Detection rules › By event

Microsoft-Windows-Sysmon event 1

1231 detection rules reference this event. View event page.

Sigma (1171)

7Zip Compressing Dump Files severity medium T1560.001
AADInternals PowerShell Cmdlets Execution - ProccessCreation severity high
Abuse of Service Permissions to Hide Services Via Set-Service severity high T1574.011
Abused Debug Privilege by Arbitrary Parent Processes severity high T1548
Abusing Print Executable severity medium T1218
Active Directory Database Snapshot Via ADExplorer severity medium T1069.002, T1087.002, T1482
Active Directory Structure Export Via Csvde.EXE severity medium T1087.002
Active Directory Structure Export Via Ldifde.EXE severity medium
Add Insecure Download Source To Winget severity high T1059
Add New Download Source To Winget severity medium T1059
Add Potential Suspicious New Download Source To Winget severity medium T1059
Add SafeBoot Keys Via Reg Utility severity high T1562.001
Add Windows Capability Via PowerShell Cmdlet severity medium
AddinUtil.EXE Execution From Uncommon Directory severity medium T1218
AgentExecutor PowerShell Execution severity medium T1218
All Backups Deleted Via Wbadmin.EXE severity high T1490
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE severity high T1543.003
Always Install Elevated MSI Spawned Cmd And Powershell severity medium T1548.002
Always Install Elevated Windows Installer severity medium T1548.002
Application Removed Via Wmic.EXE severity medium T1047
Application Terminated Via Wmic.EXE severity medium T1047
Arbitrary Binary Execution Using GUP Utility severity medium
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE severity medium T1218
Arbitrary File Download Via ConfigSecurityPolicy.EXE severity medium T1567
Arbitrary File Download Via GfxDownloadWrapper.EXE severity medium T1105
Arbitrary File Download Via IMEWDBLD.EXE severity high T1218
Arbitrary File Download Via MSEDGE_PROXY.EXE severity medium T1218
Arbitrary File Download Via MSOHTMED.EXE severity medium T1218
Arbitrary File Download Via MSPUB.EXE severity medium T1218
Arbitrary File Download Via PresentationHost.EXE severity medium T1218
Arbitrary File Download Via Squirrel.EXE severity medium T1218
Arbitrary MSI Download Via Devinit.EXE severity medium T1218
Arbitrary Shell Command Execution Via Settingcontent-Ms severity medium T1204, T1566.001
AspNetCompiler Execution severity medium T1127
Assembly Loading Via CL_LoadAssembly.ps1 severity medium T1216
Attempts of Kerberos Coercion Via DNS SPN Spoofing severity high T1187, T1557.001
Audio Capture via PowerShell severity medium T1123
Audio Capture via SoundRecorder severity medium T1123
Audit Policy Tampering Via Auditpol severity high T1562.002
Audit Policy Tampering Via NT Resource Kit Auditpol severity high T1562.002
Automated Collection Command Prompt severity medium T1119, T1552.001
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl severity medium T1216
Bad Opsec Defaults Sacrificial Processes With Improper Arguments severity high T1218.011
Base64 Encoded PowerShell Command Detected severity high T1027, T1059.001, T1140
Base64 MZ Header In CommandLine severity high
Binary Proxy Execution Via Dotnet-Trace.EXE severity medium T1218
BitLockerTogo.EXE Execution severity low T1218
Boot Configuration Tampering Via Bcdedit.EXE severity high T1490
Browser Execution In Headless Mode severity low T1105, T1564.003
Browser Started with Remote Debugging severity medium T1185
Bypass UAC via CMSTP severity high T1218.003, T1548.002
Bypass UAC via Fodhelper.exe severity high T1548.002
Bypass UAC via WSReset.exe severity high T1548.002
C# IL Code Compilation Via Ilasm.EXE severity medium T1127
Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths severity high
Capture Credentials with Rpcping.exe severity medium T1003
Certificate Exported Via Certutil.EXE severity medium T1027
Certificate Exported Via PowerShell severity medium T1059.001, T1552.004
Change Default File Association To Executable Via Assoc severity high T1546.001
Change Default File Association Via Assoc severity low T1546.001
Change PowerShell Policies to an Insecure Level severity medium T1059.001
Changing Existing Service ImagePath Value Via Reg.EXE severity medium T1574.011
Chopper Webshell Process Pattern severity high T1018, T1033, T1087, T1505.003
Chromium Browser Headless Execution To Mockbin Like Site severity high
Chromium Browser Instance Executed With Custom Extension severity medium T1176.001
Cloudflared Portable Execution severity medium T1090.001
Cloudflared Quick Tunnel Execution severity medium T1090.001
Cloudflared Tunnel Connections Cleanup severity medium T1090, T1102, T1572
Cloudflared Tunnel Execution severity medium T1090, T1102, T1572
Cmd Launched with Hidden Start Flags to Suspicious Targets severity medium T1564.003
Cmd.EXE Missing Space Characters Execution Anomaly severity high T1059.001
CMSTP Execution Process Creation severity high T1218.003
CMSTP UAC Bypass via COM Object Access severity high T1218.003, T1548.002
CobaltStrike Load by Rundll32 severity high T1218.011
Code Execution via Pcwutl.dll severity medium T1218.011
CodePage Modification Via MODE.COM To Russian Language severity medium T1036
COM Object Execution via Xwizard.EXE severity medium T1218
Command Line Execution with Suspicious URL and AppData Strings severity medium T1059.001, T1059.003, T1105
Compress Data and Lock With Password for Exfiltration With 7-ZIP severity medium T1560.001
Compress Data and Lock With Password for Exfiltration With WINZIP severity medium T1560.001
Compressed File Creation Via Tar.EXE severity low T1560, T1560.001
Compressed File Extraction Via Tar.EXE severity low T1560, T1560.001
Computer Discovery And Export Via Get-ADComputer Cmdlet severity medium T1033
Computer Password Change Via Ksetup.EXE severity medium
Computer System Reconnaissance Via Wmic.EXE severity medium T1047
Conhost Spawned By Uncommon Parent Process severity medium T1059
Conhost.exe CommandLine Path Traversal severity high T1059.003
Console CodePage Lookup Via CHCP severity medium T1614.001
Control Panel Items severity high T1218.002, T1546
ConvertTo-SecureString Cmdlet Usage Via CommandLine severity medium T1027, T1059.001
Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE severity high
Copy From Or To Admin Share Or Sysvol Folder severity medium T1021.002, T1039, T1048
Copy From VolumeShadowCopy Via Cmd.EXE severity high T1490
Copying Sensitive Files with Credential Data severity high T1003.002, T1003.003
CreateDump Process Dump severity high T1003.001, T1036
Csc.EXE Execution Form Potentially Suspicious Parent severity high T1027.004, T1059.005, T1059.007, T1218.005
Cscript/Wscript Potentially Suspicious Child Process severity medium
Cscript/Wscript Uncommon Script Extension Execution severity high T1059.005, T1059.007
Curl Download And Execute Combination severity high T1105, T1218
Curl Web Request With Potential Custom User-Agent severity medium
Data Copied To Clipboard Via Clip.EXE severity low T1115
Data Export From MSSQL Table Via BCP.EXE severity medium T1048
Delete All Scheduled Tasks severity high T1489
Delete Important Scheduled Task severity high T1489
Deleted Data Overwritten Via Cipher.EXE severity medium T1485
Deletion of Volume Shadow Copies via WMI with PowerShell severity high T1490
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE severity high T1543.003
Detected Windows Software Discovery severity medium T1518
Detection of PowerShell Execution via Sqlps.exe severity medium T1059.001, T1127
Devcon Execution Disabling VMware VMCI Device severity high T1543.003, T1562.001
DeviceCredentialDeployment Execution severity medium T1218
Devtoolslauncher.exe Executes Specified Binary severity high T1218
Direct Autorun Keys Modification severity medium T1547.001
Directory Removal Via Rmdir severity low T1070.004
DirLister Execution severity low T1083
Disable Important Scheduled Task severity high T1489
Disable Windows Defender AV Security Monitoring severity high T1562.001
Disable Windows IIS HTTP Logging severity high T1562.002
Disabled IE Security Features severity high T1562.001
Disabled Volume Snapshots severity high T1562.001
Disabling Windows Defender WMI Autologger Session via Reg.exe severity high T1562.001
Discovery of a System Time severity low T1124
Diskshadow Script Mode - Execution From Potential Suspicious Location severity medium T1218
Diskshadow Script Mode - Uncommon Script Extension Execution severity medium T1218
Dism Remove Online Package severity medium T1562.001
DLL Execution via Rasautou.exe severity medium T1218
DLL Execution Via Register-cimprovider.exe severity medium T1574
DLL Loaded via CertOC.EXE severity medium T1218
DLL Sideloading by VMware Xfer Utility severity high T1574.001
Dllhost.EXE Execution Anomaly severity high T1055
DllUnregisterServer Function Call Via Msiexec.EXE severity medium T1218.007
DNS Exfiltration and Tunneling Tools Execution severity high T1048.001, T1071.004, T1132.001
Domain Trust Discovery Via Dsquery severity medium T1482
Driver/DLL Installation Via Odbcconf.EXE severity medium T1218.008
DriverQuery.EXE Execution severity medium
Dropping Of Password Filter DLL severity medium T1556.002
DSInternals Suspicious PowerShell Cmdlets severity high T1059.001
Dumping of Sensitive Hives Via Reg.EXE severity high T1003.002, T1003.004, T1003.005
Dumping Process via Sqldumper.exe severity medium T1003.001
DumpMinitool Execution severity medium T1003.001, T1036
DumpStack.log Defender Evasion severity critical
Dynamic .NET Compilation Via Csc.EXE severity medium T1027.004
Elevated System Shell Spawned From Uncommon Parent Location severity medium T1059
Email Exifiltration Via Powershell severity high
Enable LM Hash Storage - ProcCreation severity high T1112
Enumerate All Information With Whoami.EXE severity medium T1033
Enumeration for 3rd Party Creds From CLI severity medium T1552.002
Enumeration for Credentials in Registry severity medium T1552.002
Esentutl Gather Credentials severity medium T1003, T1003.003
Esentutl Steals Browser Information severity medium T1005
ETW Logging Tamper In .NET Processes Via CommandLine severity high T1562
ETW Trace Evasion Activity severity high T1070, T1562.006
Exchange PowerShell Snap-Ins Usage severity high T1059.001, T1114
Execute Code with Pester.bat severity medium T1059.001, T1216
Execute Code with Pester.bat as Parent severity medium T1059.001, T1216
Execute Files with Msdeploy.exe severity medium T1218
Execute From Alternate Data Streams severity medium T1564.004
Execute Pcwrun.EXE To Leverage Follina severity high T1218
Execution Of Non-Existing File severity high
Execution of Powershell Script in Public Folder severity high T1059.001
Execution of Suspicious File Type Extension severity medium
Execution via stordiag.exe severity high T1218
Execution via WorkFolders.exe severity high T1218
Explorer NOUACCHECK Flag severity high T1548.002
Explorer Process Tree Break severity medium T1036
Exports Critical Registry Keys To a File severity high T1012
Exports Registry Key To a File severity low T1012
File And SubFolder Enumeration Via Dir Command severity low T1217
File Decoded From Base64/Hex Via Certutil.EXE severity high T1027
File Decryption Using Gpg4win severity medium
File Deletion Via Del severity low T1070.004
File Download And Execution Via IEExec.EXE severity high T1105
File Download From Browser Process Via Inline URL severity medium T1105
File Download From IP Based URL Via CertOC.EXE severity high T1105
File Download From IP URL Via Curl.EXE severity medium
File Download Using Notepad++ GUP Utility severity high T1105
File Download Using ProtocolHandler.exe severity medium T1218
File Download Via Bitsadmin severity medium T1036.003, T1105, T1197
File Download Via Bitsadmin To A Suspicious Target Folder severity high T1036.003, T1105, T1197
File Download via CertOC.EXE severity medium T1105
File Download Via InstallUtil.EXE severity medium T1218
File Download Via Windows Defender MpCmpRun.EXE severity high T1105, T1218
File Download with Headless Browser severity high T1105, T1564.003
File Encoded To Base64 Via Certutil.EXE severity medium T1027
File Encryption Using Gpg4win severity medium
File Encryption/Decryption Via Gpg4win From Suspicious Locations severity high
File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell severity high T1135
File In Suspicious Location Encoded To Base64 Via Certutil.EXE severity high T1027
File Recovery From Backup Via Wbadmin.EXE severity medium T1490
File With Suspicious Extension Downloaded Via Bitsadmin severity high T1036.003, T1105, T1197
Files Added To An Archive Using Rar.EXE severity low T1560.001
Filter Driver Unloaded Via Fltmc.EXE severity medium T1070, T1562, T1562.002
Findstr GPP Passwords severity high T1552.006
Findstr Launching .lnk File severity medium T1027.003, T1036, T1202
Finger.EXE Execution severity high T1105
Firewall Configuration Discovery Via Netsh.EXE severity low T1016
Firewall Disabled via Netsh.EXE severity medium T1562.004
Firewall Rule Deleted Via Netsh.EXE severity medium T1562.004
Firewall Rule Update Via Netsh.EXE severity medium
Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet severity medium T1074.001
Forfiles Command Execution severity medium T1059
Forfiles.EXE Child Process Masquerading severity high T1036
Fsutil Drive Enumeration severity low T1120
Fsutil Suspicious Invocation severity high T1070, T1485
Github Self-Hosted Runner Execution severity medium T1071, T1102.002
Gpresult Display Group Policy Information severity medium T1615
Gpscript Execution severity medium T1218
Greedy File Deletion Using Del severity medium T1070.004
Group Membership Reconnaissance Via Whoami.EXE severity medium T1033
Gzip Archive Decode Via PowerShell severity medium T1132.001
HackTool - ADCSPwn Execution severity high T1557.001
HackTool - Bloodhound/Sharphound Execution severity high T1059.001, T1069.001, T1069.002, T1087.001, T1087.002, T1482
HackTool - Certify Execution severity high T1649
HackTool - Certipy Execution severity high T1649
HackTool - CoercedPotato Execution severity high T1055
HackTool - Covenant PowerShell Launcher severity high T1059.001, T1564.003
HackTool - CrackMapExec Execution severity high T1047, T1053, T1059.001, T1059.003, T1110, T1201
HackTool - CrackMapExec Execution Patterns severity high T1047, T1053, T1059.001, T1059.003
HackTool - CrackMapExec PowerShell Obfuscation severity high T1027.005, T1059.001
HackTool - CrackMapExec Process Patterns severity high T1003.001
HackTool - CreateMiniDump Execution severity high T1003.001
HackTool - Default PowerSploit/Empire Scheduled Task Creation severity high T1053.005, T1059.001
HackTool - DInjector PowerShell Cradle Execution severity critical T1055
HackTool - Doppelanger LSASS Dumper Execution severity high T1003.001
HackTool - Dumpert Process Dumper Execution severity critical T1003.001
Hacktool - EDR-Freeze Execution severity high T1562.001
HackTool - EDRSilencer Execution severity high T1562
HackTool - Empire PowerShell Launch Parameters severity high T1059.001
HackTool - Empire PowerShell UAC Bypass severity critical T1548.002
HackTool - F-Secure C3 Load by Rundll32 severity critical T1218.011
HackTool - GMER Rootkit Detector and Remover Execution severity high
HackTool - HandleKatz LSASS Dumper Execution severity high T1003.001
HackTool - Hashcat Password Cracker Execution severity high T1110.002
HackTool - HollowReaper Execution severity high T1055.012
HackTool - Htran/NATBypass Execution severity high T1090
HackTool - Hydra Password Bruteforce Execution severity high T1110, T1110.001
HackTool - Impacket Tools Execution severity high T1557.001
HackTool - Impersonate Execution severity medium T1134.001, T1134.003
HackTool - Inveigh Execution severity critical T1003.001
HackTool - Jlaive In-Memory Assembly Execution severity medium T1059.003
HackTool - Koadic Execution severity high T1059.003, T1059.005, T1059.007
HackTool - KrbRelay Execution severity high T1558.003
HackTool - KrbRelayUp Execution severity high T1550.003, T1558.003
HackTool - LaZagne Execution severity medium
HackTool - LocalPotato Execution severity high
HackTool - Mimikatz Execution severity high T1003.001, T1003.002, T1003.004, T1003.005, T1003.006
HackTool - NetExec Execution severity high T1018, T1021
HackTool - PCHunter Execution severity high T1007, T1012, T1057, T1082, T1083
HackTool - Potential Impacket Lateral Movement Activity severity high T1021.003, T1047
HackTool - PowerTool Execution severity high T1562.001
HackTool - PPID Spoofing SelectMyParent Tool Execution severity high T1134.004
HackTool - PurpleSharp Execution severity critical T1587
HackTool - Pypykatz Credentials Dumping Activity severity high T1003.002
HackTool - Quarks PwDump Execution severity high T1003.002
HackTool - RedMimicry Winnti Playbook Execution severity high T1059.003, T1106, T1218.011
HackTool - RemoteKrbRelay Execution severity high T1558.003
HackTool - Rubeus Execution severity critical T1003, T1550.003, T1558.003
HackTool - SafetyKatz Execution severity critical T1003.001
HackTool - SecurityXploded Execution severity critical T1555
HackTool - SharpChisel Execution severity high T1090.001
HackTool - SharpDPAPI Execution severity high T1134.001, T1134.003
HackTool - SharPersist Execution severity high T1053
HackTool - SharpEvtMute Execution severity high T1562.002
HackTool - SharpImpersonation Execution severity high T1134.001, T1134.003
HackTool - SharpLDAPmonitor Execution severity medium
HackTool - SharpLdapWhoami Execution severity high T1033
HackTool - SharpMove Tool Execution severity high T1021.002
HackTool - SharpUp PrivEsc Tool Execution severity critical T1569.002, T1574.005, T1615
HackTool - SharpView Execution severity high T1033, T1049, T1069.002, T1135, T1482
HackTool - SharpWSUS/WSUSpendu Execution severity high T1210
HackTool - SILENTTRINITY Stager Execution severity high T1071
HackTool - Sliver C2 Implant Activity Pattern severity critical T1059
HackTool - SOAPHound Execution severity high T1087
HackTool - Stracciatella Execution severity high T1059, T1562.001
HackTool - SysmonEOP Execution severity critical T1068
HackTool - TruffleSnout Execution severity high T1482
HackTool - UACMe Akagi Execution severity high T1548.002
HackTool - Windows Credential Editor (WCE) Execution severity critical T1003.001
HackTool - winPEAS Execution severity high T1046, T1082, T1087
HackTool - WinPwn Execution severity high T1046, T1082, T1106, T1518, T1548.002, T1552.001
HackTool - WinRM Access Via Evil-WinRM severity medium T1021.006
HackTool - Wmiexec Default Powershell Command severity high
HackTool - WSASS Execution severity high T1003.001
HackTool - XORDump Execution severity high T1003.001, T1036
Hacktool Execution - Imphash severity critical T1003, T1588.002
Hacktool Execution - PE Metadata severity high T1003, T1588.002
Hardware Model Reconnaissance Via Wmic.EXE severity medium T1047
Harvesting Of Wifi Credentials Via Netsh.EXE severity medium T1040
HH.EXE Execution severity low T1218.001
Hidden Powershell in Link File Pattern severity medium T1059.001
Hiding Files with Attrib.exe severity medium T1564.001
Hiding User Account Via SpecialAccounts Registry Key - CommandLine severity medium T1564.002
HKTL - SharpSuccessor Privilege Escalation Tool Execution severity high T1068
HTML Help HH.EXE Suspicious Child Process severity high T1047, T1059.001, T1059.003, T1059.005, T1059.007, T1218
Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine severity high T1562.001
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI severity high
Ie4uinit Lolbin Use From Invalid Path severity medium T1218
IIS Native-Code Module Command Line Installation severity medium T1505.003
IIS WebServer Log Deletion via CommandLine Utilities severity medium T1070
ImagingDevices Unusual Parent/Child Processes severity high
Import LDAP Data Interchange Format File Via Ldifde.EXE severity medium T1105, T1218
Import PowerShell Modules From Suspicious Directories - ProcCreation severity medium T1059.001
Imports Registry Key From a File severity medium T1112
Imports Registry Key From an ADS severity high T1112
Indirect Command Execution By Program Compatibility Wizard severity low T1218
Indirect Command Execution From Script File Via Bash.EXE severity medium T1202
Indirect Inline Command Execution Via Bash.EXE severity medium T1202
InfDefaultInstall.exe .inf Execution severity medium T1218
Insecure Proxy/DOH Transfer Via Curl.EXE severity medium
Insecure Transfer Via Curl.EXE severity medium
Insensitive Subfolder Search Via Findstr.EXE severity low T1105, T1218, T1552.001, T1564.004
Install New Package Via Winget Local Manifest severity medium T1059
Installation of WSL Kali-Linux severity high T1059
Interactive AT Job severity high T1053.002
Interesting Service Enumeration Via Sc.EXE severity low T1003
Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) severity medium T1003.003
Invoke-Obfuscation CLIP+ Launcher severity high T1027, T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION severity medium T1027, T1059.001
Invoke-Obfuscation Obfuscated IEX Invocation severity high T1027, T1059.001
Invoke-Obfuscation STDIN+ Launcher severity high T1027, T1059.001
Invoke-Obfuscation VAR+ Launcher severity high T1027, T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION severity high T1027, T1059.001
Invoke-Obfuscation Via Stdin severity high T1027, T1059.001
Invoke-Obfuscation Via Use Clip severity high T1027, T1059.001
Invoke-Obfuscation Via Use MSHTA severity high T1027, T1059.001
Java Running with Remote Debugging severity medium T1203
JScript Compiler Execution severity low T1127
Kavremover Dropped Binary LOLBIN Usage severity high T1127
Kernel Memory Dump Via LiveKD severity high
Launch-VsDevShell.PS1 Proxy Execution severity medium T1216.001
Loaded Module Enumeration Via Tasklist.EXE severity medium T1003
Local Accounts Discovery severity low T1033, T1087.001
Local File Read Using Curl.EXE severity medium
Local Groups Reconnaissance Via Wmic.EXE severity low T1069.001
Logged-On User Password Change Via Ksetup.EXE severity medium
LOL-Binary Copied From System Directory severity high T1036.003
LOLBAS Data Exfiltration by DataSvcUtil.exe severity medium T1567
LOLBIN Execution From Abnormal Drive severity medium
Lolbin Runexehelper Use As Proxy severity medium T1218
Lolbin Unregmp2.exe Use As Proxy severity medium T1218
LSA PPL Protection Setting Modification via CommandLine severity medium T1562.010
LSASS Dump Keyword In CommandLine severity high T1003.001
LSASS Process Reconnaissance Via Findstr.EXE severity high T1552.006
Malicious Base64 Encoded PowerShell Keywords in Command Lines severity high T1059.001
Malicious PE Execution by Microsoft Visual Studio Debugger severity medium T1218
Malicious PowerShell Commandlets - ProcessCreation severity high T1059.001, T1069, T1069.001, T1069.002, T1087, T1087.001
Malicious Windows Script Components File Execution by TAEF Detection severity low T1218
ManageEngine Endpoint Central Dctask64.EXE Potential Abuse severity high T1055.001
Mavinject Inject DLL Into Running Process severity high T1055.001, T1218.013
Microsoft IIS Connection Strings Decryption severity high T1003
Microsoft IIS Service Account Password Dumped severity high T1003
MMC Executing Files with Reversed Extensions Using RTLO Abuse severity high T1036.002, T1204.002, T1218.014
MMC Spawning Windows Shell severity high T1021.003
MMC20 Lateral Movement severity high T1021.003
Modify Group Policy Settings severity medium T1484.001
Monitoring For Persistence Via BITS severity medium T1197
MpiExec Lolbin severity high T1218
MSDT Execution Via Answer File severity high T1218
MSExchange Transport Agent Installation severity medium T1505.002
MSHTA Execution with Suspicious File Extensions severity high T1059.007, T1140, T1218.005
Mshtml.DLL RunHTMLApplication Suspicious Usage severity high
Msiexec Quiet Installation severity medium T1218.007
MsiExec Web Install severity medium T1105, T1218.007
Mstsc.EXE Execution From Uncommon Parent severity high
Mstsc.EXE Execution With Local RDP File severity low T1219.002
Msxsl.EXE Execution severity medium T1220
Net WebClient Casing Anomalies severity high T1059.001
Netsh Allow Group Policy on Microsoft Defender Firewall severity medium T1562.004
Network Reconnaissance Activity severity high T1082, T1087
New ActiveScriptEventConsumer Created Via Wmic.EXE severity high T1546.003
New Capture Session Launched Via DXCap.EXE severity medium T1218
New DLL Registered Via Odbcconf.EXE severity medium T1218.008
New DMSA Service Account Created in Specific OUs severity medium T1078.002, T1098
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE severity high T1112, T1574.001
New Firewall Rule Added Via Netsh.EXE severity medium T1562.004
New Generic Credentials Added Via Cmdkey.EXE severity medium T1003.005
New Kernel Driver Via SC.EXE severity medium T1543.003
New Network Trace Capture Started Via Netsh.EXE severity medium T1040
New Port Forwarding Rule Added Via Netsh.EXE severity medium T1090
New Process Created Via Taskmgr.EXE severity low T1036
New Process Created Via Wmic.EXE severity medium T1047
New Remote Desktop Connection Initiated Via Mstsc.EXE severity medium T1021.001
New Root Certificate Installed Via CertMgr.EXE severity medium T1553.004
New Root Certificate Installed Via Certutil.EXE severity medium T1553.004
New Service Creation Using PowerShell severity low T1543.003
New Service Creation Using Sc.EXE severity low T1543.003
New User Created Via Net.EXE severity medium T1136.001
New User Created Via Net.EXE With Never Expire Option severity high T1136.001
New Virtual Smart Card Created Via TpmVscMgr.EXE severity medium
Nltest.EXE Execution severity low T1016, T1018, T1482
Node Process Executions severity medium T1059.007, T1127
NodeJS Execution of JavaScript File severity low T1059.007
Non Interactive PowerShell Process Spawned severity low T1059.001
Non-privileged Usage of Reg or Powershell severity high T1112
Notepad Password Files Discovery severity low T1083
Nslookup PowerShell Download Cradle - ProcessCreation severity medium
NtdllPipe Like Activity Execution severity high
Obfuscated IP Download Activity severity medium
Obfuscated IP Via CLI severity medium
Obfuscated PowerShell MSI Install via WindowsInstaller COM severity high T1027.010, T1059.001, T1218.007
Obfuscated PowerShell OneLiner Execution severity high T1059.001, T1562.001
Odbcconf.EXE Suspicious DLL Location severity high T1218.008
OneNote.EXE Execution of Malicious Embedded Scripts severity high T1218.001
OpenEDR Spawning Command Shell severity medium T1021.004, T1059.003, T1219
OpenWith.exe Executes Specified Binary severity high T1218
Operator Bloopers Cobalt Strike Commands severity high T1059.003
Operator Bloopers Cobalt Strike Modules severity high T1059.003
Outlook EnableUnsafeClientMailRules Setting Enabled severity high T1059, T1202
Password Provided In Command Line Of Net.EXE severity medium T1021.002, T1078
Password Set to Never Expire via WMI severity medium T1047, T1098
PDQ Deploy Remote Adminstartion Tool Execution severity medium T1072
Perl Inline Command Execution severity medium T1059
Permission Check Via Accesschk.EXE severity medium T1069.001
Permission Misconfiguration Reconnaissance Via Findstr.EXE severity medium T1552.006
Persistence Via Sticky Key Backdoor severity critical T1546.008
Persistence Via TypedPaths - CommandLine severity medium
Phishing Pattern ISO in Archive severity high T1566
Php Inline Command Execution severity medium T1059
Ping Hex IP severity high T1027, T1140
PktMon.EXE Execution severity medium T1040
Port Forwarding Activity Via SSH.EXE severity medium T1021.001, T1021.004, T1572
Portable Gpg.EXE Execution severity medium T1486
Possible Privilege Escalation via Weak Service Permissions severity high T1574.011
Potential Active Directory Enumeration Using AD Module - ProcCreation severity medium
Potential Adplus.EXE Abuse severity high T1003.001
Potential Amazon SSM Agent Hijacking severity medium T1219.002
Potential AMSI Bypass Using NULL Bits severity medium T1562.001
Potential AMSI Bypass Via .NET Reflection severity high T1562.001
Potential Application Whitelisting Bypass via Dnx.EXE severity medium T1027.004, T1218
Potential Arbitrary Code Execution Via Node.EXE severity high T1127
Potential Arbitrary Command Execution Using Msdt.EXE severity high T1202
Potential Arbitrary Command Execution Via FTP.EXE severity medium T1059, T1202
Potential Arbitrary DLL Load Using Winword severity medium T1202
Potential Arbitrary File Download Using Office Application severity high T1202
Potential Arbitrary File Download Via Cmdl32.EXE severity medium T1202, T1218
Potential Binary Impersonating Sysinternals Tools severity medium T1036.005, T1202, T1218
Potential Binary Proxy Execution Via Cdb.EXE severity medium T1106, T1127, T1218
Potential Binary Proxy Execution Via VSDiagnostics.EXE severity medium T1218
Potential Browser Data Stealing severity medium T1555.003
Potential CobaltStrike Process Patterns severity high T1059
Potential COM Objects Download Cradles Usage - Process Creation severity medium T1105
Potential Command Line Path Traversal Evasion Attempt severity medium T1036
Potential Commandline Obfuscation Using Escape Characters severity medium T1140
Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image severity high T1027
Potential CommandLine Path Traversal Via Cmd.EXE severity high T1059.003
Potential Configuration And Service Reconnaissance Via Reg.EXE severity medium T1007, T1012
Potential Cookies Session Hijacking severity medium
Potential Credential Dumping Attempt Using New NetworkProvider - CLI severity high T1003
Potential Credential Dumping Via LSASS Process Clone severity critical T1003, T1003.001
Potential Credential Dumping Via WER severity high T1003.001
Potential Crypto Mining Activity severity high T1496
Potential Data Exfiltration Activity Via CommandLine Tools severity high T1059.001
Potential Data Stealing Via Chromium Headless Debugging severity high T1185, T1564.003
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 severity high
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 severity high
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 severity high
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 severity high
Potential Defense Evasion Via Binary Rename severity medium T1036.003
Potential Defense Evasion Via Rename Of Highly Relevant Binaries severity high T1036.003
Potential Defense Evasion Via Right-to-Left Override severity high T1036.002
Potential Discovery Activity Via Dnscmd.EXE severity medium
Potential DLL File Download Via PowerShell Invoke-WebRequest severity medium T1059.001, T1105
Potential DLL Injection Or Execution Using Tracker.exe severity medium T1055.001
Potential DLL Injection Via AccCheckConsole severity medium
Potential DLL Sideloading Via DeviceEnroller.EXE severity medium T1574.001
Potential Dosfuscation Activity severity medium T1059
Potential Download/Upload Activity Using Type Command severity medium T1105
Potential Dropper Script Execution Via WScript/CScript severity medium T1059.005, T1059.007
Potential Encoded PowerShell Patterns In CommandLine severity low T1027, T1059.001
Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp severity high T1021.003
Potential Execution of Sysinternals Tools severity low T1588.002
Potential Fake Instance Of Hxtsr.EXE Executed severity medium T1036
Potential File Download Via MS-AppInstaller Protocol Handler severity medium T1218
Potential File Overwrite Via Sysinternals SDelete severity high T1485
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI severity medium T1564.004
Potential Homoglyph Attack Using Lookalike Characters severity medium T1036, T1036.003
Potential Lateral Movement via Windows Remote Shell severity medium T1021.006
Potential LethalHTA Technique Execution severity high T1218.005
Potential LSASS Process Dump Via Procdump severity high T1003.001, T1036
Potential Manage-bde.wsf Abuse To Proxy Execution severity high T1216
Potential Memory Dumping Activity Via LiveKD severity medium
Potential Meterpreter/CobaltStrike Activity severity high T1134.001, T1134.002
Potential Mftrace.EXE Abuse severity medium T1127
Potential Mpclient.DLL Sideloading Via Defender Binaries severity high T1574.001
Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution severity medium T1218
Potential MsiExec Masquerading severity high T1036.005
Potential MSTSC Shadowing Activity severity high T1563.002
Potential Network Sniffing Activity Using Network Tools severity medium T1040
Potential NTLM Coercion Via Certutil.EXE severity high T1218
Potential Obfuscated Ordinal Call Via Rundll32 severity medium T1027.010
Potential Password Spraying Attempt Using Dsacls.EXE severity medium T1218
Potential Persistence Attempt Via Existing Service Tampering severity medium T1543.003, T1574.011
Potential Persistence Attempt Via Run Keys Using Reg.EXE severity medium T1547.001
Potential Persistence Via Logon Scripts - CommandLine severity high T1037.001
Potential Persistence Via Microsoft Compatibility Appraiser severity medium T1053.005
Potential Persistence Via Netsh Helper DLL severity medium T1546.007
Potential Persistence Via Powershell Search Order Hijacking - Task severity high T1053.005, T1059.001
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script severity medium T1059
Potential PowerShell Command Line Obfuscation severity high T1027, T1059.001
Potential PowerShell Console History Access Attempt via History File severity medium T1552.001
Potential PowerShell Downgrade Attack severity medium T1059.001
Potential PowerShell Execution Policy Tampering - ProcCreation severity high
Potential PowerShell Execution Via DLL severity high T1218.011
Potential PowerShell Obfuscation Via Reversed Commands severity high T1027, T1059.001
Potential PowerShell Obfuscation Via WCHAR/CHAR severity high T1027, T1059.001
Potential Powershell ReverseShell Connection severity high T1059.001
Potential Privilege Escalation To LOCAL SYSTEM severity high T1587.001
Potential Privilege Escalation Using Symlink Between Osk and Cmd severity high T1546.008
Potential Privilege Escalation via Service Permissions Weakness severity high T1574.011
Potential Process Execution Proxy Via CL_Invocation.ps1 severity medium T1216
Potential Process Injection Via Msra.EXE severity high T1055
Potential Product Class Reconnaissance Via Wmic.EXE severity medium T1047, T1082
Potential Product Reconnaissance Via Wmic.EXE severity medium T1047
Potential Provisioning Registry Key Abuse For Binary Proxy Execution severity high T1218
Potential Provlaunch.EXE Binary Proxy Execution Abuse severity medium T1218
Potential PsExec Remote Execution severity high T1587.001
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE severity medium T1070, T1542.003
Potential RDP Session Hijacking Activity severity medium
Potential RDP Tunneling Via Plink severity high T1572
Potential RDP Tunneling Via SSH severity high T1572
Potential Recon Activity Using DriverQuery.EXE severity high
Potential Recon Activity Via Nltest.EXE severity medium T1016, T1482
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS severity medium T1059.005, T1615
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE severity high T1003.005
Potential ReflectDebugger Content Execution Via WerFault.EXE severity medium T1036
Potential Register_App.Vbs LOLScript Abuse severity medium T1218
Potential Regsvr32 Commandline Flag Anomaly severity medium T1218.010
Potential Remote Desktop Tunneling severity medium T1021
Potential Remote SquiblyTwo Technique Execution severity high T1047, T1059.005, T1059.007, T1220
Potential Renamed Rundll32 Execution severity high
Potential Rundll32 Execution With DLL Stored In ADS severity high T1564.004
Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 severity medium T1216
Potential ShellDispatch.DLL Functionality Abuse severity medium
Potential Shim Database Persistence via Sdbinst.EXE severity medium T1546.011
Potential Signing Bypass Via Windows Developer Features severity high
Potential SMB Relay Attack Tool Execution severity critical T1557.001
Potential SPN Enumeration Via Setspn.EXE severity medium T1558.003
Potential SSH Tunnel Persistence Install Using A Scheduled Task severity high T1053.005
Potential Suspicious Activity Using SeCEdit severity medium T1082, T1505.005, T1546.007, T1546.008, T1547.001, T1547.002
Potential Suspicious Browser Launch From Document Reader Process severity medium T1204.002
Potential Suspicious Mofcomp Execution severity high T1218
Potential Suspicious Registry File Imported Via Reg.EXE severity medium T1112
Potential Suspicious Windows Feature Enabled - ProcCreation severity medium
Potential SysInternals ProcDump Evasion severity high T1003.001, T1036
Potential Tampering With RDP Related Registry Keys Via Reg.EXE severity high T1021.001, T1112
Potential Tampering With Security Products Via WMIC severity high T1562.001
Potential UAC Bypass Via Sdclt.EXE severity medium T1548.002
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE severity medium T1047
Potential WinAPI Calls Via CommandLine severity high T1106
Potential Windows Defender AV Bypass Via Dump64.EXE Rename severity high T1003.001
Potential Windows Defender Tampering Via Wmic.EXE severity high T1047, T1562
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell severity medium T1047, T1059.001
Potentially Over Permissive Permissions Granted Using Dsacls.EXE severity medium T1218
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler severity high T1127
Potentially Suspicious Cabinet File Expansion severity medium T1218
Potentially Suspicious Call To Win32_NTEventlogFile Class severity high
Potentially Suspicious Child Process Of ClickOnce Application severity medium
Potentially Suspicious Child Process Of DiskShadow.EXE severity medium T1218
Potentially Suspicious Child Process of KeyScrambler.exe severity medium T1203, T1574.001
Potentially Suspicious Child Process Of Regsvr32 severity high T1218.010
Potentially Suspicious Child Process Of VsCode severity medium T1202, T1218
Potentially Suspicious Child Process Of WinRAR.EXE severity medium T1203
Potentially Suspicious Child Processes Spawned by ConHost severity high T1202, T1218
Potentially Suspicious CMD Shell Output Redirect severity medium T1218
Potentially Suspicious Command Targeting Teams Sensitive Files severity medium T1528
Potentially Suspicious Desktop Background Change Using Reg.EXE severity medium T1112, T1491.001
Potentially Suspicious DLL Registered Via Odbcconf.EXE severity high T1218.008
Potentially Suspicious Electron Application CommandLine severity medium
Potentially Suspicious Event Viewer Child Process severity high T1548.002
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities severity medium T1087, T1552
Potentially Suspicious Execution From Parent Process In Public Folder severity high T1059, T1564
Potentially Suspicious Execution Of PDQDeployRunner severity medium
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location severity medium T1218.009
Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension severity medium T1218.009
Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE severity high
Potentially Suspicious GoogleUpdate Child Process severity high
Potentially Suspicious Inline JavaScript Execution via NodeJS Binary severity medium T1059.007
Potentially Suspicious JWT Token Search Via CLI severity medium T1528, T1552.001
Potentially Suspicious NTFS Symlink Behavior Modification severity medium T1059, T1222.001
Potentially Suspicious Office Document Executed From Trusted Location severity high T1202
Potentially Suspicious Ping/Copy Command Combination severity medium T1070.004
Potentially Suspicious Regsvr32 HTTP IP Pattern severity high T1218.010
Potentially Suspicious Regsvr32 HTTP/FTP Pattern severity medium T1218.010
Potentially Suspicious Rundll32 Activity severity medium T1218.011
Potentially Suspicious Rundll32.EXE Execution of UDL File severity medium T1071, T1218.011
Potentially Suspicious Usage Of Qemu severity medium T1090, T1572
Potentially Suspicious WebDAV LNK Execution severity medium T1059.001, T1204
Potentially Suspicious Windows App Activity severity medium
PowerShell Base64 Encoded FromBase64String Cmdlet severity high T1059.001, T1140
PowerShell Base64 Encoded IEX Cmdlet severity high T1059.001
PowerShell Base64 Encoded Invoke Keyword severity high T1027, T1059.001
Powershell Base64 Encoded MpPreference Cmdlet severity high T1562.001
PowerShell Base64 Encoded Reflective Assembly Load severity high T1027, T1059.001, T1620
PowerShell Base64 Encoded WMI Classes severity high T1027, T1059.001
Powershell Defender Disable Scan Feature severity high T1562.001
Powershell Defender Exclusion severity medium T1562.001
PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' severity high T1562.001
PowerShell Download and Execution Cradles severity high T1059
PowerShell Download Pattern severity medium T1059.001
Powershell Executed From Headless ConHost Process severity medium T1059.001, T1059.003, T1564.003
PowerShell Execution With Potential Decryption Capabilities severity high
PowerShell Get-Clipboard Cmdlet Via CLI severity medium T1115
PowerShell Get-Process LSASS severity high T1552.004
Powershell Inline Execution From A File severity medium T1059.001
PowerShell MSI Install via WindowsInstaller COM From Remote Location severity medium T1059.001, T1105, T1218
PowerShell SAM Copy severity high T1003.002
PowerShell Script Change Permission Via Set-Acl severity high
PowerShell Script Run in AppData severity medium T1059.001
PowerShell Set-Acl On Windows Folder severity high
Powershell Token Obfuscation - Process Creation severity high T1027.009
PowerShell Web Access Feature Enabled Via DISM severity high T1548.002
PPL Tampering Via WerFaultSecure severity high T1003.001, T1562.001
PrintBrm ZIP Creation of Extraction severity high T1105, T1564.004
Private Keys Reconnaissance Via CommandLine Tools severity medium T1552.004
Privilege Escalation via Named Pipe Impersonation severity high T1021
Procdump Execution severity medium T1003.001, T1036
Process Access via TrolleyExpress Exclusion severity high T1003.001, T1218.011
Process Creation Using Sysnative Folder severity medium T1055
Process Execution From A Potentially Suspicious Folder severity high T1036
Process Launched Without Image Name severity medium
Process Memory Dump Via Comsvcs.DLL severity high T1003.001, T1036
Process Memory Dump Via Dotnet-Dump severity medium T1218
Process Memory Dump via RdrLeakDiag.EXE severity high T1003.001
Process Proxy Execution Via Squirrel.EXE severity medium T1218
Process Reconnaissance Via Wmic.EXE severity medium T1047
Program Executed Using Proxy/Local Command Via SSH.EXE severity medium T1218
Proxy Execution via Vshadow severity medium T1202
Proxy Execution Via Wuauclt.EXE severity high T1218
Psexec Execution severity medium T1021, T1569
PsExec Service Child Process Execution as LOCAL SYSTEM severity high
PsExec Service Execution severity medium
PsExec/PAExec Escalation to LOCAL SYSTEM severity high T1587.001
PUA - 3Proxy Execution severity high T1572
PUA - AdFind Suspicious Execution severity high T1018, T1069.002, T1087.002, T1482
PUA - AdFind.EXE Execution severity medium T1087.002
PUA - Adidnsdump Execution severity low T1018
PUA - Advanced IP Scanner Execution severity medium T1046, T1135
PUA - Advanced Port Scanner Execution severity medium T1046, T1135
PUA - AdvancedRun Execution severity medium T1059.003, T1134.002, T1564.003
PUA - AdvancedRun Suspicious Execution severity high T1134.002
PUA - Chisel Tunneling Tool Execution severity high T1090.001
PUA - CleanWipe Execution severity high T1562.001
PUA - Crassus Execution severity high T1590.001
PUA - CsExec Execution severity high T1569.002, T1587.001
PUA - DefenderCheck Execution severity high T1027.005
PUA - DIT Snapshot Viewer severity high T1003.003
PUA - Fast Reverse Proxy (FRP) Execution severity high T1090
PUA - Kernel Driver Utility (KDU) Execution severity high T1543.003
PUA - Mouse Lock Execution severity medium T1056.002
PUA - Netcat Suspicious Execution severity high T1095
PUA - Ngrok Execution severity high T1572
PUA - Nimgrab Execution severity high T1105
PUA - NimScan Execution severity medium T1046
PUA - NirCmd Execution severity medium T1569.002
PUA - NirCmd Execution As LOCAL SYSTEM severity high T1569.002
PUA - Nmap/Zenmap Execution severity medium T1046
PUA - NPS Tunneling Tool Execution severity high T1090
PUA - NSudo Execution severity high T1569.002
PUA - PingCastle Execution severity medium T1595
PUA - PingCastle Execution From Potentially Suspicious Parent severity high T1595
PUA - Potential PE Metadata Tamper Using Rcedit severity medium T1027, T1027.005, T1036, T1036.003
PUA - Process Hacker Execution severity medium T1543, T1564, T1622
PUA - Radmin Viewer Utility Execution severity medium T1072
PUA - Rclone Execution severity high T1567.002
PUA - Restic Backup Tool Execution severity high T1048, T1567.002
PUA - RunXCmd Execution severity high T1569.002
PUA - Seatbelt Execution severity high T1083, T1087, T1526
PUA - SoftPerfect Netscan Execution severity medium T1046
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE severity high T1087.002
PUA - System Informer Execution severity medium T1082, T1543, T1564
PUA - TruffleHog Execution severity medium T1083, T1552.001
PUA - WebBrowserPassView Execution severity medium T1555.003
PUA - Wsudo Suspicious Execution severity high T1059
PUA- IOX Tunneling Tool Execution severity high T1090
Pubprn.vbs Proxy Execution severity medium T1216.001
Python Function Execution Security Warning Disabled In Excel severity high T1562.001
Python Inline Command Execution severity medium T1059
Python One-Liners with Base64 Decoding severity high T1027.010, T1059.006
Python Spawning Pretty TTY on Windows severity high T1059
Query Usage To Exfil Data severity medium
QuickAssist Execution severity low T1219.002
Raccine Uninstall severity high T1562.001
Rar Usage with Password and Compression Level severity high T1560.001
RDP Connection Allowed Via Netsh.EXE severity high T1562.004
RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class severity medium T1021.001, T1047
RDP Port Forwarding Rule Added Via Netsh.EXE severity high T1090
Read Contents From Stdin Via Cmd.EXE severity medium T1059.003
Rebuild Performance Counter Values Via Lodctr.EXE severity medium
Recon Command Output Piped To Findstr.EXE severity medium T1057
Recon Information for Export with Command Prompt severity medium T1119
Reg Add Suspicious Paths severity high T1112, T1562.001
RegAsm.EXE Execution Without CommandLine Flags or Files severity low T1218.009
Regedit as Trusted Installer severity high T1548
REGISTER_APP.VBS Proxy Execution severity medium T1218
Registry Export of Third-Party Credentials severity high T1552.002
Registry Manipulation via WMI Stdregprov severity medium T1012, T1047, T1112
Registry Modification Attempt Via VBScript severity medium T1059.005, T1112
Registry Modification of MS-settings Protocol Handler severity medium T1112, T1546.001, T1548.002
Registry Modification Via Regini.EXE severity low T1112
Regsvr32 DLL Execution With Suspicious File Extension severity high T1218.010
Regsvr32 DLL Execution With Uncommon Extension severity medium T1574
Regsvr32 Execution From Highly Suspicious Location severity high T1218.010
Regsvr32 Execution From Potential Suspicious Location severity medium T1218.010
Remote Access Tool - AnyDesk Execution severity medium T1219.002
Remote Access Tool - Anydesk Execution From Suspicious Folder severity high T1219.002
Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate severity medium
Remote Access Tool - AnyDesk Piped Password Via CLI severity medium T1219.002
Remote Access Tool - AnyDesk Silent Installation severity high T1219.002
Remote Access Tool - GoToAssist Execution severity medium T1219.002
Remote Access Tool - LogMeIn Execution severity medium T1219.002
Remote Access Tool - MeshAgent Command Execution via MeshCentral severity medium T1219.002
Remote Access Tool - NetSupport Execution severity medium T1219.002
Remote Access Tool - NetSupport Execution From Unusual Location severity medium
Remote Access Tool - Potential MeshAgent Execution - Windows severity medium T1219.002
Remote Access Tool - Renamed MeshAgent Execution - Windows severity high T1036.003, T1219.002
Remote Access Tool - RURAT Execution From Unusual Location severity medium
Remote Access Tool - ScreenConnect Execution severity medium T1219.002
Remote Access Tool - ScreenConnect Installation Execution severity medium T1133
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution severity medium T1219.002
Remote Access Tool - ScreenConnect Remote Command Execution severity low T1059.003
Remote Access Tool - ScreenConnect Server Web Shell Execution severity high T1190
Remote Access Tool - Simple Help Execution severity medium T1219.002
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server severity medium T1105, T1219
Remote Access Tool - Team Viewer Session Started On Windows Host severity low T1133
Remote Access Tool - UltraViewer Execution severity medium T1219.002
Remote CHM File Download/Execution Via HH.EXE severity high T1218.001
Remote Code Execute via Winrm.vbs severity medium T1216
Remote File Download Via Desktopimgdownldr Utility severity medium T1105
Remote File Download Via Findstr.EXE severity medium T1105, T1218, T1552.001, T1564.004
Remote PowerShell Session Host Process (WinRM) severity medium T1021.006, T1059.001
Remote XSL Execution Via Msxsl.EXE severity high T1220
RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses severity high T1218
Remotely Hosted HTA File Executed Via Mshta.EXE severity high T1218.005
Renamed AdFind Execution severity high T1018, T1069.002, T1087.002, T1482
Renamed AutoHotkey.EXE Execution severity medium
Renamed AutoIt Execution severity high T1027
Renamed BOINC Client Execution severity medium T1553
Renamed BrowserCore.EXE Execution severity high T1036.003, T1528
Renamed Cloudflared.EXE Execution severity high T1090.001
Renamed CreateDump Utility Execution severity high T1003.001, T1036
Renamed CURL.EXE Execution severity medium T1059, T1202
Renamed FTP.EXE Execution severity medium T1059, T1202
Renamed Gpg.EXE Execution severity high T1486
Renamed Jusched.EXE Execution severity high T1036.003
Renamed Mavinject.EXE Execution severity high T1055.001, T1218.013
Renamed MegaSync Execution severity high T1218
Renamed Microsoft Teams Execution severity medium
Renamed Msdt.EXE Execution severity high T1036.003
Renamed NetSupport RAT Execution severity high
Renamed NirCmd.EXE Execution severity high T1059, T1202
Renamed Office Binary Execution severity high T1036.003
Renamed PAExec Execution severity high T1202
Renamed PingCastle Binary Execution severity high T1059, T1202
Renamed Plink Execution severity high T1036
Renamed ProcDump Execution severity high T1036.003
Renamed PsExec Service Execution severity high
Renamed Remote Utilities RAT (RURAT) Execution severity medium
Renamed Schtasks Execution severity high T1036.003, T1053.005
Renamed SysInternals DebugView Execution severity high T1588.002
Renamed Sysinternals Sdelete Execution severity high T1485
Renamed Visual Studio Code Tunnel Execution severity high T1071.001, T1219
Renamed Vmnat.exe Execution severity high T1574.001
Renamed Whoami Execution severity critical T1033
Renamed ZOHO Dctask64 Execution severity high T1036, T1055.001, T1202, T1218
Replace.exe Usage severity medium T1105
Response File Execution Via Odbcconf.EXE severity medium T1218.008
RestrictedAdminMode Registry Value Tampering - ProcCreation severity high T1112
Root Certificate Installed From Susp Locations severity high T1553.004
Ruby Inline Command Execution severity medium T1059
Run Once Task Execution as Configured in Registry severity low T1112
Run PowerShell Script from ADS severity high T1564.004
Run PowerShell Script from Redirected Input Stream severity high T1059
Rundll32 Execution With Uncommon DLL Extension severity medium T1218.011
Rundll32 Execution Without CommandLine Parameters severity high T1202
Rundll32 Execution Without Parameters severity high T1021.002, T1569.002, T1570
Rundll32 InstallScreenSaver Execution severity medium T1218.011
Rundll32 Registered COM Objects severity high T1546.015
Rundll32 Spawned Via Explorer.EXE severity medium
RunDLL32 Spawning Explorer severity high T1218.011
Rundll32 UNC Path Execution severity high T1021.002, T1218.011
RunMRU Registry Key Deletion severity high T1070.003
SafeBoot Registry Key Deleted Via Reg.EXE severity high T1562.001
Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE severity medium T1053.005
Scheduled Task Creation Masquerading as System Processes severity high T1036.004, T1036.005, T1053.005
Scheduled Task Creation Via Schtasks.EXE severity low T1053.005
Scheduled Task Creation with Curl and PowerShell Execution Combo severity medium T1053.005, T1105, T1218
Scheduled Task Executing Encoded Payload from Registry severity high T1053.005, T1059.001
Scheduled Task Executing Payload from Registry severity medium T1053.005, T1059.001
Schtasks Creation Or Modification With SYSTEM Privileges severity high T1053.005
Schtasks From Suspicious Folders severity high T1053.005
Screen Capture Activity Via Psr.EXE severity medium T1113
Script Event Consumer Spawning Process severity high T1047
Script Interpreter Execution From Suspicious Folder severity high T1059
Script Interpreter Spawning Credential Scanner - Windows severity high T1005, T1059.007, T1552
Scripting/CommandLine Process Spawned Regsvr32 severity medium T1218.010
Sdclt Child Processes severity medium T1548.002
Sdiagnhost Calling Suspicious Child Process severity high T1036, T1218
Security Event Logging Disabled via MiniNt Registry Key - Process severity high T1112, T1562.002
Security Privileges Enumeration Via Whoami.EXE severity high T1033
Security Service Disabled Via Reg.EXE severity high T1562.001
Security Tools Keyword Lookup Via Findstr.EXE severity medium T1518.001
Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location severity high T1218
Sensitive File Access Via Volume Shadow Copy Backup severity high T1490
Sensitive File Dump Via Wbadmin.EXE severity high T1003.003
Sensitive File Recovery From Backup Via Wbadmin.EXE severity high T1003.003
Service DACL Abuse To Hide Services Via Sc.EXE severity high T1574.011
Service Reconnaissance Via Wmic.EXE severity medium T1047
Service Registry Key Deleted Via Reg.EXE severity high T1562.001
Service Security Descriptor Tampering Via Sc.EXE severity medium T1574.011
Service Started/Stopped Via Wmic.EXE severity medium T1047
Service StartupType Change Via PowerShell Set-Service severity medium T1562.001
Service StartupType Change Via Sc.EXE severity medium T1562.001
Set Suspicious Files as System Files Using Attrib.EXE severity high T1564.001
Setup16.EXE Execution With Custom .Lst File severity medium T1574.005
Shadow Copies Creation Using Operating Systems Utilities severity medium T1003, T1003.002, T1003.003
Shadow Copies Deletion Using Operating Systems Utilities severity high T1070, T1490
Share And Session Enumeration Using Net.EXE severity low T1018
Shell Process Spawned by Java.EXE severity medium
Shell32 DLL Execution in Suspicious Directory severity high T1218.011
ShimCache Flush severity high T1112
SQL Client Tools PowerShell Session Detection severity medium T1059.001, T1127
SQLite Chromium Profile Data DB Access severity high T1005, T1539, T1555.003
SQLite Firefox Profile Data DB Access severity high T1005, T1539
Start of NT Virtual DOS Machine severity medium
Start Windows Service Via Net.EXE severity low T1569.002
Sticky Key Like Backdoor Execution severity critical T1546.008
Stop Windows Service Via Net.EXE severity low T1489
Stop Windows Service Via PowerShell Stop-Service severity low T1489
Stop Windows Service Via Sc.EXE severity low T1489
Suspect Svchost Activity severity high T1055
Suspicious Active Directory Database Snapshot Via ADExplorer severity high T1069.002, T1087.002, T1482
Suspicious AddinUtil.EXE CommandLine Execution severity high T1218
Suspicious Advpack Call Via Rundll32.EXE severity high
Suspicious AgentExecutor PowerShell Execution severity high T1218
Suspicious ArcSOC.exe Child Process severity high T1059, T1203
Suspicious Autorun Registry Modified via WMI severity high T1047, T1547.001
Suspicious Binary In User Directory Spawned From Office Application severity high T1204.002
Suspicious BitLocker Access Agent Update Utility Execution severity high T1021.003, T1218
Suspicious Cabinet File Execution Via Msdt.EXE severity medium T1202
Suspicious Calculator Usage severity high T1036
Suspicious CertReq Command to Download severity high T1105
Suspicious Child Process Created as System severity high T1134.002
Suspicious Child Process of AspNetCompiler severity high T1127
Suspicious Child Process Of BgInfo.EXE severity high T1059.005, T1202, T1218
Suspicious Child Process Of Manage Engine ServiceDesk severity high T1102
Suspicious Child Process of Notepad++ Updater - GUP.Exe severity high T1195.002, T1557
Suspicious Child Process Of SQL Server severity high T1190, T1505.003
Suspicious Child Process Of Veeam Dabatase severity critical
Suspicious Child Process Of Wermgr.EXE severity high T1036, T1055
Suspicious Chromium Browser Instance Executed With Custom Extension severity high T1176.001
Suspicious ClickFix/FileFix Execution Pattern severity high T1204.001, T1204.004
Suspicious CodePage Switch Via CHCP severity medium T1036
Suspicious Command Patterns In Scheduled Task Creation severity high T1053.005
Suspicious Control Panel DLL Load severity high T1218.011
Suspicious Copy From or To System Directory severity medium T1036.003
Suspicious Csi.exe Usage severity medium T1072, T1218
Suspicious Curl.EXE Download severity high T1105
Suspicious CustomShellHost Execution severity high T1216
Suspicious Debugger Registration Cmdline severity high T1546.008
Suspicious Desktopimgdownldr Command severity high T1105
Suspicious Diantz Alternate Data Stream Execution severity medium T1564.004
Suspicious Diantz Download and Compress Into a CAB File severity medium T1105
Suspicious DLL Loaded via CertOC.EXE severity high T1218
Suspicious Double Extension File Execution severity high T1566.001
Suspicious Download From Direct IP Via Bitsadmin severity high T1036.003, T1197
Suspicious Download From File-Sharing Website Via Bitsadmin severity high T1036.003, T1105, T1197
Suspicious Download from Office Domain severity high T1105, T1608
Suspicious Download Via Certutil.EXE severity medium T1027, T1105
Suspicious Driver Install by pnputil.exe severity medium T1547
Suspicious Driver/DLL Installation Via Odbcconf.EXE severity high T1218.008
Suspicious DumpMinitool Execution severity high T1003.001, T1036
Suspicious Electron Application Child Processes severity medium
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call severity high T1027, T1059.001
Suspicious Encoded PowerShell Command Line severity high T1059.001
Suspicious Eventlog Clearing or Configuration Change Activity severity high T1070.001, T1562.002
Suspicious Execution From Outlook Temporary Folder severity high T1566.001
Suspicious Execution Location Of Wermgr.EXE severity high
Suspicious Execution of Hostname severity low T1082
Suspicious Execution of InstallUtil Without Log severity medium
Suspicious Execution of Powershell with Base64 severity medium T1059.001
Suspicious Execution of Shutdown severity medium T1529
Suspicious Execution of Shutdown to Log Out severity medium T1529
Suspicious Execution of Systeminfo severity low T1082
Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix severity high T1027.010, T1204.004
Suspicious Extrac32 Alternate Data Stream Execution severity medium T1564.004
Suspicious Extrac32 Execution severity medium T1105
Suspicious File Characteristics Due to Missing Fields severity medium T1059.006
Suspicious File Download From File Sharing Domain Via Curl.EXE severity high
Suspicious File Download From File Sharing Domain Via Wget.EXE severity high
Suspicious File Download From IP Via Curl.EXE severity high
Suspicious File Download From IP Via Wget.EXE severity high
Suspicious File Download From IP Via Wget.EXE - Paths severity high
Suspicious File Downloaded From Direct IP Via Certutil.EXE severity high T1027, T1105
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE severity high T1027, T1105
Suspicious File Encoded To Base64 Via Certutil.EXE severity high T1027
Suspicious File Execution From Internet Hosted WebDav Share severity high T1059.001
Suspicious FileFix Execution Pattern severity high T1204.004
Suspicious FromBase64String Usage On Gzip Archive - Process Creation severity medium T1132.001
Suspicious Git Clone severity medium T1593.003
Suspicious Greedy Compression Using Rar.EXE severity high T1059
Suspicious Group And Account Reconnaissance Activity Using Net.EXE severity medium T1087.001, T1087.002
Suspicious GrpConv Execution severity high T1547
Suspicious GUP Usage severity high T1574.001
Suspicious HH.EXE Execution severity high T1047, T1059.001, T1059.003, T1059.005, T1059.007, T1218
Suspicious High IntegrityLevel Conhost Legacy Option severity informational T1202
Suspicious HWP Sub Processes severity high T1059.003, T1203, T1566.001
Suspicious IIS Module Registration severity high T1505.004
Suspicious IIS URL GlobalRules Rewrite Via AppCmd severity medium
Suspicious Invoke-WebRequest Execution severity high T1105
Suspicious Invoke-WebRequest Execution With DirectIP severity medium T1105
Suspicious JavaScript Execution Via Mshta.EXE severity high T1218.005
Suspicious Kerberos Ticket Request via CLI severity high T1558.003
Suspicious Kernel Dump Using Dtrace severity high T1082
Suspicious Key Manager Access severity high T1555.004
Suspicious LNK Command-Line Padding with Whitespace Characters severity high T1204.002
Suspicious Manipulation Of Default Accounts Via Net.EXE severity high T1560.001
Suspicious Microsoft Office Child Process severity high T1047, T1204.002, T1218.010
Suspicious Microsoft OneNote Child Process severity high T1566, T1566.001
Suspicious Modification Of Scheduled Tasks severity high T1053.005
Suspicious Msbuild Execution By Uncommon Parent Process severity medium
Suspicious MSDT Parent Process severity high T1036, T1218
Suspicious MSHTA Child Process severity high T1218.005
Suspicious Mshta.EXE Execution Patterns severity high T1106
Suspicious MsiExec Embedding Parent severity medium T1218.007
Suspicious Msiexec Execute Arbitrary DLL severity medium T1218.007
Suspicious Msiexec Quiet Install From Remote Location severity medium T1218.007
Suspicious Mstsc.EXE Execution With Local RDP File severity high T1219.002
Suspicious Network Command severity low T1016
Suspicious New Service Creation severity high T1543.003
Suspicious NTLM Authentication on the Printer Spooler Service severity high T1212
Suspicious Obfuscated PowerShell Code severity high
Suspicious Outlook Child Process severity high T1204.002
Suspicious Parent Double Extension File Execution severity high T1036.007
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script severity high T1059
Suspicious Ping/Del Command Combination severity high T1070.004
Suspicious Plink Port Forwarding severity high T1021.001, T1572
Suspicious Powercfg Execution To Change Lock Screen Timeout severity medium
Suspicious PowerShell Download and Execute Pattern severity high T1059.001
Suspicious PowerShell Encoded Command Patterns severity high T1059.001
Suspicious PowerShell IEX Execution Patterns severity high T1059.001
Suspicious PowerShell Invocation From Script Engines severity medium T1059.001
Suspicious PowerShell Invocations - Specific - ProcessCreation severity medium
Suspicious PowerShell Mailbox Export to Share severity critical
Suspicious PowerShell Parameter Substring severity high T1059.001
Suspicious PowerShell Parent Process severity high T1059.001
Suspicious Process By Web Server Process severity high T1190, T1505.003
Suspicious Process Created Via Wmic.EXE severity high T1047
Suspicious Process Execution From Fake Recycle.Bin Folder severity high
Suspicious Process Masquerading As SvcHost.EXE severity high T1036.005
Suspicious Process Parents severity high T1036
Suspicious Process Patterns NTDS.DIT Exfil severity high T1003.003
Suspicious Process Start Locations severity medium T1036
Suspicious Processes Spawned by Java.EXE severity high
Suspicious Processes Spawned by WinRM severity high T1190
Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE severity high T1562.004
Suspicious Program Names severity high T1059
Suspicious Provlaunch.EXE Child Process severity high T1218
Suspicious Query of MachineGUID severity low T1082
Suspicious RASdial Activity severity medium T1059
Suspicious RDP Redirect Using TSCON severity high T1021.001, T1563.002
Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet severity medium T1087.001
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS severity high T1059.005, T1615
Suspicious Recursive Takeown severity medium T1222.001
Suspicious Redirection to Local Admin Share severity high T1048
Suspicious Reg Add BitLocker severity high T1486
Suspicious Registry Modification From ADS Via Regini.EXE severity high T1112
Suspicious Regsvr32 Execution From Remote Share severity high T1218.010
Suspicious Remote Child Process From Outlook severity high T1059, T1202
Suspicious Response File Execution Via Odbcconf.EXE severity high T1218.008
Suspicious RunAs-Like Flag Combination severity medium
Suspicious Rundll32 Activity Invoking Sys File severity high T1218.011
Suspicious Rundll32 Execution With Image Extension severity high T1218.011
Suspicious Rundll32 Invoking Inline VBScript severity high T1055
Suspicious Rundll32 Setupapi.dll Activity severity medium T1218.011
Suspicious Runscripthelper.exe severity medium T1059, T1202
Suspicious Scan Loop Network severity medium T1018, T1059
Suspicious Scheduled Task Creation Involving Temp Folder severity high T1053.005
Suspicious Scheduled Task Creation via Masqueraded XML File severity medium T1036.005, T1053.005
Suspicious Scheduled Task Name As GUID severity medium T1053.005
Suspicious Schtasks Execution AppData Folder severity high T1053.005, T1059.001
Suspicious Schtasks Schedule Type With High Privileges severity medium T1053.005
Suspicious Schtasks Schedule Types severity high T1053.005
Suspicious ScreenSave Change by Reg.exe severity medium T1546.002
Suspicious Script Execution From Temp Folder severity high T1059
Suspicious Serv-U Process Pattern severity high T1555
Suspicious Service Binary Directory severity high T1202
Suspicious Service DACL Modification Via Set-Service Cmdlet severity high T1543.003
Suspicious Service Path Modification severity high T1543.003
Suspicious ShellExec_RunDLL Call Via Ordinal severity high T1218.011
Suspicious Shells Spawn by Java Utility Keytool severity high
Suspicious Speech Runtime Binary Child Process severity high T1021.003, T1218
Suspicious Splwow64 Without Params severity high T1202
Suspicious Spool Service Child Process severity high T1068, T1203
Suspicious SysAidServer Child severity medium T1210
Suspicious SYSTEM User Process Creation severity high T1003, T1027, T1134
Suspicious SYSVOL Domain Group Policy Access severity medium T1552.006
Suspicious TSCON Start as SYSTEM severity high T1219.002
Suspicious UltraVNC Execution severity high T1021.005
Suspicious Uninstall of Windows Defender Feature via PowerShell severity high T1562.001
Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) severity medium T1003.003
Suspicious Usage of For Loop with Recursive Directory Search in CMD severity medium T1027.010, T1059.003
Suspicious Usage Of ShellExec_RunDLL severity high
Suspicious Use of CSharp Interactive Console severity high T1127
Suspicious Use of PsLogList severity medium T1087, T1087.001, T1087.002
Suspicious Userinit Child Process severity medium T1055
Suspicious VBoxDrvInst.exe Parameters severity medium T1112
Suspicious Velociraptor Child Process severity high T1219
Suspicious Vsls-Agent Command With AgentExtensionPath Load severity medium T1218
Suspicious WebDav Client Execution Via Rundll32.EXE severity high T1048.003
Suspicious Where Execution severity low T1217
Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE severity medium T1562.001
Suspicious Windows Defender Registry Key Tampering Via Reg.EXE severity high T1562.001
Suspicious Windows Service Tampering severity high T1489, T1562.001
Suspicious Windows Trace ETW Session Tamper Via Logman.EXE severity high T1070.001, T1562.001
Suspicious Windows Update Agent Empty Cmdline severity high T1036
Suspicious WindowsTerminal Child Processes severity medium
Suspicious WMIC Execution Via Office Process severity high T1047, T1204.002, T1218.010
Suspicious WmiPrvSE Child Process severity high T1047, T1204.002, T1218.010
Suspicious Workstation Locking via Rundll32 severity medium
Suspicious X509Enrollment - Process Creation severity medium T1553.004
Suspicious XOR Encoded PowerShell Command severity medium T1027, T1059.001, T1140
Suspicious ZipExec Execution severity medium T1202, T1218
SyncAppvPublishingServer Execute Arbitrary PowerShell Code severity medium T1218
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code severity medium T1216, T1218
Sysinternals PsService Execution severity medium T1543.003
Sysinternals PsSuspend Execution severity medium T1543.003
Sysinternals PsSuspend Suspicious Execution severity high T1562.001
Sysmon Configuration Update severity medium T1562.001
Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE severity high T1518.001
Sysmon Driver Unloaded Via Fltmc.EXE severity high T1070, T1562, T1562.002
Sysprep on AppData Folder severity medium T1059
System Disk And Volume Reconnaissance Via Wmic.EXE severity medium T1047, T1082
System File Execution Location Anomaly severity high T1036
System Information Discovery via Registry Queries severity low T1082
System Language Discovery via Reg.Exe severity medium T1614.001
System Network Connections Discovery Via Net.EXE severity low T1049
Tamper Windows Defender Remove-MpPreference severity high T1562.001
Tap Installer Execution severity medium T1048
Taskkill Symantec Endpoint Protection severity high T1562.001
Taskmgr as LOCAL_SYSTEM severity high T1036
Tasks Folder Evasion severity high T1574.001
Terminal Service Process Spawn severity high T1190, T1210
Time Travel Debugging Utility Usage severity high T1003.001, T1218
Tor Client/Browser Execution severity high T1090.003
TrustedPath UAC Bypass Pattern severity critical T1548.002
UAC Bypass Abusing Winsat Path Parsing - Process severity high T1548.002
UAC Bypass Tools Using ComputerDefaults severity high T1548.002
UAC Bypass Using ChangePK and SLUI severity high T1548.002
UAC Bypass Using Consent and Comctl32 - Process severity high T1548.002
UAC Bypass Using Disk Cleanup severity high T1548.002
UAC Bypass Using DismHost severity high T1548.002
UAC Bypass Using Event Viewer RecentViews severity high
UAC Bypass Using IDiagnostic Profile severity high T1548.002
UAC Bypass Using IEInstal - Process severity high T1548.002
UAC Bypass Using MSConfig Token Modification - Process severity high T1548.002
UAC Bypass Using NTFS Reparse Point - Process severity high T1548.002
UAC Bypass Using PkgMgr and DISM severity high T1548.002
UAC Bypass Using Windows Media Player - Process severity high T1548.002
UAC Bypass via ICMLuaUtil severity high T1548.002
UAC Bypass via Windows Firewall Snap-In Hijack severity medium T1548
UAC Bypass WSReset severity high T1548.002
UEFI Persistence Via Wpbbin - ProcessCreation severity high T1542.001
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE severity medium T1218
Uncommon AddinUtil.EXE CommandLine Execution severity medium T1218
Uncommon Child Process Of AddinUtil.EXE severity medium T1218
Uncommon Child Process Of Appvlp.EXE severity medium T1218
Uncommon Child Process Of BgInfo.EXE severity medium T1059.005, T1202, T1218
Uncommon Child Process Of Conhost.EXE severity medium T1202
Uncommon Child Process Of Defaultpack.EXE severity medium T1218
Uncommon Child Process Of Setres.EXE severity high T1202, T1218
Uncommon Child Process Spawned By Odbcconf.EXE severity medium T1218.008
Uncommon Child Processes Of SndVol.exe severity medium
Uncommon Extension Shim Database Installation Via Sdbinst.EXE severity medium T1546.011
Uncommon FileSystem Load Attempt By Format.com severity high
Uncommon Link.EXE Parent Process severity medium T1218
Uncommon One Time Only Scheduled Task At 00:00 severity high T1053.005
Uncommon Sigverif.EXE Child Process severity medium T1216
Uncommon Svchost Command Line Parameter severity high T1036.005, T1055, T1055.012
Uncommon Svchost Parent Process severity medium T1036.005
Uncommon System Information Discovery Via Wmic.EXE severity medium T1082
Uncommon Userinit Child Process severity high T1037.001
Uninstall Crowdstrike Falcon Sensor severity high T1562.001
Uninstall Sysinternals Sysmon severity high T1562.001
Unmount Share Via Net.EXE severity low T1070.005
Unsigned AppX Installation Attempt Using Add-AppxPackage severity medium
Unusual Child Process of dns.exe severity high T1133
Unusual Parent Process For Cmd.EXE severity medium T1059
Usage Of Web Request Commands And Cmdlets severity medium T1059.001
Use Icacls to Hide File to Everyone severity medium T1564.001
Use NTFS Short Name in Command Line severity medium T1564.004
Use NTFS Short Name in Image severity medium T1564.004
Use of FSharp Interpreters severity medium T1059
Use of OpenConsole severity medium T1059
Use of Pcalua For Execution severity medium T1059
Use of Remote.exe severity medium T1127
Use of Scriptrunner.exe severity medium T1218
Use Of The SFTP.EXE Binary As A LOLBIN severity medium T1218
Use of TTDInject.exe severity medium T1127
Use of UltraVNC Remote Access Software severity medium T1219.002
Use of VisualUiaVerifyNative.exe severity medium T1218
Use of VSIISExeLauncher.exe severity medium T1127
Use of W32tm as Timer severity high T1124
Use of Wfc.exe severity medium T1127
Use Short Name Path in Image severity medium T1564.004
User Added To Highly Privileged Group severity high T1098
User Added to Local Administrators Group severity medium T1098
User Added to Remote Desktop Users Group severity high T1021.001, T1133, T1136.001
User Discovery And Export Via Get-ADUser Cmdlet severity medium T1033
User Shell Folders Registry Modification via CommandLine severity high T1112, T1547.001
Using SettingSyncHost.exe as LOLBin severity high T1574.008
UtilityFunctions.ps1 Proxy Dll severity medium T1216
Veeam Backup Database Suspicious Query severity medium T1005
VeeamBackup Database Credentials Dump Via Sqlcmd.EXE severity high T1005
Verclsid.exe Runs COM Object severity medium T1218
Virtualbox Driver Installation or Starting of VMs severity low T1564, T1564.006
Visual Basic Command Line Compiler Usage severity high T1027.004
Visual Studio Code Tunnel Execution severity medium T1071.001, T1219
Visual Studio Code Tunnel Service Installation severity medium T1071.001
Visual Studio Code Tunnel Shell Execution severity medium T1071.001
Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution severity medium T1218
Visual Studio NodejsTools PressAnyKey Renamed Execution severity medium T1218
VMToolsd Suspicious Child Process severity high T1059
VolumeShadowCopy Symlink Creation Via Mklink severity high T1003.002, T1003.003
Vulnerable Driver Blocklist Registry Tampering Via CommandLine severity high T1562.001
Wab Execution From Non Default Location severity high
Wab/Wabmig Unusual Parent Or Child Processes severity high
Weak or Abused Passwords In CLI severity medium
WebDav Client Execution Via Rundll32.EXE severity medium T1048.003
Webshell Detection With Command Line Keywords severity high T1018, T1033, T1087, T1505.003
Webshell Hacking Activity Patterns severity high T1018, T1033, T1087, T1505.003
Webshell Tool Reconnaissance Activity severity high T1505.003
WhoAmI as Parameter severity high T1033
Whoami.EXE Execution Anomaly severity medium T1033
Whoami.EXE Execution From Privileged Process severity high T1033
Whoami.EXE Execution With Output Option severity medium T1033
Windows Admin Share Mount Via Net.EXE severity medium T1021.002
Windows AMSI Related Registry Tampering Via CommandLine severity high T1562.001, T1562.006
Windows Backup Deleted Via Wbadmin.EXE severity medium T1490
Windows Binary Executed From WSL severity medium T1202
Windows Credential Guard Registry Tampering Via CommandLine severity high T1562.001
Windows Credential Manager Access via VaultCmd severity medium T1555.004
Windows Default Domain GPO Modification via GPME severity medium T1484.001
Windows Defender Context Menu Removed severity high T1562.001
Windows Defender Definition Files Removed severity high T1562.001
Windows Firewall Disabled via PowerShell severity medium T1562
Windows Hotfix Updates Reconnaissance Via Wmic.EXE severity medium T1047
Windows Internet Hosted WebDav Share Mount Via Net.EXE severity high T1021.002
Windows Kernel Debugger Execution severity medium
Windows MSIX Package Support Framework AI_STUBS Execution severity low T1204.002, T1218, T1553.005
Windows Processes Suspicious Parent Directory severity low T1036.003, T1036.005
Windows Recall Feature Enabled Via Reg.EXE severity medium T1113
Windows Recovery Environment Disabled Via Reagentc severity medium T1490
Windows Share Mount Via Net.EXE severity low T1021.002
Windows Shell/Scripting Processes Spawning Suspicious Programs severity high T1059.001, T1059.005, T1218
Winrar Compressing Dump Files severity medium T1560.001
WinRAR Execution in Non-Standard Folder severity medium T1560.001
Winrs Local Command Execution severity high T1021.006, T1218
Wlrmdr.EXE Uncommon Argument Or Child Process severity medium T1218
WMI Backdoor Exchange Transport Agent severity critical T1546.003
WMI Persistence - Script Event Consumer severity medium T1546.003
WMIC Remote Command Execution severity medium T1047
WmiPrvSE Spawned A Process severity medium T1047
Write Protect For Storage Disabled severity medium T1562
Writing Of Malicious Files To The Fonts Folder severity medium T1059, T1211
Wscript Shell Run In CommandLine severity medium T1059
WSL Child Process Anomaly severity medium T1202, T1218
WSL Kali-Linux Usage severity high T1202
Wusa.EXE Executed By Parent Process Located In Suspicious Location severity high
XBAP Execution From Uncommon Locations Via PresentationHost.EXE severity medium T1218
XSL Script Execution Via WMIC.EXE severity medium T1047, T1059.005, T1059.007, T1220
Xwizard.EXE Execution From Non-Default Location severity high T1574.001

Elastic (1)

Suspicious Process Creation CallTrace T1055, T1055.012

Microsoft-Windows-Sysmon event 1

Sigma (1171)

Elastic (1)

Splunk (59)

Keyboard Shortcuts