Skip to content
MISP galaxy
Sigma-Rules
Initializing search
MISP galaxy
Home
Statistics
360net
360net
360.net Threat Actors
Ammunitions
Ammunitions
Ammunitions
Android
Android
Android
Atrm
Atrm
Azure Threat Research Matrix
Attck4fraud
Attck4fraud
attck4fraud
Backdoor
Backdoor
Backdoor
Banker
Banker
Banker
Bhadra framework
Bhadra framework
Bhadra Framework
Botnet
Botnet
Botnet
Branded vulnerability
Branded vulnerability
Branded Vulnerability
Cancer
Cancer
Cancer
Cert eu govsector
Cert eu govsector
Cert EU GovSector
China defence universities
China defence universities
China Defence Universities Tracker
Cmtmf attack pattern
Cmtmf attack pattern
CONCORDIA Mobile Modelling Framework - Attack Pattern
Country
Country
Country
Cryptominers
Cryptominers
Cryptominers
Disarm actortypes
Disarm actortypes
Actor Types
Disarm countermeasures
Disarm countermeasures
Countermeasures
Disarm detections
Disarm detections
Detections
Disarm techniques
Disarm techniques
Techniques
Election guidelines
Election guidelines
Election guidelines
Entity
Entity
Entity
Exploit kit
Exploit kit
Exploit-Kit
Firearms
Firearms
Firearms
First dns
First dns
FIRST DNS Abuse Techniques Matrix
Gsma motif
Gsma motif
GSMA MoTIF
Handicap
Handicap
Handicap
Intelligence agencies
Intelligence agencies
Intelligence Agencies
Interpol dwva
Interpol dwva
INTERPOL DWVA Taxonomy
Malpedia
Malpedia
Malpedia
Microsoft activity group
Microsoft activity group
Microsoft Activity Group actor
Misinfosec amitt misinformation pattern
Misinfosec amitt misinformation pattern
Misinformation Pattern
Mitre atlas attack pattern
Mitre atlas attack pattern
MITRE ATLAS Attack Pattern
Mitre atlas course of action
Mitre atlas course of action
MITRE ATLAS Course of Action
Mitre attack pattern
Mitre attack pattern
Attack Pattern
Mitre course of action
Mitre course of action
Course of Action
Mitre d3fend
Mitre d3fend
MITRE D3FEND
Mitre data component
Mitre data component
mitre-data-component
Mitre data source
Mitre data source
mitre-data-source
Mitre ics assets
Mitre ics assets
Assets
Mitre ics groups
Mitre ics groups
Groups
Mitre ics levels
Mitre ics levels
Levels
Mitre ics software
Mitre ics software
Software
Mitre ics tactics
Mitre ics tactics
Tactics
Mitre intrusion set
Mitre intrusion set
Intrusion Set
Mitre malware
Mitre malware
Malware
Mitre tool
Mitre tool
mitre-tool
Nace
Nace
NACE
Naics
Naics
NAICS
Nice framework competency areas
Nice framework competency areas
NICE Competency areas
Nice framework knowledges
Nice framework knowledges
NICE Knowledges
Nice framework opm codes
Nice framework opm codes
OPM codes in cybersecurity
Nice framework skills
Nice framework skills
NICE Skills
Nice framework tasks
Nice framework tasks
NICE Tasks
Nice framework work roles
Nice framework work roles
NICE Work Roles
O365 exchange techniques
O365 exchange techniques
o365-exchange-techniques
Online service
Online service
online-service
Preventive measure
Preventive measure
Preventive Measure
Producer
Producer
Producer
Ransomware
Ransomware
Ransomware
Rat
Rat
RAT
Region
Region
Regions UN M49
Rsit
Rsit
rsit
Sector
Sector
Sector
Sigma rules
Sigma rules
Sigma-Rules
Sigma-Rules
Table of contents
CurrentVersion Autorun Keys Modification
COM Hijacking via TreatAs
Potential Registry Persistence Attempt Via DbgManagedDebugger
Potential Attachment Manager Settings Attachments Tamper
Enabling COR Profiler Environment Variables
System Scripts Autorun Keys Modification
Outlook Security Settings Updated - Registry
Wow6432Node CurrentVersion Autorun Keys Modification
Execution DLL of Choice Using WAB.EXE
Suspicious Application Allowed Through Exploit Guard
Potential Persistence Via Custom Protocol Handler
Add Debugger Entry To AeDebug For Persistence
Potentially Suspicious Desktop Background Change Via Registry
Potential PendingFileRenameOperations Tampering
Potential Persistence Via GlobalFlags
Potential Attachment Manager Settings Associations Tamper
Hiding User Account Via SpecialAccounts Registry Key
Registry Persistence via Explorer Run Key
Potential CobaltStrike Service Installations - Registry
RestrictedAdminMode Registry Value Tampering
Lsass Full Dump Request Via DumpType Registry Settings
Hypervisor Enforced Paging Translation Disabled
Wdigest Enable UseLogonCredential
DHCP Callout DLL Installation
Potential Persistence Via Outlook Today Page
New Application in AppCompat
New BgInfo.EXE Custom DB Path Registry Configuration
Disabled Windows Defender Eventlog
Disable Tamper Protection on Windows Defender
Potential Credential Dumping Attempt Using New NetworkProvider - REG
Potential Persistence Via AppCompat RegisterAppRestart Layer
Internet Explorer Autorun Keys Modification
Change User Account Associated with the FAX Service
Disable PUA Protection on Windows Defender
Potential PSFactoryBuffer COM Hijacking
Suspicious Path In Keyboard Layout IME File Registry Value
Blackbyte Ransomware Registry
Potential Persistence Via DLLPathOverride
Scheduled TaskCache Change by Uncommon Program
Potential Persistence Via Shim Database Modification
Potential Ransomware Activity Using LegalNotice Message
Potential Persistence Via Netsh Helper DLL - Registry
Suspicious Powershell In Registry Run Keys
COM Object Hijacking Via Modification Of Default System CLSID Default Value
Change Winevt Channel Access Permission Via Registry
Outlook Macro Execution Without Warning Setting Enabled
Enable LM Hash Storage
Office Macros Warning Disabled
Blue Mockingbird - Registry
Bypass UAC Using DelegateExecute
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
Disable Exploit Guard Network Protection on Windows Defender
Change the Fax Dll
Internet Explorer DisableFirstRunCustomize Enabled
Old TLS1.0/TLS1.1 Protocol Version Enabled
Register New IFiltre For Persistence
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols
Suspicious Service Installed
PowerShell Logging Disabled Via Registry Key Tampering
Potential Persistence Via Event Viewer Events.asp
Periodic Backup For System Registry Hives Enabled
Potential Persistence Via Scrobj.dll COM Hijacking
Running Chrome VPN Extensions via the Registry 2 VPN Extension
New File Association Using Exefile
Potential EventLog File Location Tampering
UAC Bypass via Event Viewer
ETW Logging Disabled In .NET Processes - Sysmon Registry
Potential Persistence Via Excel Add-in - Registry
Potential Persistence Via MyComputer Registry Keys
New Root or CA or AuthRoot Certificate to Store
Potential Persistence Via CHM Helper DLL
New Netsh Helper DLL Registered From A Suspicious Location
Potential Persistence Via COM Search Order Hijacking
Suspicious Keyboard Layout Load
Sysmon Driver Altitude Change
Allow RDP Remote Assistance Feature
Potential Persistence Via LSA Extensions
RDP Sensitive Settings Changed
Registry Disable System Restore
VBScript Payload Stored in Registry
New TimeProviders Registered With Uncommon DLL Name
Office Autorun Keys Modification
Hypervisor Enforced Code Integrity Disabled
Disable Windows Defender Functionalities Via Registry Keys
Bypass UAC Using SilentCleanup Task
Classes Autorun Keys Modification
Potential SentinelOne Shell Context Menu Scan Command Tampering
Potential AutoLogger Sessions Tampering
Registry Modification to Hidden File Extension
Winget Admin Settings Modification
CurrentVersion NT Autorun Keys Modification
Potential Persistence Via Shim Database In Uncommon Location
ServiceDll Hijack
WinSock2 Autorun Keys Modification
Add Port Monitor Persistence in Registry
Persistence Via Disk Cleanup Handler - Autorun
DNS-over-HTTPS Enabled by Registry
Scripted Diagnostics Turn Off Check Enabled - Registry
Activate Suppression of Windows Security Center Notifications
Persistence Via Hhctrl.ocx
New BgInfo.EXE Custom VBScript Registry Configuration
CurrentControlSet Autorun Keys Modification
CrashControl CrashDump Disabled
New BgInfo.EXE Custom WMI Query Registry Configuration
Trust Access Disable For VBApplications
Potential Registry Persistence Attempt Via Windows Telemetry
Potential Persistence Via App Paths Default Property
RDP Sensitive Settings Changed to Zero
Macro Enabled In A Potentially Suspicious Document
Bypass UAC Using Event Viewer
Potential Persistence Via Mpnotify
Potentially Suspicious ODBC Driver Registered
Potential Persistence Via Visual Studio Tools for Office
Uncommon Microsoft Office Trusted Location Added
Modify User Shell Folders Startup Value
Disable Administrative Share Creation at Startup
MaxMpxCt Registry Value Changed
New ODBC Driver Registered
Wow6432Node Classes Autorun Keys Modification
Uncommon Extension In Keyboard Layout IME File Registry Value
Persistence Via New SIP Provider
Potential Persistence Via AutodialDLL
Custom File Open Handler Executes PowerShell
ClickOnce Trust Prompt Tampering
Windows Recall Feature Enabled - Registry
COM Hijack via Sdclt
Service Binary in Suspicious Folder
Suspicious Printer Driver Empty Manufacturer
Potential PowerShell Execution Policy Tampering
UAC Bypass via Sdclt
New RUN Key Pointing to Suspicious Folder
Potential AMSI COM Server Hijacking
Windows Defender Exclusions Added - Registry
Potential Persistence Via Outlook Home Page
ETW Logging Disabled For rpcrt4.dll
UAC Bypass Using Windows Media Player - Registry
Potential Persistence Using DebugPath
Windows Defender Service Disabled - Registry
PowerShell Script Execution Policy Enabled
UAC Notification Disabled
Add DisallowRun Execution to Registry
Disable Macro Runtime Scan Scope
Registry Hide Function from User
Outlook EnableUnsafeClientMailRules Setting Enabled - Registry
Potential Persistence Via TypedPaths
PowerShell as a Service in Registry
Usage of Renamed Sysinternals Tools - RegistrySet
IE Change Domain Zone
Tamper With Sophos AV Registry Keys
Disable Windows Event Logging Via Registry
Potential WerFault ReflectDebugger Registry Value Abuse
Winlogon AllowMultipleTSSessions Enable
Registry Persistence via Service in Safe Mode
ScreenSaver Registry Key Set
ETW Logging Disabled For SCM
Potential Signing Bypass Via Windows Developer Features - Registry
Disable Internal Tools or Feature in Registry
UAC Bypass Abusing Winsat Path Parsing - Registry
Disable Windows Security Center Notifications
Disable Privacy Settings Experience in Registry
Hide Schedule Task Via Index Value Tamper
Suspicious Shim Database Patching Activity
Lolbas OneDriveStandaloneUpdater.exe Proxy Download
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification
UAC Secure Desktop Prompt Disabled
Common Autorun Keys Modification
Session Manager Autorun Keys Modification
Displaying Hidden Files Feature Disabled
Directory Service Restore Mode(DSRM) Registry Value Tampering
Microsoft Office Protected View Disabled
Winlogon Notify Key Logon Persistence
Enable Local Manifest Installation With Winget
Suspicious Environment Variable Has Been Registered
Disable Windows Firewall by Registry
Default RDP Port Changed to Non Standard Port
NET NGenAssemblyUsageLog Registry Key Tamper
Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
UAC Disabled
Add Debugger Entry To Hangs Key For Persistence
New DNS ServerLevelPluginDll Installed
Registry Explorer Policy Modification
Modification of IE Registry Settings
Disable Microsoft Defender Firewall via Registry
Enable Microsoft Dynamic Data Exchange
Folder Removed From Exploit Guard ProtectedFolders List - Registry
Removal Of SD Value to Hide Schedule Task - Registry
Terminal Server Client Connection History Cleared - Registry
Removal of Potential COM Hijacking Registry Keys
Removal Of AMSI Provider Registry Keys
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted
Removal Of Index Value to Hide Schedule Task - Registry
Atbroker Registry Change
New PortProxy Registry Entry Added
New DLL Added to AppCertDlls Registry Key
Windows Registry Trust Record Modification
PrinterNightmare Mimikatz Driver Name
Registry Persistence Mechanisms in Recycle Bin
Shell Open Registry Keys Manipulation
Run Once Task Configuration in Registry
Narrator's Feedback-Hub Persistence
Creation of a Local Hidden User Account by Registry
UAC Bypass Via Wsreset
New DLL Added to AppInit_DLLs Registry Key
Esentutl Volume Shadow Copy Service Keys
Registry Entries For Azorult Malware
Potential Qakbot Registry Activity
Windows Credential Editor Registry
Path To Screensaver Binary Modified
Disable Security Events Logging Adding Reg Key MiniNt
Office Application Startup - Office Test
Suspicious Run Key from Download
HybridConnectionManager Service Installation - Registry
Security Support Provider (SSP) Added to LSA Configuration
Potential Credential Dumping Via LSASS SilentProcessExit Technique
Suspicious Camera and Microphone Access
Wdigest CredGuard Registry Modification
RedMimicry Winnti Playbook Registry Manipulation
Pandemic Registry Key
Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback
Sticky Key Like Backdoor Usage - Registry
DLL Load via LSASS
NetNTLM Downgrade Attack - Registry
WINEKEY Registry Modification
CMSTP Execution Registry Event
PUA - Sysinternals Tools Execution - Registry
Suspicious Execution Of Renamed Sysinternals Tools - Registry
Potential NetWire RAT Activity - Registry
Potential COM Object Hijacking Via TreatAs Subkey - Registry
PUA - Sysinternal Tool Execution - Registry
Potential Persistence Via New AMSI Providers - Registry
Potential Persistence Via Disk Cleanup Handler - Registry
Potential Persistence Via Logon Scripts - Registry
Vulnerable WinRing0 Driver Load
Driver Load From A Temporary Directory
PUA - Process Hacker Driver Load
PUA - System Informer Driver Load
Malicious Driver Load By Name
Vulnerable Driver Load
Vulnerable Driver Load By Name
Malicious Driver Load
Vulnerable HackSys Extreme Vulnerable Driver Load
WinDivert Driver Load
Suspicious Cobalt Strike DNS Beaconing - Sysmon
Cloudflared Tunnels Related DNS Requests
DNS Query To AzureWebsites.NET By Non-Browser Process
AppX Package Installation Attempts Via AppInstaller.EXE
Suspicious DNS Query for IP Lookup Service APIs
TeamViewer Domain Query By Non-TeamViewer Application
DNS Server Discovery Via LDAP Query
DNS Query To Devtunnels Domain
DNS HybridConnectionManager Service Bus
DNS Query Tor .Onion Address - Sysmon
DNS Query To Ufile.io
DNS Query for Anonfiles.com Domain - Sysmon
DNS Query To MEGA Hosting Website
DNS Query To Visual Studio Code Tunnels Domain
DNS Query Request To OneLaunch Update Service
DNS Query Request By Regsvr32.EXE
DNS Query To Remote Access Software Domain From Non-Browser App
Malicious Named Pipe Created
CobaltStrike Named Pipe Patterns
PUA - RemCom Default Named Pipe
ADFS Database Named Pipe Connection By Uncommon Tool
CobaltStrike Named Pipe Pattern Regex
PUA - PAExec Default Named Pipe
PUA - CSExec Default Named Pipe
HackTool - CoercedPotato Named Pipe Creation
HackTool - EfsPotato Named Pipe Creation
HackTool - DiagTrackEoP Default Named Pipe
HackTool - Koh Default Named Pipe
CobaltStrike Named Pipe
Alternate PowerShell Hosts Pipe
PsExec Tool Execution From Suspicious Locations - PipeName
WMI Event Consumer Created Named Pipe
HackTool - Credential Dumping Tools Named Pipe Created
New PowerShell Instance Created
Sysmon Configuration Modification
Sysmon Configuration Change
Sysmon Blocked File Shredding
Sysmon Configuration Error
Sysmon File Executable Creation Detected
Sysmon Blocked Executable
Remote Thread Creation By Uncommon Source Image
Remote Thread Created In KeePass.EXE
Remote Thread Created In Shell Application
Remote Thread Creation Via PowerShell In Uncommon Target
HackTool - CACTUSTORCH Remote Thread Creation
HackTool - Potential CobaltStrike Process Injection
Password Dumper Remote Thread in LSASS
Remote Thread Creation In Mstsc.Exe From Suspicious Location
Remote Thread Creation Ttdinject.exe Proxy
Potential Credential Dumping Attempt Via PowerShell Remote Thread
Remote Thread Creation In Uncommon Target Image
Rare Remote Thread Creation By Uncommon Source Image
HackTool - QuarksPwDump Dump File
LiveKD Driver Creation By Uncommon Process
New Outlook Macro Created
Suspicious Executable File Creation
Office Macro File Creation From Suspicious Process
File Creation In Suspicious Directory By Msdt.EXE
Potentially Suspicious DMP/HDMP File Creation
UAC Bypass Using IDiagnostic Profile - File
Assembly DLL Creation Via AspNetCompiler
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File
Suspicious Desktopimgdownldr Target File
Installation of TeamViewer Desktop
HackTool - SafetyKatz Dump Indicator
RDP File Creation From Suspicious Application
UAC Bypass Using Windows Media Player - File
Suspicious Interactive PowerShell as SYSTEM
Legitimate Application Dropped Archive
PowerShell Module File Created
UAC Bypass Abusing Winsat Path Parsing - File
Suspicious ASPX File Drop by Exchange
Self Extraction Directive File Created In Potentially Suspicious Location
Suspicious PROCEXP152.sys File Created In TMP
Suspicious Binary Writes Via AnyDesk
WinSxS Executable File Creation By Non-System Process
Suspicious File Creation In Uncommon AppData Folder
DLL Search Order Hijackig Via Additional Space in Path
Advanced IP Scanner - File Event
VHD Image Download Via Browser
LiveKD Kernel Memory Dump File Created
Suspicious Screensaver Binary File Creation
Creation of a Diagcab
GatherNetworkInfo.VBS Reconnaissance Script Output
RemCom Service File Creation
Anydesk Temporary Artefact
Suspicious Creation with Colorcpl
HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators
Process Monitor Driver Creation By Non-Sysinternals Binary
Potential Persistence Via Microsoft Office Startup Folder
Process Explorer Driver Creation By Non-Sysinternals Binary
Creation of an WerFault.exe in Unusual Folder
WMI Persistence - Script Event Consumer File Write
Suspicious Startup Folder Persistence
Startup Folder File Write
PsExec Service File Creation
Potential Persistence Via Microsoft Office Add-In
OneNote Attachment File Dropped In Suspicious Location
Suspicious DotNET CLR Usage Log Artifact
NTDS.DIT Created
PSScriptPolicyTest Creation By Uncommon Process
Potential Winnti Dropper Activity
UEFI Persistence Via Wpbbin - FileCreation
PDF File Created By RegEdit.EXE
PowerShell Module File Created By Non-PowerShell Process
PCRE.NET Package Temp Files
Potential DCOM InternetExplorer.Application DLL Hijack
Adwind RAT / JRAT File Artifact
TeamViewer Remote Session
Malicious DLL File Dropped in the Teams or OneDrive Folder
Potential Homoglyph Attack Using Lookalike Characters in Filename
WerFault LSASS Process Memory Dump
Legitimate Application Dropped Executable
NTDS.DIT Creation By Uncommon Process
Writing Local Admin Share
Suspicious MSExchangeMailboxReplication ASPX Write
Files With System Process Name In Unsuspected Locations
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
UAC Bypass Using IEInstal - File
Publisher Attachment File Dropped In Suspicious Location
Potential Binary Or Script Dropper Via PowerShell
Windows Shell/Scripting Application File Write to Suspicious Folder
Uncommon File Created In Office Startup Folder
DPAPI Backup Keys And Certificate Export Activity IOC
HackTool - Mimikatz Kirbi File Creation
Potential Persistence Via Notepad++ Plugins
Malicious PowerShell Scripts - FileCreation
Dynamic CSharp Compile Artefact
LSASS Process Memory Dump Creation Via Taskmgr.EXE
PSEXEC Remote Execution File Artefact
LSASS Process Memory Dump Files
UAC Bypass Using NTFS Reparse Point - File
Suspicious Scheduled Task Write to System32 Tasks
ISO or Image Mount Indicator in Recent Files
Creation Exe for Service with Unquoted Path
Windows Terminal Profile Settings Modification By Uncommon Process
Suspicious Files in Default GPO Folder
SCR File Write Event
Wmiprvse Wbemcomn DLL Hijack - File
PowerShell Script Dropped Via PowerShell.EXE
Potential Suspicious PowerShell Module File Created
Potential Webshell Creation On Static Website
UAC Bypass Using EventVwr
Suspicious desktop.ini Action
ScreenConnect Temporary Installation Artefact
PowerShell Profile Modification
Potential Persistence Via Outlook Form
Rclone Config File Creation
Potential RipZip Attack on Startup Folder
CSExec Service File Creation
Suspicious PFX File Creation
UAC Bypass Using MSConfig Token Modification - File
Octopus Scanner Malware
Hijack Legit RDP Session to Move Laterally
Files With System DLL Name In Unsuspected Locations
Renamed VsCode Code Tunnel Execution - File Indicator
Windows Binaries Write Suspicious Extensions
New Custom Shim Database Created
UAC Bypass Using Consent and Comctl32 - File
Potential Startup Shortcut Persistence Via PowerShell.EXE
Cred Dump Tools Dropped Files
HackTool - Inveigh Execution Artefacts
Legitimate Application Dropped Script
Potential Persistence Attempt Via ErrorHandler.Cmd
Suspicious LNK Double Extension File Created
NTDS.DIT Creation By Uncommon Parent Process
File With Uncommon Extension Created By An Office Application
Created Files by Microsoft Sync Center
HackTool - CrackMapExec File Indicators
Uncommon File Creation By Mysql Daemon Process
HackTool - Typical HiveNightmare SAM File Export
Suspicious Outlook Macro Created
UAC Bypass Using .NET Code Profiler on MMC
Suspicious File Creation Activity From Fake Recycle.Bin Folder
LSASS Process Dump Artefact In CrashDumps Folder
Wmiexec Default Output File
ISO File Created Within Temp Folders
Drop Binaries Into Spool Drivers Color Folder
Suspicious File Drop by Exchange
LiveKD Driver Creation
HackTool - Dumpert Process Dumper Default File
ADSI-Cache File Creation By Uncommon Tool
Office Macro File Creation
Potential Privilege Escalation Attempt Via .Exe.Local Technique
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream
Suspicious Get-Variable.exe Creation
WScript or CScript Dropper - File
Suspicious Double Extension Files
Potential Initial Access via DLL Search Order Hijacking
Suspicious File Created Via OneNote Application
Office Macro File Download
HackTool - Powerup Write Hijack DLL
Visual Studio Code Tunnel Remote File Creation
EVTX Created In Uncommon Location
VsCode Powershell Profile Modification
BloodHound Collection Files
HackTool - NPPSpy Hacktool Usage
Suspicious Creation TXT File in User Desktop
GoToAssist Temporary Installation Artefact
Creation Of Non-Existent System DLL
Suspicious File Created In PerfLogs
Remote Access Tool - ScreenConnect Temporary File
NTDS Exfiltration Filename Patterns
Potential SAM Database Dump
Suspicious Appended Extension
Access To Windows DPAPI Master Keys By Uncommon Applications
Credential Manager Access By Uncommon Applications
Access To Potentially Sensitive Sysvol Files By Uncommon Applications
Access To Crypto Currency Wallets By Uncommon Applications
Microsoft Teams Sensitive File Access By Uncommon Applications
Access To Windows Credential History File By Uncommon Applications
File Creation Date Changed to Another Year
Unusual File Modification by dns.exe
Prefetch File Deleted
Backup Files Deleted
Unusual File Deletion by Dns.exe
IIS WebServer Access Logs Deleted
ADS Zone.Identifier Deleted By Uncommon Application
Exchange PowerShell Cmdlet History Deleted
Potential PrintNightmare Exploitation Attempt
TeamViewer Log File Deleted
EventLog EVTX File Deleted
Tomcat WebServer Logs Deleted
File Deleted Via Sysinternals SDelete
PowerShell Console History Logs Deleted
Potentially Suspicious Self Extraction Directive File Created
DLL Execution Via Register-cimprovider.exe
Windows Kernel Debugger Execution
Windows Internet Hosted WebDav Share Mount Via Net.EXE
Uninstall Crowdstrike Falcon Sensor
Powershell Defender Disable Scan Feature
UAC Bypass Using ChangePK and SLUI
UtilityFunctions.ps1 Proxy Dll
Process Creation Using Sysnative Folder
New Generic Credentials Added Via Cmdkey.EXE
Sysmon Driver Unloaded Via Fltmc.EXE
Suspicious Greedy Compression Using Rar.EXE
PUA - Wsudo Suspicious Execution
Esentutl Steals Browser Information
PUA - AdvancedRun Execution
LSASS Process Reconnaissance Via Findstr.EXE
Suspicious Splwow64 Without Params
Potential Arbitrary Command Execution Using Msdt.EXE
Suspicious Key Manager Access
HackTool - Rubeus Execution
Uncommon System Information Discovery Via Wmic.EXE
Diskshadow Script Mode - Uncommon Script Extension Execution
Suspicious RDP Redirect Using TSCON
Suspicious Redirection to Local Admin Share
Rar Usage with Password and Compression Level
Add Windows Capability Via PowerShell Cmdlet
Suspicious Certreq Command to Download
Potential SPN Enumeration Via Setspn.EXE
Suspicious Windows Update Agent Empty Cmdline
New Kernel Driver Via SC.EXE
Unmount Share Via Net.EXE
Console CodePage Lookup Via CHCP
HackTool - EDRSilencer Execution
Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
RDP Connection Allowed Via Netsh.EXE
HTML Help HH.EXE Suspicious Child Process
Computer Discovery And Export Via Get-ADComputer Cmdlet
Suspicious MSHTA Child Process
Potential DLL Sideloading Via DeviceEnroller.EXE
Visual Studio Code Tunnel Service Installation
Renamed PingCastle Binary Execution
Fsutil Drive Enumeration
HackTool - Bloodhound/Sharphound Execution
PUA - Seatbelt Execution
Screen Capture Activity Via Psr.EXE
System Network Connections Discovery Via Net.EXE
Remote Access Tool - ScreenConnect Execution
New Process Created Via Taskmgr.EXE
Potential Fake Instance Of Hxtsr.EXE Executed
HackTool - SharPersist Execution
Suspicious RunAs-Like Flag Combination
Suspicious Process Patterns NTDS.DIT Exfil
User Added to Local Administrators Group
Renamed Sysinternals Sdelete Execution
Potentially Suspicious Usage Of Qemu
Abuse of Service Permissions to Hide Services Via Set-Service
Proxy Execution Via Wuauclt.EXE
Port Forwarding Activity Via SSH.EXE
Chopper Webshell Process Pattern
Suspicious SYSTEM User Process Creation
New Remote Desktop Connection Initiated Via Mstsc.EXE
Use of Scriptrunner.exe
Suspect Svchost Activity
Suspicious Mstsc.EXE Execution With Local RDP File
New Port Forwarding Rule Added Via Netsh.EXE
Suspicious Rundll32 Invoking Inline VBScript
Remote PowerShell Session Host Process (WinRM)
HackTool - Empire PowerShell Launch Parameters
Terminal Service Process Spawn
HackTool - Certipy Execution
Suspicious UltraVNC Execution
Lolbin Unregmp2.exe Use As Proxy
Cloudflared Tunnel Execution
Findstr GPP Passwords
PowerShell DownloadFile
Renamed Remote Utilities RAT (RURAT) Execution
WhoAmI as Parameter
Explorer NOUACCHECK Flag
HackTool - Sliver C2 Implant Activity Pattern
Using SettingSyncHost.exe as LOLBin
Suspicious PowerShell IEX Execution Patterns
Suspicious WMIC Execution Via Office Process
Windows Shell/Scripting Processes Spawning Suspicious Programs
Potentially Suspicious WebDAV LNK Execution
Msxsl.EXE Execution
Wab Execution From Non Default Location
New ActiveScriptEventConsumer Created Via Wmic.EXE
Potential Commandline Obfuscation Using Escape Characters
File Download And Execution Via IEExec.EXE
Sdclt Child Processes
Wusa.EXE Extracting Cab Files From Suspicious Paths
Rundll32 Spawned Via Explorer.EXE
Suspicious Reg Add BitLocker
Suspicious ZipExec Execution
Rundll32 Execution Without Parameters
Potential Signing Bypass Via Windows Developer Features
Suspicious Child Process Of Manage Engine ServiceDesk
User Added To Highly Privileged Group
HackTool - LocalPotato Execution
Greedy File Deletion Using Del
Suspicious PowerShell Encoded Command Patterns
UAC Bypass Using NTFS Reparse Point - Process
Renamed BrowserCore.EXE Execution
Potential Network Sniffing Activity Using Network Tools
UEFI Persistence Via Wpbbin - ProcessCreation
Malicious Base64 Encoded PowerShell Keywords in Command Lines
Psexec Execution
Interesting Service Enumeration Via Sc.EXE
Chromium Browser Instance Executed With Custom Extension
Suspicious Service DACL Modification Via Set-Service Cmdlet
PUA - NPS Tunneling Tool Execution
Indirect Command Execution From Script File Via Bash.EXE
Remote Access Tool - Anydesk Execution From Suspicious Folder
Suspicious Processes Spawned by WinRM
Suspicious Windows Defender Registry Key Tampering Via Reg.EXE
Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet
Potential Data Exfiltration Activity Via CommandLine Tools
ManageEngine Endpoint Central Dctask64.EXE Potential Abuse
Remote Access Tool - RURAT Execution From Unusual Location
Use of FSharp Interpreters
SQLite Chromium Profile Data DB Access
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
HackTool - XORDump Execution
Suspicious WebDav Client Execution Via Rundll32.EXE
TrustedPath UAC Bypass Pattern
Renamed Msdt.EXE Execution
Process Access via TrolleyExpress Exclusion
Potential Product Reconnaissance Via Wmic.EXE
Suspicious Download Via Certutil.EXE
Suspicious Modification Of Scheduled Tasks
Sensitive File Dump Via Wbadmin.EXE
Odbcconf.EXE Suspicious DLL Location
Replace.exe Usage
Microsoft IIS Service Account Password Dumped
Suspicious Copy From or To System Directory
MsiExec Web Install
Suspicious GUP Usage
Security Privileges Enumeration Via Whoami.EXE
Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)
Weak or Abused Passwords In CLI
Suspicious PowerShell Download and Execute Pattern
Change Default File Association Via Assoc
Suspicious Rundll32 Execution With Image Extension
Query Usage To Exfil Data
PowerShell Download and Execution Cradles
Potential Execution of Sysinternals Tools
Suspicious WindowsTerminal Child Processes
Service StartupType Change Via PowerShell Set-Service
Suspicious Download from Office Domain
Response File Execution Via Odbcconf.EXE
Service Started/Stopped Via Wmic.EXE
PowerShell Execution With Potential Decryption Capabilities
HackTool - TruffleSnout Execution
UAC Bypass Tools Using ComputerDefaults
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
PowerShell Set-Acl On Windows Folder
Execute Code with Pester.bat as Parent
Non-privileged Usage of Reg or Powershell
Powershell Inline Execution From A File
Non Interactive PowerShell Process Spawned
Nltest.EXE Execution
New User Created Via Net.EXE
File Download Via Bitsadmin To An Uncommon Target Folder
Exchange PowerShell Snap-Ins Usage
Harvesting Of Wifi Credentials Via Netsh.EXE
HackTool - KrbRelay Execution
Application Whitelisting Bypass via Dxcap.exe
UAC Bypass Using PkgMgr and DISM
Local File Read Using Curl.EXE
Active Directory Database Snapshot Via ADExplorer
Powershell Token Obfuscation - Process Creation
Disable Important Scheduled Task
New Service Creation Using PowerShell
Potential Persistence Via Logon Scripts - CommandLine
Suspicious NTLM Authentication on the Printer Spooler Service
Invoke-Obfuscation Via Stdin
Suspicious Child Process of AspNetCompiler
Potential MSTSC Shadowing Activity
Suspicious PowerShell Parameter Substring
Service StartupType Change Via Sc.EXE
SQL Client Tools PowerShell Session Detection
Active Directory Structure Export Via Csvde.EXE
Suspicious Manipulation Of Default Accounts Via Net.EXE
Hardware Model Reconnaissance Via Wmic.EXE
Remote Access Tool - UltraViewer Execution
Use of OpenConsole
Curl Web Request With Potential Custom User-Agent
NtdllPipe Like Activity Execution
Suspicious File Encoded To Base64 Via Certutil.EXE
Potential SysInternals ProcDump Evasion
Taskmgr as LOCAL_SYSTEM
Windows Credential Manager Access via VaultCmd
Firewall Rule Deleted Via Netsh.EXE
Suspicious Extrac32 Alternate Data Stream Execution
Suspicious Execution of Powershell with Base64
Potential File Download Via MS-AppInstaller Protocol Handler
Suspicious Electron Application Child Processes
Suspicious Script Execution From Temp Folder
Use Short Name Path in Command Line
HackTool - SafetyKatz Execution
Suspicious Process Masquerading As SvcHost.EXE
Computer Password Change Via Ksetup.EXE
Suspicious Windows Service Tampering
Suspicious Child Process Of Wermgr.EXE
Powershell Defender Exclusion
HackTool - ADCSPwn Execution
Potentially Suspicious Execution Of PDQDeployRunner
Sysinternals PsSuspend Execution
Suspicious Service Path Modification
Renamed Vmnat.exe Execution
PowerShell Get-Clipboard Cmdlet Via CLI
Potential COM Objects Download Cradles Usage - Process Creation
Suspicious Process By Web Server Process
Suspicious Schtasks Schedule Types
Delete All Scheduled Tasks
BitLockerTogo.EXE Execution
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
Potential Tampering With Security Products Via WMIC
Potential Suspicious Activity Using SeCEdit
Arbitrary File Download Via Squirrel.EXE
Suspicious Driver/DLL Installation Via Odbcconf.EXE
Suspicious Execution of Systeminfo
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code
Use of Remote.exe
Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution
Renamed Plink Execution
Wscript Shell Run In CommandLine
Uncommon Userinit Child Process
PUA - PingCastle Execution From Potentially Suspicious Parent
Suspicious Chromium Browser Instance Executed With Custom Extension
HackTool - Potential Impacket Lateral Movement Activity
Regsvr32 Execution From Potential Suspicious Location
LSASS Dump Keyword In CommandLine
Abusing Print Executable
HackTool - SharpUp PrivEsc Tool Execution
Php Inline Command Execution
Suspicious File Download From IP Via Wget.EXE
Suspicious Driver Install by pnputil.exe
IIS Native-Code Module Command Line Installation
Use of UltraVNC Remote Access Software
Enumerate All Information With Whoami.EXE
Potential Arbitrary Command Execution Via FTP.EXE
Sensitive File Access Via Volume Shadow Copy Backup
Potential LethalHTA Technique Execution
Potentially Suspicious Office Document Executed From Trusted Location
Remote Access Tool - AnyDesk Execution
Potentially Suspicious Windows App Activity
Potential Commandline Obfuscation Using Unicode Characters
REGISTER_APP.VBS Proxy Execution
Suspicious Where Execution
Potential Windows Defender Tampering Via Wmic.EXE
Firewall Disabled via Netsh.EXE
PUA - Crassus Execution
Potential Data Stealing Via Chromium Headless Debugging
Remote Access Tool - ScreenConnect Installation Execution
PowerShell Get-Process LSASS
Suspicious Sigverif Execution
Registry Modification Via Regini.EXE
Suspicious Provlaunch.EXE Child Process
Suspicious PowerShell Invocation From Script Engines
File Download From IP URL Via Curl.EXE
MpiExec Lolbin
Install New Package Via Winget Local Manifest
Suspicious Shells Spawn by Java Utility Keytool
Suspicious IIS URL GlobalRules Rewrite Via AppCmd
PowerShell Base64 Encoded Reflective Assembly Load
HackTool - Certify Execution
Suspicious Child Process Of BgInfo.EXE
Wlrmdr.EXE Uncommon Argument Or Child Process
Suspicious File Execution From Internet Hosted WebDav Share
Tor Client/Browser Execution
Audit Policy Tampering Via Auditpol
Potential Provlaunch.EXE Binary Proxy Execution Abuse
Copy From Or To Admin Share Or Sysvol Folder
Gpscript Execution
New DLL Registered Via Odbcconf.EXE
Certificate Exported Via Certutil.EXE
File Encryption Using Gpg4win
Sensitive File Recovery From Backup Via Wbadmin.EXE
Root Certificate Installed From Susp Locations
WmiPrvSE Spawned A Process
Rundll32 Execution With Uncommon DLL Extension
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE
UAC Bypass Using Disk Cleanup
AddinUtil.EXE Execution From Uncommon Directory
Hidden Powershell in Link File Pattern
HackTool - RedMimicry Winnti Playbook Execution
PowerShell Web Download
Potential Command Line Path Traversal Evasion Attempt
Interactive AT Job
PUA - DefenderCheck Execution
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
User Discovery And Export Via Get-ADUser Cmdlet
Filter Driver Unloaded Via Fltmc.EXE
Powershell Executed From Headless ConHost Process
Renamed Whoami Execution
HackTool - WinPwn Execution
Suspicious Child Process Created as System
Suspicious MSDT Parent Process
Use Icacls to Hide File to Everyone
HackTool - winPEAS Execution
Arbitrary Binary Execution Using GUP Utility
Suspicious Powercfg Execution To Change Lock Screen Timeout
Gzip Archive Decode Via PowerShell
Suspicious GrpConv Execution
File Download From Browser Process Via Inline URL
Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution
Potentially Suspicious Ping/Copy Command Combination
Potential Configuration And Service Reconnaissance Via Reg.EXE
Renamed AdFind Execution
Procdump Execution
Potential Suspicious Registry File Imported Via Reg.EXE
Windows Hotfix Updates Reconnaissance Via Wmic.EXE
Potential RDP Tunneling Via Plink
Renamed Cloudflared.EXE Execution
Potential Adplus.EXE Abuse
PrintBrm ZIP Creation of Extraction
File Decryption Using Gpg4win
Remote Access Tool - LogMeIn Execution
Potential Mftrace.EXE Abuse
Sticky Key Like Backdoor Execution
Potential Credential Dumping Attempt Using New NetworkProvider - CLI
Potential Discovery Activity Via Dnscmd.EXE
Potential Renamed Rundll32 Execution
File Download Via InstallUtil.EXE
Logged-On User Password Change Via Ksetup.EXE
Potential Browser Data Stealing
RDP Port Forwarding Rule Added Via Netsh.EXE
Disable Windows Defender AV Security Monitoring
LSA PPL Protection Disabled Via Reg.EXE
Sysinternals PsSuspend Suspicious Execution
AspNetCompiler Execution
Devtoolslauncher.exe Executes Specified Binary
UAC Bypass via Windows Firewall Snap-In Hijack
Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate
Csc.EXE Execution Form Potentially Suspicious Parent
HackTool - SharpMove Tool Execution
Potentially Suspicious Desktop Background Change Using Reg.EXE
Use of VisualUiaVerifyNative.exe
PsExec Service Child Process Execution as LOCAL SYSTEM
Computer System Reconnaissance Via Wmic.EXE
HackTool - Impersonate Execution
Microsoft Workflow Compiler Execution
Potential Process Execution Proxy Via CL_Invocation.ps1
Sysinternals PsService Execution
Potentially Suspicious Child Process Of ClickOnce Application
Lolbin Ssh.exe Use As Proxy
Suspicious Execution of Shutdown
Potentially Suspicious Child Process Of DiskShadow.EXE
Application Terminated Via Wmic.EXE
PUA - Nimgrab Execution
HackTool - WinRM Access Via Evil-WinRM
HackTool - Hashcat Password Cracker Execution
Forfiles.EXE Child Process Masquerading
Permission Misconfiguration Reconnaissance Via Findstr.EXE
Arbitrary MSI Download Via Devinit.EXE
Read Contents From Stdin Via Cmd.EXE
Potential Password Spraying Attempt Using Dsacls.EXE
Use of Pcalua For Execution
Potential CobaltStrike Process Patterns
Suspicious Use of PsLogList
Suspicious DLL Loaded via CertOC.EXE
Add Insecure Download Source To Winget
Use Of The SFTP.EXE Binary As A LOLBIN
Renamed Mavinject.EXE Execution
Remote Access Tool - Team Viewer Session Started On Windows Host
Renamed CreateDump Utility Execution
Wusa Extracting Cab Files
Potential Credential Dumping Via LSASS Process Clone
CMSTP Execution Process Creation
Suspicious Recursive Takeown
Process Execution From A Potentially Suspicious Folder
Execution Of Non-Existing File
PowerShell Base64 Encoded WMI Classes
PUA - NirCmd Execution
Potentially Suspicious Call To Win32_NTEventlogFile Class
Operator Bloopers Cobalt Strike Modules
Wab/Wabmig Unusual Parent Or Child Processes
UAC Bypass Using Windows Media Player - Process
Bypass UAC via CMSTP
Dllhost.EXE Execution Anomaly
Suspicious Command Patterns In Scheduled Task Creation
Execute Files with Msdeploy.exe
Recon Command Output Piped To Findstr.EXE
Suspicious Child Process Of SQL Server
Potential Suspicious Mofcomp Execution
UAC Bypass Using IEInstal - Process
Uncommon Child Process Of Appvlp.EXE
Suspicious Microsoft Office Child Process
Cloudflared Tunnel Connections Cleanup
Arbitrary File Download Via IMEWDBLD.EXE
Potential Encoded PowerShell Patterns In CommandLine
Suspicious Msbuild Execution By Uncommon Parent Process
Indirect Inline Command Execution Via Bash.EXE
Suspicious Parent Double Extension File Execution
Firewall Rule Update Via Netsh.EXE
CobaltStrike Load by Rundll32
Copying Sensitive Files with Credential Data
WMIC Remote Command Execution
Potential Defense Evasion Via Right-to-Left Override
Suspicious Control Panel DLL Load
Remote Access Tool - GoToAssist Execution
Potential Product Class Reconnaissance Via Wmic.EXE
Scheduled Task Executing Encoded Payload from Registry
HackTool - CrackMapExec Execution Patterns
Potentially Suspicious Regsvr32 HTTP IP Pattern
PUA - SoftPerfect Netscan Execution
PUA - System Informer Execution
Suspicious Obfuscated PowerShell Code
Winrar Compressing Dump Files
File Download Via Bitsadmin
Windows Firewall Disabled via PowerShell
Potential PowerShell Downgrade Attack
Invoke-Obfuscation Via Use Clip
Service Reconnaissance Via Wmic.EXE
Suspicious Extexport Execution
Execute Code with Pester.bat
PUA - RunXCmd Execution
Suspicious File Download From IP Via Wget.EXE - Paths
PowerShell Base64 Encoded FromBase64String Cmdlet
Change Default File Association To Executable Via Assoc
Suspicious WmiPrvSE Child Process
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
Remote Code Execute via Winrm.vbs
Potential Credential Dumping Via WER
Start of NT Virtual DOS Machine
Invoke-Obfuscation Obfuscated IEX Invocation
Uncommon Extension Shim Database Installation Via Sdbinst.EXE
Suspicious SYSVOL Domain Group Policy Access
Suspicious Diantz Alternate Data Stream Execution
Suspicious Encoded PowerShell Command Line
Potential PowerShell Obfuscation Via Reversed Commands
Uncommon Child Process Of BgInfo.EXE
Certificate Exported Via PowerShell
Net WebClient Casing Anomalies
Reg Add Suspicious Paths
Set Suspicious Files as System Files Using Attrib.EXE
Suspicious PowerShell Mailbox Export to Share
Scripting/CommandLine Process Spawned Regsvr32
Rundll32 InstallScreenSaver Execution
Arbitrary File Download Via ConfigSecurityPolicy.EXE
Suspicious Download From Direct IP Via Bitsadmin
WMI Backdoor Exchange Transport Agent
Suspicious Workstation Locking via Rundll32
Suspicious Download From File-Sharing Website Via Bitsadmin
Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
JScript Compiler Execution
Share And Session Enumeration Using Net.EXE
Network Reconnaissance Activity
Suspicious Microsoft OneNote Child Process
Always Install Elevated Windows Installer
Regedit as Trusted Installer
Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp
DLL Loaded via CertOC.EXE
Uncommon Link.EXE Parent Process
Rundll32 UNC Path Execution
PUA - DIT Snapshot Viewer
Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE
Raccine Uninstall
Elevated System Shell Spawned From Uncommon Parent Location
Explorer Process Tree Break
Compressed File Extraction Via Tar.EXE
Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
Potential WinAPI Calls Via CommandLine
Potentially Suspicious CMD Shell Output Redirect
Whoami.EXE Execution Anomaly
Mavinject Inject DLL Into Running Process
New Virtual Smart Card Created Via TpmVscMgr.EXE
UAC Bypass WSReset
DumpStack.log Defender Evasion
Files Added To An Archive Using Rar.EXE
Potential RDP Session Hijacking Activity
LOLBIN Execution From Abnormal Drive
Potential MsiExec Masquerading
VMToolsd Suspicious Child Process
Uncommon Child Process Spawned By Odbcconf.EXE
HackTool - UACMe Akagi Execution
Run Once Task Execution as Configured in Registry
Suspicious Remote Child Process From Outlook
Potentially Suspicious Child Process Of Regsvr32
Java Running with Remote Debugging
UAC Bypass via ICMLuaUtil
Potential Obfuscated Ordinal Call Via Rundll32
HackTool - DInjector PowerShell Cradle Execution
AgentExecutor PowerShell Execution
PUA - 3Proxy Execution
Shell32 DLL Execution in Suspicious Directory
DumpMinitool Execution
Hiding Files with Attrib.exe
Suspicious X509Enrollment - Process Creation
Sdiagnhost Calling Suspicious Child Process
Suspicious Scheduled Task Creation via Masqueraded XML File
DriverQuery.EXE Execution
Suspicious Network Command
Taskkill Symantec Endpoint Protection
Remote Access Tool - AnyDesk Piped Password Via CLI
PUA - WebBrowserPassView Execution
HackTool - LaZagne Execution
Script Event Consumer Spawning Process
Use of Wfc.exe
Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet
Delete Important Scheduled Task
HackTool - Jlaive In-Memory Assembly Execution
Suspicious JavaScript Execution Via Mshta.EXE
Firewall Configuration Discovery Via Netsh.EXE
Suspicious Ping/Del Command Combination
Windows Defender Definition Files Removed
Potential Privilege Escalation Using Symlink Between Osk and Cmd
Password Provided In Command Line Of Net.EXE
HackTool - CrackMapExec Execution
Suspicious Reg Add Open Command
RunDLL32 Spawning Explorer
All Backups Deleted Via Wbadmin.EXE
PUA - Advanced Port Scanner Execution
HackTool - SecurityXploded Execution
Browser Started with Remote Debugging
Renamed Microsoft Teams Execution
Renamed MegaSync Execution
Renamed AutoIt Execution
Potential Memory Dumping Activity Via LiveKD
Suspicious MsiExec Embedding Parent
Kavremover Dropped Binary LOLBIN Usage
Renamed NetSupport RAT Execution
PUA - Netcat Suspicious Execution
MMC20 Lateral Movement
Start Windows Service Via Net.EXE
Shadow Copies Creation Using Operating Systems Utilities
DLL Sideloading by VMware Xfer Utility
SQLite Firefox Profile Data DB Access
Conhost.exe CommandLine Path Traversal
Renamed ZOHO Dctask64 Execution
Suspicious HWP Sub Processes
Process Memory Dump via RdrLeakDiag.EXE
PUA- IOX Tunneling Tool Execution
Xwizard.EXE Execution From Non-Default Location
Active Directory Structure Export Via Ldifde.EXE
Add SafeBoot Keys Via Reg Utility
File Download Using ProtocolHandler.exe
Mshtml.DLL RunHTMLApplication Suspicious Usage
Ping Hex IP
Suspicious Response File Execution Via Odbcconf.EXE
Uncommon Child Processes Of SndVol.exe
Potentially Suspicious Command Targeting Teams Sensitive Files
Arbitrary File Download Via MSEDGE_PROXY.EXE
Uncommon Child Process Of AddinUtil.EXE
Rebuild Performance Counter Values Via Lodctr.EXE
Potential Persistence Attempt Via Run Keys Using Reg.EXE
Driver/DLL Installation Via Odbcconf.EXE
Potentially Suspicious Rundll32 Activity
Uncommon Svchost Parent Process
Suspicious Query of MachineGUID
Persistence Via Sticky Key Backdoor
VeeamBackup Database Credentials Dump Via Sqlcmd.EXE
Potentially Suspicious GoogleUpdate Child Process
Add Potential Suspicious New Download Source To Winget
Suspicious Eventlog Clearing or Configuration Change Activity
Webshell Tool Reconnaissance Activity
Schtasks From Suspicious Folders
Suspicious Advpack Call Via Rundll32.EXE
HackTool - Quarks PwDump Execution
PowerShell Base64 Encoded Invoke Keyword
Insensitive Subfolder Search Via Findstr.EXE
Enumeration for Credentials in Registry
Finger.EXE Execution
Launch-VsDevShell.PS1 Proxy Execution
PUA - CsExec Execution
Potential AMSI Bypass Via .NET Reflection
Invoke-Obfuscation VAR+ Launcher
Wusa.EXE Executed By Parent Process Located In Suspicious Location
PUA - CleanWipe Execution
Hacktool Execution - Imphash
HackTool - SharpChisel Execution
Suspicious Use of CSharp Interactive Console
Rundll32 Execution Without CommandLine Parameters
Suspicious IIS Module Registration
Uncommon AddinUtil.EXE CommandLine Execution
Service Security Descriptor Tampering Via Sc.EXE
Python Inline Command Execution
Remote Access Tool - ScreenConnect Remote Command Execution
Suspicious Invoke-WebRequest Execution
Execute Pcwrun.EXE To Leverage Follina
HackTool - SharpLDAPmonitor Execution
Cloudflared Quick Tunnel Execution
HackTool - Default PowerSploit/Empire Scheduled Task Creation
Discovery of a System Time
PowerShell Download Pattern
File Download From IP Based URL Via CertOC.EXE
PUA - Adidnsdump Execution
Suspicious Csi.exe Usage
Dism Remove Online Package
HackTool - Stracciatella Execution
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE
Winrar Execution in Non-Standard Folder
HackTool - Koadic Execution
Potential Binary Proxy Execution Via Cdb.EXE
Potential Windows Defender AV Bypass Via Dump64.EXE Rename
Suspicious Regsvr32 Execution From Remote Share
HackTool - Inveigh Execution
Suspicious Process Parents
Regsvr32 DLL Execution With Uncommon Extension
Potentially Suspicious Cabinet File Expansion
Perl Inline Command Execution
Domain Trust Discovery Via Dsquery
Potentially Suspicious Child Process of KeyScrambler.exe
HackTool - CrackMapExec PowerShell Obfuscation
Time Travel Debugging Utility Usage
Potential LSASS Process Dump Via Procdump
Potential Remote Desktop Tunneling
Tasks Folder Evasion
Suspicious Service Binary Directory
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl
Add New Download Source To Winget
HackTool - Wmiexec Default Powershell Command
Potential Tampering With RDP Related Registry Keys Via Reg.EXE
Potential Arbitrary Code Execution Via Node.EXE
Suspicious File Download From IP Via Curl.EXE
Potential Amazon SSM Agent Hijacking
Visual Studio Code Tunnel Execution
Renamed PsExec Service Execution
Stop Windows Service Via PowerShell Stop-Service
Malicious PowerShell Commandlets - ProcessCreation
Webshell Detection With Command Line Keywords
Arbitrary Command Execution Using WSL
Potential Suspicious Browser Launch From Document Reader Process
COM Object Execution via Xwizard.EXE
HackTool - Windows Credential Editor (WCE) Execution
Suspicious Desktopimgdownldr Command
File Download Via Windows Defender MpCmpRun.EXE
New User Created Via Net.EXE With Never Expire Option
MSExchange Transport Agent Installation
HackTool - CrackMapExec Process Patterns
Powershell Base64 Encoded MpPreference Cmdlet
HackTool - SharpLdapWhoami Execution
Potentially Suspicious Execution From Parent Process In Public Folder
Abused Debug Privilege by Arbitrary Parent Processes
Cloudflared Portable Execution
Node Process Executions
Python Spawning Pretty TTY on Windows
UAC Bypass Using Consent and Comctl32 - Process
Writing Of Malicious Files To The Fonts Folder
Malicious PE Execution by Microsoft Visual Studio Debugger
Audio Capture via SoundRecorder
Insecure Transfer Via Curl.EXE
Suspicious AgentExecutor PowerShell Execution
Suspicious SysAidServer Child
Suspicious Double Extension File Execution
Visual Studio NodejsTools PressAnyKey Renamed Execution
File In Suspicious Location Encoded To Base64 Via Certutil.EXE
Whoami.EXE Execution With Output Option
File Encryption/Decryption Via Gpg4win From Suspicious Locations
Visual Basic Command Line Compiler Usage
Potential SMB Relay Attack Tool Execution
XBAP Execution From Uncommon Locations Via PresentationHost.EXE
Renamed Jusched.EXE Execution
PUA - Advanced IP Scanner Execution
LOL-Binary Copied From System Directory
Potential Script Proxy Execution Via CL_Mutexverifiers.ps1
Suspicious AddinUtil.EXE CommandLine Execution
PDQ Deploy Remote Adminstartion Tool Execution
Potentially Suspicious Child Process Of WinRAR.EXE
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
Potential Active Directory Enumeration Using AD Module - ProcCreation
Windows Binary Executed From WSL
Arbitrary File Download Via PresentationHost.EXE
PUA - Ngrok Execution
Renamed SysInternals DebugView Execution
Suspicious Msiexec Execute Arbitrary DLL
WMI Persistence - Script Event Consumer
RestrictedAdminMode Registry Value Tampering - ProcCreation
Possible Privilege Escalation via Weak Service Permissions
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
Potential Process Injection Via Msra.EXE
Control Panel Items
Script Interpreter Execution From Suspicious Folder
Conhost Spawned By Uncommon Parent Process
DeviceCredentialDeployment Execution
Suspicious Process Created Via Wmic.EXE
Always Install Elevated MSI Spawned Cmd And Powershell
HackTool - Empire PowerShell UAC Bypass
HackTool - CreateMiniDump Execution
File Encoded To Base64 Via Certutil.EXE
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
CMSTP UAC Bypass via COM Object Access
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
Potential Dosfuscation Activity
Shadow Copies Deletion Using Operating Systems Utilities
Suspicious Invoke-WebRequest Execution With DirectIP
Renamed Visual Studio Code Tunnel Execution
Invoke-Obfuscation STDIN+ Launcher
New Root Certificate Installed Via Certutil.EXE
Potential Binary Impersonating Sysinternals Tools
PUA - Radmin Viewer Utility Execution
Verclsid.exe Runs COM Object
Change PowerShell Policies to an Insecure Level
Use NTFS Short Name in Command Line
Scheduled Task Creation Via Schtasks.EXE
UAC Bypass Abusing Winsat Path Parsing - Process
Schtasks Creation Or Modification With SYSTEM Privileges
Potential Cookies Session Hijacking
Potential RDP Tunneling Via SSH
Suspicious Kernel Dump Using Dtrace
File Decoded From Base64/Hex Via Certutil.EXE
Gpresult Display Group Policy Information
Potential PsExec Remote Execution
Suspicious Execution of InstallUtil Without Log
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI
Suspicious Mshta.EXE Execution Patterns
DLL Execution via Rasautou.exe
HackTool - SharpDPAPI Execution
Potentially Suspicious Child Process Of VsCode
HackTool - PPID Spoofing SelectMyParent Tool Execution
Suspicious FromBase64String Usage On Gzip Archive - Process Creation
ETW Logging Tamper In .NET Processes Via CommandLine
Suspicious Child Process Of Veeam Dabatase
MSHTA Suspicious Execution 01
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities
Potential Persistence Via Powershell Search Order Hijacking - Task
New Firewall Rule Added Via Netsh.EXE
Suspicious Binary In User Directory Spawned From Office Application
Nslookup PowerShell Download Cradle - ProcessCreation
Suspicious Git Clone
Service DACL Abuse To Hide Services Via Sc.EXE
Persistence Via TypedPaths - CommandLine
Process Proxy Execution Via Squirrel.EXE
File Download Via Bitsadmin To A Suspicious Target Folder
Service Registry Key Deleted Via Reg.EXE
Suspicious Userinit Child Process
Bad Opsec Defaults Sacrificial Processes With Improper Arguments
HackTool - GMER Rootkit Detector and Remover Execution
Suspicious Program Names
Suspicious High IntegrityLevel Conhost Legacy Option
Disable Windows IIS HTTP Logging
Potentially Suspicious Event Viewer Child Process
Indirect Command Execution By Program Compatibility Wizard
Invoke-Obfuscation CLIP+ Launcher
Suspicious Execution Location Of Wermgr.EXE
Suspicious File Download From File Sharing Domain Via Curl.EXE
HackTool - Dumpert Process Dumper Execution
HackTool - Hydra Password Bruteforce Execution
Potential Dropper Script Execution Via WScript/CScript
InfDefaultInstall.exe .inf Execution
ImagingDevices Unusual Parent/Child Processes
New Network Trace Capture Started Via Netsh.EXE
Ruby Inline Command Execution
Suspicious RASdial Activity
Execution of Suspicious File Type Extension
Mstsc.EXE Execution With Local RDP File
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI
Data Copied To Clipboard Via Clip.EXE
Suspicious Diantz Download and Compress Into a CAB File
File Download with Headless Browser
HackTool - SysmonEOP Execution
Suspicious Vsls-Agent Command With AgentExtensionPath Load
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
Bypass UAC via WSReset.exe
Compress Data and Lock With Password for Exfiltration With WINZIP
Suspicious Usage Of ShellExec_RunDLL
Run PowerShell Script from ADS
Changing Existing Service ImagePath Value Via Reg.EXE
Potential AMSI Bypass Using NULL Bits
UAC Bypass Using Event Viewer RecentViews
Renamed NirCmd.EXE Execution
Netsh Allow Group Policy on Microsoft Defender Firewall
HackTool - SharpEvtMute Execution
Suspicious Rundll32 Activity Invoking Sys File
AADInternals PowerShell Cmdlets Execution - ProccessCreation
HackTool - HandleKatz LSASS Dumper Execution
Suspicious Process Execution From Fake Recycle.Bin Folder
ConvertTo-SecureString Cmdlet Usage Via CommandLine
Veeam Backup Database Suspicious Query
Unusual Child Process of dns.exe
SafeBoot Registry Key Deleted Via Reg.EXE
PowerShell Script Change Permission Via Set-Acl
PUA - NirCmd Execution As LOCAL SYSTEM
Execution via WorkFolders.exe
Binary Proxy Execution Via Dotnet-Trace.EXE
Arbitrary File Download Via GfxDownloadWrapper.EXE
Recon Information for Export with Command Prompt
Mstsc.EXE Execution From Uncommon Parent
Malicious Windows Script Components File Execution by TAEF Detection
Windows Recall Feature Enabled Via Reg.EXE
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
Remote Access Tool - AnyDesk Silent Installation
Potential Rundll32 Execution With DLL Stored In ADS
Kernel Memory Dump Via LiveKD
Invoke-Obfuscation Via Use MSHTA
Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE
Uncommon Child Process Of Defaultpack.EXE
Potentially Suspicious DLL Registered Via Odbcconf.EXE
Uncommon FileSystem Load Attempt By Format.com
DllUnregisterServer Function Call Via Msiexec.EXE
File And SubFolder Enumeration Via Dir Command
Remote Access Tool - NetSupport Execution
XSL Script Execution Via WMIC.EXE
Execute MSDT Via Answer File
Suspicious Schtasks Schedule Type With High Privileges
Process Reconnaissance Via Wmic.EXE
Dumping of Sensitive Hives Via Reg.EXE
Suspicious HH.EXE Execution
PowerShell SAM Copy
Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
Process Memory Dump Via Comsvcs.DLL
Monitoring For Persistence Via BITS
Potential UAC Bypass Via Sdclt.EXE
Potential Defense Evasion Via Binary Rename
Suspicious Scan Loop Network
Potentially Suspicious Regsvr32 HTTP/FTP Pattern
File Recovery From Backup Via Wbadmin.EXE
New Root Certificate Installed Via CertMgr.EXE
Suspicious Execution From Outlook Temporary Folder
File Download via CertOC.EXE
User Added to Remote Desktop Users Group
Use of TTDInject.exe
Whoami Utility Execution
Obfuscated IP Via CLI
Potential File Overwrite Via Sysinternals SDelete
PowerShell Script Run in AppData
Potential Privilege Escalation To LOCAL SYSTEM
Arbitrary File Download Via MSOHTMED.EXE
LOLBAS Data Exfiltration by DataSvcUtil.exe
Sysprep on AppData Folder
Suspicious Processes Spawned by Java.EXE
DNS Exfiltration and Tunneling Tools Execution
Ie4uinit Lolbin Use From Invalid Path
PUA - Rclone Execution
Potential SquiblyTwo Technique Execution
ETW Trace Evasion Activity
DirLister Execution
Local Groups Reconnaissance Via Wmic.EXE
Renamed Office Binary Execution
MMC Spawning Windows Shell
PUA - PingCastle Execution
Suspicious Outlook Child Process
Hacktool Execution - PE Metadata
Suspicious CodePage Switch Via CHCP
Bypass UAC via Fodhelper.exe
Suspicious Scheduled Task Name As GUID
HackTool - Pypykatz Credentials Dumping Activity
Potential PowerShell Command Line Obfuscation
Regsvr32 Execution From Highly Suspicious Location
PUA - Nmap/Zenmap Execution
Potential Manage-bde.wsf Abuse To Proxy Execution
Suspicious Debugger Registration Cmdline
ShimCache Flush
Disabled Volume Snapshots
Suspicious Registry Modification From ADS Via Regini.EXE
Command Line Execution with Suspicious URL and AppData Strings
Unsigned AppX Installation Attempt Using Add-AppxPackage
Curl Download And Execute Combination
Potential ShellDispatch.DLL Functionality Abuse
Suspicious File Downloaded From Direct IP Via Certutil.EXE
Cscript/Wscript Uncommon Script Extension Execution
Potential Defense Evasion Via Rename Of Highly Relevant Binaries
Application Removed Via Wmic.EXE
Write Protect For Storage Disabled
Execution of Powershell Script in Public Folder
Potential Suspicious Windows Feature Enabled - ProcCreation
File With Suspicious Extension Downloaded Via Bitsadmin
Renamed CURL.EXE Execution
Use NTFS Short Name in Image
Base64 Encoded PowerShell Command Detected
Potential Application Whitelisting Bypass via Dnx.EXE
HackTool - Mimikatz Execution
Process Memory Dump Via Dotnet-Dump
Potential Download/Upload Activity Using Type Command
HackTool - KrbRelayUp Execution
Stop Windows Service Via Sc.EXE
Remote XSL Execution Via Msxsl.EXE
Potential ReflectDebugger Content Execution Via WerFault.EXE
Potential Mpclient.DLL Sideloading Via Defender Binaries
Potentially Suspicious Electron Application CommandLine
Detect Virtualbox Driver Installation OR Starting Of VMs
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS
HackTool - CoercedPotato Execution
Dropping Of Password Filter DLL
Potentially Over Permissive Permissions Granted Using Dsacls.EXE
C# IL Code Compilation Via Ilasm.EXE
Group Membership Reconnaissance Via Whoami.EXE
Deleted Data Overwritten Via Cipher.EXE
Suspicious Curl.EXE Download
Detection of PowerShell Execution via Sqlps.exe
Findstr Launching .lnk File
Renamed BOINC Client Execution
Suspicious Schtasks Execution AppData Folder
Potential Recon Activity Using DriverQuery.EXE
Copy From VolumeShadowCopy Via Cmd.EXE
Suspicious File Characteristics Due to Missing Fields
File Deletion Via Del
Chromium Browser Headless Execution To Mockbin Like Site
Renamed FTP.EXE Execution
Portable Gpg.EXE Execution
Use of VSIISExeLauncher.exe
Enumeration for 3rd Party Creds From CLI
Insecure Proxy/DOH Transfer Via Curl.EXE
Base64 MZ Header In CommandLine
Imports Registry Key From an ADS
PsExec Service Execution
Exports Critical Registry Keys To a File
Execution via stordiag.exe
Potential Crypto Mining Activity
Process Launched Without Image Name
HackTool - F-Secure C3 Load by Rundll32
Use Short Name Path in Image
Remote Access Tool - NetSupport Execution From Unusual Location
Suspicious DumpMinitool Execution
HackTool - SILENTTRINITY Stager Execution
Detected Windows Software Discovery
Suspicious CustomShellHost Execution
Remotely Hosted HTA File Executed Via Mshta.EXE
CreateDump Process Dump
Uncommon Child Process Of Setres.EXE
HackTool - PowerTool Execution
Potential Recon Activity Via Nltest.EXE
Potential DLL Injection Or Execution Using Tracker.exe
Suspicious Active Directory Database Snapshot Via ADExplorer
System File Execution Location Anomaly
Imports Registry Key From a File
Suspicious Scheduled Task Creation Involving Temp Folder
Suspicious TSCON Start as SYSTEM
Fsutil Suspicious Invocation
Security Service Disabled Via Reg.EXE
Esentutl Gather Credentials
Suspicious Spool Service Child Process
SyncAppvPublishingServer Execute Arbitrary PowerShell Code
Potential PowerShell Execution Policy Tampering - ProcCreation
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE
PUA - Process Hacker Execution
Fsutil Behavior Set SymlinkEvaluation
Suspicious Cabinet File Execution Via Msdt.EXE
PUA - Fast Reverse Proxy (FRP) Execution
Cscript/Wscript Potentially Suspicious Child Process
Potential Persistence Via Microsoft Compatibility Appraiser
Tamper Windows Defender Remove-MpPreference
Potential PowerShell Execution Via DLL
Directory Removal Via Rmdir
HackTool - PurpleSharp Execution
Security Tools Keyword Lookup Via Findstr.EXE
Deletion of Volume Shadow Copies via WMI with PowerShell
Code Execution via Pcwutl.dll
Outlook EnableUnsafeClientMailRules Setting Enabled
Potential Meterpreter/CobaltStrike Activity
VolumeShadowCopy Symlink Creation Via Mklink
Suspicious Serv-U Process Pattern
Obfuscated IP Download Activity
Potential Arbitrary File Download Using Office Application
Pubprn.vbs Proxy Execution
Scheduled Task Executing Payload from Registry
System Disk And Volume Reconnaissance Via Wmic.EXE
Modify Group Policy Settings
Renamed PAExec Execution
Potential Register_App.Vbs LOLScript Abuse
Usage Of Web Request Commands And Cmdlets
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
Remote Access Tool - ScreenConnect Server Web Shell Execution
Potential Powershell ReverseShell Connection
Forfiles Command Execution
HackTool - Impacket Tools Execution
HackTool - RemoteKrbRelay Execution
Enable LM Hash Storage - ProcCreation
Suspicious Office Token Search Via CLI
UAC Bypass Using IDiagnostic Profile
Invoke-Obfuscation COMPRESS OBFUSCATION
PUA - Potential PE Metadata Tamper Using Rcedit
Assembly Loading Via CL_LoadAssembly.ps1
PUA - AdFind Suspicious Execution
PUA - Mouse Lock Execution
Import LDAP Data Interchange Format File Via Ldifde.EXE
Stop Windows Service Via Net.EXE
Potential Homoglyph Attack Using Lookalike Characters
Windows Backup Deleted Via Wbadmin.EXE
Potential PowerShell Obfuscation Via WCHAR
Boot Configuration Tampering Via Bcdedit.EXE
PUA - Chisel Tunneling Tool Execution
Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
Remote File Download Via Findstr.EXE
Suspicious Rundll32 Setupapi.dll Activity
Potential Regsvr32 Commandline Flag Anomaly
Remote CHM File Download/Execution Via HH.EXE
WSL Child Process Anomaly
Potential Persistence Attempt Via Existing Service Tampering
Rundll32 Registered COM Objects
Renamed ProcDump Execution
HH.EXE Execution
Sysmon Configuration Update
Audit Policy Tampering Via NT Resource Kit Auditpol
New Service Creation Using Sc.EXE
Phishing Pattern ISO in Archive
HackTool - PCHunter Execution
Windows Admin Share Mount Via Net.EXE
Renamed AutoHotkey.EXE Execution
Uninstall Sysinternals Sysmon
Windows Processes Suspicious Parent Directory
Potential Binary Proxy Execution Via VSDiagnostics.EXE
New Process Created Via Wmic.EXE
Potential Persistence Via Netsh Helper DLL
Suspicious Calculator Usage
UAC Bypass Using MSConfig Token Modification - Process
Suspicious Runscripthelper.exe
PktMon.EXE Execution
Shell Process Spawned by Java.EXE
HackTool - Htran/NATBypass Execution
Arbitrary Shell Command Execution Via Settingcontent-Ms
UAC Bypass Using DismHost
Capture Credentials with Rpcping.exe
Suspicious New Service Creation
PowerShell Base64 Encoded IEX Cmdlet
Suspicious PowerShell Parent Process
Privilege Escalation via Named Pipe Impersonation
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
Use of W32tm as Timer
Windows Share Mount Via Net.EXE
Potentially Suspicious Rundll32.EXE Execution of UDL File
Tap Installer Execution
Permission Check Via Accesschk.EXE
Suspicious File Download From File Sharing Domain Via Wget.EXE
Suspicious Msiexec Quiet Install From Remote Location
Exports Registry Key To a File
Local Accounts Discovery
Suspicious PowerShell Invocations - Specific - ProcessCreation
7Zip Compressing Dump Files
Potential DLL File Download Via PowerShell Invoke-WebRequest
Renamed Gpg.EXE Execution
Suspicious VBoxDrvInst.exe Parameters
Compressed File Creation Via Tar.EXE
Remote File Download Via Desktopimgdownldr Utility
Uncommon One Time Only Scheduled Task At 00:00
Uncommon Child Process Of Conhost.EXE
Potential Shim Database Persistence via Sdbinst.EXE
Suspicious LOLBIN AccCheckConsole
Audio Capture via PowerShell
HackTool - SharpView Execution
Automated Collection Command Prompt
Microsoft IIS Connection Strings Decryption
Whoami.EXE Execution From Privileged Process
WebDav Client Execution Via Rundll32.EXE
Potential CommandLine Path Traversal Via Cmd.EXE
Visual Studio Code Tunnel Shell Execution
Suspicious Schtasks From Env Var Folder
Suspicious ScreenSave Change by Reg.exe
Suspicious Plink Port Forwarding
Suspicious Execution of Hostname
Suspicious Group And Account Reconnaissance Activity Using Net.EXE
Suspicious Process Start Locations
Msiexec Quiet Installation
Potential Provisioning Registry Key Abuse For Binary Proxy Execution
Browser Execution In Headless Mode
CodePage Modification Via MODE.COM To Russian Language
Dumping Process via Sqldumper.exe
PUA - AdvancedRun Suspicious Execution
Direct Autorun Keys Modification
Loaded Module Enumeration Via Tasklist.EXE
File Download Using Notepad++ GUP Utility
HackTool - Covenant PowerShell Launcher
Lolbin Runexehelper Use As Proxy
Disabled IE Security Features
Suspicious Extrac32 Execution
Import PowerShell Modules From Suspicious Directories - ProcCreation
HackTool - SharpImpersonation Execution
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE
PUA - NSudo Execution
Email Exifiltration Via Powershell
Diskshadow Script Mode - Execution From Potential Suspicious Location
Dynamic .NET Compilation Via Csc.EXE
Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
Remote Access Tool - Simple Help Execution
PsExec/PAExec Escalation to LOCAL SYSTEM
DSInternals Suspicious PowerShell Cmdlets
Suspicious Windows Trace ETW Session Tamper Via Logman.EXE
RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses
Webshell Hacking Activity Patterns
Potential Privilege Escalation via Service Permissions Weakness
Potential Arbitrary File Download Via Cmdl32.EXE
OpenWith.exe Executes Specified Binary
Cmd.EXE Missing Space Characters Execution Anomaly
Run PowerShell Script from Redirected Input Stream
Execute From Alternate Data Streams
Suspicious Execution of Shutdown to Log Out
Unusual Parent Process For Cmd.EXE
Operator Bloopers Cobalt Strike Commands
Potential NTLM Coercion Via Certutil.EXE
Private Keys Reconnaissance Via CommandLine Tools
Arbitrary File Download Via MSPUB.EXE
Compress Data and Lock With Password for Exfiltration With 7-ZIP
Potential Arbitrary DLL Load Using Winword
Regsvr32 DLL Execution With Suspicious File Extension
Suspicious XOR Encoded PowerShell Command
Suspicious Encoded Scripts in a WMI Consumer
WMI Event Subscription
Suspicious Scripting in a WMI Consumer
Potential Process Hollowing Activity
Suspicious Non-Browser Network Communication With Telegram API
Network Connection Initiated By Regsvr32.EXE
Network Connection Initiated To Visual Studio Code Tunnels Domain
Network Connection Initiated To DevTunnels Domain
Network Connection Initiated To Mega.nz
RDP Over Reverse SSH Tunnel
Rundll32 Internet Connection
Potentially Suspicious Network Connection To Notion API
Suspicious Outbound SMTP Connections
Microsoft Sync Center Suspicious Network Connections
Suspicious Non-Browser Network Communication With Google API
Communication To Uncommon Destination Ports
Network Connection Initiated By IMEWDBLD.EXE
Outbound Network Connection Initiated By Script Interpreter
Network Communication Initiated To Portmap.IO Domain
Outbound Network Connection Initiated By Cmstp.EXE
Office Application Initiated Network Connection To Non-Local IP
Python Initiated Connection
Network Connection Initiated To Cloudflared Tunnels Domains
Silenttrinity Stager Msbuild Activity
RDP to HTTP or HTTPS Target Ports
Local Network Connection Initiated By Script Interpreter
Office Application Initiated Network Connection Over Uncommon Ports
Network Connection Initiated By AddinUtil.EXE
Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
Potentially Suspicious Wuauclt Network Connection
Network Connection Initiated Via Notepad.EXE
RegAsm.EXE Initiating Network Connection To Public IP
Outbound Network Connection Initiated By Microsoft Dialer
Suspicious Network Connection Binary No CommandLine
Process Initiated Network Connection To Ngrok Domain
Network Communication With Crypto Mining Pool
Outbound RDP Connections Over Non-Standard Tools
Uncommon Outbound Kerberos Connection
Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
Suspicious Dropbox API Usage
Communication To Ngrok Tunneling Service Initiated
Communication To LocaltoNet Tunneling Service Initiated
Potential Remote PowerShell Session Initiated
Potentially Suspicious Malware Callback Communication
Network Connection Initiated By Eqnedt32.EXE
Suspicious Network Connection to IP Lookup Service APIs
Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
Outbound Network Connection To Public IP Via Winlogon
Uncommon Network Connection Initiated By Certutil.EXE
Potential Dead Drop Resolvers
Suspicious Wordpad Outbound Connections
Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
Mimikatz Use
Ngrok Usage with Remote Desktop Service
BITS Transfer Job Downloading File Potential Suspicious Extension
New BITS Job Created Via PowerShell
BITS Transfer Job With Uncommon Or Suspicious Remote TLD
BITS Transfer Job Download From File Sharing Domains
BITS Transfer Job Download To Potential Suspicious Folder
New BITS Job Created Via Bitsadmin
BITS Transfer Job Download From Direct IP
File Was Not Allowed To Run
WMI Persistence
Windows Defender Firewall Has Been Reset To Its Default Configuration
The Windows Defender Firewall Service Failed To Load Group Policy
All Rules Have Been Deleted From The Windows Firewall Configuration
Uncommon New Firewall Rule Added In Windows Firewall Exception List
New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE
Windows Firewall Settings Have Been Changed
New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application
A Rule Has Been Deleted From The Windows Firewall Exception List
Loading Diagcab Package From Remote Path
WMI Persistence - Security
RDP over Reverse SSH Tunnel WFP
Processes Accessing the Microphone and Webcam
User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'
Invoke-Obfuscation Via Stdin - Security
SCM Database Privileged Operation
Metasploit SMB Authentication
DCERPC SMB Spoolss Named Pipe
HackTool - EDRSilencer Execution - Filter Added
Remote PowerShell Sessions Network Connections (WinRM)
Addition of SID History to Active Directory Object
Password Protected ZIP File Opened
Windows Defender Exclusion Reigstry Key - Write Access Requested
AD Object WriteDAC Access
SMB Create Remote File Admin Share
Suspicious Kerberos RC4 Ticket Encryption
Impacket PsExec Execution
First Time Seen Remote Named Pipe
Suspicious Scheduled Task Creation
ADCS Certificate Template Configuration Vulnerability with Risky EKU
Service Installed By Unusual Client - Security
Account Tampering - Suspicious Failed Logon Reasons
Meterpreter or Cobalt Strike Getsystem Service Installation - Security
DPAPI Domain Backup Key Extraction
Invoke-Obfuscation RUNDLL LAUNCHER - Security
Tap Driver Installation - Security
ADCS Certificate Template Configuration Vulnerability
Locked Workstation
Potential AD User Enumeration From Non-Machine Account
Invoke-Obfuscation STDIN+ Launcher - Security
New or Renamed User Account with '$' Character
Suspicious Remote Logon with Explicit Credentials
Replay Attack Detected
Windows Event Auditing Disabled
User Logoff Event
Remote Service Activity via SVCCTL Named Pipe
Windows Pcap Drivers
Kerberos Manipulation
PetitPotam Suspicious Kerberos TGT Request
Suspicious Access to Sensitive File Extensions
LSASS Access From Non System Account
ETW Logging Disabled In .NET Processes - Registry
Reconnaissance Activity
Persistence and Execution at Scale via GPO Scheduled Task
Remote Access Tool Services Have Been Installed - Security
Active Directory User Backdoors
PowerShell Scripts Installed as Services - Security
Uncommon Outbound Kerberos Connection - Security
Invoke-Obfuscation Via Use MSHTA - Security
CobaltStrike Service Installations - Security
Possible DC Shadow Attack
ISO Image Mounted
Hidden Local User Creation
Local User Creation
T1047 Wmiprvse Wbemcomn DLL Hijack
Protected Storage Service Access
Secure Deletion with SDelete
Possible Shadow Credentials Added
Azure AD Health Monitoring Agent Registry Keys Access
Weak Encryption Enabled and Kerberoast
Suspicious Teams Application Related ObjectAcess Event
Unauthorized System Time Modification
Windows Network Access Suspicious desktop.ini Action
HackTool - NoFilter Execution
HybridConnectionManager Service Installation
Password Change on Directory Service Restore Mode (DSRM) Account
Possible Impacket SecretDump Remote Activity
Security Eventlog Cleared
Sysmon Channel Reference Deletion
Suspicious PsExec Execution
External Disk Drive Or USB Storage Device Was Recognized By The System
Active Directory Replication from Non Machine Account
Add or Remove Computer from DC
Service Registry Key Read Access Request
DPAPI Domain Master Key Backup Attempt
DCOM InternetExplorer.Application Iertutil DLL Hijack - Security
Password Protected ZIP File Opened (Suspicious Filenames)
Remote Task Creation via ATSVC Named Pipe
Invoke-Obfuscation CLIP+ Launcher - Security
Register new Logon Process by Rubeus
Invoke-Obfuscation COMPRESS OBFUSCATION - Security
Suspicious Windows ANONYMOUS LOGON Local Account Created
Suspicious LDAP-Attributes Used
Azure AD Health Service Agents Registry Keys Access
Transferring Files with Credential Data via Network Shares
Windows Defender Exclusion Deleted
A New Trust Was Created To A Domain
Credential Dumping Tools Service Execution - Security
VSSAudit Security Event Source Registration
Metasploit Or Impacket Service Installation Via SMB PsExec
Enabled User Right in AD to Control User Objects
Mimikatz DC Sync
WCE wceaux.dll Access
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security
Denied Access To Remote Desktop
Password Dumper Activity on LSASS
SAM Registry Hive Handle Request
Access To ADMIN$ Network Share
Invoke-Obfuscation VAR+ Launcher - Security
SysKey Registry Keys Access
Invoke-Obfuscation Via Use Clip - Security
Powerview Add-DomainObjectAcl DCSync AD Extend Right
Device Installation Blocked
Important Scheduled Task Deleted/Disabled
Password Policy Enumerated
Failed Code Integrity Checks
Invoke-Obfuscation Via Use Rundll32 - Security
Win Susp Computer Name Containing Samtheadmin
Possible PetitPotam Coerce Authentication Attempt
Windows Defender Exclusion List Modified
Potential Privileged System Service Operation - SeLoadDriverPrivilege
Hacktool Ruler
NetNTLM Downgrade Attack
Password Protected ZIP File Opened (Email Attachment)
AD Privileged Users or Groups Reconnaissance
Potentially Suspicious AccessMask Requested From LSASS
User Added to Local Administrator Group
Invoke-Obfuscation Obfuscated IEX Invocation - Security
Suspicious Scheduled Task Update
Important Windows Event Auditing Disabled
SCM Database Handle Failure
Successful Account Login Via WMI
RottenPotato Like Attack Pattern
Remote WMI ActiveScriptEventConsumers
External Remote SMB Logon from Public IP
RDP Login from Localhost
Admin User Remote Logon
Scanner PoC for CVE-2019-0708 RDP RCE Vuln
Successful Overpass the Hash Attempt
Failed Logon From Public IP
Potential Access Token Abuse
DiagTrackEoP Default Login Username
Pass the Hash Activity 2
A Security-Enabled Global Group Was Deleted
External Remote RDP Logon from Public IP
Potential Privilege Escalation via Local Kerberos Relay over LDAP
Outgoing Logon with New Credentials
A Member Was Removed From a Security-Enabled Global Group
A Member Was Added to a Security-Enabled Global Group
Windows Filtering Platform Blocked Connection From EDR Agent Binary
CodeIntegrity - Revoked Kernel Driver Loaded
CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module
CodeIntegrity - Revoked Image Loaded
CodeIntegrity - Blocked Image Load With Revoked Certificate
CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked
CodeIntegrity - Unsigned Kernel Module Loaded
CodeIntegrity - Blocked Driver Load With Revoked Certificate
CodeIntegrity - Unsigned Image Loaded
CodeIntegrity - Unmet Signing Level Requirements By File Under Validation
CodeIntegrity - Blocked Image/Driver Load For Policy Violation
Potential Remote Desktop Connection to Non-Domain Host
NTLM Brute Force
NTLM Logon
Scheduled Task Executed Uncommon LOLBIN
Important Scheduled Task Deleted
Scheduled Task Executed From A Suspicious Location
Exchange Set OabVirtualDirectory ExternalUrl Property
MSExchange Transport Agent Installation - Builtin
Failed MSExchange Transport Agent Installation
Mailbox Export to Exchange Webserver
Remove Exported Mailbox from Exchange Webserver
ProxyLogon MSExchange OabVirtualDirectory
Certificate Request Export to Exchange Webserver
HybridConnectionManager Service Running
Unsigned Binary Loaded From Suspicious Location
Microsoft Defender Blocked from Loading Unsigned DLL
Certificate Exported From Local Certificate Store
Suspicious Rejected SMB Guest Logon From IP
Windows Defender Threat Detected
Microsoft Defender Tamper Protection Trigger
Windows Defender Real-time Protection Disabled
PSExec and WMI Process Creations Block
Windows Defender Exploit Guard Tamper
LSASS Access Detected via Attack Surface Reduction
Windows Defender Virus Scanning Feature Disabled
Windows Defender Malware Detection History Deletion
Windows Defender Exclusions Added
Windows Defender Malware And PUA Scanning Disabled
Win Defender Restored Quarantine File
Windows Defender AMSI Trigger Detected
Windows Defender Grace Period Expired
Windows Defender Real-Time Protection Failure/Restart
Windows Defender Configuration Changes
Windows Defender Submit Sample Feature Disabled
Restricted Software Access By SRP
Relevant Anti-Virus Signature Keywords In Application Log
Microsoft Malware Protection Engine Crash
Potential Credential Dumping Via WER - Application
Microsoft Malware Protection Engine Crash - WER
Ntdsutil Abuse
Dump Ntds.dit To Suspicious Location
Audit CVE Event
MSSQL XPCmdshell Option Change
MSSQL SPProcoption Set
MSSQL Add Account To Sysadmin Role
MSSQL Disable Audit Settings
MSSQL XPCmdshell Suspicious Execution
MSSQL Server Failed Logon From External Network
MSSQL Server Failed Logon
Atera Agent Installation
MSI Installation From Web
Application Uninstalled
MSI Installation From Suspicious Locations
Backup Catalog Deleted
Remote Access Tool - ScreenConnect Command Execution
Remote Access Tool - ScreenConnect File Transfer
Potential Active Directory Reconnaissance/Enumeration Via LDAP
USB Device Plugged
Potential CVE-2021-42287 Exploitation Attempt
Active Directory Certificate Services Denied Certificate Enrollment Request
Critical Hive In Suspicious Location Access Bits Cleared
NTLMv1 Logon Between Client and Server
Windows Update Error
Suspicious Usage of CVE_2021_34484 or CVE 2022_21919
Zerologon Exploitation Using Well-known Tools
Vulnerable Netlogon Secure Channel Connection Allowed
Credential Dumping Tools Service Execution - System
PowerShell Scripts Installed as Services
PAExec Service Installation
Suspicious Service Installation
smbexec.py Service Installation
Invoke-Obfuscation Via Use Rundll32 - System
Important Windows Service Terminated With Error
Windows Service Terminated With Error
New PDQDeploy Service - Client Side
Tap Driver Installation
Remote Utilities Host Service Install
Invoke-Obfuscation VAR+ Launcher - System
HackTool Service Registration or Execution
Invoke-Obfuscation Obfuscated IEX Invocation - System
Windows Defender Threat Detection Service Disabled
Invoke-Obfuscation Via Stdin - System
Important Windows Service Terminated Unexpectedly
KrbRelayUp Service Installation
Invoke-Obfuscation RUNDLL LAUNCHER - System
CobaltStrike Service Installations - System
Invoke-Obfuscation COMPRESS OBFUSCATION - System
Remote Access Tool Services Have Been Installed - System
RTCore Suspicious Service Installation
NetSupport Manager Service Install
ProcessHacker Privilege Elevation
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System
Service Installation in Suspicious Folder
Service Installed By Unusual Client - System
Moriya Rootkit - System
Invoke-Obfuscation Via Use MSHTA - System
Mesh Agent Service Installation
Suspicious Service Installation Script
Service Installation with Suspicious Folder Pattern
RemCom Service Installation
Uncommon Service Installation Image Path
Meterpreter or Cobalt Strike Getsystem Service Installation - System
Invoke-Obfuscation CLIP+ Launcher - System
CSExec Service Installation
Anydesk Remote Access Software Service Installation
TacticalRMM Service Installation
New PDQDeploy Service - Server Side
Sliver C2 Default Service Installation
Invoke-Obfuscation STDIN+ Launcher - System
PsExec Service Installation
Invoke-Obfuscation Via Use Clip - System
NTFS Vulnerability Exploitation
Sysmon Application Crashed
Potential RDP Exploit CVE-2019-0708
DHCP Server Loaded the CallOut DLL
DHCP Server Error Failed Loading the CallOut DLL
Volume Shadow Copy Mount
KDC RC4-HMAC Downgrade CVE-2022-37966
Certificate Use With No Strong Mapping
No Suitable Encryption Key Found For Generating Kerberos Ticket
Local Privilege Escalation Indicator TabTip
Eventlog Cleared
Important Windows Eventlog Cleared
DNS Server Error Failed Loading the ServerLevelPluginDLL
Failed DNS Zone Transfer
Suspicious Digital Signature Of AppX Package
Sysinternals Tools AppX Versions Execution
OpenSSH Server Listening On Socket
Standard User In High Privileged Group
Certificate Private Key Acquired
Suspicious Cobalt Strike DNS Beaconing - DNS Client
Query Tor Onion Address - DNS Client
DNS Query To MEGA Hosting Website - DNS Client
DNS Query for Anonfiles.com Domain - DNS Client
DNS Query To Ufile.io - DNS Client
Suspicious Application Installed
Deployment AppX Package Was Blocked By AppLocker
Potential Malicious AppX Package Installation Attempts
Deployment Of The AppX Package Was Blocked By The Policy
Uncommon AppX Package Locations
Suspicious AppX Package Installation Attempt
Suspicious AppX Package Locations
Suspicious Remote AppX Package Locations
Potential Azure Browser SSO Abuse
Potential CCleanerDU.DLL Sideloading
Active Directory Parsing DLL Loaded Via Office Application
HackTool - SILENTTRINITY Stager DLL Load
Potential Iviewers.DLL Sideloading
Potential appverifUI.DLL Sideloading
DLL Sideloading Of ShellChromeAPI.DLL
Potential System DLL Sideloading From Non System Locations
Suspicious Volume Shadow Copy VSS_PS.dll Load
Potential EACore.DLL Sideloading
Potential Edputil.DLL Sideloading
Potential DLL Sideloading Via VMware Xfer
PowerShell Core DLL Loaded Via Office Application
Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
Time Travel Debugging Utility Usage - Image
Microsoft Office DLL Sideload
Potential 7za.DLL Sideloading
WMIC Loading Scripting Libraries
Potential Vivaldi_elf.DLL Sideloading
Active Directory Kerberos DLL Loaded Via Office Application
Potential DLL Sideloading Of Non-Existent DLLs From System Folders
Load Of RstrtMgr.DLL By An Uncommon Process
GAC DLL Loaded Via Office Applications
DLL Load By System Process From Suspicious Locations
DotNet CLR DLL Loaded By Scripting Applications
Potential SmadHook.DLL Sideloading
Potential DLL Sideloading Of MpSvc.DLL
Potential DLL Sideloading Of MsCorSvc.DLL
Abusable DLL Potential Sideloading From Suspicious Location
Suspicious Volume Shadow Copy Vssapi.dll Load
Potential DLL Sideloading Of DBGHELP.DLL
Potential Waveedit.DLL Sideloading
Potential DLL Sideloading Via JsSchHlp
Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
Suspicious WSMAN Provider Image Loads
Potential Mfdetours.DLL Sideloading
Suspicious Renamed Comsvcs DLL Loaded By Rundll32
Potential WWlib.DLL Sideloading
VMMap Signed Dbghelp.DLL Potential Sideloading
WMI Persistence - Command Line Event Consumer
Potential RjvPlatform.DLL Sideloading From Non-Default Location
Third Party Software DLL Sideloading
Potential DLL Sideloading Using Coregen.exe
Potential SolidPDFCreator.DLL Sideloading
Suspicious Volume Shadow Copy Vsstrace.dll Load
VMGuestLib DLL Sideload
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
System Control Panel Item Loaded From Uncommon Location
DotNET Assembly DLL Loaded Via Office Application
Fax Service DLL Search Order Hijack
UAC Bypass Using Iscsicpl - ImageLoad
PowerShell Core DLL Loaded By Non PowerShell Process
Windows Spooler Service Suspicious Binary Load
Potential Goopdate.DLL Sideloading
Unsigned DLL Loaded by Windows Utility
UAC Bypass With Fake DLL
Potential Chrome Frame Helper DLL Sideloading
Potential RoboForm.DLL Sideloading
Potential RjvPlatform.DLL Sideloading From Default Location
CredUI.DLL Loaded By Uncommon Process
Unsigned Module Loaded by ClickOnce Application
VBA DLL Loaded Via Office Application
Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded
Unsigned Mfdetours.DLL Sideloading
PCRE.NET Package Image Load
Suspicious Unsigned Thor Scanner Execution
Potential Libvlc.DLL Sideloading
Aruba Network Service Potential DLL Sideloading
Potential ShellDispatch.DLL Sideloading
CLR DLL Loaded Via Office Applications
Amsi.DLL Loaded Via LOLBIN Process
Potential DLL Sideloading Via comctl32.dll
Python Image Load By Non-Python Process
Load Of RstrtMgr.DLL By A Suspicious Process
Potential Wazuh Security Platform DLL Sideloading
VMMap Unsigned Dbghelp.DLL Potential Sideloading
Microsoft Excel Add-In Loaded From Uncommon Location
Potential Rcdll.DLL Sideloading
Potential DLL Sideloading Of DBGCORE.DLL
Potential Mpclient.DLL Sideloading
Wmiprvse Wbemcomn DLL Hijack
Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE
HackTool - SharpEvtMute DLL Load
Potential CCleanerReactivator.DLL Sideloading
Potential AVKkid.DLL Sideloading
Potential DLL Sideloading Via ClassicExplorer32.dll
DLL Loaded From Suspicious Location Via Cmspt.EXE
Unsigned Image Loaded Into LSASS Process
Potential DLL Sideloading Of DbgModel.DLL
Microsoft VBA For Outlook Addin Loaded Via Outlook
Potential DCOM InternetExplorer.Application DLL Hijack - Image Load
Remote DLL Load Via Rundll32.EXE
Potential Antivirus Software DLL Sideloading
Netcat The Powershell Version
Suspicious PowerShell Download
Suspicious XOR Encoded PowerShell Command Line - PowerShell
PowerShell Called from an Executable Version Mismatch
Suspicious Non PowerShell WSMAN COM Provider
PowerShell Downgrade Attack - PowerShell
Remote PowerShell Session (PS Classic)
Use Get-NetTCPConnection
Nslookup PowerShell Download Cradle
Renamed Powershell Under Powershell Channel
Zip A Folder With PowerShell For Staging In Temp - PowerShell
Delete Volume Shadow Copies Via WMI With PowerShell
Tamper Windows Defender - PSClassic
Potential RemoteFXvGPUDisablement.EXE Abuse
Enumerate Credentials from Windows Credential Manager With PowerShell
Suspicious IO.FileStream
Suspicious TCP Tunnel Via PowerShell Script
AMSI Bypass Pattern Assembly GetType
Potential Persistence Via PowerShell User Profile Using Add-Content
PowerShell Remote Session Creation
Clear PowerShell History - PowerShell
Powershell Execute Batch Script
Change PowerShell Policies to an Insecure Level - PowerShell
Windows Firewall Profile Disabled
Modify Group Policy Settings - ScriptBlockLogging
Suspicious SSL Connection
Powershell Sensitive File Discovery
Get-ADUser Enumeration Using UserAccountControl Flags
Potential Active Directory Enumeration Using AD Module - PsScript
Invoke-Obfuscation STDIN+ Launcher - Powershell
Security Software Discovery Via Powershell Script
Powershell Keylogging
Powershell Install a DLL in System Directory
Suspicious Connection to Remote Account
Certificate Exported Via PowerShell - ScriptBlock
Suspicious PowerShell Mailbox SMTP Forward Rule
Manipulation of User Computer or Group Security Principals Across AD
Potential AMSI Bypass Script Using NULL Bits
Suspicious PowerShell Download - Powershell Script
PowerShell Write-EventLog Usage
PowerShell Script Change Permission Via Set-Acl - PsScript
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
Malicious PowerShell Commandlets - ScriptBlock
Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy
Suspicious PowerShell WindowStyle Option
Invoke-Obfuscation Via Use MSHTA - PowerShell
Change User Agents with WebRequest
Zip A Folder With PowerShell For Staging In Temp - PowerShell Script
Windows Screen Capture with CopyFromScreen
PowerShell ADRecon Execution
Potential COM Objects Download Cradles Usage - PS Script
Root Certificate Installed - PowerShell
Suspicious FromBase64String Usage On Gzip Archive - Ps Script
Active Directory Group Enumeration With Get-AdGroup
Request A Single Ticket via PowerShell
Malicious ShellIntel PowerShell Commandlets
Potential Data Exfiltration Via Audio File
Powershell LocalAccount Manipulation
Powershell Suspicious Win32_PnPEntity
Suspicious PowerShell Get Current User
HackTool - Rubeus Execution - ScriptBlock
Extracting Information with PowerShell
Dump Credentials from Windows Credential Manager With PowerShell
DirectorySearcher Powershell Exploitation
Suspicious Get-ADReplAccount
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell
Invoke-Obfuscation Via Use Clip - Powershell
Silence.EDA Detection
Suspicious New-PSDrive to Admin Share
Veeam Backup Servers Credential Dumping Script Execution
Powershell Directory Enumeration
Malicious Nishang PowerShell Commandlets
Import PowerShell Modules From Suspicious Directories
Powershell DNSExfiltration
Usage Of Web Request Commands And Cmdlets - ScriptBlock
Potential Invoke-Mimikatz PowerShell Script
PowerShell Credential Prompt
Suspicious Service DACL Modification Via Set-Service Cmdlet - PS
Potential PowerShell Obfuscation Using Character Join
Suspicious PowerShell Invocations - Generic
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell
User Discovery And Export Via Get-ADUser Cmdlet - PowerShell
Suspicious PowerShell Mailbox Export to Share - PS
Automated Collection Bookmarks Using Get-ChildItem PowerShell
Potential PowerShell Obfuscation Using Alias Cmdlets
Powershell WMI Persistence
Invoke-Obfuscation CLIP+ Launcher - PowerShell
Potential WinAPI Calls Via PowerShell Scripts
Malicious PowerShell Keywords
Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock
PowerShell Script With File Hostname Resolving Capabilities
WMIC Unquoted Services Path Lookup - PowerShell
Detected Windows Software Discovery - PowerShell
Powershell XML Execute Command
Registry-Free Process Scope COR_PROFILER
PowerShell Hotfix Enumeration
PowerShell Set-Acl On Windows Folder - PsScript
Delete Volume Shadow Copies via WMI with PowerShell - PS Script
Potential Suspicious PowerShell Keywords
PowerShell ICMP Exfiltration
Windows Defender Exclusions Added - PowerShell
Abuse of Service Permissions to Hide Services Via Set-Service - PS
Testing Usage of Uncommonly Used Port
PowerShell Create Local User
NTFS Alternate Data Stream
PowerView PowerShell Cmdlets - ScriptBlock
Suspicious PowerShell Invocations - Specific
Suspicious X509Enrollment - Ps Script
SyncAppvPublishingServer Execution to Bypass Powershell Restriction
Suspicious Unblock-File
Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging
Active Directory Computers Enumeration With Get-AdComputer
Powershell Timestomp
Create Volume Shadow Copy with Powershell
PSAsyncShell - Asynchronous TCP Reverse Shell
HackTool - WinPwn Execution - ScriptBlock
Add Windows Capability Via PowerShell Script
Clearing Windows Console History
Suspicious Mount-DiskImage
Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell
PowerShell Deleted Mounted Share
Potential Persistence Via Security Descriptors - ScriptBlock
Suspicious Get Information for SMB Share
Automated Collection Command PowerShell
Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script
Powershell Add Name Resolution Policy Table Rule
WMImplant Hack Tool
Service Registry Permissions Weakness Check
Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript
Troubleshooting Pack Cmdlet Execution
Suspicious Hyper-V Cmdlets
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
Enable Windows Remote Management
PowerShell Get-Process LSASS in ScriptBlock
Powershell Create Scheduled Task
Suspicious Eventlog Clear
Suspicious GetTypeFromCLSID ShellExecute
PowerShell Script With File Upload Capabilities
Potential Suspicious Windows Feature Enabled
PowerShell WMI Win32_Product Install MSI
Execute Invoke-command on Remote Host
Suspicious GPO Discovery With Get-GPO
Powershell Local Email Collection
Recon Information for Export with PowerShell
Disable-WindowsOptionalFeature Command PowerShell
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock
Powershell Detect Virtualization Environment
Invoke-Obfuscation Via Stdin - Powershell
AADInternals PowerShell Cmdlets Execution - PsScript
Powershell Token Obfuscation - Powershell
Suspicious Process Discovery With Get-Process
Disable Powershell Command History
Replace Desktop Wallpaper by Powershell
PowerShell ShellCode
PowerShell PSAttack
Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript
Powershell MsXml COM Object
Disable of ETW Trace - Powershell
Code Executed Via Office Add-in XLL File
Suspicious Get Local Groups Information - PowerShell
Powershell Store File In Alternate Data Stream
Suspicious Start-Process PassThru
Tamper Windows Defender - ScriptBlockLogging
Access to Browser Login Data
Potential Keylogger Activity
Suspicious Invoke-Item From Mount-DiskImage
AD Groups Or Users Enumeration Using PowerShell - ScriptBlock
Winlogon Helper DLL
Potential In-Memory Execution Using Reflection.Assembly
Invoke-Obfuscation VAR+ Launcher - PowerShell
Remove Account From Domain Admin Group
Powershell Exfiltration Over SMTP
Live Memory Dump Using Powershell
DSInternals Suspicious PowerShell Cmdlets - ScriptBlock
Invoke-Obfuscation Via Use Rundll32 - PowerShell
Invoke-Obfuscation Via Use MSHTA - PowerShell Module
AD Groups Or Users Enumeration Using PowerShell - PoshModule
Invoke-Obfuscation Via Use Clip - PowerShell Module
Alternate PowerShell Hosts - PowerShell Module
Potential Active Directory Enumeration Using AD Module - PsModule
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module
Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
Suspicious Get Information for SMB Share - PowerShell Module
Suspicious Computer Machine Password by PowerShell
HackTool - Evil-WinRm Execution - PowerShell Module
Use Get-NetTCPConnection - PowerShell Module
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module
PowerShell Decompress Commands
Suspicious Get Local Groups Information
Malicious PowerShell Scripts - PoshModule
Suspicious Get-ADDBAccount Usage
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module
Malicious PowerShell Commandlets - PoshModule
Suspicious PowerShell Download - PoshModule
Suspicious PowerShell Invocations - Specific - PowerShell Module
Invoke-Obfuscation VAR+ Launcher - PowerShell Module
Remote PowerShell Session (PS Module)
Invoke-Obfuscation Via Stdin - PowerShell Module
SyncAppvPublishingServer Bypass Powershell Restriction - PS Module
Suspicious PowerShell Invocations - Generic - PowerShell Module
Bad Opsec Powershell Code Artifacts
Zip A Folder With PowerShell For Staging In Temp - PowerShell Module
Clear PowerShell History - PowerShell Module
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
Invoke-Obfuscation STDIN+ Launcher - PowerShell Module
PowerShell Get Clipboard
Potentially Suspicious File Download From ZIP TLD
Unusual File Download From File Sharing Websites
HackTool Named File Stream Created
Potential Suspicious Winget Package Installation
Creation Of a Suspicious ADS File Outside a Browser Download
Hidden Executable In NTFS Alternate Data Stream
Exports Registry Key To an Alternate Data Stream
Suspicious File Download From File Sharing Websites
Unusual File Download from Direct IP Address
HackTool - SysmonEnte Execution
CMSTP Execution Process Access
Credential Dumping Activity By Python Based Tool
Potential Credential Dumping Activity Via LSASS
Potential Direct Syscall of NtOpenProcess
Function Call From Undocumented COM Interface EditionUpgradeManager
Uncommon Process Access Rights For Target Image
Credential Dumping Attempt Via WerFault
HackTool - Generic Process Access
Suspicious LSASS Access Via MalSecLogon
LSASS Memory Access by Tool With Dump Keyword In Name
HackTool - HandleKatz Duplicating LSASS Handle
Suspicious Svchost Process Access
HackTool - LittleCorporal Generated Maldoc Injection
UAC Bypass Using WOW64 Logger DLL Hijack
Remote LSASS Process Access Through Windows Remote Management
Lsass Memory Dump via Comsvcs DLL
Credential Dumping Attempt Via Svchost
LSASS Access From Potentially White-Listed Processes
Potentially Suspicious GrantedAccess Flags On LSASS
HackTool - CobaltStrike BOF Injection Pattern
First Time Seen Remote Named Pipe - Zeek
Kerberos Network Traffic RC4 Ticket Encryption
Publicly Accessible RDP Service
Default Cobalt Strike Certificate
WebDav Put Request
Transferring Files with Credential Data via Network Shares - Zeek
Executable from Webdav
Suspicious PsExec Execution - Zeek
Potential PetitPotam Attack Via EFS RPC Calls
New Kind of Network (NKN) Detection
Remote Task Creation via ATSVC Named Pipe - Zeek
DNS TOR Proxies
MITRE BZAR Indicators for Persistence
OMIGOD HTTP No Authentication RCE
Possible Impacket SecretDump Remote Activity - Zeek
Possible PrintNightmare Print Driver Install
Suspicious DNS Z Flag Bit Set
Suspicious Access to Sensitive File Extensions - Zeek
MITRE BZAR Indicators for Execution
DNS Events Related To Mining Pools
SMB Spoolss Name Piped Usage
Cisco BGP Authentication Failures
Cisco Local Accounts
Cisco Collect Data
Cisco Crypto Commands
Cisco Clear Logs
Cisco File Deletion
Cisco Sniffing
Cisco Discovery
Cisco Show Commands Input
Cisco Modify Configuration
Cisco Stage Data
Cisco Denial of Service
Cisco Disabling Logging
Cisco LDP Authentication Failures
Huawei BGP Authentication Failures
DNS Query to External Service Interaction Domains
Wannacry Killswitch Domain
Cobalt Strike DNS Beaconing
DNS TXT Answer with Possible Execution Strings
Monero Crypto Coin Mining Pool Lookup
Telegram Bot API Request
Suspicious DNS Query with B64 Encoded String
Juniper BGP Missing MD5
Cleartext Protocol Usage
HackTool - BabyShark Agent Default URL Pattern
Windows WebDAV User Agent
HackTool - CobaltStrike Malleable Profile Patterns - Proxy
Suspicious External WebDAV Execution
HackTool - Empire UserAgent URI Combo
Download From Suspicious TLD - Blacklist
Exploit Framework User Agent
Bitsadmin to Uncommon TLD
Suspicious User Agent
Malware User Agent
Crypto Miner User Agent
Potential Base64 Encoded User-Agent
Windows PowerShell User Agent
Rclone Activity via Proxy
Suspicious Network Communication With IPFS
Download From Suspicious TLD - Whitelist
F5 BIG-IP iControl Rest API Command Execution - Proxy
Download from Suspicious Dyndns Hosts
PUA - Advanced IP/Port Scanner Update Check
APT User Agent
Suspicious Base64 Encoded User-Agent
Bitsadmin to Uncommon IP Server Address
Flash Player Update from Suspicious Location
Hack Tool User Agent
HTTP Request With Empty User Agent
PwnDrp Access
Raw Paste Service Access
Telegram API Access
Nginx Core Dump
Apache Threading Error
Apache Segmentation Fault
Source Code Enumeration Detection by Keyword
Java Payload Strings
Webshell ReGeorg Detection Via Web Logs
JNDIExploit Pattern
Cross Site Scripting Strings
Suspicious User-Agents Related To Recon Tools
Server Side Template Injection Strings
F5 BIG-IP iControl Rest API Command Execution - Webserver
Windows Webshell Strings
SQL Injection Strings In URI
Path Traversal Exploitation Attempts
Suspicious Windows Strings In URI
Successful IIS Shortname Fuzzing Scan
Python SQL Exceptions
Potential JNDI Injection Exploitation In JVM Based Application
Process Execution Error In JVM Based Application
Potential XXE Exploitation Attempt In JVM Based Application
Potential Local File Read Vulnerability In JVM Based Application
Potential OGNL Injection Exploitation In JVM Based Application
Potential SpEL Injection In Spring Framework
Spring Framework Exceptions
Ruby on Rails Framework Exceptions
Potential Server Side Template Injection In Velocity
Suspicious SQL Error Messages
Django Framework Exceptions
Potential RCE Exploitation Attempt In NodeJS
OpenCanary - SMB File Open Request
OpenCanary - VNC Connection Attempt
OpenCanary - SSH New Connection Attempt
OpenCanary - TFTP Request
OpenCanary - FTP Login Attempt
OpenCanary - HTTPPROXY Login Attempt
OpenCanary - HTTP POST Login Attempt
OpenCanary - GIT Clone Request
OpenCanary - SNMP OID Request
OpenCanary - SIP Request
OpenCanary - SSH Login Attempt
OpenCanary - MySQL Login Attempt
OpenCanary - REDIS Action Command Attempt
OpenCanary - MSSQL Login Attempt Via SQLAuth
OpenCanary - Telnet Login Attempt
OpenCanary - MSSQL Login Attempt Via Windows Authentication
OpenCanary - HTTP GET Request
OpenCanary - NTP Monlist Request
Kubernetes Secrets Enumeration
Kubernetes Secrets Modified or Deleted
Potential Remote Command Execution In Pod Container
Kubernetes Rolebinding Modification
New Kubernetes Service Account Created
Kubernetes Admission Controller Modification
Kubernetes Unauthorized or Unauthenticated Access
Kubernetes CronJob/Job Modification
RBAC Permission Enumeration Attempt
Creation Of Pod In System Namespace
Container With A hostPath Mount Created
Kubernetes Events Deleted
Privileged Container Deployed
Deployment Deleted From Kubernetes Cluster
Potential Sidecar Injection Into Running Deployment
Remote Event Log Recon
Recon Activity via SASec
Remote Encrypting File System Abuse
Remote DCOM/WMI Lateral Movement
Remote Schedule Task Lateral Movement via ATSvc
Remote Schedule Task Lateral Movement via ITaskSchedulerService
SharpHound Recon Account Discovery
Remote Printing Abuse for Lateral Movement
Remote Schedule Task Lateral Movement via SASec
Remote Server Service Abuse for Lateral Movement
Possible DCSync Attack
Remote Schedule Task Recon via ITaskSchedulerService
Remote Registry Lateral Movement
Remote Schedule Task Recon via AtScv
Remote Registry Recon
Remote Server Service Abuse
SharpHound Recon Sessions
MacOS Emond Launch Daemon
Startup Item File Created - MacOS
Gatekeeper Bypass via Xattr
System Integrity Protection (SIP) Disabled
Potential Discovery Activity Using Find - MacOS
OSACompile Run-Only Execution
System Shutdown/Reboot - MacOs
JXA In-memory Execution Via OSAScript
System Information Discovery Using Ioreg
Potential WizardUpdate Malware Infection
Network Sniffing - MacOs
Time Machine Backup Disabled Via Tmutil - MacOS
JAMF MDM Execution
User Added To Admin Group Via DseditGroup
Launch Agent/Daemon Execution Via Launchctl
Disk Image Creation Via Hdiutil - MacOS
User Added To Admin Group Via Sysadminctl
GUI Input Capture - macOS
System Information Discovery Using sw_vers
JAMF MDM Potential Suspicious Child Process
User Added To Admin Group Via Dscl
Root Account Enable Via Dsenableroot
Local Groups Discovery - MacOs
Remote Access Tool - Team Viewer Session Started On MacOS Host
Suspicious MacOS Firmware Activity
Disk Image Mounting Via Hdiutil - MacOS
Disable Security Tools
Screen Capture - macOS
File Time Attribute Change
System Information Discovery Via Sysctl - MacOS
MacOS Network Service Scanning
Binary Padding - MacOS
Scheduled Cron Task/Job - MacOs
Split A File Into Pieces
Suspicious Microsoft Office Child Process - MacOS
Guest Account Enabled Via Sysadminctl
Macos Remote System Discovery
MacOS Scripting Interpreter AppleScript
Osacompile Execution By Potentially Suspicious Applet/Osascript
System Integrity Protection (SIP) Enumeration
Local System Accounts Discovery - MacOs
Suspicious Execution via macOS Script Editor
Payload Decoded and Decrypted via Built-in Utilities
Suspicious Installer Package Child Process
Potential Base64 Decoded From Images
System Network Discovery - macOS
Potential In-Memory Download And Compile Of Payloads
Potential XCSSET Malware Infection
Credentials In Files
Suspicious Browser Child Process - MacOS
File Download Via Nscurl - MacOS
Hidden User Creation
Creation Of A Local User Account
Credentials from Password Stores - Keychain
Decode Base64 Encoded Text -MacOs
System Information Discovery Using System_Profiler
System Network Connections Discovery - MacOs
Indicator Removal on Host - Clear Mac System Logs
Time Machine Backup Deletion Attempt Via Tmutil - MacOS
Clipboard Data Collection Via OSAScript
Security Software Discovery - MacOs
Suspicious History File Operations
Space After Filename - macOS
File and Directory Discovery - MacOS
New File Exclusion Added To Time Machine Via Tmutil - MacOS
Potential Persistence Via PlistBuddy
OneLogin User Assumed Another User
OneLogin User Account Locked
Github Push Protection Disabled
New Github Organization Member Added
Outdated Dependency Or Vulnerability Alert Disabled
Github Fork Private Repositories Setting Enabled/Cleared
Github High Risk Configuration Disabled
Github Secret Scanning Feature Disabled
Github Repository/Organization Transferred
Github Delete Action Invoked
Github New Secret Created
Github SSH Certificate Configuration Changed
Github Push Protection Bypass Detected
Github Outside Collaborator Detected
Github Self Hosted Runner Changes Detected
Okta Policy Rule Modified or Deleted
Okta Identity Provider Created
Okta Admin Role Assigned to an User or Group
Okta Admin Functions Access Through Proxy
New Okta User Created
Potential Okta Password in AlternateID Field
Okta Application Modified or Deleted
Okta API Token Revoked
Okta Suspicious Activity Reported by End-user
Okta Security Threat Detected
Okta Application Sign-On Policy Modified or Deleted
Okta API Token Created
Okta User Account Locked Out
Okta Network Zone Deactivated or Deleted
Okta New Admin Console Behaviours
Okta FastPass Phishing Detection
Okta Admin Role Assignment Created
Okta Unauthorized Access to App
Okta Policy Modified or Deleted
Okta MFA Reset or Deactivated
Okta User Session Start Via An Anonymising Proxy Service
Cisco Duo Successful MFA Authentication Via Bypass Code
New Network ACL Entry Added
AWS ElastiCache Security Group Modified or Deleted
SES Identity Has Been Deleted
AWS Root Credentials
AWS STS GetSessionToken Misuse
Ingress/Egress Security Group Modification
AWS Glue Development Endpoint Activity
AWS EFS Fileshare Mount Modified or Deleted
Restore Public AWS RDS Instance
AWS EKS Cluster Created or Deleted
New Network Route Added
AWS Suspicious SAML Activity
Potential Bucket Enumeration on AWS
AWS IAM S3Browser User or AccessKey Creation
AWS IAM Backdoor Users Keys
AWS ElastiCache Security Group Created
AWS Route 53 Domain Transfer Lock Disabled
AWS Attached Malicious Lambda Layer
AWS EC2 Disable EBS Encryption
AWS EFS Fileshare Modified or Deleted
AWS STS AssumeRole Misuse
AWS Identity Center Identity Provider Change
AWS GuardDuty Important Change
AWS Route 53 Domain Transferred to Another Account
AWS Snapshot Backup Exfiltration
AWS CloudTrail Important Change
AWS IAM S3Browser LoginProfile Creation
Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure
Potential Malicious Usage of CloudTrail System Manager
AWS ECS Task Definition That Queries The Credential Endpoint
AWS EC2 VM Export Failure
AWS EC2 Startup Shell Script Change
AWS S3 Bucket Versioning Disable
AWS SecurityHub Findings Evasion
AWS S3 Data Management Tampering
AWS RDS Master Password Change
AWS Config Disabling Channel/Recorder
LoadBalancer Security Group Modification
AWS User Login Profile Was Modified
RDS Database Security Group Modification
AWS Console GetSigninToken Potential Abuse
AWS IAM S3Browser Templated S3 Bucket Policy Creation
Google Cloud Kubernetes Secrets Modified or Deleted
Google Cloud Storage Buckets Enumeration
Google Cloud Service Account Modified
Google Cloud Firewall Modified or Deleted
Google Cloud Storage Buckets Modified or Deleted
GCP Access Policy Deleted
Google Cloud VPN Tunnel Modified or Deleted
Google Full Network Traffic Packet Capture
Google Cloud DNS Zone Modified or Deleted
Google Cloud SQL Database Modified or Deleted
Google Cloud Kubernetes Admission Controller
Google Cloud Re-identifies Sensitive Information
Google Cloud Kubernetes RoleBinding
Google Cloud Kubernetes CronJob
Google Cloud Service Account Disabled or Deleted
GCP Break-glass Container Workload Deployed
Google Workspace MFA Disabled
Google Workspace Role Privilege Deleted
Google Workspace Application Removed
Google Workspace Application Access Level Modified
Google Workspace Granted Domain API Access
Google Workspace User Granted Admin Privileges
Google Workspace Role Modified or Deleted
Bitbucket User Login Failure
Bitbucket Secret Scanning Rule Deleted
Bitbucket Global Permission Changed
Bitbucket Global SSH Settings Changed
Bitbucket User Details Export Attempt Detected
Bitbucket Unauthorized Access To A Resource
Bitbucket Audit Log Configuration Updated
Bitbucket Global Secret Scanning Rule Deleted
Bitbucket Full Data Export Triggered
Bitbucket Unauthorized Full Data Export Triggered
Bitbucket Project Secret Scanning Allowlist Added
Bitbucket User Login Failure Via SSH
Bitbucket Secret Scanning Exempt Repository Added
Bitbucket User Permissions Export Attempt
New Federated Domain Added - Exchange
New Federated Domain Added
Disabling Multi Factor Authentication
Activity from Infrequent Country
Microsoft 365 - Impossible Travel Activity
Activity from Anonymous IP Addresses
Microsoft 365 - Unusual Volume of File Deletion
Suspicious Inbox Forwarding
Suspicious OAuth App File Download Activities
PST Export Alert Using eDiscovery Alert
Microsoft 365 - User Restricted from Sending Email
Microsoft 365 - Potential Ransomware Activity
Activity Performed by Terminated User
Logon from a Risky IP Address
Data Exfiltration to Unsanctioned Apps
PST Export Alert Using New-ComplianceSearchAction
Activity from Suspicious IP Addresses
User Removed From Group With CA Policy Modification Access
Users Added to Global or Device Admin Roles
Privileged Account Creation
User Added To Privilege Role
Changes to Device Registration Policy
Guest Users Invited To Tenant By Non Approved Inviters
New CA Policy by Non-approved Actor
Azure Domain Federation Settings Modified
End User Consent
Guest User Invited By Non Approved Inviters
Temporary Access Pass Added To An Account
Password Reset By User Account
Added Credentials to Existing Application
Changes To PIM Settings
Application URI Configuration Changes
User Added To Group With CA Policy Modification Access
Added Owner To Application
New Root Certificate Authority Added
Windows LAPS Credential Dump From Entra ID
App Role Added
Delegated Permissions Granted For All Users
PIM Approvals And Deny Elevation
App Granted Privileged Delegated Or App Permissions
User State Changed From Guest To Member
CA Policy Updated by Non Approved Actor
PIM Alert Setting Changes To Disabled
Change to Authentication Method
Azure Subscription Permission Elevation Via AuditLogs
CA Policy Removed by Non Approved Actor
App Granted Microsoft Permissions
Application AppID Uri Configuration Changes
End User Consent Blocked
Account Created And Deleted Within A Close Time Frame
Bitlocker Key Retrieval
Certificate-Based Authentication Enabled
Bulk Deletion Changes To Privileged Account Permissions
Potential MFA Bypass Using Legacy Client Authentication
Azure AD Only Single Factor Authentication Required
Successful Authentications From Countries You Do Not Operate Out Of
Measurable Increase Of Successful Authentications
Discovery Using AzureHound
Sign-ins from Non-Compliant Devices
Suspicious SignIns From A Non Registered Device
Applications That Are Using ROPC Authentication Flow
Use of Legacy Authentication Protocols
User Access Blocked by Azure Conditional Access
Multifactor Authentication Interrupted
Sign-in Failure Due to Conditional Access Requirements Not Met
Failed Authentications From Countries You Do Not Operate Out Of
Sign-ins by Unknown Devices
Increased Failed Authentications Of Any Type
Azure Unusual Authentication Interruption
Account Lockout
Login to Disabled Account
Application Using Device Code Authentication Flow
Account Disabled or Blocked for Sign in Attempts
Multifactor Authentication Denied
Users Authenticating To Other Azure AD Tenants
Device Registration or Join Without MFA
Authentications To Important Apps Using Single Factor Authentication
Activity From Anonymous IP Address
SAML Token Issuer Anomaly
Impossible Travel
Primary Refresh Token Access Attempt
Malicious IP Address Sign-In Suspicious
Anomalous Token
New Country
Malicious IP Address Sign-In Failure Rate
Anomalous User Activity
Suspicious Browser Activity
Suspicious Inbox Forwarding Identity Protection
Unfamiliar Sign-In Properties
Azure AD Threat Intelligence
Azure AD Account Credential Leaked
Sign-In From Malware Infected IP
Suspicious Inbox Manipulation Rules
Password Spray Activity
Anonymous IP Address
Atypical Travel
Azure Kubernetes Pods Deleted
Azure Container Registry Created or Deleted
Azure Service Principal Created
Azure Kubernetes Sensitive Role Access
Azure Kubernetes Secret or Config Object Access
Azure Keyvault Secrets Modified or Deleted
Azure Application Deleted
Azure Owner Removed From Application or Service Principal
Azure Device or Configuration Modified or Deleted
Azure Service Principal Removed
Azure Subscription Permission Elevation Via ActivityLogs
Azure Virtual Network Modified or Deleted
Azure Firewall Rule Configuration Modified or Deleted
Azure Active Directory Hybrid Health AD FS New Server
Azure VPN Connection Modified or Deleted
Rare Subscription-level Operations In Azure
Disabled MFA to Bypass Authentication Mechanisms
Granting Of Permissions To An Account
User Added to an Administrator's Azure AD Role
Azure Kubernetes Admission Controller
Azure Firewall Rule Collection Modified or Deleted
Azure Point-to-site VPN Modified or Deleted
Azure Kubernetes Network Policy Change
Azure Application Security Group Modified or Deleted
Azure Suppression Rule Created
Azure New CloudShell Created
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted
Azure Keyvault Key Modified or Deleted
Azure Key Vault Modified or Deleted
Azure Network Firewall Policy Modified or Deleted
Azure Kubernetes Service Account Modified or Deleted
Azure Kubernetes Cluster Created or Deleted
Azure Application Gateway Modified or Deleted
Azure DNS Zone Modified or Deleted
Azure Application Credential Modified
Number Of Resource Creation Or Deployment Activities
Azure Active Directory Hybrid Health AD FS Service Delete
Azure Firewall Modified or Deleted
Azure Device No Longer Managed or Compliant
Azure Virtual Network Device Modified or Deleted
Azure Network Security Configuration Modified or Deleted
Azure Kubernetes CronJob
Azure Kubernetes Events Deleted
Stale Accounts In A Privileged Role
Invalid PIM License
Roles Activation Doesn't Require MFA
Roles Are Not Being Used
Too Many Global Admins
Roles Activated Too Frequently
Roles Assigned Outside PIM
Host Without Firewall
Default Credentials Usage
Cleartext Protocol Usage Via Netflow
Suspicious SQL Query
Antivirus Password Dumper Detection
Antivirus Relevant File Paths Alerts
Antivirus Ransomware Detection
Antivirus Hacktool Detection
Antivirus Web Shell Detection
Antivirus Exploitation Framework Detection
Triple Cross eBPF Rootkit Default LockFile
Persistence Via Cron Files
Linux Doas Conf File Creation
Potentially Suspicious Shell Script Creation in Profile Folder
Triple Cross eBPF Rootkit Default Persistence
Wget Creating Files in Tmp Directory
Persistence Via Sudoers Files
Webshell Remote Command Execution
Suspicious C2 Activities
Auditing Configuration Changes on Linux Host
Program Executions in Suspicious Folders
Linux Keylogging with Pam.d
Network Sniffing - Linux
File Time Attribute Change - Linux
Overwriting the File with Dev Zero or Null
System and Hardware Information Discovery
Linux Capabilities Discovery
Systemd Service Creation
Possible Coin Miner CPU Priority Param
Clipboard Collection of Image Data with Xclip Tool
Modification of ld.so.preload
Steganography Extract Files with Steghide
Bpfdoor TCP Ports Redirect
Steganography Hide Files with Steghide
Disable System Firewall
OMIGOD SCX RunAsProvider ExecuteShellCommand - Auditd
Screen Capture with Xwd
BPFDoor Abnormal Process ID or Lock File Accessed
Clipboard Collection with Xclip Tool - Auditd
Data Exfiltration with Wget
System Owner or User Discovery
Suspicious Commands Linux
Audio Capture
Password Policy Discovery
Steganography Unzip Hidden Information From Picture File
Steganography Hide Zip Information in Picture File
Modify System Firewall
Screen Capture with Import Tool
Creation Of An User Account
Systemd Service Reload or Start
Unix Shell Configuration Modification
Credentials In Files - Linux
Linux Network Service Scanning - Auditd
Masquerading as Linux Crond Process
Hidden Files and Directories
System Shutdown/Reboot - Linux
Data Compressed
System Information Discovery - Auditd
Remove Immutable File Attribute - Auditd
File or Folder Permissions Change
Logging Configuration Changes on Linux Host
Binary Padding - Linux
Suspicious History File Operations - Linux
Loading of Kernel Module via Insmod
Split A File Into Pieces - Linux
Use Of Hidden Paths Or Files
Clear Linux Logs
Pnscan Binary Data Transmission Activity
Remove Immutable File Attribute
Potentially Suspicious Named Pipe Created Via Mkfifo
Apt GTFOBin Abuse - Linux
Potential Python Reverse Shell
Named Pipe Created Via Mkfifo
Local System Accounts Discovery - Linux
Scheduled Task/Job At
ESXi System Information Discovery Via ESXCLI
File and Directory Discovery - Linux
System Network Connections Discovery - Linux
Disabling Security Tools
Remote Access Tool - Team Viewer Session Started On Linux Host
Interactive Bash Suspicious Children
Setuid and Setgid
Crontab Enumeration
System Information Discovery
OMIGOD SCX RunAsProvider ExecuteShellCommand
Linux Network Service Scanning Tools Execution
Linux Base64 Encoded Shebang In CLI
Print History File Contents
Potential Suspicious Change To Sensitive/Critical Files
Bash Interactive Shell
Decode Base64 Encoded Text
System Network Discovery - Linux
OS Architecture Discovery Via Grep
User Added To Root/Sudoers Group Using Usermod
BPFtrace Unsafe Option Usage
Potential Xterm Reverse Shell
Scheduled Cron Task/Job - Linux
Touch Suspicious Service File
Remove Scheduled Cron Task/Job
Atlassian Confluence CVE-2022-26134
ESXi VM List Discovery Via ESXCLI
Curl Usage on Linux
ESXi Syslog Configuration Change Via ESXCLI
Shell Execution Of Process Located In Tmp Directory
Capabilities Discovery - Linux
Triple Cross eBPF Rootkit Execve Hijack
Download File To Potentially Suspicious Directory Via Wget
ESXi VM Kill Via ESXCLI
Apache Spark Shell Command Injection - ProcessCreation
Sudo Privilege Escalation CVE-2019-14287
Flush Iptables Ufw Chain
Commands to Clear or Remove the Syslog
Potential Linux Amazon SSM Agent Hijacking
Linux Shell Pipe to Shell
Copy Passwd Or Shadow From TMP Path
Group Has Been Deleted Via Groupdel
Disable Or Stop Services
User Has Been Deleted Via Userdel
Suspicious Nohup Execution
Suspicious Curl Change User Agents - Linux
Ufw Force Stop Using Ufw-Init
ESXi VSAN Information Discovery Via ESXCLI
Linux HackTool Execution
Security Software Discovery - Linux
Process Discovery
Potential GobRAT File Discovery Via Grep
Potential PHP Reverse Shell
Linux Webshell Indicators
ESXi Network Configuration Discovery Via ESXCLI
Linux Doas Tool Execution
Docker Container Discovery Via Dockerenv Listing
Potential Ruby Reverse Shell
Linux Remote System Discovery
Container Residence Discovery Via Proc Virtual FS
Install Root Certificate
Suspicious Curl File Upload - Linux
File Deletion
Local Groups Discovery - Linux
Suspicious Package Installed - Linux
Potential Perl Reverse Shell Execution
Nohup Execution
ESXi Account Creation Via ESXCLI
Terminate Linux Process Via Kill
Triple Cross eBPF Rootkit Install Commands
OMIGOD SCX RunAsProvider ExecuteScript
ESXi Storage Information Discovery Via ESXCLI
Potential Netcat Reverse Shell Execution
Connection Proxy
Python Spawning Pretty TTY
Suspicious Git Clone - Linux
Linux Base64 Encoded Pipe to Shell
Clipboard Collection with Xclip Tool
DD File Overwrite
Vim GTFOBin Abuse - Linux
Execution Of Script Located In Potentially Suspicious Directory
Suspicious Java Children Processes
Enable BPF Kprobes Tracing
Potential Discovery Activity Using Find - Linux
Potentially Suspicious Execution From Tmp Folder
Mount Execution With Hidepid Parameter
Cat Sudoers
History File Deletion
Linux Package Uninstall
ESXi Admin Permission Assigned To Account Via ESXCLI
Potential Container Discovery Via Inodes Listing
Linux Crypto Mining Indicators
Chmod Suspicious Directory
Potential Linux Process Code Injection Via DD Utility
Linux Recon Indicators
Communication To LocaltoNet Tunneling Service Initiated - Linux
Communication To Ngrok Tunneling Service - Linux
Linux Reverse Shell Indicator
Linux Crypto Mining Pool Connections
Potentially Suspicious Malware Callback Communication - Linux
Suspicious Reverse Shell Command Line
Suspicious Use of /dev/tcp
Potential Suspicious BPF Activity - Linux
JexBoss Command Sequence
Symlink Etc Passwd
Buffer Overflow Attempts
Suspicious Activity in Shell Commands
Suspicious Log Entries
Privileged User Has Been Created
Code Injection by ld.so Preload
Commands to Clear or Remove the Syslog - Builtin
Shellshock Expression
Remote File Copy
Linux Command History Tampering
Nimbuspwn Exploitation
Space After Filename
Equation Group Indicators
Suspicious VSFTPD Error Messages
PwnKit Local Privilege Escalation
Sudo Privilege Escalation CVE-2019-14287 - Builtin
Relevant ClamAV Message
Disabling Security Tools - Builtin
Suspicious Named Error
SSHD Error Message CVE-2018-15473
Suspicious OpenSSH Daemon Error
Guacamole Two Users Sharing Session Anomaly
Modifying Crontab
Social dark patterns
Social dark patterns
Dark Patterns
Sod matrix
Sod matrix
SoD Matrix
Stealer
Stealer
Stealer
Surveillance vendor
Surveillance vendor
Surveillance Vendor
Target information
Target information
Target Information
Tds
Tds
TDS
Tea matrix
Tea matrix
Tea Matrix
Threat actor
Threat actor
Threat Actor
Tidal campaigns
Tidal campaigns
Tidal Campaigns
Tidal groups
Tidal groups
Tidal Groups
Tidal references
Tidal references
Tidal References
Tidal software
Tidal software
Tidal Software
Tidal tactic
Tidal tactic
Tidal Tactic
Tidal technique
Tidal technique
Tidal Technique
Tmss
Tmss
Threat Matrix for storage services
Tool
Tool
Tool
Uavs
Uavs
UAVs/UCAVs
Ukhsa culture collections
Ukhsa culture collections
UKHSA Culture Collections
Table of contents
CurrentVersion Autorun Keys Modification
COM Hijacking via TreatAs
Potential Registry Persistence Attempt Via DbgManagedDebugger
Potential Attachment Manager Settings Attachments Tamper
Enabling COR Profiler Environment Variables
System Scripts Autorun Keys Modification
Outlook Security Settings Updated - Registry
Wow6432Node CurrentVersion Autorun Keys Modification
Execution DLL of Choice Using WAB.EXE
Suspicious Application Allowed Through Exploit Guard
Potential Persistence Via Custom Protocol Handler
Add Debugger Entry To AeDebug For Persistence
Potentially Suspicious Desktop Background Change Via Registry
Potential PendingFileRenameOperations Tampering
Potential Persistence Via GlobalFlags
Potential Attachment Manager Settings Associations Tamper
Hiding User Account Via SpecialAccounts Registry Key
Registry Persistence via Explorer Run Key
Potential CobaltStrike Service Installations - Registry
RestrictedAdminMode Registry Value Tampering
Lsass Full Dump Request Via DumpType Registry Settings
Hypervisor Enforced Paging Translation Disabled
Wdigest Enable UseLogonCredential
DHCP Callout DLL Installation
Potential Persistence Via Outlook Today Page
New Application in AppCompat
New BgInfo.EXE Custom DB Path Registry Configuration
Disabled Windows Defender Eventlog
Disable Tamper Protection on Windows Defender
Potential Credential Dumping Attempt Using New NetworkProvider - REG
Potential Persistence Via AppCompat RegisterAppRestart Layer
Internet Explorer Autorun Keys Modification
Change User Account Associated with the FAX Service
Disable PUA Protection on Windows Defender
Potential PSFactoryBuffer COM Hijacking
Suspicious Path In Keyboard Layout IME File Registry Value
Blackbyte Ransomware Registry
Potential Persistence Via DLLPathOverride
Scheduled TaskCache Change by Uncommon Program
Potential Persistence Via Shim Database Modification
Potential Ransomware Activity Using LegalNotice Message
Potential Persistence Via Netsh Helper DLL - Registry
Suspicious Powershell In Registry Run Keys
COM Object Hijacking Via Modification Of Default System CLSID Default Value
Change Winevt Channel Access Permission Via Registry
Outlook Macro Execution Without Warning Setting Enabled
Enable LM Hash Storage
Office Macros Warning Disabled
Blue Mockingbird - Registry
Bypass UAC Using DelegateExecute
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
Disable Exploit Guard Network Protection on Windows Defender
Change the Fax Dll
Internet Explorer DisableFirstRunCustomize Enabled
Old TLS1.0/TLS1.1 Protocol Version Enabled
Register New IFiltre For Persistence
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols
Suspicious Service Installed
PowerShell Logging Disabled Via Registry Key Tampering
Potential Persistence Via Event Viewer Events.asp
Periodic Backup For System Registry Hives Enabled
Potential Persistence Via Scrobj.dll COM Hijacking
Running Chrome VPN Extensions via the Registry 2 VPN Extension
New File Association Using Exefile
Potential EventLog File Location Tampering
UAC Bypass via Event Viewer
ETW Logging Disabled In .NET Processes - Sysmon Registry
Potential Persistence Via Excel Add-in - Registry
Potential Persistence Via MyComputer Registry Keys
New Root or CA or AuthRoot Certificate to Store
Potential Persistence Via CHM Helper DLL
New Netsh Helper DLL Registered From A Suspicious Location
Potential Persistence Via COM Search Order Hijacking
Suspicious Keyboard Layout Load
Sysmon Driver Altitude Change
Allow RDP Remote Assistance Feature
Potential Persistence Via LSA Extensions
RDP Sensitive Settings Changed
Registry Disable System Restore
VBScript Payload Stored in Registry
New TimeProviders Registered With Uncommon DLL Name
Office Autorun Keys Modification
Hypervisor Enforced Code Integrity Disabled
Disable Windows Defender Functionalities Via Registry Keys
Bypass UAC Using SilentCleanup Task
Classes Autorun Keys Modification
Potential SentinelOne Shell Context Menu Scan Command Tampering
Potential AutoLogger Sessions Tampering
Registry Modification to Hidden File Extension
Winget Admin Settings Modification
CurrentVersion NT Autorun Keys Modification
Potential Persistence Via Shim Database In Uncommon Location
ServiceDll Hijack
WinSock2 Autorun Keys Modification
Add Port Monitor Persistence in Registry
Persistence Via Disk Cleanup Handler - Autorun
DNS-over-HTTPS Enabled by Registry
Scripted Diagnostics Turn Off Check Enabled - Registry
Activate Suppression of Windows Security Center Notifications
Persistence Via Hhctrl.ocx
New BgInfo.EXE Custom VBScript Registry Configuration
CurrentControlSet Autorun Keys Modification
CrashControl CrashDump Disabled
New BgInfo.EXE Custom WMI Query Registry Configuration
Trust Access Disable For VBApplications
Potential Registry Persistence Attempt Via Windows Telemetry
Potential Persistence Via App Paths Default Property
RDP Sensitive Settings Changed to Zero
Macro Enabled In A Potentially Suspicious Document
Bypass UAC Using Event Viewer
Potential Persistence Via Mpnotify
Potentially Suspicious ODBC Driver Registered
Potential Persistence Via Visual Studio Tools for Office
Uncommon Microsoft Office Trusted Location Added
Modify User Shell Folders Startup Value
Disable Administrative Share Creation at Startup
MaxMpxCt Registry Value Changed
New ODBC Driver Registered
Wow6432Node Classes Autorun Keys Modification
Uncommon Extension In Keyboard Layout IME File Registry Value
Persistence Via New SIP Provider
Potential Persistence Via AutodialDLL
Custom File Open Handler Executes PowerShell
ClickOnce Trust Prompt Tampering
Windows Recall Feature Enabled - Registry
COM Hijack via Sdclt
Service Binary in Suspicious Folder
Suspicious Printer Driver Empty Manufacturer
Potential PowerShell Execution Policy Tampering
UAC Bypass via Sdclt
New RUN Key Pointing to Suspicious Folder
Potential AMSI COM Server Hijacking
Windows Defender Exclusions Added - Registry
Potential Persistence Via Outlook Home Page
ETW Logging Disabled For rpcrt4.dll
UAC Bypass Using Windows Media Player - Registry
Potential Persistence Using DebugPath
Windows Defender Service Disabled - Registry
PowerShell Script Execution Policy Enabled
UAC Notification Disabled
Add DisallowRun Execution to Registry
Disable Macro Runtime Scan Scope
Registry Hide Function from User
Outlook EnableUnsafeClientMailRules Setting Enabled - Registry
Potential Persistence Via TypedPaths
PowerShell as a Service in Registry
Usage of Renamed Sysinternals Tools - RegistrySet
IE Change Domain Zone
Tamper With Sophos AV Registry Keys
Disable Windows Event Logging Via Registry
Potential WerFault ReflectDebugger Registry Value Abuse
Winlogon AllowMultipleTSSessions Enable
Registry Persistence via Service in Safe Mode
ScreenSaver Registry Key Set
ETW Logging Disabled For SCM
Potential Signing Bypass Via Windows Developer Features - Registry
Disable Internal Tools or Feature in Registry
UAC Bypass Abusing Winsat Path Parsing - Registry
Disable Windows Security Center Notifications
Disable Privacy Settings Experience in Registry
Hide Schedule Task Via Index Value Tamper
Suspicious Shim Database Patching Activity
Lolbas OneDriveStandaloneUpdater.exe Proxy Download
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification
UAC Secure Desktop Prompt Disabled
Common Autorun Keys Modification
Session Manager Autorun Keys Modification
Displaying Hidden Files Feature Disabled
Directory Service Restore Mode(DSRM) Registry Value Tampering
Microsoft Office Protected View Disabled
Winlogon Notify Key Logon Persistence
Enable Local Manifest Installation With Winget
Suspicious Environment Variable Has Been Registered
Disable Windows Firewall by Registry
Default RDP Port Changed to Non Standard Port
NET NGenAssemblyUsageLog Registry Key Tamper
Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
UAC Disabled
Add Debugger Entry To Hangs Key For Persistence
New DNS ServerLevelPluginDll Installed
Registry Explorer Policy Modification
Modification of IE Registry Settings
Disable Microsoft Defender Firewall via Registry
Enable Microsoft Dynamic Data Exchange
Folder Removed From Exploit Guard ProtectedFolders List - Registry
Removal Of SD Value to Hide Schedule Task - Registry
Terminal Server Client Connection History Cleared - Registry
Removal of Potential COM Hijacking Registry Keys
Removal Of AMSI Provider Registry Keys
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted
Removal Of Index Value to Hide Schedule Task - Registry
Atbroker Registry Change
New PortProxy Registry Entry Added
New DLL Added to AppCertDlls Registry Key
Windows Registry Trust Record Modification
PrinterNightmare Mimikatz Driver Name
Registry Persistence Mechanisms in Recycle Bin
Shell Open Registry Keys Manipulation
Run Once Task Configuration in Registry
Narrator's Feedback-Hub Persistence
Creation of a Local Hidden User Account by Registry
UAC Bypass Via Wsreset
New DLL Added to AppInit_DLLs Registry Key
Esentutl Volume Shadow Copy Service Keys
Registry Entries For Azorult Malware
Potential Qakbot Registry Activity
Windows Credential Editor Registry
Path To Screensaver Binary Modified
Disable Security Events Logging Adding Reg Key MiniNt
Office Application Startup - Office Test
Suspicious Run Key from Download
HybridConnectionManager Service Installation - Registry
Security Support Provider (SSP) Added to LSA Configuration
Potential Credential Dumping Via LSASS SilentProcessExit Technique
Suspicious Camera and Microphone Access
Wdigest CredGuard Registry Modification
RedMimicry Winnti Playbook Registry Manipulation
Pandemic Registry Key
Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback
Sticky Key Like Backdoor Usage - Registry
DLL Load via LSASS
NetNTLM Downgrade Attack - Registry
WINEKEY Registry Modification
CMSTP Execution Registry Event
PUA - Sysinternals Tools Execution - Registry
Suspicious Execution Of Renamed Sysinternals Tools - Registry
Potential NetWire RAT Activity - Registry
Potential COM Object Hijacking Via TreatAs Subkey - Registry
PUA - Sysinternal Tool Execution - Registry
Potential Persistence Via New AMSI Providers - Registry
Potential Persistence Via Disk Cleanup Handler - Registry
Potential Persistence Via Logon Scripts - Registry
Vulnerable WinRing0 Driver Load
Driver Load From A Temporary Directory
PUA - Process Hacker Driver Load
PUA - System Informer Driver Load
Malicious Driver Load By Name
Vulnerable Driver Load
Vulnerable Driver Load By Name
Malicious Driver Load
Vulnerable HackSys Extreme Vulnerable Driver Load
WinDivert Driver Load
Suspicious Cobalt Strike DNS Beaconing - Sysmon
Cloudflared Tunnels Related DNS Requests
DNS Query To AzureWebsites.NET By Non-Browser Process
AppX Package Installation Attempts Via AppInstaller.EXE
Suspicious DNS Query for IP Lookup Service APIs
TeamViewer Domain Query By Non-TeamViewer Application
DNS Server Discovery Via LDAP Query
DNS Query To Devtunnels Domain
DNS HybridConnectionManager Service Bus
DNS Query Tor .Onion Address - Sysmon
DNS Query To Ufile.io
DNS Query for Anonfiles.com Domain - Sysmon
DNS Query To MEGA Hosting Website
DNS Query To Visual Studio Code Tunnels Domain
DNS Query Request To OneLaunch Update Service
DNS Query Request By Regsvr32.EXE
DNS Query To Remote Access Software Domain From Non-Browser App
Malicious Named Pipe Created
CobaltStrike Named Pipe Patterns
PUA - RemCom Default Named Pipe
ADFS Database Named Pipe Connection By Uncommon Tool
CobaltStrike Named Pipe Pattern Regex
PUA - PAExec Default Named Pipe
PUA - CSExec Default Named Pipe
HackTool - CoercedPotato Named Pipe Creation
HackTool - EfsPotato Named Pipe Creation
HackTool - DiagTrackEoP Default Named Pipe
HackTool - Koh Default Named Pipe
CobaltStrike Named Pipe
Alternate PowerShell Hosts Pipe
PsExec Tool Execution From Suspicious Locations - PipeName
WMI Event Consumer Created Named Pipe
HackTool - Credential Dumping Tools Named Pipe Created
New PowerShell Instance Created
Sysmon Configuration Modification
Sysmon Configuration Change
Sysmon Blocked File Shredding
Sysmon Configuration Error
Sysmon File Executable Creation Detected
Sysmon Blocked Executable
Remote Thread Creation By Uncommon Source Image
Remote Thread Created In KeePass.EXE
Remote Thread Created In Shell Application
Remote Thread Creation Via PowerShell In Uncommon Target
HackTool - CACTUSTORCH Remote Thread Creation
HackTool - Potential CobaltStrike Process Injection
Password Dumper Remote Thread in LSASS
Remote Thread Creation In Mstsc.Exe From Suspicious Location
Remote Thread Creation Ttdinject.exe Proxy
Potential Credential Dumping Attempt Via PowerShell Remote Thread
Remote Thread Creation In Uncommon Target Image
Rare Remote Thread Creation By Uncommon Source Image
HackTool - QuarksPwDump Dump File
LiveKD Driver Creation By Uncommon Process
New Outlook Macro Created
Suspicious Executable File Creation
Office Macro File Creation From Suspicious Process
File Creation In Suspicious Directory By Msdt.EXE
Potentially Suspicious DMP/HDMP File Creation
UAC Bypass Using IDiagnostic Profile - File
Assembly DLL Creation Via AspNetCompiler
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File
Suspicious Desktopimgdownldr Target File
Installation of TeamViewer Desktop
HackTool - SafetyKatz Dump Indicator
RDP File Creation From Suspicious Application
UAC Bypass Using Windows Media Player - File
Suspicious Interactive PowerShell as SYSTEM
Legitimate Application Dropped Archive
PowerShell Module File Created
UAC Bypass Abusing Winsat Path Parsing - File
Suspicious ASPX File Drop by Exchange
Self Extraction Directive File Created In Potentially Suspicious Location
Suspicious PROCEXP152.sys File Created In TMP
Suspicious Binary Writes Via AnyDesk
WinSxS Executable File Creation By Non-System Process
Suspicious File Creation In Uncommon AppData Folder
DLL Search Order Hijackig Via Additional Space in Path
Advanced IP Scanner - File Event
VHD Image Download Via Browser
LiveKD Kernel Memory Dump File Created
Suspicious Screensaver Binary File Creation
Creation of a Diagcab
GatherNetworkInfo.VBS Reconnaissance Script Output
RemCom Service File Creation
Anydesk Temporary Artefact
Suspicious Creation with Colorcpl
HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators
Process Monitor Driver Creation By Non-Sysinternals Binary
Potential Persistence Via Microsoft Office Startup Folder
Process Explorer Driver Creation By Non-Sysinternals Binary
Creation of an WerFault.exe in Unusual Folder
WMI Persistence - Script Event Consumer File Write
Suspicious Startup Folder Persistence
Startup Folder File Write
PsExec Service File Creation
Potential Persistence Via Microsoft Office Add-In
OneNote Attachment File Dropped In Suspicious Location
Suspicious DotNET CLR Usage Log Artifact
NTDS.DIT Created
PSScriptPolicyTest Creation By Uncommon Process
Potential Winnti Dropper Activity
UEFI Persistence Via Wpbbin - FileCreation
PDF File Created By RegEdit.EXE
PowerShell Module File Created By Non-PowerShell Process
PCRE.NET Package Temp Files
Potential DCOM InternetExplorer.Application DLL Hijack
Adwind RAT / JRAT File Artifact
TeamViewer Remote Session
Malicious DLL File Dropped in the Teams or OneDrive Folder
Potential Homoglyph Attack Using Lookalike Characters in Filename
WerFault LSASS Process Memory Dump
Legitimate Application Dropped Executable
NTDS.DIT Creation By Uncommon Process
Writing Local Admin Share
Suspicious MSExchangeMailboxReplication ASPX Write
Files With System Process Name In Unsuspected Locations
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
UAC Bypass Using IEInstal - File
Publisher Attachment File Dropped In Suspicious Location
Potential Binary Or Script Dropper Via PowerShell
Windows Shell/Scripting Application File Write to Suspicious Folder
Uncommon File Created In Office Startup Folder
DPAPI Backup Keys And Certificate Export Activity IOC
HackTool - Mimikatz Kirbi File Creation
Potential Persistence Via Notepad++ Plugins
Malicious PowerShell Scripts - FileCreation
Dynamic CSharp Compile Artefact
LSASS Process Memory Dump Creation Via Taskmgr.EXE
PSEXEC Remote Execution File Artefact
LSASS Process Memory Dump Files
UAC Bypass Using NTFS Reparse Point - File
Suspicious Scheduled Task Write to System32 Tasks
ISO or Image Mount Indicator in Recent Files
Creation Exe for Service with Unquoted Path
Windows Terminal Profile Settings Modification By Uncommon Process
Suspicious Files in Default GPO Folder
SCR File Write Event
Wmiprvse Wbemcomn DLL Hijack - File
PowerShell Script Dropped Via PowerShell.EXE
Potential Suspicious PowerShell Module File Created
Potential Webshell Creation On Static Website
UAC Bypass Using EventVwr
Suspicious desktop.ini Action
ScreenConnect Temporary Installation Artefact
PowerShell Profile Modification
Potential Persistence Via Outlook Form
Rclone Config File Creation
Potential RipZip Attack on Startup Folder
CSExec Service File Creation
Suspicious PFX File Creation
UAC Bypass Using MSConfig Token Modification - File
Octopus Scanner Malware
Hijack Legit RDP Session to Move Laterally
Files With System DLL Name In Unsuspected Locations
Renamed VsCode Code Tunnel Execution - File Indicator
Windows Binaries Write Suspicious Extensions
New Custom Shim Database Created
UAC Bypass Using Consent and Comctl32 - File
Potential Startup Shortcut Persistence Via PowerShell.EXE
Cred Dump Tools Dropped Files
HackTool - Inveigh Execution Artefacts
Legitimate Application Dropped Script
Potential Persistence Attempt Via ErrorHandler.Cmd
Suspicious LNK Double Extension File Created
NTDS.DIT Creation By Uncommon Parent Process
File With Uncommon Extension Created By An Office Application
Created Files by Microsoft Sync Center
HackTool - CrackMapExec File Indicators
Uncommon File Creation By Mysql Daemon Process
HackTool - Typical HiveNightmare SAM File Export
Suspicious Outlook Macro Created
UAC Bypass Using .NET Code Profiler on MMC
Suspicious File Creation Activity From Fake Recycle.Bin Folder
LSASS Process Dump Artefact In CrashDumps Folder
Wmiexec Default Output File
ISO File Created Within Temp Folders
Drop Binaries Into Spool Drivers Color Folder
Suspicious File Drop by Exchange
LiveKD Driver Creation
HackTool - Dumpert Process Dumper Default File
ADSI-Cache File Creation By Uncommon Tool
Office Macro File Creation
Potential Privilege Escalation Attempt Via .Exe.Local Technique
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream
Suspicious Get-Variable.exe Creation
WScript or CScript Dropper - File
Suspicious Double Extension Files
Potential Initial Access via DLL Search Order Hijacking
Suspicious File Created Via OneNote Application
Office Macro File Download
HackTool - Powerup Write Hijack DLL
Visual Studio Code Tunnel Remote File Creation
EVTX Created In Uncommon Location
VsCode Powershell Profile Modification
BloodHound Collection Files
HackTool - NPPSpy Hacktool Usage
Suspicious Creation TXT File in User Desktop
GoToAssist Temporary Installation Artefact
Creation Of Non-Existent System DLL
Suspicious File Created In PerfLogs
Remote Access Tool - ScreenConnect Temporary File
NTDS Exfiltration Filename Patterns
Potential SAM Database Dump
Suspicious Appended Extension
Access To Windows DPAPI Master Keys By Uncommon Applications
Credential Manager Access By Uncommon Applications
Access To Potentially Sensitive Sysvol Files By Uncommon Applications
Access To Crypto Currency Wallets By Uncommon Applications
Microsoft Teams Sensitive File Access By Uncommon Applications
Access To Windows Credential History File By Uncommon Applications
File Creation Date Changed to Another Year
Unusual File Modification by dns.exe
Prefetch File Deleted
Backup Files Deleted
Unusual File Deletion by Dns.exe
IIS WebServer Access Logs Deleted
ADS Zone.Identifier Deleted By Uncommon Application
Exchange PowerShell Cmdlet History Deleted
Potential PrintNightmare Exploitation Attempt
TeamViewer Log File Deleted
EventLog EVTX File Deleted
Tomcat WebServer Logs Deleted
File Deleted Via Sysinternals SDelete
PowerShell Console History Logs Deleted
Potentially Suspicious Self Extraction Directive File Created
DLL Execution Via Register-cimprovider.exe
Windows Kernel Debugger Execution
Windows Internet Hosted WebDav Share Mount Via Net.EXE
Uninstall Crowdstrike Falcon Sensor
Powershell Defender Disable Scan Feature
UAC Bypass Using ChangePK and SLUI
UtilityFunctions.ps1 Proxy Dll
Process Creation Using Sysnative Folder
New Generic Credentials Added Via Cmdkey.EXE
Sysmon Driver Unloaded Via Fltmc.EXE
Suspicious Greedy Compression Using Rar.EXE
PUA - Wsudo Suspicious Execution
Esentutl Steals Browser Information
PUA - AdvancedRun Execution
LSASS Process Reconnaissance Via Findstr.EXE
Suspicious Splwow64 Without Params
Potential Arbitrary Command Execution Using Msdt.EXE
Suspicious Key Manager Access
HackTool - Rubeus Execution
Uncommon System Information Discovery Via Wmic.EXE
Diskshadow Script Mode - Uncommon Script Extension Execution
Suspicious RDP Redirect Using TSCON
Suspicious Redirection to Local Admin Share
Rar Usage with Password and Compression Level
Add Windows Capability Via PowerShell Cmdlet
Suspicious Certreq Command to Download
Potential SPN Enumeration Via Setspn.EXE
Suspicious Windows Update Agent Empty Cmdline
New Kernel Driver Via SC.EXE
Unmount Share Via Net.EXE
Console CodePage Lookup Via CHCP
HackTool - EDRSilencer Execution
Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
RDP Connection Allowed Via Netsh.EXE
HTML Help HH.EXE Suspicious Child Process
Computer Discovery And Export Via Get-ADComputer Cmdlet
Suspicious MSHTA Child Process
Potential DLL Sideloading Via DeviceEnroller.EXE
Visual Studio Code Tunnel Service Installation
Renamed PingCastle Binary Execution
Fsutil Drive Enumeration
HackTool - Bloodhound/Sharphound Execution
PUA - Seatbelt Execution
Screen Capture Activity Via Psr.EXE
System Network Connections Discovery Via Net.EXE
Remote Access Tool - ScreenConnect Execution
New Process Created Via Taskmgr.EXE
Potential Fake Instance Of Hxtsr.EXE Executed
HackTool - SharPersist Execution
Suspicious RunAs-Like Flag Combination
Suspicious Process Patterns NTDS.DIT Exfil
User Added to Local Administrators Group
Renamed Sysinternals Sdelete Execution
Potentially Suspicious Usage Of Qemu
Abuse of Service Permissions to Hide Services Via Set-Service
Proxy Execution Via Wuauclt.EXE
Port Forwarding Activity Via SSH.EXE
Chopper Webshell Process Pattern
Suspicious SYSTEM User Process Creation
New Remote Desktop Connection Initiated Via Mstsc.EXE
Use of Scriptrunner.exe
Suspect Svchost Activity
Suspicious Mstsc.EXE Execution With Local RDP File
New Port Forwarding Rule Added Via Netsh.EXE
Suspicious Rundll32 Invoking Inline VBScript
Remote PowerShell Session Host Process (WinRM)
HackTool - Empire PowerShell Launch Parameters
Terminal Service Process Spawn
HackTool - Certipy Execution
Suspicious UltraVNC Execution
Lolbin Unregmp2.exe Use As Proxy
Cloudflared Tunnel Execution
Findstr GPP Passwords
PowerShell DownloadFile
Renamed Remote Utilities RAT (RURAT) Execution
WhoAmI as Parameter
Explorer NOUACCHECK Flag
HackTool - Sliver C2 Implant Activity Pattern
Using SettingSyncHost.exe as LOLBin
Suspicious PowerShell IEX Execution Patterns
Suspicious WMIC Execution Via Office Process
Windows Shell/Scripting Processes Spawning Suspicious Programs
Potentially Suspicious WebDAV LNK Execution
Msxsl.EXE Execution
Wab Execution From Non Default Location
New ActiveScriptEventConsumer Created Via Wmic.EXE
Potential Commandline Obfuscation Using Escape Characters
File Download And Execution Via IEExec.EXE
Sdclt Child Processes
Wusa.EXE Extracting Cab Files From Suspicious Paths
Rundll32 Spawned Via Explorer.EXE
Suspicious Reg Add BitLocker
Suspicious ZipExec Execution
Rundll32 Execution Without Parameters
Potential Signing Bypass Via Windows Developer Features
Suspicious Child Process Of Manage Engine ServiceDesk
User Added To Highly Privileged Group
HackTool - LocalPotato Execution
Greedy File Deletion Using Del
Suspicious PowerShell Encoded Command Patterns
UAC Bypass Using NTFS Reparse Point - Process
Renamed BrowserCore.EXE Execution
Potential Network Sniffing Activity Using Network Tools
UEFI Persistence Via Wpbbin - ProcessCreation
Malicious Base64 Encoded PowerShell Keywords in Command Lines
Psexec Execution
Interesting Service Enumeration Via Sc.EXE
Chromium Browser Instance Executed With Custom Extension
Suspicious Service DACL Modification Via Set-Service Cmdlet
PUA - NPS Tunneling Tool Execution
Indirect Command Execution From Script File Via Bash.EXE
Remote Access Tool - Anydesk Execution From Suspicious Folder
Suspicious Processes Spawned by WinRM
Suspicious Windows Defender Registry Key Tampering Via Reg.EXE
Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet
Potential Data Exfiltration Activity Via CommandLine Tools
ManageEngine Endpoint Central Dctask64.EXE Potential Abuse
Remote Access Tool - RURAT Execution From Unusual Location
Use of FSharp Interpreters
SQLite Chromium Profile Data DB Access
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
HackTool - XORDump Execution
Suspicious WebDav Client Execution Via Rundll32.EXE
TrustedPath UAC Bypass Pattern
Renamed Msdt.EXE Execution
Process Access via TrolleyExpress Exclusion
Potential Product Reconnaissance Via Wmic.EXE
Suspicious Download Via Certutil.EXE
Suspicious Modification Of Scheduled Tasks
Sensitive File Dump Via Wbadmin.EXE
Odbcconf.EXE Suspicious DLL Location
Replace.exe Usage
Microsoft IIS Service Account Password Dumped
Suspicious Copy From or To System Directory
MsiExec Web Install
Suspicious GUP Usage
Security Privileges Enumeration Via Whoami.EXE
Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)
Weak or Abused Passwords In CLI
Suspicious PowerShell Download and Execute Pattern
Change Default File Association Via Assoc
Suspicious Rundll32 Execution With Image Extension
Query Usage To Exfil Data
PowerShell Download and Execution Cradles
Potential Execution of Sysinternals Tools
Suspicious WindowsTerminal Child Processes
Service StartupType Change Via PowerShell Set-Service
Suspicious Download from Office Domain
Response File Execution Via Odbcconf.EXE
Service Started/Stopped Via Wmic.EXE
PowerShell Execution With Potential Decryption Capabilities
HackTool - TruffleSnout Execution
UAC Bypass Tools Using ComputerDefaults
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
PowerShell Set-Acl On Windows Folder
Execute Code with Pester.bat as Parent
Non-privileged Usage of Reg or Powershell
Powershell Inline Execution From A File
Non Interactive PowerShell Process Spawned
Nltest.EXE Execution
New User Created Via Net.EXE
File Download Via Bitsadmin To An Uncommon Target Folder
Exchange PowerShell Snap-Ins Usage
Harvesting Of Wifi Credentials Via Netsh.EXE
HackTool - KrbRelay Execution
Application Whitelisting Bypass via Dxcap.exe
UAC Bypass Using PkgMgr and DISM
Local File Read Using Curl.EXE
Active Directory Database Snapshot Via ADExplorer
Powershell Token Obfuscation - Process Creation
Disable Important Scheduled Task
New Service Creation Using PowerShell
Potential Persistence Via Logon Scripts - CommandLine
Suspicious NTLM Authentication on the Printer Spooler Service
Invoke-Obfuscation Via Stdin
Suspicious Child Process of AspNetCompiler
Potential MSTSC Shadowing Activity
Suspicious PowerShell Parameter Substring
Service StartupType Change Via Sc.EXE
SQL Client Tools PowerShell Session Detection
Active Directory Structure Export Via Csvde.EXE
Suspicious Manipulation Of Default Accounts Via Net.EXE
Hardware Model Reconnaissance Via Wmic.EXE
Remote Access Tool - UltraViewer Execution
Use of OpenConsole
Curl Web Request With Potential Custom User-Agent
NtdllPipe Like Activity Execution
Suspicious File Encoded To Base64 Via Certutil.EXE
Potential SysInternals ProcDump Evasion
Taskmgr as LOCAL_SYSTEM
Windows Credential Manager Access via VaultCmd
Firewall Rule Deleted Via Netsh.EXE
Suspicious Extrac32 Alternate Data Stream Execution
Suspicious Execution of Powershell with Base64
Potential File Download Via MS-AppInstaller Protocol Handler
Suspicious Electron Application Child Processes
Suspicious Script Execution From Temp Folder
Use Short Name Path in Command Line
HackTool - SafetyKatz Execution
Suspicious Process Masquerading As SvcHost.EXE
Computer Password Change Via Ksetup.EXE
Suspicious Windows Service Tampering
Suspicious Child Process Of Wermgr.EXE
Powershell Defender Exclusion
HackTool - ADCSPwn Execution
Potentially Suspicious Execution Of PDQDeployRunner
Sysinternals PsSuspend Execution
Suspicious Service Path Modification
Renamed Vmnat.exe Execution
PowerShell Get-Clipboard Cmdlet Via CLI
Potential COM Objects Download Cradles Usage - Process Creation
Suspicious Process By Web Server Process
Suspicious Schtasks Schedule Types
Delete All Scheduled Tasks
BitLockerTogo.EXE Execution
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
Potential Tampering With Security Products Via WMIC
Potential Suspicious Activity Using SeCEdit
Arbitrary File Download Via Squirrel.EXE
Suspicious Driver/DLL Installation Via Odbcconf.EXE
Suspicious Execution of Systeminfo
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code
Use of Remote.exe
Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution
Renamed Plink Execution
Wscript Shell Run In CommandLine
Uncommon Userinit Child Process
PUA - PingCastle Execution From Potentially Suspicious Parent
Suspicious Chromium Browser Instance Executed With Custom Extension
HackTool - Potential Impacket Lateral Movement Activity
Regsvr32 Execution From Potential Suspicious Location
LSASS Dump Keyword In CommandLine
Abusing Print Executable
HackTool - SharpUp PrivEsc Tool Execution
Php Inline Command Execution
Suspicious File Download From IP Via Wget.EXE
Suspicious Driver Install by pnputil.exe
IIS Native-Code Module Command Line Installation
Use of UltraVNC Remote Access Software
Enumerate All Information With Whoami.EXE
Potential Arbitrary Command Execution Via FTP.EXE
Sensitive File Access Via Volume Shadow Copy Backup
Potential LethalHTA Technique Execution
Potentially Suspicious Office Document Executed From Trusted Location
Remote Access Tool - AnyDesk Execution
Potentially Suspicious Windows App Activity
Potential Commandline Obfuscation Using Unicode Characters
REGISTER_APP.VBS Proxy Execution
Suspicious Where Execution
Potential Windows Defender Tampering Via Wmic.EXE
Firewall Disabled via Netsh.EXE
PUA - Crassus Execution
Potential Data Stealing Via Chromium Headless Debugging
Remote Access Tool - ScreenConnect Installation Execution
PowerShell Get-Process LSASS
Suspicious Sigverif Execution
Registry Modification Via Regini.EXE
Suspicious Provlaunch.EXE Child Process
Suspicious PowerShell Invocation From Script Engines
File Download From IP URL Via Curl.EXE
MpiExec Lolbin
Install New Package Via Winget Local Manifest
Suspicious Shells Spawn by Java Utility Keytool
Suspicious IIS URL GlobalRules Rewrite Via AppCmd
PowerShell Base64 Encoded Reflective Assembly Load
HackTool - Certify Execution
Suspicious Child Process Of BgInfo.EXE
Wlrmdr.EXE Uncommon Argument Or Child Process
Suspicious File Execution From Internet Hosted WebDav Share
Tor Client/Browser Execution
Audit Policy Tampering Via Auditpol
Potential Provlaunch.EXE Binary Proxy Execution Abuse
Copy From Or To Admin Share Or Sysvol Folder
Gpscript Execution
New DLL Registered Via Odbcconf.EXE
Certificate Exported Via Certutil.EXE
File Encryption Using Gpg4win
Sensitive File Recovery From Backup Via Wbadmin.EXE
Root Certificate Installed From Susp Locations
WmiPrvSE Spawned A Process
Rundll32 Execution With Uncommon DLL Extension
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE
UAC Bypass Using Disk Cleanup
AddinUtil.EXE Execution From Uncommon Directory
Hidden Powershell in Link File Pattern
HackTool - RedMimicry Winnti Playbook Execution
PowerShell Web Download
Potential Command Line Path Traversal Evasion Attempt
Interactive AT Job
PUA - DefenderCheck Execution
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
User Discovery And Export Via Get-ADUser Cmdlet
Filter Driver Unloaded Via Fltmc.EXE
Powershell Executed From Headless ConHost Process
Renamed Whoami Execution
HackTool - WinPwn Execution
Suspicious Child Process Created as System
Suspicious MSDT Parent Process
Use Icacls to Hide File to Everyone
HackTool - winPEAS Execution
Arbitrary Binary Execution Using GUP Utility
Suspicious Powercfg Execution To Change Lock Screen Timeout
Gzip Archive Decode Via PowerShell
Suspicious GrpConv Execution
File Download From Browser Process Via Inline URL
Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution
Potentially Suspicious Ping/Copy Command Combination
Potential Configuration And Service Reconnaissance Via Reg.EXE
Renamed AdFind Execution
Procdump Execution
Potential Suspicious Registry File Imported Via Reg.EXE
Windows Hotfix Updates Reconnaissance Via Wmic.EXE
Potential RDP Tunneling Via Plink
Renamed Cloudflared.EXE Execution
Potential Adplus.EXE Abuse
PrintBrm ZIP Creation of Extraction
File Decryption Using Gpg4win
Remote Access Tool - LogMeIn Execution
Potential Mftrace.EXE Abuse
Sticky Key Like Backdoor Execution
Potential Credential Dumping Attempt Using New NetworkProvider - CLI
Potential Discovery Activity Via Dnscmd.EXE
Potential Renamed Rundll32 Execution
File Download Via InstallUtil.EXE
Logged-On User Password Change Via Ksetup.EXE
Potential Browser Data Stealing
RDP Port Forwarding Rule Added Via Netsh.EXE
Disable Windows Defender AV Security Monitoring
LSA PPL Protection Disabled Via Reg.EXE
Sysinternals PsSuspend Suspicious Execution
AspNetCompiler Execution
Devtoolslauncher.exe Executes Specified Binary
UAC Bypass via Windows Firewall Snap-In Hijack
Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate
Csc.EXE Execution Form Potentially Suspicious Parent
HackTool - SharpMove Tool Execution
Potentially Suspicious Desktop Background Change Using Reg.EXE
Use of VisualUiaVerifyNative.exe
PsExec Service Child Process Execution as LOCAL SYSTEM
Computer System Reconnaissance Via Wmic.EXE
HackTool - Impersonate Execution
Microsoft Workflow Compiler Execution
Potential Process Execution Proxy Via CL_Invocation.ps1
Sysinternals PsService Execution
Potentially Suspicious Child Process Of ClickOnce Application
Lolbin Ssh.exe Use As Proxy
Suspicious Execution of Shutdown
Potentially Suspicious Child Process Of DiskShadow.EXE
Application Terminated Via Wmic.EXE
PUA - Nimgrab Execution
HackTool - WinRM Access Via Evil-WinRM
HackTool - Hashcat Password Cracker Execution
Forfiles.EXE Child Process Masquerading
Permission Misconfiguration Reconnaissance Via Findstr.EXE
Arbitrary MSI Download Via Devinit.EXE
Read Contents From Stdin Via Cmd.EXE
Potential Password Spraying Attempt Using Dsacls.EXE
Use of Pcalua For Execution
Potential CobaltStrike Process Patterns
Suspicious Use of PsLogList
Suspicious DLL Loaded via CertOC.EXE
Add Insecure Download Source To Winget
Use Of The SFTP.EXE Binary As A LOLBIN
Renamed Mavinject.EXE Execution
Remote Access Tool - Team Viewer Session Started On Windows Host
Renamed CreateDump Utility Execution
Wusa Extracting Cab Files
Potential Credential Dumping Via LSASS Process Clone
CMSTP Execution Process Creation
Suspicious Recursive Takeown
Process Execution From A Potentially Suspicious Folder
Execution Of Non-Existing File
PowerShell Base64 Encoded WMI Classes
PUA - NirCmd Execution
Potentially Suspicious Call To Win32_NTEventlogFile Class
Operator Bloopers Cobalt Strike Modules
Wab/Wabmig Unusual Parent Or Child Processes
UAC Bypass Using Windows Media Player - Process
Bypass UAC via CMSTP
Dllhost.EXE Execution Anomaly
Suspicious Command Patterns In Scheduled Task Creation
Execute Files with Msdeploy.exe
Recon Command Output Piped To Findstr.EXE
Suspicious Child Process Of SQL Server
Potential Suspicious Mofcomp Execution
UAC Bypass Using IEInstal - Process
Uncommon Child Process Of Appvlp.EXE
Suspicious Microsoft Office Child Process
Cloudflared Tunnel Connections Cleanup
Arbitrary File Download Via IMEWDBLD.EXE
Potential Encoded PowerShell Patterns In CommandLine
Suspicious Msbuild Execution By Uncommon Parent Process
Indirect Inline Command Execution Via Bash.EXE
Suspicious Parent Double Extension File Execution
Firewall Rule Update Via Netsh.EXE
CobaltStrike Load by Rundll32
Copying Sensitive Files with Credential Data
WMIC Remote Command Execution
Potential Defense Evasion Via Right-to-Left Override
Suspicious Control Panel DLL Load
Remote Access Tool - GoToAssist Execution
Potential Product Class Reconnaissance Via Wmic.EXE
Scheduled Task Executing Encoded Payload from Registry
HackTool - CrackMapExec Execution Patterns
Potentially Suspicious Regsvr32 HTTP IP Pattern
PUA - SoftPerfect Netscan Execution
PUA - System Informer Execution
Suspicious Obfuscated PowerShell Code
Winrar Compressing Dump Files
File Download Via Bitsadmin
Windows Firewall Disabled via PowerShell
Potential PowerShell Downgrade Attack
Invoke-Obfuscation Via Use Clip
Service Reconnaissance Via Wmic.EXE
Suspicious Extexport Execution
Execute Code with Pester.bat
PUA - RunXCmd Execution
Suspicious File Download From IP Via Wget.EXE - Paths
PowerShell Base64 Encoded FromBase64String Cmdlet
Change Default File Association To Executable Via Assoc
Suspicious WmiPrvSE Child Process
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
Remote Code Execute via Winrm.vbs
Potential Credential Dumping Via WER
Start of NT Virtual DOS Machine
Invoke-Obfuscation Obfuscated IEX Invocation
Uncommon Extension Shim Database Installation Via Sdbinst.EXE
Suspicious SYSVOL Domain Group Policy Access
Suspicious Diantz Alternate Data Stream Execution
Suspicious Encoded PowerShell Command Line
Potential PowerShell Obfuscation Via Reversed Commands
Uncommon Child Process Of BgInfo.EXE
Certificate Exported Via PowerShell
Net WebClient Casing Anomalies
Reg Add Suspicious Paths
Set Suspicious Files as System Files Using Attrib.EXE
Suspicious PowerShell Mailbox Export to Share
Scripting/CommandLine Process Spawned Regsvr32
Rundll32 InstallScreenSaver Execution
Arbitrary File Download Via ConfigSecurityPolicy.EXE
Suspicious Download From Direct IP Via Bitsadmin
WMI Backdoor Exchange Transport Agent
Suspicious Workstation Locking via Rundll32
Suspicious Download From File-Sharing Website Via Bitsadmin
Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
JScript Compiler Execution
Share And Session Enumeration Using Net.EXE
Network Reconnaissance Activity
Suspicious Microsoft OneNote Child Process
Always Install Elevated Windows Installer
Regedit as Trusted Installer
Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp
DLL Loaded via CertOC.EXE
Uncommon Link.EXE Parent Process
Rundll32 UNC Path Execution
PUA - DIT Snapshot Viewer
Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE
Raccine Uninstall
Elevated System Shell Spawned From Uncommon Parent Location
Explorer Process Tree Break
Compressed File Extraction Via Tar.EXE
Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
Potential WinAPI Calls Via CommandLine
Potentially Suspicious CMD Shell Output Redirect
Whoami.EXE Execution Anomaly
Mavinject Inject DLL Into Running Process
New Virtual Smart Card Created Via TpmVscMgr.EXE
UAC Bypass WSReset
DumpStack.log Defender Evasion
Files Added To An Archive Using Rar.EXE
Potential RDP Session Hijacking Activity
LOLBIN Execution From Abnormal Drive
Potential MsiExec Masquerading
VMToolsd Suspicious Child Process
Uncommon Child Process Spawned By Odbcconf.EXE
HackTool - UACMe Akagi Execution
Run Once Task Execution as Configured in Registry
Suspicious Remote Child Process From Outlook
Potentially Suspicious Child Process Of Regsvr32
Java Running with Remote Debugging
UAC Bypass via ICMLuaUtil
Potential Obfuscated Ordinal Call Via Rundll32
HackTool - DInjector PowerShell Cradle Execution
AgentExecutor PowerShell Execution
PUA - 3Proxy Execution
Shell32 DLL Execution in Suspicious Directory
DumpMinitool Execution
Hiding Files with Attrib.exe
Suspicious X509Enrollment - Process Creation
Sdiagnhost Calling Suspicious Child Process
Suspicious Scheduled Task Creation via Masqueraded XML File
DriverQuery.EXE Execution
Suspicious Network Command
Taskkill Symantec Endpoint Protection
Remote Access Tool - AnyDesk Piped Password Via CLI
PUA - WebBrowserPassView Execution
HackTool - LaZagne Execution
Script Event Consumer Spawning Process
Use of Wfc.exe
Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet
Delete Important Scheduled Task
HackTool - Jlaive In-Memory Assembly Execution
Suspicious JavaScript Execution Via Mshta.EXE
Firewall Configuration Discovery Via Netsh.EXE
Suspicious Ping/Del Command Combination
Windows Defender Definition Files Removed
Potential Privilege Escalation Using Symlink Between Osk and Cmd
Password Provided In Command Line Of Net.EXE
HackTool - CrackMapExec Execution
Suspicious Reg Add Open Command
RunDLL32 Spawning Explorer
All Backups Deleted Via Wbadmin.EXE
PUA - Advanced Port Scanner Execution
HackTool - SecurityXploded Execution
Browser Started with Remote Debugging
Renamed Microsoft Teams Execution
Renamed MegaSync Execution
Renamed AutoIt Execution
Potential Memory Dumping Activity Via LiveKD
Suspicious MsiExec Embedding Parent
Kavremover Dropped Binary LOLBIN Usage
Renamed NetSupport RAT Execution
PUA - Netcat Suspicious Execution
MMC20 Lateral Movement
Start Windows Service Via Net.EXE
Shadow Copies Creation Using Operating Systems Utilities
DLL Sideloading by VMware Xfer Utility
SQLite Firefox Profile Data DB Access
Conhost.exe CommandLine Path Traversal
Renamed ZOHO Dctask64 Execution
Suspicious HWP Sub Processes
Process Memory Dump via RdrLeakDiag.EXE
PUA- IOX Tunneling Tool Execution
Xwizard.EXE Execution From Non-Default Location
Active Directory Structure Export Via Ldifde.EXE
Add SafeBoot Keys Via Reg Utility
File Download Using ProtocolHandler.exe
Mshtml.DLL RunHTMLApplication Suspicious Usage
Ping Hex IP
Suspicious Response File Execution Via Odbcconf.EXE
Uncommon Child Processes Of SndVol.exe
Potentially Suspicious Command Targeting Teams Sensitive Files
Arbitrary File Download Via MSEDGE_PROXY.EXE
Uncommon Child Process Of AddinUtil.EXE
Rebuild Performance Counter Values Via Lodctr.EXE
Potential Persistence Attempt Via Run Keys Using Reg.EXE
Driver/DLL Installation Via Odbcconf.EXE
Potentially Suspicious Rundll32 Activity
Uncommon Svchost Parent Process
Suspicious Query of MachineGUID
Persistence Via Sticky Key Backdoor
VeeamBackup Database Credentials Dump Via Sqlcmd.EXE
Potentially Suspicious GoogleUpdate Child Process
Add Potential Suspicious New Download Source To Winget
Suspicious Eventlog Clearing or Configuration Change Activity
Webshell Tool Reconnaissance Activity
Schtasks From Suspicious Folders
Suspicious Advpack Call Via Rundll32.EXE
HackTool - Quarks PwDump Execution
PowerShell Base64 Encoded Invoke Keyword
Insensitive Subfolder Search Via Findstr.EXE
Enumeration for Credentials in Registry
Finger.EXE Execution
Launch-VsDevShell.PS1 Proxy Execution
PUA - CsExec Execution
Potential AMSI Bypass Via .NET Reflection
Invoke-Obfuscation VAR+ Launcher
Wusa.EXE Executed By Parent Process Located In Suspicious Location
PUA - CleanWipe Execution
Hacktool Execution - Imphash
HackTool - SharpChisel Execution
Suspicious Use of CSharp Interactive Console
Rundll32 Execution Without CommandLine Parameters
Suspicious IIS Module Registration
Uncommon AddinUtil.EXE CommandLine Execution
Service Security Descriptor Tampering Via Sc.EXE
Python Inline Command Execution
Remote Access Tool - ScreenConnect Remote Command Execution
Suspicious Invoke-WebRequest Execution
Execute Pcwrun.EXE To Leverage Follina
HackTool - SharpLDAPmonitor Execution
Cloudflared Quick Tunnel Execution
HackTool - Default PowerSploit/Empire Scheduled Task Creation
Discovery of a System Time
PowerShell Download Pattern
File Download From IP Based URL Via CertOC.EXE
PUA - Adidnsdump Execution
Suspicious Csi.exe Usage
Dism Remove Online Package
HackTool - Stracciatella Execution
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE
Winrar Execution in Non-Standard Folder
HackTool - Koadic Execution
Potential Binary Proxy Execution Via Cdb.EXE
Potential Windows Defender AV Bypass Via Dump64.EXE Rename
Suspicious Regsvr32 Execution From Remote Share
HackTool - Inveigh Execution
Suspicious Process Parents
Regsvr32 DLL Execution With Uncommon Extension
Potentially Suspicious Cabinet File Expansion
Perl Inline Command Execution
Domain Trust Discovery Via Dsquery
Potentially Suspicious Child Process of KeyScrambler.exe
HackTool - CrackMapExec PowerShell Obfuscation
Time Travel Debugging Utility Usage
Potential LSASS Process Dump Via Procdump
Potential Remote Desktop Tunneling
Tasks Folder Evasion
Suspicious Service Binary Directory
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl
Add New Download Source To Winget
HackTool - Wmiexec Default Powershell Command
Potential Tampering With RDP Related Registry Keys Via Reg.EXE
Potential Arbitrary Code Execution Via Node.EXE
Suspicious File Download From IP Via Curl.EXE
Potential Amazon SSM Agent Hijacking
Visual Studio Code Tunnel Execution
Renamed PsExec Service Execution
Stop Windows Service Via PowerShell Stop-Service
Malicious PowerShell Commandlets - ProcessCreation
Webshell Detection With Command Line Keywords
Arbitrary Command Execution Using WSL
Potential Suspicious Browser Launch From Document Reader Process
COM Object Execution via Xwizard.EXE
HackTool - Windows Credential Editor (WCE) Execution
Suspicious Desktopimgdownldr Command
File Download Via Windows Defender MpCmpRun.EXE
New User Created Via Net.EXE With Never Expire Option
MSExchange Transport Agent Installation
HackTool - CrackMapExec Process Patterns
Powershell Base64 Encoded MpPreference Cmdlet
HackTool - SharpLdapWhoami Execution
Potentially Suspicious Execution From Parent Process In Public Folder
Abused Debug Privilege by Arbitrary Parent Processes
Cloudflared Portable Execution
Node Process Executions
Python Spawning Pretty TTY on Windows
UAC Bypass Using Consent and Comctl32 - Process
Writing Of Malicious Files To The Fonts Folder
Malicious PE Execution by Microsoft Visual Studio Debugger
Audio Capture via SoundRecorder
Insecure Transfer Via Curl.EXE
Suspicious AgentExecutor PowerShell Execution
Suspicious SysAidServer Child
Suspicious Double Extension File Execution
Visual Studio NodejsTools PressAnyKey Renamed Execution
File In Suspicious Location Encoded To Base64 Via Certutil.EXE
Whoami.EXE Execution With Output Option
File Encryption/Decryption Via Gpg4win From Suspicious Locations
Visual Basic Command Line Compiler Usage
Potential SMB Relay Attack Tool Execution
XBAP Execution From Uncommon Locations Via PresentationHost.EXE
Renamed Jusched.EXE Execution
PUA - Advanced IP Scanner Execution
LOL-Binary Copied From System Directory
Potential Script Proxy Execution Via CL_Mutexverifiers.ps1
Suspicious AddinUtil.EXE CommandLine Execution
PDQ Deploy Remote Adminstartion Tool Execution
Potentially Suspicious Child Process Of WinRAR.EXE
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
Potential Active Directory Enumeration Using AD Module - ProcCreation
Windows Binary Executed From WSL
Arbitrary File Download Via PresentationHost.EXE
PUA - Ngrok Execution
Renamed SysInternals DebugView Execution
Suspicious Msiexec Execute Arbitrary DLL
WMI Persistence - Script Event Consumer
RestrictedAdminMode Registry Value Tampering - ProcCreation
Possible Privilege Escalation via Weak Service Permissions
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
Potential Process Injection Via Msra.EXE
Control Panel Items
Script Interpreter Execution From Suspicious Folder
Conhost Spawned By Uncommon Parent Process
DeviceCredentialDeployment Execution
Suspicious Process Created Via Wmic.EXE
Always Install Elevated MSI Spawned Cmd And Powershell
HackTool - Empire PowerShell UAC Bypass
HackTool - CreateMiniDump Execution
File Encoded To Base64 Via Certutil.EXE
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
CMSTP UAC Bypass via COM Object Access
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
Potential Dosfuscation Activity
Shadow Copies Deletion Using Operating Systems Utilities
Suspicious Invoke-WebRequest Execution With DirectIP
Renamed Visual Studio Code Tunnel Execution
Invoke-Obfuscation STDIN+ Launcher
New Root Certificate Installed Via Certutil.EXE
Potential Binary Impersonating Sysinternals Tools
PUA - Radmin Viewer Utility Execution
Verclsid.exe Runs COM Object
Change PowerShell Policies to an Insecure Level
Use NTFS Short Name in Command Line
Scheduled Task Creation Via Schtasks.EXE
UAC Bypass Abusing Winsat Path Parsing - Process
Schtasks Creation Or Modification With SYSTEM Privileges
Potential Cookies Session Hijacking
Potential RDP Tunneling Via SSH
Suspicious Kernel Dump Using Dtrace
File Decoded From Base64/Hex Via Certutil.EXE
Gpresult Display Group Policy Information
Potential PsExec Remote Execution
Suspicious Execution of InstallUtil Without Log
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI
Suspicious Mshta.EXE Execution Patterns
DLL Execution via Rasautou.exe
HackTool - SharpDPAPI Execution
Potentially Suspicious Child Process Of VsCode
HackTool - PPID Spoofing SelectMyParent Tool Execution
Suspicious FromBase64String Usage On Gzip Archive - Process Creation
ETW Logging Tamper In .NET Processes Via CommandLine
Suspicious Child Process Of Veeam Dabatase
MSHTA Suspicious Execution 01
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities
Potential Persistence Via Powershell Search Order Hijacking - Task
New Firewall Rule Added Via Netsh.EXE
Suspicious Binary In User Directory Spawned From Office Application
Nslookup PowerShell Download Cradle - ProcessCreation
Suspicious Git Clone
Service DACL Abuse To Hide Services Via Sc.EXE
Persistence Via TypedPaths - CommandLine
Process Proxy Execution Via Squirrel.EXE
File Download Via Bitsadmin To A Suspicious Target Folder
Service Registry Key Deleted Via Reg.EXE
Suspicious Userinit Child Process
Bad Opsec Defaults Sacrificial Processes With Improper Arguments
HackTool - GMER Rootkit Detector and Remover Execution
Suspicious Program Names
Suspicious High IntegrityLevel Conhost Legacy Option
Disable Windows IIS HTTP Logging
Potentially Suspicious Event Viewer Child Process
Indirect Command Execution By Program Compatibility Wizard
Invoke-Obfuscation CLIP+ Launcher
Suspicious Execution Location Of Wermgr.EXE
Suspicious File Download From File Sharing Domain Via Curl.EXE
HackTool - Dumpert Process Dumper Execution
HackTool - Hydra Password Bruteforce Execution
Potential Dropper Script Execution Via WScript/CScript
InfDefaultInstall.exe .inf Execution
ImagingDevices Unusual Parent/Child Processes
New Network Trace Capture Started Via Netsh.EXE
Ruby Inline Command Execution
Suspicious RASdial Activity
Execution of Suspicious File Type Extension
Mstsc.EXE Execution With Local RDP File
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI
Data Copied To Clipboard Via Clip.EXE
Suspicious Diantz Download and Compress Into a CAB File
File Download with Headless Browser
HackTool - SysmonEOP Execution
Suspicious Vsls-Agent Command With AgentExtensionPath Load
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
Bypass UAC via WSReset.exe
Compress Data and Lock With Password for Exfiltration With WINZIP
Suspicious Usage Of ShellExec_RunDLL
Run PowerShell Script from ADS
Changing Existing Service ImagePath Value Via Reg.EXE
Potential AMSI Bypass Using NULL Bits
UAC Bypass Using Event Viewer RecentViews
Renamed NirCmd.EXE Execution
Netsh Allow Group Policy on Microsoft Defender Firewall
HackTool - SharpEvtMute Execution
Suspicious Rundll32 Activity Invoking Sys File
AADInternals PowerShell Cmdlets Execution - ProccessCreation
HackTool - HandleKatz LSASS Dumper Execution
Suspicious Process Execution From Fake Recycle.Bin Folder
ConvertTo-SecureString Cmdlet Usage Via CommandLine
Veeam Backup Database Suspicious Query
Unusual Child Process of dns.exe
SafeBoot Registry Key Deleted Via Reg.EXE
PowerShell Script Change Permission Via Set-Acl
PUA - NirCmd Execution As LOCAL SYSTEM
Execution via WorkFolders.exe
Binary Proxy Execution Via Dotnet-Trace.EXE
Arbitrary File Download Via GfxDownloadWrapper.EXE
Recon Information for Export with Command Prompt
Mstsc.EXE Execution From Uncommon Parent