object was deleted.

Channel: Security Event ID 5140: A network share object was accessed. (2 low)

Shared field: AccessListlow confidence — 2 rules
Startup/Logon Script added to Group Policy ObjectmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPOmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5141: A directory service object was deleted. (5 low)

Shared field: ObjectDNlow confidence — 5 rules
Potential ADIDNS Poisoning via Wildcard Record CreationhighRelated:
  • Security-Auditing 5136: A directory service object was modified.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Potential WPAD Spoofing via DNS Record CreationmediumRelated:
  • Security-Auditing 5136: A directory service object was modified.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Potential Kerberos Coercion via DNS-Based SPN SpoofinghighRelated:
  • Security-Auditing 5136: A directory service object was modified.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
AdminSDHolder BackdoorhighRelated:
  • Security-Auditing 5137: A directory service object was created.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Account Configured with Never-Expiring PasswordmediumRelated:
  • Security-Auditing 4657: A registry value was modified.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
  • Security-Auditing 5137: A directory service object was created.

Channel: Security Event ID 5142: A network share object was added. (2 low)

Shared field: ShareNamelow confidence — 2 rules
Startup/Logon Script added to Group Policy ObjectmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPOmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5143: A network share object was modified. (2 low)

Shared field: ShareNamelow confidence — 2 rules
Startup/Logon Script added to Group Policy ObjectmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPOmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5144: A network share object was deleted. (2 low)

Shared field: ShareNamelow confidence — 2 rules
Startup/Logon Script added to Group Policy ObjectmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPOmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5169: A directory service object was modified. (14 low)

Shared field: ObjectDNlow confidence — 4 rules
Potential ADIDNS Poisoning via Wildcard Record CreationhighRelated:
  • Security-Auditing 5136: A directory service object was modified.
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Potential WPAD Spoofing via DNS Record CreationmediumRelated:
  • Security-Auditing 5136: A directory service object was modified.
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Potential Kerberos Coercion via DNS-Based SPN SpoofinghighRelated:
  • Security-Auditing 5136: A directory service object was modified.
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
AdminSDHolder BackdoorhighRelated:
  • Security-Auditing 5137: A directory service object was created.
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Shared field: AttributeLDAPDisplayNamelow confidence — 7 rules
Potential Active Directory Replication Account BackdoormediumRelated:
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Potential Shadow Credentials added to AD ObjecthighRelated:
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
AdminSDHolder SDProp Exclusion AddedhighRelated:
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Delegated Managed Service Account Modification by an Unusual UserhighRelated:
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Startup/Logon Script added to Group Policy ObjectmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Group Policy Abuse for Privilege AdditionhighRelated:
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Scheduled Task Execution at Scale via GPOmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Shared field: OperationTypelow confidence — 3 rules
User account exposed to KerberoastingmediumRelated:
  • Security-Auditing 4657: A registry value was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
Account Configured with Never-Expiring PasswordmediumRelated:
  • Security-Auditing 4657: A registry value was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.
  • Security-Auditing 5137: A directory service object was created.
  • Security-Auditing 5141: A directory service object was deleted.
Modification of the msPKIAccountCredentialsmediumRelated:
  • Security-Auditing 4657: A registry value was modified.
  • Security-Auditing 5170: A directory service object was modified during a background cleanup task.

Channel: Security Event ID 5170: A directory service object was modified during a background cleanup task. (14 low)

Shared field: ObjectDNlow confidence — 4 rules
Potential ADIDNS Poisoning via Wildcard Record CreationhighRelated:
  • Security-Auditing 5136: A directory service object was modified.
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
Potential WPAD Spoofing via DNS Record CreationmediumRelated:
  • Security-Auditing 5136: A directory service object was modified.
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
Potential Kerberos Coercion via DNS-Based SPN SpoofinghighRelated:
  • Security-Auditing 5136: A directory service object was modified.
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
AdminSDHolder BackdoorhighRelated:
  • Security-Auditing 5137: A directory service object was created.
  • Security-Auditing 5141: A directory service object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
Shared field: AttributeLDAPDisplayNamelow confidence — 7 rules
Potential Active Directory Replication Account BackdoormediumRelated:
  • Security-Auditing 5169: A directory service object was modified.
Potential Shadow Credentials added to AD ObjecthighRelated:
  • Security-Auditing 5169: A directory service object was modified.
AdminSDHolder SDProp Exclusion AddedhighRelated:
  • Security-Auditing 5169: A directory service object was modified.
Delegated Managed Service Account Modification by an Unusual UserhighRelated:
  • Security-Auditing 5169: A directory service object was modified.
Startup/Logon Script added to Group Policy ObjectmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
Group Policy Abuse for Privilege AdditionhighRelated:
  • Security-Auditing 5169: A directory service object was modified.
Scheduled Task Execution at Scale via GPOmediumRelated:
  • Security-Auditing 4659: A handle to an object was requested with intent to delete.
  • Security-Auditing 4663: An attempt was made to access an object.
  • Security-Auditing 4691: Indirect access to an object was requested.
  • Security-Auditing 5140: A network share object was accessed.
  • Security-Auditing 5142: A network share object was added.
  • Security-Auditing 5143: A network share object was modified.
  • Security-Auditing 5144: A network share object was deleted.
  • Security-Auditing 5169: A directory service object was modified.
Shared field: OperationTypelow confidence — 3 rules
User account exposed to KerberoastingmediumRelated:
  • Security-Auditing 4657: A registry value was modified.
  • Security-Auditing 5169: A directory service object was modified.
Account Configured with Never-Expiring PasswordmediumRelated:
  • Security-Auditing 4657: A registry value was modified.
  • Security-Auditing 5169: A directory service object was modified.
  • Security-Auditing 5137: A directory service object was created.
  • Security-Auditing 5141: A directory service object was deleted.
Modification of the msPKIAccountCredentialsmediumRelated:
  • Security-Auditing 4657: A registry value was modified.
  • Security-Auditing 5169: A directory service object was modified.

Channel: Security Event ID 5380: Vault Find Credential. (1 low)

Shared field: SchemaFriendlyNamelow confidence — 1 rule
Multiple Vault Web Credentials Readmedium

Microsoft-Windows-Sysmon (14 events, 690 rules) #

Channel: Operational Event ID 1: Process creation (229 medium, 1 low)

EQL category process where → start medium confidence — 209 rules
Curl or Wget Spawned via Node.jsmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Traffic Tunneling using QEMUmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Secret Scanning via GitleaksmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Credential Access via TruffleHog ExecutionmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Data Encrypted via OpenSSL UtilitylowRelated:
  • Security-Auditing 4688: A new process has been created.
Elastic Agent Service Terminatedmedium
ROT Encoded Python Script ExecutionmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
GenAI Process Compiling or Generating Executablesmedium
GenAI Process Performing Encoding/Chunking Prior to Network ActivitymediumRelated:
  • Sysmon 3: Network connection
Kubernetes Direct API Request via Curl or WgetmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Execution via OpenClaw Agentmedium
Remote GitHub Actions Runner RegistrationmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential SAP NetWeaver Exploitationhigh
Execution via GitHub Actions RunnermediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Data Exfiltration Through CurlmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Show all 209 rules (194 more)
Suspicious React Server Child Processhigh
Exporting Exchange Mailbox via PowerShellmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Encrypting Files with WinRar or 7zmedium
Potential File Transfer via CertreqmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential DNS Tunneling via NsLookupmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential File Download via a Headless BrowserhighRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Command and Control via Internet ExplorermediumRelated:
  • Sysmon 7: Image loaded
  • Sysmon 3: Network connection
Potential Remote Desktop Tunneling DetectedhighRelated:
  • Security-Auditing 4688: A new process has been created.
Remote File Download via Desktopimgdownldr UtilitymediumRelated:
  • Security-Auditing 4688: A new process has been created.
Remote File Download via MpCmdRunmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Remote Management Access Launch After MSI InstallmediumRelated:
  • Security-Auditing 4688: A new process has been created.
NetSupport Manager Execution from an Unusual PathhighRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious ScreenConnect Client Child ProcessmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Protocol Tunneling via CloudflaredmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Attempt to Establish VScode Remote TunnelmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Protocol Tunneling via YuzemediumRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Shell Execution via VelociraptormediumRelated:
  • Security-Auditing 4688: A new process has been created.
Browser Process Spawned from an Unusual ParenthighRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Credential Access via Windows UtilitieshighRelated:
  • Security-Auditing 4688: A new process has been created.
NTDS or SAM Database File CopiedhighRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Credential Access via Trusted Developer Utilityhigh
Credential Acquisition via Registry Hive DumpinghighRelated:
  • Security-Auditing 4688: A new process has been created.
Microsoft IIS Connection Strings DecryptionhighRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Local NTLM Relay via HTTPhighRelated:
  • Security-Auditing 4688: A new process has been created.
Searching for Saved Credentials via VaultCmdmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Symbolic Link to Shadow Copy CreatedmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Veeam Credential Access CommandmediumRelated:
  • Security-Auditing 4688: A new process has been created.
NTDS Dump via WbadminmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Wireless Credential Dumping using Netsh CommandhighRelated:
  • Security-Auditing 4688: A new process has been created.
Adding Hidden File Attribute via AttriblowRelated:
  • Security-Auditing 4688: A new process has been created.
Clearing Windows Console HistorymediumRelated:
  • Security-Auditing 4688: A new process has been created.
Clearing Windows Event LogslowRelated:
  • Security-Auditing 4688: A new process has been created.
Code Signing Policy Modification Through Built-in toolsmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Communication App Child Processmedium
Windows Defender Exclusions Added via PowerShellmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Delete Volume USN Journal with FsutillowRelated:
  • Security-Auditing 4688: A new process has been created.
Disable Windows Firewall Rules via NetshmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Disabling Windows Defender Security Settings via PowerShellmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Disable Windows Event and Security Logs Using Built-in ToolslowRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious .NET Code CompilationmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Remote Desktop Enabled in Windows Firewall by NetshmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Enable Host Network Discovery via NetshmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Control Panel Process with Unusual ArgumentshighRelated:
  • Security-Auditing 4688: A new process has been created.
ImageLoad via Windows Update Auto Update ClientmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Microsoft Build Engine Started by an Office ApplicationhighRelated:
  • Security-Auditing 4688: A new process has been created.
Microsoft Build Engine Started by a System ProcessmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Microsoft Build Engine Using an Alternate Namelow
Potential DLL Side-Loading via Trusted Microsoft Programsmedium
Suspicious Microsoft Antimalware Service Executionhigh
Process Execution from an Unusual DirectorymediumRelated:
  • Security-Auditing 4688: A new process has been created.
IIS HTTP Logging DisabledhighRelated:
  • Security-Auditing 4688: A new process has been created.
Proxy Execution via Console Window HosthighRelated:
  • Security-Auditing 4688: A new process has been created.
Command Execution via ForFilesmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Proxy Execution via Windows OpenSSHhighRelated:
  • Security-Auditing 4688: A new process has been created.
InstallUtil Process Making Network ConnectionsmediumRelated:
  • Sysmon 3: Network connection
Execution via Windows Command Debugging UtilitymediumRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Endpoint Security Parent ProcessmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Masquerading as Business App Installerlow
Potential Masquerading as Communication Appsmedium
Renamed Automation Script Interpreterhigh
Suspicious WerFault Child Processmedium
Program Files Directory MasqueradingmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Windows Error Manager MasqueradingmediumRelated:
  • Sysmon 3: Network connection
Network Connection via Signed BinarylowRelated:
  • Sysmon 3: Network connection
System File Ownership ChangemediumRelated:
  • Security-Auditing 4688: A new process has been created.
MsBuild Making Network ConnectionsmediumRelated:
  • Sysmon 3: Network connection
Mshta Making Network ConnectionsmediumRelated:
  • Sysmon 3: Network connection
Suspicious Microsoft HTML Application Child ProcesshighRelated:
  • Security-Auditing 4688: A new process has been created.
MsiExec Service Child Process With Network ConnectionmediumRelated:
  • Sysmon 3: Network connection
Potential Remote Install via MsiExechighRelated:
  • Security-Auditing 4688: A new process has been created.
Network Connection via MsXsllowRelated:
  • Sysmon 3: Network connection
Unusual Network Activity from a Windows System BinarymediumRelated:
  • Sysmon 3: Network connection
Command Obfuscation via Unicode Modifier LettershighRelated:
  • Security-Auditing 4688: A new process has been created.
Parent Process PID Spoofinghigh
Windows Firewall Disabled via PowerShellmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Microsoft Diagnostics Wizard Executionhigh
Windows Sandbox with Sensitive Configurationmedium
Unusual Child Processes of RunDLL32high
Service DACL Modification via sc.exemedium
Script Execution via Microsoft HTML ApplicationhighRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious CertUtil CommandsmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Execution from a Mounted Devicemedium
Renamed Utility Executed with Short Program Namemedium
Suspicious WMIC XSL Script Executionmedium
Suspicious Zoom Child ProcessmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Unusual Process Execution Path - Alternate Data Streammedium
Unusual Network Connection via DllHostmediumRelated:
  • Sysmon 3: Network connection
Unusual Network Connection via RunDLL32mediumRelated:
  • Sysmon 3: Network connection
Unusual Process Network ConnectionlowRelated:
  • Sysmon 3: Network connection
Unusual Child Process from a System Virtual ProcesshighRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Evasion via Filter ManagermediumRelated:
  • Security-Auditing 4688: A new process has been created.
Signed Proxy Execution via MS Work FoldersmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Execution via Windows Subsystem for Linuxlow
Execution via Windows Subsystem for LinuxmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Windows Subsystem for Linux Enabled via Dism UtilitymediumRelated:
  • Security-Auditing 4688: A new process has been created.
Host File System Changes via Windows Subsystem for LinuxmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Attempt to Install Kali Linux via WSLhighRelated:
  • Security-Auditing 4688: A new process has been created.
Active Directory Discovery using AdExplorerlowRelated:
  • Security-Auditing 4688: A new process has been created.
AdFind Command ActivitylowRelated:
  • Security-Auditing 4688: A new process has been created.
Enumerating Domain Trusts via DSQUERY.EXElowRelated:
  • Security-Auditing 4688: A new process has been created.
Enumerating Domain Trusts via NLTEST.EXElowRelated:
  • Security-Auditing 4688: A new process has been created.
Group Policy Discovery via Microsoft GPResult UtilitylowRelated:
  • Security-Auditing 4688: A new process has been created.
Peripheral Device DiscoverylowRelated:
  • Security-Auditing 4688: A new process has been created.
Command Execution via SolarWinds ProcessmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious SolarWinds Child Processmedium
Execution of COM object via XwizardmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Command Prompt Network ConnectionlowRelated:
  • Sysmon 3: Network connection
Unusual Parent Process for cmd.exemedium
Command Shell Activity Started via RunDLL32low
Enumeration Command Spawned via WMIPrvSElowRelated:
  • Security-Auditing 4688: A new process has been created.
Execution from Unusual Directory - Command LinemediumRelated:
  • Security-Auditing 4688: A new process has been created.
Network Connection via Compiled HTML FilelowRelated:
  • Sysmon 3: Network connection
Potential Foxmail ExploitationhighRelated:
  • Security-Auditing 4688: A new process has been created.
Unusual Execution via Microsoft Common Console Filehigh
Execution of File Written or Modified by Microsoft OfficehighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Execution with NodeJShighRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Notepad Markdown RCE Exploitationhigh
Command and Scripting Interpreter via Windows ScriptshighRelated:
  • Security-Auditing 4688: A new process has been created.
PsExec Network ConnectionlowRelated:
  • Sysmon 3: Network connection
Potential Command Shell via NetCathigh
Suspicious Execution from a WebDav SharehighRelated:
  • Security-Auditing 4688: A new process has been created.
Windows Script Execution from ArchivemediumRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious JavaScript Execution via DenohighRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Cmd Execution via WMIhighRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious PDF Reader Child ProcesslowRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Process Execution via Renamed PsExec Executablemedium
Process Activity via Compiled HTML FilemediumRelated:
  • Security-Auditing 4688: A new process has been created.
Conhost Spawned By Suspicious Parent Processhigh
Microsoft Management Console File from Unusual PathmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Windows Command Shell ArgumentshighRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Fake CAPTCHA Phishing AttackhighRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Execution via FileFix Phishing Attackhigh
Suspicious Windows Powershell ArgumentsmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Execution of a Downloaded Windows ScriptmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Data Exfiltration via RclonemediumRelated:
  • Security-Auditing 4688: A new process has been created.
Backup Deletion with WbadminlowRelated:
  • Security-Auditing 4688: A new process has been created.
Modification of Boot ConfigurationlowRelated:
  • Security-Auditing 4688: A new process has been created.
Volume Shadow Copy Deleted or Resized via VssAdminhighRelated:
  • Security-Auditing 4688: A new process has been created.
Volume Shadow Copy Deletion via PowerShellhighRelated:
  • Security-Auditing 4688: A new process has been created.
Volume Shadow Copy Deletion via WMIChighRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Execution from INET CachehighRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious Execution via Microsoft Office Add-Insmedium
Suspicious JetBrains TeamCity Child ProcessmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Remote Desktop File Opened from Suspicious PathmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Windows Script Executing PowerShelllow
Windows Script Interpreter Executing Process via WMImedium
Microsoft Exchange Server UM Spawning Suspicious ProcessesmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Microsoft Exchange Worker Spawning Suspicious Processeshigh
Suspicious MS Office Child ProcessmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Suspicious MS Outlook Child ProcesslowRelated:
  • Security-Auditing 4688: A new process has been created.
Windows Server Update Service Spawning Suspicious Processeshigh
Potential CVE-2025-33053 Exploitationhigh
Suspicious Explorer Child Processmedium
ScreenConnect Server Spawning Suspicious ProcesseshighRelated:
  • Security-Auditing 4688: A new process has been created.
Service Command Lateral MovementlowRelated:
  • Sysmon 3: Network connection
Incoming DCOM Lateral Movement via MSHTAhighRelated:
  • Sysmon 3: Network connection
Incoming DCOM Lateral Movement with MMChighRelated:
  • Sysmon 3: Network connection
Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindowsmediumRelated:
  • Sysmon 3: Network connection
SMB Connections via LOLBin or Untrusted ProcessmediumRelated:
  • Sysmon 3: Network connection
Execution via TSClient MountpointhighRelated:
  • Security-Auditing 4688: A new process has been created.
Remote Execution via File SharesmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Incoming Execution via WinRM Remote ShellmediumRelated:
  • Sysmon 3: Network connection
Mounting Hidden or WebDav Remote SharesmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Incoming Execution via PowerShell RemotingmediumRelated:
  • Sysmon 3: Network connection
Potential SharpRDP BehaviorhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Remote File Copy to a Hidden SharemediumRelated:
  • Security-Auditing 4688: A new process has been created.
Remotely Started Services via RPCmediumRelated:
  • Sysmon 3: Network connection
Unusual Child Process of dns.exehighRelated:
  • Security-Auditing 4688: A new process has been created.
Potential WSUS Abuse for Lateral MovementmediumRelated:
  • Security-Auditing 4688: A new process has been created.
New ActiveSyncAllowedDeviceID Added via PowerShellmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Modification of Accessibility Binarieshigh
Execution of Persistent Suspicious Programmedium
Startup Folder Persistence via Unsigned ProcessmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Execution via Scheduled Taskmedium
System Shells via ServicesmediumRelated:
  • Security-Auditing 4688: A new process has been created.
User Account CreationlowRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Application Shimming via SdbinstlowRelated:
  • Security-Auditing 4688: A new process has been created.
Persistence via BITS Job Notify Cmdlinemedium
Persistence via TelemetryController Scheduled Task HijackhighRelated:
  • Security-Auditing 4688: A new process has been created.
Persistence via Update Orchestrator Service HijackhighRelated:
  • Security-Auditing 4688: A new process has been created.
Persistence via WMI Event SubscriptionlowRelated:
  • Security-Auditing 4688: A new process has been created.
Potential Privilege Escalation via InstallerFileTakeOverhigh
Potential Escalation via Vulnerable MSI Repairhigh
Privilege Escalation via Named Pipe ImpersonationhighRelated:
  • Security-Auditing 4688: A new process has been created.
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interfacehigh
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installermedium
UAC Bypass via ICMLuaUtil Elevated COM Interfacehigh
UAC Bypass via DiskCleanup Scheduled Task HijackmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Bypass UAC via Event ViewerhighRelated:
  • Security-Auditing 4688: A new process has been created.
UAC Bypass Attempt via Windows Directory MasqueradinghighRelated:
  • Security-Auditing 4688: A new process has been created.
UAC Bypass via Windows Firewall Snap-In Hijackmedium
Potential Exploitation of an Unquoted Service Path VulnerabilitylowRelated:
  • Security-Auditing 4688: A new process has been created.
Unusual Parent-Child RelationshipmediumRelated:
  • Security-Auditing 4688: A new process has been created.
Unusual Service Host Child Process - Childless Servicemedium
EQL category process wheremedium confidence — 20 rules
Potential Cookies Theft via Browser DebuggingmediumRelated:
  • Sysmon 5: Process terminated
Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability ScorehighRelated:
  • Sysmon 5: Process terminated
Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability ScorelowRelated:
  • Sysmon 5: Process terminated
Suspicious Inter-Process Communication via OutlookmediumRelated:
  • Sysmon 5: Process terminated
Suspicious LSASS Access via MalSecLogonhighRelated:
  • Sysmon 5: Process terminated
  • Sysmon 8: CreateRemoteThread
Potential Credential Access via DuplicateHandle in LSASSmediumRelated:
  • Sysmon 5: Process terminated
Potential Credential Access via Renamed COM+ Services DLLhighRelated:
  • Sysmon 5: Process terminated
Suspicious Lsass Process AccessmediumRelated:
  • Sysmon 5: Process terminated
  • Sysmon 8: CreateRemoteThread
Potential Credential Access via LSASS Memory DumphighRelated:
  • Sysmon 5: Process terminated
  • Sysmon 8: CreateRemoteThread
Process Injection by the Microsoft Build EnginelowRelated:
  • Sysmon 5: Process terminated
Suspicious Process Access via Direct System CallhighRelated:
  • Sysmon 5: Process terminated
  • Sysmon 8: CreateRemoteThread
Delayed Execution via PinglowRelated:
  • Sysmon 5: Process terminated
Suspicious HTML File CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 5: Process terminated
Execution from a Removable Media with Network ConnectionlowRelated:
  • Sysmon 5: Process terminated
  • Sysmon 3: Network connection
Potential Remote File Execution via MSIEXEClowRelated:
  • Sysmon 5: Process terminated
  • Sysmon 3: Network connection
Show all 20 rules (5 more)
Suspicious Execution from VS Code ExtensionmediumRelated:
  • Sysmon 5: Process terminated
Remote XSL Script Execution via COMlowRelated:
  • Sysmon 7: Image loaded
  • Sysmon 5: Process terminated
Process Created with a Duplicated TokenmediumRelated:
  • Sysmon 5: Process terminated
Privileges Elevation via Parent Process PID SpoofinghighRelated:
  • Sysmon 5: Process terminated
Process Created with an Elevated TokenhighRelated:
  • Sysmon 5: Process terminated
Shared field: ParentProcessIdlow confidence — 1 rule
Windows Service Installed via an Unusual ClienthighRelated:
  • Security-Auditing 4700: A scheduled task was enabled.
  • Security-Auditing 4701: A scheduled task was disabled.

Channel: Operational Event ID 2: A process changed a file creation time (40 medium)

EQL category file wheremedium confidence — 38 rules
GenAI Process Accessing Sensitive FileshighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
ROT Encoded Python Script ExecutionmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential SAP NetWeaver WebShell CreationhighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Initial Access via File Upload Followed by GET RequestmediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Ingress Transfer via Windows BITSlowRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Creation or Modification of Domain Backup DPAPI private keyhighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
LSASS Memory Dump CreationhighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Mimikatz Memssp Log File DetectedhighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Sensitive Registry Hive Access via RegBackhighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Remote Credential Access via RegistryhighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Antimalware Scan Interface DLLhighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Managed Code Hosting ProcesshighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Unusual Executable File Creation by a System Critical ProcesshighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
WDAC Policy File by an Unusual ProcesshighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Host File System Changes via Windows Subsystem for LinuxmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Show all 38 rules (23 more)
Execution of File Written or Modified by Microsoft OfficehighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Execution via local SxS Shared ModulemediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Execution of a Downloaded Windows ScriptmediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Potential System Tampering via File ModificationhighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious File Renamed via SMBhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Ransomware Note File Dropped via SMBhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious HTML File CreationmediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated
Potential Lateral Tool Transfer via SMB SharemediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Remote Execution via File SharesmediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Lateral Movement via Startup FolderhighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Scheduled Job CreationmediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Microsoft Office AddInshighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Microsoft Outlook VBAmediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via PowerShell profilemediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Startup Persistence by a Suspicious ProcessmediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Startup Folder Persistence via Unsigned ProcessmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistent Scripts in the Startup DirectorymediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Persistence via Mandatory User ProfilemediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Web Shell ASPX File CreationmediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential privilege escalation via CVE-2022-38028highRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Creation or Modification of a new GPO Scheduled Task or ServicelowRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Print Spooler SPL File CreatedlowRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Privilege Escalation via Rogue Named Pipe ImpersonationhighRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
EQL category file where → change medium confidence — 2 rules
Potential Secure File Deletion via SDelete Utilitylow
UAC Bypass Attempt via Privileged IFileOperation COM Interfacehigh

Channel: Operational Event ID 3: Network connection (52 medium)

EQL category network wheremedium confidence — 44 rules
Connection to Common Large Language Model Endpointsmedium
GenAI Process Connection to Suspicious Top Level Domainmedium
PANW and Elastic Defend - Command and Control Correlationmedium
FortiGate SOCKS Traffic from an Unusual Processmedium
Suricata and Elastic Defend Network Correlationmedium
Initial Access via File Upload Followed by GET RequestmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Ollama API Accessed from External Networkmedium
Connection to Commonly Abused Web Serviceslow
Network Activity to a Suspicious Top Level Domainhigh
Connection to Commonly Abused Free SSL Certificate Providerslow
Potential Command and Control via Internet ExplorermediumRelated:
  • Sysmon 7: Image loaded
  • Sysmon 1: Process creation
Remote File Download via PowerShellmediumRelated:
  • Sysmon 11: FileCreate
Remote File Download via Script InterpretermediumRelated:
  • Sysmon 11: FileCreate
Potential Kerberos SPN Spoofing via Suspicious DNS Queryhigh
InstallUtil Process Making Network ConnectionsmediumRelated:
  • Sysmon 1: Process creation
Show all 44 rules (29 more)
Potential Windows Error Manager MasqueradingmediumRelated:
  • Sysmon 1: Process creation
Network Connection via Signed BinarylowRelated:
  • Sysmon 1: Process creation
MsBuild Making Network ConnectionsmediumRelated:
  • Sysmon 1: Process creation
Mshta Making Network ConnectionsmediumRelated:
  • Sysmon 1: Process creation
MsiExec Service Child Process With Network ConnectionmediumRelated:
  • Sysmon 1: Process creation
Network Connection via MsXsllowRelated:
  • Sysmon 1: Process creation
Unusual Network Activity from a Windows System BinarymediumRelated:
  • Sysmon 1: Process creation
Unusual Network Connection via DllHostmediumRelated:
  • Sysmon 1: Process creation
Unusual Network Connection via RunDLL32mediumRelated:
  • Sysmon 1: Process creation
Unusual Process Network ConnectionlowRelated:
  • Sysmon 1: Process creation
Potential Enumeration via Active Directory Web ServicemediumRelated:
  • Sysmon 7: Image loaded
System Public IP Discovery via DNS Queryhigh
Suspicious Command Prompt Network ConnectionlowRelated:
  • Sysmon 1: Process creation
Network Connection via Compiled HTML FilelowRelated:
  • Sysmon 1: Process creation
PsExec Network ConnectionlowRelated:
  • Sysmon 1: Process creation
Network Connection via Registration Utilitylow
Outbound Scheduled Task Activity via PowerShellmedium
Suspicious File Renamed via SMBhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Ransomware Note File Dropped via SMBhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Execution from a Removable Media with Network ConnectionlowRelated:
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated
Potential Remote File Execution via MSIEXEClowRelated:
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated
Service Command Lateral MovementlowRelated:
  • Sysmon 1: Process creation
Suspicious Kerberos Authentication Ticket RequesthighRelated:
  • Security-Auditing 4624: An account was successfully logged on.
  • Security-Auditing 4625: An account failed to log on.
  • Security-Auditing 4634: An account was logged off.
  • Security-Auditing 4647: User initiated logoff.
  • Security-Auditing 4648: A logon was attempted using explicit credentials.
SMB Connections via LOLBin or Untrusted ProcessmediumRelated:
  • Sysmon 1: Process creation
Incoming Execution via WinRM Remote ShellmediumRelated:
  • Sysmon 1: Process creation
WMI Incoming Lateral Movementmedium
Incoming Execution via PowerShell RemotingmediumRelated:
  • Sysmon 1: Process creation
Remotely Started Services via RPCmediumRelated:
  • Sysmon 1: Process creation
Remote Scheduled Task CreationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
EQL category network where → start medium confidence — 7 rules
GenAI Process Performing Encoding/Chunking Prior to Network ActivitymediumRelated:
  • Sysmon 1: Process creation
Kerberos Traffic from Unusual Processmedium
Incoming DCOM Lateral Movement via MSHTAhighRelated:
  • Sysmon 1: Process creation
Incoming DCOM Lateral Movement with MMChighRelated:
  • Sysmon 1: Process creation
Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindowsmediumRelated:
  • Sysmon 1: Process creation
Potential Lateral Tool Transfer via SMB SharemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential SharpRDP BehaviorhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
  • Sysmon 1: Process creation
EQL category network where → protocol medium confidence — 1 rule
SUNBURST Command and Control Activityhigh

Channel: Operational Event ID 5: Process terminated (21 medium)

EQL category process wheremedium confidence — 21 rules
Potential Cookies Theft via Browser DebuggingmediumRelated:
  • Sysmon 1: Process creation
Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability ScorehighRelated:
  • Sysmon 1: Process creation
Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability ScorelowRelated:
  • Sysmon 1: Process creation
Suspicious Inter-Process Communication via OutlookmediumRelated:
  • Sysmon 1: Process creation
Suspicious LSASS Access via MalSecLogonhighRelated:
  • Sysmon 1: Process creation
  • Sysmon 8: CreateRemoteThread
Potential Credential Access via DuplicateHandle in LSASSmediumRelated:
  • Sysmon 1: Process creation
Potential Credential Access via Renamed COM+ Services DLLhighRelated:
  • Sysmon 1: Process creation
Suspicious Lsass Process AccessmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 8: CreateRemoteThread
Potential Credential Access via LSASS Memory DumphighRelated:
  • Sysmon 1: Process creation
  • Sysmon 8: CreateRemoteThread
Process Injection by the Microsoft Build EnginelowRelated:
  • Sysmon 1: Process creation
Suspicious Process Access via Direct System CallhighRelated:
  • Sysmon 1: Process creation
  • Sysmon 8: CreateRemoteThread
Suspicious Process Creation CallTracemedium
Delayed Execution via PinglowRelated:
  • Sysmon 1: Process creation
Suspicious HTML File CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Execution from a Removable Media with Network ConnectionlowRelated:
  • Sysmon 1: Process creation
  • Sysmon 3: Network connection
Show all 21 rules (6 more)
Potential Remote File Execution via MSIEXEClowRelated:
  • Sysmon 1: Process creation
  • Sysmon 3: Network connection
Suspicious Execution from VS Code ExtensionmediumRelated:
  • Sysmon 1: Process creation
Remote XSL Script Execution via COMlowRelated:
  • Sysmon 7: Image loaded
  • Sysmon 1: Process creation
Process Created with a Duplicated TokenmediumRelated:
  • Sysmon 1: Process creation
Privileges Elevation via Parent Process PID SpoofinghighRelated:
  • Sysmon 1: Process creation
Process Created with an Elevated TokenhighRelated:
  • Sysmon 1: Process creation

Channel: Operational Event ID 6: Driver loaded (2 medium)

EQL category driver wheremedium confidence — 2 rules
Untrusted Driver Loadedhigh
Expired or Revoked Driver Loadedmedium

Channel: Operational Event ID 7: Image loaded (7 medium)

EQL category library wheremedium confidence — 7 rules
Potential Command and Control via Internet ExplorermediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 3: Network connection
Veeam Backup Library Loaded by Unusual Processmedium
Potential Windows Session Hijacking via CcmExecmedium
Unsigned DLL Side-Loading from a Suspicious Foldermedium
Potential Enumeration via Active Directory Web ServicemediumRelated:
  • Sysmon 3: Network connection
Remote XSL Script Execution via COMlowRelated:
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated
Unsigned DLL Loaded by Svchostmedium

Channel: Operational Event ID 8: CreateRemoteThread (5 low)

Shared field: TargetImagelow confidence — 5 rules
Suspicious LSASS Access via MalSecLogonhighRelated:
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated
Suspicious Lsass Process AccessmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated
Potential Credential Access via LSASS Memory DumphighRelated:
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated
Potential LSASS Memory Dump via PssCaptureSnapShothigh
Suspicious Process Access via Direct System CallhighRelated:
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated

Channel: Operational Event ID 11: FileCreate (51 medium)

EQL category file wheremedium confidence — 39 rules
GenAI Process Accessing Sensitive FileshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
ROT Encoded Python Script ExecutionmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential SAP NetWeaver WebShell CreationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Initial Access via File Upload Followed by GET RequestmediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Ingress Transfer via Windows BITSlowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Creation or Modification of Domain Backup DPAPI private keyhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
LSASS Memory Dump CreationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Mimikatz Memssp Log File DetectedhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Sensitive Registry Hive Access via RegBackhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Remote Credential Access via RegistryhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Antimalware Scan Interface DLLhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Managed Code Hosting ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Unusual Executable File Creation by a System Critical ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Timestomp in Executable FilesmediumRelated:
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
WDAC Policy File by an Unusual ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Show all 39 rules (24 more)
Host File System Changes via Windows Subsystem for LinuxmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Execution of File Written or Modified by Microsoft OfficehighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Execution via local SxS Shared ModulemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Execution of a Downloaded Windows ScriptmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Potential System Tampering via File ModificationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious File Renamed via SMBhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Ransomware Note File Dropped via SMBhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious HTML File CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated
Potential Lateral Tool Transfer via SMB SharemediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Remote Execution via File SharesmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Lateral Movement via Startup FolderhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Scheduled Job CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Microsoft Office AddInshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Microsoft Outlook VBAmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via PowerShell profilemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Startup Persistence by a Suspicious ProcessmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Startup Folder Persistence via Unsigned ProcessmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistent Scripts in the Startup DirectorymediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Persistence via Mandatory User ProfilemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Web Shell ASPX File CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential privilege escalation via CVE-2022-38028highRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Creation or Modification of a new GPO Scheduled Task or ServicelowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Print Spooler SPL File CreatedlowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Privilege Escalation via Rogue Named Pipe ImpersonationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
EQL category file where → creation medium confidence — 12 rules
Remote File Download via PowerShellmediumRelated:
  • Sysmon 3: Network connection
Remote File Download via Script InterpretermediumRelated:
  • Sysmon 3: Network connection
Remote File Copy via TeamViewermedium
Kirbi File Creationhigh
Windows Registry File Creation in SMB Sharemedium
Executable File Creation with Multiple Extensionsmedium
Unusual File Creation - Alternate Data Streamhigh
Downloaded Shortcut Filesmedium
Downloaded URL Filesmedium
Microsoft Exchange Server UM Writing Suspicious Filesmedium
Deprecated - Adobe Hijack Persistencelow
Browser Extension Installlow

Channel: Operational Event ID 12: RegistryEvent (Object create and delete) (53 medium)

EQL category registry wheremedium confidence — 9 rules
Outlook Home Page Registry ModificationhighRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Full User-Mode Dumps Enabled System-WidemediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Modification of WDigest Security ProviderhighRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Network-Level Authentication (NLA) DisabledlowRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Deprecated - Encoded Executable Stored in the RegistrymediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential NetNTLMv1 Downgrade AttackmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential RemoteMonologue AttackmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Office Test Registry PersistencelowRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Suspicious Print Spooler Point and Print DLLhighRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
EQL category registry where → change medium confidence — 44 rules
Port Forwarding Rule AdditionmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Network Logon Provider Registry ModificationmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Modification of AmsiEnable Registry KeyhighRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Code Signing Policy Modification Through RegistrymediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Creation or Modification of Root CertificatelowRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Windows Defender Disabled via Registry ModificationlowRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
PowerShell Script Block Logging DisabledmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
DNS-over-HTTPS Enabled via RegistrylowRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Disabling Lsa Protection via Registry ModificationhighRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Microsoft Windows Defender TamperingmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
MS Office Macro Security Registry ModificationsmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Local Account TokenFilter Policy DisabledmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
DNS Global Query Block List Modified or DisabledmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Scheduled Tasks AT Command EnabledmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
SIP Provider ModificationmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Show all 44 rules (29 more)
SolarWinds Process Disabling Services via RegistrymediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Windows Subsystem for Linux Distribution InstalledmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
NullSessionPipe Registry ModificationmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
RDP Enabled via RegistrymediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential SharpRDP BehaviorhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
  • Sysmon 1: Process creation
Remote Scheduled Task CreationmediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Installation of Custom Shim DatabasesmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Registry Persistence via AppCert DLLmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Registry Persistence via AppInit DLLmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Creation of a Hidden Local User AccounthighRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Image File Execution Options InjectionmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Suspicious Startup Shell Folder ModificationhighRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Scheduled Task Created by a Windows ScriptmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Netsh Helper DLLlowRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Uncommon Registry Persistence ChangemediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Startup or Run Key Registry ModificationlowRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Unusual Persistence via Services RegistrylowRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Component Object Model HijackinglowRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Suspicious ImagePath Service CreationhighRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential Persistence via Time Provider ModificationmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Persistence via Hidden Run Key DetectedhighRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Installation of Security Support ProvidermediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Persistence via WMI Standard Registry ProviderhighRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Werfault ReflectDebugger PersistencelowRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Disabling User Account Control via Registry ModificationmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential LSA Authentication Package AbusemediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential Port Monitor or Print Processor Registration AbusemediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential Privilege Escalation via Service ImagePath ModificationmediumRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Privilege Escalation via Windir Environment VariablehighRelated:
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 14: RegistryEvent (Key and Value Rename)

Channel: Operational Event ID 13: RegistryEvent (Value Set) (53 medium)

EQL category registry wheremedium confidence — 9 rules
Outlook Home Page Registry ModificationhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Full User-Mode Dumps Enabled System-WidemediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Modification of WDigest Security ProviderhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Network-Level Authentication (NLA) DisabledlowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Deprecated - Encoded Executable Stored in the RegistrymediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential NetNTLMv1 Downgrade AttackmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential RemoteMonologue AttackmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Office Test Registry PersistencelowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Suspicious Print Spooler Point and Print DLLhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
EQL category registry where → change medium confidence — 44 rules
Port Forwarding Rule AdditionmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Network Logon Provider Registry ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Modification of AmsiEnable Registry KeyhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Code Signing Policy Modification Through RegistrymediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Creation or Modification of Root CertificatelowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Windows Defender Disabled via Registry ModificationlowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
PowerShell Script Block Logging DisabledmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
DNS-over-HTTPS Enabled via RegistrylowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Disabling Lsa Protection via Registry ModificationhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Microsoft Windows Defender TamperingmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
MS Office Macro Security Registry ModificationsmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Local Account TokenFilter Policy DisabledmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
DNS Global Query Block List Modified or DisabledmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Scheduled Tasks AT Command EnabledmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
SIP Provider ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Show all 44 rules (29 more)
SolarWinds Process Disabling Services via RegistrymediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Windows Subsystem for Linux Distribution InstalledmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
NullSessionPipe Registry ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
RDP Enabled via RegistrymediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential SharpRDP BehaviorhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
  • Sysmon 1: Process creation
Remote Scheduled Task CreationmediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Installation of Custom Shim DatabasesmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Registry Persistence via AppCert DLLmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Registry Persistence via AppInit DLLmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Creation of a Hidden Local User AccounthighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Image File Execution Options InjectionmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Suspicious Startup Shell Folder ModificationhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Scheduled Task Created by a Windows ScriptmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Netsh Helper DLLlowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Uncommon Registry Persistence ChangemediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Startup or Run Key Registry ModificationlowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Unusual Persistence via Services RegistrylowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Component Object Model HijackinglowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Suspicious ImagePath Service CreationhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential Persistence via Time Provider ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Persistence via Hidden Run Key DetectedhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Installation of Security Support ProvidermediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Persistence via WMI Standard Registry ProviderhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Werfault ReflectDebugger PersistencelowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Disabling User Account Control via Registry ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential LSA Authentication Package AbusemediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential Port Monitor or Print Processor Registration AbusemediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Potential Privilege Escalation via Service ImagePath ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)
Privilege Escalation via Windir Environment VariablehighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 14: RegistryEvent (Key and Value Rename)

Channel: Operational Event ID 14: RegistryEvent (Key and Value Rename) (53 medium)

EQL category registry wheremedium confidence — 9 rules
Outlook Home Page Registry ModificationhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Full User-Mode Dumps Enabled System-WidemediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Modification of WDigest Security ProviderhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Network-Level Authentication (NLA) DisabledlowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Deprecated - Encoded Executable Stored in the RegistrymediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Potential NetNTLMv1 Downgrade AttackmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Potential RemoteMonologue AttackmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Office Test Registry PersistencelowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Suspicious Print Spooler Point and Print DLLhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
EQL category registry where → change medium confidence — 44 rules
Port Forwarding Rule AdditionmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Network Logon Provider Registry ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Modification of AmsiEnable Registry KeyhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Code Signing Policy Modification Through RegistrymediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Creation or Modification of Root CertificatelowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Windows Defender Disabled via Registry ModificationlowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
PowerShell Script Block Logging DisabledmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
DNS-over-HTTPS Enabled via RegistrylowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Disabling Lsa Protection via Registry ModificationhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Microsoft Windows Defender TamperingmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
MS Office Macro Security Registry ModificationsmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Local Account TokenFilter Policy DisabledmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
DNS Global Query Block List Modified or DisabledmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Scheduled Tasks AT Command EnabledmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
SIP Provider ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Show all 44 rules (29 more)
SolarWinds Process Disabling Services via RegistrymediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Windows Subsystem for Linux Distribution InstalledmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
NullSessionPipe Registry ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
RDP Enabled via RegistrymediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Potential SharpRDP BehaviorhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
  • Sysmon 1: Process creation
Remote Scheduled Task CreationmediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Installation of Custom Shim DatabasesmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Registry Persistence via AppCert DLLmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Registry Persistence via AppInit DLLmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Creation of a Hidden Local User AccounthighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Image File Execution Options InjectionmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Suspicious Startup Shell Folder ModificationhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Scheduled Task Created by a Windows ScriptmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Netsh Helper DLLlowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Uncommon Registry Persistence ChangemediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Startup or Run Key Registry ModificationlowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Unusual Persistence via Services RegistrylowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Component Object Model HijackinglowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Suspicious ImagePath Service CreationhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Potential Persistence via Time Provider ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Persistence via Hidden Run Key DetectedhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Installation of Security Support ProvidermediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Persistence via WMI Standard Registry ProviderhighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Werfault ReflectDebugger PersistencelowRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Disabling User Account Control via Registry ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Potential LSA Authentication Package AbusemediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Potential Port Monitor or Print Processor Registration AbusemediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Potential Privilege Escalation via Service ImagePath ModificationmediumRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)
Privilege Escalation via Windir Environment VariablehighRelated:
  • Sysmon 12: RegistryEvent (Object create and delete)
  • Sysmon 13: RegistryEvent (Value Set)

Channel: Operational Event ID 15: FileCreateStreamHash (39 medium)

EQL category file wheremedium confidence — 39 rules
GenAI Process Accessing Sensitive FileshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
ROT Encoded Python Script ExecutionmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential SAP NetWeaver WebShell CreationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Initial Access via File Upload Followed by GET RequestmediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Ingress Transfer via Windows BITSlowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Creation or Modification of Domain Backup DPAPI private keyhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
LSASS Memory Dump CreationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Mimikatz Memssp Log File DetectedhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Sensitive Registry Hive Access via RegBackhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Remote Credential Access via RegistryhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Antimalware Scan Interface DLLhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Managed Code Hosting ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Unusual Executable File Creation by a System Critical ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Timestomp in Executable FilesmediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
WDAC Policy File by an Unusual ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Show all 39 rules (24 more)
Host File System Changes via Windows Subsystem for LinuxmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Execution of File Written or Modified by Microsoft OfficehighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Execution via local SxS Shared ModulemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Execution of a Downloaded Windows ScriptmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Potential System Tampering via File ModificationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious File Renamed via SMBhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Ransomware Note File Dropped via SMBhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious HTML File CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated
Potential Lateral Tool Transfer via SMB SharemediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Remote Execution via File SharesmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Lateral Movement via Startup FolderhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Scheduled Job CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Microsoft Office AddInshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Microsoft Outlook VBAmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via PowerShell profilemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Startup Persistence by a Suspicious ProcessmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Startup Folder Persistence via Unsigned ProcessmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistent Scripts in the Startup DirectorymediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Persistence via Mandatory User ProfilemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Web Shell ASPX File CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential privilege escalation via CVE-2022-38028highRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Creation or Modification of a new GPO Scheduled Task or ServicelowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Print Spooler SPL File CreatedlowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Privilege Escalation via Rogue Named Pipe ImpersonationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 26: FileDeleteDetected (File Delete logged)

Channel: Operational Event ID 23: FileDelete (File Delete archived) (42 medium)

EQL category file wheremedium confidence — 39 rules
GenAI Process Accessing Sensitive FileshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
ROT Encoded Python Script ExecutionmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential SAP NetWeaver WebShell CreationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Initial Access via File Upload Followed by GET RequestmediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Ingress Transfer via Windows BITSlowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Creation or Modification of Domain Backup DPAPI private keyhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
LSASS Memory Dump CreationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Mimikatz Memssp Log File DetectedhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Sensitive Registry Hive Access via RegBackhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Remote Credential Access via RegistryhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Antimalware Scan Interface DLLhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Managed Code Hosting ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Unusual Executable File Creation by a System Critical ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Timestomp in Executable FilesmediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
WDAC Policy File by an Unusual ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Show all 39 rules (24 more)
Host File System Changes via Windows Subsystem for LinuxmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Execution of File Written or Modified by Microsoft OfficehighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Execution via local SxS Shared ModulemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Execution of a Downloaded Windows ScriptmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Potential System Tampering via File ModificationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious File Renamed via SMBhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Ransomware Note File Dropped via SMBhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious HTML File CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated
Potential Lateral Tool Transfer via SMB SharemediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Remote Execution via File SharesmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
  • Sysmon 1: Process creation
Lateral Movement via Startup FolderhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Scheduled Job CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Microsoft Office AddInshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via Microsoft Outlook VBAmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistence via PowerShell profilemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Startup Persistence by a Suspicious ProcessmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Startup Folder Persistence via Unsigned ProcessmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Persistent Scripts in the Startup DirectorymediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Persistence via Mandatory User ProfilemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential Web Shell ASPX File CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Potential privilege escalation via CVE-2022-38028highRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Creation or Modification of a new GPO Scheduled Task or ServicelowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Print Spooler SPL File CreatedlowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Privilege Escalation via Rogue Named Pipe ImpersonationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 26: FileDeleteDetected (File Delete logged)
EQL category file where → deletion medium confidence — 3 rules
WebServer Access Logs DeletedmediumRelated:
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Third-party Backup Files Deleted via Unexpected ProcessmediumRelated:
  • Sysmon 26: FileDeleteDetected (File Delete logged)
Suspicious Print Spooler File DeletionmediumRelated:
  • Sysmon 26: FileDeleteDetected (File Delete logged)

Channel: Operational Event ID 26: FileDeleteDetected (File Delete logged) (42 medium)

EQL category file wheremedium confidence — 39 rules
GenAI Process Accessing Sensitive FileshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
ROT Encoded Python Script ExecutionmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Potential SAP NetWeaver WebShell CreationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Initial Access via File Upload Followed by GET RequestmediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Ingress Transfer via Windows BITSlowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Creation or Modification of Domain Backup DPAPI private keyhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
LSASS Memory Dump CreationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Mimikatz Memssp Log File DetectedhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Sensitive Registry Hive Access via RegBackhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Potential Remote Credential Access via RegistryhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Suspicious Antimalware Scan Interface DLLhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Suspicious Managed Code Hosting ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Unusual Executable File Creation by a System Critical ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Potential Timestomp in Executable FilesmediumRelated:
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
WDAC Policy File by an Unusual ProcesshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Show all 39 rules (24 more)
Host File System Changes via Windows Subsystem for LinuxmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Execution of File Written or Modified by Microsoft OfficehighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 1: Process creation
Execution via local SxS Shared ModulemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Execution of a Downloaded Windows ScriptmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 1: Process creation
Potential System Tampering via File ModificationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Suspicious File Renamed via SMBhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Potential Ransomware Note File Dropped via SMBhighRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Suspicious HTML File CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 1: Process creation
  • Sysmon 5: Process terminated
Potential Lateral Tool Transfer via SMB SharemediumRelated:
  • Sysmon 3: Network connection
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Remote Execution via File SharesmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
  • Sysmon 1: Process creation
Lateral Movement via Startup FolderhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Persistence via Scheduled Job CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Persistence via Microsoft Office AddInshighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Persistence via Microsoft Outlook VBAmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Persistence via PowerShell profilemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Startup Persistence by a Suspicious ProcessmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Startup Folder Persistence via Unsigned ProcessmediumRelated:
  • Sysmon 1: Process creation
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Persistent Scripts in the Startup DirectorymediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Potential Persistence via Mandatory User ProfilemediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Potential Web Shell ASPX File CreationmediumRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Potential privilege escalation via CVE-2022-38028highRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Creation or Modification of a new GPO Scheduled Task or ServicelowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Suspicious Print Spooler SPL File CreatedlowRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
Privilege Escalation via Rogue Named Pipe ImpersonationhighRelated:
  • Sysmon 2: A process changed a file creation time
  • Sysmon 11: FileCreate
  • Sysmon 15: FileCreateStreamHash
  • Sysmon 23: FileDelete (File Delete archived)
EQL category file where → deletion medium confidence — 3 rules
WebServer Access Logs DeletedmediumRelated:
  • Sysmon 23: FileDelete (File Delete archived)
Third-party Backup Files Deleted via Unexpected ProcessmediumRelated:
  • Sysmon 23: FileDelete (File Delete archived)
Suspicious Print Spooler File DeletionmediumRelated:
  • Sysmon 23: FileDelete (File Delete archived)