Detection rules › By event

Microsoft-Windows-Security-Auditing event 4688

512 detection rules reference this event. View event page.

Sigma (493)

Abusing Print Executable severity medium T1218
Arbitrary Binary Execution Using GUP Utility severity medium
Arbitrary File Download Via GfxDownloadWrapper.EXE severity medium T1105
Arbitrary File Download Via Squirrel.EXE severity medium T1218
Arbitrary MSI Download Via Devinit.EXE severity medium T1218
Arbitrary Shell Command Execution Via Settingcontent-Ms severity medium T1204, T1566.001
AspNetCompiler Execution severity medium T1127
Assembly Loading Via CL_LoadAssembly.ps1 severity medium T1216
Attempts of Kerberos Coercion Via DNS SPN Spoofing severity high T1187, T1557.001
Audio Capture via PowerShell severity medium T1123
Audio Capture via SoundRecorder severity medium T1123
Audit Policy Tampering Via NT Resource Kit Auditpol severity high T1562.002
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl severity medium T1216
Base64 Encoded PowerShell Command Detected severity high T1027, T1059.001, T1140
Base64 MZ Header In CommandLine severity high
BitLockerTogo.EXE Execution severity low T1218
Browser Execution In Headless Mode severity low T1105, T1564.003
Browser Started with Remote Debugging severity medium T1185
Bypass UAC via Fodhelper.exe severity high T1548.002
Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths severity high
Certificate Exported Via PowerShell severity medium T1059.001, T1552.004
Changing Existing Service ImagePath Value Via Reg.EXE severity medium T1574.011
Chopper Webshell Process Pattern severity high T1018, T1033, T1087, T1505.003
Chromium Browser Headless Execution To Mockbin Like Site severity high
Chromium Browser Instance Executed With Custom Extension severity medium T1176.001
Cloudflared Portable Execution severity medium T1090.001
Cloudflared Tunnel Connections Cleanup severity medium T1090, T1102, T1572
Cloudflared Tunnel Execution severity medium T1090, T1102, T1572
Cmd.EXE Missing Space Characters Execution Anomaly severity high T1059.001
CMSTP Execution Process Creation severity high T1218.003
COM Object Execution via Xwizard.EXE severity medium T1218
Command Line Execution with Suspicious URL and AppData Strings severity medium T1059.001, T1059.003, T1105
Compress Data and Lock With Password for Exfiltration With WINZIP severity medium T1560.001
Copy From VolumeShadowCopy Via Cmd.EXE severity high T1490
Cscript/Wscript Potentially Suspicious Child Process severity medium
Curl Download And Execute Combination severity high T1105, T1218
Delete All Scheduled Tasks severity high T1489
Delete Important Scheduled Task severity high T1489
Deletion of Volume Shadow Copies via WMI with PowerShell severity high T1490
Detected Windows Software Discovery severity medium T1518
DeviceCredentialDeployment Execution severity medium T1218
Devtoolslauncher.exe Executes Specified Binary severity high T1218
Disable Important Scheduled Task severity high T1489
Disabled IE Security Features severity high T1562.001
Disabled Volume Snapshots severity high T1562.001
Discovery of a System Time severity low T1124
DLL Execution Via Register-cimprovider.exe severity medium T1574
DLL Sideloading by VMware Xfer Utility severity high T1574.001
Dllhost.EXE Execution Anomaly severity high T1055
DNS Exfiltration and Tunneling Tools Execution severity high T1048.001, T1071.004, T1132.001
Dropping Of Password Filter DLL severity medium T1556.002
DSInternals Suspicious PowerShell Cmdlets severity high T1059.001
Dumping Process via Sqldumper.exe severity medium T1003.001
DumpStack.log Defender Evasion severity critical
Email Exifiltration Via Powershell severity high
Enable LM Hash Storage - ProcCreation severity high T1112
Enumeration for 3rd Party Creds From CLI severity medium T1552.002
Enumeration for Credentials in Registry severity medium T1552.002
Esentutl Gather Credentials severity medium T1003, T1003.003
ETW Logging Tamper In .NET Processes Via CommandLine severity high T1562
ETW Trace Evasion Activity severity high T1070, T1562.006
Execute Code with Pester.bat severity medium T1059.001, T1216
Execute Files with Msdeploy.exe severity medium T1218
Execute From Alternate Data Streams severity medium T1564.004
Execute Pcwrun.EXE To Leverage Follina severity high T1218
Execution Of Non-Existing File severity high
Execution of Powershell Script in Public Folder severity high T1059.001
Execution of Suspicious File Type Extension severity medium
Execution via stordiag.exe severity high T1218
Execution via WorkFolders.exe severity high T1218
Explorer Process Tree Break severity medium T1036
File Download From Browser Process Via Inline URL severity medium T1105
File Download with Headless Browser severity high T1105, T1564.003
File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell severity high T1135
Files Added To An Archive Using Rar.EXE severity low T1560.001
Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet severity medium T1074.001
Gpresult Display Group Policy Information severity medium T1615
Gzip Archive Decode Via PowerShell severity medium T1132.001
HackTool - ADCSPwn Execution severity high T1557.001
HackTool - Covenant PowerShell Launcher severity high T1059.001, T1564.003
HackTool - CrackMapExec Execution severity high T1047, T1053, T1059.001, T1059.003, T1110, T1201
HackTool - CrackMapExec Execution Patterns severity high T1047, T1053, T1059.001, T1059.003
HackTool - CrackMapExec Process Patterns severity high T1003.001
HackTool - Default PowerSploit/Empire Scheduled Task Creation severity high T1053.005, T1059.001
HackTool - DInjector PowerShell Cradle Execution severity critical T1055
HackTool - Empire PowerShell Launch Parameters severity high T1059.001
HackTool - Empire PowerShell UAC Bypass severity critical T1548.002
HackTool - F-Secure C3 Load by Rundll32 severity critical T1218.011
HackTool - Hashcat Password Cracker Execution severity high T1110.002
HackTool - HollowReaper Execution severity high T1055.012
HackTool - Htran/NATBypass Execution severity high T1090
HackTool - Hydra Password Bruteforce Execution severity high T1110, T1110.001
HackTool - Impacket Tools Execution severity high T1557.001
HackTool - LaZagne Execution severity medium
HackTool - Mimikatz Execution severity high T1003.001, T1003.002, T1003.004, T1003.005, T1003.006
HackTool - NetExec Execution severity high T1018, T1021
HackTool - Pypykatz Credentials Dumping Activity severity high T1003.002
HackTool - Quarks PwDump Execution severity high T1003.002
HackTool - RedMimicry Winnti Playbook Execution severity high T1059.003, T1106, T1218.011
HackTool - SharpWSUS/WSUSpendu Execution severity high T1210
HackTool - Sliver C2 Implant Activity Pattern severity critical T1059
HackTool - SOAPHound Execution severity high T1087
HackTool - WinPwn Execution severity high T1046, T1082, T1106, T1518, T1548.002, T1552.001
HackTool - WinRM Access Via Evil-WinRM severity medium T1021.006
HackTool - Wmiexec Default Powershell Command severity high
HackTool - XORDump Execution severity high T1003.001, T1036
Hidden Powershell in Link File Pattern severity medium T1059.001
Hiding User Account Via SpecialAccounts Registry Key - CommandLine severity medium T1564.002
HTML Help HH.EXE Suspicious Child Process severity high T1047, T1059.001, T1059.003, T1059.005, T1059.007, T1218
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI severity high
ImagingDevices Unusual Parent/Child Processes severity high
Import PowerShell Modules From Suspicious Directories - ProcCreation severity medium T1059.001
Indirect Command Execution By Program Compatibility Wizard severity low T1218
InfDefaultInstall.exe .inf Execution severity medium T1218
Interactive AT Job severity high T1053.002
Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) severity medium T1003.003
Invoke-Obfuscation CLIP+ Launcher severity high T1027, T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION severity medium T1027, T1059.001
Invoke-Obfuscation Obfuscated IEX Invocation severity high T1027, T1059.001
Invoke-Obfuscation STDIN+ Launcher severity high T1027, T1059.001
Invoke-Obfuscation VAR+ Launcher severity high T1027, T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION severity high T1027, T1059.001
Invoke-Obfuscation Via Stdin severity high T1027, T1059.001
Invoke-Obfuscation Via Use Clip severity high T1027, T1059.001
Invoke-Obfuscation Via Use MSHTA severity high T1027, T1059.001
Java Running with Remote Debugging severity medium T1203
Kavremover Dropped Binary LOLBIN Usage severity high T1127
Launch-VsDevShell.PS1 Proxy Execution severity medium T1216.001
Lolbin Runexehelper Use As Proxy severity medium T1218
LSASS Dump Keyword In CommandLine severity high T1003.001
Malicious PE Execution by Microsoft Visual Studio Debugger severity medium T1218
Malicious PowerShell Commandlets - ProcessCreation severity high T1059.001, T1069, T1069.001, T1069.002, T1087, T1087.001
Mavinject Inject DLL Into Running Process severity high T1055.001, T1218.013
MMC Spawning Windows Shell severity high T1021.003
MMC20 Lateral Movement severity high T1021.003
MSDT Execution Via Answer File severity high T1218
MSExchange Transport Agent Installation severity medium T1505.002
Mshtml.DLL RunHTMLApplication Suspicious Usage severity high
MsiExec Web Install severity medium T1105, T1218.007
Msxsl.EXE Execution severity medium T1220
Network Reconnaissance Activity severity high T1082, T1087
New ActiveScriptEventConsumer Created Via Wmic.EXE severity high T1546.003
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE severity high T1112, T1574.001
New Kernel Driver Via SC.EXE severity medium T1543.003
New Process Created Via Taskmgr.EXE severity low T1036
New Service Creation Using PowerShell severity low T1543.003
New Service Creation Using Sc.EXE severity low T1543.003
Node Process Executions severity medium T1059.007, T1127
Non-privileged Usage of Reg or Powershell severity high T1112
Notepad Password Files Discovery severity low T1083
NtdllPipe Like Activity Execution severity high
Obfuscated IP Download Activity severity medium
Obfuscated IP Via CLI severity medium
Obfuscated PowerShell OneLiner Execution severity high T1059.001, T1562.001
OneNote.EXE Execution of Malicious Embedded Scripts severity high T1218.001
OpenEDR Spawning Command Shell severity medium T1021.004, T1059.003, T1219
OpenWith.exe Executes Specified Binary severity high T1218
Outlook EnableUnsafeClientMailRules Setting Enabled severity high T1059, T1202
Persistence Via Sticky Key Backdoor severity critical T1546.008
Persistence Via TypedPaths - CommandLine severity medium
Phishing Pattern ISO in Archive severity high T1566
Ping Hex IP severity high T1027, T1140
Port Forwarding Activity Via SSH.EXE severity medium T1021.001, T1021.004, T1572
Possible Privilege Escalation via Weak Service Permissions severity high T1574.011
Potential Amazon SSM Agent Hijacking severity medium T1219.002
Potential AMSI Bypass Using NULL Bits severity medium T1562.001
Potential AMSI Bypass Via .NET Reflection severity high T1562.001
Potential Application Whitelisting Bypass via Dnx.EXE severity medium T1027.004, T1218
Potential Arbitrary Code Execution Via Node.EXE severity high T1127
Potential COM Objects Download Cradles Usage - Process Creation severity medium T1105
Potential Command Line Path Traversal Evasion Attempt severity medium T1036
Potential Commandline Obfuscation Using Escape Characters severity medium T1140
Potential Credential Dumping Attempt Using New NetworkProvider - CLI severity high T1003
Potential Credential Dumping Via LSASS Process Clone severity critical T1003, T1003.001
Potential Crypto Mining Activity severity high T1496
Potential Data Exfiltration Activity Via CommandLine Tools severity high T1059.001
Potential Data Stealing Via Chromium Headless Debugging severity high T1185, T1564.003
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 severity high
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 severity high
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 severity high
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 severity high
Potential Defense Evasion Via Right-to-Left Override severity high T1036.002
Potential Discovery Activity Via Dnscmd.EXE severity medium
Potential DLL File Download Via PowerShell Invoke-WebRequest severity medium T1059.001, T1105
Potential Dosfuscation Activity severity medium T1059
Potential Download/Upload Activity Using Type Command severity medium T1105
Potential Dropper Script Execution Via WScript/CScript severity medium T1059.005, T1059.007
Potential Execution of Sysinternals Tools severity low T1588.002
Potential Fake Instance Of Hxtsr.EXE Executed severity medium T1036
Potential File Download Via MS-AppInstaller Protocol Handler severity medium T1218
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI severity medium T1564.004
Potential Homoglyph Attack Using Lookalike Characters severity medium T1036, T1036.003
Potential Lateral Movement via Windows Remote Shell severity medium T1021.006
Potential LethalHTA Technique Execution severity high T1218.005
Potential LSASS Process Dump Via Procdump severity high T1003.001, T1036
Potential Meterpreter/CobaltStrike Activity severity high T1134.001, T1134.002
Potential Mftrace.EXE Abuse severity medium T1127
Potential Mpclient.DLL Sideloading Via Defender Binaries severity high T1574.001
Potential MSTSC Shadowing Activity severity high T1563.002
Potential Network Sniffing Activity Using Network Tools severity medium T1040
Potential Persistence Attempt Via Existing Service Tampering severity medium T1543.003, T1574.011
Potential Persistence Attempt Via Run Keys Using Reg.EXE severity medium T1547.001
Potential Persistence Via Logon Scripts - CommandLine severity high T1037.001
Potential PowerShell Console History Access Attempt via History File severity medium T1552.001
Potential PowerShell Downgrade Attack severity medium T1059.001
Potential PowerShell Execution Policy Tampering - ProcCreation severity high
Potential PowerShell Obfuscation Via WCHAR/CHAR severity high T1027, T1059.001
Potential Privilege Escalation To LOCAL SYSTEM severity high T1587.001
Potential Privilege Escalation via Service Permissions Weakness severity high T1574.011
Potential Process Execution Proxy Via CL_Invocation.ps1 severity medium T1216
Potential Provisioning Registry Key Abuse For Binary Proxy Execution severity high T1218
Potential Provlaunch.EXE Binary Proxy Execution Abuse severity medium T1218
Potential PsExec Remote Execution severity high T1587.001
Potential RDP Tunneling Via Plink severity high T1572
Potential RDP Tunneling Via SSH severity high T1572
Potential Regsvr32 Commandline Flag Anomaly severity medium T1218.010
Potential Remote Desktop Tunneling severity medium T1021
Potential Renamed Rundll32 Execution severity high
Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 severity medium T1216
Potential SMB Relay Attack Tool Execution severity critical T1557.001
Potential Suspicious Browser Launch From Document Reader Process severity medium T1204.002
Potential Suspicious Windows Feature Enabled - ProcCreation severity medium
Potential SysInternals ProcDump Evasion severity high T1003.001, T1036
Potential Tampering With Security Products Via WMIC severity high T1562.001
Potential UAC Bypass Via Sdclt.EXE severity medium T1548.002
Potential WinAPI Calls Via CommandLine severity high T1106
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler severity high T1127
Potentially Suspicious Cabinet File Expansion severity medium T1218
Potentially Suspicious Call To Win32_NTEventlogFile Class severity high
Potentially Suspicious Child Process Of ClickOnce Application severity medium
Potentially Suspicious Child Process Of DiskShadow.EXE severity medium T1218
Potentially Suspicious Child Process Of Regsvr32 severity high T1218.010
Potentially Suspicious Child Process Of VsCode severity medium T1202, T1218
Potentially Suspicious Command Targeting Teams Sensitive Files severity medium T1528
Potentially Suspicious Event Viewer Child Process severity high T1548.002
Potentially Suspicious Execution From Parent Process In Public Folder severity high T1059, T1564
Potentially Suspicious Execution Of PDQDeployRunner severity medium
Potentially Suspicious GoogleUpdate Child Process severity high
Potentially Suspicious JWT Token Search Via CLI severity medium T1528, T1552.001
Potentially Suspicious Usage Of Qemu severity medium T1090, T1572
Potentially Suspicious WebDAV LNK Execution severity medium T1059.001, T1204
Potentially Suspicious Windows App Activity severity medium
PowerShell Base64 Encoded FromBase64String Cmdlet severity high T1059.001, T1140
PowerShell Base64 Encoded IEX Cmdlet severity high T1059.001
Powershell Base64 Encoded MpPreference Cmdlet severity high T1562.001
PowerShell Base64 Encoded Reflective Assembly Load severity high T1027, T1059.001, T1620
Powershell Defender Disable Scan Feature severity high T1562.001
Powershell Defender Exclusion severity medium T1562.001
PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' severity high T1562.001
PowerShell Download and Execution Cradles severity high T1059
PowerShell Get-Clipboard Cmdlet Via CLI severity medium T1115
PowerShell Get-Process LSASS severity high T1552.004
Powershell Inline Execution From A File severity medium T1059.001
PowerShell SAM Copy severity high T1003.002
PowerShell Script Run in AppData severity medium T1059.001
Powershell Token Obfuscation - Process Creation severity high T1027.009
PrintBrm ZIP Creation of Extraction severity high T1105, T1564.004
Procdump Execution severity medium T1003.001, T1036
Process Creation Using Sysnative Folder severity medium T1055
Process Execution From A Potentially Suspicious Folder severity high T1036
Process Launched Without Image Name severity medium
Process Proxy Execution Via Squirrel.EXE severity medium T1218
PsExec Service Child Process Execution as LOCAL SYSTEM severity high
PsExec/PAExec Escalation to LOCAL SYSTEM severity high T1587.001
PUA - AdFind Suspicious Execution severity high T1018, T1069.002, T1087.002, T1482
PUA - Adidnsdump Execution severity low T1018
PUA - AdvancedRun Suspicious Execution severity high T1134.002
PUA - Chisel Tunneling Tool Execution severity high T1090.001
PUA - CleanWipe Execution severity high T1562.001
PUA - DIT Snapshot Viewer severity high T1003.003
PUA - Netcat Suspicious Execution severity high T1095
PUA - Ngrok Execution severity high T1572
PUA - NirCmd Execution As LOCAL SYSTEM severity high T1569.002
PUA - Restic Backup Tool Execution severity high T1048, T1567.002
PUA - RunXCmd Execution severity high T1569.002
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE severity high T1087.002
PUA - TruffleHog Execution severity medium T1083, T1552.001
Pubprn.vbs Proxy Execution severity medium T1216.001
Python Function Execution Security Warning Disabled In Excel severity high T1562.001
Python Spawning Pretty TTY on Windows severity high T1059
Query Usage To Exfil Data severity medium
QuickAssist Execution severity low T1219.002
Raccine Uninstall severity high T1562.001
Rar Usage with Password and Compression Level severity high T1560.001
Recon Command Output Piped To Findstr.EXE severity medium T1057
Regedit as Trusted Installer severity high T1548
REGISTER_APP.VBS Proxy Execution severity medium T1218
Registry Modification Attempt Via VBScript severity medium T1059.005, T1112
Remote Access Tool - AnyDesk Piped Password Via CLI severity medium T1219.002
Remote Access Tool - AnyDesk Silent Installation severity high T1219.002
Remote Access Tool - MeshAgent Command Execution via MeshCentral severity medium T1219.002
Remote Access Tool - Potential MeshAgent Execution - Windows severity medium T1219.002
Remote Access Tool - ScreenConnect Installation Execution severity medium T1133
Remote Access Tool - ScreenConnect Server Web Shell Execution severity high T1190
Remote Access Tool - Simple Help Execution severity medium T1219.002
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server severity medium T1105, T1219
Remote Access Tool - Team Viewer Session Started On Windows Host severity low T1133
Remote File Download Via Desktopimgdownldr Utility severity medium T1105
Remote PowerShell Session Host Process (WinRM) severity medium T1021.006, T1059.001
Remote XSL Execution Via Msxsl.EXE severity high T1220
RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses severity high T1218
Replace.exe Usage severity medium T1105
RestrictedAdminMode Registry Value Tampering - ProcCreation severity high T1112
Root Certificate Installed From Susp Locations severity high T1553.004
Run PowerShell Script from ADS severity high T1564.004
Run PowerShell Script from Redirected Input Stream severity high T1059
Rundll32 Execution Without CommandLine Parameters severity high T1202
Rundll32 Execution Without Parameters severity high T1021.002, T1569.002, T1570
Scheduled Task Creation Via Schtasks.EXE severity low T1053.005
Scheduled Task Creation with Curl and PowerShell Execution Combo severity medium T1053.005, T1105, T1218
Schtasks Creation Or Modification With SYSTEM Privileges severity high T1053.005
Screen Capture Activity Via Psr.EXE severity medium T1113
Script Event Consumer Spawning Process severity high T1047
Script Interpreter Spawning Credential Scanner - Windows severity high T1005, T1059.007, T1552
Scripting/CommandLine Process Spawned Regsvr32 severity medium T1218.010
Sdclt Child Processes severity medium T1548.002
Sdiagnhost Calling Suspicious Child Process severity high T1036, T1218
Security Service Disabled Via Reg.EXE severity high T1562.001
Sensitive File Access Via Volume Shadow Copy Backup severity high T1490
Shell Process Spawned by Java.EXE severity medium
ShimCache Flush severity high T1112
Start of NT Virtual DOS Machine severity medium
Sticky Key Like Backdoor Execution severity critical T1546.008
Suspect Svchost Activity severity high T1055
Suspicious ArcSOC.exe Child Process severity high T1059, T1203
Suspicious Binary In User Directory Spawned From Office Application severity high T1204.002
Suspicious BitLocker Access Agent Update Utility Execution severity high T1021.003, T1218
Suspicious Calculator Usage severity high T1036
Suspicious Child Process of AspNetCompiler severity high T1127
Suspicious Child Process Of BgInfo.EXE severity high T1059.005, T1202, T1218
Suspicious Child Process Of Manage Engine ServiceDesk severity high T1102
Suspicious Child Process of Notepad++ Updater - GUP.Exe severity high T1195.002, T1557
Suspicious Child Process Of SQL Server severity high T1190, T1505.003
Suspicious Child Process Of Wermgr.EXE severity high T1036, T1055
Suspicious Chromium Browser Instance Executed With Custom Extension severity high T1176.001
Suspicious ClickFix/FileFix Execution Pattern severity high T1204.001, T1204.004
Suspicious CodePage Switch Via CHCP severity medium T1036
Suspicious Command Patterns In Scheduled Task Creation severity high T1053.005
Suspicious CustomShellHost Execution severity high T1216
Suspicious Debugger Registration Cmdline severity high T1546.008
Suspicious Desktopimgdownldr Command severity high T1105
Suspicious Diantz Alternate Data Stream Execution severity medium T1564.004
Suspicious Diantz Download and Compress Into a CAB File severity medium T1105
Suspicious Double Extension File Execution severity high T1566.001
Suspicious Download from Office Domain severity high T1105, T1608
Suspicious Driver Install by pnputil.exe severity medium T1547
Suspicious Electron Application Child Processes severity medium
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call severity high T1027, T1059.001
Suspicious Execution From Outlook Temporary Folder severity high T1566.001
Suspicious Execution Location Of Wermgr.EXE severity high
Suspicious Execution of Hostname severity low T1082
Suspicious Execution of InstallUtil Without Log severity medium
Suspicious Execution of Powershell with Base64 severity medium T1059.001
Suspicious Execution of Shutdown severity medium T1529
Suspicious Execution of Shutdown to Log Out severity medium T1529
Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix severity high T1027.010, T1204.004
Suspicious Extrac32 Alternate Data Stream Execution severity medium T1564.004
Suspicious FileFix Execution Pattern severity high T1204.004
Suspicious FromBase64String Usage On Gzip Archive - Process Creation severity medium T1132.001
Suspicious GrpConv Execution severity high T1547
Suspicious GUP Usage severity high T1574.001
Suspicious High IntegrityLevel Conhost Legacy Option severity informational T1202
Suspicious HWP Sub Processes severity high T1059.003, T1203, T1566.001
Suspicious IIS Module Registration severity high T1505.004
Suspicious Kernel Dump Using Dtrace severity high T1082
Suspicious Modification Of Scheduled Tasks severity high T1053.005
Suspicious Msiexec Execute Arbitrary DLL severity medium T1218.007
Suspicious Network Command severity low T1016
Suspicious New Service Creation severity high T1543.003
Suspicious Obfuscated PowerShell Code severity high
Suspicious Outlook Child Process severity high T1204.002
Suspicious Ping/Del Command Combination severity high T1070.004
Suspicious PowerShell Download and Execute Pattern severity high T1059.001
Suspicious PowerShell IEX Execution Patterns severity high T1059.001
Suspicious PowerShell Invocations - Specific - ProcessCreation severity medium
Suspicious PowerShell Mailbox Export to Share severity critical
Suspicious PowerShell Parameter Substring severity high T1059.001
Suspicious Process Created Via Wmic.EXE severity high T1047
Suspicious Process Execution From Fake Recycle.Bin Folder severity high
Suspicious Process Parents severity high T1036
Suspicious Process Patterns NTDS.DIT Exfil severity high T1003.003
Suspicious Process Start Locations severity medium T1036
Suspicious Processes Spawned by Java.EXE severity high
Suspicious Processes Spawned by WinRM severity high T1190
Suspicious Program Names severity high T1059
Suspicious Provlaunch.EXE Child Process severity high T1218
Suspicious Query of MachineGUID severity low T1082
Suspicious RASdial Activity severity medium T1059
Suspicious RDP Redirect Using TSCON severity high T1021.001, T1563.002
Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet severity medium T1087.001
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS severity high T1059.005, T1615
Suspicious Recursive Takeown severity medium T1222.001
Suspicious Redirection to Local Admin Share severity high T1048
Suspicious Reg Add BitLocker severity high T1486
Suspicious Remote Child Process From Outlook severity high T1059, T1202
Suspicious RunAs-Like Flag Combination severity medium
Suspicious Rundll32 Activity Invoking Sys File severity high T1218.011
Suspicious Rundll32 Invoking Inline VBScript severity high T1055
Suspicious Runscripthelper.exe severity medium T1059, T1202
Suspicious Scan Loop Network severity medium T1018, T1059
Suspicious Scheduled Task Creation Involving Temp Folder severity high T1053.005
Suspicious Scheduled Task Name As GUID severity medium T1053.005
Suspicious Schtasks Execution AppData Folder severity high T1053.005, T1059.001
Suspicious ScreenSave Change by Reg.exe severity medium T1546.002
Suspicious Script Execution From Temp Folder severity high T1059
Suspicious Serv-U Process Pattern severity high T1555
Suspicious Service Binary Directory severity high T1202
Suspicious Service Path Modification severity high T1543.003
Suspicious Shells Spawn by Java Utility Keytool severity high
Suspicious Speech Runtime Binary Child Process severity high T1021.003, T1218
Suspicious Splwow64 Without Params severity high T1202
Suspicious SYSVOL Domain Group Policy Access severity medium T1552.006
Suspicious TSCON Start as SYSTEM severity high T1219.002
Suspicious UltraVNC Execution severity high T1021.005
Suspicious Usage Of ShellExec_RunDLL severity high
Suspicious VBoxDrvInst.exe Parameters severity medium T1112
Suspicious Velociraptor Child Process severity high T1219
Suspicious Vsls-Agent Command With AgentExtensionPath Load severity medium T1218
Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE severity medium T1562.001
Suspicious WindowsTerminal Child Processes severity medium
Suspicious WmiPrvSE Child Process severity high T1047, T1204.002, T1218.010
Suspicious X509Enrollment - Process Creation severity medium T1553.004
Suspicious ZipExec Execution severity medium T1202, T1218
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code severity medium T1216, T1218
Sysprep on AppData Folder severity medium T1059
System File Execution Location Anomaly severity high T1036
System Information Discovery via Registry Queries severity low T1082
Tamper Windows Defender Remove-MpPreference severity high T1562.001
Tap Installer Execution severity medium T1048
Taskkill Symantec Endpoint Protection severity high T1562.001
Taskmgr as LOCAL_SYSTEM severity high T1036
Tasks Folder Evasion severity high T1574.001
Time Travel Debugging Utility Usage severity high T1003.001, T1218
TrustedPath UAC Bypass Pattern severity critical T1548.002
UAC Bypass Tools Using ComputerDefaults severity high T1548.002
UAC Bypass Using ChangePK and SLUI severity high T1548.002
UAC Bypass Using Consent and Comctl32 - Process severity high T1548.002
UAC Bypass Using DismHost severity high T1548.002
UAC Bypass Using Event Viewer RecentViews severity high
UAC Bypass Using IEInstal - Process severity high T1548.002
UAC Bypass Using MSConfig Token Modification - Process severity high T1548.002
UAC Bypass Using PkgMgr and DISM severity high T1548.002
UAC Bypass WSReset severity high T1548.002
UEFI Persistence Via Wpbbin - ProcessCreation severity high T1542.001
Uncommon Child Process Of AddinUtil.EXE severity medium T1218
Uncommon Child Process Of Appvlp.EXE severity medium T1218
Uncommon Child Process Of BgInfo.EXE severity medium T1059.005, T1202, T1218
Uncommon Child Process Of Conhost.EXE severity medium T1202
Uncommon Child Process Of Defaultpack.EXE severity medium T1218
Uncommon Child Process Of Setres.EXE severity high T1202, T1218
Uncommon Child Process Spawned By Odbcconf.EXE severity medium T1218.008
Uncommon Child Processes Of SndVol.exe severity medium
Uncommon FileSystem Load Attempt By Format.com severity high
Uncommon Link.EXE Parent Process severity medium T1218
Uncommon Sigverif.EXE Child Process severity medium T1216
Uncommon Svchost Command Line Parameter severity high T1036.005, T1055, T1055.012
Uncommon Svchost Parent Process severity medium T1036.005
Uncommon Userinit Child Process severity high T1037.001
Uninstall Crowdstrike Falcon Sensor severity high T1562.001
Unusual Child Process of dns.exe severity high T1133
Unusual Parent Process For Cmd.EXE severity medium T1059
Usage Of Web Request Commands And Cmdlets severity medium T1059.001
Use NTFS Short Name in Command Line severity medium T1564.004
Use NTFS Short Name in Image severity medium T1564.004
Use of Pcalua For Execution severity medium T1059
Use Of The SFTP.EXE Binary As A LOLBIN severity medium T1218
User Added To Highly Privileged Group severity high T1098
User Added to Local Administrators Group severity medium T1098
User Added to Remote Desktop Users Group severity high T1021.001, T1133, T1136.001
UtilityFunctions.ps1 Proxy Dll severity medium T1216
Veeam Backup Database Suspicious Query severity medium T1005
VeeamBackup Database Credentials Dump Via Sqlcmd.EXE severity high T1005
Virtualbox Driver Installation or Starting of VMs severity low T1564, T1564.006
Visual Basic Command Line Compiler Usage severity high T1027.004
Visual Studio Code Tunnel Service Installation severity medium T1071.001
Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution severity medium T1218
VolumeShadowCopy Symlink Creation Via Mklink severity high T1003.002, T1003.003
Wab Execution From Non Default Location severity high
Wab/Wabmig Unusual Parent Or Child Processes severity high
Weak or Abused Passwords In CLI severity medium
Webshell Hacking Activity Patterns severity high T1018, T1033, T1087, T1505.003
Webshell Tool Reconnaissance Activity severity high T1505.003
WhoAmI as Parameter severity high T1033
Windows Processes Suspicious Parent Directory severity low T1036.003, T1036.005
WMI Backdoor Exchange Transport Agent severity critical T1546.003
WMI Persistence - Script Event Consumer severity medium T1546.003
WmiPrvSE Spawned A Process severity medium T1047
Write Protect For Storage Disabled severity medium T1562
Writing Of Malicious Files To The Fonts Folder severity medium T1059, T1211
Wscript Shell Run In CommandLine severity medium T1059
WSL Child Process Anomaly severity medium T1202, T1218
WSL Kali-Linux Usage severity high T1202
Wusa.EXE Executed By Parent Process Located In Suspicious Location severity high

Elastic (1)

Potential LSASS Clone Creation via PssCaptureSnapShot T1003, T1003.001

Microsoft-Windows-Security-Auditing event 4688

Sigma (493)

Elastic (1)

Splunk (18)

Keyboard Shortcuts