Detection rules › By event

Microsoft-Windows-Security-Auditing event 5145

27 detection rules reference this event. View event page.

Sigma (17)

DCERPC SMB Spoolss Named Pipe severity medium T1021.002
DCOM InternetExplorer.Application Iertutil DLL Hijack - Security severity high T1021.002, T1021.003
First Time Seen Remote Named Pipe severity high T1021.002
Impacket PsExec Execution severity high T1021.002
Persistence and Execution at Scale via GPO Scheduled Task severity high T1053.005
Possible Impacket SecretDump Remote Activity severity high T1003.002, T1003.003, T1003.004
Possible PetitPotam Coerce Authentication Attempt severity high T1187
Protected Storage Service Access severity high T1021.002
Remote Service Activity via SVCCTL Named Pipe severity medium T1021.002
Remote Task Creation via ATSVC Named Pipe severity medium T1053.002
SMB Create Remote File Admin Share severity high T1021.002
Startup/Logon Script Added to Group Policy Object severity medium T1484.001, T1547
Suspicious Access to Sensitive File Extensions severity medium T1039
Suspicious PsExec Execution severity high T1021.002
T1047 Wmiprvse Wbemcomn DLL Hijack severity high T1021.002, T1047
Transferring Files with Credential Data via Network Shares severity medium T1003.001, T1003.002, T1003.003
Windows Network Access Suspicious desktop.ini Action severity medium T1547.009

Splunk (4)