Experimental

Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...

Elevated Group Discovery with PowerView

Permission Groups Discovery, Domain Groups

Windows Debugger Tool Execution

Masquerading

Windows Unsigned DLL Side-Loading In Same Process Path

DLL Side-Loading, Hijack Execution Flow

Windows Event Triggered Image File Execution Options Injection

Image File Execution Options Injection

Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos

Password Spraying, Brute Force

Windows Post Exploitation Risk Behavior

Query Registry, System Network Connections Discovery, Permission Groups Discovery, System Network Configuration Discovery, OS Credential Dumping, System Info...

Windows Modify Registry Disable Restricted Admin

Modify Registry

Services Escalate Exe

Abuse Elevation Control Mechanism

Windows PowerView Kerberos Service Ticket Request

Steal or Forge Kerberos Tickets, Kerberoasting

Detect Copy of ShadowCopy with Script Block Logging

Security Account Manager, OS Credential Dumping

Windows Remote Services Allow Rdp In Firewall

Remote Desktop Protocol, Remote Services

Windows Impair Defense Disable Win Defender Signature Retirement

Disable or Modify Tools, Impair Defenses

Windows Impair Defense Define Win Defender Threat Action

Disable or Modify Tools, Impair Defenses

PowerShell Invoke CIMMethod CIMSession

Windows Management Instrumentation

Windows Unsigned DLL Side-Loading

DLL Side-Loading

Windows Query Registry UnInstall Program List

Query Registry

Exchange PowerShell Module Usage

Command and Scripting Interpreter, PowerShell

Windows Impair Defense Override SmartScreen Prompt

Disable or Modify Tools, Impair Defenses

Windows Modify Registry wuStatusServer

Modify Registry

PetitPotam Suspicious Kerberos TGT Request

OS Credential Dumping

Linux Indicator Removal Clear Cache

Indicator Removal

Windows Admin Permission Discovery

Local Groups

Ntdsutil Export NTDS

NTDS, OS Credential Dumping

Credential Dumping via Copy Command from Shadow Copy

NTDS, OS Credential Dumping

Ping Sleep Batch Command

Virtualization/Sandbox Evasion, Time Based Evasion

Windows Phishing Recent ISO Exec Registry

Spearphishing Attachment, Phishing

Windows Disable LogOff Button Through Registry

Modify Registry

Windows Domain Account Discovery Via Get-NetComputer

Account Discovery, Domain Account

Windows Alternate DataStream - Executable Content

Hide Artifacts, NTFS File Attributes

Windows Modify Registry NoChangingWallPaper

Modify Registry

Suspicious MSBuild Spawn

Trusted Developer Utilities Proxy Execution, MSBuild

Linux Possible Append Command To Profile Config File

Unix Shell Configuration Modification, Event Triggered Execution

Linux DD File Overwrite

Data Destruction

Linux File Creation In Init Boot Directory

RC Scripts, Boot or Logon Initialization Scripts

Windows AppLocker Rare Application Launch Detection

System Binary Proxy Execution

Suspicious Rundll32 StartW

System Binary Proxy Execution, Rundll32

Impacket Lateral Movement Commandline Parameters

Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service

Windows Account Discovery for Sam Account Name

Account Discovery

Windows Private Keys Discovery

Private Keys, Unsecured Credentials

PowerShell Script Block With URL Chain

PowerShell, Ingress Tool Transfer

Runas Execution in CommandLine

Access Token Manipulation, Token Impersonation/Theft

PaperCut NG Suspicious Behavior Debug Log

Exploit Public-Facing Application, External Remote Services

Windows DNS Gather Network Info

DNS

Windows Service Creation Using Registry Entry

Services Registry Permissions Weakness

Monitor Registry Keys for Print Monitors

Port Monitors, Boot or Logon Autostart Execution

Windows Registry BootExecute Modification

Pre-OS Boot, Registry Run Keys / Startup Folder

Linux Service Started Or Enabled

Systemd Timers, Scheduled Task/Job

Windows WMI Impersonate Token

Windows Management Instrumentation

Windows Rundll32 Apply User Settings Changes

System Binary Proxy Execution, Rundll32

Attacker Tools On Endpoint

Match Legitimate Name or Location, Masquerading, OS Credential Dumping, Active Scanning

Disable AMSI Through Registry

Disable or Modify Tools, Impair Defenses

Enable RDP In Other Port Number

Remote Services

Windows MsiExec HideWindow Rundll32 Execution

Msiexec, System Binary Proxy Execution

Headless Browser Mockbin or Mocky Request

Hidden Window

Windows Impair Defense Disable Win Defender Network Protection

Disable or Modify Tools, Impair Defenses

Add or Set Windows Defender Exclusion

Disable or Modify Tools, Impair Defenses

Windows Credential Access From Browser Password Store

Query Registry

Linux Common Process For Elevation Control

Setuid and Setgid, Abuse Elevation Control Mechanism

Windows Registry Certificate Added

Install Root Certificate, Subvert Trust Controls

Windows Screen Capture Via Powershell

Screen Capture

Local Account Discovery with Net

Account Discovery, Local Account

Linux Possible Access To Sudoers File

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Suspicious Curl Network Connection

Ingress Tool Transfer

Disable Security Logs Using MiniNt Registry

Modify Registry

Windows Impair Defense Disable Controlled Folder Access

Disable or Modify Tools, Impair Defenses

Rundll32 Create Remote Thread To A Process

Process Injection

GetWmiObject Ds Computer with PowerShell Script Block

Remote System Discovery

Windows DnsAdmins New Member Added

Account Manipulation

Excessive distinct processes from Windows Temp

Command and Scripting Interpreter

Detect RTLO In Process

Right-to-Left Override, Masquerading

Windows Information Discovery Fsutil

System Information Discovery

Get ADUser with PowerShell Script Block

Domain Account, Account Discovery

Windows Findstr GPP Discovery

Unsecured Credentials, Group Policy Preferences

Disabled Kerberos Pre-Authentication Discovery With Get-ADUser

Steal or Forge Kerberos Tickets, AS-REP Roasting

Windows Powershell Import Applocker Policy

PowerShell, Command and Scripting Interpreter, Disable or Modify Tools, Impair Defenses

Domain Group Discovery With Net

Permission Groups Discovery, Domain Groups

Remcos client registry install entry

Modify Registry

Linux Unix Shell Enable All SysRq Functions

Unix Shell, Command and Scripting Interpreter

Windows Find Interesting ACL with FindInterestingDomainAcl

Account Discovery, Domain Account

Suspicious SQLite3 LSQuarantine Behavior

Data Staged

GetWmiObject Ds Group with PowerShell

Permission Groups Discovery, Domain Groups

Windows Time Based Evasion via Choice Exec

Time Based Evasion, Virtualization/Sandbox Evasion

Add DefaultUser And Password In Registry

Credentials in Registry, Unsecured Credentials

Windows Unusual Count Of Users Failed To Auth Using Kerberos

Password Spraying, Brute Force

Schtasks Run Task On Demand

Scheduled Task/Job

Modification Of Wallpaper

Defacement

Windows Mail Protocol In Non-Common Process Path

Mail Protocols, Application Layer Protocol

Disable Defender AntiVirus Registry

Disable or Modify Tools, Impair Defenses

GetAdComputer with PowerShell Script Block

Remote System Discovery

Windows Raw Access To Disk Volume Partition

Disk Structure Wipe, Disk Wipe

Windows Password Managers Discovery

Password Managers

Randomly Generated Scheduled Task Name

Scheduled Task/Job, Scheduled Task

Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos

Password Spraying, Brute Force

Windows System Reboot CommandLine

System Shutdown/Reboot

Windows Impair Defense Disable Win Defender App Guard

Disable or Modify Tools, Impair Defenses

Windows Admon Default Group Policy Object Modified

Domain or Tenant Policy Modification, Group Policy Modification

Windows Multiple Users Remotely Failed To Authenticate From Host

Password Spraying, Brute Force

Windows Valid Account With Never Expires Password

Service Stop

Windows Alternate DataStream - Base64 Content

Hide Artifacts, NTFS File Attributes

Windows Modify Registry AuthenticationLevelOverride

Modify Registry

Network Connection Discovery With Net

System Network Connections Discovery

Windows CAB File on Disk

Spearphishing Attachment

Windows Privilege Escalation System Process Without System Parent

Exploitation for Privilege Escalation, Abuse Elevation Control Mechanism, Access Token Manipulation

Windows Query Registry Browser List Application

Query Registry

Windows Registry SIP Provider Modification

SIP and Trust Provider Hijacking

Windows Process Injection Wermgr Child Process

Process Injection

Windows Spearphishing Attachment Onenote Spawn Mshta

Spearphishing Attachment, Phishing

Windows Security Support Provider Reg Query

Security Support Provider, Boot or Logon Autostart Execution

Linux Iptables Firewall Modification

Disable or Modify System Firewall, Impair Defenses

Detect Credential Dumping through LSASS access

LSASS Memory, OS Credential Dumping

Windows System Discovery Using ldap Nslookup

System Owner/User Discovery

Windows DisableAntiSpyware Registry

Disable or Modify Tools, Impair Defenses

Windows Indirect Command Execution Via forfiles

Indirect Command Execution

Windows Disable Notification Center

Modify Registry

Print Spooler Failed to Load a Plug-in

Print Processors, Boot or Logon Autostart Execution

Windows Hidden Schedule Task Settings

Scheduled Task/Job

Windows Command Shell Fetch Env Variables

Process Injection

Windows Impair Defense Disable Win Defender Scan On Update

Disable or Modify Tools, Impair Defenses

Windows Powershell Cryptography Namespace

PowerShell, Command and Scripting Interpreter

Process Deleting Its Process File Path

Indicator Removal

Windows Impair Defense Change Win Defender Throttle Rate

Disable or Modify Tools, Impair Defenses

Active Setup Registry Autostart

Active Setup, Boot or Logon Autostart Execution

Wermgr Process Connecting To IP Check Web Services

Gather Victim Network Information, IP Addresses

Suspicious Rundll32 no Command Line Arguments

System Binary Proxy Execution, Rundll32

Windows Impair Defense Disable Web Evaluation

Disable or Modify Tools, Impair Defenses

Windows Credentials from Password Stores Query

Credentials from Password Stores

Spoolsv Writing a DLL

Print Processors, Boot or Logon Autostart Execution

Icacls Deny Command

File and Directory Permissions Modification

Windows Account Discovery With NetUser PreauthNotRequire

Account Discovery

Allow Network Discovery In Firewall

Disable or Modify Cloud Firewall, Impair Defenses

Linux Service File Created In Systemd Directory

Systemd Timers, Scheduled Task/Job

Windows Modify Show Compress Color And Info Tip Registry

Modify Registry

Linux Data Destruction Command

Data Destruction

Single Letter Process On Endpoint

User Execution, Malicious File

Detect suspicious processnames using pretrained model in DSDL

Command and Scripting Interpreter

MS Exchange Mailbox Replication service writing Active Server Pages

Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services

Windows Unsigned MS DLL Side-Loading

DLL Side-Loading, Boot or Logon Autostart Execution

Possible Browser Pass View Parameter

Credentials from Web Browsers, Credentials from Password Stores

Get-DomainTrust with PowerShell Script Block

Domain Trust Discovery

UAC Bypass MMC Load Unsigned Dll

Bypass User Account Control, Abuse Elevation Control Mechanism, MMC

Detect Certipy File Modifications

Steal or Forge Authentication Certificates, Archive Collected Data

Kerberos Service Ticket Request Using RC4 Encryption

Steal or Forge Kerberos Tickets, Golden Ticket

Windows Impair Defense Change Win Defender Quick Scan Interval

Disable or Modify Tools, Impair Defenses

Windows Archive Collected Data via Powershell

Archive Collected Data

GetWmiObject Ds Computer with PowerShell

Remote System Discovery

Disable Show Hidden Files

Hidden Files and Directories, Disable or Modify Tools, Hide Artifacts, Impair Defenses, Modify Registry

Windows Disable Windows Group Policy Features Through Registry

Modify Registry

Office Product Spawning MSHTA

Phishing, Spearphishing Attachment

Windows Exfiltration Over C2 Via Powershell UploadString

Exfiltration Over C2 Channel

Linux Adding Crontab Using List Parameter

Cron, Scheduled Task/Job

Get ADDefaultDomainPasswordPolicy with Powershell Script Block

Password Policy Discovery

Kerberos TGT Request Using RC4 Encryption

Use Alternate Authentication Material

Windows Non Discord App Access Discord LevelDB

Query Registry

Linux Visudo Utility Execution

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Windows Proxy Via Registry

Internal Proxy, Proxy

Windows UAC Bypass Suspicious Escalation Behavior

Abuse Elevation Control Mechanism, Bypass User Account Control

Windows Default Group Policy Object Modified

Domain or Tenant Policy Modification, Group Policy Modification

Windows Powershell RemoteSigned File

PowerShell, Command and Scripting Interpreter

Windows MSHTA Writing to World Writable Path

Mshta

Windows Account Discovery for None Disable User Account

Account Discovery, Local Account

Loading Of Dynwrapx Module

Process Injection, Dynamic-link Library Injection

Wermgr Process Spawned CMD Or Powershell Process

Command and Scripting Interpreter

Disable Schedule Task

Disable or Modify Tools, Impair Defenses

Impacket Lateral Movement WMIExec Commandline Parameters

Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service

Outbound Network Connection from Java Using Default Ports

Exploit Public-Facing Application, External Remote Services

Windows Query Registry Reg Save

Query Registry

Windows Hide Notification Features Through Registry

Modify Registry

Powershell Using memory As Backing Store

PowerShell, Command and Scripting Interpreter

Common Ransomware Extensions

Data Destruction

Eventvwr UAC Bypass

Bypass User Account Control, Abuse Elevation Control Mechanism

Log4Shell CVE-2021-44228 Exploitation

Ingress Tool Transfer, Exploit Public-Facing Application, Command and Scripting Interpreter, External Remote Services

Linux At Allow Config File Creation

Cron, Scheduled Task/Job

PetitPotam Network Share Access Request

Forced Authentication

SLUI RunAs Elevated

Bypass User Account Control, Abuse Elevation Control Mechanism

Steal or Forge Authentication Certificates Behavior Identified

Steal or Forge Authentication Certificates

Headless Browser Usage

Hidden Window

Change To Safe Mode With Network Config

Inhibit System Recovery

Detect Mimikatz With PowerShell Script Block Logging

OS Credential Dumping, PowerShell

Windows Root Domain linked policies Discovery

Domain Account, Account Discovery

Windows Multiple Users Failed To Authenticate From Host Using NTLM

Password Spraying, Brute Force

WMI Permanent Event Subscription

Windows Management Instrumentation

Windows AD Privileged Account SID History Addition

SID-History Injection, Access Token Manipulation

Windows Modify Registry No Auto Reboot With Logon User

Modify Registry

Disable Windows SmartScreen Protection

Disable or Modify Tools, Impair Defenses

Active Directory Privilege Escalation Identified

Domain or Tenant Policy Modification

Unusually Long Command Line - MLTK

High Frequency Copy Of Files In Network Share

Transfer Data to Cloud Account

Windows InProcServer32 New Outlook Form

Phishing, Modify Registry

Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos

Password Spraying, Brute Force

Registry Keys Used For Persistence

Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution

Suspicious SearchProtocolHost no Command Line Arguments

Process Injection

Ransomware Notes bulk creation

Data Encrypted for Impact

Detect Certify Command Line Arguments

Steal or Forge Authentication Certificates, Ingress Tool Transfer

Kerberos User Enumeration

Gather Victim Identity Information, Email Addresses

Suspicious Ticket Granting Ticket Request

Valid Accounts, Domain Accounts

Windows AppLocker Execution from Uncommon Locations

System Binary Proxy Execution

Windows Disable Lock Workstation Feature Through Registry

Modify Registry

Linux Hardware Addition SwapOff

Hardware Additions

Drop IcedID License dat

User Execution, Malicious File

Unusual Number of Computer Service Tickets Requested

Valid Accounts

System Processes Run From Unexpected Locations

Masquerading, Rename System Utilities

Office Application Spawn rundll32 process

Phishing, Spearphishing Attachment

Windows Multiple Users Failed To Authenticate From Process

Password Spraying, Brute Force

Windows Service Create SliverC2

System Services, Service Execution

GetDomainController with PowerShell

Remote System Discovery

Non Chrome Process Accessing Chrome Default Dir

Credentials from Password Stores, Credentials from Web Browsers

Remote Process Instantiation via WinRM and PowerShell Script Block

Remote Services, Windows Remote Management

Linux Possible Append Command To At Allow Config File

At, Scheduled Task/Job

Domain Controller Discovery with Wmic

Remote System Discovery

Local Account Discovery With Wmic

Account Discovery, Local Account

Windows Modify Registry With MD5 Reg Key Name

Modify Registry

Print Processor Registry Autostart

Print Processors, Boot or Logon Autostart Execution

Windows Parent PID Spoofing with Explorer

Parent PID Spoofing, Access Token Manipulation

Linux Possible Access To Credential Files

/etc/passwd and /etc/shadow, OS Credential Dumping

Overwriting Accessibility Binaries

Event Triggered Execution, Accessibility Features

Linux Edit Cron Table Parameter

Cron, Scheduled Task/Job

Windows Impair Defense Disable PUA Protection

Disable or Modify Tools, Impair Defenses

Remote Desktop Process Running On System

Remote Desktop Protocol, Remote Services

Linux Disable Services

Service Stop

Disable ETW Through Registry

Disable or Modify Tools, Impair Defenses

Windows Steal Authentication Certificates - ESC1 Authentication

Steal or Forge Authentication Certificates, Use Alternate Authentication Material

Revil Registry Entry

Modify Registry

AdsiSearcher Account Discovery

Domain Account, Account Discovery

Disable Defender Enhanced Notification

Disable or Modify Tools, Impair Defenses

Remote System Discovery with Wmic

Remote System Discovery

Powershell Get LocalGroup Discovery with Script Block Logging

Permission Groups Discovery, Local Groups

Office Product Spawn CMD Process

Phishing, Spearphishing Attachment

Processes launching netsh

Disable or Modify System Firewall, Impair Defenses

Windows Impair Defense Disable Defender Protocol Recognition

Disable or Modify Tools, Impair Defenses

Windows Impair Defenses Disable HVCI

Disable or Modify Tools, Impair Defenses

Linux Persistence and Privilege Escalation Risk Behavior

Abuse Elevation Control Mechanism

Unloading AMSI via Reflection

Impair Defenses, PowerShell, Command and Scripting Interpreter

Linux Setuid Using Setcap Utility

Setuid and Setgid, Abuse Elevation Control Mechanism

Windows System File on Disk

Exploitation for Privilege Escalation

Disable UAC Remote Restriction

Bypass User Account Control, Abuse Elevation Control Mechanism

Powershell Fileless Script Contains Base64 Encoded Content

Command and Scripting Interpreter, Obfuscated Files or Information, PowerShell

Windows Process Injection Remote Thread

Process Injection, Portable Executable Injection

Linux Possible Access Or Modification Of sshd Config File

SSH Authorized Keys, Account Manipulation

Windows Steal Authentication Certificates Certificate Request

Steal or Forge Authentication Certificates

Windows Masquerading Explorer As Child Process

DLL Side-Loading, Hijack Execution Flow

Suspicious mshta child process

System Binary Proxy Execution, Mshta

Linux System Network Discovery

System Network Configuration Discovery

Windows Special Privileged Logon On Multiple Hosts

Account Discovery, SMB/Windows Admin Shares, Network Share Discovery

Windows LSA Secrets NoLMhash Registry

LSA Secrets

Detect RTLO In File Name

Right-to-Left Override, Masquerading

Elevated Group Discovery With Wmic

Permission Groups Discovery, Domain Groups

Windows Data Destruction Recursive Exec Files Deletion

Data Destruction

Windows Time Based Evasion

Virtualization/Sandbox Evasion, Time Based Evasion

Windows App Layer Protocol Wermgr Connect To NamedPipe

Application Layer Protocol

Windows Command Shell DCRat ForkBomb Payload

Windows Command Shell, Command and Scripting Interpreter

Remcos RAT File Creation in Remcos Folder

Screen Capture

Kerberos Pre-Authentication Flag Disabled in UserAccountControl

Steal or Forge Kerberos Tickets, AS-REP Roasting

Windows AD DSRM Account Changes

Account Manipulation

Windows Driver Inventory

Exploitation for Privilege Escalation

Windows PowerShell Get CIMInstance Remote Computer

PowerShell

Remote Process Instantiation via WMI

Windows Management Instrumentation

Windows Remote Service Rdpwinst Tool Execution

Remote Desktop Protocol, Remote Services

Windows Process Writing File to World Writable Path

Mshta

System User Discovery With Query

System Owner/User Discovery

Wermgr Process Create Executable File

Obfuscated Files or Information

Windows Njrat Fileless Storage via Registry

Fileless Storage, Obfuscated Files or Information

Spoolsv Suspicious Loaded Modules

Print Processors, Boot or Logon Autostart Execution

Allow Inbound Traffic In Firewall Rule

Remote Desktop Protocol, Remote Services

Suspicious Rundll32 PluginInit

System Binary Proxy Execution, Rundll32

Windows System User Privilege Discovery

System Owner/User Discovery

Extraction of Registry Hives

Security Account Manager, OS Credential Dumping

GetLocalUser with PowerShell

Account Discovery, Local Account

Linux Account Manipulation Of SSH Config and Keys

Data Destruction, File Deletion, Indicator Removal

Windows Privilege Escalation Suspicious Process Elevation

Exploitation for Privilege Escalation, Abuse Elevation Control Mechanism, Access Token Manipulation

Get WMIObject Group Discovery with Script Block Logging

Permission Groups Discovery, Local Groups

Windows WinLogon with Public Network Connection

Bootkit

Delete ShadowCopy With PowerShell

Inhibit System Recovery

Download Files Using Telegram

Ingress Tool Transfer

Linux Add User Account

Local Account, Create Account

Windows Impair Defense Add Xml Applocker Rules

Disable or Modify Tools, Impair Defenses

Excessive Usage Of Net App

Account Access Removal

Sdelete Application Execution

Data Destruction, File Deletion, Indicator Removal

Windows Phishing PDF File Executes URL Link

Spearphishing Attachment, Phishing

Network Connection Discovery With Netstat

System Network Connections Discovery

Windows Impair Defense Disable Win Defender Report Infection

Disable or Modify Tools, Impair Defenses

Windows Spearphishing Attachment Connect To None MS Office Domain

Spearphishing Attachment, Phishing

Windows File Transfer Protocol In Non-Common Process Path

Mail Protocols, Application Layer Protocol

Windows Modify Registry MaxConnectionPerServer

Modify Registry

Windows Phishing Outlook Drop Dll In FORM Dir

Phishing

Disabling SystemRestore In Registry

Inhibit System Recovery

Domain Group Discovery With Dsquery

Permission Groups Discovery, Domain Groups

GetAdGroup with PowerShell Script Block

Permission Groups Discovery, Domain Groups

Bcdedit Command Back To Normal Mode Boot

Inhibit System Recovery

Linux Doas Tool Execution

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Windows Get Local Admin with FindLocalAdminAccess

Account Discovery, Domain Account

Windows Impair Defense Configure App Install Control

Disable or Modify Tools, Impair Defenses

Linux Shred Overwrite Command

Data Destruction

Linux Change File Owner To Root

Linux and Mac File and Directory Permissions Modification, File and Directory Permissions Modification

MacOS plutil

Plist File Modification

Suspicious IcedID Rundll32 Cmdline

System Binary Proxy Execution, Rundll32

GetWmiObject User Account with PowerShell

Account Discovery, Local Account

Creation of lsass Dump with Taskmgr

LSASS Memory, OS Credential Dumping

Windows Modify Registry ProxyEnable

Modify Registry

Common Ransomware Notes

Data Destruction

Elevated Group Discovery With Net

Permission Groups Discovery, Domain Groups

Windows Remote Services Allow Remote Assistance

Remote Desktop Protocol, Remote Services

Windows Driver Load Non-Standard Path

Rootkit, Exploitation for Privilege Escalation

Detect Rundll32 Inline HTA Execution

System Binary Proxy Execution, Mshta

Windows AD ServicePrincipalName Added To Domain Account

Account Manipulation

Windows System LogOff Commandline

System Shutdown/Reboot

Windows App Layer Protocol Qakbot NamedPipe

Application Layer Protocol

Rundll32 Process Creating Exe Dll Files

System Binary Proxy Execution, Rundll32

Windows AD Same Domain SID History Addition

SID-History Injection, Access Token Manipulation

SAM Database File Access Attempt

Security Account Manager, OS Credential Dumping

Get WMIObject Group Discovery

Permission Groups Discovery, Local Groups

Ryuk Wake on LAN Command

Command and Scripting Interpreter, Windows Command Shell

Windows Modify Registry Auto Update Notif

Modify Registry

Windows Multi hop Proxy TOR Website Query

Mail Protocols, Application Layer Protocol

Windows Modify Registry DisAllow Windows App

Modify Registry

Windows UAC Bypass Suspicious Child Process

Abuse Elevation Control Mechanism, Bypass User Account Control

Suspicious MSBuild Rename

Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities, MSBuild

Windows PowerShell Add Module to Global Assembly Cache

Server Software Component, IIS Components

Windows MSExchange Management Mailbox Cmdlet Usage

Command and Scripting Interpreter, PowerShell

Windows Unsecured Outlook Credentials Access In Registry

Unsecured Credentials

Disable Defender BlockAtFirstSeen Feature

Disable or Modify Tools, Impair Defenses

Windows DLL Side-Loading Process Child Of Calc

DLL Side-Loading, Hijack Execution Flow

Process Execution via WMI

Windows Management Instrumentation

Windows Archive Collected Data via Rar

Archive via Utility, Archive Collected Data

Windows File Without Extension In Critical Folder

Data Destruction

Windows Service Create RemComSvc

Windows Service, Create or Modify System Process

Allow Inbound Traffic By Firewall Rule Registry

Remote Desktop Protocol, Remote Services

GetNetTcpconnection with PowerShell Script Block

System Network Connections Discovery

Windows Abused Web Services

Web Service

System Info Gathering Using Dxdiag Application

Gather Victim Host Information

Windows WMI Process And Service List

Windows Management Instrumentation

Windows Modify Registry Disable Toast Notifications

Modify Registry

Windows PowerShell Export PfxCertificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

Powershell COM Hijacking InprocServer32 Modification

Component Object Model Hijacking, Command and Scripting Interpreter, PowerShell

PowerShell Domain Enumeration

Command and Scripting Interpreter, PowerShell

Windows Defacement Modify Transcodedwallpaper File

Defacement

Windows Modify Registry Do Not Connect To Win Update

Modify Registry

Linux Stdout Redirection To Dev Null File

Disable or Modify System Firewall, Impair Defenses

Windows Change Default File Association For No File Ext

Change Default File Association, Event Triggered Execution

Disable Defender MpEngine Registry

Disable or Modify Tools, Impair Defenses

Windows Impair Defense Set Win Defender Smart Screen Level To Warn

Disable or Modify Tools, Impair Defenses

Windows Files and Dirs Access Rights Modification Via Icacls

Windows File and Directory Permissions Modification, File and Directory Permissions Modification

Powershell Disable Security Monitoring

Disable or Modify Tools, Impair Defenses

PowerShell Get LocalGroup Discovery

Permission Groups Discovery, Local Groups

Windows System Time Discovery W32tm Delay

System Time Discovery

Windows Process Injection Of Wermgr to Known Browser

Dynamic-link Library Injection, Process Injection

Executables Or Script Creation In Suspicious Path

Masquerading

Windows SOAPHound Binary Execution

Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery

Detect Exchange Web Shell

Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services

First Time Seen Running Windows Service

System Services, Service Execution

GetCurrent User with PowerShell Script Block

System Owner/User Discovery

3CX Supply Chain Attack Network Indicators

Compromise Software Supply Chain

Windows Remote Access Software BRC4 Loaded Dll

Remote Access Software, OS Credential Dumping

Windows AD Abnormal Object Access Activity

Account Discovery, Domain Account

Verclsid CLSID Execution

Verclsid, System Binary Proxy Execution

Suspicious WAV file in Appdata Folder

Screen Capture

Net Localgroup Discovery

Permission Groups Discovery, Local Groups

Get-DomainTrust with PowerShell

Domain Trust Discovery

Windows Multiple Accounts Deleted

Account Manipulation, Valid Accounts

Detect Rare Executables

User Execution

Windows Service Created with Suspicious Service Path

System Services, Service Execution

Windows Executable in Loaded Modules

Shared Modules

Linux Deletion Of Cron Jobs

Data Destruction, File Deletion, Indicator Removal

Windows Modify Registry LongPathsEnabled

Modify Registry

Rundll32 with no Command Line Arguments with Network

System Binary Proxy Execution, Rundll32

MS Scripting Process Loading WMI Module

Command and Scripting Interpreter, JavaScript

Exchange PowerShell Abuse via SSRF

Exploit Public-Facing Application, External Remote Services

Recon AVProduct Through Pwh or WMI

Gather Victim Host Information

Windows Modify Registry Disable Windows Security Center Notif

Modify Registry

Windows Unusual Count Of Users Failed To Authenticate From Process

Password Spraying, Brute Force

Living Off The Land Detection

Ingress Tool Transfer, Exploit Public-Facing Application, Command and Scripting Interpreter, External Remote Services

Windows AD Short Lived Server Object

Rogue Domain Controller

Windows Defender Exclusion Registry Entry

Disable or Modify Tools, Impair Defenses

Create Remote Thread In Shell Application

Process Injection

Clop Ransomware Known Service Name

Create or Modify System Process

Windows Exfiltration Over C2 Via Invoke RestMethod

Exfiltration Over C2 Channel

Windows Multiple Invalid Users Fail To Authenticate Using Kerberos

Password Spraying, Brute Force

Excessive number of taskhost processes

Command and Scripting Interpreter

Sc exe Manipulating Windows Services

Windows Service, Create or Modify System Process

CSC Net On The Fly Compilation

Compile After Delivery, Obfuscated Files or Information

Linux System Reboot Via System Request Key

System Shutdown/Reboot

Windows Process Injection In Non-Service SearchIndexer

Process Injection

Windows Modify Registry Reg Restore

Query Registry

Windows RDP Connection Successful

RDP Hijacking

Windows Bypass UAC via Pkgmgr Tool

Bypass User Account Control

Windows Modify Registry UpdateServiceUrlAlternate

Modify Registry

Unusually Long Command Line

Windows Registry Modification for Safe Mode Persistence

Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution

Credential Dumping via Symlink to Shadow Copy

NTDS, OS Credential Dumping

Linux At Application Execution

At, Scheduled Task/Job

Powershell Remote Services Add TrustedHost

Windows Remote Management, Remote Services

Windows Modify Registry Auto Minor Updates

Modify Registry

Services LOLBAS Execution Process Spawn

Create or Modify System Process, Windows Service

Detect Use of cmd exe to Launch Script Interpreters

Command and Scripting Interpreter, Windows Command Shell

SearchProtocolHost with no Command Line with Network

Process Injection

WinEvent Windows Task Scheduler Event Action Started

Scheduled Task

WMI Permanent Event Subscription - Sysmon

Windows Management Instrumentation Event Subscription, Event Triggered Execution

WinRM Spawning a Process

Exploit Public-Facing Application

Windows Computer Account Created by Computer Account

Steal or Forge Kerberos Tickets

Detect Excessive User Account Lockouts

Valid Accounts, Local Accounts

GetDomainGroup with PowerShell

Permission Groups Discovery, Domain Groups

Malicious Powershell Executed As A Service

System Services, Service Execution

GetAdGroup with PowerShell

Permission Groups Discovery, Domain Groups

Wmic Group Discovery

Permission Groups Discovery, Local Groups

Suspicious Scheduled Task from Public Directory

Scheduled Task, Scheduled Task/Job

Allow Operation with Consent Admin

Abuse Elevation Control Mechanism

Windows Access Token Manipulation SeDebugPrivilege

Create Process with Token, Access Token Manipulation

RunDLL Loading DLL By Ordinal

System Binary Proxy Execution, Rundll32

Active Directory Lateral Movement Identified

Exploitation of Remote Services

Windows Security Account Manager Stopped

Service Stop

Windows Admon Group Policy Object Created

Domain or Tenant Policy Modification, Group Policy Modification

Windows Process Commandline Discovery

Process Discovery

Windows Snake Malware Kernel Driver Comadmin

Kernel Modules and Extensions

Ryuk Test Files Detected

Data Encrypted for Impact

SecretDumps Offline NTDS Dumping Tool

NTDS, OS Credential Dumping

CMD Carry Out String Command Parameter

Windows Command Shell, Command and Scripting Interpreter

Windows AD Replication Request Initiated from Unsanctioned Location

DCSync, OS Credential Dumping

Windows System Shutdown CommandLine

System Shutdown/Reboot

Fsutil Zeroing File

Indicator Removal

ConnectWise ScreenConnect Path Traversal Windows SACL

Exploit Public-Facing Application

Detection of tools built by NirSoft

Software Deployment Tools

Windows Scheduled Task with Highest Privileges

Scheduled Task/Job, Scheduled Task

Office Application Spawn Regsvr32 process

Phishing, Spearphishing Attachment

Detect Webshell Exploit Behavior

Server Software Component, Web Shell

Windows Impair Defense Overide Win Defender Phishing Filter

Disable or Modify Tools, Impair Defenses

Sqlite Module In Temp Folder

Data from Local System

Windows Service Stop Win Updates

Service Stop

Windows System User Discovery Via Quser

System Owner/User Discovery

Windows Multiple Account Passwords Changed

Account Manipulation, Valid Accounts

Rundll32 LockWorkStation

System Binary Proxy Execution, Rundll32

Creation of Shadow Copy

NTDS, OS Credential Dumping

Non Firefox Process Access Firefox Profile Dir

Credentials from Password Stores, Credentials from Web Browsers

Linux High Frequency Of File Deletion In Boot Folder

Data Destruction, File Deletion, Indicator Removal

GetNetTcpconnection with PowerShell

System Network Connections Discovery

Windows PowerShell ScheduleTask

Scheduled Task, PowerShell, Command and Scripting Interpreter

Network Discovery Using Route Windows App

System Network Configuration Discovery, Internet Connection Discovery

Network Share Discovery Via Dir Command

Network Share Discovery

Windows Administrative Shares Accessed On Multiple Hosts

Network Share Discovery

Powershell Load Module in Meterpreter

Command and Scripting Interpreter, PowerShell

Excessive Usage Of SC Service Utility

System Services, Service Execution

Unknown Process Using The Kerberos Protocol

Use Alternate Authentication Material

Windows Excessive Disabled Services Event

Disable or Modify Tools, Impair Defenses

Detect Excessive Account Lockouts From Endpoint

Valid Accounts, Domain Accounts

Windows Indirect Command Execution Via Series Of Forfiles

Indirect Command Execution

Linux Sudoers Tmp File Creation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Possible Append Cronjob Entry on Existing Cronjob File

Cron, Scheduled Task/Job

Detect Outlook exe writing a zip file

Phishing, Spearphishing Attachment

Windows Boot or Logon Autostart Execution In Startup Folder

Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution

Disabling Defender Services

Disable or Modify Tools, Impair Defenses

WSReset UAC Bypass

Bypass User Account Control, Abuse Elevation Control Mechanism

Windows Impair Defense Disable Defender Firewall And Network

Disable or Modify Tools, Impair Defenses

Modify ACL permission To Files Or Folder

File and Directory Permissions Modification

Windows Disable Shutdown Button Through Registry

Modify Registry

Batch File Write to System32

User Execution, Malicious File

Disabling Windows Local Security Authority Defences via Registry

Modify Authentication Process

Windows Create Local Account

Local Account, Create Account

Windows Credentials from Password Stores Chrome LocalState Access

Query Registry

Windows Masquerading Msdtc Process

Masquerading

Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM

Password Spraying, Brute Force

Windows Disable Change Password Through Registry

Modify Registry

User Discovery With Env Vars PowerShell

System Owner/User Discovery

MS Scripting Process Loading Ldap Module

Command and Scripting Interpreter, JavaScript

Windows Common Abused Cmd Shell Risk Behavior

File and Directory Permissions Modification, System Network Connections Discovery, System Owner/User Discovery, System Shutdown/Reboot, System Network Config...

Windows AD Domain Controller Promotion

Rogue Domain Controller

Windows AD Privileged Object Access Activity

Account Discovery, Domain Account

Windows Unusual Count Of Users Remotely Failed To Auth From Host

Password Spraying, Brute Force

Malicious PowerShell Process With Obfuscation Techniques

Command and Scripting Interpreter, PowerShell

Windows InstallUtil Credential Theft

InstallUtil, System Binary Proxy Execution

Registry Keys Used For Privilege Escalation

Image File Execution Options Injection, Event Triggered Execution

Office Product Spawning Rundll32 with no DLL

Phishing, Spearphishing Attachment

Windows Credentials from Password Stores Creation

Credentials from Password Stores

Linux Setuid Using Chmod Utility

Setuid and Setgid, Abuse Elevation Control Mechanism

Disabling Remote User Account Control

Bypass User Account Control, Abuse Elevation Control Mechanism

Windows AD Short Lived Domain Account ServicePrincipalName

Account Manipulation

Windows Application Layer Protocol RMS Radmin Tool Namedpipe

Application Layer Protocol

Suspicious writes to windows Recycle Bin

Masquerading

Powershell Remove Windows Defender Directory

Disable or Modify Tools, Impair Defenses

Windows File Share Discovery With Powerview

Network Share Discovery

Windows Vulnerable Driver Loaded

Windows Service

Powershell Fileless Process Injection via GetProcAddress

Command and Scripting Interpreter, Process Injection, PowerShell

Windows Computer Account With SPN

Steal or Forge Kerberos Tickets

SLUI Spawning a Process

Bypass User Account Control, Abuse Elevation Control Mechanism

PowerShell Loading DotNET into Memory via Reflection

Command and Scripting Interpreter, PowerShell

Linux Deletion of SSL Certificate

Data Destruction, File Deletion, Indicator Removal

Windows Impair Defenses Disable Win Defender Auto Logging

Disable or Modify Tools, Impair Defenses

Linux Deletion Of Init Daemon Script

Data Destruction, File Deletion, Indicator Removal

Disabling ControlPanel

Disable or Modify Tools, Impair Defenses, Modify Registry

Network Traffic to Active Directory Web Services Protocol

Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery

GetWmiObject Ds Group with PowerShell Script Block

Permission Groups Discovery, Domain Groups

Process Kill Base On File Path

Disable or Modify Tools, Impair Defenses

Windows PowerShell Export Certificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

Windows Diskshadow Proxy Execution

System Binary Proxy Execution

Get-ForestTrust with PowerShell

Domain Trust Discovery

SilentCleanup UAC Bypass

Bypass User Account Control, Abuse Elevation Control Mechanism

Windows Linked Policies In ADSI Discovery

Domain Account, Account Discovery

Windows High File Deletion Frequency

Data Destruction

Print Spooler Adding A Printer Driver

Print Processors, Boot or Logon Autostart Execution

Creation of Shadow Copy with wmic and powershell

NTDS, OS Credential Dumping

Windows Credentials from Password Stores Chrome Extension Access

Query Registry

WinEvent Scheduled Task Created to Spawn Shell

Scheduled Task, Scheduled Task/Job

Nishang PowershellTCPOneLine

Command and Scripting Interpreter, PowerShell

IcedID Exfiltrated Archived File Creation

Archive via Utility, Archive Collected Data

Linux Service Restarted

Systemd Timers, Scheduled Task/Job

PowerShell Start or Stop Service

PowerShell

Recon Using WMI Class

Gather Victim Host Information, PowerShell

Linux Doas Conf File Creation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Registry Keys for Creating SHIM Databases

Application Shimming, Event Triggered Execution

Windows Known Abused DLL Created

DLL Search Order Hijacking, DLL Side-Loading, Hijack Execution Flow

Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials

Password Spraying, Brute Force

Windows Modify Registry Suppress Win Defender Notif

Modify Registry

Windows System Network Config Discovery Display DNS

System Network Configuration Discovery

Linux Possible Cronjob Modification With Editor

Cron, Scheduled Task/Job

Scheduled Task Deleted Or Created via CMD

Scheduled Task, Scheduled Task/Job

Windows ConHost with Headless Argument

Hidden Window, Run Virtual Instance

Allow File And Printing Sharing In Firewall

Disable or Modify Cloud Firewall, Impair Defenses

NLTest Domain Trust Discovery

Domain Trust Discovery

Linux Deletion Of Services

Data Destruction, File Deletion, Indicator Removal

Windows System Network Connections Discovery Netsh

System Network Connections Discovery

Linux NOPASSWD Entry In Sudoers File

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Reg exe Manipulating Windows Services Registry Keys

Services Registry Permissions Weakness, Hijack Execution Flow

Hide User Account From Sign-In Screen

Disable or Modify Tools, Impair Defenses

Windows Scheduled Task Created Via XML

Scheduled Task, Scheduled Task/Job

Short Lived Scheduled Task

Scheduled Task

Office Product Spawning CertUtil

Phishing, Spearphishing Attachment

MacOS LOLbin

Unix Shell, Command and Scripting Interpreter

Windows Multiple Invalid Users Failed To Authenticate Using NTLM

Password Spraying, Brute Force

Linux Sudo OR Su Execution

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Windows PowerShell WMI Win32 ScheduledJob

PowerShell, Command and Scripting Interpreter

Change Default File Association

Change Default File Association, Event Triggered Execution

PowerShell Enable PowerShell Remoting

PowerShell, Command and Scripting Interpreter

PowerShell Start-BitsTransfer

BITS Jobs

Windows PowerView AD Access Control List Enumeration

Domain Accounts, Permission Groups Discovery

Suspicious Computer Account Name Change

Valid Accounts, Domain Accounts

Spoolsv Writing a DLL - Sysmon

Print Processors, Boot or Logon Autostart Execution

Windows SqlWriter SQLDumper DLL Sideload

DLL Side-Loading

Windows System Discovery Using Qwinsta

System Owner/User Discovery

Remote WMI Command Attempt

Windows Management Instrumentation

Windows Group Policy Object Created

Domain or Tenant Policy Modification, Group Policy Modification, Domain Accounts

Remote Process Instantiation via WMI and PowerShell

Windows Management Instrumentation

Windows Defender ASR Audit Events

Command and Scripting Interpreter, Spearphishing Attachment, Spearphishing Link

Windows Find Domain Organizational Units with GetDomainOU

Account Discovery, Domain Account

7zip CommandLine To SMB Share Path

Archive via Utility, Archive Collected Data

Disabling CMD Application

Disable or Modify Tools, Impair Defenses, Modify Registry

Spike in File Writes

Windows Computer Account Requesting Kerberos Ticket

Steal or Forge Kerberos Tickets

Suspicious Driver Loaded Path

Windows Service, Create or Modify System Process

Executable File Written in Administrative SMB Share

Remote Services, SMB/Windows Admin Shares

Windows Export Certificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

Windows Processes Killed By Industroyer2 Malware

Service Stop

Suspicious Copy on System32

Rename System Utilities, Masquerading

Office Document Creating Schedule Task

Phishing, Spearphishing Attachment

Windows Modify Registry USeWuServer

Modify Registry

Suspicious PlistBuddy Usage

Launch Agent, Create or Modify System Process

Network Connection Discovery With Arp

System Network Connections Discovery

Windows Credentials in Registry Reg Query

Credentials in Registry, Unsecured Credentials

Windows Forest Discovery with GetForestDomain

Account Discovery, Domain Account

Windows Steal Authentication Certificates CryptoAPI

Steal or Forge Authentication Certificates

Msmpeng Application DLL Side Loading

DLL Side-Loading, Hijack Execution Flow

Suspicious Kerberos Service Ticket Request

Valid Accounts, Domain Accounts

Windows Service Stop Via Net and SC Application

Service Stop

Prevent Automatic Repair Mode using Bcdedit

Inhibit System Recovery

Windows Rapid Authentication On Multiple Hosts

Security Account Manager

WinEvent Scheduled Task Created Within Public Path

Scheduled Task, Scheduled Task/Job

Kerberoasting spn request with RC4 encryption

Steal or Forge Kerberos Tickets, Kerberoasting

Windows User Execution Malicious URL Shortcut File

Malicious File, User Execution

Windows Autostart Execution LSASS Driver Registry Modification

LSASS Driver

Windows AD Replication Request Initiated by User Account

DCSync, OS Credential Dumping

Windows Modify Registry DontShowUI

Modify Registry

Suspicious Process With Discord DNS Query

Visual Basic, Command and Scripting Interpreter

Windows Modify Registry DisableRemoteDesktopAntiAlias

Modify Registry

Windows Credentials from Password Stores Deletion

Credentials from Password Stores

Linux File Creation In Profile Directory

Unix Shell Configuration Modification, Event Triggered Execution

Windows Multiple Users Failed To Authenticate Using Kerberos

Password Spraying, Brute Force

Linux Deleting Critical Directory Using RM Command

Data Destruction

Windows Alternate DataStream - Process Execution

Hide Artifacts, NTFS File Attributes

Windows Service Stop By Deletion

Service Stop

Trickbot Named Pipe

Process Injection

Windows Deleted Registry By A Non Critical Process File Path

Modify Registry

Windows Enable Win32 ScheduledJob via Registry

Scheduled Task

Windows AD SID History Attribute Modified

Access Token Manipulation, SID-History Injection

W3WP Spawning Shell

Server Software Component, Web Shell

Powershell Processing Stream Of Data

Command and Scripting Interpreter, PowerShell

Windows Local Administrator Credential Stuffing

Brute Force, Credential Stuffing

Windows WMI Process Call Create

Windows Management Instrumentation

NET Profiler UAC bypass

Bypass User Account Control, Abuse Elevation Control Mechanism

Enumerate Users Local Group Using Telegram

Account Discovery

Windows Modify Registry No Auto Update

Modify Registry

Unusual Number of Kerberos Service Tickets Requested

Steal or Forge Kerberos Tickets, Kerberoasting

Unload Sysmon Filter Driver

Disable or Modify Tools, Impair Defenses

Windows AppLocker Block Events

System Binary Proxy Execution

Disabling Task Manager

Disable or Modify Tools, Impair Defenses

Windows Command and Scripting Interpreter Hunting Path Traversal

Command and Scripting Interpreter

Linux Possible Ssh Key File Creation

SSH Authorized Keys, Account Manipulation

WMI Recon Running Process Or Services

Gather Victim Host Information

Detect New Local Admin account

Local Account, Create Account

ICACLS Grant Command

File and Directory Permissions Modification

Child Processes of Spoolsv exe

Exploitation for Privilege Escalation

Windows Modify Registry Default Icon Setting

Modify Registry

Detect SharpHound Command-Line Arguments

Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery

Windows Modify Registry WuServer

Modify Registry

Windows Suspect Process With Authentication Traffic

Account Discovery, Domain Account, User Execution, Malicious File

FodHelper UAC Bypass

Modify Registry, Bypass User Account Control, Abuse Elevation Control Mechanism

System User Discovery With Whoami

System Owner/User Discovery

Windows Hijack Execution Flow Version Dll Side Load

DLL Search Order Hijacking, Hijack Execution Flow

Schedule Task with Rundll32 Command Trigger

Scheduled Task/Job

GetWmiObject User Account with PowerShell Script Block

Account Discovery, Local Account, PowerShell

Windows Modify Registry Risk Behavior

Modify Registry

Process Creating LNK file in Suspicious Location

Phishing, Spearphishing Link

Schedule Task with HTTP Command Arguments

Scheduled Task/Job

Windows Impair Defense Change Win Defender Health Check Intervals

Disable or Modify Tools, Impair Defenses

Windows BootLoader Inventory

System Firmware, Pre-OS Boot

Detect SharpHound File Modifications

Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery

Domain Controller Discovery with Nltest

Remote System Discovery

Windows IIS Components Module Failed to Load

Server Software Component, IIS Components

Linux Install Kernel Module Using Modprobe Utility

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Linux Insert Kernel Module Using Insmod Utility

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Excessive Usage of NSLOOKUP App

Exfiltration Over Alternative Protocol

GetDomainGroup with PowerShell Script Block

Permission Groups Discovery, Domain Groups

Linux Add Files In Known Crontab Directories

Cron, Scheduled Task/Job

Detect WMI Event Subscription Persistence

Windows Management Instrumentation Event Subscription, Event Triggered Execution

Windows Impair Defense Disable Realtime Signature Delivery

Disable or Modify Tools, Impair Defenses

Rundll32 DNSQuery

System Binary Proxy Execution, Rundll32

Windows Remote Access Software RMS Registry

Remote Access Software

Detect SharpHound Usage

Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery

Windows Service Deletion In Registry

Service Stop

Windows Scheduled Task Service Spawned Shell

Scheduled Task, Command and Scripting Interpreter

Linux Stop Services

Service Stop

Disable Registry Tool

Disable or Modify Tools, Impair Defenses, Modify Registry

Linux Preload Hijack Library Calls

Dynamic Linker Hijacking, Hijack Execution Flow

Windows Proxy Via Netsh

Internal Proxy, Proxy

Short Lived Windows Accounts

Local Account, Create Account

Interactive Session on Remote Endpoint with PowerShell

Remote Services, Windows Remote Management

Windows Impair Defense Disable Win Defender Gen reports

Disable or Modify Tools, Impair Defenses

System Information Discovery Detection

System Information Discovery

Windows Kerberos Local Successful Logon

Steal or Forge Kerberos Tickets

Windows Modify Registry Regedit Silent Reg Import

Modify Registry

Office Application Drop Executable

Phishing, Spearphishing Attachment

Disable Defender Submit Samples Consent Feature

Disable or Modify Tools, Impair Defenses

Windows Regsvr32 Renamed Binary

Regsvr32, System Binary Proxy Execution

Get-ForestTrust with PowerShell Script Block

Domain Trust Discovery, PowerShell

Linux Indicator Removal Service File Deletion

File Deletion, Indicator Removal

Powershell Creating Thread Mutex

Obfuscated Files or Information, Indicator Removal from Tools, PowerShell

Windows Replication Through Removable Media

Replication Through Removable Media

MSHTML Module Load in Office Product

Phishing, Spearphishing Attachment

Suspicious mshta spawn

System Binary Proxy Execution, Mshta

Samsam Test File Write

Data Encrypted for Impact

MacOS - Re-opened Applications

Vbscript Execution Using Wscript App

Visual Basic, Command and Scripting Interpreter

Windows PowerShell IIS Components WebGlobalModule Usage

Server Software Component, IIS Components

Suspicious Event Log Service Behavior

Indicator Removal, Clear Windows Event Logs

Remote Process Instantiation via WMI and PowerShell Script Block

Windows Management Instrumentation

Uninstall App Using MsiExec

Msiexec, System Binary Proxy Execution

Linux Kworker Process In Writable Process Path

Masquerade Task or Service, Masquerading

Spoolsv Spawning Rundll32

Print Processors, Boot or Logon Autostart Execution

Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials

Password Spraying, Brute Force

Svchost LOLBAS Execution Process Spawn

Scheduled Task/Job, Scheduled Task

PowerShell Invoke WmiExec Usage

Windows Management Instrumentation

Office Product Spawning Wmic

Phishing, Spearphishing Attachment

Windows Impair Defense Change Win Defender Tracing Level

Disable or Modify Tools, Impair Defenses

Suspicious microsoft workflow compiler rename

Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities

Powershell Remote Thread To Known Windows Process

Process Injection

Windows Process With NamedPipe CommandLine

Process Injection

Disabling NoRun Windows App

Disable or Modify Tools, Impair Defenses, Modify Registry

WBAdmin Delete System Backups

Inhibit System Recovery

Windows Privilege Escalation User Process Spawn System Process

Exploitation for Privilege Escalation, Abuse Elevation Control Mechanism, Access Token Manipulation

Windows Get-AdComputer Unconstrained Delegation Discovery

Remote System Discovery

Windows Indicator Removal Via Rmdir

Indicator Removal

Windows AdFind Exe

Remote System Discovery

Resize ShadowStorage volume

Inhibit System Recovery

Powershell Enable SMB1Protocol Feature

Obfuscated Files or Information, Indicator Removal from Tools

Rundll32 Shimcache Flush

Modify Registry

Windows PowerView SPN Discovery

Steal or Forge Kerberos Tickets, Kerberoasting

Remote System Discovery with Dsquery

Remote System Discovery

Wbemprox COM Object Execution

System Binary Proxy Execution, CMSTP

Malicious PowerShell Process - Execution Policy Bypass

Command and Scripting Interpreter, PowerShell

SchCache Change By App Connect And Create ADSI Object

Domain Account, Account Discovery

Windows Modify Registry DisableSecuritySettings

Modify Registry

Windows Modify Registry EnableLinkedConnections

Modify Registry

Windows Remote Services Rdp Enable

Remote Desktop Protocol, Remote Services

Windows SIP WinVerifyTrust Failed Trust Validation

SIP and Trust Provider Hijacking

Hiding Files And Directories With Attrib exe

File and Directory Permissions Modification, Windows File and Directory Permissions Modification

GetDomainController with PowerShell Script Block

Remote System Discovery

Windows Impair Defense Delete Win Defender Profile Registry

Disable or Modify Tools, Impair Defenses

Windows Snake Malware Service Create

Kernel Modules and Extensions, Service Execution

Time Provider Persistence Registry

Time Providers, Boot or Logon Autostart Execution

Windows Command and Scripting Interpreter Path Traversal Exec

Command and Scripting Interpreter

Screensaver Event Trigger Execution

Event Triggered Execution, Screensaver

ConnectWise ScreenConnect Path Traversal

Exploit Public-Facing Application

Suspicious Process DNS Query Known Abuse Web Services

Visual Basic, Command and Scripting Interpreter

GetLocalUser with PowerShell Script Block

Account Discovery, Local Account, PowerShell

MSBuild Suspicious Spawned By Script Process

MSBuild, Trusted Developer Utilities Proxy Execution

Windows Snake Malware Registry Modification wav OpenWithProgIds

Modify Registry

Windows Modify Registry Tamper Protection

Modify Registry

Windows Credentials from Password Stores Chrome Login Data Access

Query Registry

Windows Service Create Kernel Mode Driver

Windows Service, Create or Modify System Process, Exploitation for Privilege Escalation

Windows Steal or Forge Kerberos Tickets Klist

Steal or Forge Kerberos Tickets

Windows Registry Delete Task SD

Scheduled Task, Impair Defenses

Suspicious DLLHost no Command Line Arguments

Process Injection

Windows AD Domain Controller Audit Policy Disabled

Disable or Modify Tools

Remote Process Instantiation via DCOM and PowerShell Script Block

Remote Services, Distributed Component Object Model

Suspicious Image Creation In Appdata Folder

Screen Capture

Mmc LOLBAS Execution Process Spawn

Remote Services, Distributed Component Object Model, MMC

GetDomainComputer with PowerShell Script Block

Remote System Discovery

Detect Certify With PowerShell Script Block Logging

Steal or Forge Authentication Certificates, Command and Scripting Interpreter, PowerShell

PowerShell - Connect To Internet With Hidden Window

PowerShell, Command and Scripting Interpreter

Windows Mshta Execution In Registry

Mshta

Execute Javascript With Jscript COM CLSID

Command and Scripting Interpreter, Visual Basic

Sdclt UAC Bypass

Bypass User Account Control, Abuse Elevation Control Mechanism

Windows AD DSRM Password Reset

Account Manipulation

Impacket Lateral Movement smbexec CommandLine Parameters

Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service

USN Journal Deletion

Indicator Removal

Excessive File Deletion In WinDefender Folder

Data Destruction

Office Document Executing Macro Code

Phishing, Spearphishing Attachment

Disabled Kerberos Pre-Authentication Discovery With PowerView

Steal or Forge Kerberos Tickets, AS-REP Roasting

Windows ClipBoard Data via Get-ClipBoard

Clipboard Data

Domain Group Discovery With Wmic

Permission Groups Discovery, Domain Groups

Remote System Discovery with Net

Remote System Discovery

Potentially malicious code on commandline

Windows Command Shell

Suspicious Process File Path

Create or Modify System Process

Revil Common Exec Parameter

User Execution

Office Document Spawned Child Process To Download

Phishing, Spearphishing Attachment

Windows Unusual Count Of Users Failed To Authenticate Using NTLM

Password Spraying, Brute Force

Windows Multiple Accounts Disabled

Account Manipulation, Valid Accounts

Windows Disable Memory Crash Dump

Data Destruction

Kerberos Pre-Authentication Flag Disabled with PowerShell

Steal or Forge Kerberos Tickets, AS-REP Roasting

Windows IIS Components New Module Added

Server Software Component, IIS Components

Wsmprovhost LOLBAS Execution Process Spawn

Remote Services, Windows Remote Management

Windows Modify Registry Qakbot Binary Data Registry

Modify Registry

Windows Modify Registry Disabling WER Settings

Modify Registry

Detect AzureHound File Modifications

Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery

PowerShell WebRequest Using Memory Stream

PowerShell, Ingress Tool Transfer, Fileless Storage

Windows Domain Admin Impersonation Indicator

Steal or Forge Kerberos Tickets

Enable WDigest UseLogonCredential Registry

Modify Registry, OS Credential Dumping

Domain Group Discovery with Adsisearcher

Permission Groups Discovery, Domain Groups

Windows PowerSploit GPP Discovery

Unsecured Credentials, Group Policy Preferences

Jscript Execution Using Cscript App

Command and Scripting Interpreter, JavaScript

GetWmiObject DS User with PowerShell Script Block

Domain Account, Account Discovery

Permission Modification using Takeown App

File and Directory Permissions Modification

Rundll32 CreateRemoteThread In Browser

Process Injection

Suspicious msbuild path

Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities, MSBuild

Suspicious GPUpdate no Command Line Arguments

Process Injection

Office Product Spawning BITSAdmin

Phishing, Spearphishing Attachment

PowerShell 4104 Hunting

Command and Scripting Interpreter, PowerShell

Windows Steal Authentication Certificates - ESC1 Abuse

Steal or Forge Authentication Certificates

Windows MOVEit Transfer Writing ASPX

Exploit Public-Facing Application, External Remote Services

Windows Known GraphicalProton Loaded Modules

DLL Side-Loading, Hijack Execution Flow

Detect Empire with PowerShell Script Block Logging

Command and Scripting Interpreter, PowerShell

Linux File Created In Kernel Driver Directory

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Unusual Number of Remote Endpoint Authentication Events

Valid Accounts

Script Execution via WMI

Windows Management Instrumentation

Check Elevated CMD using whoami

System Owner/User Discovery

Get DomainPolicy with Powershell Script Block

Password Policy Discovery

Windows Steal Authentication Certificates CS Backup

Steal or Forge Authentication Certificates

Windows Event For Service Disabled

Disable or Modify Tools, Impair Defenses

Windows Steal Authentication Certificates Certificate Issued

Steal or Forge Authentication Certificates

Firewall Allowed Program Enable

Disable or Modify System Firewall, Impair Defenses

Windows Mark Of The Web Bypass

Mark-of-the-Web Bypass

Disabling FolderOptions Windows Feature

Disable or Modify Tools, Impair Defenses

Windows Raw Access To Master Boot Record Drive

Disk Structure Wipe, Disk Wipe

Windows DLL Search Order Hijacking Hunt with Sysmon

DLL Search Order Hijacking, Hijack Execution Flow

Sunburst Correlation DLL and Network Event

Exploitation for Client Execution

Potential password in username

Local Accounts, Credentials In Files

Windows AD Short Lived Domain Controller SPN Attribute

Rogue Domain Controller

Linux Impair Defenses Process Kill

Disable or Modify Tools, Impair Defenses

Windows AD Cross Domain SID History Addition

SID-History Injection, Access Token Manipulation

Windows Cached Domain Credentials Reg Query

Cached Domain Credentials, OS Credential Dumping

Windows Input Capture Using Credential UI Dll

GUI Input Capture, Input Capture

Windows Impair Defense Delete Win Defender Context Menu

Disable or Modify Tools, Impair Defenses

Windows Large Number of Computer Service Tickets Requested

Network Share Discovery, Valid Accounts

LOLBAS With Network Traffic

Ingress Tool Transfer, Exfiltration Over Web Service, System Binary Proxy Execution

Disable Windows App Hotkeys

Disable or Modify Tools, Impair Defenses, Modify Registry

ServicePrincipalNames Discovery with PowerShell

Kerberoasting

Windows Modify Registry ProxyServer

Modify Registry

Schtasks used for forcing a reboot

Scheduled Task, Scheduled Task/Job

Suspicious Linux Discovery Commands

Unix Shell

Windows Modify Registry Disable Win Defender Raw Write Notif

Modify Registry

Windows Impair Defense Disable Win Defender Compute File Hashes

Disable or Modify Tools, Impair Defenses

Windows PowerView Unconstrained Delegation Discovery

Remote System Discovery

GetDomainComputer with PowerShell

Remote System Discovery

Windows Gather Victim Host Information Camera

Hardware, Gather Victim Host Information

Windows Drivers Loaded by Signature

Rootkit, Exploitation for Privilege Escalation

Windows Modify System Firewall with Notable Process Path

Disable or Modify System Firewall, Impair Defenses

Windows Registry Payload Injection

Obfuscated Files or Information, Fileless Storage

GetAdComputer with PowerShell

Remote System Discovery

Recursive Delete of Directory In Batch CMD

File Deletion, Indicator Removal

Windows DLL Side-Loading In Calc

DLL Side-Loading, Hijack Execution Flow

Windows Gather Victim Identity SAM Info

Credentials, Gather Victim Identity Information

Linux High Frequency Of File Deletion In Etc Folder

Data Destruction, File Deletion, Indicator Removal

Wmiprsve LOLBAS Execution Process Spawn

Windows Management Instrumentation

ETW Registry Disabled

Indicator Blocking, Trusted Developer Utilities Proxy Execution, Impair Defenses

Windows PowerView Constrained Delegation Discovery

Remote System Discovery

GetCurrent User with PowerShell

System Owner/User Discovery

User Discovery With Env Vars PowerShell Script Block

System Owner/User Discovery

Logon Script Event Trigger Execution

Boot or Logon Initialization Scripts, Logon Script (Windows)

Windows Indirect Command Execution Via pcalua

Indirect Command Execution

Auto Admin Logon Registry Entry

Credentials in Registry, Unsecured Credentials

Windows KrbRelayUp Service Creation

Windows Service

Windows Impair Defense Deny Security Software With Applocker

Disable or Modify Tools, Impair Defenses

Suspicious Process Executed From Container File

Malicious File, Masquerade File Type

Windows ISO LNK File Creation

Spearphishing Attachment, Phishing, Malicious Link, User Execution

Windows Modify Registry Disable WinDefender Notifications

Modify Registry

Get ADUserResultantPasswordPolicy with Powershell Script Block

Password Policy Discovery

Remote System Discovery with Adsisearcher

Remote System Discovery

Powershell Execute COM Object

Component Object Model Hijacking, Event Triggered Execution, PowerShell

Get DomainUser with PowerShell Script Block

Domain Account, Account Discovery

Mshta spawning Rundll32 OR Regsvr32 Process

System Binary Proxy Execution, Mshta

Shim Database Installation With Suspicious Parameters

Application Shimming, Event Triggered Execution

Windows Mimikatz Crypto Export File Extensions

Steal or Forge Authentication Certificates

CHCP Command Execution

Command and Scripting Interpreter

Windows SIP Provider Inventory

SIP and Trust Provider Hijacking

Mailsniper Invoke functions

Email Collection, Local Email Collection

Disable Defender Spynet Reporting

Disable or Modify Tools, Impair Defenses

Windows Snake Malware File Modification Crmlog

Obfuscated Files or Information

XMRIG Driver Loaded

Windows Service, Create or Modify System Process

CMLUA Or CMSTPLUA UAC Bypass

System Binary Proxy Execution, CMSTP

Windows PowerShell Disable HTTP Logging

Impair Defenses, Disable Windows Event Logging, Server Software Component, IIS Components

Disabling Firewall with Netsh

Disable or Modify Tools, Impair Defenses

Suspicious microsoft workflow compiler usage

Trusted Developer Utilities Proxy Execution

Windows IIS Components Get-WebGlobalModule Module Query

IIS Components, Server Software Component

Windows LOLBAS Executed As Renamed File

Masquerading, Rename System Utilities, Rundll32

Windows LOLBAS Executed Outside Expected Path

Masquerading, Match Legitimate Name or Location, Rundll32

Windows Known Abused DLL Loaded Suspiciously

DLL Search Order Hijacking, DLL Side-Loading, Hijack Execution Flow

Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path

Masquerading, Rename System Utilities

Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path

Masquerading, Rename System Utilities

Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path

Masquerading, Rename System Utilities

Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path

Masquerading, Rename System Utilities

Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path

Masquerading, Rename System Utilities

Windows Rename System Utilities At exe LOLBAS in Non Standard Path

Masquerading, Rename System Utilities

Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path

Masquerading, Rename System Utilities

Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path

Masquerading, Rename System Utilities

Windows AppLocker Privilege Escalation via Unauthorized Bypass

System Binary Proxy Execution

Windows Powershell DownloadString

Command and Scripting Interpreter, PowerShell, Ingress Tool Transfer

Windows Multiple NTLM Null Domain Authentications

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Destinations By Source

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Destinations By User

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Users By Source

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Users By Destination

Brute Force, Password Spraying

Impacket Lateral Movement WMIExec Commandline Parameters

Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service

Windows Screen Capture Via Powershell

Screen Capture

Possible Lateral Movement PowerShell Spawn

Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...

ServicePrincipalNames Discovery with PowerShell

Kerberoasting

Impacket Lateral Movement smbexec CommandLine Parameters

Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service

Detect PowerShell Applications Spawning cmd exe

Command and Scripting Interpreter

Detect Prohibited Office Applications Spawning cmd exe

Command and Scripting Interpreter

Detect Prohibited Browsers Spawning cmd exe

Command and Scripting Interpreter

Detect Password Spray Attack Behavior From Source

Password Spraying, Brute Force

Detect Password Spray Attack Behavior On User

Password Spraying, Brute Force

Create Local Admin Accounts Using Net Exe

Local Account, Create Account

Create Local User Accounts Using Net Exe

Local Account, Create Account

Deleting Shadow Copies

Inhibit System Recovery

Windows PowerSploit GPP Discovery

Unsecured Credentials, Group Policy Preferences

Windows File Share Discovery With Powerview

Unsecured Credentials, Group Policy Preferences

Windows Default Group Policy Object Modified with GPME

Domain or Tenant Policy Modification, Group Policy Modification

Windows Findstr GPP Discovery

Unsecured Credentials, Group Policy Preferences

Windows Network Share Interaction With Net

Network Share Discovery, Data from Network Shared Drive

Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView

Steal or Forge Kerberos Tickets, AS-REP Roasting

Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser

Steal or Forge Kerberos Tickets, AS-REP Roasting

Office Product Spawning Windows Script Host

Phishing, Spearphishing Attachment

Windows Exchange PowerShell Module Usage

Command and Scripting Interpreter, PowerShell

Windows COM Hijacking InprocServer32 Modification

Component Object Model Hijacking, Event Triggered Execution

Windows Execute Arbitrary Commands with MSDT

System Binary Proxy Execution

Windows Odbcconf Load Response File

Odbcconf, System Binary Proxy Execution

Windows Ingress Tool Transfer Using Explorer

Ingress Tool Transfer

Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers

Compiled HTML File, System Binary Proxy Execution

Windows System Binary Proxy Execution Compiled HTML File Decompile

Compiled HTML File, System Binary Proxy Execution

Windows System Binary Proxy Execution Compiled HTML File URL In Command Line

Compiled HTML File, System Binary Proxy Execution

Windows OS Credential Dumping with Procdump

LSASS Memory, OS Credential Dumping

Windows System Binary Proxy Execution MSIExec Unregister DLL

Msiexec

Windows OS Credential Dumping with Ntdsutil Export NTDS

NTDS, OS Credential Dumping

Windows System Binary Proxy Execution MSIExec Remote Download

Msiexec

Windows System Binary Proxy Execution MSIExec DLLRegisterServer

Msiexec

Windows LOLBin Binary in Non Standard Path

Masquerading, Rename System Utilities, System Binary Proxy Execution, InstallUtil

Windows Defender Tools in Non Standard Path

Masquerading, Rename System Utilities

Windows Rundll32 Comsvcs Memory Dump

NTDS, OS Credential Dumping

Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path

Masquerading, Rename System Utilities

System Process Running from Unexpected Location

Masquerading

Modify ACLs Permission Of Files Or Folders

File and Directory Permissions Modification

Delete A Net User

Account Access Removal

Windows DotNet Binary in Non Standard Path

Masquerading, Rename System Utilities, System Binary Proxy Execution, InstallUtil

Windows Script Host Spawn MSBuild

MSBuild, Trusted Developer Utilities Proxy Execution

Windows WMIPrvse Spawn MSBuild

Trusted Developer Utilities Proxy Execution, MSBuild

Windows MSHTA Child Process

Mshta, System Binary Proxy Execution

Windows MSHTA Command-Line URL

Mshta, System Binary Proxy Execution

Windows MSHTA Inline HTA Execution

Mshta, System Binary Proxy Execution

Windows Rundll32 Inline HTA Execution

System Binary Proxy Execution, Mshta

Windows Diskshadow Proxy Execution

System Binary Proxy Execution

Windows Bitsadmin Download File

BITS Jobs, Ingress Tool Transfer

Windows CertUtil Decode File

Deobfuscate/Decode Files or Information

Windows CertUtil VerifyCtl Download

Ingress Tool Transfer

Windows CertUtil URLCache Download

Ingress Tool Transfer

Windows PowerShell Start-BitsTransfer

BITS Jobs, Ingress Tool Transfer

Windows Rasautou DLL Execution

Dynamic-link Library Injection, System Binary Proxy Execution, Process Injection

Windows Bits Job Persistence

BITS Jobs

Windows Powershell Connect to Internet With Hidden Window

Automated Exfiltration

Windows Powershell DownloadFile

Automated Exfiltration

Clear Unallocated Sector Using Cipher App

File Deletion, Indicator Removal

Hiding Files And Directories With Attrib exe

Windows File and Directory Permissions Modification, File and Directory Permissions Modification

Fsutil Zeroing File

Indicator Removal

BCDEdit Failure Recovery Modification

Inhibit System Recovery

WBAdmin Delete System Backups

Inhibit System Recovery

DNS Exfiltration Using Nslookup App

Exfiltration Over Alternative Protocol

Detect RClone Command-Line Usage

Automated Exfiltration

Windows Curl Upload to Remote Destination

Ingress Tool Transfer

Resize Shadowstorage Volume

Service Stop

Grant Permission Using Cacls Utility

File and Directory Permissions Modification

Disable Net User Account

Service Stop, Valid Accounts

Deny Permission using Cacls Utility

File and Directory Permissions Modification

Attempted Credential Dump From Registry via Reg exe

OS Credential Dumping, Security Account Manager

Attempt To Disable Services

Service Stop

Attempt To Delete Services

Service Stop, Create or Modify System Process, Windows Service

Anomalous usage of Archive Tools

Archive via Utility, Archive Collected Data

Sdelete Application Execution

Data Destruction, File Deletion, Indicator Removal

Wevtutil Usage To Disable Logs

Indicator Removal, Clear Windows Event Logs

WevtUtil Usage To Clear Logs

Indicator Removal, Clear Windows Event Logs

Cloud

AWS SAML Update identity provider

Valid Accounts

Abnormally High Number Of Cloud Security Group API Calls

Cloud Accounts, Valid Accounts

Cloud Instance Modified By Previously Unseen User

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Infrastructure API Calls

Cloud Accounts, Valid Accounts

Azure AD High Number Of Failed Authentications From Ip

Brute Force, Password Guessing, Password Spraying

Azure AD Concurrent Sessions From Different Ips

Browser Session Hijacking

Azure AD Admin Consent Bypassed by Service Principal

Additional Cloud Roles

O365 Multi-Source Failed Authentications Spike

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Azure AD Privileged Role Assigned to Service Principal

Account Manipulation, Additional Cloud Roles

AWS Multiple Failed MFA Requests For User

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

Azure AD Service Principal Created

Cloud Account

Cloud Compute Instance Created With Previously Unseen Image

Kubernetes Process with Resource Ratio Anomalies

User Execution

Azure AD User Consent Blocked for Risky Application

Steal Application Access Token

O365 Multiple Service Principals Created by SP

Cloud Account

AWS IAM Successful Group Deletion

Cloud Groups, Account Manipulation, Permission Groups Discovery

Amazon EKS Kubernetes Pod scan detection

Cloud Service Discovery

Azure AD Privileged Role Assigned

Account Manipulation, Additional Cloud Roles

Azure AD Global Administrator Role Assigned

Additional Cloud Roles

O365 New Email Forwarding Rule Created

Email Collection, Email Forwarding Rule

Azure AD High Number Of Failed Authentications For User

Brute Force, Password Guessing

AWS Console Login Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

O365 Tenant Wide Admin Consent Granted

Account Manipulation, Additional Cloud Roles

O365 New Forwarding Mailflow Rule Created

Email Collection

Azure AD New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

ASL AWS Defense Evasion Delete Cloudtrail

Disable or Modify Cloud Logs, Impair Defenses

O365 New Federated Domain Added

Cloud Account, Create Account

Azure AD Device Code Authentication

Steal Application Access Token, Phishing, Spearphishing Link

AWS Defense Evasion PutBucketLifecycle

Disable or Modify Cloud Logs, Impair Defenses

AWS Detect Users creating keys with encrypt policy without MFA

Data Encrypted for Impact

Detect AWS Console Login by New User

Compromise Accounts, Cloud Accounts, Unsecured Credentials

Azure AD New Federated Domain Added

Domain or Tenant Policy Modification, Trust Modification

Azure AD Service Principal Owner Added

Account Manipulation

Kubernetes Cron Job Creation

Container Orchestration Job

Kubernetes Create or Update Privileged Pod

User Execution

AWS ECR Container Upload Unknown User

Malicious Image, User Execution

AWS Exfiltration via DataSync Task

Automated Collection

Kubernetes Previously Unseen Container Image Name

User Execution

Abnormally High Number Of Cloud Instances Destroyed

Cloud Accounts, Valid Accounts

AWS IAM Delete Policy

Account Manipulation

Kubernetes Abuse of Secret by Unusual User Name

Container API

O365 File Permissioned Application Consent Granted by User

Steal Application Access Token

O365 Concurrent Sessions From Different Ips

Browser Session Hijacking

Kubernetes newly seen UDP edge

User Execution

Kubernetes Process Running From New Path

User Execution

Kubernetes Process with Anomalous Resource Utilisation

User Execution

O365 Added Service Principal

Cloud Account, Create Account

GitHub Dependabot Alert

Compromise Software Dependencies and Development Tools, Supply Chain Compromise

O365 Multiple Failed MFA Requests For User

Multi-Factor Authentication Request Generation

AWS Defense Evasion Delete CloudWatch Log Group

Impair Defenses, Disable or Modify Cloud Logs

Azure AD Successful Authentication From Different Ips

Brute Force, Password Guessing, Password Spraying

AWS Defense Evasion Impair Security Services

Disable or Modify Cloud Logs, Impair Defenses

Kubernetes Anomalous Inbound to Outbound Network IO Ratio

User Execution

Azure AD Multiple AppIDs and UserAgents Authentication Spike

Valid Accounts

AWS Successful Console Authentication From Multiple IPs

Compromise Accounts, Unused/Unsupported Cloud Regions

O365 User Consent Blocked for Risky Application

Steal Application Access Token

Azure AD User Enabled And Password Reset

Account Manipulation

O365 Block User Consent For Risky Apps Disabled

Impair Defenses

Kubernetes Shell Running on Worker Node

User Execution

AWS High Number Of Failed Authentications For User

Password Policy Discovery

Kubernetes Anomalous Outbound Network Activity from Process

User Execution

AWS ECR Container Upload Outside Business Hours

Malicious Image, User Execution

Kubernetes Falco Shell Spawned

User Execution

O365 Mailbox Folder Read Permission Granted

Account Manipulation, Additional Email Delegate Permissions

GCP Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication

Kubernetes Abuse of Secret by Unusual User Group

Container API

Azure AD PIM Role Assignment Activated

Account Manipulation, Additional Cloud Roles

High Number of Login Failures from a single source

Password Guessing, Brute Force

Circle CI Disable Security Step

Compromise Host Software Binary

GCP Successful Single-Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

Detect AWS Console Login by User from New City

Compromise Accounts, Cloud Accounts, Unused/Unsupported Cloud Regions

ASL AWS Defense Evasion Delete CloudWatch Log Group

Impair Defenses, Disable or Modify Cloud Logs

Github Commit In Develop

Trusted Relationship

GCP Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

ASL AWS Concurrent Sessions From Different Ips

Browser Session Hijacking

Kubernetes Anomalous Traffic on Network Edge

User Execution

Azure Automation Account Created

Create Account, Cloud Account

AWS Disable Bucket Versioning

Inhibit System Recovery

Azure AD Successful PowerShell Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

O365 Compliance Content Search Exported

Email Collection, Remote Email Collection

Risk Rule for Dev Sec Ops by Repository

Malicious Image, User Execution

Azure AD OAuth Application Consent Granted By User

Steal Application Access Token

Azure AD User ImmutableId Attribute Updated

Account Manipulation

O365 Mailbox Email Forwarding Enabled

Email Collection, Email Forwarding Rule

AWS Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

AWS High Number Of Failed Authentications From Ip

Brute Force, Password Spraying, Credential Stuffing

AWS IAM Assume Role Policy Brute Force

Cloud Infrastructure Discovery, Brute Force

Azure Runbook Webhook Created

Valid Accounts, Cloud Accounts

Azure AD Tenant Wide Admin Consent Granted

Account Manipulation, Additional Cloud Roles

GCP Multiple Failed MFA Requests For User

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts

AWS SAML Access by Provider User and Principal

Valid Accounts

O365 New Email Forwarding Rule Enabled

Email Collection, Email Forwarding Rule

Azure AD Successful Single-Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

O365 Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Azure AD Block User Consent For Risky Apps Disabled

Impair Defenses

O365 ApplicationImpersonation Role Assigned

Account Manipulation, Additional Email Delegate Permissions

Azure AD Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication

aws detect permanent key creation

Valid Accounts

AWS Exfiltration via Batch Service

Automated Collection

GCP Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Github Commit Changes In Master

Trusted Relationship

Cloud Provisioning Activity From Previously Unseen Country

Valid Accounts

ASL AWS IAM Delete Policy

Account Manipulation

ASL AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

O365 User Consent Denied for OAuth Application

Steal Application Access Token

Azure Active Directory High Risk Sign-in

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying

Kubernetes Abuse of Secret by Unusual User Agent

Container API

Gsuite Drive Share In External Email

Exfiltration to Cloud Storage, Exfiltration Over Web Service

O365 Multiple Service Principals Created by User

Cloud Account

Kubernetes Unauthorized Access

User Execution

Azure AD Service Principal Authentication

Cloud Accounts

AWS Credential Access GetPasswordData

Compromise Accounts, Cloud Accounts, Brute Force, Password Guessing

Gsuite suspicious calendar invite

Phishing

Azure AD Privileged Authentication Administrator Role Assigned

Security Account Manager

aws detect sts assume role abuse

Valid Accounts

Circle CI Disable Security Job

Compromise Host Software Binary

Kubernetes Scanner Image Pulling

Cloud Service Discovery

AWS IAM AccessDenied Discovery Events

Cloud Infrastructure Discovery

Azure AD Multiple Failed MFA Requests For User

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts

Kubernetes Nginx Ingress RFI

Exploitation for Credential Access

Detect S3 access from a new IP

Data from Cloud Storage

Kubernetes Pod With Host Network Attachment

User Execution

O365 Add App Role Assignment Grant User

Cloud Account, Create Account

Detect New Open S3 Buckets over AWS CLI

Data from Cloud Storage

Detect Spike in AWS Security Hub Alerts for EC2 Instance

Detect New Open S3 buckets

Data from Cloud Storage

Kubernetes Nginx Ingress LFI

Exploitation for Credential Access

Azure AD Authentication Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

O365 Excessive Authentication Failures Alert

Brute Force

Azure AD Multiple Denied MFA Requests For User

Multi-Factor Authentication Request Generation

Cloud Security Groups Modifications by User

Modify Cloud Compute Configurations

Azure AD User Consent Denied for OAuth Application

Steal Application Access Token

Detect AWS Console Login by User from New Region

Compromise Accounts, Cloud Accounts, Unused/Unsupported Cloud Regions

O365 OAuth App Mailbox Access via Graph API

Remote Email Collection

O365 Admin Consent Bypassed by Service Principal

Additional Cloud Roles

AWS Detect Users with KMS keys performing encryption S3

Data Encrypted for Impact

Cloud Compute Instance Created By Previously Unseen User

Cloud Accounts, Valid Accounts

ASL AWS New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

Detect Spike in AWS Security Hub Alerts for User

O365 Mailbox Inbox Folder Shared with All Users

Email Collection, Remote Email Collection

GCP Kubernetes cluster pod scan detection

Cloud Service Discovery

Kubernetes AWS detect suspicious kubectl calls

Detect New Open GCP Storage Buckets

Data from Cloud Storage

O365 Excessive SSO logon errors

Modify Authentication Process

AWS Defense Evasion Update Cloudtrail

Impair Defenses, Disable or Modify Cloud Logs

Cloud Provisioning Activity From Previously Unseen Region

Valid Accounts

O365 Advanced Audit Disabled

Impair Defenses, Disable or Modify Cloud Logs

AWS UpdateLoginProfile

Cloud Account, Create Account

Kubernetes Anomalous Inbound Network Activity from Process

User Execution

GitHub Actions Disable Security Workflow

Compromise Software Supply Chain, Supply Chain Compromise

Cloud Provisioning Activity From Previously Unseen IP Address

Valid Accounts

Abnormally High Number Of Cloud Instances Launched

Cloud Accounts, Valid Accounts

Cloud Provisioning Activity From Previously Unseen City

Valid Accounts

Kubernetes DaemonSet Deployed

User Execution

AWS Credential Access Failed Login

Compromise Accounts, Cloud Accounts, Brute Force, Password Guessing

O365 Multiple Mailboxes Accessed via API

Remote Email Collection

GSuite Email Suspicious Attachment

Spearphishing Attachment, Phishing

Detect AWS Console Login by User from New Country

Compromise Accounts, Cloud Accounts, Unused/Unsupported Cloud Regions

O365 PST export alert

Email Collection

O365 High Number Of Failed Authentications for User

Brute Force, Password Guessing

AWS CreateLoginProfile

Cloud Account, Create Account

AWS SetDefaultPolicyVersion

Cloud Accounts, Valid Accounts

AWS Cross Account Activity From Previously Unseen Account

Azure AD New MFA Method Registered

Account Manipulation, Device Registration

O365 Compliance Content Search Started

Email Collection, Remote Email Collection

Azure AD Application Administrator Role Assigned

Account Manipulation, Additional Cloud Roles

AWS Exfiltration via Anomalous GetObject API Activity

Automated Collection

AWS ECR Container Scanning Findings Low Informational Unknown

Malicious Image, User Execution

O365 Bypass MFA via Trusted IP

Disable or Modify Cloud Firewall, Impair Defenses

AWS Network Access Control List Deleted

Disable or Modify Cloud Firewall, Impair Defenses

Gsuite Email Suspicious Subject With Attachment

Spearphishing Attachment, Phishing

AWS Defense Evasion Stop Logging Cloudtrail

Disable or Modify Cloud Logs, Impair Defenses

aws detect role creation

Valid Accounts

AWS Concurrent Sessions From Different Ips

Browser Session Hijacking

O365 New MFA Method Registered

Account Manipulation, Device Registration

Azure AD Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

Amazon EKS Kubernetes cluster scan detection

Cloud Service Discovery

O365 Elevated Mailbox Permission Assigned

Account Manipulation, Additional Email Delegate Permissions

Cloud API Calls From Previously Unseen User Roles

Valid Accounts

Kubernetes newly seen TCP edge

User Execution

O365 Mail Permissioned Application Consent Granted by User

Steal Application Access Token

Azure AD PIM Role Assigned

Account Manipulation, Additional Cloud Roles

O365 OAuth App Mailbox Access via EWS

Remote Email Collection

Detect GCP Storage access from a new IP

Data from Cloud Storage

Cloud Compute Instance Created With Previously Unseen Instance Type

AWS Network Access Control List Created with All Open Ports

Disable or Modify Cloud Firewall, Impair Defenses

GCP Detect gcploit framework

Valid Accounts

O365 Privileged Graph API Permission Assigned

Security Account Manager

aws detect sts get session token abuse

Use Alternate Authentication Material

AWS Defense Evasion Delete Cloudtrail

Disable or Modify Cloud Logs, Impair Defenses

Azure AD New Custom Domain Added

Domain or Tenant Policy Modification, Trust Modification

O365 Mailbox Read Access Granted to Application

Remote Email Collection, Email Collection, Account Manipulation, Additional Cloud Roles

O365 Mailbox Folder Read Permission Assigned

Account Manipulation, Additional Email Delegate Permissions

Azure AD Multi-Source Failed Authentications Spike

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Gsuite Suspicious Shared File Name

Spearphishing Attachment, Phishing

Kubernetes Previously Unseen Process

User Execution

Gdrive suspicious file sharing

Phishing

GitHub Pull Request from Unknown User

Compromise Software Dependencies and Development Tools, Supply Chain Compromise

Azure AD Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

AWS S3 Exfiltration Behavior Identified

Transfer Data to Cloud Account

Azure AD Multiple Service Principals Created by SP

Cloud Account

ASL AWS Defense Evasion Impair Security Services

Disable or Modify Cloud Logs, Impair Defenses

Kubernetes Anomalous Inbound Outbound Network IO

User Execution

AWS New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

Kubernetes Suspicious Image Pulling

Cloud Service Discovery

Azure AD Multiple Service Principals Created by User

Cloud Account

AWS Lambda UpdateFunctionCode

User Execution

O365 High Privilege Role Granted

Account Manipulation, Additional Cloud Roles

Kubernetes Node Port Creation

User Execution

Detect Spike in blocked Outbound Traffic from your AWS

Azure AD FullAccessAsApp Permission Assigned

Additional Email Delegate Permissions, Additional Cloud Roles

AWS Successful Single-Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

O365 Service Principal New Client Credentials

Account Manipulation, Additional Cloud Credentials

aws detect attach to role policy

Valid Accounts

O365 Multiple AppIDs and UserAgents Authentication Spike

Valid Accounts

Kubernetes Pod Created in Default Namespace

User Execution

AWS ECR Container Scanning Findings High

Malicious Image, User Execution

Kubernetes Access Scanning

Network Service Discovery

AWS CreateAccessKey

Cloud Account, Create Account

AWS Exfiltration via Bucket Replication

Transfer Data to Cloud Account

Azure AD Service Principal New Client Credentials

Account Manipulation, Additional Cloud Credentials

Kubernetes Shell Running on Worker Node with CPU Activity

User Execution

O365 Disable MFA

Modify Authentication Process

Azure AD External Guest User Invited

Cloud Account

O365 Application Registration Owner Added

Account Manipulation

Gsuite Email With Known Abuse Web Service Link

Spearphishing Attachment, Phishing

AWS IAM Failure Group Deletion

Account Manipulation

Azure AD Privileged Graph API Permission Assigned

Security Account Manager

Kubernetes Abuse of Secret by Unusual Location

Container API

GCP Authentication Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

Azure Automation Runbook Created

Create Account, Cloud Account

O365 FullAccessAsApp Permission Assigned

Additional Email Delegate Permissions, Additional Cloud Roles

Cloud Compute Instance Created In Previously Unused Region

Unused/Unsupported Cloud Regions

Kubernetes Scanning by Unauthenticated IP Address

Network Service Discovery

Gsuite Outbound Email With Attachment To External Domain

Exfiltration Over Unencrypted Non-C2 Protocol, Exfiltration Over Alternative Protocol

AWS Password Policy Changes

Password Policy Discovery

AWS Exfiltration via EC2 Snapshot

Transfer Data to Cloud Account

AWS Multiple Users Failing To Authenticate From Ip

Brute Force, Password Spraying, Credential Stuffing

AWS Create Policy Version to allow all resources

Cloud Accounts, Valid Accounts

AWS AMI Attribute Modification for Exfiltration

Transfer Data to Cloud Account

AWS Credential Access RDS Password reset

Compromise Accounts, Cloud Accounts, Brute Force

O365 Security And Compliance Alert Triggered

Valid Accounts, Cloud Accounts

AWS Excessive Security Scanning

Cloud Service Discovery

AWS EC2 Snapshot Shared Externally

Transfer Data to Cloud Account

AWS ECR Container Scanning Findings Medium

Malicious Image, User Execution

Detect Spike in S3 Bucket deletion

Data from Cloud Storage

O365 Privileged Role Assigned

Account Manipulation, Additional Cloud Roles

O365 Application Available To Other Tenants

Additional Cloud Roles, Account Manipulation

O365 External Guest User Invited

Cloud Account

O365 Privileged Role Assigned To Service Principal

Account Manipulation, Additional Cloud Roles

O365 Cross-Tenant Access Change

Trust Modification

O365 External Identity Policy Changed

Cloud Account

O365 Email Access By Security Administrator

Exfiltration Over Web Service, Email Collection, Remote Email Collection

O365 SharePoint Allowed Domains Policy Changed

Cloud Account

O365 Email Reported By Admin Found Malicious

Phishing, Spearphishing Attachment, Spearphishing Link

O365 Email Suspicious Behavior Alert

Email Collection, Email Forwarding Rule

O365 Email Reported By User Found Malicious

Phishing, Spearphishing Attachment, Spearphishing Link

O365 DLP Rule Triggered

Exfiltration Over Alternative Protocol, Exfiltration Over Web Service

O365 Threat Intelligence Suspicious Email Delivered

Phishing, Spearphishing Attachment, Spearphishing Link

O365 SharePoint Malware Detection

Malicious File, User Execution

O365 ZAP Activity Detection

Phishing, Spearphishing Attachment, Spearphishing Link

O365 Email Security Feature Changed

Impair Defenses, Disable or Modify Cloud Logs, Disable or Modify Tools

O365 Threat Intelligence Suspicious File Detected

Malicious File, User Execution

O365 Safe Links Detection

Phishing, Spearphishing Attachment

ASL AWS IAM Failure Group Deletion

Account Manipulation

ASL AWS ECR Container Upload Unknown User

Malicious Image, User Execution

ASL AWS ECR Container Upload Outside Business Hours

Malicious Image, User Execution

ASL AWS IAM Successful Group Deletion

Cloud Groups, Account Manipulation, Permission Groups Discovery

ASL AWS Defense Evasion Update Cloudtrail

Impair Defenses, Disable or Modify Cloud Logs

ASL AWS Defense Evasion Stop Logging Cloudtrail

Disable or Modify Cloud Logs, Impair Defenses

Application

Ivanti VTM New Account Creation

Exploit Public-Facing Application

Splunk risky Command Abuse disclosed february 2023

Abuse Elevation Control Mechanism, Indirect Command Execution

Splunk Stored XSS via Specially Crafted Bulletin Message

Drive-by Compromise

Splunk Stored XSS conf-web Settings on Premises

Drive-by Compromise

Splunk Unauthenticated Path Traversal Modules Messaging

File and Directory Discovery

Splunk Unauthenticated DoS via Null Pointer References

Endpoint Denial of Service

Splunk RCE PDFgen Render

Exploitation of Remote Services

Splunk XSS Via External Urls in Dashboards SSRF

Drive-by Compromise

Splunk XSS in Save table dialog header in search page

Drive-by Compromise

Splunk Enterprise Windows Deserialization File Partition

Exploit Public-Facing Application

Splunk RCE via External Lookup Copybuckets

Exploitation of Remote Services

Splunk Unauthorized Experimental Items Creation

Drive-by Compromise

Splunk Unauthorized Notification Input by User

Abuse Elevation Control Mechanism

Splunk CSRF in the SSG kvstore Client Endpoint

Drive-by Compromise

Splunk DoS via POST Request Datamodel Endpoint

Endpoint Denial of Service

Splunk Information Disclosure on Account Login

Account Discovery

Splunk XSS in Highlighted JSON Events

Drive-by Compromise

Splunk Stored XSS via Data Model objectName Field

Drive-by Compromise

Splunk XSS Privilege Escalation via Custom Urls in Dashboard

Drive-by Compromise

Okta Multiple Failed Requests to Access Applications

Web Session Cookie, Cloud Service Dashboard

Okta Authentication Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

PingID Multiple Failed MFA Requests For User

Multi-Factor Authentication Request Generation, Valid Accounts, Brute Force

Splunk ES DoS Through Investigation Attachments

Endpoint Denial of Service

Splunk Low Privilege User Can View Hashed Splunk Password

Exploitation for Credential Access

Splunk DoS Using Malformed SAML Request

Network Denial of Service

Okta Suspicious Use of a Session Cookie

Steal Web Session Cookie

Suspicious Email Attachment Extensions

Spearphishing Attachment, Phishing

Okta IDP Lifecycle Modifications

Cloud Account

Okta Multiple Users Failing To Authenticate From Ip

Password Spraying

Okta Risk Threshold Exceeded

Valid Accounts, Brute Force

Splunk unnecessary file extensions allowed by lookup table uploads

Drive-by Compromise

Splunk Protocol Impersonation Weak Encryption Configuration

Protocol Impersonation

Splunk DoS via Malformed S2S Request

Network Denial of Service

Splunk HTTP Response Splitting Via Rest SPL Command

HTML Smuggling

Splunk Endpoint Denial of Service DoS Zip Bomb

Endpoint Denial of Service

Splunk Digital Certificates Infrastructure Version

Digital Certificates

Path traversal SPL injection

File and Directory Discovery

Splunk RCE via Serialized Session Payload

Exploit Public-Facing Application

Detect Risky SPL using Pretrained ML Model

Command and Scripting Interpreter

Okta Successful Single Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

Splunk Data exfiltration from Analytics Workspace using sid query

Exfiltration Over Web Service

Splunk Authentication Token Exposure in Debug Log

Log Enumeration

Splunk ES DoS Investigations Manager via Investigation Creation

Endpoint Denial of Service

Splunk DOS via printf search function

Application or System Exploitation

Persistent XSS in RapidDiag through User Interface Views

Drive-by Compromise

Okta New Device Enrolled on Account

Account Manipulation, Device Registration

Splunk Code Injection via custom dashboard leading to RCE

Exploitation of Remote Services

Splunk Reflected XSS in the templates lists radio

Drive-by Compromise

Splunk Process Injection Forwarder Bundle Downloads

Process Injection

Splunk protocol impersonation weak encryption simplerequest

Digital Certificates

Splunk Reflected XSS on App Search Table Endpoint

Drive-by Compromise

Splunk Path Traversal In Splunk App For Lookup File Edit

File and Directory Discovery

PingID Mismatch Auth Source and Verification Response

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

Splunk protocol impersonation weak encryption selfsigned

Digital Certificates

Splunk Command and Scripting Interpreter Delete Usage

Command and Scripting Interpreter

Splunk list all nonstandard admin accounts

Drive-by Compromise

PingID New MFA Method After Credential Reset

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

Splunk User Enumeration Attempt

Valid Accounts

Okta ThreatInsight Threat Detected

Valid Accounts, Cloud Accounts

Splunk Information Disclosure in Splunk Add-on Builder

System Information Discovery

Splunk Persistent XSS Via URL Validation Bypass W Dashboard

Drive-by Compromise

Okta Multiple Failed MFA Requests For User

Multi-Factor Authentication Request Generation

Splunk Unauthenticated Log Injection Web Service Log

Exploit Public-Facing Application

Okta Mismatch Between Source and Response for Verify Push Request

Multi-Factor Authentication Request Generation

Suspicious Java Classes

Splunk Command and Scripting Interpreter Risky Commands

Command and Scripting Interpreter

Okta MFA Exhaustion Hunt

Brute Force

Email servers sending high volume traffic to hosts

Email Collection, Remote Email Collection

Splunk Digital Certificates Lack of Encryption

Digital Certificates

Splunk XSS in Monitoring Console

Drive-by Compromise

Splunk Absolute Path Traversal Using runshellscript

File and Directory Discovery

CrushFTP Server Side Template Injection

Exploit Public-Facing Application

Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature

Exploitation of Remote Services

Splunk App for Lookup File Editing RCE via User XSLT

Exploitation of Remote Services

Splunk RCE via User XSLT

Exploitation of Remote Services

Email Attachments With Lots Of Spaces

Splunk Account Discovery Drilldown Dashboard Disclosure

Account Discovery

Okta Phishing Detection with FastPass Origin Check

Valid Accounts, Default Accounts, Modify Authentication Process

Splunk RBAC Bypass On Indexing Preview REST Endpoint

Access Token Manipulation

Email files written outside of the Outlook directory

Email Collection, Local Email Collection

Splunk Edit User Privilege Escalation

Abuse Elevation Control Mechanism

No Windows Updates in a time frame

Splunk Command and Scripting Interpreter Risky SPL MLTK

Command and Scripting Interpreter

Detect New Login Attempts to Routers

Splunk Improperly Formatted Parameter Crashes splunkd

Endpoint Denial of Service

Okta Suspicious Activity Reported

Valid Accounts, Default Accounts

Splunk XSS via View

Drive-by Compromise

Okta Multi-Factor Authentication Disabled

Modify Authentication Process, Multi-Factor Authentication

Okta Unauthorized Access to Application

Cloud Account

Web Servers Executing Suspicious Processes

System Information Discovery

Okta New API Token Created

Valid Accounts, Default Accounts

Okta Multiple Accounts Locked Out

Brute Force

Splunk Enterprise KV Store Incorrect Authorization

Abuse Elevation Control Mechanism

Okta User Logins from Multiple Cities

Cloud Accounts

PingID New MFA Method Registered For User

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

Splunk DOS Via Dump SPL Command

Application or System Exploitation

Monitor Email For Brand Abuse

Windows AD Suspicious GPO Modification

Domain or Tenant Policy Modification, Group Policy Modification, File and Directory Permissions Modification, Windows File and Directory Permissions Modifica...

Windows AD Self DACL Assignment

Domain or Tenant Policy Modification, Account Manipulation

Windows AD add Self to Group

Account Manipulation

Windows AD GPO Disabled

Disable or Modify Tools, Group Policy Modification

Windows AD GPO Deleted

Disable or Modify Tools, Group Policy Modification

Windows AD GPO New CSE Addition

Domain or Tenant Policy Modification, Group Policy Modification, File and Directory Permissions Modification, Windows File and Directory Permissions Modifica...

Windows AD Dangerous Deny ACL Modification

Domain or Tenant Policy Modification, File and Directory Permissions Modification, Windows File and Directory Permissions Modification

Windows AD Hidden OU Creation

Domain or Tenant Policy Modification, File and Directory Permissions Modification, Windows File and Directory Permissions Modification

Windows AD Dangerous User ACL Modification

Domain or Tenant Policy Modification, File and Directory Permissions Modification, Windows File and Directory Permissions Modification

Windows AD Dangerous Group ACL Modification

Domain or Tenant Policy Modification, File and Directory Permissions Modification, Windows File and Directory Permissions Modification

Windows AD Suspicious Attribute Modification

Use Alternate Authentication Material, File and Directory Permissions Modification, Windows File and Directory Permissions Modification

Windows AD Object Owner Updated

Domain or Tenant Policy Modification, File and Directory Permissions Modification, Windows File and Directory Permissions Modification

Windows AD Domain Root ACL Deletion

Domain or Tenant Policy Modification, File and Directory Permissions Modification, Windows File and Directory Permissions Modification

Windows AD Domain Root ACL Modification

Domain or Tenant Policy Modification, File and Directory Permissions Modification, Windows File and Directory Permissions Modification

Windows AD DCShadow Privileges ACL Addition

Domain or Tenant Policy Modification, Rogue Domain Controller, Windows File and Directory Permissions Modification

Detect Distributed Password Spray Attempts

Password Spraying, Brute Force

Detect Password Spray Attempts

Password Spraying, Brute Force

Windows Increase in Group or Object Modification Activity

Account Manipulation, Impair Defenses

Windows Increase in User Modification Activity

Account Manipulation, Impair Defenses

Windows AD Privileged Group Modification

Account Manipulation