Detections

Name	Data Source	Technique	Type	Analytic Story	Date
Large HTTP POST Request Resulting in Server Error	Zeek HTTP	T1190	Anomaly	PHP2Shell	2026-10-22
PHP Memory Exhaustion Exploitation Attempt via Multipart Request	Nginx Access, Nginx Error Log	T1190	Anomaly	PHP2Shell	2026-10-22
PHP Session Upload Progress with PHP Code in Upload Filename	Zeek HTTP	T1190	Anomaly	PHP2Shell	2026-10-22
PHP Session Upload Progress Serialized Payload in Upload Filename	Zeek HTTP	T1190	Anomaly	PHP2Shell	2026-10-22
Windows Suspicious Child Process Spawned From WebServer	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1505.003	Anomaly	CISA AA22-257A, CISA AA22-264A, SysAid On-Prem Software CVE-2023-47246 Vulnerability, Microsoft WSUS CVE-2025-59287, BlackByte Ransomware, Flax Typhoon, GhostRedirector IIS Module and Rungan Backdoor, HAFNIUM Group, Microsoft SharePoint Vulnerabilities, PHP2Shell, Medusa Ransomware, ProxyShell, ProxyNotShell, WS FTP Server Critical Vulnerabilities, Citrix ShareFile RCE CVE-2023-24489, Compromised Windows Host	2026-10-22
Inline PHP Code Execution	Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1, Sysmon for Linux EventID 1	T1059	Anomaly	PHP2Shell	2026-10-22
Web or Application Server Spawning a Shell	Sysmon EventID 1, Sysmon for Linux EventID 1	T1133 T1190	TTP	CISA AA22-257A, SysAid On-Prem Software CVE-2023-47246 Vulnerability, PHP-CGI RCE Attack on Japanese Organizations, Spring4Shell CVE-2022-22965, Data Destruction, BlackByte Ransomware, Flax Typhoon, PHP2Shell, WS FTP Server Critical Vulnerabilities, Hermetic Wiper, CISA AA22-264A, GhostRedirector IIS Module and Rungan Backdoor, Microsoft SharePoint Vulnerabilities, ProxyShell, Log4Shell CVE-2021-44228, Cleo File Transfer Software, Microsoft WSUS CVE-2025-59287, HAFNIUM Group, ProxyNotShell, SAP NetWeaver Exploitation	2026-10-22
Windows Process Outbound Connection To Social Media Domain	Sysmon EventID 3	T1586.001	Anomaly	Braodo Stealer	2026-10-20
AWS CreateAccessKey	AWS CloudTrail CreateAccessKey	T1136.003	Hunting	AWS IAM Privilege Escalation	2026-10-19
HTTP POST Request with Encoded Payload	Zeek HTTP	T1071.001 T1132.001	Anomaly	Data Exfiltration, Command And Control	2026-10-19
Ollama Abnormal Network Connectivity	Ollama Server	N/A	Anomaly	Suspicious Ollama Activities	2026-10-19
Ollama Repeated Application Errors	Ollama Server	N/A	Anomaly	Suspicious Ollama Activities	2026-10-19
Cisco AI Defense Security Alerts by Application Name	Cisco AI Defense Alerts	N/A	Anomaly	Abuse of GenAI Systems and Applications, Critical Alerts	2026-10-19
Detect Remote Access Software Usage Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1219	Anomaly	Insider Threat, CISA AA24-241A, Interlock Ransomware, Seashell Blizzard, Storm-0501 Ransomware, Command And Control, Remote Monitoring and Management Software, GhostRedirector IIS Module and Rungan Backdoor, Cactus Ransomware, Ransomware, Gozi Malware, Scattered Spider, Scattered Lapsus$ Hunters	2026-10-19
Detect Remote Access Software Usage Registry	Sysmon EventID 13	T1219	Anomaly	Insider Threat, CISA AA24-241A, Seashell Blizzard, Command And Control, Remote Monitoring and Management Software, Cactus Ransomware, Ransomware, Gozi Malware, Scattered Spider, Scattered Lapsus$ Hunters	2026-10-19
Detect Remote Access Software Usage File	Sysmon EventID 11	T1219	Anomaly	Insider Threat, CISA AA24-241A, Interlock Ransomware, Seashell Blizzard, Command And Control, GhostRedirector IIS Module and Rungan Backdoor, Remote Monitoring and Management Software, Cactus Ransomware, Ransomware, Gozi Malware, Scattered Lapsus$ Hunters, Scattered Spider	2026-10-19
Cisco AI Defense Repeated High Risk Activity	Cisco AI Defense Alerts	N/A	TTP	Abuse of GenAI Systems and Applications, Critical Alerts	2026-10-15
Cisco AI Defense Allowed Sensitive Response	Cisco AI Defense Alerts	N/A	TTP	Data Protection, Abuse of GenAI Systems and Applications, Critical Alerts	2026-10-15
Cisco AI Defense Allowed Sensitive Prompt	Cisco AI Defense Alerts	N/A	TTP	Data Protection, Abuse of GenAI Systems and Applications, Critical Alerts	2026-10-15
AWS IAM Role Created with External Trust	AWS CloudTrail	T1098.003	TTP	AWS IAM Privilege Escalation	2026-10-13
PowerShell Download from Code Hosting Service	Powershell Script Block Logging 4104	T1059.001 T1105	Anomaly	Braodo Stealer	2026-10-13
Unusual HTTP Request Method	Zeek HTTP	T1071.001 T1190	Anomaly	HTTP Request Smuggling, Command And Control	2026-10-12
Windows Wermgr Alternate Data Stream in Temp Dir	Sysmon EventID 15	T1564.004	Anomaly	RoguePlanet	2026-10-12
Unusual SSH Client Banner	Zeek SSH	T1021.004 T1572	Anomaly	Ingress Tool Transfer, Command And Control	2026-10-12
Ollama Long-Running Inference Requests	Ollama Server	N/A	Anomaly	Suspicious Ollama Activities	2026-10-10
Windows Possible Credential Dumping	Sysmon EventID 10	T1003.001	Anomaly	CISA AA22-257A, CISA AA22-264A, DarkSide Ransomware, CISA AA23-347A, Credential Dumping, Scattered Lapsus$ Hunters, Detect Zerologon Attack	2026-10-09
PowerShell Enable PowerShell Remoting	Powershell Script Block Logging 4104	T1059.001	Anomaly	Malicious PowerShell	2026-10-09
Detect Credential Dumping through LSASS access	Sysmon EventID 10	T1003.001	TTP	Lokibot, CISA AA23-347A, Credential Dumping, BlackSuit Ransomware, Scattered Lapsus$ Hunters, Detect Zerologon Attack	2026-10-09
PowerShell Start or Stop Service	Powershell Script Block Logging 4104	T1059.001	Anomaly	Active Directory Lateral Movement, Scattered Lapsus$ Hunters	2026-10-09
Windows Export Certificate	Windows Event Log CertificateServicesClient 1007	T1552.004 T1649	Anomaly	Windows Certificate Services	2026-10-09
WMI Permanent Event Subscription	Windows Event Log WMI Activity 5861	T1546.003	Anomaly	Suspicious WMI Use	2026-10-09
Windows Non-System Account Targeting Lsass	Sysmon EventID 10	T1003.001	TTP	Lokibot, CISA AA23-347A, Credential Dumping, Scattered Lapsus$ Hunters	2026-10-09
Windows PowerShell Get CIMInstance Remote Computer	Powershell Script Block Logging 4104	T1059.001	Anomaly	Active Directory Lateral Movement	2026-10-09
Windows PowerShell Export Certificate	Powershell Script Block Logging 4104	T1552.004 T1649	Anomaly	Windows Certificate Services	2026-10-09
Windows Event Triggered Image File Execution Options Injection	Windows Event Log Application 3000	T1546.012	Hunting	Windows Persistence Techniques	2026-10-09
Access LSASS Memory for Dump Creation	Sysmon EventID 10	T1003.001	TTP	Lokibot, CISA AA23-347A, Cactus Ransomware, Credential Dumping, Scattered Lapsus$ Hunters	2026-10-09
Windows Steal Authentication Certificates CryptoAPI	Windows Event Log CAPI2 70	T1649	Anomaly	Windows Certificate Services, Hellcat Ransomware	2026-10-09
PowerShell Invoke CIMMethod CIMSession	Powershell Script Block Logging 4104	T1047	Anomaly	Malicious PowerShell, Active Directory Lateral Movement, Scattered Lapsus$ Hunters	2026-10-09
Windows PowerShell Export PfxCertificate	Powershell Script Block Logging 4104	T1552.004 T1649	Anomaly	Windows Certificate Services, Scattered Lapsus$ Hunters, Water Gamayun	2026-10-09
Detect New Local Admin account	Windows Event Log Security 4732, Windows Event Log Security 4720	T1136.001	TTP	CISA AA22-257A, CISA AA24-241A, HAFNIUM Group, DHS Report TA18-074A, Scattered Lapsus$ Hunters	2026-10-09
WMI Permanent Event Subscription - Sysmon	Sysmon EventID 21	T1546.003	Anomaly	Suspicious WMI Use	2026-10-09
Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script	Powershell Script Block Logging 4104	T1071.001 T1078 T1212 T1482	TTP	Azure Active Directory Persistence, Azure Active Directory Account Takeover, Azure Active Directory Privilege Escalation	2026-10-09
Windows Access Token Manipulation SeDebugPrivilege	Windows Event Log Security 4703	T1134.002	Anomaly	WinDealer RAT, Gh0st RAT, CISA AA23-347A, China-Nexus Threat Activity, DarkGate Malware, SnappyBee, Lokibot, Derusbi, Meduza Stealer, ValleyRAT, Scattered Lapsus$ Hunters, Salat Stealer, GhostRedirector IIS Module and Rungan Backdoor, Salt Typhoon, AsyncRAT, PlugX, Vidar Stealer, Brute Ratel C4, Tuoni, PathWiper	2026-10-09
Ollama Possible Memory Exhaustion Resource Abuse	Ollama Server	T1499	Anomaly	Suspicious Ollama Activities	2026-10-09
Ollama Possible API Endpoint Scan Reconnaissance	Ollama Server	T1595	Anomaly	Suspicious Ollama Activities	2026-10-09
Ollama Excessive API Requests	Ollama Server	T1498	Anomaly	Suspicious Ollama Activities	2026-10-09
Ollama Possible Model Exfiltration Data Leakage	Ollama Server	T1048	Anomaly	Suspicious Ollama Activities	2026-10-09
Ollama Possible RCE via Model Loading	Ollama Server	T1190	Anomaly	Suspicious Ollama Activities	2026-10-09
Monitor Registry Keys for Print Monitors	Sysmon EventID 13	T1547.010	TTP	Windows Registry Abuse, Suspicious Windows Registry Activities, Windows Persistence Techniques	2026-10-09
Credential Dumping via Copy Command from Shadow Copy	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.003	TTP	Credential Dumping, Compromised Windows Host	2026-10-09
Windows NirSoft Utilities	Sysmon EventID 1	T1588.002	Anomaly	WhisperGate, Unusual Processes, Data Destruction	2026-10-09
ServicePrincipalNames Discovery with SetSPN	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1558.003	TTP	Compromised Windows Host, Active Directory Discovery, Active Directory Kerberos Attacks, Active Directory Privilege Escalation	2026-10-09
Detect mshta inline hta execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.005	TTP	XWorm, Living Off The Land, BlankGrabber Stealer, Gozi Malware, APT37 Rustonotto and FadeStealer, Compromised Windows Host, Suspicious MSHTA Activity	2026-10-09
Deleting Shadow Copies	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1490	TTP	Storm-2460 CLFS Zero Day Exploitation, SamSam Ransomware, CISA AA22-264A, LockBit Ransomware, Chaos Ransomware, Windows Log Manipulation, VanHelsing Ransomware, Void Manticore, Cactus Ransomware, Ransomware, Rhysida Ransomware, Clop Ransomware, Medusa Ransomware, DarkGate Malware, Black Basta Ransomware, Prestige Ransomware, Compromised Windows Host, Termite Ransomware	2026-10-09
Windows Indirect Command Execution Via forfiles	Sysmon EventID 1	T1202	TTP	Living Off The Land, Windows Post-Exploitation	2026-10-09
Windows Entra User Management Via Azure CLI	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1078.004 T1098 T1136	Anomaly	Azure Active Directory Persistence	2026-10-09
Malicious PowerShell Process - Encoded Command	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1027	Hunting	Hermetic Wiper, Data Destruction, Microsoft WSUS CVE-2025-59287, Qakbot, Microsoft SharePoint Vulnerabilities, GhostRedirector IIS Module and Rungan Backdoor, Volt Typhoon, SolarWinds WHD RCE Post Exploitation, Malicious PowerShell, Lumma Stealer, NOBELIUM Group, DarkCrystal RAT, Scattered Spider, WhisperGate, Crypto Stealer, CISA AA22-320A, Sandworm Tools	2026-10-09
Windows Create Local Administrator Account Via Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1136.001	Anomaly	CISA AA22-257A, CISA AA24-241A, GhostRedirector IIS Module and Rungan Backdoor, DHS Report TA18-074A, Medusa Ransomware, Azorult, DarkGate Malware, Scattered Lapsus$ Hunters	2026-10-09
Windows Proxy Execution of .NET Utilities via Scripts	Sysmon EventID 1	T1218	Anomaly	VIP Keylogger	2026-10-09
Remote Process Instantiation via WMI	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1047	TTP	CISA AA23-347A, Void Manticore, Suspicious WMI Use, Ransomware, China-Nexus Threat Activity, Salt Typhoon, Active Directory Lateral Movement	2026-10-09
Windows Steal Authentication Certificates Export PfxCertificate	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1649	Anomaly	Windows Certificate Services	2026-10-09
Windows InstallUtil in Non Standard Path	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003 T1218.004	TTP	Data Destruction, Living Off The Land, Masquerading - Rename System Utilities, Ransomware, Signed Binary Proxy Execution InstallUtil, WhisperGate, Unusual Processes	2026-10-09
Detect Path Interception By Creation Of program exe	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1574.009	TTP	Scattered Lapsus$ Hunters, Windows Persistence Techniques	2026-10-09
Creation of Shadow Copy	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.003	TTP	Compromised Windows Host, Volt Typhoon, Credential Dumping	2026-10-09
Scheduled Task Deleted Or Created via CMD	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1053.005	Anomaly	CISA AA22-257A, Quasar RAT, AgentTesla, CISA AA23-347A, MoonPeak, NjRAT, DarkCrystal RAT, China-Nexus Threat Activity, Phemedrone Stealer, Remcos, ShrinkLocker, CISA AA24-241A, 0bj3ctivity Stealer, XWorm, Lokibot, Living Off The Land, DHS Report TA18-074A, SolarWinds WHD RCE Post Exploitation, Rhysida Ransomware, Scheduled Tasks, NOBELIUM Group, ValleyRAT, Windows Persistence Techniques, Prestige Ransomware, Sandworm Tools, Winter Vivern, Qakbot, Scattered Spider, Salt Typhoon, RedLine Stealer, AsyncRAT, Trickbot, PlugX, Medusa Ransomware, NetSupport RMM Tool Abuse, Azorult, Amadey, APT37 Rustonotto and FadeStealer	2026-10-09
Suspicious mshta child process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.005	TTP	Lumma Stealer, Living Off The Land, MuddyWater, Suspicious MSHTA Activity	2026-10-09
Shim Database File Creation	Sysmon EventID 11	T1546.011	TTP	Windows Persistence Techniques	2026-10-09
Windows Curl Upload to Remote Destination	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1105	TTP	Microsoft WSUS CVE-2025-59287, PromptLock, Axios Supply Chain Post Compromise, Cisco Network Visibility Module Analytics, NPM Supply Chain Compromise, Ingress Tool Transfer, Compromised Windows Host	2026-10-09
Linux Ingress Tool Transfer Hunting	Sysmon for Linux EventID 1	T1105	Hunting	XorDDos, Axios Supply Chain Post Compromise, NPM Supply Chain Compromise, Ingress Tool Transfer, Linux Living Off The Land	2026-10-09
Windows Steal Authentication Certificates Export Certificate	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1649	Anomaly	Windows Certificate Services	2026-10-09
Possible Lateral Movement PowerShell Spawn	Sysmon EventID 1	T1021.003 T1021.006 T1047 T1053.005 T1059.001 T1218.014 T1543.003	Anomaly	Hermetic Wiper, CISA AA24-241A, Data Destruction, Microsoft WSUS CVE-2025-59287, Malicious PowerShell, Scheduled Tasks, Active Directory Lateral Movement	2026-10-09
Registry Keys Used For Privilege Escalation	Sysmon EventID 13	T1546.012	TTP	Hermetic Wiper, Data Destruction, Cloud Federated Credential Abuse, Suspicious Windows Registry Activities, Windows Registry Abuse, Windows Privilege Escalation	2026-10-09
Hiding Files And Directories With Attrib exe	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1222.001	TTP	Windows Defense Evasion Tactics, VIP Keylogger, Malicious Inno Setup Loader, Azorult, Windows Persistence Techniques, Compromised Windows Host, Crypto Stealer	2026-10-09
Windows Odbcconf Hunting	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.008	Hunting	Living Off The Land	2026-10-09
Windows MOF Event Triggered Execution via WMI	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1546.003	TTP	Living Off The Land, Compromised Windows Host	2026-10-09
Windows Ngrok Reverse Proxy Usage	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1090 T1102 T1572	Anomaly	Reverse Network Proxy, CISA AA24-241A, CISA AA22-320A	2026-10-09
Windows Scheduled Task Service Spawned Shell	Sysmon EventID 1	T1053.005 T1059	TTP	Windows Persistence Techniques	2026-10-09
Jscript Execution Using Cscript App	Sysmon EventID 1	T1059.007	Anomaly	Remcos, FIN7	2026-10-09
Overwriting Accessibility Binaries	Sysmon EventID 11	T1546.008	TTP	Hermetic Wiper, Flax Typhoon, Data Destruction, Windows Privilege Escalation	2026-10-09
Linux At Application Execution	Sysmon for Linux EventID 1	T1053.002	Anomaly	Linux Persistence Techniques, Cisco Isovalent Suspicious Activity, Linux Privilege Escalation, Scheduled Tasks, Linux Living Off The Land	2026-10-09
Vbscript Execution Using Wscript App	Sysmon EventID 1	T1059.005	TTP	AsyncRAT, Remcos, FIN7	2026-10-09
Enable WDigest UseLogonCredential Registry	Sysmon EventID 13	T1003 T1112	TTP	Credential Dumping, CISA AA22-320A, Windows Registry Abuse	2026-10-09
Windows SSH Proxy Command	Sysmon EventID 1	T1059.001 T1105 T1572	Anomaly	Living Off The Land, ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day, Hellcat Ransomware	2026-10-09
Registry Keys for Creating SHIM Databases	Sysmon EventID 13	T1546.011	TTP	Windows Registry Abuse, Suspicious Windows Registry Activities, Windows Persistence Techniques	2026-10-09
Short Lived Windows Accounts	Windows Event Log System 4726, Windows Event Log System 4720	T1078.003 T1136.001	TTP	GhostRedirector IIS Module and Rungan Backdoor, Active Directory Lateral Movement	2026-10-09
Create or delete windows shares using net exe	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1070.005	TTP	CISA AA22-277A, Hidden Cobra Malware, Windows Post-Exploitation, DarkGate Malware, Prestige Ransomware	2026-10-09
Windows Remote Create Service	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1543.003	Anomaly	CISA AA23-347A, BlackSuit Ransomware, Active Directory Lateral Movement	2026-10-09
Windows Mimikatz Crypto Export File Extensions	Sysmon EventID 11	T1649	Anomaly	Windows Certificate Services, CISA AA23-347A, Sandworm Tools	2026-10-09
Windows Cabinet File Extraction Via Expand	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1105	TTP	APT37 Rustonotto and FadeStealer, NetSupport RMM Tool Abuse	2026-10-09
USN Journal Deletion	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1070	TTP	Windows Log Manipulation, Ransomware	2026-10-09
Windows DISM Remove Defender	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	TTP	CISA AA23-347A, Compromised Windows Host, Windows Defense Evasion Tactics	2026-10-09
Windows Suspicious React or Next.js Child Process	Sysmon EventID 1	T1059.001 T1059.003 T1190	TTP	React2Shell	2026-10-09
Linux Kernel Module Enumeration	Sysmon for Linux EventID 1	T1014 T1082	Anomaly	Linux Rootkit, XorDDos	2026-10-09
Windows File Download Via CertUtil	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1105	TTP	CISA AA22-277A, Forest Blizzard, DarkSide Ransomware, Flax Typhoon, Living Off The Land, ProxyNotShell, Cisco Network Visibility Module Analytics, Ingress Tool Transfer, Compromised Windows Host	2026-10-09
Windows Command Shell DCRat ForkBomb Payload	Sysmon EventID 1	T1059.003	TTP	Compromised Windows Host, DarkCrystal RAT	2026-10-09
System Information Discovery Detection	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1082	TTP	Cleo File Transfer Software, Interlock Ransomware, Windows Discovery Techniques, BlankGrabber Stealer, Medusa Ransomware, SolarWinds WHD RCE Post Exploitation, NetSupport RMM Tool Abuse, Lotus Blossom Chrysalis Backdoor, BlackSuit Ransomware, Gozi Malware, LAMEHUG	2026-10-09
Process Execution via WMI	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1047	TTP	Suspicious WMI Use	2026-10-09
Disabling Remote User Account Control	Sysmon EventID 13	T1548.002	TTP	Windows Defense Evasion Tactics, AgentTesla, Suspicious Windows Registry Activities, Windows Registry Abuse, Azorult, Remcos	2026-10-09
Creation of Shadow Copy with wmic and powershell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.003	TTP	Living Off The Land, Volt Typhoon, Compromised Windows Host, Credential Dumping	2026-10-09
Windows DisableAntiSpyware Registry	Sysmon EventID 13	T1685	TTP	CISA AA22-264A, Windows Defense Evasion Tactics, RedLine Stealer, CISA AA23-347A, SolarWinds WHD RCE Post Exploitation, Windows Registry Abuse, Azorult, Ryuk Ransomware	2026-10-09
Ping Sleep Batch Command	Sysmon EventID 1	T1497.003	Anomaly	Data Destruction, Quasar RAT, BlackByte Ransomware, Gh0st RAT, Warzone RAT, Void Manticore, Meduza Stealer, WhisperGate	2026-10-09
Windows Indirect Command Execution Via pcalua	Sysmon EventID 1	T1202	TTP	Living Off The Land	2026-10-09
Windows Time Based Evasion	Sysmon EventID 1	T1497.003	TTP	BlankGrabber Stealer, NjRAT	2026-10-09
Linux Ingress Tool Transfer with Curl	Sysmon for Linux EventID 1	T1105	Anomaly	Ingress Tool Transfer, Linux Living Off The Land, XorDDos, NPM Supply Chain Compromise	2026-10-09
Registry Keys Used For Persistence	Sysmon EventID 13	T1547.001	TTP	Chaos Ransomware, WinDealer RAT, Quasar RAT, Gh0st RAT, CISA AA23-347A, SystemBC, Emotet Malware DHS Report TA18-201A, MoonPeak, Cactus Ransomware, Ransomware, IcedID, BlackSuit Ransomware, NjRAT, Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns, Braodo Stealer, DarkGate Malware, China-Nexus Threat Activity, DarkCrystal RAT, SnappyBee, Remcos, BlackByte Ransomware, XWorm, 0bj3ctivity Stealer, Warzone RAT, DHS Report TA18-074A, Derusbi, Lokibot, MuddyWater, ValleyRAT, Windows Persistence Techniques, Salat Stealer, Interlock Ransomware, Qakbot, Sneaky Active Directory Persistence Tricks, Suspicious Windows Registry Activities, Windows Registry Abuse, Salt Typhoon, Snake Keylogger, AsyncRAT, RedLine Stealer, Castle RAT, Starland RAT Campaign, NetSupport RMM Tool Abuse, Axios Supply Chain Post Compromise, Phantom Stealer, Azorult, Amadey, APT37 Rustonotto and FadeStealer, Suspicious MSHTA Activity	2026-10-09
Detect Rundll32 Inline HTA Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.005	TTP	Living Off The Land, APT37 Rustonotto and FadeStealer, NOBELIUM Group, Suspicious MSHTA Activity	2026-10-09
RunDLL Loading DLL By Ordinal	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	TTP	Living Off The Land, IcedID, Suspicious Rundll32 Activity, Unusual Processes	2026-10-09
Suspicious Reg exe Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1112	Anomaly	DHS Report TA18-074A, Windows Defense Evasion Tactics, Disabling Security Tools	2026-10-09
PowerShell Start-BitsTransfer	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1197	TTP	Gozi Malware, BITS Jobs	2026-10-09
Windows ESX Admins Group Creation via Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1136.001 T1136.002	TTP	VMware ESXi AD Integration Authentication Bypass CVE-2024-37085	2026-10-09
Shim Database Installation With Suspicious Parameters	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1546.011	TTP	Compromised Windows Host, Windows Persistence Techniques	2026-10-09
Detect PsExec With accepteula Flag	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.002	TTP	SamSam Ransomware, DarkSide Ransomware, Seashell Blizzard, BlackByte Ransomware, HAFNIUM Group, VanHelsing Ransomware, DHS Report TA18-074A, Volt Typhoon, Storm-0501 Ransomware, Medusa Ransomware, Cactus Ransomware, Rhysida Ransomware, IcedID, DarkGate Malware, Active Directory Lateral Movement, CISA AA22-320A, Sandworm Tools	2026-10-09
Credential Dumping via Symlink to Shadow Copy	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.003	TTP	Credential Dumping, Compromised Windows Host	2026-10-09
Windows Outlook WebView Registry Modification	Sysmon EventID 13	T1112	Anomaly	Suspicious Windows Registry Activities	2026-10-09
Windows System Binary Proxy Execution Compiled HTML File Decompile	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.001	TTP	APT37 Rustonotto and FadeStealer, Living Off The Land, Compromised Windows Host, Suspicious Compiled HTML Activity	2026-10-09
Impacket Lateral Movement WMIExec Commandline Parameters	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.002 T1021.003 T1047 T1543.003	TTP	CISA AA22-277A, Storm-0501 Ransomware, Data Destruction, Volt Typhoon, Industroyer2, Gozi Malware, Graceful Wipe Out Attack, WhisperGate, Prestige Ransomware, Compromised Windows Host, Active Directory Lateral Movement	2026-10-09
Svchost LOLBAS Execution Process Spawn	Sysmon EventID 1	T1053.005	TTP	Living Off The Land, Hellcat Ransomware, Scheduled Tasks, Active Directory Lateral Movement	2026-10-09
Windows Create Local Account	Windows Event Log Security 4720	T1136.001	Anomaly	GhostRedirector IIS Module and Rungan Backdoor, CISA AA24-241A, Scattered Lapsus$ Hunters, Active Directory Password Spraying	2026-10-09
Windows For Loop Usage Within Cmd.exe To Execute Commands	Sysmon EventID 1	T1059.003	Anomaly	Living Off The Land, Suspicious Command-Line Executions, Fake CAPTCHA Campaigns, Windows Post-Exploitation, Compromised Windows Host	2026-10-09
Detect HTML Help Spawn Child Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.001	TTP	Compromised Windows Host, Suspicious Compiled HTML Activity, AgentTesla, Living Off The Land, APT37 Rustonotto and FadeStealer	2026-10-09
Ollama Abnormal Service Crash Availability Attack	Ollama Server	T1489	Anomaly	Suspicious Ollama Activities	2026-10-09
Ollama Suspicious Prompt Injection Jailbreak	Ollama Server	T1059 T1190	Anomaly	Suspicious Ollama Activities	2026-10-09
Windows NirSoft AdvancedRun	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1588.002	TTP	Data Destruction, WhisperGate, Unusual Processes, Ransomware	2026-10-09
Windows Non-System Process Querying Definition Update	Sysmon EventID 22	T1068 T1071.001	Anomaly	BlueHammer, RedSun, Windows Privilege Escalation	2026-10-08
Windows Cloud Files Filter Loaded by Uncommon Process	Sysmon EventID 7	T1543.003	Anomaly	BlueHammer, RedSun	2026-10-08
Cisco Secure Firewall - Communication Over Suspicious Ports	Cisco Secure Firewall Threat Defense Connection Event	T1021 T1055 T1059.001 T1105 T1219 T1571	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-10-08
Cisco Secure Firewall - Connection to File Sharing Domain	Cisco Secure Firewall Threat Defense Connection Event	T1071.001 T1090.002 T1105 T1567.002 T1588.002	Anomaly	Cisco Secure Firewall Threat Defense Analytics, Scattered Lapsus$ Hunters	2026-10-08
Detect Remote Access Software Usage URL	Palo Alto Network Threat	T1219	Anomaly	Insider Threat, CISA AA24-241A, Interlock Ransomware, Command And Control, Remote Monitoring and Management Software, Ransomware, Scattered Lapsus$ Hunters	2026-10-08
Detect Remote Access Software Usage FileInfo	Sysmon EventID 1	T1219	Anomaly	Insider Threat, Interlock Ransomware, Seashell Blizzard, Command And Control, Remote Monitoring and Management Software, Cactus Ransomware, Ransomware, Gozi Malware, Scattered Spider, Scattered Lapsus$ Hunters	2026-10-08
Cisco Secure Firewall - Remote Access Software Usage Traffic	Cisco Secure Firewall Threat Defense Connection Event	T1219	Anomaly	Insider Threat, Interlock Ransomware, Cisco Secure Firewall Threat Defense Analytics, Command And Control, Remote Monitoring and Management Software, Ransomware, Scattered Spider, Scattered Lapsus$ Hunters	2026-10-08
Detect Remote Access Software Usage DNS	Sysmon EventID 22	T1219	Anomaly	Insider Threat, CISA AA24-241A, Interlock Ransomware, Command And Control, Remote Monitoring and Management Software, Ransomware, Scattered Spider, Scattered Lapsus$ Hunters	2026-10-08
Detect Remote Access Software Usage Traffic	Palo Alto Network Traffic	T1219	Anomaly	Insider Threat, Interlock Ransomware, Command And Control, Remote Monitoring and Management Software, Ransomware, Scattered Spider, Scattered Lapsus$ Hunters	2026-10-08
AWS EC2 Startup Script Modified on Stopped Instance	AWS CloudTrail	T1578.005	TTP	Suspicious Cloud User Activities	2026-10-07
Download Files Using Telegram	Sysmon EventID 15	T1105	TTP	XMRig, 0bj3ctivity Stealer, Phemedrone Stealer, Braodo Stealer, Snake Keylogger, Crypto Stealer, Water Gamayun	2026-10-06
Windows DNS Query Request To TinyUrl	Sysmon EventID 22	T1105	Anomaly	Malicious Inno Setup Loader, Braodo Stealer	2026-10-06
Non Firefox Process Access Firefox Profile Dir	Windows Event Log Security 4663	T1555.003	Anomaly	Quasar RAT, CISA AA23-347A, AgentTesla, BlankGrabber Stealer, NjRAT, Phemedrone Stealer, China-Nexus Threat Activity, DarkGate Malware, Braodo Stealer, SnappyBee, Remcos, 0bj3ctivity Stealer, Lokibot, Warzone RAT, 3CX Supply Chain Attack, Salat Stealer, FIN7, Salt Typhoon, Snake Keylogger, RedLine Stealer, Vidar Stealer, VIP Keylogger, Malicious Inno Setup Loader, Phantom Stealer, StealC Stealer, Azorult	2026-10-06
Windows DNS Query Request by Telegram Bot API	Sysmon EventID 22	T1071.004 T1102.002	Anomaly	Starland RAT Campaign, VIP Keylogger, 0bj3ctivity Stealer, BlankGrabber Stealer, Phantom Stealer, Braodo Stealer, Crypto Stealer	2026-10-06
Executables Or Script Creation In Temp Path	Sysmon EventID 11	T1036	Anomaly	LockBit Ransomware, Chaos Ransomware, WinDealer RAT, Handala Wiper, Interlock Rat, CISA AA23-347A, AgentTesla, Volt Typhoon, MoonPeak, Industroyer2, IcedID, NjRAT, DarkCrystal RAT, China-Nexus Threat Activity, DarkGate Malware, XML Runner Loader, WhisperGate, Double Zero Destructor, Crypto Stealer, Remcos, SnappyBee, PromptLock, SesameOp, Data Destruction, BlackByte Ransomware, Lokibot, Derusbi, Warzone RAT, Meduza Stealer, Rhysida Ransomware, ValleyRAT, Braodo Stealer, Hermetic Wiper, Salat Stealer, Qakbot, Void Manticore, PromptFlux, Graceful Wipe Out Attack, Salt Typhoon, Snake Keylogger, AsyncRAT, Trickbot, RedLine Stealer, PlugX, XMRig, AcidPour, Vidar Stealer, VIP Keylogger, Axios Supply Chain Post Compromise, Swift Slicer, RoguePlanet, Phantom Stealer, Azorult, Brute Ratel C4, Amadey, APT37 Rustonotto and FadeStealer	2026-10-06
Windows Boot or Logon Autostart Execution In Startup Folder	Sysmon EventID 11	T1547.001	Anomaly	Interlock Ransomware, Chaos Ransomware, Starland RAT Campaign, Quasar RAT, XWorm, BlankGrabber Stealer, PromptFlux, Phantom Stealer, Gozi Malware, NjRAT, APT37 Rustonotto and FadeStealer, Braodo Stealer, RedLine Stealer, Crypto Stealer	2026-10-06
Windows Password Managers Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1555.005	Anomaly	Windows Post-Exploitation, Scattered Lapsus$ Hunters, Scattered Spider, Braodo Stealer, Prestige Ransomware	2026-10-06
Executables Or Script Creation In Suspicious Path	Sysmon EventID 11	T1036	Anomaly	LockBit Ransomware, Chaos Ransomware, WinDealer RAT, Quasar RAT, Handala Wiper, AgentTesla, CISA AA23-347A, Volt Typhoon, Industroyer2, Cactus Ransomware, SystemBC, MoonPeak, IcedID, Interlock Rat, NjRAT, DarkCrystal RAT, China-Nexus Threat Activity, DarkGate Malware, XML Runner Loader, WhisperGate, Double Zero Destructor, Crypto Stealer, Remcos, SnappyBee, PromptLock, SesameOp, Data Destruction, BlackByte Ransomware, Lokibot, Warzone RAT, Earth Alux, Derusbi, DynoWiper, Meduza Stealer, Rhysida Ransomware, ValleyRAT, Braodo Stealer, Hermetic Wiper, Interlock Ransomware, Qakbot, GhostRedirector IIS Module and Rungan Backdoor, Void Manticore, Graceful Wipe Out Attack, Salt Typhoon, Snake Keylogger, AsyncRAT, Trickbot, RedLine Stealer, Castle RAT, PlugX, XMRig, AcidPour, Starland RAT Campaign, VIP Keylogger, Vidar Stealer, NailaoLocker Ransomware, Swift Slicer, Axios Supply Chain Post Compromise, Phantom Stealer, Brute Ratel C4, Azorult, Amadey	2026-10-06
WMI Temporary Event Subscription		T1047	TTP	Suspicious WMI Use	2026-10-05
Detect WMI Event Subscription Persistence	Sysmon EventID 20	T1546.003	TTP	Hellcat Ransomware, Suspicious WMI Use	2026-10-05
Windows PowerShell ScheduleTask	Powershell Script Block Logging 4104	T1053.005 T1059.001	Anomaly	Starland RAT Campaign, Scheduled Tasks, Scattered Spider	2026-10-02
Get WMIObject Group Discovery with Script Block Logging	Powershell Script Block Logging 4104	T1069.001	Hunting	Active Directory Discovery	2026-10-02
Windows PowerShell Disable HTTP Logging	Powershell Script Block Logging 4104	T1505.004 T1685.001	TTP	Windows Defense Evasion Tactics, IIS Components	2026-10-02
Powershell Execute COM Object	Powershell Script Block Logging 4104	T1059.001 T1546.015	TTP	Malicious PowerShell, Data Destruction, Hermetic Wiper, Ransomware	2026-10-02
Windows DLL Search Order Hijacking Hunt with Sysmon	Sysmon EventID 7	T1574.001	Hunting	Qakbot, Malicious Inno Setup Loader, Living Off The Land, Windows Defense Evasion Tactics	2026-10-02
Kerberoasting spn request with RC4 encryption	Windows Event Log Security 4769	T1558.003	TTP	Hermetic Wiper, Data Destruction, Windows Privilege Escalation, Active Directory Kerberos Attacks, Compromised Windows Host	2026-10-02
Linux Auditd System Network Configuration Discovery	Linux Auditd Syscall	T1016	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-10-02
Windows Root Domain linked policies Discovery	Powershell Script Block Logging 4104	T1087.002	Anomaly	Industroyer2, Active Directory Discovery, Data Destruction	2026-10-02
Linux Magic SysRq Key Abuse	Linux Auditd Path, Linux Auditd Cwd	T1059.004 T1489 T1499 T1529	TTP	Compromised Linux Host	2026-10-02
Windows Linked Policies In ADSI Discovery	Powershell Script Block Logging 4104	T1087.002	Anomaly	Industroyer2, Active Directory Discovery, Data Destruction	2026-10-02
Linux Auditd Stop Services	Linux Auditd Service Stop	T1489	Hunting	AwfulShred, Industroyer2, Compromised Linux Host, Data Destruction	2026-10-02
Windows PowerView Kerberos Service Ticket Request	Powershell Script Block Logging 4104	T1558.003	TTP	Active Directory Kerberos Attacks, Rhysida Ransomware	2026-10-02
Windows Event Logging Service Has Shutdown	Windows Event Log Security 1100	T1685.005	Hunting	Clop Ransomware, Windows Log Manipulation, Ransomware, Scattered Lapsus$ Hunters	2026-10-02
Linux Auditd Possible Access To Credential Files	Linux Auditd Proctitle	T1003.008	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Axios Supply Chain Post Compromise, China-Nexus Threat Activity, Salt Typhoon	2026-10-02
Windows Input Capture Using Credential UI Dll	Sysmon EventID 7	T1056.002	Hunting	APT37 Rustonotto and FadeStealer, Brute Ratel C4	2026-10-02
Domain Group Discovery with Adsisearcher	Powershell Script Block Logging 4104	T1069.002	TTP	Active Directory Discovery, Scattered Lapsus$ Hunters	2026-10-02
Linux Auditd Whoami User Discovery	Linux Auditd Syscall	T1033	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Linux Living Off The Land, QuietVault	2026-10-02
Windows Event Log Cleared	Windows Event Log System 104, Windows Event Log Security 1102	T1685.005	TTP	Salat Stealer, CISA AA22-264A, Windows Log Manipulation, Ransomware, Clop Ransomware, Compromised Windows Host, ShrinkLocker	2026-10-02
GetCurrent User with PowerShell Script Block	Powershell Script Block Logging 4104	T1033	Hunting	Active Directory Discovery	2026-10-02
GetAdComputer with PowerShell Script Block	Powershell Script Block Logging 4104	T1018	Hunting	Gozi Malware, Active Directory Discovery, Medusa Ransomware, CISA AA22-320A	2026-10-02
GetDomainGroup with PowerShell Script Block	Powershell Script Block Logging 4104	T1069.002	TTP	Active Directory Discovery	2026-10-02
Linux Auditd Insert Kernel Module Using Insmod Utility	Linux Auditd Syscall	T1547.006	Anomaly	Compromised Linux Host, Linux Persistence Techniques, XorDDos, Linux Privilege Escalation, Linux Rootkit	2026-10-02
Delete ShadowCopy With PowerShell	Powershell Script Block Logging 4104	T1490	TTP	DarkSide Ransomware, VanHelsing Ransomware, Cactus Ransomware, Ransomware, DarkGate Malware, Revil Ransomware	2026-10-02
Windows Multiple Users Failed To Authenticate From Host Using NTLM	Windows Event Log Security 4776	T1110.003	TTP	Volt Typhoon, Active Directory Password Spraying	2026-10-02
Windows IIS Components New Module Added	Windows IIS 29	T1505.004	TTP	GhostRedirector IIS Module and Rungan Backdoor, IIS Components	2026-10-02
GetAdGroup with PowerShell Script Block	Powershell Script Block Logging 4104	T1069.002	Hunting	Active Directory Discovery, Scattered Lapsus$ Hunters	2026-10-02
Linux Auditd File And Directory Discovery	Linux Auditd Execve	T1083	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-10-02
Powershell Get LocalGroup Discovery with Script Block Logging	Powershell Script Block Logging 4104	T1069.001	Hunting	Active Directory Discovery	2026-10-02
Network Share Discovery Via Dir Command	Windows Event Log Security 5140	T1135	Hunting	IcedID	2026-10-02
Windows PowerShell IIS Components WebGlobalModule Usage	Powershell Script Block Logging 4104	T1505.004	Anomaly	GhostRedirector IIS Module and Rungan Backdoor, IIS Components	2026-10-02
Get ADUser with PowerShell Script Block	Powershell Script Block Logging 4104	T1087.002	Hunting	CISA AA23-347A, Active Directory Discovery	2026-10-02
Powershell COM Hijacking InprocServer32 Modification	Powershell Script Block Logging 4104	T1059.001 T1546.015	TTP	Malicious PowerShell	2026-10-02
AdsiSearcher Account Discovery	Powershell Script Block Logging 4104	T1087.002	TTP	Data Destruction, CISA AA23-347A, Industroyer2, Scattered Lapsus$ Hunters, Active Directory Discovery	2026-10-02
Linux Auditd Dd File Overwrite	Linux Auditd Proctitle	T1485	TTP	Industroyer2, Compromised Linux Host, Data Destruction	2026-10-02
Creation of lsass Dump with Taskmgr	Sysmon EventID 11	T1003.001	TTP	CISA AA22-257A, Seashell Blizzard, Cactus Ransomware, Credential Dumping, Scattered Lapsus$ Hunters	2026-10-02
Linux Auditd Add User Account	Linux Auditd Proctitle	T1136.001	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-10-02
Cisco Isovalent - Curl Execution With Insecure Flags	Cisco Isovalent Process Exec	T1105	Anomaly	Cisco Isovalent Suspicious Activity	2026-10-02
Windows File Share Discovery With Powerview	Powershell Script Block Logging 4104	T1135	TTP	Active Directory Discovery, Active Directory Privilege Escalation	2026-10-02
Remote System Discovery with Adsisearcher	Powershell Script Block Logging 4104	T1018	TTP	Active Directory Discovery	2026-10-02
Linux Auditd Clipboard Data Copy	Linux Auditd Execve	T1115	Anomaly	Linux Living Off The Land, Compromised Linux Host	2026-10-02
User Discovery With Env Vars PowerShell Script Block	Powershell Script Block Logging 4104	T1033	Hunting	Active Directory Discovery	2026-10-02
Windows Snake Malware Service Create	Windows Event Log System 7045	T1547.006 T1569.002	TTP	Snake Malware, Compromised Windows Host	2026-10-02
Linux Insert Kernel Module Using Insmod Utility	Sysmon for Linux EventID 1	T1547.006	Anomaly	Linux Rootkit, Linux Persistence Techniques, XorDDos, Linux Privilege Escalation	2026-10-02
Windows RunMRU Command Execution	Sysmon EventID 13	T1202	Anomaly	Lumma Stealer, Fake CAPTCHA Campaigns	2026-10-02
Windows SQLCMD Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.003	Hunting	GhostRedirector IIS Module and Rungan Backdoor, SQL Server Abuse	2026-10-02
Windows WMI Reconnaissance Class Query	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1047	Anomaly	BlankGrabber Stealer	2026-10-02
GetLocalUser with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1087.001	Hunting	Active Directory Discovery	2026-10-02
MacOS Keychains Dumped	Osquery Results	T1555.001	TTP	MacOS Privilege Escalation	2026-10-02
GetCurrent User with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1033	Hunting	Active Directory Discovery	2026-10-02
Disable Logs Using WevtUtil	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685.005	TTP	CISA AA23-347A, Ransomware, Rhysida Ransomware	2026-10-02
Windows Modify Registry Do Not Connect To Win Update	Sysmon EventID 13	T1112	Anomaly	RedLine Stealer	2026-10-02
FodHelper UAC Bypass	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1112 T1548.002	TTP	Windows Defense Evasion Tactics, BlankGrabber Stealer, IcedID, ValleyRAT, Compromised Windows Host	2026-10-02
Windows Registry Certificate Added	Sysmon EventID 13	T1553.004	Anomaly	Windows Drivers, Windows Registry Abuse	2026-10-02
Windows Modify Registry Tamper Protection	Sysmon EventID 13	T1112	TTP	RedLine Stealer, Scattered Lapsus$ Hunters	2026-10-02
Windows Indirect Command Execution Via Series Of Forfiles	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1202	Anomaly	Prestige Ransomware, Windows Post-Exploitation	2026-10-02
Windows New EventLog ChannelAccess Registry Value Set	Sysmon EventID 13	T1685.001	Anomaly	Defense Evasion or Unauthorized Access Via SDDL Tampering, LockBit Ransomware	2026-10-02
Windows Disable Notification Center	Sysmon EventID 13	T1112	Anomaly	CISA AA23-347A, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-10-02
Windows Snake Malware Registry Modification wav OpenWithProgIds	Sysmon EventID 13	T1112	TTP	Snake Malware	2026-10-02
Windows Modify Registry Disable Windows Security Center Notif	Sysmon EventID 13	T1112	Anomaly	CISA AA23-347A, Azorult	2026-10-02
Windows Modify Registry EnableLinkedConnections	Sysmon EventID 13	T1112	TTP	BlackByte Ransomware	2026-10-02
Linux Clipboard Data Copy	Sysmon for Linux EventID 1	T1115	Anomaly	Linux Living Off The Land	2026-10-02
Windows Modify Registry Disabling WER Settings	Sysmon EventID 13	T1112	TTP	CISA AA23-347A, Azorult	2026-10-02
Windows System Script Proxy Execution Syncappvpublishingserver	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1216 T1218	TTP	Living Off The Land	2026-10-02
WBAdmin Delete System Backups	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1490	TTP	Storm-2460 CLFS Zero Day Exploitation, Chaos Ransomware, Storm-0501 Ransomware, Ransomware, Ryuk Ransomware, Prestige Ransomware	2026-10-02
Windows MSIExec Remote Download	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1218.007	Anomaly	SolarWinds WHD RCE Post Exploitation, StealC Stealer, Cisco Network Visibility Module Analytics, Windows System Binary Proxy Execution MSIExec, Water Gamayun	2026-10-02
Disable Registry Tool	Sysmon EventID 13	T1112 T1685	TTP	NjRAT, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-10-02
Get-DomainTrust with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1482	TTP	Active Directory Discovery	2026-10-02
Windows SubInAcl Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1222.001	Anomaly	Defense Evasion or Unauthorized Access Via SDDL Tampering	2026-10-02
Detect HTML Help URL in Command Line	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1218.001	TTP	Compromised Windows Host, Suspicious Compiled HTML Activity, Living Off The Land, Cisco Network Visibility Module Analytics, APT37 Rustonotto and FadeStealer	2026-10-02
Windows Attempt To Stop Security Service	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	TTP	Data Destruction, Disabling Security Tools, Graceful Wipe Out Attack, Azorult, WhisperGate, Trickbot	2026-10-02
Windows Ldifde Directory Object Behavior	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.002 T1105	TTP	Volt Typhoon	2026-10-02
Windows Service Creation Using Registry Entry	Sysmon EventID 13	T1574.011	Anomaly	Gh0st RAT, CISA AA23-347A, Derusbi, Suspicious Windows Registry Activities, SolarWinds WHD RCE Post Exploitation, Windows Registry Abuse, China-Nexus Threat Activity, Windows Persistence Techniques, Brute Ratel C4, SnappyBee, Crypto Stealer, Active Directory Lateral Movement, Salt Typhoon, PlugX	2026-10-02
CertUtil With Decode Argument	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1140	TTP	Storm-2460 CLFS Zero Day Exploitation, Forest Blizzard, GhostRedirector IIS Module and Rungan Backdoor, Living Off The Land, Deobfuscate-Decode Files or Information, APT29 Diplomatic Deceptions with WINELOADER	2026-10-02
Windows Guest Account Enabled Via Net.EXE	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1078.001	Anomaly	Windows Persistence Techniques	2026-10-02
Windows Service Create with Tscon	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1543.003 T1563.002	TTP	Windows RDP Artifacts and Defense Evasion, Compromised Windows Host, Active Directory Lateral Movement	2026-10-02
NLTest Domain Trust Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1482	TTP	Cleo File Transfer Software, Storm-0501 Ransomware, Qakbot, Medusa Ransomware, Rhysida Ransomware, IcedID, Ryuk Ransomware, Active Directory Discovery, Domain Trust Discovery	2026-10-02
Windows Modify Registry No Auto Reboot With Logon User	Sysmon EventID 13	T1112	Anomaly	RedLine Stealer	2026-10-02
Suspicious Rundll32 StartW	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	TTP	Cobalt Strike, BlackByte Ransomware, Hellcat Ransomware, Graceful Wipe Out Attack, Trickbot, Suspicious Rundll32 Activity	2026-10-02
System User Discovery With Query	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1033	Hunting	Active Directory Discovery, Medusa Ransomware	2026-10-02
Linux Add User Account	Cisco Isovalent Process Exec, Sysmon for Linux EventID 1	T1136.001	Hunting	Linux Persistence Techniques, Cisco Isovalent Suspicious Activity, Linux Privilege Escalation	2026-10-02
Scheduled Task Initiation on Remote Endpoint	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1053.005	TTP	Seashell Blizzard, Living Off The Land, Medusa Ransomware, Scheduled Tasks, Active Directory Lateral Movement	2026-10-02
BITSAdmin Download File	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1105 T1197	TTP	BITS Jobs, DarkSide Ransomware, Flax Typhoon, GhostRedirector IIS Module and Rungan Backdoor, Living Off The Land, Gozi Malware, Hellcat Ransomware, Scattered Spider, Ingress Tool Transfer, APT37 Rustonotto and FadeStealer	2026-10-02
Windows Identify Protocol Handlers	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059	Hunting	Living Off The Land	2026-10-02
MacOS Osascript Displaying Suspicious User Prompt	Osquery Results	T1056.002 T1059.002	Anomaly	MacOS Privilege Escalation	2026-10-02
Windows Snake Malware File Modification Crmlog	Sysmon EventID 11	T1027	TTP	Snake Malware	2026-10-02
Linux Curl Upload File	Cisco Isovalent Process Exec, Sysmon for Linux EventID 1	T1105	TTP	Ingress Tool Transfer, Linux Living Off The Land, Data Exfiltration, NPM Supply Chain Compromise	2026-10-02
Windows System Time Discovery W32tm Delay	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1124	Anomaly	DarkCrystal RAT	2026-10-02
Windows Disable Change Password Through Registry	Sysmon EventID 13	T1112	Anomaly	Windows Defense Evasion Tactics, Ransomware	2026-10-02
GetDomainController with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1018	Hunting	Active Directory Discovery	2026-10-02
Linux System Reboot Via System Request Key	Sysmon for Linux EventID 1	T1529	TTP	AwfulShred, Data Destruction	2026-10-02
Windows Group Discovery Via Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.001 T1069.002	Hunting	Cleo File Transfer Software, Microsoft WSUS CVE-2025-59287, Windows Discovery Techniques, Volt Typhoon, Medusa Ransomware, SolarWinds WHD RCE Post Exploitation, Rhysida Ransomware, IcedID, Graceful Wipe Out Attack, Windows Post-Exploitation, Azorult, Prestige Ransomware, Active Directory Discovery	2026-10-02
BCDEdit Failure Recovery Modification	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1490	TTP	Storm-2460 CLFS Zero Day Exploitation, Void Manticore, Ransomware, Ryuk Ransomware, Compromised Windows Host	2026-10-02
XSL Script Execution With WMIC	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1220	TTP	Suspicious WMI Use, FIN7	2026-10-02
Windows Modify Registry DontShowUI	Sysmon EventID 13	T1112	TTP	DarkGate Malware	2026-10-02
Windows Proxy Via Registry	Sysmon EventID 13	T1090.001	Anomaly	Volt Typhoon	2026-10-02
Get DomainPolicy with Powershell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1201	TTP	Active Directory Discovery	2026-10-02
Esentutl SAM Copy	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.002	Hunting	Living Off The Land, Credential Dumping	2026-10-02
Windows Modify Registry MaxConnectionPerServer	Sysmon EventID 13	T1112	Anomaly	Warzone RAT	2026-10-02
Windows Disable Lock Workstation Feature Through Registry	Sysmon EventID 13	T1112	Anomaly	Windows Defense Evasion Tactics, Ransomware, Windows Registry Abuse	2026-10-02
Remote WMI Command Attempt	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1047	TTP	CISA AA23-347A, Living Off The Land, Volt Typhoon, Suspicious WMI Use, IcedID, Graceful Wipe Out Attack	2026-10-02
Suspicious wevtutil Usage	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685.005	TTP	Storm-2460 CLFS Zero Day Exploitation, Windows Log Manipulation, Storm-0501 Ransomware, CISA AA23-347A, VoidLink Cloud-Native Linux Malware, Ransomware, Rhysida Ransomware, Clop Ransomware, Scattered Spider, ShrinkLocker	2026-10-02
Resize ShadowStorage volume	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1490	TTP	BlackByte Ransomware, VanHelsing Ransomware, Medusa Ransomware, Clop Ransomware, Compromised Windows Host	2026-10-02
PowerShell Get LocalGroup Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.001	Hunting	Active Directory Discovery	2026-10-02
Linux Docker Root Directory Mount	Sysmon for Linux EventID 1	T1611	TTP	Linux Living Off The Land, Linux Privilege Escalation	2026-10-02
Windows Modify Show Compress Color And Info Tip Registry	Sysmon EventID 13	T1112	TTP	Hermetic Wiper, Windows Defense Evasion Tactics, Data Destruction, Windows Registry Abuse	2026-10-02
WMIC XSL Execution via URL	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1220	TTP	Cisco Network Visibility Module Analytics, Compromised Windows Host, Suspicious WMI Use	2026-10-02
Windows DotNet Binary in Non Standard Path	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003 T1218.004	TTP	Data Destruction, Masquerading - Rename System Utilities, Ransomware, Signed Binary Proxy Execution InstallUtil, WhisperGate, Unusual Processes	2026-10-02
Windows Modify Registry DisAllow Windows App	Sysmon EventID 13	T1112	TTP	Azorult	2026-10-02
Disabling SystemRestore In Registry	Sysmon EventID 13	T1490	TTP	NjRAT, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-10-02
Get DomainUser with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1087.002	TTP	CISA AA23-347A, Active Directory Discovery	2026-10-02
Dump LSASS via procdump	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.001	TTP	CISA AA22-257A, Storm-2460 CLFS Zero Day Exploitation, Seashell Blizzard, HAFNIUM Group, Credential Dumping, Compromised Windows Host	2026-10-02
Steal or Forge Authentication Certificates Behavior Identified		T1649	Correlation	Windows Certificate Services	2026-10-02
Windows Proxy Via Netsh	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1090.001	Anomaly	Volt Typhoon	2026-10-02
Windows MSIExec DLLRegisterServer	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.007	TTP	Windows System Binary Proxy Execution MSIExec, Water Gamayun	2026-10-02
Schtasks scheduling job on remote system	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1053.005	TTP	Quasar RAT, Living Off The Land, Scheduled Tasks, Phemedrone Stealer, NOBELIUM Group, RedLine Stealer, Prestige Ransomware, Compromised Windows Host, Active Directory Lateral Movement	2026-10-02
Get ADDefaultDomainPasswordPolicy with Powershell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1201	Hunting	Active Directory Discovery	2026-10-02
Windows File Download Via PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1059.001 T1105	Anomaly	SysAid On-Prem Software CVE-2023-47246 Vulnerability, PHP-CGI RCE Attack on Japanese Organizations, IcedID, Phemedrone Stealer, Data Destruction, XWorm, SolarWinds WHD RCE Post Exploitation, Ingress Tool Transfer, Hermetic Wiper, Winter Vivern, GhostRedirector IIS Module and Rungan Backdoor, Cisco Network Visibility Module Analytics, Microsoft WSUS CVE-2025-59287, HAFNIUM Group, NetSupport RMM Tool Abuse, Malicious PowerShell, StealC Stealer, NPM Supply Chain Compromise, APT37 Rustonotto and FadeStealer, Tuoni	2026-10-02
Detect Regsvr32 Application Control Bypass	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.010	TTP	Cobalt Strike, BlackByte Ransomware, Living Off The Land, Suspicious Regsvr32 Activity, PHP-CGI RCE Attack on Japanese Organizations, Graceful Wipe Out Attack, Compromised Windows Host	2026-10-02
Windows Modify Registry No Auto Update	Sysmon EventID 13	T1112	Anomaly	RedLine Stealer, CISA AA23-347A	2026-10-02
Ntdsutil Export NTDS	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.003	TTP	HAFNIUM Group, Living Off The Land, Volt Typhoon, NetSupport RMM Tool Abuse, Rhysida Ransomware, Credential Dumping, Prestige Ransomware	2026-10-02
Windows Service Stop Attempt	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1489	Hunting	Prestige Ransomware, Graceful Wipe Out Attack, Scattered Lapsus$ Hunters, Gh0st RAT	2026-10-02
Linux System Network Discovery	Osquery Results, Sysmon for Linux EventID 1	T1016	Anomaly	Network Discovery, Industroyer2, VoidLink Cloud-Native Linux Malware, Data Destruction	2026-10-02
Powershell Disable Security Monitoring	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	TTP	Salat Stealer, CISA AA24-241A, BlankGrabber Stealer, Ransomware, Revil Ransomware	2026-10-02
Windows Wmic Systeminfo Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1082	Anomaly	BlankGrabber Stealer, LAMEHUG, Lotus Blossom Chrysalis Backdoor	2026-10-02
Windows AdFind Exe	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1018	TTP	IcedID, BlackSuit Ransomware, Graceful Wipe Out Attack, NOBELIUM Group, Domain Trust Discovery	2026-10-02
Windows Modify Registry Suppress Win Defender Notif	Sysmon EventID 13	T1112	Anomaly	CISA AA23-347A, Azorult	2026-10-02
Windows Modify Registry AuthenticationLevelOverride	Sysmon EventID 13	T1112	Anomaly	DarkGate Malware	2026-10-02
Unload Sysmon Filter Driver	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	TTP	CISA AA23-347A, Disabling Security Tools	2026-10-02
Disable ETW Through Registry	Sysmon EventID 13	T1685	TTP	CISA AA23-347A, Ransomware, Windows Registry Abuse	2026-10-02
Windows IIS Components Add New Module	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1505.004	Anomaly	GhostRedirector IIS Module and Rungan Backdoor, IIS Components	2026-10-02
User Discovery With Env Vars PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1033	Hunting	Active Directory Discovery	2026-10-02
GetAdGroup with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.002	Hunting	Active Directory Discovery	2026-10-02
Windows Modify Registry on Smart Card Group Policy	Sysmon EventID 13	T1112	Anomaly	ShrinkLocker	2026-10-02
Windows Modify Registry Disable WinDefender Notifications	Sysmon EventID 13	T1112	TTP	RedLine Stealer, CISA AA23-347A, SolarWinds WHD RCE Post Exploitation	2026-10-02
Windows Impair Defenses Disable HVCI	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, BlackLotus Campaign, Windows Registry Abuse	2026-10-02
Windows WMI Process Call Create	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1047	Hunting	Qakbot, CISA AA23-347A, Volt Typhoon, Suspicious WMI Use, Cactus Ransomware, IcedID	2026-10-02
Windows Modify Registry DisableSecuritySettings	Sysmon EventID 13	T1112	TTP	CISA AA23-347A, DarkGate Malware	2026-10-02
Windows Registry BootExecute Modification	Sysmon EventID 13	T1542 T1547.001	TTP	Windows BootKits	2026-10-02
Windows Impair Defenses Disable Auto Logger Session	Sysmon EventID 13	T1685	Anomaly	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-10-02
Detect SharpHound File Modifications	Sysmon EventID 11	T1069.001 T1069.002 T1087.001 T1087.002 T1482	TTP	Windows Discovery Techniques, BlackSuit Ransomware, Ransomware	2026-10-02
Windows InstallUtil Uninstall Option	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.004	TTP	Signed Binary Proxy Execution InstallUtil, Living Off The Land, Compromised Windows Host	2026-10-02
Windows Modify Registry ProxyServer	Sysmon EventID 13	T1112	Anomaly	DarkGate Malware	2026-10-02
GetDomainGroup with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.002	TTP	Active Directory Discovery	2026-10-02
Disabling CMD Application	Sysmon EventID 13	T1112 T1685	TTP	NjRAT, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-10-02
Windows Eventlog Cleared Via Wevtutil	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685.005	Anomaly	Windows Log Manipulation, CISA AA23-347A, Ransomware, Rhysida Ransomware, Clop Ransomware, ShrinkLocker	2026-10-02
Disable Windows Behavior Monitoring	Sysmon EventID 13	T1685	TTP	Salat Stealer, Windows Defense Evasion Tactics, Storm-0501 Ransomware, CISA AA23-347A, BlankGrabber Stealer, Cactus Ransomware, SolarWinds WHD RCE Post Exploitation, Windows Registry Abuse, Ransomware, NetSupport RMM Tool Abuse, Azorult, Scattered Lapsus$ Hunters, RedLine Stealer, Black Basta Ransomware, Revil Ransomware	2026-10-02
Windows Parent PID Spoofing with Explorer	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1134.004	TTP	Compromised Windows Host, Windows Defense Evasion Tactics	2026-10-02
Control Loading from World Writable Directory	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.002	TTP	Microsoft MSHTML Remote Code Execution CVE-2021-40444, Living Off The Land, Compromised Windows Host	2026-10-02
BITS Job Persistence	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1197	TTP	Living Off The Land, BITS Jobs	2026-10-02
Windows New Custom Security Descriptor Set On EventLog Channel	Sysmon EventID 13	T1685.001	Anomaly	Defense Evasion or Unauthorized Access Via SDDL Tampering, LockBit Ransomware	2026-10-02
Windows Disable Shutdown Button Through Registry	Sysmon EventID 13	T1112	Anomaly	Ransomware, Windows Registry Abuse	2026-10-02
Windows ScManager Security Descriptor Tampering Via Sc.EXE	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1569.002	TTP	Defense Evasion or Unauthorized Access Via SDDL Tampering	2026-10-02
Windows Snake Malware Kernel Driver Comadmin	Sysmon EventID 11	T1547.006	TTP	Snake Malware	2026-10-02
Linux Obfuscated Files or Information Base64 Decode	Sysmon for Linux EventID 1	T1027	Anomaly	Linux Living Off The Land	2026-10-02
Detect SharpHound Command-Line Arguments	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.001 T1069.002 T1087.001 T1087.002 T1482	TTP	Windows Discovery Techniques, BlackSuit Ransomware, Ransomware	2026-10-02
Wmic Group Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.001	Anomaly	Active Directory Discovery, LAMEHUG	2026-10-02
Windows Disable Windows Event Logging Disable HTTP Logging	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1505.004 T1685.001	Anomaly	CISA AA23-347A, Windows Defense Evasion Tactics, Compromised Windows Host, IIS Components	2026-10-02
Windows HTTP Network Communication From MSIExec	Cisco Network Visibility Module Flow Data, Sysmon EventID 1, Sysmon EventID 3	T1218.007	Anomaly	GhostRedirector IIS Module and Rungan Backdoor, SolarWinds WHD RCE Post Exploitation, Cisco Network Visibility Module Analytics, APT37 Rustonotto and FadeStealer, Windows System Binary Proxy Execution MSIExec, Water Gamayun	2026-10-02
Windows Modify Registry LongPathsEnabled	Sysmon EventID 13	T1112	Anomaly	BlackByte Ransomware	2026-10-02
DSQuery Domain Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1482	TTP	Compromised Windows Host, Active Directory Discovery, Domain Trust Discovery	2026-10-02
Detect MSHTA Url in Command Line	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1218.005	TTP	Starland RAT Campaign, XWorm, Living Off The Land, NetSupport RMM Tool Abuse, Lumma Stealer, Cisco Network Visibility Module Analytics, APT37 Rustonotto and FadeStealer, Compromised Windows Host, Suspicious MSHTA Activity	2026-10-02
Windows Files and Dirs Access Rights Modification Via Icacls	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1222.001	Anomaly	Defense Evasion or Unauthorized Access Via SDDL Tampering, Amadey	2026-10-02
Linux SSH Authorized Keys Modification	Sysmon for Linux EventID 1	T1098.004	Anomaly	Linux Living Off The Land, Hellcat Ransomware, VoidLink Cloud-Native Linux Malware	2026-10-02
Dump LSASS via comsvcs DLL	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.001	TTP	CISA AA22-257A, Compromised Windows Host, CISA AA22-264A, Data Destruction, HAFNIUM Group, Flax Typhoon, Living Off The Land, Volt Typhoon, Industroyer2, Credential Dumping, Hellcat Ransomware, Scattered Lapsus$ Hunters, Prestige Ransomware, Suspicious Rundll32 Activity	2026-10-02
Windows System User Discovery Via Quser	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1033	Hunting	Prestige Ransomware, Crypto Stealer, Windows Post-Exploitation	2026-10-02
Windows Modify Registry Disable Win Defender Raw Write Notif	Sysmon EventID 13	T1112	Anomaly	CISA AA23-347A, Azorult	2026-10-02
Windows Binary Proxy Execution Mavinject DLL Injection	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.013	TTP	Living Off The Land	2026-10-02
Get ADUser with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1087.002	Hunting	CISA AA23-347A, Active Directory Discovery	2026-10-02
Windows Modify Registry Auto Update Notif	Sysmon EventID 13	T1112	Anomaly	RedLine Stealer	2026-10-02
Suspicious microsoft workflow compiler usage	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1127	TTP	Living Off The Land, Trusted Developer Utilities Proxy Execution	2026-10-02
Windows MSIExec Unregister DLLRegisterServer	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.007	TTP	Windows System Binary Proxy Execution MSIExec	2026-10-02
Windows Curl Download to Suspicious Path	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1105	TTP	Forest Blizzard, Starland RAT Campaign, GhostRedirector IIS Module and Rungan Backdoor, IcedID, Cisco Network Visibility Module Analytics, APT37 Rustonotto and FadeStealer, China-Nexus Threat Activity, NPM Supply Chain Compromise, Black Basta Ransomware, Ingress Tool Transfer, Compromised Windows Host, Salt Typhoon	2026-10-02
Linux DD File Overwrite	Sysmon for Linux EventID 1	T1485	TTP	Industroyer2, Data Destruction	2026-10-02
Linux Decode Base64 to Shell	Cisco Isovalent Process Exec, Sysmon for Linux EventID 1	T1027 T1059.004	TTP	Linux Living Off The Land, Cisco Isovalent Suspicious Activity	2026-10-02
Windows Modify Registry DisableRemoteDesktopAntiAlias	Sysmon EventID 13	T1112	TTP	DarkGate Malware	2026-10-02
Detect SharpHound Usage	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.001 T1069.002 T1087.001 T1087.002 T1482	TTP	Windows Discovery Techniques, Ransomware	2026-10-02
Windows AD DSRM Password Reset	Windows Event Log Security 4794	T1098	TTP	Sneaky Active Directory Persistence Tricks, Scattered Lapsus$ Hunters	2026-10-02
Windows Application Whitelisting Bypass Attempt via Rundll32	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	TTP	Living Off The Land, Suspicious Rundll32 Activity, Compromised Windows Host	2026-10-02
MacOS List Firewall Rules	Osquery Results	T1016	Anomaly	Network Discovery	2026-10-02
Windows Get-Variable.EXE Execution from WindowsApps Folder	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1574.008	Anomaly	Windows Persistence Techniques	2026-10-02
Windows Modify Registry ProxyEnable	Sysmon EventID 13	T1112	Anomaly	DarkGate Malware	2026-10-02
Windows Odbcconf Load DLL	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.008	TTP	Living Off The Land	2026-10-02
Windows Registry Dotnet ETW Disabled Via ENV Variable	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-10-02
GetWmiObject Ds Computer with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1018	Anomaly	Active Directory Discovery	2026-10-02
System Processes Run From Unexpected Locations	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003	Anomaly	Qakbot, Suspicious Command-Line Executions, Masquerading - Rename System Utilities, Ransomware, DarkGate Malware, Unusual Processes, Windows Error Reporting Service Elevation of Privilege Vulnerability	2026-10-02
Windows System Network Connections Discovery Netsh	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1049	Anomaly	VIP Keylogger, BlankGrabber Stealer, Phantom Stealer, Windows Post-Exploitation, Snake Keylogger, Prestige Ransomware	2026-10-02
Rundll32 Control RunDLL Hunt	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	Hunting	Microsoft MSHTML Remote Code Execution CVE-2021-40444, Living Off The Land, Suspicious Rundll32 Activity	2026-10-02
Get-ForestTrust with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1482	TTP	Active Directory Discovery	2026-10-02
Windows Disable Windows Group Policy Features Through Registry	Sysmon EventID 13	T1112	Anomaly	CISA AA23-347A, Windows Defense Evasion Tactics, Ransomware, Windows Registry Abuse	2026-10-02
Windows Modify Registry Disable RDP	Sysmon EventID 13	T1112	Anomaly	Windows RDP Artifacts and Defense Evasion, ShrinkLocker	2026-10-02
Detect HTML Help Using InfoTech Storage Handlers	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.001	TTP	APT37 Rustonotto and FadeStealer, Living Off The Land, Compromised Windows Host, Suspicious Compiled HTML Activity	2026-10-02
Windows Net System Service Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1007	Hunting	LAMEHUG, Gh0st RAT	2026-10-02
Windows Autostart Execution LSASS Driver Registry Modification	Sysmon EventID 13	T1547.008	TTP	Windows Registry Abuse	2026-10-02
Windows Modify Registry Disable Toast Notifications	Sysmon EventID 13	T1112	Anomaly	Azorult	2026-10-02
Windows Network Sniffing Tool Executed	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1040	Anomaly	Windows Discovery Techniques, Suspicious Command-Line Executions, Credential Dumping, Data Exfiltration, Network Discovery	2026-10-02
Windows Credential Dumping LSASS Memory Createdump	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.001	TTP	Credential Dumping, Compromised Windows Host, Scattered Lapsus$ Hunters	2026-10-02
Windows Sensitive Group Discovery With Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.002	Anomaly	Microsoft WSUS CVE-2025-59287, Volt Typhoon, Rhysida Ransomware, IcedID, BlackSuit Ransomware, Active Directory Discovery	2026-10-02
Windows Sensitive Registry Hive Dump Via CommandLine	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.002	TTP	CISA AA22-257A, DarkSide Ransomware, Data Destruction, Seashell Blizzard, CISA AA23-347A, Industroyer2, Volt Typhoon, Windows Registry Abuse, Credential Dumping, Compromised Windows Host	2026-10-02
Regsvr32 Silent and Install Param Dll Loading	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.010	Anomaly	Hermetic Wiper, Data Destruction, Living Off The Land, Suspicious Regsvr32 Activity, AsyncRAT, Remcos	2026-10-02
Eventvwr UAC Bypass	Sysmon EventID 13	T1548.002	TTP	Windows Defense Evasion Tactics, Living Off The Land, Windows Registry Abuse, IcedID, ValleyRAT	2026-10-02
Windows Registry Modification for Safe Mode Persistence	Sysmon EventID 13	T1547.001	TTP	Windows Drivers, Ransomware, Windows Registry Abuse	2026-10-02
MacOS Gatekeeper Bypass	Osquery Results	T1553.001	Anomaly	MacOS Privilege Escalation, MacOS Persistence Techniques, MacOS Post-Exploitation	2026-10-02
Windows Disable LogOff Button Through Registry	Sysmon EventID 13	T1112	Anomaly	Ransomware, Windows Registry Abuse	2026-10-02
Get WMIObject Group Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.001	Hunting	Active Directory Discovery	2026-10-02
MacOS Network Share Discovery	Osquery Results	T1135	Anomaly	MacOS Post-Exploitation	2026-10-02
Windows Odbcconf Load Response File	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.008	TTP	Living Off The Land	2026-10-02
Windows Service Execution RemCom	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1569.002	TTP	Active Directory Discovery	2026-10-02
Windows Network Share Interaction Via Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1039 T1135	Hunting	Network Discovery, Active Directory Discovery, Active Directory Privilege Escalation	2026-10-02
Windows WMIC Shadowcopy Delete	Sysmon EventID 1	T1490	Anomaly	Volt Typhoon, Suspicious WMI Use, Cactus Ransomware	2026-10-02
Detect Large ICMP Traffic	Cisco Secure Access Firewall, Palo Alto Network Traffic	T1095	TTP	Cisco Secure Access Analytics, Backdoor Pingpong, China-Nexus Threat Activity, Command And Control	2026-10-02
Child Processes of Spoolsv exe	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1068	TTP	Hermetic Wiper, Data Destruction, Windows Privilege Escalation	2026-10-02
Circle CI Disable Security Step	CircleCI	T1554	Anomaly	Dev Sec Ops	2026-10-01
Circle CI Disable Security Job	CircleCI	T1554	Anomaly	Dev Sec Ops	2026-10-01
Windows NirSoft Tool Bundle File Created	Sysmon EventID 11	T1588.002	Anomaly	WhisperGate, Unusual Processes, Data Destruction	2026-10-01
Possible Browser Pass View Parameter	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1555.003	Hunting	Remcos	2026-10-01
Detection of tools built by NirSoft	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1072	Anomaly	Emotet Malware DHS Report TA18-201A	2026-10-01
Windows Alternate Data Stream Created Over Local Share	Windows Event Log Security 5145	T1021.002 T1564.004	Anomaly	RoguePlanet	2026-09-30
Windows Defender Intermediary Artifact Was Observed	Sysmon EventID 15, Sysmon EventID 23, Sysmon EventID 11	T1068	Anomaly	Windows Privilege Escalation, RoguePlanet	2026-09-30
AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity	AWS CloudTrail	T1021.004 T1021.008	TTP	Suspicious Cloud Instance Activities	2026-09-29
AWS Anomalous Secrets Manager Batch Retrieval	AWS CloudTrail	T1555.006	TTP	AWS Identity and Access Management Account Takeover	2026-09-29
PingID New MFA Method After Credential Reset	PingID	T1098.005 T1556.006 T1621	TTP	Compromised User Account, Scattered Lapsus$ Hunters	2026-09-29
Windows Crowdstrike RTR Script Execution	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001	Anomaly	Malicious PowerShell, Living Off The Land, Cobalt Strike, Suspicious MSHTA Activity	2026-09-28
Windows AD SPN Unicode Collision Injection	Windows Event Log Security 5136	T1562.010	TTP	Sneaky Active Directory Persistence Tricks, Compromised User Account, Active Directory Kerberos Attacks	2026-09-25
Windows AD Computer SPN Modified By User Account	Windows Event Log Security 5136	T1558.003 T1562.010	Anomaly	Sneaky Active Directory Persistence Tricks, Compromised User Account, Active Directory Kerberos Attacks	2026-09-25
Azure AD OAuth Application Consent Granted By User	Azure Active Directory Consent to application	T1528	TTP	Azure Active Directory Account Takeover	2026-09-24
Azure AD User Consent Blocked for Risky Application	Azure Active Directory Consent to application	T1528	TTP	Azure Active Directory Account Takeover	2026-09-24
O365 Email Send and Hard Delete Exfiltration Behavior	Office 365 Universal Audit Log, Office 365 Reporting Message Trace	T1070.008 T1114.001 T1485	Anomaly	Office 365 Account Takeover, Suspicious Emails, Data Destruction, Office 365 Collection Techniques	2026-09-23
O365 Email Password and Payroll Compromise Behavior	Office 365 Universal Audit Log, Office 365 Reporting Message Trace	T1070.008 T1114.001 T1485	TTP	Office 365 Account Takeover, Suspicious Emails, Data Destruction, Office 365 Collection Techniques	2026-09-23
O365 Email Send Attachments Excessive Volume	Office 365 Universal Audit Log	T1070.008 T1485	Anomaly	Office 365 Account Takeover, Suspicious Emails	2026-09-23
O365 Email Receive and Hard Delete Takeover Behavior	Office 365 Universal Audit Log, Office 365 Reporting Message Trace	T1070.008 T1114.001 T1485	Anomaly	Office 365 Account Takeover, Suspicious Emails, Data Destruction, Office 365 Collection Techniques	2026-09-23
Windows Admin Password Changed by Non-Admin	Windows Event Log Security 4723	T1068 T1543.003	TTP	BlueHammer, Windows Privilege Escalation	2026-09-23
Windows AD User Suspicious UPN Change	Windows Event Log Security 4738	T1078.002	TTP	Active Directory Kerberos Attacks	2026-09-23
Windows Renamed Popular 3rd Party Software was Executed	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003	Anomaly	Living Off The Land, Windows Defense Evasion Tactics, Masquerading - Rename System Utilities, Water Gamayun	2026-09-23
Windows Renamed LOLBAS Binary was Executed	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003	Anomaly	Living Off The Land, Windows Defense Evasion Tactics, Masquerading - Rename System Utilities, Water Gamayun	2026-09-23
Windows Renamed Python Binary was Executed	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003 T1059.006	Anomaly	Living Off The Land, Windows Defense Evasion Tactics, Masquerading - Rename System Utilities, Water Gamayun	2026-09-23
Windows Renamed Command Interpreter was Executed	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003 T1059	Anomaly	Windows Defense Evasion Tactics, Living Off The Land, Suspicious Command-Line Executions, Masquerading - Rename System Utilities, Water Gamayun	2026-09-23
Detect mshta renamed	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.005	Hunting	Living Off The Land, APT37 Rustonotto and FadeStealer, Suspicious MSHTA Activity	2026-09-23
Detect Renamed 7-Zip	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1560.001	Hunting	Malicious Inno Setup Loader, Collection and Staging	2026-09-23
Detect HTML Help Renamed	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.001	Hunting	Living Off The Land, APT37 Rustonotto and FadeStealer, Suspicious Compiled HTML Activity	2026-09-23
Suspicious microsoft workflow compiler rename	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003 T1127	Hunting	Cobalt Strike, BlackByte Ransomware, Living Off The Land, Masquerading - Rename System Utilities, Trusted Developer Utilities Proxy Execution, Graceful Wipe Out Attack	2026-09-23
Detect Renamed RClone	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1020	Hunting	Black Basta Ransomware, Cactus Ransomware, DarkSide Ransomware, Ransomware	2026-09-23
Windows Regsvr32 Renamed Binary	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.010	TTP	Qakbot, Compromised Windows Host	2026-09-23
Windows LOLBAS Executed As Renamed File	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003 T1218.011	TTP	Living Off The Land, Windows Defense Evasion Tactics, Masquerading - Rename System Utilities, Water Gamayun	2026-09-23
Windows Renamed Powershell Execution	Sysmon EventID 1	T1036.003	TTP	XWorm, Hellcat Ransomware, Axios Supply Chain Post Compromise	2026-09-23
Suspicious MSBuild Rename	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003 T1127.001	Hunting	Storm-2460 CLFS Zero Day Exploitation, Cobalt Strike, BlackByte Ransomware, Trusted Developer Utilities Proxy Execution MSBuild, Living Off The Land, Masquerading - Rename System Utilities, Graceful Wipe Out Attack	2026-09-23
Detect Renamed PSExec	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1569.002	Hunting	SamSam Ransomware, Salt Typhoon, DarkSide Ransomware, BlackByte Ransomware, HAFNIUM Group, VanHelsing Ransomware, DHS Report TA18-074A, Cactus Ransomware, Medusa Ransomware, Rhysida Ransomware, China-Nexus Threat Activity, DarkGate Malware, Active Directory Lateral Movement, CISA AA22-320A, Sandworm Tools	2026-09-23
Detect Renamed WinRAR	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1560.001	Hunting	CISA AA22-277A, Collection and Staging, China-Nexus Threat Activity, Salt Typhoon	2026-09-23
O365 BEC Email Hiding Rule Created		T1564.008	TTP	Office 365 Account Takeover	2026-09-22
O365 Privileged Role Assigned To Service Principal	Office 365 Universal Audit Log	T1098.003	TTP	Scattered Lapsus$ Hunters, Azure Active Directory Privilege Escalation	2026-09-22
Azure AD Privileged Role Assigned	Azure Active Directory Add member to role	T1098.003	TTP	Azure Active Directory Persistence, Storm-0501 Ransomware, NOBELIUM Group, Scattered Lapsus$ Hunters	2026-09-22
Kubernetes Nginx Ingress LFI		T1212	TTP	Dev Sec Ops	2026-09-22
O365 Privileged Role Assigned	Office 365 Universal Audit Log	T1098.003	TTP	Azure Active Directory Persistence, Scattered Lapsus$ Hunters	2026-09-22
Azure AD Privileged Role Assigned to Service Principal	Azure Active Directory Add member to role	T1098.003	TTP	NOBELIUM Group, Scattered Lapsus$ Hunters, Azure Active Directory Privilege Escalation	2026-09-22
Windows Scheduled Task with Suspicious Name	Windows Event Log Security 4700, Windows Event Log Security 4698, Windows Event Log Security 4702	T1053.005	TTP	0bj3ctivity Stealer, Castle RAT, Ransomware, Scheduled Tasks, Windows Persistence Techniques, Ryuk Ransomware, APT37 Rustonotto and FadeStealer	2026-09-22
Windows AD DCShadow Privileges ACL Addition	Windows Event Log Security 5136	T1207 T1222.001 T1484	TTP	Sneaky Active Directory Persistence Tricks	2026-09-22
Windows Defender ASR Block Events	Windows Event Log Defender 1126, Windows Event Log Defender 1121, Windows Event Log Defender 1131, Windows Event Log Defender 1133, Windows Event Log Defender 1129	T1059 T1566.001 T1566.002	Anomaly	Windows Attack Surface Reduction	2026-09-22
Cisco NVM - Suspicious Download From File Sharing Website	Cisco Network Visibility Module Flow Data	T1197	Anomaly	Cisco Network Visibility Module Analytics, APT37 Rustonotto and FadeStealer, BlankGrabber Stealer	2026-09-22
Windows Defender ASR Audit Events	Windows Event Log Defender 1134, Windows Event Log Defender 1132, Windows Event Log Defender 1125, Windows Event Log Defender 1122	T1059 T1566.001 T1566.002	Anomaly	Windows Attack Surface Reduction	2026-09-22
Windows Vulnerable Driver Installed	Windows Event Log System 7045	T1543.003	TTP	Windows Drivers, Void Manticore	2026-09-22
Windows AD Dangerous User ACL Modification	Windows Event Log Security 5136	T1222.001 T1484	TTP	Sneaky Active Directory Persistence Tricks	2026-09-22
Windows AI Platform DNS Query	Sysmon EventID 22	T1071.004	Anomaly	PromptFlux, LAMEHUG, SesameOp	2026-09-22
Cisco NVM - Webserver Download From File Sharing Website	Cisco Network Visibility Module Flow Data	T1105 T1190	TTP	GhostRedirector IIS Module and Rungan Backdoor, Cisco Network Visibility Module Analytics	2026-09-22
Cisco NVM - Suspicious File Download via Headless Browser	Cisco Network Visibility Module Flow Data	T1059 T1105	TTP	Cisco Network Visibility Module Analytics, BlankGrabber Stealer	2026-09-22
Windows Suspicious C2 Named Pipe	Sysmon EventID 18, Sysmon EventID 17	T1021.002 T1055 T1559	TTP	Cobalt Strike, LockBit Ransomware, Storm-0501 Ransomware, DarkSide Ransomware, BlackByte Ransomware, Remote Monitoring and Management Software, Meterpreter, Gozi Malware, Hellcat Ransomware, Graceful Wipe Out Attack, Brute Ratel C4, Trickbot, APT37 Rustonotto and FadeStealer, Tuoni	2026-09-22
Windows AppLocker Block Events		T1218	Anomaly	Windows AppLocker	2026-09-22
Windows AD Dangerous Group ACL Modification	Windows Event Log Security 5136	T1222.001 T1484	TTP	Sneaky Active Directory Persistence Tricks	2026-09-22
Windows AD Object Owner Updated	Windows Event Log Security 5136	T1222.001 T1484	TTP	Sneaky Active Directory Persistence Tricks	2026-09-22
Windows Credential Access From Browser Password Store	Windows Event Log Security 4663	T1012	Anomaly	Quasar RAT, MoonPeak, BlankGrabber Stealer, PXA Stealer, Braodo Stealer, China-Nexus Threat Activity, SnappyBee, 0bj3ctivity Stealer, Earth Alux, Meduza Stealer, Scattered Lapsus$ Hunters, Salat Stealer, Scattered Spider, Salt Typhoon, Snake Keylogger, VIP Keylogger, Malicious Inno Setup Loader, Phantom Stealer, StealC Stealer	2026-09-22
Windows Hosts File Access	Windows Event Log Security 4663	T1012	Anomaly	BlankGrabber Stealer, Gh0st RAT	2026-09-22
Windows AD GPO New CSE Addition	Windows Event Log Security 5136	T1222.001 T1484.001	TTP	Sneaky Active Directory Persistence Tricks	2026-09-22
Cisco NVM - Rclone Execution With Network Activity	Cisco Network Visibility Module Flow Data	T1567.002	Anomaly	Cisco Network Visibility Module Analytics, Scattered Lapsus$ Hunters	2026-09-22
Cisco NVM - Installation of Typosquatted Python Package	Cisco Network Visibility Module Flow Data	T1059	TTP	Cisco Network Visibility Module Analytics	2026-09-22
Windows PowerShell Script Block With Malicious String	Powershell Script Block Logging 4104	T1059.001	TTP	Malicious PowerShell	2026-09-22
Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download	Cisco Network Visibility Module Flow Data	T1218.005	Anomaly	Cisco Network Visibility Module Analytics	2026-09-22
Windows AD Self DACL Assignment	Windows Event Log Security 5136	T1098 T1484	TTP	Sneaky Active Directory Persistence Tricks	2026-09-22
Windows AD Domain Replication ACL Addition	Windows Event Log Security 5136	T1484	TTP	Sneaky Active Directory Persistence Tricks, Compromised Windows Host	2026-09-22
Cisco NVM - Browser Spawned Unix Shell with External Connection	Cisco Network Visibility Module Flow Data	T1059	Anomaly	Cisco Network Visibility Module Analytics	2026-09-22
Windows Important Audit Policy Disabled	Windows Event Log Security 4719	T1685	TTP	Windows Audit Policy Tampering	2026-09-22
Cisco NVM - Outbound Connection to Suspicious Port	Cisco Network Visibility Module Flow Data	T1571	Anomaly	Cisco Network Visibility Module Analytics	2026-09-22
Cisco NVM - Suspicious Network Connection From Process With No Args	Cisco Network Visibility Module Flow Data	T1055 T1218	Anomaly	Cisco Network Visibility Module Analytics	2026-09-22
Windows AD Domain Root ACL Modification	Windows Event Log Security 5136	T1222.001 T1484	TTP	Sneaky Active Directory Persistence Tricks	2026-09-22
Windows Defender ASR Registry Modification	Windows Event Log Defender 5007	T1112	Hunting	Windows Attack Surface Reduction	2026-09-22
Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI	Cisco Network Visibility Module Flow Data	T1059.005 T1218.005	Anomaly	Cisco Network Visibility Module Analytics, BlankGrabber Stealer	2026-09-22
Windows Defender ASR Rule Disabled	Windows Event Log Defender 5007	T1112	TTP	Windows Attack Surface Reduction	2026-09-22
Cisco NVM - Non-Network Binary Making Network Connection	Cisco Network Visibility Module Flow Data	T1036 T1055	Anomaly	Cisco Network Visibility Module Analytics	2026-09-22
Windows Domain Admin Impersonation Indicator	Windows Event Log Security 4627	T1558	TTP	Compromised Windows Host, Gozi Malware, Active Directory Kerberos Attacks, Active Directory Privilege Escalation	2026-09-22
Windows Kerberos Local Successful Logon	Windows Event Log Security 4624	T1558	TTP	Scattered Lapsus$ Hunters, Local Privilege Escalation With KrbRelayUp, Compromised Windows Host, Active Directory Kerberos Attacks	2026-09-22
Windows RMM Named Pipe	Sysmon EventID 18, Sysmon EventID 17	T1021.002 T1055 T1559	Anomaly	Insider Threat, CISA AA24-241A, Interlock Ransomware, Seashell Blizzard, Command And Control, GhostRedirector IIS Module and Rungan Backdoor, Remote Monitoring and Management Software, Cactus Ransomware, Ransomware, Gozi Malware, Scattered Lapsus$ Hunters, Scattered Spider	2026-09-22
Windows AppLocker Privilege Escalation via Unauthorized Bypass		T1218	TTP	Windows AppLocker	2026-09-22
Windows Defender ASR Rules Stacking	Windows Event Log Defender 1126, Windows Event Log Defender 1122, Windows Event Log Defender 1125, Windows Event Log Defender 1121, Windows Event Log Defender 1131, Windows Event Log Defender 1133, Windows Event Log Defender 1134, Windows Event Log Defender 5007, Windows Event Log Defender 1129	T1059 T1566.001 T1566.002	Hunting	Windows Attack Surface Reduction	2026-09-22
Cisco NVM - Susp Script From Archive Triggering Network Activity	Cisco Network Visibility Module Flow Data	T1059.005 T1204.002	Anomaly	Cisco Network Visibility Module Analytics	2026-09-22
Cisco NVM - Suspicious Network Connection Initiated via MsXsl	Cisco Network Visibility Module Flow Data	T1220	Anomaly	Cisco Network Visibility Module Analytics	2026-09-22
Windows Suspicious Named Pipe	Sysmon EventID 18, Sysmon EventID 17	T1021.002 T1055 T1559	TTP	Cobalt Strike, LockBit Ransomware, DarkSide Ransomware, BlackByte Ransomware, Remote Monitoring and Management Software, Meterpreter, Gozi Malware, Hellcat Ransomware, Graceful Wipe Out Attack, Brute Ratel C4, Trickbot, APT37 Rustonotto and FadeStealer, Tuoni	2026-09-22
Cisco NVM - Suspicious Network Connection to IP Lookup Service API	Cisco Network Visibility Module Flow Data	T1016 T1590.005	Anomaly	Cisco Network Visibility Module Analytics, Castle RAT, BlankGrabber Stealer	2026-09-22
Windows Scheduled Task with Suspicious Command	Windows Event Log Security 4700, Windows Event Log Security 4698, Windows Event Log Security 4702	T1053.005	TTP	Seashell Blizzard, Quasar RAT, SolarWinds WHD RCE Post Exploitation, Ransomware, Scheduled Tasks, Windows Persistence Techniques, Ryuk Ransomware, APT37 Rustonotto and FadeStealer	2026-09-22
Windows Vulnerable Driver Loaded	Sysmon EventID 6	T1543.003	Hunting	Windows Drivers, Void Manticore, BlackByte Ransomware	2026-09-22
Windows AD Dangerous Deny ACL Modification	Windows Event Log Security 5136	T1222.001 T1484	TTP	Sneaky Active Directory Persistence Tricks	2026-09-22
Windows Service Created with Suspicious Service Name	Windows Event Log System 7045	T1569.002	Anomaly	Gh0st RAT, Flax Typhoon, CISA AA23-347A, Qakbot, Clop Ransomware, Snake Malware, Brute Ratel C4, Tuoni, Active Directory Lateral Movement, PlugX	2026-09-22
Windows AD Privileged Group Modification	Windows Event Log Security 4728	T1098	TTP	Sneaky Active Directory Persistence Tricks, Active Directory Privilege Escalation	2026-09-22
Windows AD Domain Controller Audit Policy Disabled	Windows Event Log Security 4719	T1685	TTP	Windows Audit Policy Tampering	2026-09-22
Cisco NVM - Osascript Network Connection for a Long Duration	Cisco Network Visibility Module Flow Data	T1059.002 T1071.001	Anomaly	Cisco Network Visibility Module Analytics, MacOS Post-Exploitation, Command And Control	2026-09-22
Windows AD Hidden OU Creation	Windows Event Log Security 5136	T1222.001 T1484	TTP	Sneaky Active Directory Persistence Tricks	2026-09-22
Windows Known Abused DLL Loaded Suspiciously	Sysmon EventID 7	T1574.001	TTP	Living Off The Land, Windows Defense Evasion Tactics, SolarWinds WHD RCE Post Exploitation	2026-09-22
Windows AD AdminSDHolder ACL Modified	Windows Event Log Security 5136	T1546	TTP	Sneaky Active Directory Persistence Tricks	2026-09-22
Windows AD Domain Root ACL Deletion	Windows Event Log Security 5136	T1222.001 T1484	TTP	Sneaky Active Directory Persistence Tricks	2026-09-22
Windows AD Privileged Account SID History Addition	Windows Event Log Security 4742, Windows Event Log Security 4738	T1134.005	TTP	Sneaky Active Directory Persistence Tricks, Compromised Windows Host	2026-09-22
Windows PUA Named Pipe	Sysmon EventID 18, Sysmon EventID 17	T1021.002 T1055 T1559	Anomaly	SamSam Ransomware, DarkSide Ransomware, Seashell Blizzard, BlackByte Ransomware, HAFNIUM Group, VanHelsing Ransomware, DHS Report TA18-074A, Volt Typhoon, Cactus Ransomware, Medusa Ransomware, Rhysida Ransomware, IcedID, DarkGate Malware, Active Directory Lateral Movement, CISA AA22-320A, Sandworm Tools	2026-09-22
Cisco NVM - Curl Execution With Insecure Flags	Cisco Network Visibility Module Flow Data	T1197	Anomaly	Cisco Network Visibility Module Analytics, PromptLock, Microsoft WSUS CVE-2025-59287	2026-09-22
Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint	Cisco Secure Firewall Threat Defense Connection Event	T1071.001 T1573.002 T1587.002 T1588.004	TTP	Cisco Secure Firewall Threat Defense Analytics	2026-09-22
Cisco Secure Firewall - Repeated Malware Downloads	Cisco Secure Firewall Threat Defense File Event	T1027 T1105	Anomaly	Hellcat Ransomware, Cisco Secure Firewall Threat Defense Analytics	2026-09-22
Cisco Secure Firewall - Malware File Downloaded	Cisco Secure Firewall Threat Defense File Event	T1105 T1203	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-09-22
Cisco Secure Firewall - Binary File Type Download	Cisco Secure Firewall Threat Defense File Event	T1059 T1203	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-09-22
Cisco Secure Firewall - Intrusion Events by Threat Activity	Cisco Secure Firewall Threat Defense Intrusion Event	T1041 T1573.002	Anomaly	ArcaneDoor, Cisco Secure Firewall Threat Defense Analytics	2026-09-22
Cisco Secure Firewall - File Download Over Uncommon Port	Cisco Secure Firewall Threat Defense File Event	T1105 T1571	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-09-22
HTTP Scripting Tool User Agent	Nginx Access	T1071.001	Anomaly	HTTP Request Smuggling, Suspicious User Agents	2026-09-22
Cloud Provisioning Activity From Previously Unseen IP Address	AWS CloudTrail	T1078	Anomaly	Suspicious Cloud Provisioning Activities	2026-09-22
Cloud Provisioning Activity From Previously Unseen Country	AWS CloudTrail	T1078	Anomaly	Suspicious Cloud Provisioning Activities	2026-09-22
Cloud Instance Modified By Previously Unseen User	AWS CloudTrail	T1078.004	Anomaly	Suspicious Cloud Instance Activities	2026-09-22
Cloud Compute Instance Created By Previously Unseen User	AWS CloudTrail	T1078.004	Anomaly	Cloud Cryptomining	2026-09-22
Cloud Provisioning Activity From Previously Unseen City	AWS CloudTrail	T1078	Anomaly	Suspicious Cloud Provisioning Activities	2026-09-22
Cloud Compute Instance Created With Previously Unseen Instance Type	AWS CloudTrail	T1578.002	Anomaly	Cloud Cryptomining	2026-09-22
Cloud Compute Instance Created With Previously Unseen Image	AWS CloudTrail	N/A	Anomaly	Cloud Cryptomining	2026-09-22
Cloud Compute Instance Created In Previously Unused Region	AWS CloudTrail	T1535	Anomaly	Cloud Cryptomining	2026-09-22
Cloud API Calls From Previously Unseen User Roles	AWS CloudTrail	T1078	Anomaly	Suspicious Cloud User Activities	2026-09-22
Cloud Provisioning Activity From Previously Unseen Region	AWS CloudTrail	T1078	Anomaly	Suspicious Cloud Provisioning Activities	2026-09-22
Attacker Tools On Endpoint	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1003 T1036.005 T1595	TTP	SamSam Ransomware, XMRig, Compromised Windows Host, CISA AA22-264A, PHP-CGI RCE Attack on Japanese Organizations, Cisco Network Visibility Module Analytics, Scattered Spider, Unusual Processes	2026-09-22
Windows LOLBAS Executed Outside Expected Path	Windows Event Log Security 4688, Sysmon EventID 1	T1036.005 T1218.011	Anomaly	Living Off The Land, Windows Defense Evasion Tactics, Masquerading - Rename System Utilities	2026-09-22
Windows Known Abused DLL Created	Sysmon EventID 11	T1574.001	Anomaly	Living Off The Land, Windows Defense Evasion Tactics	2026-09-22
Potential password in username	Linux Secure	T1078.003 T1552.001	Hunting	Insider Threat, Credential Dumping	2026-09-22
Common Ransomware Extensions	Sysmon EventID 11	T1485	TTP	SamSam Ransomware, LockBit Ransomware, Interlock Ransomware, Medusa Ransomware, Ransomware, Rhysida Ransomware, Clop Ransomware, NailaoLocker Ransomware, Ryuk Ransomware, Black Basta Ransomware, Prestige Ransomware, Termite Ransomware	2026-09-22
Windows PowerShell Process With Malicious String	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001	TTP	Malicious PowerShell	2026-09-22
Prohibited Network Traffic Allowed	Cisco Secure Firewall Threat Defense Connection Event	T1048	Anomaly	Cisco Secure Firewall Threat Defense Analytics, Prohibited Traffic Allowed or Protocol Mismatch, Ransomware, Command And Control	2026-09-22
3CX Supply Chain Attack Network Indicators	Sysmon EventID 22	T1195.002	TTP	3CX Supply Chain Attack	2026-09-22
HTTP Malware User Agent	Suricata	T1071.001	TTP	Lokibot, Meduza Stealer, Lumma Stealer, RedLine Stealer, Crypto Stealer, Suspicious User Agents	2026-09-22
HTTP RMM User Agent	Suricata	T1071.001 T1219	Anomaly	Remote Monitoring and Management Software, Suspicious User Agents	2026-09-22
HTTP PUA User Agent	Suricata	T1071.001	Anomaly	Local Privilege Escalation With KrbRelayUp, BlackSuit Ransomware, Cactus Ransomware, Suspicious User Agents	2026-09-22
HTTP C2 Framework User Agent	Suricata	T1071.001	TTP	Cobalt Strike, Malicious PowerShell, Spearphishing Attachments, Meterpreter, BishopFox Sliver Adversary Emulation Framework, Brute Ratel C4, Tuoni, Suspicious User Agents	2026-09-22
Detect hosts connecting to dynamic domain providers	Sysmon EventID 22	T1189	TTP	Command And Control, Data Protection, Dynamic DNS, Prohibited Traffic Allowed or Protocol Mismatch, Suspicious DNS Traffic, DNS Hijacking	2026-09-22
First Time Seen Child Process of Zoom	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1068	Anomaly	Suspicious Zoom Child Processes	2026-09-22
AWS Repeated CloudWatch Logs Read Operations	AWS CloudTrail	T1530	TTP	Data Exfiltration	2026-09-21
Windows Process Injection into Notepad	Sysmon EventID 10	T1055.002	Anomaly	APT37 Rustonotto and FadeStealer, BishopFox Sliver Adversary Emulation Framework, Earth Alux	2026-09-21
MacOS Osascript Executing Interactive Shell	Osquery Results	T1059.002 T1059.004	Anomaly	MacOS Post-Exploitation	2026-09-18
MacOS Osascript Executing JavaScript Code With ObjC	Osquery Results	T1059.002 T1059.007	Anomaly	MacOS Post-Exploitation	2026-09-18
MacOS - Re-opened Applications	Sysmon EventID 1	N/A	TTP	ColdRoot MacOS RAT	2026-09-18
Windows Process Accessing IronLanguages Repository On GitHub	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059 T1105	Anomaly	Ingress Tool Transfer, Compromised Windows Host, Windows Post-Exploitation, Fake CAPTCHA Campaigns	2026-09-16
Windows Finger.exe Connecting to a Remote Host	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1071	TTP	Command And Control, Living Off The Land, Fake CAPTCHA Campaigns, Windows Post-Exploitation, Compromised Windows Host	2026-09-16
Windows Node.exe Executing JS Script In Immediate Folder	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.007	TTP	Compromised Windows Host, Windows Post-Exploitation, Fake CAPTCHA Campaigns	2026-09-16
Plain HTTP POST Exfiltrated Data	Splunk Stream HTTP	T1048.003	TTP	APT37 Rustonotto and FadeStealer, Data Exfiltration, Command And Control	2026-09-08
Nginx ConnectWise ScreenConnect Authentication Bypass	Nginx Access	T1190	TTP	Scattered Lapsus$ Hunters, Hellcat Ransomware, Seashell Blizzard, ConnectWise ScreenConnect Vulnerabilities	2026-09-08
CrushFTP Max Simultaneous Users From IP	CrushFTP	T1110.001 T1110.004	Anomaly	CrushFTP Vulnerabilities	2026-09-08
Log4Shell JNDI Payload Injection Attempt	Nginx Access	T1133 T1190	Anomaly	CISA AA22-257A, CISA AA22-320A, Log4Shell CVE-2021-44228	2026-09-08
CrushFTP Authentication Bypass Exploitation	CrushFTP	T1059.001 T1059.003 T1190	TTP	Hellcat Ransomware, CrushFTP Vulnerabilities	2026-09-08
Windows Terminating Lsass Process	Sysmon EventID 10	T1685	Anomaly	Scattered Lapsus$ Hunters, Double Zero Destructor, Data Destruction	2026-09-08
Windows WMI Impersonate Token	Sysmon EventID 10	T1047	Anomaly	Qakbot, Water Gamayun	2026-09-08
Windows Process Injection into Commonly Abused Processes	Sysmon EventID 10	T1055.002	Anomaly	APT37 Rustonotto and FadeStealer, BishopFox Sliver Adversary Emulation Framework, Earth Alux, SAP NetWeaver Exploitation	2026-09-08
Windows Access Token Winlogon Duplicate Handle In Uncommon Path	Sysmon EventID 10	T1134.001	Anomaly	PathWiper, Brute Ratel C4	2026-09-08
Rubeus Kerberos Ticket Exports Through Winlogon Access	Sysmon EventID 10	T1550.003	TTP	ZOVWiper, CISA AA23-347A, BlackSuit Ransomware, Scattered Lapsus$ Hunters, Active Directory Kerberos Attacks	2026-09-08
Windows Handle Duplication in Known UAC-Bypass Binaries	Sysmon EventID 10	T1134.001	Anomaly	Castle RAT	2026-09-08
Windows Access Token Manipulation Winlogon Duplicate Token Handle	Sysmon EventID 10	T1134.001	Hunting	Brute Ratel C4	2026-09-08
Windows Unsecured Outlook Credentials Access In Registry	Windows Event Log Security 4663	T1552	Anomaly	VIP Keylogger, 0bj3ctivity Stealer, Lokibot, Meduza Stealer, Phantom Stealer, StealC Stealer, Snake Keylogger	2026-09-08
Cisco IOS XE WebUI Programmatic Configuration	Cisco IOS Logs	T1078 T1190	Anomaly	Salt Typhoon	2026-09-08
ESXi Audit Tampering	VMWare ESXi Syslog	T1070 T1690	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-09-08
ESXi Bulk VM Termination	VMWare ESXi Syslog	T1499 T1529 T1673	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-09-08
Unusually Long Content-Type Length		N/A	Anomaly	Apache Struts Vulnerability	2026-09-08
Log4Shell JNDI Payload Injection with Outbound Connection	Splunk Stream IP	T1133 T1190	Anomaly	CISA AA22-320A, Log4Shell CVE-2021-44228	2026-09-08
Windows Unusual File Creation in Confluence Directory	Sysmon EventID 11	T1190 T1608.001 T1608.002	Anomaly	Confluence Data Center and Confluence Server Vulnerabilities, CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server	2026-09-08
DNS Kerberos Coercion	Sysmon EventID 22, Suricata	T1071.004 T1187 T1557.001	TTP	Local Privilege Escalation With KrbRelayUp, Compromised Windows Host, Suspicious DNS Traffic, Kerberos Coercion with DNS	2026-09-08
Internal Horizontal Port Scan NMAP Top 20	AWS CloudWatchLogs VPCflow, Cisco Secure Firewall Threat Defense Connection Event	T1046	TTP	Scattered Lapsus$ Hunters, Network Discovery, Cisco Secure Firewall Threat Defense Analytics, China-Nexus Threat Activity	2026-09-08
Email files written outside of the Outlook directory	Sysmon EventID 11	T1114.001	Anomaly	Collection and Staging	2026-09-08
XMRIG Driver Loaded	Sysmon EventID 6	T1543.003	TTP	XMRig, Crypto Stealer, CISA AA22-320A	2026-09-08
Windows Content Copied from Browser was Executed	Sysmon EventID 24, Sysmon EventID 13	T1059.001 T1059.003 T1202	TTP	Fake CAPTCHA Campaigns	2026-09-07
PowerShell 4104 Hunting	Powershell Script Block Logging 4104	T1003 T1059.001 T1689	Hunting	CISA AA23-347A, SystemBC, Cactus Ransomware, PHP-CGI RCE Attack on Japanese Organizations, Braodo Stealer, DarkGate Malware, China-Nexus Threat Activity, CISA AA24-241A, Data Destruction, 0bj3ctivity Stealer, Flax Typhoon, XWorm, Rhysida Ransomware, MuddyWater, Hermetic Wiper, Salat Stealer, Interlock Ransomware, GhostRedirector IIS Module and Rungan Backdoor, Hellcat Ransomware, Scattered Spider, Salt Typhoon, Water Gamayun, Cleo File Transfer Software, Starland RAT Campaign, Microsoft WSUS CVE-2025-59287, Medusa Ransomware, Axios Supply Chain Post Compromise, Malicious PowerShell, Lumma Stealer, Phantom Stealer, APT37 Rustonotto and FadeStealer	2026-09-03
Linux Crontab Enumeration	Cisco Isovalent Process Exec, Sysmon for Linux EventID 1	T1053.003	Hunting	Linux Persistence Techniques, Data Destruction, Industroyer2, Gomir, Cisco Isovalent Suspicious Activity, VoidLink Cloud-Native Linux Malware, Linux Privilege Escalation, Scheduled Tasks, Linux Living Off The Land	2026-09-03
MacOS AppleScript Shell Execution and Compilation	Osquery Results	T1059.002	Anomaly	MacOS Post-Exploitation	2026-09-03
Citrix ADC Exploitation CVE-2023-3519	Palo Alto Network Threat	T1190	Hunting	Citrix Netscaler ADC CVE-2023-3519, CISA AA24-241A	2026-09-01
Windows Unusual SysWOW64 Process Run System32 Executable	Windows Event Log Security 4688, Sysmon EventID 1	T1036.009	Anomaly	China-Nexus Threat Activity, Salt Typhoon, DarkGate Malware	2026-09-01
Linux Data Destruction Command	Sysmon for Linux EventID 1	T1485	Anomaly	AwfulShred, Data Destruction	2026-09-01
MacOS Data Chunking	Osquery Results	T1030	Anomaly	MacOS Post-Exploitation	2026-09-01
Icacls Deny Command	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1222	Anomaly	XMRig, Defense Evasion or Unauthorized Access Via SDDL Tampering, Azorult, Compromised Windows Host, Crypto Stealer, Sandworm Tools	2026-09-01
Windows TinyCC Shellcode Execution	Windows Event Log Security 4688, Sysmon EventID 1	T1027 T1036 T1059.003	TTP	Lotus Blossom Chrysalis Backdoor	2026-09-01
File Download or Read to Pipe Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Sysmon for Linux EventID 1	T1105	TTP	Compromised Windows Host, NPM Supply Chain Compromise, Ingress Tool Transfer, Linux Living Off The Land, Log4Shell CVE-2021-44228	2026-09-01
Windows Suspicious Process File Path	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.005 T1543	TTP	LockBit Ransomware, Chaos Ransomware, Quasar RAT, Handala Wiper, AgentTesla, CISA AA23-347A, Volt Typhoon, Industroyer2, SystemBC, MoonPeak, Interlock Rat, IcedID, DarkCrystal RAT, China-Nexus Threat Activity, DarkGate Malware, Phemedrone Stealer, WhisperGate, Double Zero Destructor, SnappyBee, Remcos, PromptLock, SesameOp, Data Destruction, BlackByte Ransomware, XWorm, Lokibot, Warzone RAT, Earth Alux, Meduza Stealer, Rhysida Ransomware, ValleyRAT, Prestige Ransomware, Hermetic Wiper, Interlock Ransomware, Qakbot, GhostRedirector IIS Module and Rungan Backdoor, Void Manticore, Graceful Wipe Out Attack, Salt Typhoon, RedLine Stealer, AsyncRAT, Trickbot, Castle RAT, PlugX, Water Gamayun, XMRig, Starland RAT Campaign, VIP Keylogger, Vidar Stealer, Malicious Inno Setup Loader, NailaoLocker Ransomware, StealC Stealer, Swift Slicer, Axios Supply Chain Post Compromise, RoguePlanet, Phantom Stealer, Brute Ratel C4, Azorult, Amadey	2026-09-01
Windows Process Execution in Temp Dir	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.005 T1543	Anomaly	Salat Stealer, Gh0st RAT, XWorm, AgentTesla, Qakbot, Lokibot, Ransomware, PathWiper, PromptLock, Axios Supply Chain Post Compromise, RoguePlanet, NjRAT, Ryuk Ransomware, Trickbot, Remcos, SesameOp	2026-09-01
Linux Ghostscript Exploitation	Sysmon for Linux EventID 1	T1059 T1068 T1204.002 T1566	TTP	Linux Living Off The Land, Suspicious Command-Line Executions, Unusual Processes, Linux Post-Exploitation	2026-09-01
MacOS Account Created	Osquery Results	T1136	Anomaly	MacOS Persistence Techniques	2026-09-01
Windows Private Keys Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1552.004	Anomaly	Prestige Ransomware, Windows Post-Exploitation	2026-08-31
Network Connection Discovery With Arp	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1049	Hunting	Interlock Ransomware, Qakbot, Volt Typhoon, IcedID, Windows Post-Exploitation, Prestige Ransomware, Active Directory Discovery	2026-08-30
System User Discovery With Whoami	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1033	Hunting	Winter Vivern, Qakbot, CISA AA23-347A, PHP-CGI RCE Attack on Japanese Organizations, Rhysida Ransomware, Lotus Blossom Chrysalis Backdoor, Active Directory Discovery, LAMEHUG	2026-08-30
Socat Remote TCP Connection with Local Echo Disabled	Osquery Results, Sysmon for Linux EventID 1	T1059 T1572	Anomaly	MacOS Post-Exploitation	2026-08-27
Socat Network Listener Binding an Executable	Osquery Results, Sysmon for Linux EventID 1	T1059 T1572	TTP	MacOS Post-Exploitation	2026-08-27
Windows Builtin Account Name Was Changed	Windows Event Log Security 4781	T1036.010 T1078.003	TTP	Compromised Windows Host, Windows Defense Evasion Tactics	2026-08-24
LOLBAS Rare Network Connection	Sysmon EventID 3	T1105 T1218 T1567	Anomaly	GhostRedirector IIS Module and Rungan Backdoor, Malicious Inno Setup Loader, Living Off The Land, NetSupport RMM Tool Abuse, Fake CAPTCHA Campaigns, Hellcat Ransomware, APT37 Rustonotto and FadeStealer, Water Gamayun	2026-08-24
Excessive Usage of NSLOOKUP App	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1048	Anomaly	Suspicious DNS Traffic, Dynamic DNS, Data Exfiltration, Command And Control	2026-08-24
LOLBAS Network Connection On Uncommon Port	Sysmon EventID 3	T1105 T1218 T1567	Anomaly	GhostRedirector IIS Module and Rungan Backdoor, Malicious Inno Setup Loader, Living Off The Land, NetSupport RMM Tool Abuse, Fake CAPTCHA Campaigns, Hellcat Ransomware, APT37 Rustonotto and FadeStealer, Water Gamayun	2026-08-24
Windows SCCM Smsexec Spawned a Suspicious Child Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1068 T1574.001	Anomaly	Windows Privilege Escalation	2026-08-24
Windows CAB File on Disk	Sysmon EventID 11	T1566.001	Anomaly	APT37 Rustonotto and FadeStealer, DarkGate Malware	2026-08-24
Windows Filtering Platform Filter Added To Block EDR Process	Windows Event Log Security 5447	T1685	TTP	Disabling Security Tools, Security Solution Tampering	2026-08-23
Windows EDRSilencer Custom Outbound Filter Added	Windows Event Log Security 5447, Windows Event Log Security 5441	T1685	TTP	Disabling Security Tools, Security Solution Tampering	2026-08-23
Python Network Traffic During Package Build	Sysmon EventID 1, Sysmon EventID 3	T1059.006 T1195.002	Anomaly	Malicious Python Package Installation, Ingress Tool Transfer, Compromised Windows Host, Command And Control	2026-08-21
Python Site Hooks Creation During Package Installation	Sysmon EventID 1, Sysmon EventID 11	T1195.002 T1546	TTP	Malicious Python Package Installation, Compromised Windows Host, Windows Persistence Techniques	2026-08-21
Python PTH File Creation During Package Installation	Sysmon EventID 1, Sysmon EventID 11	T1195.002 T1546	Anomaly	Malicious Python Package Installation, Compromised Windows Host, Windows Persistence Techniques	2026-08-21
Python PYTHONPATH Modification During Package Installation	Sysmon EventID 1, Sysmon EventID 13	T1195.002 T1574.007	TTP	Malicious Python Package Installation, Suspicious Windows Registry Activities, Windows Registry Abuse, Windows Persistence Techniques, Compromised Windows Host	2026-08-21
Windows Phantom DLL Created on Disk	Sysmon EventID 11	T1068 T1574.001	TTP	Windows Defense Evasion Tactics, Windows Privilege Escalation, RoguePlanet	2026-08-20
Windows SCCM Adsource DLL Was Planted In SMS Provider Directory	Sysmon EventID 11	T1574.002	TTP	Windows Privilege Escalation	2026-08-20
Windows Cloud Sensitive File Read Access By Uncommon Process	Windows Event Log Security 4663	T1528	Anomaly	Vidar Stealer	2026-08-19
Windows Defender MpClient.dll Loaded by Non-Defender Process	Sysmon EventID 7	T1068	Anomaly	RoguePlanet	2026-08-19
Windows Defender Threat Detected on Kernel Object Path	Windows Event Log Defender 1117, Windows Event Log Defender 1116	T1068 T1211	TTP	RoguePlanet	2026-08-18
Windows App Layer Protocol Wermgr Connect To NamedPipe	Sysmon EventID 18, Sysmon EventID 17	T1071	Anomaly	Qakbot, Windows Error Reporting Service Elevation of Privilege Vulnerability, RoguePlanet	2026-08-18
Windows Error Report Created in ReportQueue Manually	Sysmon EventID 11	T1053.005 T1068	Anomaly	Windows Privilege Escalation, Windows Error Reporting Service Elevation of Privilege Vulnerability, RoguePlanet	2026-08-18
Windows Wermgr Spawning System Integrity Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1068 T1134.001	TTP	Windows Privilege Escalation, Windows Error Reporting Service Elevation of Privilege Vulnerability, RoguePlanet	2026-08-18
Windows Process Injection Wermgr Child Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055	Anomaly	Qakbot, Windows Error Reporting Service Elevation of Privilege Vulnerability, RoguePlanet	2026-08-18
Non Chrome Process Accessing Chrome Default Dir	Windows Event Log Security 4663	T1555.003	Anomaly	Quasar RAT, CISA AA23-347A, AgentTesla, BlankGrabber Stealer, NjRAT, Phemedrone Stealer, China-Nexus Threat Activity, DarkGate Malware, SnappyBee, Remcos, Lokibot, Warzone RAT, 3CX Supply Chain Attack, Salat Stealer, FIN7, Salt Typhoon, Snake Keylogger, RedLine Stealer, Vidar Stealer, VIP Keylogger, Malicious Inno Setup Loader, Phantom Stealer, StealC Stealer	2026-08-14
Windows Credentials from Password Stores Chrome LocalState Access	Windows Event Log Security 4663	T1012	Anomaly	Quasar RAT, MoonPeak, BlankGrabber Stealer, PXA Stealer, NjRAT, Phemedrone Stealer, Braodo Stealer, DarkGate Malware, China-Nexus Threat Activity, SnappyBee, 0bj3ctivity Stealer, Lokibot, Warzone RAT, Earth Alux, Meduza Stealer, Scattered Lapsus$ Hunters, Salat Stealer, Salt Typhoon, Snake Keylogger, RedLine Stealer, Vidar Stealer, VIP Keylogger, Malicious Inno Setup Loader, Phantom Stealer, StealC Stealer, Amadey	2026-08-14
Windows Credentials from Password Stores Chrome Extension Access	Windows Event Log Security 4663	T1012	Anomaly	Vidar Stealer, 0bj3ctivity Stealer, Malicious Inno Setup Loader, CISA AA23-347A, MoonPeak, BlankGrabber Stealer, Meduza Stealer, Phantom Stealer, StealC Stealer, Phemedrone Stealer, Braodo Stealer, DarkGate Malware, RedLine Stealer, Amadey	2026-08-14
Windows Process Injection Remote Thread	Sysmon EventID 8	T1055.002	TTP	Vidar Stealer, Qakbot, Warzone RAT, Earth Alux, Phantom Stealer, Graceful Wipe Out Attack, Water Gamayun	2026-08-14
Windows Credentials from Password Stores Chrome Login Data Access	Windows Event Log Security 4663	T1012	Anomaly	Quasar RAT, MoonPeak, BlankGrabber Stealer, PXA Stealer, NjRAT, Phemedrone Stealer, Braodo Stealer, DarkGate Malware, China-Nexus Threat Activity, SnappyBee, 0bj3ctivity Stealer, Lokibot, Warzone RAT, Earth Alux, Meduza Stealer, Scattered Lapsus$ Hunters, Salat Stealer, Salt Typhoon, Snake Keylogger, RedLine Stealer, Vidar Stealer, VIP Keylogger, Malicious Inno Setup Loader, Phantom Stealer, StealC Stealer, Amadey	2026-08-14
Windows Query Registry UnInstall Program List	Windows Event Log Security 4663	T1012	Anomaly	StealC Stealer, Vidar Stealer, Meduza Stealer, RedLine Stealer	2026-08-14
Windows Disable or Stop Browser Process	Sysmon EventID 1	T1685	TTP	Salat Stealer, Vidar Stealer, BlankGrabber Stealer, Phantom Stealer, Hellcat Ransomware, Scattered Lapsus$ Hunters, Braodo Stealer, Castle RAT	2026-08-14
Windows Indicator Removal Via Rmdir	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1070	Anomaly	APT37 Rustonotto and FadeStealer, Vidar Stealer, ZOVWiper, DarkGate Malware	2026-08-14
Windows Screen Capture in TEMP folder	Sysmon EventID 11	T1113	TTP	Vidar Stealer, VIP Keylogger, StealC Stealer, APT37 Rustonotto and FadeStealer, Hellcat Ransomware, Braodo Stealer, Crypto Stealer	2026-08-14
ESXi Encryption Settings Modified	VMWare ESXi Syslog	T1685	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-08-12
Linux Possible Append Command To Profile Config File	Sysmon for Linux EventID 1	T1546.004	Anomaly	Linux Persistence Techniques, Linux Privilege Escalation	2026-08-12
Windows Set Account Password Policy To Unlimited Via Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1489	Anomaly	XMRig, Crypto Stealer, Ransomware, BlackByte Ransomware	2026-08-11
High Frequency Copy Of Files In Network Share	Windows Event Log Security 5145	T1537	Anomaly	Insider Threat, Information Sabotage, Hellcat Ransomware	2026-08-05
Executable File Written in Administrative SMB Share	Windows Event Log Security 5145	T1021.002	TTP	Hermetic Wiper, Data Destruction, VanHelsing Ransomware, Industroyer2, IcedID, BlackSuit Ransomware, Trickbot, Graceful Wipe Out Attack, Prestige Ransomware, Compromised Windows Host, Active Directory Lateral Movement	2026-08-05
Windows User Discovery Via Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1087.001 T1087.002	Hunting	Active Directory Discovery, Medusa Ransomware, Sandworm Tools	2026-08-05
Windows Powershell Commands from DNS TXT	Powershell Script Block Logging 4104	T1059.001 T1071.004	Anomaly	Malicious PowerShell, Suspicious DNS Traffic, Command And Control	2026-07-30
Windows Suspicious Child Process of Consent.EXE	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059 T1068 T1548.002	Anomaly	Unusual Processes, Windows Privilege Escalation	2026-07-30
Windows Dir Piped to Findstr Activity	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1119	Hunting	Windows Discovery Techniques, Suspicious Command-Line Executions, Active Directory Discovery	2026-07-30
Windows File Without Extension In Critical Folder	Sysmon EventID 11	T1485	Anomaly	Hermetic Wiper, Data Destruction	2026-07-27
Windows AppCertDLL Modification Via Command Line	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1546.009	Anomaly	Windows Privilege Escalation, Windows Persistence Techniques	2026-07-27
Windows AppCertDLL Modification Via Registry	Sysmon EventID 13	T1546.009	Anomaly	Windows Privilege Escalation, Windows Persistence Techniques	2026-07-27
Windows WinSCP Configuration Security Access	Windows Event Log Security 4663	T1552.001	Anomaly	Phantom Stealer	2026-07-22
Windows Rdp AutomaticDestinations Deletion	Sysmon EventID 26, Sysmon EventID 23	T1070.004	Anomaly	Windows RDP Artifacts and Defense Evasion	2026-07-20
Windows Mark Of The Web Bypass	Sysmon EventID 26, Sysmon EventID 23	T1553.005	TTP	Warzone RAT, Quasar RAT	2026-07-20
Windows Suspicious Defender Update Activity in INetCache	Sysmon EventID 23, Sysmon EventID 11	T1068 T1105	Anomaly	BlueHammer, Windows Persistence Techniques	2026-07-20
Windows MSI Rollback Script Deleted By Non-Msiexec Process	Sysmon EventID 26, Sysmon EventID 23	T1068 T1218.007	TTP	Windows Privilege Escalation	2026-07-20
Recon AVProduct Through Pwh or WMI	Powershell Script Block Logging 4104	T1592	TTP	Hermetic Wiper, Starland RAT Campaign, Data Destruction, Quasar RAT, XWorm, Qakbot, MoonPeak, Ransomware, Malicious PowerShell, Windows Post-Exploitation, Prestige Ransomware	2026-07-20
Windows RDP Cache File Deletion	Sysmon EventID 26, Sysmon EventID 23	T1070.004	Anomaly	Windows RDP Artifacts and Defense Evasion	2026-07-20
Windows Gather Victim Network Info Through Ip Check Web Services	Sysmon EventID 22	T1590.005	Anomaly	Starland RAT Campaign, VIP Keylogger, Handala Wiper, Quasar RAT, 0bj3ctivity Stealer, Void Manticore, BlankGrabber Stealer, PXA Stealer, Meduza Stealer, Phemedrone Stealer, DarkCrystal RAT, Azorult, Snake Keylogger, Castle RAT, Water Gamayun	2026-07-20
Wscript Or Cscript Suspicious Child Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055 T1134.004 T1543	Anomaly	Starland RAT Campaign, VIP Keylogger, Data Destruction, 0bj3ctivity Stealer, XWorm, FIN7, MuddyWater, Axios Supply Chain Post Compromise, NjRAT, WhisperGate, Unusual Processes, Remcos, ShrinkLocker	2026-07-20
Domain Controller Discovery with Nltest	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1018	TTP	Starland RAT Campaign, CISA AA23-347A, Medusa Ransomware, NetSupport RMM Tool Abuse, Rhysida Ransomware, BlackSuit Ransomware, Active Directory Discovery	2026-07-20
Set Default PowerShell Execution Policy To Unrestricted or Bypass	Sysmon EventID 13	T1059.001	TTP	Hermetic Wiper, Starland RAT Campaign, Data Destruction, HAFNIUM Group, SystemBC, SolarWinds WHD RCE Post Exploitation, Malicious PowerShell, Credential Dumping, DarkGate Malware	2026-07-20
Malicious PowerShell Process - Execution Policy Bypass	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001	Anomaly	Starland RAT Campaign, 0bj3ctivity Stealer, HAFNIUM Group, XWorm, DHS Report TA18-074A, Volt Typhoon, BlankGrabber Stealer, MuddyWater, DarkCrystal RAT, China-Nexus Threat Activity, Salt Typhoon, AsyncRAT, APT37 Rustonotto and FadeStealer	2026-07-20
Windows Mshta Execution In Registry	Sysmon EventID 13	T1218.005	TTP	Starland RAT Campaign, Suspicious Windows Registry Activities, Windows Persistence Techniques	2026-07-20
Linux Binary Launched Process with Null Argv	Linux Messages Syslog	T1068	TTP	Linux Privilege Escalation	2026-07-17
Linux PF_ALG Registration Outside of Boot Window	Linux Messages Syslog	T1068	TTP	Linux Privilege Escalation	2026-07-17
Linux Suspicious Child Process of PostgreSQL	Sysmon for Linux EventID 1	T1190	TTP	Linux Persistence Techniques, Compromised Linux Host, Linux Post-Exploitation, Linux Privilege Escalation, SQL Injection	2026-07-17
Local LLM Framework DNS Query	Sysmon EventID 22	T1590	Hunting	Suspicious Local LLM Frameworks	2026-07-15
Windows Local LLM Framework Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1543	Hunting	Suspicious Local LLM Frameworks	2026-07-15
LLM Model File Creation	Sysmon EventID 11	T1543	Hunting	Suspicious Local LLM Frameworks	2026-07-15
Windows PowerShell FakeCAPTCHA Clipboard Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1059.001 T1059.003 T1204.001	TTP	Interlock Ransomware, NetSupport RMM Tool Abuse, Fake CAPTCHA Campaigns, Cisco Network Visibility Module Analytics, Scattered Lapsus$ Hunters	2026-07-14
Windows InstallUtil Remote Network Connection	Cisco Network Visibility Module Flow Data, Sysmon EventID 1, Sysmon EventID 3	T1218.004	Anomaly	Signed Binary Proxy Execution InstallUtil, Living Off The Land, Compromised Windows Host, Cisco Network Visibility Module Analytics	2026-07-14
Detect RClone Command-Line Usage	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1020	TTP	Storm-0501 Ransomware, DarkSide Ransomware, Cactus Ransomware, Ransomware, Cisco Network Visibility Module Analytics, Hellcat Ransomware, Black Basta Ransomware	2026-07-14
Windows InstallUtil URL in Command Line	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1218.004	TTP	Signed Binary Proxy Execution InstallUtil, Living Off The Land, Compromised Windows Host, Cisco Network Visibility Module Analytics	2026-07-14
Suspicious Process Executed From Container File	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.008 T1204.002	TTP	GhostRedirector IIS Module and Rungan Backdoor, APT37 Rustonotto and FadeStealer, Snake Keylogger, Amadey, Unusual Processes, Remcos, Water Gamayun	2026-07-09
AWS Bedrock Claude Unusually Large Prompts	AWS Bedrock Claude	T1055	Anomaly	Suspicious AWS Bedrock Claude Activities	2026-07-08
Linux Usermod Root UID Set	Sysmon for Linux EventID 1	T1078 T1098 T1548.001	TTP	Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation	2026-07-08
Linux Suspicious Docker Build Command Execution	Sysmon for Linux EventID 1	T1610	Anomaly	Linux Post-Exploitation	2026-07-08
Linux Possible System Binary Backdoor	Sysmon for Linux EventID 11	T1036 T1059.004	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Linux Post-Exploitation	2026-07-08
Linux Possible Nimbuspwn Privilege Escalation	Sysmon for Linux EventID 1	T1068	TTP	Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation	2026-07-08
Linux Suspicious GCC Invocation Building Init Shared Object	Sysmon for Linux EventID 1	T1027.004 T1068 T1129 T1608	TTP	Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation	2026-07-08
Windows Process With NamedPipe CommandLine	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055	Anomaly	Windows Defense Evasion Tactics	2026-07-08
Linux UDEV Rule Created	Sysmon for Linux EventID 11	T1037 T1547	Anomaly	Linux Persistence Techniques, Linux Privilege Escalation, Linux Post-Exploitation	2026-07-08
Linux Suspicious Privileged Container Execution	Sysmon for Linux EventID 1	T1059.004 T1610	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Linux Post-Exploitation	2026-07-08
Linux Suspicious XDG Autostart	Sysmon for Linux EventID 11	T1037 T1059.004 T1547	Anomaly	Linux Persistence Techniques, Linux Post-Exploitation	2026-07-08
Linux Root Execution of id	Sysmon for Linux EventID 1	T1033	Anomaly	Linux Persistence Techniques, Linux Privilege Escalation, Linux Post-Exploitation	2026-07-08
Linux File Creation In System Generator Directory	Sysmon for Linux EventID 11	T1037.005 T1547	Anomaly	Linux Persistence Techniques	2026-07-08
Linux Shell Pseudo Device Reverse Shell	Sysmon for Linux EventID 1	T1048.003 T1059	Anomaly	Compromised Linux Host, Linux Persistence Techniques, Command And Control, Linux Privilege Escalation, Linux Post-Exploitation	2026-07-08
Linux Netcat Outbound Connection	Sysmon for Linux EventID 3	T1059.004	Anomaly	Compromised Linux Host, Command And Control, Data Exfiltration, Linux Post-Exploitation	2026-07-08
Linux EFI Bootloader File Deletion	Sysmon for Linux EventID 11	T1542.001 T1542.003	TTP	Linux Persistence Techniques, Data Destruction, Ransomware	2026-07-08
Linux MOTD Script Added	Sysmon for Linux EventID 11	T1037 T1059.004 T1547	Anomaly	Linux Persistence Techniques, Linux Post-Exploitation	2026-07-08
Linux Binary Executed from Shared Memory Directory	Sysmon for Linux EventID 1	T1059	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Linux Post-Exploitation	2026-07-08
Linux Possible Bootloader Modification	Sysmon for Linux EventID 1	T1542.001	TTP	Data Destruction, Linux Persistence Techniques, Linux Rootkit	2026-07-08
Linux Shell History Access Via Command Line Utility	Sysmon for Linux EventID 1	T1552.003	Anomaly	Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Credential Dumping, Linux Post-Exploitation	2026-07-08
Linux Possible GSM Privilege Escalation	Sysmon for Linux EventID 1	T1068	Anomaly	Linux Privilege Escalation	2026-07-08
Time Provider Persistence Registry	Sysmon EventID 13	T1547.003	TTP	Hermetic Wiper, Data Destruction, Windows Registry Abuse, Windows Privilege Escalation, Windows Persistence Techniques	2026-07-08
Linux Possible Privilege Escalation via PYTHONPATH	Sysmon for Linux EventID 11	T1068 T1574.007	TTP	Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation	2026-07-08
Linux Suspicious Staging of Alternate System Files	Sysmon for Linux EventID 11	T1036	Anomaly	Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation	2026-07-08
Linux Suspicious Redis Activity	Sysmon for Linux EventID 1	T1210 T1505	TTP	Compromised Linux Host, Linux Persistence Techniques, Command And Control, Linux Privilege Escalation, Linux Post-Exploitation, Linux Living Off The Land	2026-07-08
Short Lived Scheduled Task	Windows Event Log Security 4698, Windows Event Log Security 4699	T1053.005	Anomaly	CISA AA22-257A, CISA AA23-347A, Scheduled Tasks, Compromised Windows Host, Active Directory Lateral Movement	2026-07-07
Linux Pedit Offset Out Of Bounds	Linux Messages Syslog	T1068	TTP	Linux Privilege Escalation	2026-07-06
Linux Dirty Frag Kernel Privilege Escalation	Linux Auditd Syscall	T1068 T1548.001	TTP	Linux Privilege Escalation	2026-07-06
Linux Auditd Possible Setuid Execve Privesc	Linux Auditd Execve	T1068	Anomaly	Linux Privilege Escalation	2026-07-06
AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation	AWS Bedrock Claude	T1055	Anomaly	Suspicious AWS Bedrock Claude Activities	2026-07-06
AWS Bedrock Claude Hostile Prompt Sentiment	AWS Bedrock Claude	T1055	Anomaly	Suspicious AWS Bedrock Claude Activities	2026-07-06
AWS Bedrock Claude Possible Prompt Injection	AWS Bedrock Claude	T1055	Hunting	Suspicious AWS Bedrock Claude Activities	2026-07-06
AWS Bedrock Claude Sensitive Data in Prompts	AWS Bedrock Claude	T1055	Anomaly	Suspicious AWS Bedrock Claude Activities	2026-07-06
AWS Bedrock Claude Cross Region Possible Inference Abuse	AWS Bedrock Claude	T1599	Anomaly	Suspicious AWS Bedrock Claude Activities	2026-07-06
AWS Bedrock Claude excessive use of tokens	AWS Bedrock Claude	T1055	Anomaly	Suspicious AWS Bedrock Claude Activities	2026-07-06
Windows Large Number of Computer Service Tickets Requested	Windows Event Log Security 4769	T1078 T1135	Anomaly	Active Directory Lateral Movement, Active Directory Privilege Escalation	2026-07-05
PetitPotam Suspicious Kerberos TGT Request	Windows Event Log Security 4768	T1003	TTP	PetitPotam NTLM Relay on Active Directory Certificate Services, Active Directory Kerberos Attacks	2026-07-04
Common Ransomware Notes	Sysmon EventID 11	T1485	Hunting	SamSam Ransomware, LockBit Ransomware, Interlock Ransomware, Chaos Ransomware, Storm-0501 Ransomware, Medusa Ransomware, Ransomware, Rhysida Ransomware, Clop Ransomware, NailaoLocker Ransomware, Hellcat Ransomware, Ryuk Ransomware, Black Basta Ransomware, Termite Ransomware	2026-07-02
Batch File Write to System32	Sysmon EventID 11	T1204.002	Anomaly	SamSam Ransomware, Compromised Windows Host	2026-07-02
Powershell Remote Thread To Known Windows Process	Sysmon EventID 8	T1055	TTP	Trickbot	2026-07-01
Linux Apparmor Bypass Via Aaexec	Sysmon for Linux EventID 1	T1068	TTP	Linux Privilege Escalation	2026-06-30
Windows ClipBoard Data via Get-ClipBoard	Powershell Script Block Logging 4104	T1115	Anomaly	Prestige Ransomware, BlankGrabber Stealer, Windows Post-Exploitation	2026-06-29
Windows Uncommon Remote Thread Creation In Browser Process	Sysmon EventID 8	T1055.001	Anomaly	Qakbot, IcedID, Living Off The Land	2026-06-29
Rundll32 Create Remote Thread To A Process	Sysmon EventID 8	T1055	TTP	IcedID, Living Off The Land	2026-06-29
PowerShell Environment Variable Execution	Powershell Script Block Logging 4104	T1059.001	Anomaly	VIP Keylogger	2026-06-29
Create Remote Thread In Shell Application	Sysmon EventID 8	T1055	TTP	IcedID, Warzone RAT, Qakbot	2026-06-29
Powershell Windows Defender Exclusion Commands	Powershell Script Block Logging 4104	T1685	Anomaly	Salat Stealer, Windows Defense Evasion Tactics, Data Destruction, AgentTesla, Warzone RAT, BlankGrabber Stealer, NetSupport RMM Tool Abuse, WhisperGate, Remcos, CISA AA22-320A	2026-06-29
Windows Powershell Logoff User via Quser	Powershell Script Block Logging 4104	T1059.001 T1531	Anomaly	Crypto Stealer	2026-06-29
Powershell Remove Windows Defender Directory	Powershell Script Block Logging 4104	T1685	Anomaly	WhisperGate, Data Destruction	2026-06-29
Powershell Processing Stream Of Data	Powershell Script Block Logging 4104	T1059.001	Anomaly	Hermetic Wiper, Salat Stealer, Data Destruction, XWorm, MoonPeak, Medusa Ransomware, PXA Stealer, MuddyWater, Malicious PowerShell, IcedID, Hellcat Ransomware, Braodo Stealer, AsyncRAT	2026-06-29
Windows Powershell Import Applocker Policy	Powershell Script Block Logging 4104	T1059.001 T1685	Anomaly	Azorult	2026-06-29
Create Remote Thread into LSASS	Sysmon EventID 8	T1003.001	TTP	Lokibot, Credential Dumping, BlackSuit Ransomware	2026-06-29
PowerShell Loading DotNET into Memory via Reflection	Powershell Script Block Logging 4104	T1059.001	Anomaly	Hermetic Wiper, Winter Vivern, VIP Keylogger, Data Destruction, 0bj3ctivity Stealer, AgentTesla, Axios Supply Chain Post Compromise, Malicious PowerShell, Hellcat Ransomware, AsyncRAT	2026-06-29
PowerShell Domain Enumeration	Powershell Script Block Logging 4104	T1059.001	Anomaly	Hermetic Wiper, Interlock Ransomware, Data Destruction, Microsoft WSUS CVE-2025-59287, CISA AA23-347A, Malicious PowerShell	2026-06-28
Windows Powershell Cryptography Namespace	Powershell Script Block Logging 4104	T1059.001	Anomaly	XWorm, AsyncRAT, VIP Keylogger, Phantom Stealer	2026-06-25
Windows Non Discord App Access Discord LevelDB	Windows Event Log Security 4663	T1012	Anomaly	BlankGrabber Stealer, PXA Stealer, Phantom Stealer, StealC Stealer, Snake Keylogger	2026-06-25
Windows Unusual Process Load Mozilla NSS-Mozglue Module	Sysmon EventID 7	T1218.003	Anomaly	VIP Keylogger, 0bj3ctivity Stealer, Lokibot, Quasar RAT, Phantom Stealer, StealC Stealer	2026-06-25
Powershell Fileless Script Contains Base64 Encoded Content	Powershell Script Block Logging 4104	T1027 T1059.001	TTP	IcedID, NjRAT, Data Destruction, 0bj3ctivity Stealer, XWorm, MuddyWater, Hermetic Wiper, Winter Vivern, Salat Stealer, GhostRedirector IIS Module and Rungan Backdoor, Hellcat Ransomware, AsyncRAT, VIP Keylogger, Microsoft WSUS CVE-2025-59287, Medusa Ransomware, NetSupport RMM Tool Abuse, Axios Supply Chain Post Compromise, Malicious PowerShell, Phantom Stealer, APT37 Rustonotto and FadeStealer	2026-06-25
Windows File Transfer Protocol In Non-Common Process Path	Sysmon EventID 3	T1071.003	Anomaly	Snake Keylogger, AgentTesla, Hellcat Ransomware, Phantom Stealer	2026-06-25
Windows Unusual FileZilla XML Config Access	Windows Event Log Security 4663	T1552.001	Anomaly	Phantom Stealer, Quasar RAT	2026-06-25
PowerShell PInvoke Process Injection API Chain	Powershell Script Block Logging 4104	T1055.001 T1055.003 T1055.004 T1055.012 T1055.013 T1059.001 T1620	TTP	VIP Keylogger, Phantom Stealer	2026-06-25
Suspicious Process With Discord DNS Query	Sysmon EventID 22	T1059.005	Anomaly	Data Destruction, BlankGrabber Stealer, Cactus Ransomware, PXA Stealer, Phantom Stealer, WhisperGate	2026-06-25
Windows Browser Process Launched with Unusual Flags	Sysmon EventID 1	T1185	Anomaly	Castle RAT, Phantom Stealer	2026-06-25
Headless Browser Usage	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1497 T1564.003	Anomaly	Browser Hijacking, Forest Blizzard, Phantom Stealer	2026-06-25
Windows Chromium Browser with Custom User Data Directory	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1497	Anomaly	StealC Stealer, Malicious Inno Setup Loader, Lokibot, Phantom Stealer	2026-06-25
Windows Credentials from Password Stores Chrome Copied in TEMP Dir	Sysmon EventID 11	T1555.003	TTP	Scattered Lapsus$ Hunters, BlankGrabber Stealer, Braodo Stealer, Phantom Stealer	2026-06-25
Windows Chromium Browser No Security Sandbox Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1497	TTP	Malicious Inno Setup Loader, Phantom Stealer	2026-06-25
Windows Disable or Modify Tools Via Taskkill	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Anomaly	BlankGrabber Stealer, PXA Stealer, Phantom Stealer, NjRAT, Crypto Stealer	2026-06-25
Splunk Authentication Token Exposure in Debug Log		T1654	TTP	Splunk Vulnerabilities	2026-06-24
Splunk RCE Through Arbitrary File Write to Windows System Root	Splunk	T1210	Hunting	Splunk Vulnerabilities	2026-06-23
PTC Windchill Gateway Command Execution	Windchill Log4j	T1005 T1059 T1190	Anomaly	PTC Windchill Exploitation	2026-06-14
PTC Windchill GW READY OK Probe	Windchill Log4j	T1059 T1190	Anomaly	PTC Windchill Exploitation	2026-06-14
Windows EDRSilencer Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Anomaly	Security Solution Tampering	2026-06-13
Splunk Secure Application Alerts for Runtime Security		N/A	Anomaly	Critical Alerts	2026-06-12
Cisco SA - Automated Web Reconnaissance via HTTP Access Errors	Cisco Secure Access Proxy	T1595	Anomaly	Cisco Secure Access Analytics	2026-06-09
Cisco SA - Access to Anonymizer Services	Cisco Secure Access DNS	T1090.003	Anomaly	Cisco Secure Access Analytics	2026-06-09
Cisco SD-WAN Multiple SSH key Authentication from Same Source	Cisco SD-WAN Auth Log	T1595	Hunting	Cisco Catalyst SD-WAN Analytics	2026-06-09
Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication	Cisco SD-WAN Auth Log	T1595	Hunting	Cisco Catalyst SD-WAN Analytics	2026-06-09
Windows Obfuscated Files or Information via RAR SFX	Sysmon EventID 11	T1027.013	Anomaly	APT37 Rustonotto and FadeStealer, Salat Stealer, Crypto Stealer, GhostRedirector IIS Module and Rungan Backdoor	2026-06-08
Windows Firewall Rule Added	Windows Event Log Security 4946	T1686	Anomaly	NetSupport RMM Tool Abuse, Salat Stealer, Medusa Ransomware, ShrinkLocker	2026-06-08
Powershell Using memory As Backing Store	Powershell Script Block Logging 4104	T1059.001	TTP	Hermetic Wiper, Salat Stealer, Data Destruction, MoonPeak, Medusa Ransomware, IcedID, Malicious PowerShell	2026-06-08
Windows Impair Defense Disable Web Evaluation	Sysmon EventID 13	T1685	TTP	Salat Stealer, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-06-08
Windows Process Execution From ProgramData	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.005	Hunting	Salat Stealer, XWorm, GhostRedirector IIS Module and Rungan Backdoor, SolarWinds WHD RCE Post Exploitation, Axios Supply Chain Post Compromise, StealC Stealer, China-Nexus Threat Activity, Salt Typhoon, SnappyBee, APT37 Rustonotto and FadeStealer	2026-06-08
Windows Defender Exclusion Registry Entry	Sysmon EventID 13	T1685	TTP	Salat Stealer, Windows Defense Evasion Tactics, Qakbot, XWorm, Warzone RAT, NetSupport RMM Tool Abuse, ValleyRAT, Azorult, Remcos	2026-06-08
Disable Windows SmartScreen Protection	Sysmon EventID 13	T1685	TTP	CISA AA23-347A, Salat Stealer, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-06-08
Firewall Allowed Program Enable	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1686	Anomaly	Salat Stealer, Windows Defense Evasion Tactics, BlackByte Ransomware, Medusa Ransomware, NjRAT, Azorult, PlugX	2026-06-08
Disable Defender AntiVirus Registry	Sysmon EventID 13	T1685	TTP	Salat Stealer, CISA AA24-241A, Cactus Ransomware, SolarWinds WHD RCE Post Exploitation, Windows Registry Abuse, IcedID, Black Basta Ransomware	2026-06-08
Disable Defender Submit Samples Consent Feature	Sysmon EventID 13	T1685	TTP	Salat Stealer, CISA AA23-347A, BlankGrabber Stealer, Windows Registry Abuse, IcedID, Azorult	2026-06-08
Add or Set Windows Defender Exclusion	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	TTP	Salat Stealer, Windows Defense Evasion Tactics, Data Destruction, XWorm, AgentTesla, NetSupport RMM Tool Abuse, Crypto Stealer, ValleyRAT, WhisperGate, Compromised Windows Host, Remcos, CISA AA22-320A	2026-06-08
Windows Alternate DataStream - Process Execution	Windows Event Log Security 4688, Sysmon EventID 1	T1564.004	TTP	Compromised Windows Host, Windows Defense Evasion Tactics	2026-06-04
M365 Copilot Impersonation Jailbreak Attack	M365 Exported eDiscovery Prompts	T1685	TTP	Suspicious Microsoft 365 Copilot Activities	2026-06-04
Linux Proxy Socks Curl	Sysmon for Linux EventID 1	T1090 T1095	TTP	Ingress Tool Transfer, Linux Living Off The Land	2026-06-04
Windows AD add Self to Group	Windows Event Log Security 4728	T1098	TTP	Sneaky Active Directory Persistence Tricks, Medusa Ransomware, Active Directory Privilege Escalation	2026-06-01
Cisco IOS XE Tunnel Interface Configuration	Cisco IOS Logs	T1090 T1572	Anomaly	Salt Typhoon	2026-05-20
Cisco IOS XE VTY Access Class Tampering	Cisco IOS Logs	T1021 T1562	Anomaly	Salt Typhoon	2026-05-20
Cisco IOS XE Guestshell Activation and Destroy	Cisco IOS Logs	T1059 T1611	Anomaly	Salt Typhoon	2026-05-20
Cisco IOS XE Reconnaissance Command Activity	Cisco IOS Logs	T1016 T1082 T1590	Anomaly	Salt Typhoon	2026-05-20
Cisco IOS XE Remote Access Probe Burst	Cisco IOS Logs	T1018 T1021.004 T1046	Anomaly	Salt Typhoon	2026-05-20
Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal	Cisco IOS Logs	T1070.001 T1562	Anomaly	Salt Typhoon	2026-05-20
Cisco IOS XE Request Platform Package Describe Shell Pattern	Cisco IOS Logs	T1059 T1190	TTP	Salt Typhoon	2026-05-20
Windows FFmpeg DirectShow Video Capture	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1125	Anomaly	Salat Stealer	2026-05-20
Windows FFmpeg Audio and Video Device Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1125	Anomaly	Salat Stealer	2026-05-20
Cisco IOS XE WebUI Login From IOSd Local Port	Cisco IOS Logs	T1078 T1190	TTP	Salt Typhoon	2026-05-19
Splunk RCE via User XSLT		T1210	Hunting	Splunk Vulnerabilities	2026-05-14
Splunk User Enumeration Attempt	Splunk	T1078	TTP	Splunk Vulnerabilities	2026-05-14
Splunk Sensitive Information Disclosure in DEBUG Logging Channels	Splunk	T1552	Hunting	Splunk Vulnerabilities	2026-05-14
Splunk XSS Privilege Escalation via Custom Urls in Dashboard	Splunk	T1189	Hunting	Splunk Vulnerabilities	2026-05-14
Zscaler Phishing Activity Threat Blocked		T1566	Anomaly	Zscaler Browser Proxy Threats, Hellcat Ransomware	2026-05-13
Zscaler Exploit Threat Blocked		T1566	TTP	Zscaler Browser Proxy Threats	2026-05-13
Confluence CVE-2023-22515 Trigger Vulnerability	Suricata	T1190	TTP	CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server	2026-05-13
Juniper Networks Remote Code Execution Exploit Detection	Suricata	T1059 T1105 T1190	TTP	Juniper JunOS Remote Code Execution	2026-05-13
Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure	Suricata	T1190	Anomaly	Citrix NetScaler ADC and NetScaler Gateway CVE-2025-5777	2026-05-13
Zscaler Behavior Analysis Threat Blocked		T1566	Anomaly	Zscaler Browser Proxy Threats	2026-05-13
HTTP Duplicated Header	Suricata	T1071.001 T1190	Anomaly	HTTP Request Smuggling	2026-05-13
JetBrains TeamCity Authentication Bypass CVE-2024-27198	Suricata	T1190	TTP	JetBrains TeamCity Vulnerabilities	2026-05-13
Web JSP Request via URL	Nginx Access	T1133 T1190 T1505.003	TTP	Spring4Shell CVE-2022-22965, Earth Alux	2026-05-13
Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint	Suricata	T1190	TTP	Ivanti Connect Secure VPN Vulnerabilities, CISA AA24-241A	2026-05-13
Zscaler Privacy Risk Destinations Threat Blocked		T1566	Anomaly	Zscaler Browser Proxy Threats	2026-05-13
Zscaler CryptoMiner Downloaded Threat Blocked		T1566	Anomaly	Zscaler Browser Proxy Threats	2026-05-13
Windows SharePoint ToolPane Endpoint Exploitation Attempt	Suricata	T1190 T1505.003	TTP	Microsoft SharePoint Vulnerabilities	2026-05-13
Zscaler Legal Liability Threat Blocked		T1566	Anomaly	Zscaler Browser Proxy Threats	2026-05-13
Zscaler Scam Destinations Threat Blocked		T1566	Anomaly	Zscaler Browser Proxy Threats	2026-05-13
Web Remote ShellServlet Access	Nginx Access	T1190	TTP	GhostRedirector IIS Module and Rungan Backdoor, CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server	2026-05-13
Ivanti Connect Secure System Information Access via Auth Bypass	Suricata	T1190	Anomaly	Ivanti Connect Secure VPN Vulnerabilities, CISA AA24-241A	2026-05-13
F5 TMUI Authentication Bypass	Suricata	N/A	TTP	F5 Authentication Bypass with TMUI	2026-05-13
Confluence Data Center and Server Privilege Escalation	Nginx Access	T1190	TTP	Confluence Data Center and Confluence Server Vulnerabilities, CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server	2026-05-13
Zscaler Virus Download threat blocked		T1566	Anomaly	Zscaler Browser Proxy Threats	2026-05-13
ConnectWise ScreenConnect Authentication Bypass	Suricata	T1190	TTP	Seashell Blizzard, ConnectWise ScreenConnect Vulnerabilities	2026-05-13
Spring4Shell Payload URL Request	Nginx Access	T1133 T1190 T1505.003	TTP	Spring4Shell CVE-2022-22965	2026-05-13
Web Spring Cloud Function FunctionRouter	Splunk Stream HTTP	T1133 T1190	TTP	Spring4Shell CVE-2022-22965	2026-05-13
HTTP Rapid POST with Mixed Status Codes	Nginx Access	T1071.001 T1190 T1595	Anomaly	HTTP Request Smuggling	2026-05-13
Zscaler Potentially Abused File Download		T1566	Anomaly	Zscaler Browser Proxy Threats	2026-05-13
Zscaler Malware Activity Threat Blocked		T1566	Anomaly	Zscaler Browser Proxy Threats	2026-05-13
Tomcat Session Deserialization Attempt	Nginx Access	T1190 T1505.003	Anomaly	Apache Tomcat Session Deserialization Attacks	2026-05-13
Citrix ADC and Gateway Unauthorized Data Disclosure	Suricata	T1190	TTP	Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966, Scattered Lapsus$ Hunters	2026-05-13
HTTP Possible Request Smuggling	Suricata	T1071.001	TTP	HTTP Request Smuggling	2026-05-13
Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527	Suricata	T1190	TTP	Confluence Data Center and Confluence Server Vulnerabilities	2026-05-13
Tomcat Session File Upload Attempt	Nginx Access	T1190 T1505.003	Anomaly	Apache Tomcat Session Deserialization Attacks	2026-05-13
Windows SharePoint Spinstall0 GET Request	Suricata	T1190 T1505.003 T1552	TTP	Microsoft SharePoint Vulnerabilities	2026-05-13
Ivanti Connect Secure Command Injection Attempts	Suricata	T1190	TTP	Ivanti Connect Secure VPN Vulnerabilities, CISA AA24-241A	2026-05-13
JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199	Suricata	T1190	TTP	JetBrains TeamCity Vulnerabilities	2026-05-13
Jenkins Arbitrary File Read CVE-2024-23897	Nginx Access	T1190	TTP	Jenkins Server Vulnerabilities, Hellcat Ransomware	2026-05-13
Multiple Archive Files Http Post Traffic	Splunk Stream HTTP	T1048.003	TTP	APT37 Rustonotto and FadeStealer, Hellcat Ransomware, Data Exfiltration, Command And Control	2026-05-13
Hunting for Log4Shell	Nginx Access	T1133 T1190	Hunting	CISA AA22-320A, Log4Shell CVE-2021-44228	2026-05-13
Zscaler Adware Activities Threat Blocked		T1566	Anomaly	Zscaler Browser Proxy Threats	2026-05-13
Ivanti Connect Secure SSRF in SAML Component	Suricata	T1190	TTP	Ivanti Connect Secure VPN Vulnerabilities	2026-05-13
Zscaler Employment Search Web Activity		T1566	Anomaly	Zscaler Browser Proxy Threats	2026-05-13
Web Spring4Shell HTTP Request Class Module	Splunk Stream HTTP	T1133 T1190	TTP	Spring4Shell CVE-2022-22965	2026-05-13
JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198	Suricata	T1190	TTP	Hellcat Ransomware, JetBrains TeamCity Vulnerabilities	2026-05-13
Detect Spike in AWS Security Hub Alerts for EC2 Instance	AWS Security Hub	N/A	Anomaly	AWS Security Hub Alerts, Critical Alerts	2026-05-13
O365 ApplicationImpersonation Role Assigned	O365	T1098.002	TTP	Office 365 Persistence Mechanisms, NOBELIUM Group, Office 365 Collection Techniques	2026-05-13
Azure AD Admin Consent Bypassed by Service Principal	Azure Active Directory Add app role assignment to service principal	T1098.003	TTP	NOBELIUM Group, Azure Active Directory Privilege Escalation	2026-05-13
AWS IAM AccessDenied Discovery Events	AWS CloudTrail	T1580	Anomaly	Suspicious Cloud User Activities	2026-05-13
ASL AWS Defense Evasion Impair Security Services	ASL AWS CloudTrail	T1685.002	Hunting	AWS Defense Evasion	2026-05-13
Azure AD Multiple Users Failing To Authenticate From Ip	Azure Active Directory	T1110.003 T1110.004 T1586.003	Anomaly	Azure Active Directory Account Takeover	2026-05-13
AWS EC2 Snapshot Shared Externally	AWS CloudTrail ModifySnapshotAttribute	T1537	TTP	Suspicious Cloud Instance Activities, Data Exfiltration	2026-05-13
Okta Non-Standard VPN Usage	Okta	T1078 T1090 T1572	TTP	Suspicious Okta Activity, Remote Employment Fraud	2026-05-13
O365 Exfiltration via File Download	Office 365 Universal Audit Log	T1530 T1567	Anomaly	Office 365 Account Takeover, Data Exfiltration	2026-05-13
AWS ECR Container Scanning Findings Low Informational Unknown	AWS CloudTrail DescribeImageScanFindings	T1204.003	Anomaly	Dev Sec Ops	2026-05-13
O365 Mailbox Inbox Folder Shared with All Users	O365 ModifyFolderPermissions	T1114.002	TTP	Office 365 Persistence Mechanisms	2026-05-13
O365 Mailbox Read Access Granted to Application	O365 Update application.	T1098.003 T1114.002	TTP	Office 365 Persistence Mechanisms	2026-05-13
Gsuite Email With Known Abuse Web Service Link	G Suite Gmail	T1566.001	Anomaly	Dev Sec Ops	2026-05-13
O365 User Consent Denied for OAuth Application	O365	T1528	TTP	Office 365 Account Takeover	2026-05-13
Azure AD Privileged Authentication Administrator Role Assigned	Azure Active Directory Add member to role	T1003.002	TTP	Scattered Lapsus$ Hunters, Azure Active Directory Privilege Escalation	2026-05-13
AWS AMI Attribute Modification for Exfiltration	AWS CloudTrail ModifyImageAttribute	T1537	TTP	Suspicious Cloud Instance Activities, Data Exfiltration	2026-05-13
Kubernetes Scanning by Unauthenticated IP Address	Kubernetes Audit	T1046	Anomaly	Kubernetes Security	2026-05-13
Microsoft Intune Mobile Apps	Azure Monitor Activity	T1021.007 T1072 T1105 T1202	Hunting	Azure Active Directory Account Takeover	2026-05-13
AWS Exfiltration via Batch Service	AWS CloudTrail JobCreated	T1119	TTP	Data Exfiltration	2026-05-13
AWS Multiple Users Failing To Authenticate From Ip	AWS CloudTrail ConsoleLogin	T1110.003 T1110.004	Anomaly	Compromised User Account, AWS Identity and Access Management Account Takeover	2026-05-13
Gsuite suspicious calendar invite		T1566	Hunting	Spearphishing Attachments	2026-05-13
Azure AD Multiple Service Principals Created by SP	Azure Active Directory Add service principal	T1136.003	Anomaly	Azure Active Directory Persistence, NOBELIUM Group	2026-05-13
AWS Credential Access GetPasswordData	AWS CloudTrail GetPasswordData	T1110.001 T1586.003	Anomaly	AWS Identity and Access Management Account Takeover	2026-05-13
Azure AD Successful Authentication From Different Ips	Azure Active Directory	T1110.001 T1110.003	TTP	Azure Active Directory Account Takeover, Compromised User Account	2026-05-13
ASL AWS EC2 Snapshot Shared Externally	ASL AWS CloudTrail	T1537	TTP	Suspicious Cloud Instance Activities, Data Exfiltration	2026-05-13
Azure AD Service Principal Authentication	Azure Active Directory Sign-in activity	T1078.004	TTP	Azure Active Directory Account Takeover, NOBELIUM Group	2026-05-13
AWS Defense Evasion Update Cloudtrail	AWS CloudTrail UpdateTrail	T1685.002	TTP	AWS Defense Evasion	2026-05-13
O365 Mail Permissioned Application Consent Granted by User	O365 Consent to application.	T1528	TTP	Office 365 Account Takeover	2026-05-13
AWS Exfiltration via EC2 Snapshot	AWS CloudTrail DescribeSnapshotAttribute, AWS CloudTrail CreateSnapshot, AWS CloudTrail DeleteSnapshot, AWS CloudTrail ModifySnapshotAttribute	T1537	TTP	Suspicious Cloud Instance Activities, Data Exfiltration	2026-05-13
ASL AWS UpdateLoginProfile	ASL AWS CloudTrail	T1136.003	TTP	AWS IAM Privilege Escalation	2026-05-13
Azure Runbook Webhook Created	Azure Audit Create or Update an Azure Automation webhook	T1078.004	TTP	Azure Active Directory Persistence	2026-05-13
ASL AWS Defense Evasion Update Cloudtrail	ASL AWS CloudTrail	T1685.002	TTP	AWS Defense Evasion	2026-05-13
Microsoft Intune Device Health Scripts	Azure Monitor Activity	T1021.007 T1072 T1105 T1202	Hunting	Azure Active Directory Account Takeover	2026-05-13
Kubernetes newly seen UDP edge		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
Azure AD Service Principal Owner Added	Azure Active Directory Add owner to application	T1098	TTP	Azure Active Directory Persistence, NOBELIUM Group, Azure Active Directory Privilege Escalation	2026-05-13
AWS ECR Container Scanning Findings Medium	AWS CloudTrail DescribeImageScanFindings	T1204.003	Anomaly	Dev Sec Ops	2026-05-13
Azure AD Privileged Graph API Permission Assigned	Azure Active Directory Update application	T1003.002	TTP	Azure Active Directory Persistence, NOBELIUM Group	2026-05-13
O365 Email Reported By Admin Found Malicious	Office 365 Universal Audit Log	T1566.001 T1566.002	TTP	Suspicious Emails, Spearphishing Attachments	2026-05-13
GitHub Organizations Disable Dependabot	GitHub Organizations Audit Logs	T1195 T1685	Anomaly	GitHub Malicious Activity	2026-05-13
Kubernetes Previously Unseen Process		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
O365 File Permissioned Application Consent Granted by User	O365 Consent to application.	T1528	TTP	Office 365 Account Takeover	2026-05-13
Azure AD Application Administrator Role Assigned	Azure Active Directory Add member to role	T1098.003	TTP	Scattered Lapsus$ Hunters, Azure Active Directory Privilege Escalation	2026-05-13
O365 Excessive SSO logon errors	O365 UserLoginFailed	T1556	Anomaly	Office 365 Account Takeover, Cloud Federated Credential Abuse	2026-05-13
ASL AWS Defense Evasion Stop Logging Cloudtrail	ASL AWS CloudTrail	T1685.002	TTP	AWS Defense Evasion	2026-05-13
GitHub Enterprise Repository Archived	GitHub Enterprise Audit Logs	T1195 T1485	Anomaly	GitHub Malicious Activity, NPM Supply Chain Compromise	2026-05-13
O365 SharePoint Allowed Domains Policy Changed	Office 365 Universal Audit Log	T1136.003	TTP	Azure Active Directory Persistence	2026-05-13
O365 Service Principal Privilege Escalation	O365 Add app role assignment grant to user.	T1098.003	TTP	Office 365 Account Takeover, Azure Active Directory Privilege Escalation	2026-05-13
Kubernetes Anomalous Traffic on Network Edge		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
AWS ECR Container Upload Unknown User	AWS CloudTrail PutImage	T1204.003	Anomaly	Dev Sec Ops	2026-05-13
AWS IAM Successful Group Deletion	AWS CloudTrail DeleteGroup	T1069.003 T1098	Hunting	AWS IAM Privilege Escalation	2026-05-13
Amazon EKS Kubernetes cluster scan detection		T1526	Hunting	Kubernetes Scanning Activity	2026-05-13
Azure AD Service Principal Created	Azure Active Directory Add service principal	T1136.003	TTP	Azure Active Directory Persistence, NOBELIUM Group	2026-05-13
Kubernetes Nginx Ingress RFI		T1212	TTP	Dev Sec Ops	2026-05-13
GitHub Enterprise Delete Branch Ruleset	GitHub Enterprise Audit Logs	T1195 T1685	Anomaly	GitHub Malicious Activity, NPM Supply Chain Compromise	2026-05-13
O365 Exfiltration via File Sync Download	Office 365 Universal Audit Log	T1530 T1567	Anomaly	Office 365 Account Takeover, Data Exfiltration	2026-05-13
Kubernetes Shell Running on Worker Node		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
O365 Threat Intelligence Suspicious File Detected	Office 365 Universal Audit Log	T1204.002	TTP	Office 365 Account Takeover, Azure Active Directory Account Takeover, Ransomware Cloud	2026-05-13
AWS Lambda UpdateFunctionCode	AWS CloudTrail	T1204	Hunting	Suspicious Cloud User Activities	2026-05-13
ASL AWS Disable Bucket Versioning	ASL AWS CloudTrail	T1490	Anomaly	Suspicious AWS S3 Activities, Data Exfiltration	2026-05-13
AWS Unusual Number of Failed Authentications From Ip	AWS CloudTrail ConsoleLogin	T1110.003 T1110.004 T1586.003	Anomaly	AWS Identity and Access Management Account Takeover	2026-05-13
Azure Automation Account Created	Azure Audit Create or Update an Azure Automation account	T1136.003	TTP	Azure Active Directory Persistence	2026-05-13
Kubernetes Unauthorized Access	Kubernetes Audit	T1204	Anomaly	Kubernetes Security	2026-05-13
ASL AWS IAM Failure Group Deletion	ASL AWS CloudTrail	T1098	Anomaly	AWS IAM Privilege Escalation	2026-05-13
ASL AWS Create Policy Version to allow all resources	ASL AWS CloudTrail	T1078.004	TTP	AWS IAM Privilege Escalation, Scattered Lapsus$ Hunters	2026-05-13
GitHub Enterprise Disable IP Allow List	GitHub Enterprise Audit Logs	T1195 T1685	Anomaly	GitHub Malicious Activity	2026-05-13
O365 Exfiltration via File Access	Office 365 Universal Audit Log	T1530 T1567	Anomaly	Office 365 Account Takeover, Data Exfiltration	2026-05-13
O365 Email Suspicious Search Behavior	Office 365 Universal Audit Log	T1114.002 T1552	Anomaly	Office 365 Account Takeover, Compromised User Account, CISA AA22-320A, Office 365 Collection Techniques	2026-05-13
Kubernetes Process Running From New Path		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
O365 FullAccessAsApp Permission Assigned	O365 Update application.	T1098.002 T1098.003	TTP	Office 365 Persistence Mechanisms, NOBELIUM Group	2026-05-13
Azure AD New MFA Method Registered For User	Azure Active Directory User registered security info	T1556.006	TTP	Azure Active Directory Account Takeover, Compromised User Account, Scattered Lapsus$ Hunters	2026-05-13
O365 Email Hard Delete Excessive Volume	Office 365 Universal Audit Log	T1070.008 T1485	Anomaly	Office 365 Account Takeover, Suspicious Emails, Data Destruction	2026-05-13
Kubernetes DaemonSet Deployed	Kubernetes Audit	T1204	Anomaly	Kubernetes Security	2026-05-13
O365 OAuth App Mailbox Access via EWS	O365 MailItemsAccessed	T1114.002	TTP	NOBELIUM Group, Office 365 Collection Techniques	2026-05-13
GSuite Email Suspicious Attachment	G Suite Gmail	T1566.001	Anomaly	Dev Sec Ops	2026-05-13
O365 Safe Links Detection	Office 365 Universal Audit Log	T1566.001	TTP	Office 365 Account Takeover, Spearphishing Attachments	2026-05-13
O365 Add App Role Assignment Grant User	O365 Add app role assignment grant to user.	T1136.003	TTP	Cloud Federated Credential Abuse, Office 365 Persistence Mechanisms	2026-05-13
ASL AWS Credential Access GetPasswordData	ASL AWS CloudTrail	T1110.001 T1586.003	Anomaly	AWS Identity and Access Management Account Takeover	2026-05-13
Azure AD High Number Of Failed Authentications For User	Azure Active Directory	T1110.001	TTP	Azure Active Directory Account Takeover, Compromised User Account	2026-05-13
ASL AWS ECR Container Upload Outside Business Hours	ASL AWS CloudTrail	T1204.003	Anomaly	Dev Sec Ops	2026-05-13
O365 Mailbox Email Forwarding Enabled		T1114.003	TTP	Office 365 Collection Techniques	2026-05-13
Azure AD Multi-Source Failed Authentications Spike	Azure Active Directory	T1110.003 T1110.004 T1586.003	Hunting	Azure Active Directory Account Takeover, NOBELIUM Group	2026-05-13
AWS Exfiltration via DataSync Task	AWS CloudTrail CreateTask	T1119	TTP	Hellcat Ransomware, Suspicious AWS S3 Activities, Data Exfiltration	2026-05-13
O365 Email Access By Security Administrator	Office 365 Universal Audit Log	T1114.002 T1567	TTP	Office 365 Account Takeover, Azure Active Directory Account Takeover, Data Exfiltration	2026-05-13
AWS IAM Failure Group Deletion	AWS CloudTrail DeleteGroup	T1098	Anomaly	AWS IAM Privilege Escalation	2026-05-13
Gsuite Suspicious Shared File Name	G Suite Drive	T1566.001	Anomaly	Dev Sec Ops	2026-05-13
AWS CreateLoginProfile	AWS CloudTrail CreateLoginProfile, AWS CloudTrail ConsoleLogin	T1136.003	TTP	AWS IAM Privilege Escalation	2026-05-13
O365 Email Security Feature Changed	Office 365 Universal Audit Log	T1685.002	TTP	Office 365 Account Takeover, Office 365 Persistence Mechanisms	2026-05-13
Azure AD User ImmutableId Attribute Updated	Azure Active Directory Update user	T1098	TTP	Azure Active Directory Persistence, Hellcat Ransomware	2026-05-13
Azure AD Multi-Factor Authentication Disabled	Azure Active Directory Disable Strong Authentication	T1556.006 T1586.003	TTP	Azure Active Directory Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
Azure AD AzureHound UserAgent Detected	Azure Active Directory NonInteractiveUserSignInLogs, Azure Active Directory MicrosoftGraphActivityLogs	T1087.004 T1526	TTP	Compromised User Account, Azure Active Directory Privilege Escalation	2026-05-13
Azure AD External Guest User Invited	Azure Active Directory Invite external user	T1136.003	TTP	Azure Active Directory Persistence	2026-05-13
O365 DLP Rule Triggered	Office 365 Universal Audit Log	T1048 T1567	Anomaly	Data Exfiltration	2026-05-13
O365 Email New Inbox Rule Created	Office 365 Universal Audit Log	T1114.003 T1564.008	Anomaly	Office 365 Collection Techniques	2026-05-13
Azure AD User Consent Denied for OAuth Application	Azure Active Directory Sign-in activity	T1528	TTP	Azure Active Directory Account Takeover	2026-05-13
AWS Exfiltration via Bucket Replication	AWS CloudTrail PutBucketReplication	T1537	TTP	Suspicious AWS S3 Activities, Data Exfiltration	2026-05-13
O365 SharePoint Malware Detection	Office 365 Universal Audit Log	T1204.002	TTP	Office 365 Account Takeover, Azure Active Directory Persistence, Ransomware Cloud	2026-05-13
O365 Application Registration Owner Added	O365 Add owner to application.	T1098	TTP	Office 365 Persistence Mechanisms, NOBELIUM Group	2026-05-13
GitHub Enterprise Remove Organization	GitHub Enterprise Audit Logs	T1195 T1485	Anomaly	GitHub Malicious Activity	2026-05-13
AWS Network Access Control List Created with All Open Ports	AWS CloudTrail ReplaceNetworkAclEntry, AWS CloudTrail CreateNetworkAclEntry	T1686.001	TTP	AWS Network ACL Activity	2026-05-13
Azure AD High Number Of Failed Authentications From Ip	Azure Active Directory	T1110.001 T1110.003	TTP	Azure Active Directory Account Takeover, Compromised User Account, NOBELIUM Group	2026-05-13
AWS UpdateLoginProfile	AWS CloudTrail UpdateLoginProfile	T1136.003	TTP	AWS IAM Privilege Escalation	2026-05-13
ASL AWS Defense Evasion Delete CloudWatch Log Group	ASL AWS CloudTrail	T1685.002	TTP	AWS Defense Evasion	2026-05-13
GitHub Organizations Repository Archived	GitHub Organizations Audit Logs	T1195 T1485	Anomaly	GitHub Malicious Activity, NPM Supply Chain Compromise	2026-05-13
O365 Compliance Content Search Started		T1114.002	TTP	Office 365 Collection Techniques	2026-05-13
Kubernetes Falco Shell Spawned	Kubernetes Falco	T1204	Anomaly	Kubernetes Security	2026-05-13
AWS Create Policy Version to allow all resources	AWS CloudTrail CreatePolicyVersion	T1078.004	TTP	AWS IAM Privilege Escalation	2026-05-13
AWS Disable Bucket Versioning	AWS CloudTrail PutBucketVersioning	T1490	Anomaly	Suspicious AWS S3 Activities, Data Exfiltration	2026-05-13
Kubernetes Shell Running on Worker Node with CPU Activity		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
O365 Disable MFA	O365 Disable Strong Authentication.	T1556	TTP	Office 365 Persistence Mechanisms	2026-05-13
Cloud Security Groups Modifications by User	AWS CloudTrail	T1578.005	Anomaly	Suspicious Cloud User Activities	2026-05-13
O365 Multiple Mailboxes Accessed via API	O365 MailItemsAccessed	T1114.002	TTP	NOBELIUM Group, Office 365 Collection Techniques	2026-05-13
GCP Multi-Factor Authentication Disabled	Google Workspace	T1556.006 T1586.003	TTP	GCP Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
AWS Detect Users creating keys with encrypt policy without MFA	AWS CloudTrail PutKeyPolicy, AWS CloudTrail CreateKey	T1486	TTP	Ransomware Cloud	2026-05-13
Kubernetes Anomalous Inbound Network Activity from Process		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
AWS Concurrent Sessions From Different Ips	AWS CloudTrail DescribeEventAggregates	T1185	TTP	Compromised User Account, Scattered Lapsus$ Hunters, AWS Identity and Access Management Account Takeover	2026-05-13
AWS Defense Evasion Delete Cloudtrail	AWS CloudTrail DeleteTrail	T1685.002	TTP	AWS Defense Evasion	2026-05-13
GitHub Enterprise Disable 2FA Requirement	GitHub Enterprise Audit Logs	T1195 T1685	Anomaly	GitHub Malicious Activity	2026-05-13
O365 Multiple Service Principals Created by User	O365 Add service principal.	T1136.003	Anomaly	Office 365 Persistence Mechanisms, NOBELIUM Group	2026-05-13
Kubernetes Abuse of Secret by Unusual User Group	Kubernetes Audit	T1552.007	Anomaly	Kubernetes Security	2026-05-13
O365 Concurrent Sessions From Different Ips	O365 UserLoggedIn	T1185	TTP	Office 365 Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
Azure AD Concurrent Sessions From Different Ips	Azure Active Directory	T1185	TTP	Azure Active Directory Account Takeover, Compromised User Account, Scattered Lapsus$ Hunters	2026-05-13
GitHub Enterprise Repository Deleted	GitHub Enterprise Audit Logs	T1195 T1485	Anomaly	GitHub Malicious Activity, NPM Supply Chain Compromise	2026-05-13
Azure AD Successful PowerShell Authentication	Azure Active Directory	T1078.004 T1586.003	TTP	Azure Active Directory Account Takeover	2026-05-13
Kubernetes Pod Created in Default Namespace	Kubernetes Audit	T1204	Anomaly	Kubernetes Security	2026-05-13
AWS Defense Evasion PutBucketLifecycle	AWS CloudTrail PutBucketLifecycle	T1485.001 T1685.002	Hunting	AWS Defense Evasion	2026-05-13
AWS Defense Evasion Stop Logging Cloudtrail	AWS CloudTrail StopLogging	T1685.002	TTP	AWS Defense Evasion	2026-05-13
Azure AD Multiple AppIDs and UserAgents Authentication Spike	Azure Active Directory Sign-in activity	T1078	Anomaly	Azure Active Directory Account Takeover	2026-05-13
Kubernetes Anomalous Outbound Network Activity from Process		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
O365 External Identity Policy Changed	Office 365 Universal Audit Log	T1136.003	TTP	Azure Active Directory Persistence	2026-05-13
Azure AD Service Principal Privilege Escalation	Azure Active Directory Add app role assignment to service principal	T1098.003	TTP	Azure Active Directory Privilege Escalation	2026-05-13
AWS Bedrock High Number List Foundation Model Failures	AWS CloudTrail	T1580	TTP	AWS Bedrock Security	2026-05-13
ASL AWS Create Access Key	ASL AWS CloudTrail	T1136.003	Hunting	AWS IAM Privilege Escalation, Scattered Lapsus$ Hunters	2026-05-13
Gsuite Outbound Email With Attachment To External Domain	G Suite Gmail	T1048.003	Hunting	Insider Threat, Dev Sec Ops	2026-05-13
O365 Email Suspicious Behavior Alert	Office 365 Universal Audit Log	T1114.003	TTP	Suspicious Emails, Office 365 Account Takeover, Office 365 Collection Techniques	2026-05-13
O365 Cross-Tenant Access Change	Office 365 Universal Audit Log	T1484.002	TTP	Azure Active Directory Persistence	2026-05-13
O365 User Consent Blocked for Risky Application	O365 Consent to application.	T1528	TTP	Office 365 Account Takeover	2026-05-13
Gsuite Drive Share In External Email	G Suite Drive	T1567.002	Anomaly	Insider Threat, Dev Sec Ops, Scattered Lapsus$ Hunters	2026-05-13
O365 Multiple Users Failing To Authenticate From Ip	O365 UserLoginFailed	T1110.003 T1110.004 T1586.003	TTP	Office 365 Account Takeover, NOBELIUM Group	2026-05-13
GCP Authentication Failed During MFA Challenge	Google Workspace login_failure	T1078.004 T1586.003 T1621	TTP	GCP Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
Azure AD Authentication Failed During MFA Challenge	Azure Active Directory	T1078.004 T1586.003 T1621	TTP	Azure Active Directory Account Takeover	2026-05-13
AWS Network Access Control List Deleted	AWS CloudTrail DeleteNetworkAclEntry	T1686.001	Anomaly	AWS Network ACL Activity	2026-05-13
O365 Advanced Audit Disabled	O365 Change user license.	T1685.002	TTP	Office 365 Persistence Mechanisms	2026-05-13
AWS Multi-Factor Authentication Disabled	AWS CloudTrail DeleteVirtualMFADevice, AWS CloudTrail DeactivateMFADevice	T1556.006 T1586.003 T1621	TTP	Scattered Lapsus$ Hunters, AWS Identity and Access Management Account Takeover	2026-05-13
Kubernetes Suspicious Image Pulling	Kubernetes Audit	T1526	Anomaly	Kubernetes Security	2026-05-13
Azure AD Tenant Wide Admin Consent Granted	Azure Active Directory Consent to application	T1098.003	TTP	Azure Active Directory Persistence, NOBELIUM Group	2026-05-13
O365 PST export alert	O365	T1114	TTP	Data Exfiltration, Office 365 Collection Techniques	2026-05-13
O365 Tenant Wide Admin Consent Granted	O365 Consent to application.	T1098.003	TTP	Office 365 Persistence Mechanisms, NOBELIUM Group	2026-05-13
Azure Active Directory High Risk Sign-in	Azure Active Directory	T1110.003 T1586.003	TTP	Azure Active Directory Account Takeover	2026-05-13
Kubernetes AWS detect suspicious kubectl calls	Kubernetes Audit	N/A	Anomaly	Kubernetes Security	2026-05-13
GitHub Organizations Delete Branch Ruleset	GitHub Organizations Audit Logs	T1195 T1685	Anomaly	GitHub Malicious Activity, NPM Supply Chain Compromise	2026-05-13
O365 Security And Compliance Alert Triggered		T1078.004	TTP	Office 365 Account Takeover	2026-05-13
O365 Bypass MFA via Trusted IP	O365 Set Company Information.	T1686.001	TTP	Office 365 Persistence Mechanisms	2026-05-13
AWS ECR Container Upload Outside Business Hours	AWS CloudTrail PutImage	T1204.003	Anomaly	Dev Sec Ops	2026-05-13
Azure AD PIM Role Assignment Activated	Azure Active Directory	T1098.003	TTP	Azure Active Directory Persistence, Scattered Lapsus$ Hunters, Azure Active Directory Privilege Escalation	2026-05-13
GitHub Organizations Disable 2FA Requirement	GitHub Organizations Audit Logs	T1195 T1685	Anomaly	GitHub Malicious Activity	2026-05-13
ASL AWS Credential Access RDS Password reset	ASL AWS CloudTrail	T1110 T1586.003	TTP	Scattered Lapsus$ Hunters, AWS Identity and Access Management Account Takeover	2026-05-13
Detect New Open S3 Buckets over AWS CLI	AWS CloudTrail	T1530	TTP	Suspicious AWS S3 Activities	2026-05-13
O365 Compliance Content Search Exported		T1114.002	TTP	Office 365 Collection Techniques	2026-05-13
O365 SharePoint Suspicious Search Behavior	Office 365 Universal Audit Log	T1213.002 T1552	Anomaly	Office 365 Account Takeover, Compromised User Account, CISA AA22-320A, Office 365 Collection Techniques	2026-05-13
AWS New MFA Method Registered For User	AWS CloudTrail CreateVirtualMFADevice	T1556.006	TTP	AWS Identity and Access Management Account Takeover	2026-05-13
O365 Elevated Mailbox Permission Assigned	O365 Add-MailboxPermission	T1098.002	TTP	Office 365 Collection Techniques	2026-05-13
Azure AD User Enabled And Password Reset	Azure Active Directory Reset password (by admin), Azure Active Directory Update user, Azure Active Directory Enable account	T1098	TTP	Azure Active Directory Persistence, Scattered Lapsus$ Hunters	2026-05-13
GCP Kubernetes cluster pod scan detection		T1526	Hunting	Kubernetes Scanning Activity, Scattered Lapsus$ Hunters	2026-05-13
ASL AWS Detect Users creating keys with encrypt policy without MFA	ASL AWS CloudTrail	T1486	TTP	Ransomware Cloud	2026-05-13
GitHub Organizations Disable Classic Branch Protection Rule	GitHub Organizations Audit Logs	T1195 T1685	Anomaly	GitHub Malicious Activity	2026-05-13
ASL AWS IAM AccessDenied Discovery Events	ASL AWS CloudTrail	T1580	Anomaly	Suspicious Cloud User Activities	2026-05-13
ASL AWS Multi-Factor Authentication Disabled	ASL AWS CloudTrail	T1556.006 T1586.003 T1621	TTP	AWS Identity and Access Management Account Takeover	2026-05-13
GitHub Organizations Repository Deleted	GitHub Organizations Audit Logs	T1195 T1485	Anomaly	GitHub Malicious Activity, NPM Supply Chain Compromise	2026-05-13
Azure AD Service Principal Enumeration	Azure Active Directory MicrosoftGraphActivityLogs	T1087.004 T1526	TTP	Compromised User Account, Azure Active Directory Privilege Escalation	2026-05-13
ASL AWS Network Access Control List Deleted	ASL AWS CloudTrail	T1686.001	Anomaly	AWS Network ACL Activity, Scattered Lapsus$ Hunters	2026-05-13
Detect Spike in AWS Security Hub Alerts for User	AWS Security Hub	N/A	Anomaly	AWS Security Hub Alerts, Critical Alerts	2026-05-13
Azure AD New Federated Domain Added	Azure Active Directory Set domain authentication	T1484.002	TTP	Azure Active Directory Persistence, Hellcat Ransomware, Storm-0501 Ransomware, Scattered Lapsus$ Hunters	2026-05-13
AWS IAM Assume Role Policy Brute Force	AWS CloudTrail	T1110 T1580	TTP	AWS IAM Privilege Escalation	2026-05-13
O365 Multiple Service Principals Created by SP	O365 Add service principal.	T1136.003	Anomaly	Office 365 Persistence Mechanisms, NOBELIUM Group	2026-05-13
ASL AWS IAM Successful Group Deletion	ASL AWS CloudTrail	T1069.003 T1098	Hunting	AWS IAM Privilege Escalation	2026-05-13
AWS Defense Evasion Delete CloudWatch Log Group	AWS CloudTrail DeleteLogGroup	T1685.002	TTP	AWS Defense Evasion	2026-05-13
AWS IAM Delete Policy	AWS CloudTrail DeletePolicy	T1098	Hunting	AWS IAM Privilege Escalation	2026-05-13
O365 New Federated Domain Added	O365	T1136.003	TTP	Cloud Federated Credential Abuse, Office 365 Persistence Mechanisms	2026-05-13
Azure AD New MFA Method Registered	Azure Active Directory Update user	T1098.005	TTP	Azure Active Directory Persistence, Scattered Lapsus$ Hunters	2026-05-13
Kubernetes Abuse of Secret by Unusual User Agent	Kubernetes Audit	T1552.007	Anomaly	Kubernetes Security	2026-05-13
GitHub Enterprise Register Self Hosted Runner	GitHub Enterprise Audit Logs	T1195 T1685	Anomaly	GitHub Malicious Activity, NPM Supply Chain Compromise	2026-05-13
O365 Threat Intelligence Suspicious Email Delivered	Office 365 Universal Audit Log	T1566.001 T1566.002	Anomaly	Suspicious Emails, Spearphishing Attachments	2026-05-13
O365 Multi-Source Failed Authentications Spike	O365 UserLoginFailed	T1110.003 T1110.004 T1586.003	Hunting	Office 365 Account Takeover, NOBELIUM Group	2026-05-13
AWS Bedrock Delete Model Invocation Logging Configuration	AWS CloudTrail DeleteModelInvocationLoggingConfiguration	T1685.002	TTP	AWS Bedrock Security	2026-05-13
AWS Exfiltration via Anomalous GetObject API Activity	AWS CloudTrail GetObject	T1119	Anomaly	Data Exfiltration	2026-05-13
Kubernetes newly seen TCP edge		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
Microsoft Intune Manual Device Management	Azure Monitor Activity	T1021.007 T1072 T1529	Hunting	Azure Active Directory Account Takeover	2026-05-13
O365 Excessive Authentication Failures Alert		T1110	Anomaly	Office 365 Account Takeover	2026-05-13
Gdrive suspicious file sharing		T1566	Hunting	Scattered Lapsus$ Hunters, Spearphishing Attachments, Data Exfiltration	2026-05-13
AWS Bedrock Delete Knowledge Base	AWS CloudTrail DeleteKnowledgeBase	T1485	TTP	AWS Bedrock Security	2026-05-13
O365 High Privilege Role Granted	O365 Add member to role.	T1098.003	TTP	Office 365 Persistence Mechanisms	2026-05-13
AWS Password Policy Changes	AWS CloudTrail UpdateAccountPasswordPolicy, AWS CloudTrail DeleteAccountPasswordPolicy, AWS CloudTrail GetAccountPasswordPolicy	T1201	Hunting	AWS IAM Privilege Escalation, Compromised User Account	2026-05-13
O365 Application Available To Other Tenants	Office 365 Universal Audit Log	T1098.003	TTP	Azure Active Directory Persistence, Azure Active Directory Account Takeover, Data Exfiltration	2026-05-13
GitHub Enterprise Disable Classic Branch Protection Rule	GitHub Enterprise Audit Logs	T1195 T1685	Anomaly	GitHub Malicious Activity	2026-05-13
GitHub Enterprise Disable Audit Log Event Stream	GitHub Enterprise Audit Logs	T1195 T1685.002	Anomaly	GitHub Malicious Activity, NPM Supply Chain Compromise	2026-05-13
AWS SAML Update identity provider	AWS CloudTrail UpdateSAMLProvider	T1078	TTP	Cloud Federated Credential Abuse	2026-05-13
O365 Email Send and Hard Delete Suspicious Behavior	Office 365 Universal Audit Log	T1070.008 T1114.001 T1485	Anomaly	Office 365 Account Takeover, Suspicious Emails, Data Destruction, Office 365 Collection Techniques	2026-05-13
AWS Credential Access RDS Password reset	AWS CloudTrail ModifyDBInstance	T1110 T1586.003	TTP	Scattered Lapsus$ Hunters, AWS Identity and Access Management Account Takeover	2026-05-13
GCP Multiple Failed MFA Requests For User	Google Workspace	T1078.004 T1586.003 T1621	TTP	GCP Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
ASL AWS SAML Update identity provider	ASL AWS CloudTrail	T1078	TTP	Cloud Federated Credential Abuse	2026-05-13
Azure AD FullAccessAsApp Permission Assigned	Azure Active Directory Update application	T1098.002 T1098.003	TTP	Azure Active Directory Persistence, NOBELIUM Group	2026-05-13
AWS Excessive Security Scanning	AWS CloudTrail	T1526	TTP	AWS User Monitoring	2026-05-13
Azure AD New Custom Domain Added	Azure Active Directory Add unverified domain	T1484.002	TTP	Azure Active Directory Persistence	2026-05-13
O365 New Forwarding Mailflow Rule Created		T1114	TTP	Office 365 Collection Techniques	2026-05-13
O365 Email Reported By User Found Malicious	Office 365 Universal Audit Log	T1566.001 T1566.002	TTP	Suspicious Emails, Spearphishing Attachments	2026-05-13
ASL AWS New MFA Method Registered For User	ASL AWS CloudTrail	T1556.006	TTP	AWS Identity and Access Management Account Takeover	2026-05-13
Azure AD Device Code Authentication	Azure Active Directory	T1528 T1566.002	TTP	Azure Active Directory Account Takeover	2026-05-13
Kubernetes Pod With Host Network Attachment	Kubernetes Audit	T1204	Anomaly	Kubernetes Security	2026-05-13
AWS Credential Access Failed Login	AWS CloudTrail ConsoleLogin	T1110.001 T1586.003	TTP	AWS Identity and Access Management Account Takeover	2026-05-13
AWS Successful Console Authentication From Multiple IPs	AWS CloudTrail ConsoleLogin	T1535 T1586	Anomaly	Suspicious AWS Login Activities, Compromised User Account	2026-05-13
GCP Unusual Number of Failed Authentications From Ip	Google Workspace	T1110.003 T1110.004 T1586.003	Anomaly	GCP Account Takeover	2026-05-13
GitHub Enterprise Disable Dependabot	GitHub Enterprise Audit Logs	T1195 T1685	Anomaly	GitHub Malicious Activity	2026-05-13
O365 New MFA Method Registered	O365 Update user.	T1098.005	TTP	Office 365 Persistence Mechanisms	2026-05-13
O365 External Guest User Invited	Office 365 Universal Audit Log	T1136.003	TTP	Azure Active Directory Persistence	2026-05-13
ASL AWS IAM Assume Role Policy Brute Force	ASL AWS CloudTrail	T1110 T1580	TTP	AWS IAM Privilege Escalation, Scattered Lapsus$ Hunters	2026-05-13
AWS High Number Of Failed Authentications From Ip	AWS CloudTrail ConsoleLogin	T1110.003 T1110.004	Anomaly	Compromised User Account, AWS Identity and Access Management Account Takeover	2026-05-13
Kubernetes Previously Unseen Container Image Name		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
Detect New Open GCP Storage Buckets		T1530	TTP	Suspicious GCP Storage Activities	2026-05-13
ASL AWS Network Access Control List Created with All Open Ports	ASL AWS CloudTrail	T1686.001	TTP	AWS Network ACL Activity	2026-05-13
Detect GCP Storage access from a new IP		T1530	Anomaly	Suspicious GCP Storage Activities	2026-05-13
O365 ZAP Activity Detection	Office 365 Universal Audit Log	T1566.001 T1566.002	Anomaly	Suspicious Emails, Spearphishing Attachments	2026-05-13
Azure AD Multiple Denied MFA Requests For User	Azure Active Directory Sign-in activity	T1621	TTP	Azure Active Directory Account Takeover	2026-05-13
ASL AWS IAM Delete Policy	ASL AWS CloudTrail	T1098	Hunting	AWS IAM Privilege Escalation	2026-05-13
GCP Successful Single-Factor Authentication	Google Workspace	T1078.004 T1586.003	TTP	GCP Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
Geographic Improbable Location	Okta	T1078	Anomaly	Remote Employment Fraud	2026-05-13
ASL AWS Defense Evasion Delete Cloudtrail	ASL AWS CloudTrail	T1685.002	TTP	AWS Defense Evasion	2026-05-13
GCP Multiple Users Failing To Authenticate From Ip	Google Workspace	T1110.003 T1110.004 T1586.003	Anomaly	GCP Account Takeover	2026-05-13
AWS SetDefaultPolicyVersion	AWS CloudTrail SetDefaultPolicyVersion	T1078.004	TTP	AWS IAM Privilege Escalation	2026-05-13
ASL AWS Defense Evasion PutBucketLifecycle	ASL AWS CloudTrail	T1485.001 T1685.002	Hunting	AWS Defense Evasion	2026-05-13
Azure AD Successful Single-Factor Authentication	Azure Active Directory	T1078.004 T1586.003	TTP	Azure Active Directory Account Takeover	2026-05-13
Kubernetes Create or Update Privileged Pod	Kubernetes Audit	T1204	Anomaly	Kubernetes Security	2026-05-13
O365 Privileged Graph API Permission Assigned	O365 Update application.	T1003.002	TTP	Office 365 Persistence Mechanisms, NOBELIUM Group	2026-05-13
AWS Detect Users with KMS keys performing encryption S3	AWS CloudTrail	T1486	Anomaly	Ransomware Cloud	2026-05-13
O365 New Email Forwarding Rule Created		T1114.003	TTP	Office 365 Collection Techniques	2026-05-13
Azure AD Multiple Service Principals Created by User	Azure Active Directory Add service principal	T1136.003	Anomaly	Azure Active Directory Persistence, NOBELIUM Group	2026-05-13
O365 Admin Consent Bypassed by Service Principal	O365 Add app role assignment to service principal.	T1098.003	TTP	Office 365 Persistence Mechanisms	2026-05-13
Kubernetes Abuse of Secret by Unusual Location	Kubernetes Audit	T1552.007	Anomaly	Kubernetes Security	2026-05-13
O365 Mailbox Folder Read Permission Assigned	O365 ModifyFolderPermissions	T1098.002	TTP	Office 365 Collection Techniques	2026-05-13
Kubernetes Scanner Image Pulling		T1526	TTP	Dev Sec Ops	2026-05-13
AWS Successful Single-Factor Authentication	AWS CloudTrail ConsoleLogin	T1078.004 T1586.003	TTP	AWS Identity and Access Management Account Takeover	2026-05-13
Kubernetes Node Port Creation	Kubernetes Audit	T1204	Anomaly	Kubernetes Security	2026-05-13
O365 Multiple Failed MFA Requests For User	O365 UserLoginFailed	T1621	TTP	Office 365 Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
Gsuite Email Suspicious Subject With Attachment	G Suite Gmail	T1566.001	Anomaly	Dev Sec Ops	2026-05-13
Microsoft Intune Bulk Wipe	Azure Monitor Activity	T1561.001	TTP	Azure Active Directory Account Takeover	2026-05-13
GitHub Enterprise Modify Audit Log Event Stream	GitHub Enterprise Audit Logs	T1195 T1685.002	Anomaly	GitHub Malicious Activity, NPM Supply Chain Compromise	2026-05-13
GCP Detect gcploit framework		T1078	TTP	GCP Cross Account Activity	2026-05-13
O365 Service Principal New Client Credentials	O365	T1098.001	TTP	Office 365 Persistence Mechanisms, NOBELIUM Group	2026-05-13
Kubernetes Abuse of Secret by Unusual User Name	Kubernetes Audit	T1552.007	Anomaly	Kubernetes Security	2026-05-13
O365 New Email Forwarding Rule Enabled		T1114.003	TTP	Office 365 Collection Techniques	2026-05-13
Azure AD Global Administrator Role Assigned	Azure Active Directory Add member to role	T1098.003	TTP	Azure Active Directory Persistence, Scattered Lapsus$ Hunters, Azure Active Directory Privilege Escalation	2026-05-13
O365 Mailbox Folder Read Permission Granted	O365 ModifyFolderPermissions	T1098.002	TTP	Office 365 Collection Techniques	2026-05-13
Azure AD Unusual Number of Failed Authentications From Ip	Azure Active Directory	T1110.003 T1110.004 T1586.003	Anomaly	Azure Active Directory Account Takeover	2026-05-13
Azure AD Multiple Failed MFA Requests For User	Azure Active Directory Sign-in activity	T1078.004 T1586.003 T1621	TTP	Azure Active Directory Account Takeover	2026-05-13
AWS Bedrock Delete GuardRails	AWS CloudTrail DeleteGuardrail	T1685.002	TTP	AWS Bedrock Security	2026-05-13
Azure AD PIM Role Assigned	Azure Active Directory	T1098.003	TTP	Azure Active Directory Persistence, Scattered Lapsus$ Hunters, Azure Active Directory Privilege Escalation	2026-05-13
AWS Multiple Failed MFA Requests For User	AWS CloudTrail ConsoleLogin	T1586.003 T1621	Anomaly	AWS Identity and Access Management Account Takeover	2026-05-13
AWS ECR Container Scanning Findings High	AWS CloudTrail DescribeImageScanFindings	T1204.003	TTP	Dev Sec Ops	2026-05-13
Azure AD Service Principal New Client Credentials	Azure Active Directory	T1098.001	TTP	Azure Active Directory Persistence, NOBELIUM Group, Scattered Lapsus$ Hunters, Azure Active Directory Privilege Escalation	2026-05-13
O365 OAuth App Mailbox Access via Graph API	O365 MailItemsAccessed	T1114.002	TTP	NOBELIUM Group, Office 365 Collection Techniques	2026-05-13
O365 Block User Consent For Risky Apps Disabled	O365 Update authorization policy.	T1685	TTP	Office 365 Account Takeover	2026-05-13
Azure Automation Runbook Created	Azure Audit Create or Update an Azure Automation Runbook	T1136.003	TTP	Azure Active Directory Persistence	2026-05-13
O365 Email Transport Rule Changed	Office 365 Universal Audit Log	T1114.003 T1564.008	Anomaly	Office 365 Account Takeover, Data Exfiltration	2026-05-13
AWS Bedrock Invoke Model Access Denied	AWS CloudTrail	T1078 T1550	TTP	AWS Bedrock Security	2026-05-13
O365 Multiple AppIDs and UserAgents Authentication Spike	O365 UserLoggedIn, O365 UserLoginFailed	T1078	Anomaly	Office 365 Account Takeover	2026-05-13
GitHub Enterprise Pause Audit Log Event Stream	GitHub Enterprise Audit Logs	T1195 T1685.002	Anomaly	GitHub Malicious Activity, NPM Supply Chain Compromise	2026-05-13
AWS High Number Of Failed Authentications For User	AWS CloudTrail ConsoleLogin	T1201	Anomaly	Compromised User Account, AWS Identity and Access Management Account Takeover	2026-05-13
Amazon EKS Kubernetes Pod scan detection		T1526	Hunting	Kubernetes Scanning Activity	2026-05-13
AWS Console Login Failed During MFA Challenge	AWS CloudTrail ConsoleLogin	T1586.003 T1621	TTP	Compromised User Account, AWS Identity and Access Management Account Takeover	2026-05-13
AWS Defense Evasion Impair Security Services	AWS CloudTrail DeleteAlarms, AWS CloudTrail DeleteDetector, AWS CloudTrail DeleteRuleGroup, AWS CloudTrail DeleteLoggingConfiguration, AWS CloudTrail DeleteWebACL, AWS CloudTrail DeleteLogStream, AWS CloudTrail DeleteIPSet, AWS CloudTrail DeleteRule	T1685.002	TTP	AWS Defense Evasion	2026-05-13
ASL AWS Concurrent Sessions From Different Ips	ASL AWS CloudTrail	T1185	Anomaly	Compromised User Account, Scattered Lapsus$ Hunters, AWS Identity and Access Management Account Takeover	2026-05-13
High Number of Login Failures from a single source	O365 UserLoginFailed	T1110.001	Anomaly	Office 365 Account Takeover	2026-05-13
Microsoft Intune DeviceManagementConfigurationPolicies	Azure Monitor Activity	T1021.007 T1072 T1484 T1685 T1686	Hunting	Azure Active Directory Account Takeover	2026-05-13
Azure AD Block User Consent For Risky Apps Disabled	Azure Active Directory Update authorization policy	T1685	TTP	Azure Active Directory Account Takeover	2026-05-13
O365 Multiple OS Vendors Authenticating From User	Office 365 Universal Audit Log	T1110	TTP	Office 365 Account Takeover	2026-05-13
ASL AWS ECR Container Upload Unknown User	ASL AWS CloudTrail	T1204.003	Anomaly	Dev Sec Ops	2026-05-13
O365 High Number Of Failed Authentications for User	O365 UserLoginFailed	T1110.001	TTP	Office 365 Account Takeover	2026-05-13
O365 Added Service Principal	O365	T1136.003	TTP	Cloud Federated Credential Abuse, Office 365 Persistence Mechanisms, NOBELIUM Group	2026-05-13
Kubernetes Cron Job Creation	Kubernetes Audit	T1053.007	Anomaly	Kubernetes Security	2026-05-13
Kubernetes Access Scanning	Kubernetes Audit	T1046	Anomaly	Kubernetes Security	2026-05-13
Detect New Open S3 buckets	AWS CloudTrail	T1530	TTP	Suspicious AWS S3 Activities	2026-05-13
Linux Auditd Private Keys and Certificate Enumeration	Linux Auditd Execve	T1552.004	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Linux Auditd Sysmon Service Stop	Linux Auditd Service Stop	T1489	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
MacOS LOLbin	Osquery Results	T1059.004	TTP	Living Off The Land, Hellcat Ransomware, Axios Supply Chain Post Compromise	2026-05-13
Windows MMC Loaded Script Engine DLL	Sysmon EventID 7	T1620	Anomaly	XML Runner Loader	2026-05-13
Linux Auditd File Permissions Modification Via Chattr	Linux Auditd Execve	T1222.002	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Windows Service Create SliverC2	Windows Event Log System 7045	T1569.002	TTP	Compromised Windows Host, BishopFox Sliver Adversary Emulation Framework, Hellcat Ransomware	2026-05-13
Linux Auditd Base64 Decode Files	Linux Auditd Execve	T1140	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
PetitPotam Network Share Access Request	Windows Event Log Security 5145	T1187	TTP	PetitPotam NTLM Relay on Active Directory Certificate Services	2026-05-13
Windows ConsoleHost History File Deletion	Sysmon EventID 26, Sysmon EventID 23	T1070.003	Anomaly	Medusa Ransomware	2026-05-13
Windows Hijack Execution Flow Version Dll Side Load	Sysmon EventID 7	T1574.001	Anomaly	XWorm, Malicious Inno Setup Loader, Brute Ratel C4, SolarWinds WHD RCE Post Exploitation	2026-05-13
Windows RDP File Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.001 T1598.002	TTP	Windows RDP Artifacts and Defense Evasion, Spearphishing Attachments, Interlock Ransomware	2026-05-13
Schedule Task with Rundll32 Command Trigger	Windows Event Log Security 4698	T1053	TTP	Living Off The Land, Castle RAT, IcedID, Scheduled Tasks, Windows Persistence Techniques, Trickbot, Compromised Windows Host	2026-05-13
Elevated Group Discovery with PowerView	Powershell Script Block Logging 4104	T1069.002	Hunting	Active Directory Discovery	2026-05-13
Windows Steal Authentication Certificates - ESC1 Authentication	Windows Event Log Security 4887, Windows Event Log Security 4768	T1550 T1649	TTP	Windows Certificate Services, Compromised Windows Host	2026-05-13
Windows Developer-Signed MSIX Package Installation	Windows Event Log AppXDeployment-Server 855	T1204.002 T1553.005	Anomaly	MSIX Package Abuse	2026-05-13
Windows Application Layer Protocol RMS Radmin Tool Namedpipe	Sysmon EventID 18, Sysmon EventID 17	T1071	TTP	Azorult	2026-05-13
Windows Unusual NTLM Authentication Users By Source	NTLM Operational 8006, NTLM Operational 8005, NTLM Operational 8004	T1110.003	Anomaly	Active Directory Password Spraying	2026-05-13
MSI Module Loaded by Non-System Binary	Sysmon EventID 7	T1574.001	Hunting	Hermetic Wiper, Data Destruction, Windows Privilege Escalation	2026-05-13
Modification Of Wallpaper	Sysmon EventID 13	T1491	TTP	LockBit Ransomware, ZOVWiper, Ransomware, Rhysida Ransomware, Windows Registry Abuse, BlackMatter Ransomware, Brute Ratel C4, Black Basta Ransomware, Revil Ransomware	2026-05-13
Windows Multiple Invalid Users Failed To Authenticate Using NTLM	Windows Event Log Security 4776	T1110.003	TTP	Volt Typhoon, Active Directory Password Spraying	2026-05-13
Detect Regasm with Network Connection	Sysmon EventID 3	T1218.009	TTP	Handala Wiper, Suspicious Regsvcs Regasm Activity, Living Off The Land, Void Manticore, Hellcat Ransomware	2026-05-13
Windows Query Registry Browser List Application	Windows Event Log Security 4663	T1012	Anomaly	RedLine Stealer, SnappyBee, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Detect Regsvcs with Network Connection	Sysmon EventID 3	T1218.009	TTP	Suspicious Regsvcs Regasm Activity, Living Off The Land, Hellcat Ransomware	2026-05-13
Windows Security And Backup Services Stop	Windows Event Log System 7036	T1490	TTP	LockBit Ransomware, Ransomware, Hellcat Ransomware, BlackMatter Ransomware, Scattered Lapsus$ Hunters, Compromised Windows Host, Termite Ransomware	2026-05-13
Linux Auditd Nopasswd Entry In Sudoers File	Linux Auditd Proctitle	T1548.003	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Detect Computer Changed with Anonymous Account	Windows Event Log Security 4742	T1210	Hunting	Detect Zerologon Attack	2026-05-13
Kerberos Pre-Authentication Flag Disabled in UserAccountControl	Windows Event Log Security 4738	T1558.004	TTP	BlackSuit Ransomware, Active Directory Kerberos Attacks	2026-05-13
High Process Termination Frequency	Sysmon EventID 5	T1486	Anomaly	LockBit Ransomware, Interlock Ransomware, BlackByte Ransomware, Medusa Ransomware, Rhysida Ransomware, Clop Ransomware, NailaoLocker Ransomware, Hellcat Ransomware, Snake Keylogger, Crypto Stealer, Termite Ransomware	2026-05-13
Windows PowerShell Script TabExpansion Direct Call	Powershell Script Block Logging 4104	T1059.001 T1129	Anomaly	Malicious PowerShell	2026-05-13
Get-DomainTrust with PowerShell Script Block	Powershell Script Block Logging 4104	T1482	TTP	Active Directory Discovery	2026-05-13
Windows AD Short Lived Domain Account ServicePrincipalName	Windows Event Log Security 5136	T1098	TTP	Sneaky Active Directory Persistence Tricks, Interlock Ransomware	2026-05-13
Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos	Windows Event Log Security 4768	T1110.003	Anomaly	Active Directory Kerberos Attacks, Volt Typhoon, Active Directory Password Spraying	2026-05-13
Windows Unusual Count Of Users Failed To Authenticate From Process	Windows Event Log Security 4625	T1110.003	Anomaly	Insider Threat, Volt Typhoon, Active Directory Password Spraying	2026-05-13
Cisco Isovalent - Late Process Execution	Cisco Isovalent Process Exec	T1543	Anomaly	Cisco Isovalent Suspicious Activity	2026-05-13
Windows Enable PowerShell Web Access	Powershell Script Block Logging 4104	T1059.001	TTP	Malicious PowerShell, CISA AA24-241A	2026-05-13
Windows AD Same Domain SID History Addition	Windows Event Log Security 4742, Windows Event Log Security 4738	T1134.005	TTP	Sneaky Active Directory Persistence Tricks, Compromised Windows Host, Windows Persistence Techniques	2026-05-13
Windows NetSupport RMM DLL Loaded By Uncommon Process	Sysmon EventID 7	T1036	Anomaly	NetSupport RMM Tool Abuse	2026-05-13
Linux Auditd Osquery Service Stop	Linux Auditd Service Stop	T1489	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Windows AD GPO Disabled	Windows Event Log Security 5136	T1484.001 T1685	TTP	Sneaky Active Directory Persistence Tricks	2026-05-13
Windows Anonymous Pipe Activity	Sysmon EventID 18, Sysmon EventID 17	T1559	Hunting	Interlock Rat, China-Nexus Threat Activity, Salt Typhoon, SnappyBee, Castle RAT	2026-05-13
Windows Administrative Shares Accessed On Multiple Hosts	Windows Event Log Security 5140, Windows Event Log Security 5145	T1135	TTP	Active Directory Lateral Movement, Active Directory Privilege Escalation	2026-05-13
Windows Suspicious QEMU Execution	Sysmon EventID 1	T1001 T1036 T1204.002 T1564.006	TTP	Compromised Linux Host, VoidLink Cloud-Native Linux Malware, Linux Privilege Escalation, Linux Post-Exploitation, Linux Living Off The Land, Linux Rootkit	2026-05-13
Windows Account Discovery for None Disable User Account	Powershell Script Block Logging 4104	T1087.001	Hunting	CISA AA23-347A	2026-05-13
Windows Executable Masquerading as Benign File Types	Sysmon EventID 29	T1036.008	Anomaly	NetSupport RMM Tool Abuse	2026-05-13
Powershell Enable SMB1Protocol Feature	Powershell Script Block Logging 4104	T1027.005	TTP	Malicious PowerShell, Data Destruction, Hermetic Wiper, Ransomware	2026-05-13
Drop IcedID License dat	Sysmon EventID 11	T1204.002	Hunting	IcedID	2026-05-13
Crowdstrike Admin With Duplicate Password		T1110	TTP	Compromised Windows Host	2026-05-13
Windows Suspicious Driver Loaded Path	Sysmon EventID 6	T1543.003	TTP	XMRig, Interlock Ransomware, BlackByte Ransomware, AgentTesla, Snake Keylogger, APT37 Rustonotto and FadeStealer, CISA AA22-320A	2026-05-13
Powershell Fileless Process Injection via GetProcAddress	Powershell Script Block Logging 4104	T1055 T1059.001	TTP	Malicious PowerShell, Hermetic Wiper, Hellcat Ransomware, Data Destruction	2026-05-13
Crowdstrike Admin Weak Password Policy		T1110	TTP	Compromised Windows Host	2026-05-13
Detect Baron Samedit CVE-2021-3156 Segfault		T1068	TTP	Baron Samedit CVE-2021-3156	2026-05-13
Linux Auditd Setuid Using Setcap Utility	Linux Auditd Execve	T1548.001	TTP	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Unloading AMSI via Reflection	Powershell Script Block Logging 4104	T1059.001 T1685	TTP	Malicious PowerShell, Hermetic Wiper, Data Destruction	2026-05-13
Windows PowerShell Invoke-RestMethod IP Information Collection	Powershell Script Block Logging 4104	T1016 T1059.001 T1082	Anomaly	Water Gamayun	2026-05-13
Wermgr Process Create Executable File	Sysmon EventID 11	T1027	TTP	Trickbot	2026-05-13
Windows Unusual NTLM Authentication Users By Destination	NTLM Operational 8006, NTLM Operational 8005, NTLM Operational 8004	T1110.003	Anomaly	Active Directory Password Spraying	2026-05-13
Cisco Isovalent - Shell Execution	Cisco Isovalent Process Exec	T1543	Anomaly	Cisco Isovalent Suspicious Activity	2026-05-13
Windows Admon Default Group Policy Object Modified	Windows Active Directory Admon	T1484.001	TTP	Sneaky Active Directory Persistence Tricks, Active Directory Privilege Escalation	2026-05-13
Linux Auditd Find Ssh Private Keys	Linux Auditd Execve	T1552.004	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Hellcat Ransomware, Linux Living Off The Land	2026-05-13
Windows AD Domain Controller Promotion	Windows Event Log Security 4742	T1207	TTP	Sneaky Active Directory Persistence Tricks, Compromised Windows Host	2026-05-13
Windows Find Domain Organizational Units with GetDomainOU	Powershell Script Block Logging 4104	T1087.002	TTP	Active Directory Discovery	2026-05-13
Windows Gather Victim Host Information Camera	Powershell Script Block Logging 4104	T1592.001	Anomaly	DarkCrystal RAT	2026-05-13
Windows Bluetooth Service Installed From Uncommon Location	Windows Event Log System 7045	T1036 T1543.003	Anomaly	Lotus Blossom Chrysalis Backdoor	2026-05-13
Windows SharePoint Spinstall0 Webshell File Creation	Sysmon EventID 11	T1190 T1505.003	TTP	Microsoft SharePoint Vulnerabilities	2026-05-13
Linux Auditd Setuid Using Chmod Utility	Linux Auditd Proctitle	T1548.001	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Linux Auditd Virtual Disk File And Directory Discovery	Linux Auditd Execve	T1083	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Windows AppLocker Rare Application Launch Detection		T1218	Hunting	Windows AppLocker	2026-05-13
Linux Auditd Doas Conf File Creation	Linux Auditd Path, Linux Auditd Cwd	T1548.003	TTP	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
MacOS AMOS Stealer - Virtual Machine Check Activity	Osquery Results	T1059.002	Anomaly	AMOS Stealer, Hellcat Ransomware	2026-05-13
Remote Process Instantiation via DCOM and PowerShell Script Block	Powershell Script Block Logging 4104	T1021.003	TTP	Active Directory Lateral Movement	2026-05-13
Windows Steal Authentication Certificates Certificate Issued	Windows Event Log Security 4887	T1649	Anomaly	Windows Certificate Services	2026-05-13
Windows Scheduled Task DLL Module Loaded	Sysmon EventID 7	T1053	TTP	ValleyRAT	2026-05-13
WinEvent Scheduled Task Created to Spawn Shell	Windows Event Log Security 4698	T1053.005	TTP	CISA AA22-257A, Winter Vivern, 0bj3ctivity Stealer, SystemBC, Castle RAT, Medusa Ransomware, Ransomware, Windows Persistence Techniques, Scheduled Tasks, China-Nexus Threat Activity, Salt Typhoon, Ryuk Ransomware, Compromised Windows Host, Windows Error Reporting Service Elevation of Privilege Vulnerability	2026-05-13
Windows Excessive Disabled Services Event	Windows Event Log System 7040	T1685	TTP	CISA AA23-347A, Compromised Windows Host, Windows Defense Evasion Tactics	2026-05-13
Windows Devtunnels Image Loaded	Sysmon EventID 7	T1090	Anomaly	Reverse Network Proxy	2026-05-13
Windows Unsigned DLL Side-Loading	Sysmon EventID 7	T1574.001	Anomaly	Derusbi, Warzone RAT, Earth Alux, SolarWinds WHD RCE Post Exploitation, NjRAT, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Windows Computer Account Requesting Kerberos Ticket	Windows Event Log Security 4768	T1558	TTP	Local Privilege Escalation With KrbRelayUp, Active Directory Kerberos Attacks	2026-05-13
Windows Hidden Schedule Task Settings	Windows Event Log Security 4698	T1053	TTP	CISA AA22-257A, Data Destruction, Malicious Inno Setup Loader, Industroyer2, Cactus Ransomware, Scheduled Tasks, Hellcat Ransomware, Compromised Windows Host, Active Directory Discovery	2026-05-13
Windows Service Create RemComSvc	Windows Event Log System 7045	T1543.003	Anomaly	Active Directory Discovery	2026-05-13
Windows SqlWriter SQLDumper DLL Sideload	Sysmon EventID 7	T1574.001	TTP	APT29 Diplomatic Deceptions with WINELOADER	2026-05-13
Windows Downdate Registry Activity	Sysmon EventID 14, Sysmon EventID 13, Sysmon EventID 12	T1112 T1689	Anomaly	Windows Persistence Techniques	2026-05-13
Windows Firewall Rule Deletion	Windows Event Log Security 4948	T1686	Anomaly	NetSupport RMM Tool Abuse, Medusa Ransomware, ShrinkLocker	2026-05-13
Crowdstrike User with Duplicate Password		T1110	Anomaly	Compromised Windows Host	2026-05-13
Detect Empire with PowerShell Script Block Logging	Powershell Script Block Logging 4104	T1059.001	TTP	Malicious PowerShell, Hermetic Wiper, Hellcat Ransomware, Data Destruction	2026-05-13
Detect Mimikatz With PowerShell Script Block Logging	Powershell Script Block Logging 4104	T1003 T1059.001	TTP	Hermetic Wiper, CISA AA22-264A, Data Destruction, CISA AA23-347A, Malicious PowerShell, Hellcat Ransomware, Scattered Spider, CISA AA22-320A, Sandworm Tools	2026-05-13
Crowdstrike Medium Identity Risk Severity		T1110	TTP	Compromised Windows Host	2026-05-13
Windows Unusual Count Of Users Failed To Authenticate Using NTLM	Windows Event Log Security 4776	T1110.003	Anomaly	Volt Typhoon, Active Directory Password Spraying	2026-05-13
Windows Exfiltration Over C2 Via Powershell UploadString	Powershell Script Block Logging 4104	T1041	TTP	Winter Vivern, APT37 Rustonotto and FadeStealer	2026-05-13
Windows Computer Account Created by Computer Account	Windows Event Log Security 4741	T1558	TTP	Local Privilege Escalation With KrbRelayUp, Active Directory Kerberos Attacks	2026-05-13
Windows Processes Killed By Industroyer2 Malware	Sysmon EventID 5	T1489	Anomaly	Industroyer2, Data Destruction	2026-05-13
Microsoft Defender ATP Alerts	MS Defender ATP Alerts	N/A	TTP	Critical Alerts	2026-05-13
Windows AD Cross Domain SID History Addition	Windows Event Log Security 4742, Windows Event Log Security 4738	T1134.005	TTP	Sneaky Active Directory Persistence Tricks, Compromised Windows Host	2026-05-13
Windows RDP Connection Successful	Windows Event Log RemoteConnectionManager 1149	T1563.002	Hunting	Interlock Ransomware, BlackByte Ransomware, Windows RDP Artifacts and Defense Evasion, NetSupport RMM Tool Abuse, Active Directory Lateral Movement	2026-05-13
Windows Unusual Count Of Users Remotely Failed To Auth From Host	Windows Event Log Security 4625	T1110.003	Anomaly	Volt Typhoon, Active Directory Password Spraying	2026-05-13
Detect Certify With PowerShell Script Block Logging	Powershell Script Block Logging 4104	T1059.001 T1649	TTP	Windows Certificate Services, Malicious PowerShell	2026-05-13
Linux Auditd Sudo Or Su Execution	Linux Auditd Proctitle	T1548.003	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Windows Azure PowerShell Module Installation Via PowerShell Script	Powershell Script Block Logging 4104	T1021.007 T1069.003 T1078 T1098 T1136.003	Anomaly	Azure Active Directory Account Takeover, Azure Active Directory Persistence, Azure Active Directory Privilege Escalation	2026-05-13
CMLUA Or CMSTPLUA UAC Bypass	Sysmon EventID 7	T1218.003	TTP	ValleyRAT, LockBit Ransomware, DarkSide Ransomware, Ransomware	2026-05-13
Mailsniper Invoke functions	Powershell Script Block Logging 4104	T1114.001	TTP	Data Exfiltration	2026-05-13
Windows Multiple Accounts Disabled	Windows Event Log Security 4725	T1078 T1098	TTP	Azure Active Directory Persistence	2026-05-13
Linux Auditd Edit Cron Table Parameter	Linux Auditd Syscall	T1053.003	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Scheduled Tasks, Linux Living Off The Land	2026-05-13
Linux Auditd File Permission Modification Via Chmod	Linux Auditd Proctitle	T1222.002	Anomaly	Linux Persistence Techniques, Compromised Linux Host, XorDDos, Linux Privilege Escalation, Axios Supply Chain Post Compromise, China-Nexus Threat Activity, Salt Typhoon, Linux Living Off The Land	2026-05-13
Windows Remote Access Software BRC4 Loaded Dll	Sysmon EventID 7	T1003 T1219	Anomaly	Brute Ratel C4	2026-05-13
Crowdstrike User Weak Password Policy		T1110	Anomaly	Compromised Windows Host	2026-05-13
Linux Auditd Unload Module Via Modprobe	Linux Auditd Execve	T1547.006	TTP	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Windows SQL Server xp_cmdshell Config Change	Windows Event Log Application 15457	T1505.001	TTP	Seashell Blizzard, GhostRedirector IIS Module and Rungan Backdoor, SQL Server Abuse	2026-05-13
Windows SIP WinVerifyTrust Failed Trust Validation	Windows Event Log CAPI2 81	T1553.003	Anomaly	Subvert Trust Controls SIP and Trust Provider Hijacking	2026-05-13
Linux Auditd Unix Shell Configuration Modification	Linux Auditd Path, Linux Auditd Cwd	T1546.004	TTP	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Linux Living Off The Land, QuietVault	2026-05-13
Linux Auditd Kernel Module Enumeration	Linux Auditd Syscall	T1014 T1082	Anomaly	Linux Rootkit, Compromised Linux Host, XorDDos	2026-05-13
Windows Office Product Loading Taskschd DLL	Sysmon EventID 7	T1566.001	Anomaly	Spearphishing Attachments	2026-05-13
Windows Multiple Users Remotely Failed To Authenticate From Host	Windows Event Log Security 4625	T1110.003	TTP	Volt Typhoon, Active Directory Password Spraying	2026-05-13
Linux Auditd Hidden Files And Directories Creation	Linux Auditd Execve	T1083	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Powershell Load Module in Meterpreter	Powershell Script Block Logging 4104	T1059.001	TTP	MetaSploit	2026-05-13
Windows Driver Load Non-Standard Path	Windows Event Log System 7045	T1014 T1068	TTP	BlackByte Ransomware, AgentTesla, Windows Drivers, BlackSuit Ransomware, CISA AA22-320A	2026-05-13
Print Spooler Failed to Load a Plug-in	Windows Event Log Printservice 808, Windows Event Log Printservice 4909	T1547.012	TTP	Black Basta Ransomware, PrintNightmare CVE-2021-34527	2026-05-13
Detect Baron Samedit CVE-2021-3156		T1068	TTP	Baron Samedit CVE-2021-3156	2026-05-13
Windows App Layer Protocol Qakbot NamedPipe	Sysmon EventID 18, Sysmon EventID 17	T1071	Anomaly	Qakbot	2026-05-13
Windows Event For Service Disabled	Windows Event Log System 7040	T1685	Hunting	RedLine Stealer, Windows Defense Evasion Tactics	2026-05-13
Windows AD Replication Request Initiated from Unsanctioned Location	Windows Event Log Security 4624, Windows Event Log Security 4662	T1003.006	TTP	Sneaky Active Directory Persistence Tricks, Credential Dumping, Compromised Windows Host	2026-05-13
GetWmiObject DS User with PowerShell Script Block	Powershell Script Block Logging 4104	T1087.002	TTP	Active Directory Discovery	2026-05-13
Kerberos Pre-Authentication Flag Disabled with PowerShell	Powershell Script Block Logging 4104	T1558.004	TTP	Active Directory Kerberos Attacks	2026-05-13
Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM	Windows Event Log Security 4776	T1110.003	Anomaly	Volt Typhoon, Active Directory Password Spraying	2026-05-13
Windows Unusual Count Of Users Failed To Auth Using Kerberos	Windows Event Log Security 4771	T1110.003	Anomaly	Active Directory Kerberos Attacks, Volt Typhoon, Active Directory Password Spraying	2026-05-13
Windows Multiple Accounts Deleted	Windows Event Log Security 4726	T1078 T1098	TTP	Azure Active Directory Persistence	2026-05-13
Ransomware Notes bulk creation	Sysmon EventID 11	T1486	Anomaly	LockBit Ransomware, Interlock Ransomware, Chaos Ransomware, DarkSide Ransomware, Medusa Ransomware, Cactus Ransomware, Rhysida Ransomware, Clop Ransomware, NailaoLocker Ransomware, Hellcat Ransomware, BlackMatter Ransomware, Black Basta Ransomware, Termite Ransomware	2026-05-13
Windows PowerSploit GPP Discovery	Powershell Script Block Logging 4104	T1552.006	TTP	Active Directory Privilege Escalation	2026-05-13
Windows BitLockerToGo with Network Activity	Sysmon EventID 22	T1218	Hunting	Lumma Stealer, Hellcat Ransomware	2026-05-13
Spoolsv Writing a DLL - Sysmon	Sysmon EventID 11	T1547.012	TTP	Black Basta Ransomware, PrintNightmare CVE-2021-34527	2026-05-13
Linux Auditd Preload Hijack Library Calls	Linux Auditd Execve	T1574.006	TTP	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Windows BitDefender Submission Wizard DLL Sideloading	Sysmon EventID 7	T1574	TTP	Lotus Blossom Chrysalis Backdoor	2026-05-13
Windows MSHTA Writing to World Writable Path	Sysmon EventID 11	T1218.005	TTP	APT29 Diplomatic Deceptions with WINELOADER, XWorm, Suspicious MSHTA Activity	2026-05-13
Windows Identify PowerShell Web Access IIS Pool	Windows Event Log Security 4648	T1190	Hunting	CISA AA24-241A	2026-05-13
Cisco Isovalent - Access To Cloud Metadata Service	Cisco Isovalent Process Connect	T1552.005	Anomaly	VoidLink Cloud-Native Linux Malware, Cisco Isovalent Suspicious Activity	2026-05-13
Cisco Isovalent - Nsenter Usage in Kubernetes Pod	Cisco Isovalent Process Exec	T1543	Anomaly	Cisco Isovalent Suspicious Activity	2026-05-13
Windows Data Destruction Recursive Exec Files Deletion	Sysmon EventID 26, Sysmon EventID 23	T1485	TTP	Data Destruction, Handala Wiper, Void Manticore, Swift Slicer, Disk Wiper	2026-05-13
Cisco Isovalent - Potential Escape to Host	Cisco Isovalent Process Exec	T1611	Anomaly	VoidLink Cloud-Native Linux Malware, Cisco Isovalent Suspicious Activity	2026-05-13
Windows SpeechRuntime COM Hijacking DLL Load	Sysmon EventID 7	T1021.003	TTP	Compromised Windows Host, Active Directory Lateral Movement, Scattered Lapsus$ Hunters	2026-05-13
Remote Process Instantiation via WinRM and PowerShell Script Block	Powershell Script Block Logging 4104	T1021.006	TTP	Active Directory Lateral Movement	2026-05-13
Windows AD Short Lived Server Object	Windows Event Log Security 5137, Windows Event Log Security 5141	T1207	TTP	Sneaky Active Directory Persistence Tricks, Compromised Windows Host	2026-05-13
Windows AppX Deployment Full Trust Package Installation	Windows Event Log AppXDeployment-Server 400	T1204.002 T1553.005	Hunting	MSIX Package Abuse	2026-05-13
Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos	Windows Event Log Security 4768	T1110.003	Anomaly	Active Directory Kerberos Attacks, Volt Typhoon, Active Directory Password Spraying	2026-05-13
Windows Level RMM PowerShell Script Installer	Powershell Script Block Logging 4104	T1219	Anomaly	Remote Monitoring and Management Software	2026-05-13
Interactive Session on Remote Endpoint with PowerShell	Powershell Script Block Logging 4104	T1021.006	TTP	Active Directory Lateral Movement	2026-05-13
MOVEit Empty Key Fingerprint Authentication Attempt		T1190	Hunting	MOVEit Transfer Authentication Bypass, Hellcat Ransomware	2026-05-13
UAC Bypass With Colorui COM Object	Sysmon EventID 7	T1218.003	TTP	LockBit Ransomware, Ransomware	2026-05-13
Cisco Isovalent - Non Allowlisted Image Use	Cisco Isovalent Process Exec	T1204.003	Anomaly	Cisco Isovalent Suspicious Activity	2026-05-13
Windows Admon Group Policy Object Created	Windows Active Directory Admon	T1484.001	TTP	Sneaky Active Directory Persistence Tricks, Active Directory Privilege Escalation	2026-05-13
GetDomainController with PowerShell Script Block	Powershell Script Block Logging 4104	T1018	TTP	Active Directory Discovery	2026-05-13
Windows AD Replication Request Initiated by User Account	Windows Event Log Security 4624, Windows Event Log Security 4662	T1003.006	TTP	Sneaky Active Directory Persistence Tricks, Credential Dumping, Compromised Windows Host	2026-05-13
Get DomainUser with PowerShell Script Block	Powershell Script Block Logging 4104	T1087.002	TTP	CISA AA23-347A, Active Directory Discovery	2026-05-13
Crowdstrike Privilege Escalation For Non-Admin User		T1110	Anomaly	Compromised Windows Host	2026-05-13
Windows AD Suspicious Attribute Modification	Windows Event Log Security 5136	T1222.001 T1550	TTP	Sneaky Active Directory Persistence Tricks	2026-05-13
Linux Auditd Service Started	Linux Auditd Proctitle	T1569.002	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Linux Auditd Install Kernel Module Using Modprobe Utility	Linux Auditd Syscall	T1547.006	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, China-Nexus Threat Activity, Linux Rootkit	2026-05-13
Windows AD Short Lived Domain Controller SPN Attribute	Windows Event Log Security 5136, Windows Event Log Security 4624	T1207	TTP	Sneaky Active Directory Persistence Tricks, Compromised Windows Host	2026-05-13
Windows High File Deletion Frequency	Sysmon EventID 26, Sysmon EventID 23	T1485	Anomaly	ZOVWiper, Interlock Ransomware, Data Destruction, Handala Wiper, DynoWiper, Void Manticore, Medusa Ransomware, NailaoLocker Ransomware, Swift Slicer, Clop Ransomware, APT37 Rustonotto and FadeStealer, DarkCrystal RAT, WhisperGate, Black Basta Ransomware, Sandworm Tools	2026-05-13
PaperCut NG Suspicious Behavior Debug Log		T1133 T1190	Hunting	PaperCut MF NG Vulnerability	2026-05-13
Windows DnsAdmins New Member Added	Windows Event Log Security 4732	T1098	TTP	Active Directory Privilege Escalation	2026-05-13
Trickbot Named Pipe	Sysmon EventID 18, Sysmon EventID 17	T1055	TTP	Trickbot, Hellcat Ransomware	2026-05-13
Windows Modify Registry Delete Firewall Rules	Sysmon EventID 12	T1112	TTP	CISA AA24-241A, NetSupport RMM Tool Abuse, ShrinkLocker	2026-05-13
Windows RDP Login Session Was Established	Windows Event Log Security 4624	T1021.001	Anomaly	Windows RDP Artifacts and Defense Evasion, Scattered Lapsus$ Hunters	2026-05-13
Linux Auditd Disable Or Modify System Firewall	Linux Auditd Service Stop	T1686	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Windows SQL Server Startup Procedure	Windows Event Log Application 17135	T1505.001	Anomaly	Hellcat Ransomware, SQL Server Abuse	2026-05-13
MacOS plutil	Osquery Results	T1647	TTP	Living Off The Land	2026-05-13
Wbemprox COM Object Execution	Sysmon EventID 7	T1218.003	TTP	LockBit Ransomware, Revil Ransomware, Ransomware	2026-05-13
Windows Gather Victim Identity SAM Info	Sysmon EventID 7	T1589.001	Hunting	Brute Ratel C4	2026-05-13
Linux Auditd Find Credentials From Password Managers	Linux Auditd Execve	T1555.005	TTP	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Scattered Lapsus$ Hunters, Linux Living Off The Land	2026-05-13
Windows AD Abnormal Object Access Activity	Windows Event Log Security 4662	T1087.002	Anomaly	BlackSuit Ransomware, Active Directory Discovery	2026-05-13
Windows MSIX Package Interaction	Windows Event Log AppXPackaging 171	T1204.002	Hunting	MSIX Package Abuse	2026-05-13
Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos	Windows Event Log Security 4768	T1110.003	TTP	Active Directory Kerberos Attacks, Volt Typhoon, Active Directory Password Spraying	2026-05-13
Remote Process Instantiation via WMI and PowerShell Script Block	Powershell Script Block Logging 4104	T1047	TTP	Active Directory Lateral Movement	2026-05-13
Windows ESX Admins Group Creation Security Event	Windows Event Log Security 4730, Windows Event Log Security 4737, Windows Event Log Security 4727	T1136.001 T1136.002	TTP	VMware ESXi AD Integration Authentication Bypass CVE-2024-37085	2026-05-13
Sqlite Module In Temp Folder	Sysmon EventID 11	T1005	TTP	IcedID, Lokibot	2026-05-13
Cisco Isovalent - Pods Running Offensive Tools	Cisco Isovalent Process Exec	T1204.003	Anomaly	Cisco Isovalent Suspicious Activity	2026-05-13
Windows Kerberos Coercion via DNS	Windows Event Log Security 5137, Windows Event Log Security 5136, Windows Event Log Security 4662	T1071.004 T1187 T1557.001	TTP	Local Privilege Escalation With KrbRelayUp, Compromised Windows Host, Suspicious DNS Traffic, Kerberos Coercion with DNS	2026-05-13
Windows SQL Server Critical Procedures Enabled	Windows Event Log Application 15457	T1505.001	TTP	SQL Server Abuse	2026-05-13
Windows SQL Server Configuration Option Hunt	Windows Event Log Application 15457	T1505.001	Hunting	SQL Server Abuse	2026-05-13
Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials	Windows Event Log Security 4648	T1110.003	Anomaly	Insider Threat, Volt Typhoon, Active Directory Password Spraying	2026-05-13
Linux Auditd Kernel Module Using Rmmod Utility	Linux Auditd Syscall	T1547.006	TTP	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr	Windows Event Log Security 4698	T1053	TTP	ValleyRAT, Water Gamayun	2026-05-13
Windows Multiple Account Passwords Changed	Windows Event Log Security 4724	T1078 T1098	TTP	Azure Active Directory Persistence	2026-05-13
Windows Raw Access To Master Boot Record Drive	Sysmon EventID 9	T1561.002	TTP	Hermetic Wiper, CISA AA22-264A, Caddy Wiper, Data Destruction, BlackByte Ransomware, Void Manticore, NjRAT, Graceful Wipe Out Attack, Disk Wiper, WhisperGate, PathWiper	2026-05-13
Windows Multiple Users Failed To Authenticate From Process	Windows Event Log Security 4625	T1110.003	TTP	Insider Threat, Volt Typhoon, Active Directory Password Spraying	2026-05-13
Unusual Number of Kerberos Service Tickets Requested	Windows Event Log Security 4769	T1558.003	Anomaly	Active Directory Kerberos Attacks	2026-05-13
Windows Potato Privilege Escalation Tool Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1068	TTP	Windows Privilege Escalation	2026-05-13
Windows Steal Authentication Certificates CS Backup	Windows Event Log Security 4876	T1649	Anomaly	Windows Certificate Services	2026-05-13
Windows Mail Protocol In Non-Common Process Path	Sysmon EventID 3	T1071.003	Anomaly	AgentTesla	2026-05-13
Windows Product Key Registry Query	Windows Event Log Security 4663	T1012	Anomaly	BlankGrabber Stealer	2026-05-13
Detect Copy of ShadowCopy with Script Block Logging	Powershell Script Block Logging 4104	T1003.002	TTP	VanHelsing Ransomware, Credential Dumping	2026-05-13
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File	Linux Auditd Path, Linux Auditd Cwd	T1053.003	Hunting	Compromised Linux Host, Linux Persistence Techniques, XorDDos, Linux Privilege Escalation, Scheduled Tasks, Linux Living Off The Land	2026-05-13
Windows Powershell History File Deletion	Powershell Script Block Logging 4104	T1059.003 T1070.003	Anomaly	Medusa Ransomware	2026-05-13
Windows PowerView AD Access Control List Enumeration	Powershell Script Block Logging 4104	T1069 T1078.002	TTP	Active Directory Discovery, Rhysida Ransomware, Active Directory Privilege Escalation	2026-05-13
Windows Unsigned MS DLL Side-Loading	Sysmon EventID 7	T1547 T1574.001	Anomaly	XWorm, Derusbi, Earth Alux, China-Nexus Threat Activity, Salt Typhoon, APT29 Diplomatic Deceptions with WINELOADER	2026-05-13
PowerShell Script Block With URL Chain	Powershell Script Block Logging 4104	T1059.001 T1105	TTP	Malicious PowerShell, Hellcat Ransomware	2026-05-13
Kerberos User Enumeration	Windows Event Log Security 4768	T1589.002	Anomaly	Active Directory Kerberos Attacks	2026-05-13
Linux Auditd Auditd Daemon Start	Linux Auditd Daemon Start	T1685.004	Anomaly	Compromised Linux Host	2026-05-13
Linux Auditd Possible Access Or Modification Of Sshd Config File	Linux Auditd Path, Linux Auditd Cwd	T1098.004	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Get-ForestTrust with PowerShell Script Block	Powershell Script Block Logging 4104	T1059.001 T1482	TTP	Active Directory Discovery	2026-05-13
Linux Auditd Auditd Daemon Shutdown	Linux Auditd Daemon End	T1685.004	Anomaly	Compromised Linux Host	2026-05-13
Windows Archive Collected Data via Powershell	Powershell Script Block Logging 4104	T1560	Anomaly	CISA AA23-347A, APT37 Rustonotto and FadeStealer	2026-05-13
Loading Of Dynwrapx Module	Sysmon EventID 7	T1055.001	TTP	AsyncRAT, Remcos	2026-05-13
Spoolsv Suspicious Process Access	Sysmon EventID 10	T1068	TTP	Black Basta Ransomware, PrintNightmare CVE-2021-34527	2026-05-13
Disabled Kerberos Pre-Authentication Discovery With PowerView	Powershell Script Block Logging 4104	T1558.004	TTP	Interlock Ransomware, Active Directory Kerberos Attacks	2026-05-13
Windows RDPClient Connection Sequence Events	Windows Event Log Microsoft Windows TerminalServices RDPClient 1024	T1133	Anomaly	Windows RDP Artifacts and Defense Evasion, Spearphishing Attachments	2026-05-13
Windows Local Administrator Credential Stuffing	Windows Event Log Security 4625, Windows Event Log Security 4624	T1110.004	TTP	Active Directory Lateral Movement, Scattered Lapsus$ Hunters, Active Directory Privilege Escalation	2026-05-13
Crowdstrike High Identity Risk Severity		T1110	TTP	Compromised Windows Host	2026-05-13
Windows PowerShell Invoke-Sqlcmd Execution	Powershell Script Block Logging 4104	T1059.001 T1059.003	Hunting	GhostRedirector IIS Module and Rungan Backdoor, SQL Server Abuse	2026-05-13
Windows CrowdStrike Agent Registry Key Removal	Sysmon EventID 12	T1685	Anomaly	Windows Defense Evasion Tactics, Security Solution Tampering	2026-05-13
UAC Bypass MMC Load Unsigned Dll	Sysmon EventID 7	T1218.014 T1548.002	TTP	Windows Defense Evasion Tactics	2026-05-13
Windows Process Accessing Windows Recall Directory	Windows Event Log Security 4663	T1059 T1119	Anomaly	Windows Post-Exploitation	2026-05-13
Process Deleting Its Process File Path	Sysmon EventID 1	T1070	TTP	Clop Ransomware, WhisperGate, Remcos, Data Destruction	2026-05-13
Windows PowerShell WMI Win32 ScheduledJob	Powershell Script Block Logging 4104	T1059.001	TTP	Active Directory Lateral Movement	2026-05-13
Linux Auditd Data Transfer Size Limits Via Split Syscall	Linux Auditd Syscall	T1030	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Windows Unusual NTLM Authentication Destinations By User	NTLM Operational 8006, NTLM Operational 8005, NTLM Operational 8004	T1110.003	Anomaly	Active Directory Password Spraying	2026-05-13
Windows AD Privileged Object Access Activity	Windows Event Log Security 4662	T1087.002	TTP	BlackSuit Ransomware, Active Directory Discovery	2026-05-13
ServicePrincipalNames Discovery with PowerShell	Powershell Script Block Logging 4104	T1558.003	TTP	Malicious PowerShell, Hellcat Ransomware, Active Directory Kerberos Attacks, Active Directory Discovery, Active Directory Privilege Escalation	2026-05-13
Windows PowerView Unconstrained Delegation Discovery	Powershell Script Block Logging 4104	T1018	TTP	CISA AA23-347A, Active Directory Kerberos Attacks, Rhysida Ransomware	2026-05-13
Linux Auditd At Application Execution	Linux Auditd Syscall	T1053.002	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Scheduled Tasks, Linux Living Off The Land	2026-05-13
Suspicious Kerberos Service Ticket Request	Windows Event Log Security 4769	T1078.002	TTP	sAMAccountName Spoofing and Domain Controller Impersonation, Active Directory Kerberos Attacks, Active Directory Privilege Escalation	2026-05-13
Windows Get-AdComputer Unconstrained Delegation Discovery	Powershell Script Block Logging 4104	T1018	TTP	Medusa Ransomware, Active Directory Kerberos Attacks	2026-05-13
Windows Default Group Policy Object Modified	Windows Event Log Security 5136	T1484.001	TTP	Sneaky Active Directory Persistence Tricks, Active Directory Privilege Escalation	2026-05-13
Get DomainPolicy with Powershell Script Block	Powershell Script Block Logging 4104	T1201	TTP	Active Directory Discovery	2026-05-13
Windows Multiple Users Failed To Authenticate Using Kerberos	Windows Event Log Security 4771	T1110.003	TTP	Active Directory Kerberos Attacks, Volt Typhoon, Active Directory Password Spraying	2026-05-13
Detect Baron Samedit CVE-2021-3156 via OSQuery		T1068	TTP	Baron Samedit CVE-2021-3156	2026-05-13
Unusual Number of Computer Service Tickets Requested	Windows Event Log Security 4769	T1078	Hunting	Scattered Lapsus$ Hunters, Active Directory Lateral Movement, Active Directory Kerberos Attacks, Active Directory Privilege Escalation	2026-05-13
Windows Known GraphicalProton Loaded Modules	Sysmon EventID 7	T1574.001	Anomaly	CISA AA23-347A, Hellcat Ransomware, Water Gamayun	2026-05-13
Windows BootLoader Inventory		T1542.001	Hunting	Windows BootKits, BlackLotus Campaign	2026-05-13
Windows AppLocker Execution from Uncommon Locations		T1218	Hunting	Windows AppLocker	2026-05-13
Windows Computer Account Changed to Domain Controller	Windows Event Log Security 4742	T1136.002	TTP	Sneaky Active Directory Persistence Tricks, Active Directory Privilege Escalation	2026-05-13
PowerShell Invoke WmiExec Usage	Powershell Script Block Logging 4104	T1047	TTP	Suspicious WMI Use, Scattered Lapsus$ Hunters	2026-05-13
Windows Forest Discovery with GetForestDomain	Powershell Script Block Logging 4104	T1087.002	TTP	Active Directory Discovery	2026-05-13
Malicious Powershell Executed As A Service	Windows Event Log System 7045	T1569.002	TTP	Malicious PowerShell, Compromised Windows Host, Rhysida Ransomware	2026-05-13
GetWmiObject Ds Group with PowerShell Script Block	Powershell Script Block Logging 4104	T1069.002	TTP	Active Directory Discovery	2026-05-13
Kerberos TGT Request Using RC4 Encryption	Windows Event Log Security 4768	T1550	TTP	Scattered Lapsus$ Hunters, Active Directory Kerberos Attacks	2026-05-13
Windows Cobalt Strike PowerShell Loader	Powershell Script Block Logging 4104	T1059.001 T1608	TTP	Cobalt Strike	2026-05-13
Sunburst Correlation DLL and Network Event	Sysmon EventID 22, Sysmon EventID 7	T1203	TTP	NOBELIUM Group	2026-05-13
Get ADUserResultantPasswordPolicy with Powershell Script Block	Powershell Script Block Logging 4104	T1201	TTP	CISA AA23-347A, Active Directory Discovery	2026-05-13
MS Scripting Process Loading Ldap Module	Sysmon EventID 7	T1059.007	Anomaly	FIN7	2026-05-13
Powershell Remote Services Add TrustedHost	Powershell Script Block Logging 4104	T1021.006	TTP	DarkGate Malware	2026-05-13
Linux Auditd Service Restarted	Linux Auditd Proctitle	T1053.006	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Data Destruction, Gomir, Linux Privilege Escalation, Scheduled Tasks, AwfulShred, Linux Living Off The Land	2026-05-13
Linux Auditd Preload Hijack Via Preload File	Linux Auditd Path, Linux Auditd Cwd	T1574.006	TTP	Linux Persistence Techniques, Compromised Linux Host, VoidLink Cloud-Native Linux Malware, Linux Privilege Escalation, Linux Living Off The Land	2026-05-13
Windows Increase in User Modification Activity	Windows Event Log Security 4720	T1098 T1685	TTP	Sneaky Active Directory Persistence Tricks	2026-05-13
Windows InstallUtil Credential Theft	Sysmon EventID 7	T1218.004	TTP	Signed Binary Proxy Execution InstallUtil	2026-05-13
Crowdstrike Medium Severity Alert		T1110	Anomaly	Compromised Windows Host	2026-05-13
Linux Auditd Auditd Service Stop	Linux Auditd Service Stop	T1489	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Windows Visual Basic Commandline Compiler DNSQuery	Sysmon EventID 22	T1071.004	TTP	Lokibot	2026-05-13
WinEvent Scheduled Task Created Within Public Path	Windows Event Log Security 4698	T1053.005	TTP	CISA AA22-257A, Quasar RAT, CISA AA23-347A, SystemBC, Industroyer2, Ransomware, IcedID, China-Nexus Threat Activity, Remcos, Data Destruction, 0bj3ctivity Stealer, XWorm, Scheduled Tasks, ValleyRAT, Windows Persistence Techniques, Ryuk Ransomware, Prestige Ransomware, Winter Vivern, Salt Typhoon, AsyncRAT, Compromised Windows Host, Castle RAT, Active Directory Lateral Movement, PlugX, Malicious Inno Setup Loader, Medusa Ransomware, APT37 Rustonotto and FadeStealer	2026-05-13
Windows Unusual NTLM Authentication Destinations By Source	NTLM Operational 8006, NTLM Operational 8005, NTLM Operational 8004	T1110.003	Anomaly	Active Directory Password Spraying	2026-05-13
Windows Special Privileged Logon On Multiple Hosts	Windows Event Log Security 4672	T1021.002 T1087 T1135	TTP	Compromised Windows Host, Active Directory Lateral Movement, Active Directory Privilege Escalation	2026-05-13
Windows Credentials Access via VaultCli Module	Sysmon EventID 7	T1555.004	Anomaly	Hellcat Ransomware, Meduza Stealer	2026-05-13
Schedule Task with HTTP Command Arguments	Windows Event Log Security 4698	T1053	TTP	Winter Vivern, Living Off The Land, Scheduled Tasks, Hellcat Ransomware, Windows Persistence Techniques, Compromised Windows Host	2026-05-13
Windows Hunting System Account Targeting Lsass	Sysmon EventID 10	T1003.001	Hunting	Lokibot, CISA AA23-347A, Credential Dumping, Scattered Lapsus$ Hunters	2026-05-13
Windows Office Product Loading VBE7 DLL	Sysmon EventID 7	T1566.001	Anomaly	Qakbot, AgentTesla, MuddyWater, IcedID, Spearphishing Attachments, NjRAT, DarkCrystal RAT, Azorult, Trickbot, Remcos, PlugX	2026-05-13
Windows PowerView SPN Discovery	Powershell Script Block Logging 4104	T1558.003	TTP	CISA AA23-347A, Interlock Ransomware, Active Directory Kerberos Attacks, Rhysida Ransomware	2026-05-13
Powershell Creating Thread Mutex	Powershell Script Block Logging 4104	T1027.005 T1059.001	TTP	Malicious PowerShell, Water Gamayun	2026-05-13
Get ADDefaultDomainPasswordPolicy with Powershell Script Block	Powershell Script Block Logging 4104	T1201	Hunting	Active Directory Discovery	2026-05-13
Randomly Generated Scheduled Task Name	Windows Event Log Security 4698	T1053.005	Hunting	CISA AA22-257A, Scheduled Tasks, Active Directory Lateral Movement, 0bj3ctivity Stealer	2026-05-13
WinEvent Windows Task Scheduler Event Action Started	Windows Event Log TaskScheduler 200, Windows Event Log TaskScheduler 201	T1053.005	Hunting	CISA AA22-257A, SystemBC, Industroyer2, IcedID, BlackSuit Ransomware, DarkCrystal RAT, Remcos, CISA AA24-241A, Data Destruction, SolarWinds WHD RCE Post Exploitation, Scheduled Tasks, ValleyRAT, Windows Persistence Techniques, Prestige Ransomware, Sandworm Tools, Winter Vivern, Qakbot, AsyncRAT, PlugX, Malicious Inno Setup Loader, Amadey	2026-05-13
Windows AppX Deployment Package Installation Success	Windows Event Log AppXDeployment-Server 854	T1204.002	Anomaly	MSIX Package Abuse	2026-05-13
Windows DLL Side-Loading In Calc	Sysmon EventID 7	T1574.001	TTP	Qakbot, Earth Alux	2026-05-13
Enumerate Users Local Group Using Telegram	Windows Event Log Security 4798	T1087	TTP	XMRig, Compromised Windows Host, Water Gamayun	2026-05-13
Windows Scheduled Task Created in a Group Policy Object	Windows Event Log Security 5145	T1053.005 T1484.001	TTP	Living Off The Land, Scheduled Tasks, Windows Persistence Techniques	2026-05-13
Windows GrimResource - MMC Process Accessing APDS DLL	Windows Event Log Security 4663	T1059.007 T1218.014	TTP	Compromised Windows Host	2026-05-13
Windows AD ServicePrincipalName Added To Domain Account	Windows Event Log Security 5136	T1098	TTP	Sneaky Active Directory Persistence Tricks, Interlock Ransomware	2026-05-13
MS Scripting Process Loading WMI Module	Sysmon EventID 7	T1059.007	Anomaly	FIN7	2026-05-13
Windows Steal Authentication Certificates Certificate Request	Windows Event Log Security 4886	T1649	Anomaly	Windows Certificate Services	2026-05-13
Windows Increase in Group or Object Modification Activity	Windows Event Log Security 4663	T1098 T1685	TTP	Sneaky Active Directory Persistence Tricks	2026-05-13
Windows Get Local Admin with FindLocalAdminAccess	Powershell Script Block Logging 4104	T1087.002	TTP	Active Directory Discovery	2026-05-13
Linux Auditd AI CLI Permission Override Activated	Linux Auditd Proctitle	T1480	Anomaly	QuietVault	2026-05-13
Windows Find Interesting ACL with FindInterestingDomainAcl	Powershell Script Block Logging 4104	T1087.002	TTP	Active Directory Discovery	2026-05-13
Windows Unsigned DLL Side-Loading In Same Process Path	Sysmon EventID 7	T1574.001	TTP	XWorm, Malicious Inno Setup Loader, Derusbi, Lokibot, SolarWinds WHD RCE Post Exploitation, NailaoLocker Ransomware, China-Nexus Threat Activity, DarkGate Malware, SnappyBee, Salt Typhoon, PlugX	2026-05-13
Windows Privileged Group Modification	Windows Event Log Security 4790, Windows Event Log Security 4749, Windows Event Log Security 4754, Windows Event Log Security 4727, Windows Event Log Security 4783, Windows Event Log Security 4756, Windows Event Log Security 4759, Windows Event Log Security 4731, Windows Event Log Security 4744	T1136.001 T1136.002	TTP	VMware ESXi AD Integration Authentication Bypass CVE-2024-37085, Scattered Lapsus$ Hunters	2026-05-13
Windows Short Lived DNS Record	Windows Event Log Security 5137, Windows Event Log Security 5136	T1071.004 T1187 T1557.001	TTP	Local Privilege Escalation With KrbRelayUp, Compromised Windows Host, Suspicious DNS Traffic, Kerberos Coercion with DNS	2026-05-13
Windows Rapid Authentication On Multiple Hosts	Windows Event Log Security 4624	T1003.002	TTP	Active Directory Lateral Movement, Active Directory Privilege Escalation	2026-05-13
GetDomainComputer with PowerShell Script Block	Powershell Script Block Logging 4104	T1018	TTP	Active Directory Discovery	2026-05-13
Windows Firewall Rule Modification	Windows Event Log Security 4947	T1686	Anomaly	NetSupport RMM Tool Abuse, Medusa Ransomware, ShrinkLocker	2026-05-13
Linux Auditd Copy Fail Privilege Escalation	Linux Auditd Syscall	T1068	TTP	Linux Privilege Escalation	2026-05-13
Windows SIP Provider Inventory		T1553.003	Hunting	Subvert Trust Controls SIP and Trust Provider Hijacking	2026-05-13
Excessive File Deletion In WinDefender Folder	Sysmon EventID 26, Sysmon EventID 23	T1485	TTP	WhisperGate, Data Destruction, BlackByte Ransomware	2026-05-13
Windows Multiple NTLM Null Domain Authentications	NTLM Operational 8006, NTLM Operational 8005, NTLM Operational 8004	T1110.003	TTP	Active Directory Password Spraying	2026-05-13
Network Traffic to Active Directory Web Services Protocol	Sysmon EventID 3	T1069.001 T1069.002 T1087.001 T1087.002 T1482	Hunting	Windows Discovery Techniques	2026-05-13
Windows PowerView Constrained Delegation Discovery	Powershell Script Block Logging 4104	T1018	TTP	CISA AA23-347A, Active Directory Kerberos Attacks, Rhysida Ransomware	2026-05-13
Windows Remote Image Load	Sysmon EventID 7	T1059 T1068 T1129 T1203	Anomaly	LockBit Ransomware, Ransomware, BlackByte Ransomware	2026-05-13
Processes Tapping Keyboard Events	Osquery Results	N/A	TTP	ColdRoot MacOS RAT, APT37 Rustonotto and FadeStealer	2026-05-13
Windows KrbRelayUp Service Creation	Windows Event Log System 7045	T1543.003	TTP	Local Privilege Escalation With KrbRelayUp, Compromised Windows Host	2026-05-13
Suspicious Computer Account Name Change	Windows Event Log Security 4781	T1078.002	TTP	Compromised Windows Host, sAMAccountName Spoofing and Domain Controller Impersonation, Scattered Lapsus$ Hunters, Active Directory Privilege Escalation	2026-05-13
GetNetTcpconnection with PowerShell Script Block	Powershell Script Block Logging 4104	T1049	Hunting	Active Directory Discovery	2026-05-13
Linux Auditd Add User Account Type	Linux Auditd Add User	T1136.001	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Windows MSExchange Management Mailbox Cmdlet Usage		T1059.001	Anomaly	ProxyNotShell, ProxyShell, Scattered Spider, BlackByte Ransomware	2026-05-13
Linux Auditd Shred Overwrite Command	Linux Auditd Proctitle	T1485	TTP	Linux Persistence Techniques, Compromised Linux Host, Data Destruction, Industroyer2, Linux Privilege Escalation, AwfulShred	2026-05-13
Windows AD SID History Attribute Modified	Windows Event Log Security 5136	T1134.005	TTP	Sneaky Active Directory Persistence Tricks	2026-05-13
Windows Multiple Invalid Users Fail To Authenticate Using Kerberos	Windows Event Log Security 4768	T1110.003	TTP	Active Directory Kerberos Attacks, Volt Typhoon, Active Directory Password Spraying	2026-05-13
Windows DLL Module Loaded in Temp Dir	Sysmon EventID 7	T1105	Hunting	Interlock Rat, Lokibot, SolarWinds WHD RCE Post Exploitation	2026-05-13
MOVEit Certificate Store Access Failure		T1190	Hunting	MOVEit Transfer Authentication Bypass	2026-05-13
CrowdStrike Falcon Stream Alerts	CrowdStrike Falcon Stream Alert	N/A	Anomaly	Critical Alerts	2026-05-13
Unusual Number of Remote Endpoint Authentication Events	Windows Event Log Security 4624	T1078	Hunting	Active Directory Lateral Movement, Active Directory Privilege Escalation	2026-05-13
Windows Executable in Loaded Modules	Sysmon EventID 7	T1129	TTP	Lokibot, NjRAT	2026-05-13
Windows Computer Account With SPN	Windows Event Log Security 4741	T1558	TTP	Local Privilege Escalation With KrbRelayUp, Compromised Windows Host, Active Directory Kerberos Attacks	2026-05-13
Windows Raw Access To Disk Volume Partition	Sysmon EventID 9	T1561.002	Anomaly	Hermetic Wiper, Caddy Wiper, CISA AA22-264A, Data Destruction, BlackByte Ransomware, Void Manticore, NjRAT, Graceful Wipe Out Attack, Disk Wiper, PathWiper	2026-05-13
Windows WinPEAS PowerShell Script Execution	Powershell Script Block Logging 4104	T1007 T1016 T1033 T1082 T1590 T1592.002 T1592.004 T1615	TTP	Windows Post-Exploitation	2026-05-13
Linux Auditd Hardware Addition Swapoff	Linux Auditd Execve	T1200	Anomaly	AwfulShred, Compromised Linux Host, Scattered Lapsus$ Hunters, Data Destruction	2026-05-13
Recon Using WMI Class	Powershell Script Block Logging 4104	T1059.001 T1592	Anomaly	Hermetic Wiper, LockBit Ransomware, VIP Keylogger, Data Destruction, Quasar RAT, Qakbot, Malicious Inno Setup Loader, MoonPeak, Industroyer2, BlankGrabber Stealer, Axios Supply Chain Post Compromise, Malicious PowerShell, Scattered Spider, AsyncRAT	2026-05-13
PowerShell WebRequest Using Memory Stream	Powershell Script Block Logging 4104	T1027.011 T1059.001 T1105	TTP	Malicious PowerShell, PHP-CGI RCE Attack on Japanese Organizations, MoonPeak, Medusa Ransomware	2026-05-13
Windows Screen Capture Via Powershell	Powershell Script Block Logging 4104	T1113	TTP	Winter Vivern, APT37 Rustonotto and FadeStealer, BlankGrabber Stealer, Water Gamayun	2026-05-13
Windows Default Rdp File Deletion	Sysmon EventID 26, Sysmon EventID 23	T1070.004	Anomaly	Windows RDP Artifacts and Defense Evasion	2026-05-13
Clop Ransomware Known Service Name	Windows Event Log System 7045	T1543	TTP	Clop Ransomware, Compromised Windows Host	2026-05-13
Windows IIS Components Get-WebGlobalModule Module Query	Powershell Installed IIS Modules	T1505.004	Hunting	GhostRedirector IIS Module and Rungan Backdoor, WS FTP Server Critical Vulnerabilities, IIS Components	2026-05-13
Suspicious PlistBuddy Usage via OSquery	Osquery Results	T1543.001	TTP	Silver Sparrow	2026-05-13
Windows Driver Inventory		T1068	Hunting	Windows Drivers	2026-05-13
Windows Steal Authentication Certificates - ESC1 Abuse	Windows Event Log Security 4887, Windows Event Log Security 4886	T1649	TTP	Windows Certificate Services	2026-05-13
Windows Vulnerable 3CX Software	Sysmon EventID 1	T1195.002	TTP	3CX Supply Chain Attack	2026-05-13
Windows AD GPO Deleted	Windows Event Log Security 5136	T1484.001 T1685	TTP	Sneaky Active Directory Persistence Tricks	2026-05-13
Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials	Windows Event Log Security 4648	T1110.003	TTP	Insider Threat, Volt Typhoon, Active Directory Password Spraying	2026-05-13
Linux Auditd Find Credentials From Password Stores	Linux Auditd Execve	T1555.005	TTP	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Hellcat Ransomware, Scattered Lapsus$ Hunters, Linux Living Off The Land	2026-05-13
Windows Exfiltration Over C2 Via Invoke RestMethod	Powershell Script Block Logging 4104	T1041	TTP	Winter Vivern, Microsoft WSUS CVE-2025-59287, Hellcat Ransomware, APT37 Rustonotto and FadeStealer, Water Gamayun	2026-05-13
Windows SQL Server Extended Procedure DLL Loading Hunt	Windows Event Log Application 8128	T1059.009 T1505.001	Hunting	SQL Server Abuse	2026-05-13
Windows Software Discovery Via PowerShell	Powershell Script Block Logging 4104	T1012 T1059.001 T1518	Anomaly	Windows Discovery Techniques	2026-05-13
Windows Account Discovery for Sam Account Name	Powershell Script Block Logging 4104	T1087	Anomaly	CISA AA23-347A	2026-05-13
Windows Domain Account Discovery Via Get-NetComputer	Powershell Script Block Logging 4104	T1087.002	Anomaly	CISA AA23-347A	2026-05-13
Windows AppX Deployment Unsigned Package Installation	Windows Event Log AppXDeployment-Server 855	T1204.002 T1553.005	TTP	MSIX Package Abuse	2026-05-13
Windows Level RMM Watchdog Task Created	Windows Event Log Security 4698	T1053 T1219	Anomaly	Remote Monitoring and Management Software	2026-05-13
Windows SoftEther VPN Masquerading as Legitimate Binary	Sysmon EventID 1	T1036 T1572	TTP	Flax Typhoon, Linux Persistence Techniques, Linux Privilege Escalation	2026-05-13
Randomly Generated Windows Service Name	Windows Event Log System 7045	T1543.003	Hunting	BlackSuit Ransomware, Active Directory Lateral Movement	2026-05-13
GetWmiObject Ds Computer with PowerShell Script Block	Powershell Script Block Logging 4104	T1018	TTP	Active Directory Discovery	2026-05-13
Windows RMM Tool Execution	Sysmon EventID 1	T1219	Anomaly	Remote Monitoring and Management Software, NetSupport RMM Tool Abuse, Suspicious User Agents	2026-05-13
Windows Service Created with Suspicious Service Path	Windows Event Log System 7045	T1569.002	TTP	Gh0st RAT, Qakbot, CISA AA23-347A, Flax Typhoon, Derusbi, Snake Malware, Clop Ransomware, APT37 Rustonotto and FadeStealer, China-Nexus Threat Activity, Salt Typhoon, Brute Ratel C4, Crypto Stealer, Active Directory Lateral Movement, PlugX	2026-05-13
Windows Cisco Secure Endpoint Related Service Stopped	Windows Event Log System 7036	T1490	Anomaly	Hellcat Ransomware, Security Solution Tampering, Scattered Lapsus$ Hunters	2026-05-13
Windows Group Policy Object Created	Windows Event Log Security 5137, Windows Event Log Security 5136	T1078.002 T1484.001	TTP	Sneaky Active Directory Persistence Tricks, Active Directory Privilege Escalation	2026-05-13
Cisco Isovalent - Kprobe Spike	Cisco Isovalent Process Kprobe	T1068	Hunting	VoidLink Cloud-Native Linux Malware, Cisco Isovalent Suspicious Activity	2026-05-13
SAM Database File Access Attempt	Windows Event Log Security 4663	T1003.002	Hunting	Credential Dumping, Graceful Wipe Out Attack, Rhysida Ransomware	2026-05-13
Windows PowerShell MSIX Package Installation	Powershell Script Block Logging 4104	T1059.001 T1547.001	TTP	Malicious PowerShell, MSIX Package Abuse	2026-05-13
Windows Drivers Loaded by Signature	Sysmon EventID 6	T1014 T1068	Hunting	Windows Drivers, AgentTesla, CISA AA22-320A, BlackByte Ransomware	2026-05-13
Windows Service Stop Win Updates	Windows Event Log System 7040	T1489	Anomaly	RedLine Stealer, CISA AA23-347A	2026-05-13
Microsoft Defender Incident Alerts	MS365 Defender Incident Alerts	N/A	TTP	Critical Alerts	2026-05-13
Suspicious Ticket Granting Ticket Request	Windows Event Log Security 4768, Windows Event Log Security 4781	T1078.002	Hunting	sAMAccountName Spoofing and Domain Controller Impersonation, Active Directory Kerberos Attacks, Active Directory Privilege Escalation	2026-05-13
Rundll32 Process Creating Exe Dll Files	Sysmon EventID 11	T1218.011	TTP	IcedID, Living Off The Land, Gh0st RAT	2026-05-13
Windows Unusual Intelliform Storage Registry Access	Windows Event Log Security 4663	T1552.001	Anomaly	Lokibot, Quasar RAT	2026-05-13
Linux Auditd Change File Owner To Root	Linux Auditd Proctitle	T1222.002	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Crowdstrike Multiple LOW Severity Alerts		T1110	Anomaly	Compromised Windows Host	2026-05-13
Linux Auditd Possible Access To Sudoers File	Linux Auditd Path, Linux Auditd Cwd	T1548.003	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Windows IIS Components Module Failed to Load	Windows Event Log Application 2282	T1505.004	Anomaly	IIS Components	2026-05-13
ConnectWise ScreenConnect Path Traversal Windows SACL	Windows Event Log Security 4663	T1190	TTP	Compromised Windows Host, Seashell Blizzard, ConnectWise ScreenConnect Vulnerabilities	2026-05-13
Exchange PowerShell Abuse via SSRF		T1133 T1190	TTP	ProxyNotShell, ProxyShell, Seashell Blizzard, BlackByte Ransomware	2026-05-13
WMI Recon Running Process Or Services	Powershell Script Block Logging 4104	T1592	Anomaly	Malicious PowerShell, Hermetic Wiper, Data Destruction	2026-05-13
Windows Office Product Loaded MSHTML Module	Sysmon EventID 7	T1566.001	Anomaly	Microsoft MSHTML Remote Code Execution CVE-2021-40444, Spearphishing Attachments, CVE-2023-36884 Office and Windows HTML RCE Vulnerability, MuddyWater	2026-05-13
Windows LAPS Password Gathering Via PowerShell Script	Powershell Script Block Logging 4104	T1003 T1552	Anomaly	Credential Dumping, Active Directory Privilege Escalation	2026-05-13
Cisco Isovalent - Cron Job Creation	Cisco Isovalent Process Exec	T1053.003 T1053.007	Anomaly	Cisco Isovalent Suspicious Activity	2026-05-13
Spoolsv Suspicious Loaded Modules	Sysmon EventID 7	T1547.012	TTP	Black Basta Ransomware, PrintNightmare CVE-2021-34527	2026-05-13
Windows Privilege Escalation System Process Without System Parent	Sysmon EventID 1	T1068 T1134 T1548	TTP	BlackSuit Ransomware, Windows Privilege Escalation	2026-05-13
Allow Inbound Traffic In Firewall Rule	Powershell Script Block Logging 4104	T1021.001	TTP	NetSupport RMM Tool Abuse, Prohibited Traffic Allowed or Protocol Mismatch	2026-05-13
Exchange PowerShell Module Usage	Powershell Script Block Logging 4104	T1059.001	TTP	CISA AA22-277A, CISA AA22-264A, BlackByte Ransomware, ProxyShell, ProxyNotShell, Scattered Spider	2026-05-13
Windows ESX Admins Group Creation via PowerShell	Powershell Script Block Logging 4104	T1136.001 T1136.002	TTP	VMware ESXi AD Integration Authentication Bypass CVE-2024-37085	2026-05-13
SchCache Change By App Connect And Create ADSI Object	Sysmon EventID 11	T1087.002	Anomaly	BlackMatter Ransomware	2026-05-13
Kerberos Service Ticket Request Using RC4 Encryption	Windows Event Log Security 4769	T1558.001	TTP	Scattered Lapsus$ Hunters, Active Directory Kerberos Attacks, Active Directory Privilege Escalation	2026-05-13
Windows Default Cobalt Strike PowerShell Beacon	Powershell Script Block Logging 4104	T1059.001 T1204.002	TTP	Cobalt Strike	2026-05-13
GetLocalUser with PowerShell Script Block	Powershell Script Block Logging 4104	T1059.001 T1087.001	Hunting	Malicious PowerShell, Active Directory Discovery	2026-05-13
Windows Account Discovery With NetUser PreauthNotRequire	Powershell Script Block Logging 4104	T1087	Hunting	CISA AA23-347A	2026-05-13
Linux Auditd Doas Tool Execution	Linux Auditd Syscall	T1548.003	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Disabled Kerberos Pre-Authentication Discovery With Get-ADUser	Powershell Script Block Logging 4104	T1558.004	TTP	CISA AA23-347A, BlackSuit Ransomware, Interlock Ransomware, Active Directory Kerberos Attacks	2026-05-13
Linux Auditd Database File And Directory Discovery	Linux Auditd Execve	T1083	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation	2026-05-13
Windows PowerShell Add Module to Global Assembly Cache	Powershell Script Block Logging 4104	T1505.004	TTP	IIS Components	2026-05-13
Linux Auditd Data Destruction Command	Linux Auditd Proctitle	T1485	TTP	AwfulShred, Compromised Linux Host, Data Destruction	2026-05-13
GetWmiObject User Account with PowerShell Script Block	Powershell Script Block Logging 4104	T1059.001 T1087.001	Hunting	Malicious PowerShell, Winter Vivern, Active Directory Discovery	2026-05-13
Print Spooler Adding A Printer Driver	Windows Event Log Printservice 316	T1547.012	TTP	Black Basta Ransomware, PrintNightmare CVE-2021-34527	2026-05-13
Linux Auditd Data Transfer Size Limits Via Split	Linux Auditd Execve	T1030	Anomaly	Linux Persistence Techniques, Compromised Linux Host, Linux Privilege Escalation, Hellcat Ransomware, Linux Living Off The Land	2026-05-13
Windows Alternate DataStream - Executable Content	Sysmon EventID 15	T1564.004	TTP	Windows Defense Evasion Tactics	2026-05-13
Linux Auditd Auditd Daemon Abort	Linux Auditd Daemon Abort	T1685.004	Anomaly	Compromised Linux Host	2026-05-13
Cisco Secure Firewall - Privileged Command Execution via HTTP	Cisco Secure Firewall Threat Defense Intrusion Event	T1059 T1505.003	Anomaly	Cisco Secure Firewall Threat Defense Analytics, Salt Typhoon	2026-05-13
Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt	Cisco Secure Firewall Threat Defense Intrusion Event	T1059 T1203	TTP	Citrix NetScaler ADC and NetScaler Gateway CVE-2025-5777, Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Cisco Secure Firewall - Oracle E-Business Suite Correlation	Cisco Secure Firewall Threat Defense Intrusion Event	T1190	TTP	Cisco Secure Firewall Threat Defense Analytics, Oracle E-Business Suite Exploitation	2026-05-13
Cisco Secure Firewall - Blocked Connection	Cisco Secure Firewall Threat Defense Connection Event	T1018 T1046 T1110 T1203 T1595.002	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Cisco Secure Firewall - Static Tundra Smart Install Abuse	Cisco Secure Firewall Threat Defense Intrusion Event	T1190 T1210 T1499	TTP	Cisco Smart Install Remote Code Execution CVE-2018-0171, Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Windows Abused Web Services	Sysmon EventID 22	T1102	Anomaly	Malicious Inno Setup Loader, CISA AA24-241A, NjRAT, BlankGrabber Stealer	2026-05-13
Zeek x509 Certificate with Punycode		T1573	Hunting	OpenSSL CVE-2022-3602	2026-05-13
Detect ARP Poisoning	Cisco IOS Logs	T1200 T1498 T1557.002	TTP	Router and Infrastructure Security	2026-05-13
Cisco Secure Firewall - React Server Components RCE Attempt	Cisco Secure Firewall Threat Defense Intrusion Event	T1190	TTP	React2Shell	2026-05-13
Cisco Secure Firewall - Possibly Compromised Host	Cisco Secure Firewall Threat Defense Intrusion Event	T1059 T1203 T1587.001	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Cisco Secure Firewall - Lumma Stealer Activity	Cisco Secure Firewall Threat Defense Intrusion Event	T1027 T1190 T1204 T1210	TTP	Lumma Stealer, Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Suspicious Process DNS Query Known Abuse Web Services	Sysmon EventID 22	T1059.005	TTP	Data Destruction, RedLine Stealer, Malicious Inno Setup Loader, BlankGrabber Stealer, Cactus Ransomware, Meduza Stealer, PXA Stealer, Phemedrone Stealer, Braodo Stealer, Snake Keylogger, WhisperGate, Remcos	2026-05-13
Detect IPv6 Network Infrastructure Threats	Cisco IOS Logs	T1200 T1498 T1557.002	TTP	Router and Infrastructure Security, Scattered Lapsus$ Hunters	2026-05-13
Detect Traffic Mirroring	Cisco IOS Logs	T1020.001 T1200 T1498	TTP	Router and Infrastructure Security	2026-05-13
Detect Port Security Violation	Cisco IOS Logs	T1200 T1498 T1557.002	TTP	Router and Infrastructure Security	2026-05-13
Wermgr Process Connecting To IP Check Web Services	Sysmon EventID 22	T1590.005	TTP	Trickbot	2026-05-13
Cisco Secure Firewall - Rare Snort Rule Triggered	Cisco Secure Firewall Threat Defense Intrusion Event	T1583.006 T1598	Hunting	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Windows Multi hop Proxy TOR Website Query	Sysmon EventID 22	T1071.003	Anomaly	AgentTesla, Interlock Ransomware	2026-05-13
Detect SNICat SNI Exfiltration		T1041	TTP	Data Exfiltration	2026-05-13
Cisco Secure Firewall - High EVE Threat Confidence	Cisco Secure Firewall Threat Defense Connection Event	T1041 T1071.001 T1105 T1573.002	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Cisco Secure Firewall - Potential Data Exfiltration	Cisco Secure Firewall Threat Defense Connection Event	T1041 T1048.003 T1567.002	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Windows AD Rogue Domain Controller Network Activity		T1207	TTP	Sneaky Active Directory Persistence Tricks	2026-05-13
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts	Cisco Secure Firewall Threat Defense Intrusion Event	T1027 T1105	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Cisco SD-WAN - Low Frequency Rogue Peer	Cisco SD-WAN NTCE 1000001	T1190	Anomaly	Cisco Catalyst SD-WAN Analytics	2026-05-13
Detect Zerologon via Zeek		T1190	TTP	Black Basta Ransomware, Detect Zerologon Attack, Rhysida Ransomware	2026-05-13
Cisco Secure Firewall - Wget or Curl Download	Cisco Secure Firewall Threat Defense Connection Event	T1053.003 T1059 T1071.001 T1105	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity	Cisco SD-WAN Service Proxy Access Logs	T1190	TTP	Cisco Catalyst SD-WAN Analytics	2026-05-13
Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt	Cisco Secure Firewall Threat Defense Intrusion Event	T1041 T1573.002	Anomaly	Lumma Stealer, Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Cisco Secure Firewall - SSH Connection to sshd_operns	Cisco Secure Firewall Threat Defense Intrusion Event	T1021.004	Anomaly	Cisco Secure Firewall Threat Defense Analytics, Salt Typhoon	2026-05-13
Cisco Secure Firewall - SSH Connection to Non-Standard Port	Cisco Secure Firewall Threat Defense Intrusion Event	T1021.004	Anomaly	Cisco Secure Firewall Threat Defense Analytics, Salt Typhoon	2026-05-13
Cisco Secure Firewall - Bits Network Activity	Cisco Secure Firewall Threat Defense Connection Event	N/A	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Cisco Secure Firewall - Repeated Blocked Connections	Cisco Secure Firewall Threat Defense Connection Event	T1018 T1046 T1110 T1203 T1595.002	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity	Cisco SD-WAN Service Proxy Access Logs	T1595	Hunting	Cisco Catalyst SD-WAN Analytics	2026-05-13
Rundll32 DNSQuery	Sysmon EventID 22	T1218.011	TTP	IcedID, Living Off The Land	2026-05-13
Cisco SD-WAN - Peering Activity	Cisco SD-WAN NTCE 1000001	T1190	Hunting	Cisco Catalyst SD-WAN Analytics	2026-05-13
Detect Windows DNS SIGRed via Splunk Stream		T1203	TTP	Windows DNS SIGRed CVE-2020-1350	2026-05-13
Cisco Secure Firewall - Lumma Stealer Download Attempt	Cisco Secure Firewall Threat Defense Intrusion Event	T1041 T1573.002	Anomaly	Lumma Stealer, Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Cisco Secure Firewall - Oracle E-Business Suite Exploitation	Cisco Secure Firewall Threat Defense Intrusion Event	T1190	TTP	Cisco Secure Firewall Threat Defense Analytics, Oracle E-Business Suite Exploitation	2026-05-13
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity	Cisco Secure Firewall Threat Defense Intrusion Event	T1003.001 T1059.001 T1190 T1210	TTP	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Detect Rogue DHCP Server	Cisco IOS Logs	T1200 T1498 T1557	TTP	Router and Infrastructure Security, Scattered Lapsus$ Hunters	2026-05-13
Cisco Secure Firewall - High Volume of Intrusion Events Per Host	Cisco Secure Firewall Threat Defense Intrusion Event	T1059 T1071 T1595.002	Anomaly	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
Windows Spearphishing Attachment Connect To None MS Office Domain	Sysmon EventID 22	T1566.001	Hunting	AsyncRAT, Spearphishing Attachments, MuddyWater	2026-05-13
Cisco Secure Firewall - High Priority Intrusion Classification	Cisco Secure Firewall Threat Defense Intrusion Event	T1003 T1071 T1078 T1190 T1203	TTP	Cisco Secure Firewall Threat Defense Analytics	2026-05-13
CrushFTP Server Side Template Injection	CrushFTP	T1190	TTP	Hellcat Ransomware, CrushFTP Vulnerabilities	2026-05-13
Zoom Rare Input Devices		T1123	Hunting	Remote Employment Fraud	2026-05-13
MCP Prompt Injection	MCP Server	T1059	TTP	Suspicious MCP Activities	2026-05-13
MCP Github Suspicious Operation	MCP Server	T1552.001	Hunting	Suspicious MCP Activities	2026-05-13
MCP Filesystem Server Suspicious Extension Write	MCP Server	T1059	Hunting	Suspicious MCP Activities	2026-05-13
Zoom Rare Video Devices		T1123	Hunting	Remote Employment Fraud	2026-05-13
M365 Copilot Jailbreak Attempts	M365 Exported eDiscovery Prompts	T1685	Anomaly	Suspicious Microsoft 365 Copilot Activities	2026-05-13
Cisco ASA - Device File Copy Activity	Cisco ASA Logs	T1005 T1530	Anomaly	ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
ESXi Syslog Config Change	VMWare ESXi Syslog	T1690	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
Cisco Duo Policy Allow Old Flash	Cisco Duo Administrator	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
ESXi VM Discovery	VMWare ESXi Syslog	T1673	TTP	Black Basta Ransomware, ESXi Post Compromise, China-Nexus Threat Activity	2026-05-13
Cisco ASA - Reconnaissance Command Activity	Cisco ASA Logs	T1082 T1590.001 T1590.005	Anomaly	Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
M365 Copilot Agentic Jailbreak Attack	M365 Exported eDiscovery Prompts	T1685	Anomaly	Suspicious Microsoft 365 Copilot Activities	2026-05-13
ESXi VIB Acceptance Level Tampering	VMWare ESXi Syslog	T1685	TTP	Black Basta Ransomware, ESXi Post Compromise, China-Nexus Threat Activity	2026-05-13
Cisco Duo Admin Login Unusual Country	Cisco Duo Activity	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
Cisco ASA - User Privilege Level Change	Cisco ASA Logs	T1078.003 T1098	Anomaly	ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
Cisco Duo Bulk Policy Deletion	Cisco Duo Administrator	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
Cisco Duo Policy Allow Tampered Devices	Cisco Duo Administrator	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
ESXi System Information Discovery	VMWare ESXi Syslog	T1082	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
Okta Unauthorized Access to Application	Okta	T1087.004	Anomaly	Okta Account Takeover	2026-05-13
Okta Multiple Failed Requests to Access Applications	Okta	T1538 T1550.004	Hunting	Okta Account Takeover	2026-05-13
ESXi Reverse Shell Patterns	VMWare ESXi Syslog	T1059	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
ESXi VM Exported via Remote Tool	VMWare ESXi Syslog	T1005	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
Okta MFA Exhaustion Hunt	Okta	T1110	Hunting	Scattered Lapsus$ Hunters, Okta Account Takeover, Okta MFA Exhaustion	2026-05-13
ESXi Account Modified	VMWare ESXi Syslog	T1078 T1098 T1136.001	Anomaly	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
Cisco ASA - User Account Lockout Threshold Exceeded	Cisco ASA Logs	T1110.001 T1110.003	Anomaly	Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
Cisco ASA - Logging Message Suppression	Cisco ASA Logs	T1070 T1685.001	Anomaly	ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
MCP Sensitive System File Search	MCP Server	T1552.001	Hunting	Suspicious MCP Activities	2026-05-13
PingID Mismatch Auth Source and Verification Response	PingID	T1098.005 T1556.006 T1621	TTP	Compromised User Account	2026-05-13
ESXi Sensitive Files Accessed	VMWare ESXi Syslog	T1003.008 T1005	TTP	Black Basta Ransomware, ESXi Post Compromise, China-Nexus Threat Activity	2026-05-13
Cisco Duo Policy Deny Access	Cisco Duo Administrator	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
ESXi User Granted Admin Role	VMWare ESXi Syslog	T1078 T1098	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
Okta Successful Single Factor Authentication	Okta	T1078.004 T1586.003 T1621	Anomaly	Okta Account Takeover	2026-05-13
Zoom Rare Audio Devices		T1123	Hunting	Remote Employment Fraud	2026-05-13
M365 Copilot Application Usage Pattern Anomalies	M365 Copilot Graph API	T1078	Anomaly	Suspicious Microsoft 365 Copilot Activities	2026-05-13
PingID New MFA Method Registered For User	PingID	T1098.005 T1556.006 T1621	TTP	Compromised User Account	2026-05-13
ESXi Lockdown Mode Disabled	VMWare ESXi Syslog	T1685	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
ESXi SSH Enabled	VMWare ESXi Syslog	T1021.004	TTP	Black Basta Ransomware, Hellcat Ransomware, ESXi Post Compromise	2026-05-13
Cisco Duo Admin Login Unusual Os	Cisco Duo Activity	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
ESXi Firewall Disabled	VMWare ESXi Syslog	T1686	TTP	Black Basta Ransomware, ESXi Post Compromise, China-Nexus Threat Activity	2026-05-13
Cisco Duo Policy Skip 2FA for Other Countries	Cisco Duo Administrator	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
Cisco ASA - Device File Copy to Remote Location	Cisco ASA Logs	T1005 T1041 T1048.003	Anomaly	ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
ESXi Download Errors	VMWare ESXi Syslog	T1601.001 T1685	Anomaly	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
Okta IDP Lifecycle Modifications	Okta	T1087.004	Anomaly	Suspicious Okta Activity	2026-05-13
Ivanti VTM New Account Creation	Ivanti VTM Audit	T1190	TTP	Ivanti Virtual Traffic Manager CVE-2024-7593, Hellcat Ransomware, Scattered Lapsus$ Hunters	2026-05-13
ESXi SSH Brute Force	VMWare ESXi Syslog	T1110	Anomaly	Black Basta Ransomware, Hellcat Ransomware, ESXi Post Compromise	2026-05-13
M365 Copilot Failed Authentication Patterns	M365 Copilot Graph API	T1110	Anomaly	Suspicious Microsoft 365 Copilot Activities	2026-05-13
ESXi Loghost Config Tampering	VMWare ESXi Syslog	T1685	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
Cisco ASA - Packet Capture Activity	Cisco ASA Logs	T1040 T1557	Anomaly	ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
Cisco ASA - Logging Disabled via CLI	Cisco ASA Logs	T1685	TTP	Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
Zoom High Video Latency		T1078	Anomaly	Remote Employment Fraud	2026-05-13
Cisco ASA - New Local User Account Created	Cisco ASA Logs	T1078.003 T1136.001	Anomaly	Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
Cisco Duo Set User Status to Bypass 2FA	Cisco Duo Administrator	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
Cisco Duo Policy Allow Devices Without Screen Lock	Cisco Duo Administrator	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
ESXi Shell Access Enabled	VMWare ESXi Syslog	T1021	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
Okta Phishing Detection with FastPass Origin Check	Okta	T1078.001 T1556	TTP	Okta Account Takeover	2026-05-13
ESXi Malicious VIB Forced Install	VMWare ESXi Syslog	T1505.006	TTP	Black Basta Ransomware, ESXi Post Compromise, China-Nexus Threat Activity	2026-05-13
Cisco ASA - Logging Filters Configuration Tampering	Cisco ASA Logs	T1685	Anomaly	Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
Cisco Duo Policy Allow Network Bypass 2FA	Cisco Duo Administrator	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
Okta Suspicious Use of a Session Cookie	Okta	T1539	Anomaly	Suspicious Okta Activity, Okta Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
Cisco Duo Bypass Code Generation	Cisco Duo Administrator	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
Cisco ASA - Core Syslog Message Volume Drop	Cisco ASA Logs	T1685	Hunting	ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
Cisco ASA - AAA Policy Tampering	Cisco ASA Logs	T1556.004	Anomaly	Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
Cisco Duo Policy Bypass 2FA	Cisco Duo Administrator	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
Cisco ASA - User Account Deleted From Local Database	Cisco ASA Logs	T1070.008 T1531	Anomaly	Suspicious Cisco Adaptive Security Appliance Activity	2026-05-13
MCP Postgres Suspicious Query	MCP Server	T1555	Hunting	Suspicious MCP Activities	2026-05-13
ESXi Shared or Stolen Root Account	VMWare ESXi Syslog	T1078	Anomaly	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
M365 Copilot Non Compliant Devices Accessing M365 Copilot	M365 Copilot Graph API	T1685	Anomaly	Suspicious Microsoft 365 Copilot Activities	2026-05-13
ESXi System Clock Manipulation	VMWare ESXi Syslog	T1070.006	TTP	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
M365 Copilot Information Extraction Jailbreak Attack	M365 Exported eDiscovery Prompts	T1685	TTP	Suspicious Microsoft 365 Copilot Activities	2026-05-13
Suspicious Java Classes		T1190	Anomaly	Apache Struts Vulnerability	2026-05-13
Splunk AppDynamics Secure Application Alerts	Splunk AppDynamics Secure Application Alert	N/A	Anomaly	Critical Alerts	2026-05-13
Okta ThreatInsight Threat Detected	Okta	T1078.004	Anomaly	Okta Account Takeover	2026-05-13
Okta Mismatch Between Source and Response for Verify Push Request	Okta	T1621	TTP	Scattered Lapsus$ Hunters, Okta Account Takeover, Okta MFA Exhaustion	2026-05-13
ESXi External Root Login Activity	VMWare ESXi Syslog	T1078	Anomaly	Black Basta Ransomware, ESXi Post Compromise	2026-05-13
Cisco Duo Policy Allow Old Java	Cisco Duo Administrator	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
Cisco Duo Admin Login Unusual Browser	Cisco Duo Activity	T1556	TTP	Cisco Duo Suspicious Activity	2026-05-13
M365 Copilot Session Origin Anomalies	M365 Copilot Graph API	T1078	Anomaly	Suspicious Microsoft 365 Copilot Activities	2026-05-13
Okta Multiple Failed MFA Requests For User	Okta	T1621	Anomaly	Okta Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
PingID Multiple Failed MFA Requests For User	PingID	T1078 T1110 T1621	TTP	Compromised User Account	2026-05-13
Okta Suspicious Activity Reported	Okta	T1078.001	TTP	Okta Account Takeover	2026-05-13
Supernova Webshell		T1133 T1505.003	TTP	GhostRedirector IIS Module and Rungan Backdoor, Earth Alux, NOBELIUM Group	2026-05-13
VMware Server Side Template Injection Hunt	Palo Alto Network Threat	T1133 T1190	Hunting	VMware Server Side Injection and Privilege Escalation	2026-05-13
Confluence Unauthenticated Remote Code Execution CVE-2022-26134	Palo Alto Network Threat	T1133 T1190 T1505	TTP	Confluence Data Center and Confluence Server Vulnerabilities, Atlassian Confluence Server and Data Center CVE-2022-26134	2026-05-13
Windows Exchange Autodiscover SSRF Abuse	Windows IIS	T1133 T1190	TTP	ProxyNotShell, ProxyShell, Seashell Blizzard, BlackByte Ransomware	2026-05-13
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082	Suricata	T1133 T1190	TTP	Ivanti EPMM Remote Unauthenticated Access	2026-05-13
High Volume of Bytes Out to Url	Nginx Access	T1567	Anomaly	Hellcat Ransomware, Data Exfiltration	2026-05-13
Windows IIS Server PSWA Console Access	Windows IIS	T1190	Hunting	CISA AA24-241A	2026-05-13
ProxyShell ProxyNotShell Behavior Detected		T1133 T1190	Correlation	ProxyShell, Seashell Blizzard, ProxyNotShell	2026-05-13
VMWare Aria Operations Exploit Attempt	Palo Alto Network Threat	T1068 T1133 T1190 T1210	TTP	VMware Aria Operations vRealize CVE-2023-20887	2026-05-13
Fortinet Appliance Auth bypass	Palo Alto Network Threat	T1133 T1190	TTP	CVE-2022-40684 Fortinet Appliance Auth bypass	2026-05-13
Detect malicious requests to exploit JBoss servers		N/A	TTP	JBoss Vulnerability, SamSam Ransomware	2026-05-13
Exploit Public Facing Application via Apache Commons Text	Nginx Access	T1133 T1190 T1505.003	Anomaly	Text4Shell CVE-2022-42889	2026-05-13
WS FTP Remote Code Execution	Suricata	T1190	TTP	WS FTP Server Critical Vulnerabilities	2026-05-13
Adobe ColdFusion Access Control Bypass	Suricata	T1190	Anomaly	Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360	2026-05-13
PaperCut NG Remote Web Access Attempt	Suricata	T1133 T1190	TTP	PaperCut MF NG Vulnerability	2026-05-13
Microsoft SharePoint Server Elevation of Privilege	Suricata	T1068	Anomaly	Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357	2026-05-13
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078	Suricata	T1133 T1190	TTP	Ivanti EPMM Remote Unauthenticated Access	2026-05-13
JetBrains TeamCity RCE Attempt	Suricata	T1190	TTP	CISA AA23-347A, JetBrains TeamCity Vulnerabilities, JetBrains TeamCity Unauthenticated RCE	2026-05-13
Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952	Palo Alto Network Threat	T1133 T1190	TTP	Fortinet FortiNAC CVE-2022-39952, Hellcat Ransomware	2026-05-13
SQL Injection with Long URLs		T1190	TTP	GhostRedirector IIS Module and Rungan Backdoor, SQL Injection	2026-05-13
HTTP Request to Reserved Name on IIS Server	Suricata	T1071.001 T1190	TTP	HTTP Request Smuggling	2026-05-13
Adobe ColdFusion Unauthenticated Arbitrary File Read	Suricata	T1190	Anomaly	Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360	2026-05-13
Cisco IOS XE Implant Access	Suricata	T1190	TTP	Cisco IOS XE Software Web Management User Interface vulnerability	2026-05-13
Detect attackers scanning for vulnerable JBoss servers		T1082 T1133	TTP	JBoss Vulnerability, SamSam Ransomware	2026-05-13
VMware Workspace ONE Freemarker Server-side Template Injection	Palo Alto Network Threat	T1133 T1190	Anomaly	VMware Server Side Injection and Privilege Escalation	2026-05-13
Detect Web Access to Decommissioned S3 Bucket	AWS Cloudfront	T1485	Anomaly	AWS S3 Bucket Security Monitoring, Data Destruction	2026-05-13
WordPress Bricks Builder plugin RCE	Nginx Access	T1190	TTP	WordPress Vulnerabilities, Hellcat Ransomware	2026-05-13
Citrix ShareFile Exploitation CVE-2023-24489	Suricata	T1190	Hunting	Citrix ShareFile RCE CVE-2023-24489	2026-05-13
SAP NetWeaver Visual Composer Exploitation Attempt	Suricata	T1190	Hunting	SAP NetWeaver Exploitation	2026-05-13
Java Class File download by Java User Agent	Splunk Stream HTTP	T1190	TTP	Log4Shell CVE-2021-44228	2026-05-13
Ivanti EPM SQL Injection Remote Code Execution	Suricata	T1190	TTP	GhostRedirector IIS Module and Rungan Backdoor, Ivanti EPM Vulnerabilities, Hellcat Ransomware	2026-05-13
Kubernetes Process with Resource Ratio Anomalies		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
AWS S3 Exfiltration Behavior Identified		T1537	Correlation	Suspicious Cloud Instance Activities, Data Exfiltration	2026-05-13
Detect S3 access from a new IP		T1530	Anomaly	Suspicious AWS S3 Activities	2026-05-13
Detect AWS Console Login by New User	AWS CloudTrail	T1552 T1586.003	Hunting	Suspicious Cloud Authentication Activities, AWS Identity and Access Management Account Takeover	2026-05-13
Kubernetes Anomalous Inbound to Outbound Network IO Ratio		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
Detect AWS Console Login by User from New Region	AWS CloudTrail	T1535 T1586.003	Hunting	Compromised User Account, Suspicious AWS Login Activities, Suspicious Cloud Authentication Activities, AWS Identity and Access Management Account Takeover	2026-05-13
Detect Spike in S3 Bucket deletion	AWS CloudTrail	T1530	Anomaly	Suspicious AWS S3 Activities	2026-05-13
Kubernetes Anomalous Inbound Outbound Network IO		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
Kubernetes Process with Anomalous Resource Utilisation		T1204	Anomaly	Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring	2026-05-13
Risk Rule for Dev Sec Ops by Repository		T1204.003	Correlation	Dev Sec Ops	2026-05-13
Detect AWS Console Login by User from New Country	AWS CloudTrail	T1535 T1586.003	Hunting	Compromised User Account, Suspicious AWS Login Activities, Suspicious Cloud Authentication Activities, AWS Identity and Access Management Account Takeover	2026-05-13
Detect AWS Console Login by User from New City	AWS CloudTrail	T1535 T1586.003	Hunting	Compromised User Account, Suspicious AWS Login Activities, Suspicious Cloud Authentication Activities, AWS Identity and Access Management Account Takeover	2026-05-13
Detect Spike in blocked Outbound Traffic from your AWS		N/A	Anomaly	Suspicious AWS Traffic, AWS Network ACL Activity, Command And Control	2026-05-13
Linux Stdout Redirection To Dev Null File	Sysmon for Linux EventID 1	T1686	Anomaly	Industroyer2, Cyclops Blink, Data Destruction	2026-05-13
Hide User Account From Sign-In Screen	Sysmon EventID 13	T1685	TTP	XMRig, Warzone RAT, Azorult, Windows Registry Abuse	2026-05-13
Linux Iptables Firewall Modification	Sysmon for Linux EventID 1	T1686	Anomaly	Sandworm Tools, Cyclops Blink, China-Nexus Threat Activity, Backdoor Pingpong	2026-05-13
Windows Bypass UAC via Pkgmgr Tool	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1548.002	Anomaly	Warzone RAT	2026-05-13
Headless Browser Mockbin or Mocky Request	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1564.003	TTP	GhostRedirector IIS Module and Rungan Backdoor, Forest Blizzard	2026-05-13
Linux c89 Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Protocol Tunneling with Plink	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.004 T1572	TTP	CISA AA22-257A	2026-05-13
Windows Audit Policy Security Descriptor Tampering via Auditpol	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685.001	Anomaly	Windows Audit Policy Tampering	2026-05-13
Windows Chromium Process with Disabled Extensions	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1497	Anomaly	Browser Hijacking	2026-05-13
Windows Modify Registry WuServer	Sysmon EventID 13	T1112	Hunting	RedLine Stealer	2026-05-13
Windows Set Network Profile Category to Private via Registry	Sysmon EventID 13	T1112	Anomaly	Secret Blizzard	2026-05-13
Windows Modify Registry Regedit Silent Reg Import	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1112	Anomaly	Azorult	2026-05-13
Windows Explorer LNK Exploit Process Launch With Padding	Windows Event Log Security 4688, Sysmon EventID 1	T1059.001 T1204.002	TTP	ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day	2026-05-13
Windows New InProcServer32 Added	Sysmon EventID 13	T1112	Hunting	Hellcat Ransomware, Outlook RCE CVE-2024-21378	2026-05-13
Windows Impair Defense Define Win Defender Threat Action	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
System Info Gathering Using Dxdiag Application	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1592	Hunting	Remcos	2026-05-13
Windows Impair Defense Change Win Defender Health Check Intervals	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows RDP Server Registry Entry Created	Sysmon EventID 13	T1021.001	Anomaly	Windows RDP Artifacts and Defense Evasion	2026-05-13
Linux Account Manipulation Of SSH Config and Keys	Sysmon for Linux EventID 11	T1070.004 T1485	Anomaly	AcidRain, Hellcat Ransomware	2026-05-13
Windows Excessive Service Stop Attempt	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1489	TTP	XMRig, Ransomware, BlackByte Ransomware	2026-05-13
Domain Account Discovery with Wmic	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1087.002	TTP	Interlock Ransomware, Active Directory Discovery	2026-05-13
Windows Admin Permission Discovery	Sysmon EventID 11	T1069.001	Anomaly	NjRAT	2026-05-13
Windows Execution of Microsoft MSC File In Suspicious Path	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.014	Anomaly	XML Runner Loader	2026-05-13
Wmic NonInteractive App Uninstallation	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Hunting	IcedID, Azorult	2026-05-13
Windows Remote Assistance Spawning Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055	TTP	Compromised Windows Host, Unusual Processes	2026-05-13
Recursive Delete of Directory In Batch CMD	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1070.004	TTP	APT37 Rustonotto and FadeStealer, Ransomware	2026-05-13
Windows Audit Policy Auditing Option Modified - Registry	Sysmon EventID 13	T1547.014	Anomaly	Windows Audit Policy Tampering	2026-05-13
Windows COM Hijacking InprocServer32 Modification	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1546.015	TTP	Living Off The Land, Compromised Windows Host	2026-05-13
ConnectWise ScreenConnect Path Traversal	Sysmon EventID 11	T1190	TTP	Seashell Blizzard, ConnectWise ScreenConnect Vulnerabilities	2026-05-13
Windows Impair Defense Delete Win Defender Profile Registry	Sysmon EventID 13	T1685	Anomaly	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Linux Doas Tool Execution	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Persistence Techniques, Linux Privilege Escalation	2026-05-13
Windows Explorer.exe Spawning PowerShell or Cmd	Windows Event Log Security 4688, Sysmon EventID 1	T1059.001 T1204.002	Hunting	ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day	2026-05-13
Allow File And Printing Sharing In Firewall	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1686.001	TTP	Hellcat Ransomware, Ransomware, BlackByte Ransomware	2026-05-13
Windows Scheduled Task with Highest Privileges	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1053.005	TTP	Quasar RAT, XWorm, CISA AA23-347A, Castle RAT, NetSupport RMM Tool Abuse, SolarWinds WHD RCE Post Exploitation, Scheduled Tasks, RedLine Stealer, AsyncRAT, Compromised Windows Host	2026-05-13
Samsam Test File Write	Sysmon EventID 11	T1486	TTP	SamSam Ransomware	2026-05-13
Wermgr Process Spawned CMD Or Powershell Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059	TTP	Qakbot, Trickbot	2026-05-13
Malicious PowerShell Process With Obfuscation Techniques	Sysmon EventID 1	T1059.001	TTP	Hermetic Wiper, Data Destruction, GhostRedirector IIS Module and Rungan Backdoor, Malicious PowerShell, Hellcat Ransomware	2026-05-13
Linux File Creation In Profile Directory	Sysmon for Linux EventID 11	T1546.004	Anomaly	Linux Persistence Techniques, Linux Privilege Escalation	2026-05-13
Windows System LogOff Commandline	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1529	Anomaly	XWorm, NjRAT, DarkCrystal RAT, Scattered Lapsus$ Hunters	2026-05-13
Windows EFI Bootloader File Modification	Sysmon EventID 11	T1542.003	TTP	Windows BootKits	2026-05-13
Windows Steal Authentication Certificates CertUtil Backup	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1649	Anomaly	Windows Certificate Services, Storm-2460 CLFS Zero Day Exploitation	2026-05-13
Detect Regasm Spawning a Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.009	TTP	Handala Wiper, Suspicious Regsvcs Regasm Activity, Living Off The Land, Void Manticore, DarkGate Malware, Snake Keylogger, Compromised Windows Host	2026-05-13
ETW Registry Disabled	Sysmon EventID 13	T1127 T1685	TTP	Hermetic Wiper, Data Destruction, CISA AA23-347A, Windows Registry Abuse, Windows Privilege Escalation, Windows Persistence Techniques	2026-05-13
Windows Office Product Dropped Cab or Inf File	Windows Event Log Security 4688, Sysmon EventID 1, Sysmon EventID 11	T1566.001	TTP	Microsoft MSHTML Remote Code Execution CVE-2021-40444, Spearphishing Attachments, Compromised Windows Host, APT37 Rustonotto and FadeStealer	2026-05-13
Linux Possible Access Or Modification Of sshd Config File	Sysmon for Linux EventID 1	T1098.004	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation	2026-05-13
Windows DNS Gather Network Info	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1590.002	Anomaly	Volt Typhoon, Sandworm Tools	2026-05-13
ICACLS Grant Command	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1222	Anomaly	XMRig, NetSupport RMM Tool Abuse, Ransomware, Defense Evasion or Unauthorized Access Via SDDL Tampering, Crypto Stealer	2026-05-13
Windows User Disabled Via Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1531	Anomaly	XMRig	2026-05-13
Windows Theme File Creation in Unusual Location	Sysmon EventID 11	T1021.002 T1187 T1557.001	Anomaly	Spearphishing Attachments	2026-05-13
Conti Common Exec parameter	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1204	TTP	Compromised Windows Host, Hellcat Ransomware, Ransomware	2026-05-13
Windows Office Product Spawned Child Process For Download	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1566.001	TTP	Spearphishing Attachments, NjRAT, CVE-2023-36884 Office and Windows HTML RCE Vulnerability, APT37 Rustonotto and FadeStealer, PlugX	2026-05-13
Windows SymbolicLink-Testing-Tools Utility Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1222 T1564.004	TTP	Windows Privilege Escalation, Windows Post-Exploitation, Windows Persistence Techniques	2026-05-13
Windows ISO LNK File Creation	Sysmon EventID 11	T1204.001 T1566.001	Hunting	Qakbot, AgentTesla, Warzone RAT, IcedID, Spearphishing Attachments, Gozi Malware, Brute Ratel C4, Azorult, Amadey, APT37 Rustonotto and FadeStealer, Remcos	2026-05-13
Windows Modify Registry to Add or Modify Firewall Rule	Sysmon EventID 13, Sysmon EventID 14	T1112	Anomaly	CISA AA24-241A, NetSupport RMM Tool Abuse, ShrinkLocker	2026-05-13
Linux GDB Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Service Initiation on Remote Endpoint	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1543.003	TTP	CISA AA23-347A, Active Directory Lateral Movement	2026-05-13
Local Account Discovery With Wmic	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1087.001	Hunting	Active Directory Discovery, Scattered Lapsus$ Hunters	2026-05-13
Domain Group Discovery With Wmic	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.002	Hunting	Active Directory Discovery	2026-05-13
Windows Defender ASR or Threat Configuration Tamper	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	TTP	Windows Defense Evasion Tactics	2026-05-13
Linux OpenVPN Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Suspect Process With Authentication Traffic	Sysmon EventID 3	T1087.002 T1204.002	Anomaly	Active Directory Discovery	2026-05-13
Windows New Default File Association Value Set	Sysmon EventID 13	T1546.001	Hunting	Hermetic Wiper, Data Destruction, Windows Privilege Escalation, Windows Registry Abuse, Windows Persistence Techniques, Prestige Ransomware	2026-05-13
Windows Sqlservr Spawning Shell	Windows Event Log Security 4688, Sysmon EventID 1	T1505.001	Hunting	SQL Server Abuse	2026-05-13
Windows Impair Defenses Disable Win Defender Auto Logging	Sysmon EventID 13	T1685	Anomaly	CISA AA23-347A, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Shell or Script Execution From IIS Directory	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1190 T1505.004	Anomaly	ProxyShell, ProxyNotShell	2026-05-13
Windows SOAPHound Binary Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.001 T1069.002 T1087.001 T1087.002 T1482	TTP	Windows Discovery Techniques, Compromised Windows Host	2026-05-13
Windows Modify Registry ValleyRat PWN Reg Entry	Sysmon EventID 13	T1112	TTP	ValleyRAT	2026-05-13
Suspicious Rundll32 PluginInit	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	TTP	IcedID	2026-05-13
Windows Set Custom DNS ServerLevelPlugin Via Dnscmd	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1574	Anomaly	Windows Persistence Techniques	2026-05-13
Prevent Automatic Repair Mode using Bcdedit	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1490	TTP	Void Manticore, Chaos Ransomware, Ransomware	2026-05-13
Advanced IP or Port Scanner Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1046 T1135	Anomaly	Windows Defense Evasion Tactics	2026-05-13
Linux Gem Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Linux Indicator Removal Clear Cache	Sysmon for Linux EventID 1	T1070	TTP	AwfulShred, Data Destruction	2026-05-13
Screensaver Event Trigger Execution	Sysmon EventID 13	T1546.002	TTP	Hermetic Wiper, Data Destruction, Windows Registry Abuse, Windows Privilege Escalation, Windows Persistence Techniques	2026-05-13
Windows Wmic Network Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1082	Anomaly	LAMEHUG	2026-05-13
Windows EventLog Recon Activity Using Log Query Utilities	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1654	Anomaly	Windows Discovery Techniques, BlankGrabber Stealer	2026-05-13
Windows Credentials from Web Browsers Saved in TEMP Folder	Sysmon EventID 11	T1555.003	TTP	Scattered Lapsus$ Hunters, Braodo Stealer	2026-05-13
Linux Deletion Of Cron Jobs	Sysmon for Linux EventID 11	T1070.004 T1485	Anomaly	AcidRain, AcidPour, Data Destruction	2026-05-13
Windows Security Account Manager Stopped	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1489	TTP	Ryuk Ransomware, Compromised Windows Host, Scattered Lapsus$ Hunters	2026-05-13
Windows DLL Side-Loading Process Child Of Calc	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1574.001	Anomaly	Qakbot, Earth Alux	2026-05-13
Windows Audit Policy Excluded Category via Auditpol	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685.001	Anomaly	Windows Audit Policy Tampering	2026-05-13
Unknown Process Using The Kerberos Protocol	Sysmon EventID 1, Sysmon EventID 3	T1550	TTP	BlackSuit Ransomware, Active Directory Kerberos Attacks	2026-05-13
Windows Rasautou DLL Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055.001 T1218	TTP	Hellcat Ransomware, Compromised Windows Host, Windows Defense Evasion Tactics	2026-05-13
Windows OneDrive Share Mounted via Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1567.002	Anomaly	Data Exfiltration	2026-05-13
Windows Phishing Outlook Drop Dll In FORM Dir	Sysmon EventID 1, Sysmon EventID 11	T1566	TTP	Outlook RCE CVE-2024-21378	2026-05-13
Windows Routing and Remote Access Service Registry Key Change	Sysmon EventID 13	T1112	Anomaly	Gh0st RAT	2026-05-13
Windows WSUS Spawning Shell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1190 T1505.003	TTP	Microsoft WSUS CVE-2025-59287	2026-05-13
Process Kill Base On File Path	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	TTP	XMRig	2026-05-13
Windows Modify Registry With MD5 Reg Key Name	Sysmon EventID 13	T1112	TTP	NjRAT	2026-05-13
DLLHost with no Command Line Arguments with Network	Sysmon EventID 1, Sysmon EventID 3	T1055	TTP	Storm-2460 CLFS Zero Day Exploitation, Cobalt Strike, BlackByte Ransomware, Earth Alux, Cactus Ransomware, Graceful Wipe Out Attack	2026-05-13
Windows Impair Defense Disable Win Defender App Guard	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Disable Windows App Hotkeys	Sysmon EventID 13	T1112 T1685	TTP	XMRig, Windows Registry Abuse	2026-05-13
Windows File and Directory Permissions Enable Inheritance	Windows Event Log Security 4688, Sysmon EventID 1	T1222.001	Hunting	Crypto Stealer, NetSupport RMM Tool Abuse	2026-05-13
SLUI Spawning a Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1548.002	TTP	Compromised Windows Host, Windows Defense Evasion Tactics, DarkSide Ransomware	2026-05-13
Windows Office Product Spawned Uncommon Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1566.001	TTP	Qakbot, AgentTesla, Warzone RAT, FIN7, MuddyWater, IcedID, CVE-2023-21716 Word RTF Heap Corruption, Spearphishing Attachments, APT37 Rustonotto and FadeStealer, NjRAT, DarkCrystal RAT, Azorult, CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Trickbot, Compromised Windows Host, Remcos, PlugX	2026-05-13
Windows Server Software Component GACUtil Install to GAC	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1505.004	TTP	IIS Components	2026-05-13
NET Profiler UAC bypass	Sysmon EventID 13	T1548.002	TTP	Windows Defense Evasion Tactics	2026-05-13
Windows Hide Notification Features Through Registry	Sysmon EventID 13	T1112	Anomaly	Windows Defense Evasion Tactics, Ransomware, Windows Registry Abuse	2026-05-13
Windows Chromium Process Launched with Logging Disabled	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1497	Anomaly	Browser Hijacking	2026-05-13
Windows MSTSC RDP Commandline	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.001	Anomaly	Windows RDP Artifacts and Defense Evasion, Medusa Ransomware	2026-05-13
MacOS Hidden Files and Directories	Osquery Results	T1564.001	Anomaly	MacOS Persistence Techniques	2026-05-13
Nishang PowershellTCPOneLine	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001	TTP	HAFNIUM Group, Cleo File Transfer Software	2026-05-13
Windows Process With NetExec Command Line Parameters	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1550.003 T1558.003 T1558.004	TTP	Active Directory Kerberos Attacks, Active Directory Privilege Escalation	2026-05-13
Windows Compatibility Telemetry Tampering Through Registry	Sysmon EventID 13	T1053.005 T1546	TTP	Windows Persistence Techniques	2026-05-13
Windows WinLogon with Public Network Connection	Sysmon EventID 1, Sysmon EventID 3	T1542.003	Hunting	BlackLotus Campaign	2026-05-13
Disable Show Hidden Files	Sysmon EventID 13	T1112 T1564.001 T1685	Anomaly	Windows Defense Evasion Tactics, Azorult, Windows Registry Abuse	2026-05-13
Windows Mustang Panda USB Tool Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1020 T1204.002 T1574.001	TTP	Compromised Windows Host	2026-05-13
Windows WinRAR Launched Outside Default Installation Directory	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1047	Anomaly	BlankGrabber Stealer	2026-05-13
GetDomainComputer with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1018	TTP	Active Directory Discovery	2026-05-13
Windows User Deletion Via Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1531	Anomaly	XMRig, Graceful Wipe Out Attack, DarkGate Malware	2026-05-13
Mshta spawning Rundll32 OR Regsvr32 Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.005	TTP	IcedID, Living Off The Land, Trickbot, APT37 Rustonotto and FadeStealer	2026-05-13
Services Escalate Exe	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1548	TTP	Cobalt Strike, BlackByte Ransomware, CISA AA23-347A, Graceful Wipe Out Attack, Compromised Windows Host	2026-05-13
Scheduled Task Creation on Remote Endpoint using At	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1053.002	TTP	Living Off The Land, Scheduled Tasks, Active Directory Lateral Movement, 0bj3ctivity Stealer	2026-05-13
Windows Registry Payload Injection	Sysmon EventID 13	T1027.011	TTP	Unusual Processes	2026-05-13
Windows MpCmdRun RemoveDefinitions Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Anomaly	BlankGrabber Stealer	2026-05-13
Windows Change File Association Command To Notepad	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1546.001	TTP	Prestige Ransomware, Compromised Windows Host	2026-05-13
Windows MsiExec HideWindow Rundll32 Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.007	TTP	Qakbot, Water Gamayun	2026-05-13
Detect Password Spray Attack Behavior From Source	Windows Event Log Security 4625, Windows Event Log Security 4624	T1110.003	TTP	Compromised User Account	2026-05-13
Schtasks Run Task On Demand	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1053	Anomaly	CISA AA22-257A, XMRig, Data Destruction, Qakbot, Industroyer2, Medusa Ransomware, Scheduled Tasks	2026-05-13
Windows Command Obfuscation with Environment Variable Substrings	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1027.010	Anomaly	Malicious PowerShell	2026-05-13
Windows WinDBG Spawning AutoIt3	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059	TTP	Compromised Windows Host, DarkGate Malware	2026-05-13
Windows Azure Storage Utility Execution Via CLI	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1567.002	Anomaly	Data Exfiltration	2026-05-13
Windows PowerShell Script From WindowsApps Directory	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001 T1204.002	TTP	Malicious PowerShell, MSIX Package Abuse	2026-05-13
Windows AutoIt3 Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059	TTP	DarkGate Malware, Void Manticore, Crypto Stealer, Handala Wiper	2026-05-13
Windows Modify Registry USeWuServer	Sysmon EventID 13	T1112	Hunting	RedLine Stealer	2026-05-13
Spoolsv Writing a DLL	Windows Event Log Security 4688, Sysmon EventID 1, Sysmon EventID 11	T1547.012	TTP	Black Basta Ransomware, PrintNightmare CVE-2021-34527, Compromised Windows Host	2026-05-13
Windows Enable Win32 ScheduledJob via Registry	Sysmon EventID 13	T1053.005	Anomaly	Scheduled Tasks, Active Directory Lateral Movement	2026-05-13
Windows System Reboot CommandLine	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1529	Hunting	Quasar RAT, XWorm, MoonPeak, MuddyWater, NjRAT, DarkCrystal RAT, Scattered Lapsus$ Hunters, DarkGate Malware	2026-05-13
Clop Common Exec Parameter	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1204	TTP	Clop Ransomware, Compromised Windows Host	2026-05-13
Windows File Collection Via Copy Utilities	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1119	Anomaly	LAMEHUG	2026-05-13
Windows Privilege Escalation User Process Spawn System Process	Sysmon EventID 1	T1068 T1134 T1548	TTP	GhostRedirector IIS Module and Rungan Backdoor, BlackSuit Ransomware, Compromised Windows Host, Windows Privilege Escalation	2026-05-13
Windows WMI Process And Service List	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1047	Anomaly	Prestige Ransomware, Windows Post-Exploitation	2026-05-13
Windows Audit Policy Restored via Auditpol	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685.001	Anomaly	Windows Audit Policy Tampering	2026-05-13
Remcos client registry install entry	Sysmon EventID 13, Sysmon EventID 12	T1112	TTP	Remcos, Windows Registry Abuse	2026-05-13
IcedID Exfiltrated Archived File Creation	Sysmon EventID 11	T1560.001	Hunting	IcedID, APT37 Rustonotto and FadeStealer	2026-05-13
Disable Schedule Task	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Anomaly	IcedID, Living Off The Land	2026-05-13
Detect Prohibited Applications Spawning cmd exe	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.003	Hunting	NOBELIUM Group, Suspicious Command-Line Executions, Suspicious Zoom Child Processes, Suspicious MSHTA Activity	2026-05-13
Suspicious DLLHost no Command Line Arguments	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055	TTP	Cactus Ransomware, Cobalt Strike, Graceful Wipe Out Attack, BlackByte Ransomware	2026-05-13
Windows Filtering Platform Policy Added to Block EDR Process	Sysmon EventID 13	T1685	TTP	Disabling Security Tools, Security Solution Tampering	2026-05-13
Windows Process Execution From RDP Share	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.001 T1059 T1105	Anomaly	Hidden Cobra Malware	2026-05-13
Add DefaultUser And Password In Registry	Sysmon EventID 13, Sysmon EventID 12	T1552.002	Anomaly	BlackMatter Ransomware	2026-05-13
Windows Cisco Secure Endpoint Unblock File Via Sfc	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Anomaly	Security Solution Tampering	2026-05-13
Windows File Association Modification via Ftype	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.003	Anomaly	Windows File Extension and Association Abuse	2026-05-13
Linux pkexec Privilege Escalation	Sysmon for Linux EventID 1	T1068	TTP	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
File with Samsam Extension	Sysmon EventID 11	N/A	TTP	SamSam Ransomware, Hellcat Ransomware	2026-05-13
Windows Gdrive Binary Activity	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1567	TTP	China-Nexus Threat Activity	2026-05-13
Suspicious Copy on System32	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003	Anomaly	Compromised Windows Host, Qakbot, Volt Typhoon, IcedID, AsyncRAT, Unusual Processes, Water Gamayun, Sandworm Tools	2026-05-13
Suspicious PlistBuddy Usage	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1543.001	TTP	Silver Sparrow	2026-05-13
Windows Remote Management Execute Shell	Windows Event Log Security 4688, Sysmon EventID 1	T1021.006	Anomaly	Crypto Stealer	2026-05-13
Potential System Network Configuration Discovery Activity	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1016	Anomaly	Unusual Processes	2026-05-13
Change To Safe Mode With Network Config	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1490	TTP	Black Basta Ransomware, BlackMatter Ransomware	2026-05-13
Windows Credentials from Password Stores Query	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1555	Anomaly	NetSupport RMM Tool Abuse, Prestige Ransomware, Windows Post-Exploitation, DarkGate Malware	2026-05-13
Suspicious Linux Discovery Commands	Sysmon for Linux EventID 1	T1059.004	TTP	VoidLink Cloud-Native Linux Malware, Linux Post-Exploitation	2026-05-13
Rundll32 with no Command Line Arguments with Network	Sysmon EventID 1, Sysmon EventID 3	T1218.011	TTP	Compromised Windows Host, Cobalt Strike, BlackByte Ransomware, Cactus Ransomware, BlackSuit Ransomware, PrintNightmare CVE-2021-34527, Graceful Wipe Out Attack, Suspicious Rundll32 Activity	2026-05-13
MacOS LoginHook Persistence	Osquery Results	T1037.002	TTP	MacOS Post-Exploitation	2026-05-13
SearchProtocolHost with no Command Line with Network	Sysmon EventID 1, Sysmon EventID 3	T1055	TTP	Cobalt Strike, BlackByte Ransomware, Cactus Ransomware, Hellcat Ransomware, Graceful Wipe Out Attack, Compromised Windows Host	2026-05-13
SilentCleanup UAC Bypass	Sysmon EventID 13	T1548.002	TTP	MoonPeak, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Ryuk Wake on LAN Command	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.003	TTP	Ryuk Ransomware, Compromised Windows Host, Hellcat Ransomware	2026-05-13
Windows Privilege Escalation Suspicious Process Elevation	Sysmon EventID 1	T1068 T1134 T1548	TTP	GhostRedirector IIS Module and Rungan Backdoor, BlackSuit Ransomware, Windows Privilege Escalation	2026-05-13
WinRAR Spawning Shell Application	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1105	TTP	WinRAR Spoofing Attack CVE-2023-38831, Compromised Windows Host	2026-05-13
Linux Service Started Or Enabled	Sysmon for Linux EventID 1	T1053.006	Anomaly	Linux Persistence Techniques, Gomir, Linux Privilege Escalation, Scheduled Tasks, Linux Living Off The Land	2026-05-13
Windows Process Injection In Non-Service SearchIndexer	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055	TTP	Qakbot	2026-05-13
Windows PsTools Recon Usage	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1018 T1046 T1082	Anomaly	Compromised Windows Host	2026-05-13
Linux Service Restarted	Sysmon for Linux EventID 1	T1053.006	Anomaly	Linux Persistence Techniques, Data Destruction, Gomir, Linux Privilege Escalation, Scheduled Tasks, AwfulShred, Linux Living Off The Land	2026-05-13
Windows RDP Server Registry Deletion	Sysmon EventID 13, Sysmon EventID 12	T1070.004	Anomaly	Windows RDP Artifacts and Defense Evasion	2026-05-13
Disabling NoRun Windows App	Sysmon EventID 13	T1112 T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Potential Web Shell Creation For VMware Workspace ONE	Sysmon EventID 11	T1505.003	Anomaly	VMware Aria Operations vRealize CVE-2023-20887, VMware Server Side Injection and Privilege Escalation, VMware ESXi AD Integration Authentication Bypass CVE-2024-37085	2026-05-13
Sdelete Application Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1070.004 T1485	TTP	Void Manticore, Masquerading - Rename System Utilities, Scattered Spider	2026-05-13
Windows Modify Registry ValleyRAT C2 Config	Sysmon EventID 13	T1112	TTP	ValleyRAT	2026-05-13
Linux Add Files In Known Crontab Directories	Sysmon for Linux EventID 11	T1053.003	Anomaly	Linux Persistence Techniques, XorDDos, Linux Privilege Escalation, Scheduled Tasks, Linux Living Off The Land	2026-05-13
Windows Remote Services Rdp Enable	Sysmon EventID 13	T1021.001	TTP	Windows RDP Artifacts and Defense Evasion, BlackSuit Ransomware, Medusa Ransomware, Azorult	2026-05-13
GetWmiObject DS User with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1087.002	Anomaly	Active Directory Discovery	2026-05-13
Windows DiskCryptor Usage	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1486	Hunting	Ransomware	2026-05-13
Windows Scheduled Task Created Via XML	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1053.005	Anomaly	Winter Vivern, Lokibot, Malicious Inno Setup Loader, CISA AA23-347A, MoonPeak, Scheduled Tasks	2026-05-13
Windows Findstr GPP Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1552.006	TTP	Active Directory Privilege Escalation	2026-05-13
Windows ComputerDefaults Spawning a Process	Sysmon EventID 1	T1548.002	TTP	Castle RAT, BlankGrabber Stealer	2026-05-13
Linux Possible Cronjob Modification With Editor	Sysmon for Linux EventID 1	T1053.003	Hunting	Linux Persistence Techniques, XorDDos, Linux Privilege Escalation, Scheduled Tasks, Linux Living Off The Land	2026-05-13
Suspicious msbuild path	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003 T1127.001	TTP	Storm-2460 CLFS Zero Day Exploitation, Cobalt Strike, BlackByte Ransomware, Trusted Developer Utilities Proxy Execution MSBuild, Living Off The Land, Masquerading - Rename System Utilities, Graceful Wipe Out Attack	2026-05-13
Windows SnappyBee Create Test Registry	Sysmon EventID 13	T1112	TTP	SnappyBee, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Anomaly	Security Solution Tampering	2026-05-13
Windows System Network Config Discovery Display DNS	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1016	Anomaly	Prestige Ransomware, Windows Post-Exploitation, Medusa Ransomware, Water Gamayun	2026-05-13
Unusually Long Command Line	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	N/A	Anomaly	Unusual Processes, Suspicious Command-Line Executions, Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns, Ransomware	2026-05-13
Windows Modify System Firewall with Notable Process Path	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1686	TTP	Compromised Windows Host, NjRAT, Medusa Ransomware	2026-05-13
Windows UAC Bypass Suspicious Escalation Behavior	Sysmon EventID 1	T1548.002	TTP	Living Off The Land, Compromised Windows Host, Windows Defense Evasion Tactics	2026-05-13
Windows Impair Defense Disable Win Defender Compute File Hashes	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Office Product Spawned Control	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1566.001	TTP	Microsoft MSHTML Remote Code Execution CVE-2021-40444, Spearphishing Attachments, Compromised Windows Host	2026-05-13
Runas Execution in CommandLine	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1134.001	Hunting	Hermetic Wiper, Windows Privilege Escalation, Data Destruction, Quasar RAT	2026-05-13
Outbound Network Connection from Java Using Default Ports	Sysmon EventID 1, Sysmon EventID 3	T1133 T1190	TTP	Log4Shell CVE-2021-44228	2026-05-13
Windows InProcServer32 New Outlook Form	Sysmon EventID 13	T1112 T1566	Anomaly	Outlook RCE CVE-2024-21378	2026-05-13
Windows ConHost with Headless Argument	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1564.003 T1564.006	TTP	Spearphishing Attachments, Compromised Windows Host	2026-05-13
Uninstall App Using MsiExec	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.007	TTP	Ransomware	2026-05-13
Linux At Allow Config File Creation	Sysmon for Linux EventID 11	T1053.003	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation	2026-05-13
Windows RDP Bitmap Cache File Creation	Sysmon EventID 11	T1021.001	Anomaly	Windows RDP Artifacts and Defense Evasion	2026-05-13
Windows Excessive Usage Of Net App	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1531	Anomaly	XMRig, Ransomware, Rhysida Ransomware, Windows Post-Exploitation, Azorult, Graceful Wipe Out Attack, Prestige Ransomware	2026-05-13
Windows Rundll32 Apply User Settings Changes	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	Anomaly	Rhysida Ransomware	2026-05-13
Windows Phishing Recent ISO Exec Registry	Sysmon EventID 13	T1566.001	Hunting	Qakbot, AgentTesla, Warzone RAT, IcedID, Gozi Malware, Azorult, Brute Ratel C4, Remcos	2026-05-13
Windows Impair Defense Disable Win Defender Gen reports	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Audit Policy Cleared via Auditpol	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685.001	TTP	Windows Audit Policy Tampering	2026-05-13
Revil Registry Entry	Sysmon EventID 13, Sysmon EventID 12	T1112	TTP	Revil Ransomware, Ransomware, Windows Registry Abuse	2026-05-13
Linux Impair Defenses Process Kill	Sysmon for Linux EventID 1	T1685	Hunting	AwfulShred, Scattered Lapsus$ Hunters, Data Destruction	2026-05-13
Suspicious SQLite3 LSQuarantine Behavior	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1074	TTP	Silver Sparrow	2026-05-13
Linux Disable Services	Sysmon for Linux EventID 1	T1489	TTP	AwfulShred, Industroyer2, Data Destruction	2026-05-13
Windows .Key File Creation in Root Directory	Sysmon EventID 11	T1486	Anomaly	Ransomware	2026-05-13
Windows Netspy Network Scanner Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1018 T1595	Anomaly	Windows Discovery Techniques, Network Discovery	2026-05-13
Linux Emacs Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Rundll32 WebDAV Request	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1048.003	Hunting	CVE-2023-23397 Outlook Elevation of Privilege	2026-05-13
Linux Telnet Authentication Bypass	Sysmon for Linux EventID 1	T1548	TTP	Telnetd CVE-2026-24061	2026-05-13
Windows Excel Spawning Microsoft Project Application	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.003	Anomaly	PathWiper	2026-05-13
Detect Regsvcs with No Command Line Arguments	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.009	TTP	Suspicious Regsvcs Regasm Activity, Living Off The Land	2026-05-13
Curl Execution with Percent Encoded URL	Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1, Sysmon for Linux EventID 1	T1027 T1105	Anomaly	Living Off The Land, Ingress Tool Transfer, Compromised Windows Host	2026-05-13
Windows Chromium Process Loaded Extension via Command-Line	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1185	Anomaly	Browser Hijacking	2026-05-13
Active Directory Privilege Escalation Identified		T1484	Correlation	Active Directory Privilege Escalation	2026-05-13
Detect Regasm with no Command Line Arguments	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.009	TTP	Suspicious Regsvcs Regasm Activity, Living Off The Land, Void Manticore, Handala Wiper	2026-05-13
Get ADUserResultantPasswordPolicy with Powershell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1201	TTP	CISA AA23-347A, Active Directory Discovery	2026-05-13
Windows Remote Services Allow Remote Assistance	Sysmon EventID 13	T1021.001	Anomaly	Azorult	2026-05-13
Windows Office Product Spawned Rundll32 With No DLL	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1566.001	TTP	Compromised Windows Host, Spearphishing Attachments, Graceful Wipe Out Attack, Prestige Ransomware, CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Crypto Stealer	2026-05-13
Sdclt UAC Bypass	Sysmon EventID 13, Sysmon EventID 12	T1548.002	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Detect AzureHound File Modifications	Sysmon EventID 11	T1069.001 T1069.002 T1087.001 T1087.002 T1482	TTP	Windows Discovery Techniques	2026-05-13
Linux Change File Owner To Root	Sysmon for Linux EventID 1	T1222.002	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation	2026-05-13
Windows Suspicious VMWare Tools Child Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059	TTP	ESXi Post Compromise, China-Nexus Threat Activity	2026-05-13
Windows Steal or Forge Kerberos Tickets Klist	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1558	Hunting	Prestige Ransomware, Windows Post-Exploitation	2026-05-13
Detect Outlook exe writing a zip file	Sysmon EventID 1, Sysmon EventID 11	T1566.001	Anomaly	Meduza Stealer, PXA Stealer, Spearphishing Attachments, Amadey, APT37 Rustonotto and FadeStealer, Remcos	2026-05-13
Windows Outlook Dialogs Disabled from Unusual Process	Sysmon EventID 13	T1112 T1685	TTP	NotDoor Malware, Windows Registry Abuse	2026-05-13
Windows Modify Registry Auto Minor Updates	Sysmon EventID 13	T1112	Hunting	RedLine Stealer	2026-05-13
Windows Metasploit Confluence Plugin Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1190 T1505.003 T1608	TTP	Confluence Data Center and Confluence Server Vulnerabilities	2026-05-13
Winhlp32 Spawning a Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055	TTP	Compromised Windows Host, Remcos	2026-05-13
Windows Command and Scripting Interpreter Hunting Path Traversal	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059	Hunting	Windows Defense Evasion Tactics, Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190	2026-05-13
Windows Schtasks Create Run As System	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1053.005	TTP	Qakbot, Medusa Ransomware, SolarWinds WHD RCE Post Exploitation, Scheduled Tasks, Windows Persistence Techniques, Castle RAT	2026-05-13
GPUpdate with no Command Line Arguments with Network	Sysmon EventID 1, Sysmon EventID 3	T1055	TTP	Cobalt Strike, BlackByte Ransomware, Hellcat Ransomware, Graceful Wipe Out Attack, Compromised Windows Host	2026-05-13
Linux Visudo Utility Execution	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Persistence Techniques, Linux Privilege Escalation	2026-05-13
Windows Default Group Policy Object Modified with GPME	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1484.001	TTP	Sneaky Active Directory Persistence Tricks, Active Directory Privilege Escalation	2026-05-13
Wsmprovhost LOLBAS Execution Process Spawn	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.006	TTP	CISA AA24-241A, Hellcat Ransomware, Active Directory Lateral Movement	2026-05-13
Network Connection Discovery With Netstat	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1049	Hunting	CISA AA22-277A, Qakbot, CISA AA23-347A, Volt Typhoon, Medusa Ransomware, Windows Post-Exploitation, Prestige Ransomware, Active Directory Discovery, PlugX	2026-05-13
Windows SpeechRuntime Suspicious Child Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.003	TTP	Compromised Windows Host, Active Directory Lateral Movement	2026-05-13
Linux Find Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows User Execution Malicious URL Shortcut File	Sysmon EventID 11	T1204.002	Anomaly	Chaos Ransomware, Quasar RAT, XWorm, NjRAT, Snake Keylogger, APT37 Rustonotto and FadeStealer	2026-05-13
Excessive Usage Of Taskkill	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Anomaly	CISA AA22-277A, XMRig, CISA AA22-264A, AgentTesla, BlankGrabber Stealer, NjRAT, Azorult, Crypto Stealer	2026-05-13
Windows Njrat Fileless Storage via Registry	Sysmon EventID 13	T1027.011	TTP	NjRAT	2026-05-13
Windows Advanced Installer MSIX with AI_STUBS Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1204.002 T1218 T1553.005	TTP	MSIX Package Abuse	2026-05-13
Windows Process Commandline Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1057	Hunting	CISA AA23-347A	2026-05-13
Windows Default RDP File Creation By Non MSTSC Process	Sysmon EventID 1, Sysmon EventID 11	T1021.001	Anomaly	Windows RDP Artifacts and Defense Evasion	2026-05-13
Linux Csvtool Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Suspicious Image Creation In Appdata Folder	Sysmon EventID 1, Sysmon EventID 11	T1113	TTP	APT37 Rustonotto and FadeStealer, Remcos	2026-05-13
Windows System Remote Discovery With Query	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1033	Hunting	Active Directory Discovery, Medusa Ransomware	2026-05-13
Linux Medusa Rootkit	Sysmon for Linux EventID 11	T1014 T1589.001	TTP	Hellcat Ransomware, VoidLink Cloud-Native Linux Malware, China-Nexus Threat Activity, Medusa Rootkit	2026-05-13
Windows List ENV Variables Via SET Command From Uncommon Parent	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055	Anomaly	Qakbot	2026-05-13
Windows Deleted Registry By A Non Critical Process File Path	Sysmon EventID 1, Sysmon EventID 12	T1112	Anomaly	Double Zero Destructor, Data Destruction	2026-05-13
Windows Archive Collected Data via Rar	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1560.001	Anomaly	China-Nexus Threat Activity, APT37 Rustonotto and FadeStealer, Salt Typhoon, DarkGate Malware	2026-05-13
Notepad with no Command Line Arguments	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055	TTP	BishopFox Sliver Adversary Emulation Framework	2026-05-13
Ryuk Test Files Detected	Sysmon EventID 11	T1486	TTP	Ryuk Ransomware	2026-05-13
Windows Impair Defense Add Xml Applocker Rules	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Hunting	Azorult	2026-05-13
Windows Time Based Evasion via Choice Exec	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1497.003	Anomaly	Snake Keylogger, VIP Keylogger, 0bj3ctivity Stealer	2026-05-13
Spike in File Writes	Sysmon EventID 11	N/A	Anomaly	Ryuk Ransomware, SamSam Ransomware, Ransomware, Rhysida Ransomware	2026-05-13
Suspicious mshta spawn	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.005	TTP	Living Off The Land, APT37 Rustonotto and FadeStealer, Suspicious MSHTA Activity	2026-05-13
Linux File Created In Kernel Driver Directory	Sysmon for Linux EventID 11	T1547.006	Anomaly	Linux Persistence Techniques, Linux Rootkit, Linux Privilege Escalation	2026-05-13
Impacket Lateral Movement Commandline Parameters	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.002 T1021.003 T1047 T1543.003	TTP	CISA AA22-277A, Storm-0501 Ransomware, Data Destruction, Volt Typhoon, Industroyer2, Gozi Malware, Graceful Wipe Out Attack, WhisperGate, Prestige Ransomware, Compromised Windows Host, Active Directory Lateral Movement	2026-05-13
7zip CommandLine To SMB Share Path	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1560.001	Hunting	Ransomware	2026-05-13
Windows Potential Cloudflared Network Connection	Sysmon EventID 3	T1572	Hunting	Reverse Network Proxy	2026-05-13
Excessive number of service control start as disabled	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Anomaly	Windows Defense Evasion Tactics	2026-05-13
GetAdComputer with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1018	Hunting	Active Directory Discovery, Medusa Ransomware	2026-05-13
Windows Privilege Escalation Attempt Via MSI Rollback	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1068	TTP	Windows Privilege Escalation	2026-05-13
Windows Cached Domain Credentials Reg Query	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.005	Anomaly	Prestige Ransomware, Windows Post-Exploitation	2026-05-13
Permission Modification using Takeown App	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1222	Anomaly	Scattered Lapsus$ Hunters, Crypto Stealer, Ransomware, Sandworm Tools	2026-05-13
Windows Raccine Scheduled Task Deletion	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	TTP	Compromised Windows Host, Ransomware	2026-05-13
Suspicious IcedID Rundll32 Cmdline	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	TTP	IcedID, Living Off The Land	2026-05-13
Linux Deleting Critical Directory Using RM Command	Sysmon for Linux EventID 1	T1485	TTP	AwfulShred, Industroyer2, Data Destruction	2026-05-13
Windows RunMRU Registry Key or Value Deleted	Sysmon EventID 12	T1112	Anomaly	NetSupport RMM Tool Abuse	2026-05-13
SecretDumps Offline NTDS Dumping Tool	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003.003	TTP	Storm-0501 Ransomware, Rhysida Ransomware, Credential Dumping, Graceful Wipe Out Attack, Compromised Windows Host	2026-05-13
Windows Replication Through Removable Media	Sysmon EventID 11	T1091	TTP	Chaos Ransomware, Derusbi, NjRAT, China-Nexus Threat Activity, Salt Typhoon, APT37 Rustonotto and FadeStealer, PlugX	2026-05-13
Allow Operation with Consent Admin	Sysmon EventID 13	T1548	TTP	Azorult, MoonPeak, Ransomware, Windows Registry Abuse	2026-05-13
Linux APT Privilege Escalation	Cisco Isovalent Process Exec, Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Malicious InProcServer32 Modification	Sysmon EventID 13, Sysmon EventID 12	T1112 T1218.010	TTP	Remcos, Suspicious Regsvr32 Activity	2026-05-13
Windows New Service Security Descriptor Set Via Sc.EXE	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1564	Anomaly	Defense Evasion or Unauthorized Access Via SDDL Tampering	2026-05-13
Windows Execute Arbitrary Commands with MSDT	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218	TTP	Compromised Windows Host, Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190	2026-05-13
Disabling Defender Services	Sysmon EventID 13	T1685	TTP	IcedID, RedLine Stealer, Windows Registry Abuse	2026-05-13
Check Elevated CMD using whoami	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1033	TTP	FIN7	2026-05-13
Linux MySQL Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Disable Defender Spynet Reporting	Sysmon EventID 13	T1685	TTP	Qakbot, CISA AA23-347A, Windows Registry Abuse, IcedID, Azorult	2026-05-13
Detect RTLO In File Name	Sysmon EventID 11	T1036.002	TTP	Spearphishing Attachments	2026-05-13
Windows Outlook Macro Security Modified	Sysmon EventID 13	T1008 T1137	TTP	NotDoor Malware, Windows Registry Abuse	2026-05-13
Linux Possible Append Cronjob Entry on Existing Cronjob File	Sysmon for Linux EventID 1	T1053.003	Hunting	Linux Persistence Techniques, XorDDos, Linux Privilege Escalation, Scheduled Tasks, Linux Living Off The Land	2026-05-13
Detect Exchange Web Shell	Sysmon EventID 11	T1133 T1190 T1505.003	TTP	CISA AA22-257A, Seashell Blizzard, BlackByte Ransomware, HAFNIUM Group, GhostRedirector IIS Module and Rungan Backdoor, ProxyShell, ProxyNotShell, Compromised Windows Host	2026-05-13
Windows IOBit Unlocker Extension DLL Registration via Regsvr32	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.010	TTP	Compromised Windows Host	2026-05-13
Linux Hardware Addition SwapOff	Sysmon for Linux EventID 1	T1200	Anomaly	AwfulShred, Scattered Lapsus$ Hunters, Data Destruction	2026-05-13
Linux High Frequency Of File Deletion In Etc Folder	Sysmon for Linux EventID 11	T1070.004 T1485	Anomaly	AcidRain, Data Destruction	2026-05-13
Excessive Usage Of SC Service Utility	Sysmon EventID 1	T1569.002	Anomaly	Crypto Stealer, Azorult, Ransomware	2026-05-13
Windows Binary Execution from an Archive	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1204.002	Anomaly	Spearphishing Attachments	2026-05-13
Remote Process Instantiation via WMI and PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1047	TTP	Compromised Windows Host, Active Directory Lateral Movement	2026-05-13
Windows MSIExec Spawn Discovery Command	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.007	Anomaly	StealC Stealer, Medusa Ransomware, Windows System Binary Proxy Execution MSIExec, Water Gamayun	2026-05-13
Detect Excessive Account Lockouts From Endpoint		T1078.002	Anomaly	Active Directory Password Spraying	2026-05-13
Linux Persistence and Privilege Escalation Risk Behavior		T1548	Correlation	Linux Persistence Techniques, Linux Privilege Escalation	2026-05-13
WSReset UAC Bypass	Sysmon EventID 13, Sysmon EventID 12	T1548.002	TTP	Living Off The Land, MoonPeak, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Detect Network Scanner Behavior	Sysmon EventID 3	T1595.001 T1595.002	Anomaly	Windows Discovery Techniques, Network Discovery	2026-05-13
Linux Busybox Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Remote Process Instantiation via WinRM and PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.006	TTP	Active Directory Lateral Movement	2026-05-13
Remote Process Instantiation via WinRM and Winrs	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.006	TTP	Active Directory Lateral Movement	2026-05-13
Linux Service File Created In Systemd Directory	Sysmon for Linux EventID 11	T1053.006	Anomaly	Linux Persistence Techniques, Gomir, VoidLink Cloud-Native Linux Malware, Linux Privilege Escalation, Scheduled Tasks, China-Nexus Threat Activity, Linux Living Off The Land	2026-05-13
Windows Masquerading Msdtc Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036	TTP	Compromised Windows Host, PlugX	2026-05-13
Windows XLL File Creation Outside of Typical Location	Sysmon EventID 11	T1059 T1129	Anomaly	Spearphishing Attachments	2026-05-13
Windows Process Executed From Removable Media	Sysmon EventID 1, Sysmon EventID 13	T1025 T1091 T1200	Anomaly	Data Protection, APT37 Rustonotto and FadeStealer	2026-05-13
Windows TeamCity Payload Execution from Temp Directory	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059 T1190 T1505.003	TTP	JetBrains TeamCity Unauthenticated RCE, JetBrains TeamCity Vulnerabilities	2026-05-13
Windows Office Product Dropped Uncommon File	Sysmon EventID 1, Sysmon EventID 11	T1566.001	Anomaly	AgentTesla, Warzone RAT, FIN7, CVE-2023-21716 Word RTF Heap Corruption, Compromised Windows Host, PlugX	2026-05-13
Windows Impair Defense Disable Realtime Signature Delivery	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Living Off The Land Detection		T1059 T1105 T1133 T1190	Correlation	Living Off The Land, Hellcat Ransomware	2026-05-13
Windows Impair Defense Delete Win Defender Context Menu	Sysmon EventID 13	T1685	Hunting	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Apache Benchmark Binary	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059	Anomaly	MetaSploit	2026-05-13
Fsutil Zeroing File	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1070	TTP	LockBit Ransomware, Ransomware	2026-05-13
Windows NorthStar C2 Agent Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1204.002 T1547.001 T1608	TTP	Compromised Windows Host	2026-05-13
Disabling FolderOptions Windows Feature	Sysmon EventID 13	T1685	TTP	CISA AA23-347A, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Linux Cpulimit Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Anomaly	Security Solution Tampering	2026-05-13
Windows BitLocker Suspicious Command Usage	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1486 T1490	TTP	ShrinkLocker	2026-05-13
Disable Defender MpEngine Registry	Sysmon EventID 13	T1685	TTP	IcedID, Windows Registry Abuse	2026-05-13
Linux Octave Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Enable RDP In Other Port Number	Sysmon EventID 13	T1021	TTP	Windows RDP Artifacts and Defense Evasion, Interlock Ransomware, Prohibited Traffic Allowed or Protocol Mismatch, Windows Registry Abuse	2026-05-13
Detect Certify Command Line Arguments	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1105 T1649	TTP	Windows Certificate Services, Ingress Tool Transfer, Compromised Windows Host	2026-05-13
Windows MSC EvilTwin Directory Path Manipulation	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.005 T1203 T1218	TTP	Living Off The Land, Windows Defense Evasion Tactics, Water Gamayun	2026-05-13
Windows System User Privilege Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1033	Hunting	CISA AA23-347A	2026-05-13
Linux Node Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Linux Possible Access To Sudoers File	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Persistence Techniques, Linux Privilege Escalation, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Active Setup Registry Autostart	Sysmon EventID 13	T1547.014	TTP	Hermetic Wiper, Windows Persistence Techniques, Data Destruction, Windows Privilege Escalation	2026-05-13
Windows Registry Entries Restored Via Reg	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1012	Hunting	Prestige Ransomware, Windows Post-Exploitation	2026-05-13
Suspicious Rundll32 no Command Line Arguments	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	TTP	Cobalt Strike, BlackByte Ransomware, PrintNightmare CVE-2021-34527, Hellcat Ransomware, Graceful Wipe Out Attack, Suspicious Rundll32 Activity	2026-05-13
Disable Defender BlockAtFirstSeen Feature	Sysmon EventID 13	T1685	TTP	CISA AA23-347A, SolarWinds WHD RCE Post Exploitation, Windows Registry Abuse, IcedID, Azorult	2026-05-13
Windows Credentials in Registry Reg Query	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1552.002	Anomaly	Prestige Ransomware, Windows Post-Exploitation	2026-05-13
Windows Potential Cloudflared Tunnel Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1572	Anomaly	Reverse Network Proxy	2026-05-13
Windows Impair Defense Disable Controlled Folder Access	Sysmon EventID 13	T1685	TTP	BlankGrabber Stealer, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Impair Defense Disable Defender Protocol Recognition	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Scattered Lapsus$ Hunters, Windows Registry Abuse	2026-05-13
Allow Inbound Traffic By Firewall Rule Registry	Sysmon EventID 13	T1021.001	TTP	Medusa Ransomware, Prohibited Traffic Allowed or Protocol Mismatch, Windows Registry Abuse, NjRAT, Azorult, PlugX	2026-05-13
Windows New Deny Permission Set On Service SD Via Sc.EXE	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1564	Anomaly	Defense Evasion or Unauthorized Access Via SDDL Tampering	2026-05-13
Windows Compatibility Telemetry Suspicious Child Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1053.005 T1546	TTP	Windows Persistence Techniques	2026-05-13
Linux Deletion of SSL Certificate	Sysmon for Linux EventID 11	T1070.004 T1485	Anomaly	AcidRain, AcidPour	2026-05-13
Windows RDP Client Launched with Admin Session	Sysmon EventID 1	T1021.001	Anomaly	Windows RDP Artifacts and Defense Evasion	2026-05-13
Windows Wmic DiskDrive Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1082	Anomaly	LAMEHUG	2026-05-13
Windows Potential AppDomainManager Hijack Artifacts Creation	Sysmon EventID 11	T1574.014	Anomaly	SesameOp	2026-05-13
Windows Registry Delete Task SD	Sysmon EventID 12	T1053.005 T1685	Anomaly	Scheduled Tasks, Windows Persistence Techniques, Windows Registry Abuse	2026-05-13
Windows PuTTY Suite Utility Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.004	Anomaly	Active Directory Lateral Movement, Command And Control	2026-05-13
Windows PaperCut NG Spawn Shell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059 T1133 T1190	TTP	PaperCut MF NG Vulnerability, Compromised Windows Host	2026-05-13
Active Directory Lateral Movement Identified		T1210	Correlation	Active Directory Lateral Movement	2026-05-13
Disable AMSI Through Registry	Sysmon EventID 13	T1685	TTP	CISA AA23-347A, Ransomware, Windows Registry Abuse	2026-05-13
Execute Javascript With Jscript COM CLSID	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.005	TTP	Ransomware	2026-05-13
Mimikatz PassTheTicket CommandLine Parameters	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1550.003	TTP	CISA AA23-347A, Scattered Lapsus$ Hunters, Active Directory Kerberos Attacks, CISA AA22-320A, Sandworm Tools	2026-05-13
Windows Registry Entries Exported Via Reg	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1012	Hunting	CISA AA23-347A, Prestige Ransomware, Windows Post-Exploitation	2026-05-13
Linux GNU Awk Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Linux Setuid Using Setcap Utility	Sysmon for Linux EventID 1	T1548.001	Anomaly	Linux Persistence Techniques, Linux Privilege Escalation	2026-05-13
Excessive distinct processes from Windows Temp	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059	Anomaly	Meterpreter	2026-05-13
Windows DISM Install PowerShell Web Access	Windows Event Log Security 4688, Sysmon EventID 1	T1548.002	TTP	CISA AA24-241A	2026-05-13
Certutil exe certificate extraction	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1649	TTP	Storm-2460 CLFS Zero Day Exploitation, Cloud Federated Credential Abuse, Living Off The Land, Windows Certificate Services, Windows Persistence Techniques, Compromised Windows Host	2026-05-13
Linux File Creation In Init Boot Directory	Sysmon for Linux EventID 11	T1037.004	Anomaly	Linux Persistence Techniques, XorDDos, Linux Privilege Escalation, China-Nexus Threat Activity, Backdoor Pingpong	2026-05-13
Remote System Discovery with Wmic	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1018	TTP	Active Directory Discovery	2026-05-13
Reg exe Manipulating Windows Services Registry Keys	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1574.011	TTP	Living Off The Land, Windows Service Abuse, Windows Persistence Techniques	2026-05-13
Modify ACL permission To Files Or Folder	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1222	Anomaly	Defense Evasion or Unauthorized Access Via SDDL Tampering, XMRig, Crypto Stealer	2026-05-13
Windows Rundll32 Load DLL in Temp Dir	Sysmon EventID 1	T1218.011	Anomaly	Interlock Rat	2026-05-13
CSC Net On The Fly Compilation	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1027.004	Hunting	Windows Defense Evasion Tactics	2026-05-13
Windows Mimikatz Binary Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1003	TTP	Flax Typhoon, CISA AA23-347A, Volt Typhoon, Credential Dumping, Scattered Spider, Compromised Windows Host, CISA AA22-320A, Sandworm Tools	2026-05-13
Linux Sqlite3 Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Command and Scripting Interpreter Path Traversal Exec	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059	TTP	Compromised Windows Host, Windows Defense Evasion Tactics, Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190	2026-05-13
GetWmiObject User Account with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1087.001	Hunting	Winter Vivern, Active Directory Discovery, Water Gamayun	2026-05-13
Windows Rundll32 with Non-Standard File Extension	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	Anomaly	Living Off The Land, Suspicious Rundll32 Activity, Gh0st RAT	2026-05-13
Disable Defender Enhanced Notification	Sysmon EventID 13	T1685	TTP	IcedID, CISA AA23-347A, Azorult, Windows Registry Abuse	2026-05-13
Rubeus Command Line Parameters	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1550.003 T1558.003 T1558.004	TTP	ZOVWiper, CISA AA23-347A, BlackSuit Ransomware, Scattered Lapsus$ Hunters, Active Directory Kerberos Attacks, Active Directory Privilege Escalation	2026-05-13
Disabling Task Manager	Sysmon EventID 13	T1685	TTP	NjRAT, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Common Abused Cmd Shell Risk Behavior		T1016 T1033 T1049 T1059 T1222 T1529	Correlation	Windows Defense Evasion Tactics, Microsoft WSUS CVE-2025-59287, Qakbot, CISA AA23-347A, Volt Typhoon, Disabling Security Tools, FIN7, Netsh Abuse, Windows Post-Exploitation, Azorult, DarkCrystal RAT, Sandworm Tools	2026-05-13
Windows Service Deletion In Registry	Sysmon EventID 13	T1489	Anomaly	Crypto Stealer, Brute Ratel C4, PlugX	2026-05-13
Linux Edit Cron Table Parameter	Sysmon for Linux EventID 1	T1053.003	Hunting	Linux Living Off The Land, Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation	2026-05-13
Windows Modify Registry UpdateServiceUrlAlternate	Sysmon EventID 13	T1112	Anomaly	RedLine Stealer	2026-05-13
Linux Sudo OR Su Execution	Sysmon for Linux EventID 1	T1548.003	Hunting	Linux Persistence Techniques, VoidLink Cloud-Native Linux Malware, Linux Privilege Escalation	2026-05-13
WinRM Spawning a Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1190	TTP	CISA AA23-347A, Unusual Processes, Microsoft WSUS CVE-2025-59287, Rhysida Ransomware	2026-05-13
Process Creating LNK file in Suspicious Location	Sysmon EventID 11	T1566.002	Anomaly	Qakbot, BlankGrabber Stealer, IcedID, Spearphishing Attachments, Gozi Malware, Amadey, APT37 Rustonotto and FadeStealer	2026-05-13
Hunting 3CXDesktopApp Software	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1195.002	Hunting	3CX Supply Chain Attack	2026-05-13
Windows Symlink Evaluation Change via Fsutil	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1222.001	Anomaly	Windows Post-Exploitation	2026-05-13
Log4Shell CVE-2021-44228 Exploitation		T1059 T1105 T1133 T1190	Correlation	CISA AA22-320A, Log4Shell CVE-2021-44228	2026-05-13
Linux Kworker Process In Writable Process Path	Sysmon for Linux EventID 1	T1036.004	Hunting	Cyclops Blink, Sandworm Tools	2026-05-13
Windows Suspicious File in EFI Volume	Sysmon EventID 11	T1490 T1542.001	TTP	Windows BootKits, BlackLotus Campaign, Sandworm Tools	2026-05-13
Windows Wmic Memory Chip Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1082	Anomaly	LAMEHUG	2026-05-13
Windows Service Creation on Remote Endpoint	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1543.003	TTP	CISA AA23-347A, China-Nexus Threat Activity, Salt Typhoon, SnappyBee, Active Directory Lateral Movement	2026-05-13
Excessive number of taskhost processes	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059	Anomaly	Meterpreter	2026-05-13
Windows Archived Collected Data In TEMP Folder	Sysmon EventID 11	T1560	Anomaly	APT37 Rustonotto and FadeStealer, Braodo Stealer	2026-05-13
Windows MSIExec Spawn WinDBG	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.007	TTP	Compromised Windows Host, DarkGate Malware	2026-05-13
Domain Account Discovery with Dsquery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1087.002	Anomaly	Active Directory Discovery, LAMEHUG	2026-05-13
Disable Security Logs Using MiniNt Registry	Sysmon EventID 13	T1112	TTP	CISA AA23-347A, Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows System Discovery Using Qwinsta	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1033	Hunting	Qakbot	2026-05-13
Windows Audit Policy Auditing Option Disabled via Auditpol	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685.001	TTP	Windows Audit Policy Tampering	2026-05-13
Linux High Frequency Of File Deletion In Boot Folder	Sysmon for Linux EventID 11	T1070.004 T1485	TTP	Industroyer2, Data Destruction, AcidPour	2026-05-13
Domain Group Discovery With Dsquery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.002	Anomaly	Active Directory Discovery, LAMEHUG	2026-05-13
Windows LSA Secrets NoLMhash Registry	Sysmon EventID 13	T1003.004	TTP	CISA AA23-347A, Scattered Lapsus$ Hunters	2026-05-13
Detect RTLO In Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.002	TTP	Spearphishing Attachments	2026-05-13
Linux Deletion Of Services	Sysmon for Linux EventID 11	T1070.004 T1485	TTP	AwfulShred, AcidRain, AcidPour, Data Destruction	2026-05-13
Windows PowerShell Process Implementing Manual Base64 Decoder	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1027.010 T1059.001	Anomaly	Deobfuscate-Decode Files or Information, Compromised Windows Host	2026-05-13
Windows Disable Internet Explorer Addons	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1176.001	Anomaly	Malicious Inno Setup Loader	2026-05-13
Linux Stop Services	Sysmon for Linux EventID 1	T1489	TTP	AwfulShred, Industroyer2, Data Destruction	2026-05-13
Windows USBSTOR Registry Key Modification	Sysmon EventID 13, Sysmon EventID 12	T1025 T1091 T1200	Anomaly	Data Protection, APT37 Rustonotto and FadeStealer	2026-05-13
Windows Chrome Extension Allowed Registry Modification	Sysmon EventID 13	T1185	Anomaly	Browser Hijacking	2026-05-13
First Time Seen Running Windows Service	Windows Event Log System 7036	T1569.002	Anomaly	Windows Service Abuse, Orangeworm Attack Group, NOBELIUM Group	2026-05-13
Elevated Group Discovery With Wmic	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.002	TTP	Active Directory Discovery	2026-05-13
Detect Password Spray Attack Behavior On User	Windows Event Log Security 4625, Windows Event Log Security 4624	T1110.003	TTP	Crypto Stealer, Compromised User Account	2026-05-13
Suspicious GPUpdate no Command Line Arguments	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055	TTP	Cobalt Strike, Hellcat Ransomware, Graceful Wipe Out Attack, BlackByte Ransomware	2026-05-13
Suspicious MSBuild Spawn	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1127.001	TTP	Trusted Developer Utilities Proxy Execution MSBuild, Living Off The Land, Storm-2460 CLFS Zero Day Exploitation	2026-05-13
Remcos RAT File Creation in Remcos Folder	Sysmon EventID 11	T1113	TTP	Remcos	2026-05-13
Linux Make Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Impacket Lateral Movement smbexec CommandLine Parameters	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.002 T1021.003 T1047 T1543.003	TTP	CISA AA22-277A, Data Destruction, Industroyer2, Volt Typhoon, Graceful Wipe Out Attack, WhisperGate, Prestige Ransomware, Compromised Windows Host, Active Directory Lateral Movement	2026-05-13
Rundll32 LockWorkStation	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	Anomaly	Ransomware	2026-05-13
Mmc LOLBAS Execution Process Spawn	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.003 T1218.014	TTP	XML Runner Loader, Living Off The Land, Active Directory Lateral Movement, Water Gamayun	2026-05-13
Linux Docker Shell Execution	Sysmon for Linux EventID 1	T1059.013	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Msmpeng Application DLL Side Loading	Sysmon EventID 11	T1574.001	TTP	Revil Ransomware, Ransomware	2026-05-13
Execution of File with Multiple Extensions	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036.003	TTP	AsyncRAT, Masquerading - Rename System Utilities, Windows File Extension and Association Abuse, DarkGate Malware	2026-05-13
Windows Impair Defense Change Win Defender Tracing Level	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
CMD Carry Out String Command Parameter	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.003	Hunting	Chaos Ransomware, Quasar RAT, Interlock Rat, CISA AA23-347A, Gh0st RAT, IcedID, NjRAT, DarkCrystal RAT, DarkGate Malware, WhisperGate, Crypto Stealer, Data Destruction, 0bj3ctivity Stealer, Warzone RAT, Living Off The Land, Rhysida Ransomware, Hermetic Wiper, Winter Vivern, Qakbot, RedLine Stealer, AsyncRAT, PlugX, Log4Shell CVE-2021-44228, Malicious Inno Setup Loader, ProxyNotShell, StealC Stealer, Azorult	2026-05-13
Windows DLL Search Order Hijacking with iscsicpl	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1574.001	TTP	Living Off The Land, Compromised Windows Host, Windows Defense Evasion Tactics	2026-05-13
Detect AzureHound Command-Line Arguments	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.001 T1069.002 T1087.001 T1087.002 T1482	TTP	Windows Discovery Techniques, Compromised Windows Host	2026-05-13
Linux Ngrok Reverse Proxy Usage	Sysmon for Linux EventID 1	T1090 T1102 T1572	Anomaly	Reverse Network Proxy	2026-05-13
Windows Disable Memory Crash Dump	Sysmon EventID 13	T1485	TTP	Data Destruction, Hermetic Wiper, Ransomware, Windows Registry Abuse	2026-05-13
Windows File and Directory Permissions Remove Inheritance	Windows Event Log Security 4688, Sysmon EventID 1	T1222.001	Anomaly	Crypto Stealer	2026-05-13
Windows File and Directory Enable ReadOnly Permissions	Windows Event Log Security 4688, Sysmon EventID 1	T1222.001	TTP	Crypto Stealer, NetSupport RMM Tool Abuse	2026-05-13
Spoolsv Spawning Rundll32	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1547.012	TTP	Black Basta Ransomware, PrintNightmare CVE-2021-34527, Compromised Windows Host	2026-05-13
Verclsid CLSID Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.012	Hunting	Unusual Processes	2026-05-13
Revil Common Exec Parameter	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1204	TTP	Revil Ransomware, Ransomware	2026-05-13
Windows AD DSRM Account Changes	Sysmon EventID 13	T1098	TTP	Sneaky Active Directory Persistence Tricks, Windows Persistence Techniques, Scattered Lapsus$ Hunters, Windows Registry Abuse	2026-05-13
Windows Chromium Browser Launched with Small Window Size	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1497	TTP	Browser Hijacking	2026-05-13
DNS Exfiltration Using Nslookup App	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1048	TTP	Command And Control, Dynamic DNS, Suspicious DNS Traffic, Data Exfiltration, Compromised Windows Host	2026-05-13
Windows Debugger Tool Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1036	Hunting	PlugX, DarkGate Malware	2026-05-13
Windows Outlook LoadMacroProviderOnBoot Persistence	Sysmon EventID 13	T1112 T1137	TTP	NotDoor Malware, Windows Registry Abuse	2026-05-13
Linux Possible Append Command To At Allow Config File	Sysmon for Linux EventID 1	T1053.002	Anomaly	Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation	2026-05-13
Windows Spearphishing Attachment Onenote Spawn Mshta	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1566.001	TTP	APT37 Rustonotto and FadeStealer, AsyncRAT, Spearphishing Attachments, Compromised Windows Host	2026-05-13
Services LOLBAS Execution Process Spawn	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1543.003	TTP	Qakbot, CISA AA23-347A, Living Off The Land, Hellcat Ransomware, Active Directory Lateral Movement	2026-05-13
Excessive Usage Of Cacls App	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1222	Anomaly	XMRig, Defense Evasion or Unauthorized Access Via SDDL Tampering, Windows Post-Exploitation, Azorult, Prestige Ransomware, Crypto Stealer	2026-05-13
Windows WBAdmin File Recovery From Backup	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1490 T1565.001	Anomaly	Credential Dumping	2026-05-13
Linux Gdrive Binary Activity	Sysmon for Linux EventID 1	T1567	TTP	China-Nexus Threat Activity	2026-05-13
Windows Delete or Modify System Firewall	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1686	Hunting	NjRAT, ShrinkLocker	2026-05-13
Windows Remote Access Software RMS Registry	Sysmon EventID 13	T1219	TTP	Azorult	2026-05-13
Windows PowerShell Module File Created	Sysmon EventID 11	T1059.001 T1129 T1574	Anomaly	Malicious PowerShell, Windows Persistence Techniques	2026-05-13
Linux PHP Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Rundll32 Execution With Log.DLL	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1574	Anomaly	Lotus Blossom Chrysalis Backdoor	2026-05-13
Linux Composer Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Remote Desktop Process Running On System	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.001	Hunting	Windows RDP Artifacts and Defense Evasion, Hidden Cobra Malware, Active Directory Lateral Movement	2026-05-13
Suspicious Rundll32 dllregisterserver	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	TTP	IcedID, Living Off The Land, Suspicious Rundll32 Activity	2026-05-13
Suspicious writes to windows Recycle Bin	Sysmon EventID 1, Sysmon EventID 11	T1036	TTP	Collection and Staging, PlugX	2026-05-13
Disabling ControlPanel	Sysmon EventID 13	T1112 T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Auto Admin Logon Registry Entry	Sysmon EventID 13	T1552.002	TTP	BlackMatter Ransomware, Windows Registry Abuse	2026-05-13
Windows TeamCity Plugin Installed	Sysmon EventID 11	T1059 T1190 T1505.003	Anomaly	JetBrains TeamCity Unauthenticated RCE, JetBrains TeamCity Vulnerabilities	2026-05-13
Web Servers Executing Suspicious Processes	Sysmon EventID 1	T1082	TTP	Apache Struts Vulnerability	2026-05-13
Windows Chrome Auto-Update Disabled via Registry	Sysmon EventID 13	T1185	Anomaly	Browser Hijacking	2026-05-13
Windows Impair Defense Disable Win Defender Report Infection	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Defacement Modify Transcodedwallpaper File	Sysmon EventID 1, Sysmon EventID 11	T1491	Anomaly	Brute Ratel C4	2026-05-13
Windows Certutil Root Certificate Addition	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1587.003	TTP	Secret Blizzard	2026-05-13
Windows SQL Spawning CertUtil	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1105	TTP	Flax Typhoon, Storm-2460 CLFS Zero Day Exploitation, SQL Server Abuse	2026-05-13
Windows Credential Target Information Structure in Commandline	Sysmon EventID 1	T1071.004 T1187 T1557.001	TTP	Local Privilege Escalation With KrbRelayUp, Compromised Windows Host, Suspicious DNS Traffic, Kerberos Coercion with DNS	2026-05-13
Windows Phishing PDF File Executes URL Link	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1566.001	Anomaly	Snake Keylogger, Spearphishing Attachments, MuddyWater	2026-05-13
Windows Modify Registry NoChangingWallPaper	Sysmon EventID 13	T1112	TTP	Rhysida Ransomware	2026-05-13
Windows Svchost.exe Parent Process Anomaly	Windows Event Log Security 4688, Sysmon EventID 1	T1036.009	Anomaly	SnappyBee, China-Nexus Threat Activity	2026-05-13
Potential Telegram API Request Via CommandLine	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1041 T1102.002	Anomaly	XMRig, 0bj3ctivity Stealer, BlankGrabber Stealer, Hellcat Ransomware, Water Gamayun	2026-05-13
Shai-Hulud 2 Exfiltration Artifact Files	Sysmon for Linux EventID 11, Sysmon EventID 11	T1074.001 T1195.002 T1552.001	TTP	NPM Supply Chain Compromise	2026-05-13
Detect Excessive User Account Lockouts		T1078.003	Anomaly	Scattered Lapsus$ Hunters, Active Directory Password Spraying	2026-05-13
Suspicious SearchProtocolHost no Command Line Arguments	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1055	TTP	Cobalt Strike, BlackByte Ransomware, Cactus Ransomware, Hellcat Ransomware, Graceful Wipe Out Attack	2026-05-13
Windows Masquerading Explorer As Child Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1574.001	TTP	Qakbot, Compromised Windows Host, Water Gamayun	2026-05-13
Windows Impair Defense Configure App Install Control	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Detect Certipy File Modifications	Sysmon EventID 11	T1560 T1649	TTP	Windows Certificate Services, Ingress Tool Transfer, Data Exfiltration	2026-05-13
Linux Common Process For Elevation Control	Sysmon for Linux EventID 1	T1548.001	Hunting	Linux Persistence Techniques, Linux Privilege Escalation, Axios Supply Chain Post Compromise, China-Nexus Threat Activity, Salt Typhoon, Linux Living Off The Land	2026-05-13
Remote System Discovery with Dsquery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1018	Anomaly	Active Directory Discovery, LAMEHUG	2026-05-13
Windows Service Create Kernel Mode Driver	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1068 T1543.003	TTP	Windows Drivers, CISA AA22-320A	2026-05-13
Linux Setuid Using Chmod Utility	Sysmon for Linux EventID 1	T1548.001	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation	2026-05-13
Windows Credentials from Password Stores Deletion	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1555	TTP	Compromised Windows Host, NetSupport RMM Tool Abuse, DarkGate Malware	2026-05-13
Windows Process Writing File to World Writable Path	Sysmon EventID 11	T1218.005	Hunting	APT29 Diplomatic Deceptions with WINELOADER, PathWiper, PHP-CGI RCE Attack on Japanese Organizations	2026-05-13
CMD Echo Pipe - Escalation	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.003 T1543.003	TTP	Compromised Windows Host, Cobalt Strike, Graceful Wipe Out Attack, BlackByte Ransomware	2026-05-13
Linux Ruby Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Password Policy Discovery with Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1201	Hunting	Active Directory Discovery	2026-05-13
Windows Modify Registry Qakbot Binary Data Registry	Sysmon EventID 1, Sysmon EventID 13	T1112	Anomaly	Qakbot	2026-05-13
GitHub Workflow File Creation or Modification	Sysmon for Linux EventID 11, Sysmon EventID 11	T1195 T1554 T1574.006	Hunting	NPM Supply Chain Compromise	2026-05-13
Linux Install Kernel Module Using Modprobe Utility	Sysmon for Linux EventID 1	T1547.006	Anomaly	Linux Persistence Techniques, VoidLink Cloud-Native Linux Malware, Linux Privilege Escalation, China-Nexus Threat Activity, Linux Rootkit	2026-05-13
Windows Universal Data Link File Creation	Sysmon EventID 11	T1204.002 T1566.001	Anomaly	Spearphishing Attachments	2026-05-13
Detect Rare Executables	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1204	Anomaly	Rhysida Ransomware, China-Nexus Threat Activity, Salt Typhoon, SnappyBee, Unusual Processes, Crypto Stealer	2026-05-13
Wmiprvse LOLBAS Execution Process Spawn	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1047	TTP	Active Directory Lateral Movement	2026-05-13
Windows Mock Trusted Directory MSC File Creation	Sysmon EventID 11	T1218.014 T1548.002 T1574	TTP	Windows Privilege Escalation, Windows Persistence Techniques	2026-05-13
Bcdedit Command Back To Normal Mode Boot	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1490	TTP	Black Basta Ransomware, BlackMatter Ransomware	2026-05-13
Windows System File on Disk	Sysmon EventID 11	T1068	Hunting	Windows Drivers, CISA AA22-264A, Crypto Stealer	2026-05-13
Windows Network Connection From Program In Suspect Location	Sysmon EventID 3	T1011	Anomaly	Compromised Windows Host	2026-05-13
Windows Impair Defenses Disable AV AutoStart via Registry	Sysmon EventID 13	T1112	TTP	ValleyRAT, Scattered Lapsus$ Hunters	2026-05-13
Detect Use of cmd exe to Launch Script Interpreters	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.003	Anomaly	Emotet Malware DHS Report TA18-201A, Suspicious Command-Line Executions, Azorult	2026-05-13
Linux NOPASSWD Entry In Sudoers File	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Persistence Techniques, Linux Privilege Escalation, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Linux AWK Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Default Rdp File Unhidden	Sysmon EventID 1	T1021.001	Anomaly	Windows RDP Artifacts and Defense Evasion	2026-05-13
Detect Regsvcs Spawning a Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.009	TTP	Suspicious Regsvcs Regasm Activity, Living Off The Land, Compromised Windows Host	2026-05-13
Remote Process Instantiation via DCOM and PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.003	TTP	Compromised Windows Host, Active Directory Lateral Movement	2026-05-13
Windows Powershell RemoteSigned File	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001	Anomaly	Amadey	2026-05-13
MSBuild Suspicious Spawned By Script Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1127.001	TTP	Trusted Developer Utilities Proxy Execution MSBuild, Storm-2460 CLFS Zero Day Exploitation	2026-05-13
Windows TOR Client Execution	Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1	T1090.003	Anomaly	Command And Control, Data Protection, Windows Post-Exploitation, Data Exfiltration, Compromised Windows Host	2026-05-13
Windows BitLockerToGo Process Execution	Windows Event Log Security 4688, Sysmon EventID 1	T1218	Hunting	Lumma Stealer	2026-05-13
Linux c99 Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Impair Defense Disable Win Defender Scan On Update	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Allow Network Discovery In Firewall	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1686.001	TTP	BlackByte Ransomware, Medusa Ransomware, Ransomware, NjRAT, Hellcat Ransomware, Revil Ransomware	2026-05-13
Windows Credentials from Password Stores Creation	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1555	TTP	Compromised Windows Host, NetSupport RMM Tool Abuse, DarkGate Malware	2026-05-13
Windows Anomalous Registry Value Length in Environment Key	Sysmon EventID 13	T1112	Anomaly	VIP Keylogger	2026-05-13
Windows Account Access Removal via Logoff Exec	Sysmon EventID 1	T1059.001 T1531	Anomaly	Crypto Stealer	2026-05-13
Windows System Discovery Using ldap Nslookup	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1033	Anomaly	Qakbot	2026-05-13
Linux Puppet Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Shell Process from CrushFTP	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001 T1059.003 T1190 T1505	TTP	CrushFTP Vulnerabilities	2026-05-13
Linux Possible Ssh Key File Creation	Sysmon for Linux EventID 11	T1098.004	Anomaly	Linux Living Off The Land, Linux Persistence Techniques, Hellcat Ransomware, Linux Privilege Escalation	2026-05-13
Windows UAC Bypass Suspicious Child Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1548.002	TTP	Living Off The Land, Castle RAT, Windows Defense Evasion Tactics	2026-05-13
Disabling Windows Local Security Authority Defences via Registry	Sysmon EventID 13	T1556	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Suspicious Scheduled Task from Public Directory	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1053.005	Anomaly	Quasar RAT, CISA AA23-347A, MoonPeak, Ransomware, DarkCrystal RAT, China-Nexus Threat Activity, Crypto Stealer, CISA AA24-241A, XWorm, Lokibot, Living Off The Land, SolarWinds WHD RCE Post Exploitation, Scheduled Tasks, Windows Persistence Techniques, Ryuk Ransomware, Scattered Spider, Salt Typhoon, Malicious Inno Setup Loader, Medusa Ransomware, NetSupport RMM Tool Abuse, Azorult, APT37 Rustonotto and FadeStealer	2026-05-13
Windows Impair Defense Deny Security Software With Applocker	Sysmon EventID 13	T1685	TTP	Scattered Lapsus$ Hunters, Azorult	2026-05-13
Windows Outlook Macro Created by Suspicious Process	Sysmon EventID 11	T1059.005 T1137	TTP	NotDoor Malware	2026-05-13
Windows Impair Defense Set Win Defender Smart Screen Level To Warn	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Linux Deletion Of Init Daemon Script	Sysmon for Linux EventID 11	T1070.004 T1485	TTP	AcidRain, AcidPour, Data Destruction	2026-05-13
Excessive Attempt To Disable Services	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1489	Anomaly	XMRig, Azorult	2026-05-13
Windows System Shutdown CommandLine	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1529	Anomaly	ZOVWiper, Quasar RAT, XWorm, MoonPeak, MuddyWater, NjRAT, DarkCrystal RAT, Scattered Lapsus$ Hunters, DarkGate Malware, Sandworm Tools	2026-05-13
Domain Controller Discovery with Wmic	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1018	Hunting	Active Directory Discovery	2026-05-13
Linux Doas Conf File Creation	Sysmon for Linux EventID 11	T1548.003	Anomaly	Linux Persistence Techniques, Linux Privilege Escalation	2026-05-13
Windows Remote Service Rdpwinst Tool Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.001	TTP	Scattered Lapsus$ Hunters, Windows RDP Artifacts and Defense Evasion, Compromised Windows Host, Azorult	2026-05-13
Windows Impair Defense Disable PUA Protection	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Scattered Lapsus$ Hunters, Windows Registry Abuse	2026-05-13
Disable UAC Remote Restriction	Sysmon EventID 13	T1548.002	TTP	CISA AA23-347A, Windows Defense Evasion Tactics, Suspicious Windows Registry Activities, Windows Registry Abuse	2026-05-13
Windows Diskshadow Proxy Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218	TTP	Living Off The Land	2026-05-13
Windows Information Discovery Fsutil	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1082	Anomaly	Prestige Ransomware, Windows Post-Exploitation	2026-05-13
GetNetTcpconnection with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1049	Hunting	Active Directory Discovery	2026-05-13
Windows Impair Defense Disable Win Defender Network Protection	Sysmon EventID 13	T1685	TTP	BlankGrabber Stealer, Windows Defense Evasion Tactics, Scattered Lapsus$ Hunters, Windows Registry Abuse	2026-05-13
Windows Audit Policy Disabled via Legacy Auditpol	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685.001	Anomaly	Windows Audit Policy Tampering	2026-05-13
Windows Modify Registry Utilize ProgIDs	Sysmon EventID 13	T1112	Anomaly	ValleyRAT	2026-05-13
Windows Chromium process Launched with Disable Popup Blocking	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1497	Anomaly	Browser Hijacking	2026-05-13
Windows Modify Registry Configure BitLocker	Sysmon EventID 13	T1112	TTP	ShrinkLocker	2026-05-13
Windows MOVEit Transfer Writing ASPX	Sysmon EventID 11	T1133 T1190	TTP	Hellcat Ransomware, MOVEit Transfer Critical Vulnerability	2026-05-13
Anomalous usage of 7zip	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1560.001	Anomaly	Cobalt Strike, BlackByte Ransomware, BlackSuit Ransomware, Graceful Wipe Out Attack, NOBELIUM Group	2026-05-13
Windows WPDBusEnum Registry Key Modification	Sysmon EventID 13, Sysmon EventID 12	T1025 T1091 T1200	Anomaly	Data Protection, APT37 Rustonotto and FadeStealer	2026-05-13
Rundll32 Control RunDLL World Writable Directory	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.011	TTP	Microsoft MSHTML Remote Code Execution CVE-2021-40444, Living Off The Land, Suspicious Rundll32 Activity, Compromised Windows Host	2026-05-13
Linux Unix Shell Enable All SysRq Functions	Sysmon for Linux EventID 1	T1059.004	Anomaly	AwfulShred, Data Destruction	2026-05-13
Linux Indicator Removal Service File Deletion	Sysmon for Linux EventID 1	T1070.004	Anomaly	AwfulShred, Data Destruction	2026-05-13
Linux Preload Hijack Library Calls	Sysmon for Linux EventID 1	T1574.006	TTP	Linux Persistence Techniques, VoidLink Cloud-Native Linux Malware, Linux Privilege Escalation, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Linux Sudoers Tmp File Creation	Sysmon for Linux EventID 11	T1548.003	Anomaly	Linux Persistence Techniques, Linux Privilege Escalation, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Schtasks used for forcing a reboot	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1053.005	TTP	Scheduled Tasks, Ransomware, Windows Persistence Techniques	2026-05-13
MacOS Kextload Usage	Osquery Results	T1543	TTP	MacOS Privilege Escalation, MacOS Persistence Techniques	2026-05-13
Windows Impair Defense Change Win Defender Throttle Rate	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Modify Registry Default Icon Setting	Sysmon EventID 13	T1112	Anomaly	LockBit Ransomware	2026-05-13
Suspicious Curl Network Connection	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2, Sysmon for Linux EventID 1	T1105	TTP	Silver Sparrow, GhostRedirector IIS Module and Rungan Backdoor, APT37 Rustonotto and FadeStealer, Hellcat Ransomware, Ingress Tool Transfer, Linux Living Off The Land	2026-05-13
Windows Impair Defense Disable Defender Firewall And Network	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Scattered Lapsus$ Hunters, Windows Registry Abuse	2026-05-13
Windows Impair Defense Overide Win Defender Phishing Filter	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Cmdline Tool Execution From Non-Shell Process	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.007	Anomaly	CISA AA22-277A, Gh0st RAT, Qakbot, CISA AA23-347A, Volt Typhoon, BlankGrabber Stealer, Medusa Ransomware, FIN7, Rhysida Ransomware, SolarWinds WHD RCE Post Exploitation, Gozi Malware, DarkGate Malware, Tuoni, Water Gamayun	2026-05-13
Windows Remote Services Allow Rdp In Firewall	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1021.001	Anomaly	Windows RDP Artifacts and Defense Evasion, Azorult	2026-05-13
Windows Modify Registry Disable Restricted Admin	Sysmon EventID 13	T1112	TTP	GhostRedirector IIS Module and Rungan Backdoor, CISA AA23-347A, Medusa Ransomware	2026-05-13
Linux Possible Access To Credential Files	Sysmon for Linux EventID 1	T1003.008	Anomaly	Linux Persistence Techniques, XorDDos, Linux Privilege Escalation, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Windows Network Connection Discovery Via Net	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1049	Hunting	Prestige Ransomware, Active Directory Discovery, Windows Post-Exploitation, Azorult	2026-05-13
Windows Alternate DataStream - Base64 Content	Sysmon EventID 15	T1564.004	TTP	APT37 Rustonotto and FadeStealer, Windows Defense Evasion Tactics	2026-05-13
Disabling Firewall with Netsh	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685	Anomaly	Windows Defense Evasion Tactics, BlackByte Ransomware	2026-05-13
GetWmiObject Ds Group with PowerShell	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1069.002	Anomaly	Active Directory Discovery	2026-05-13
Windows Impair Defense Change Win Defender Quick Scan Interval	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Windows Ingress Tool Transfer Using Explorer	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1105	Anomaly	DarkCrystal RAT	2026-05-13
Process Writing DynamicWrapperX	Sysmon EventID 11	T1059 T1559.001	Hunting	Remcos	2026-05-13
Windows Remote Host Computer Management Access	Windows Event Log Security 4688, Sysmon EventID 1	T1021.006	Anomaly	Medusa Ransomware	2026-05-13
Suspicious Regsvr32 Register Suspicious Path	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.010	TTP	Qakbot, Living Off The Land, Derusbi, Suspicious Regsvr32 Activity, IcedID, China-Nexus Threat Activity, Salt Typhoon	2026-05-13
Windows Post Exploitation Risk Behavior		T1003 T1012 T1016 T1049 T1069 T1082 T1115 T1552	Correlation	Windows Post-Exploitation	2026-05-13
Java Writing JSP File	Sysmon for Linux EventID 11, Sysmon for Linux EventID 1	T1133 T1190	TTP	Spring4Shell CVE-2022-22965, SAP NetWeaver Exploitation, SysAid On-Prem Software CVE-2023-47246 Vulnerability, Atlassian Confluence Server and Data Center CVE-2022-26134	2026-05-13
Linux Suspicious React or Next.js Child Process	Sysmon for Linux EventID 1	T1059.004 T1190	TTP	React2Shell	2026-05-13
Linux RPM Privilege Escalation	Sysmon for Linux EventID 1	T1548.003	Anomaly	Linux Living Off The Land, Linux Privilege Escalation	2026-05-13
Windows Service Stop By Deletion	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1489	Hunting	Crypto Stealer, Graceful Wipe Out Attack, Azorult	2026-05-13
MacOS Log Removal	Osquery Results	T1070	TTP	MacOS Post-Exploitation	2026-05-13
Suspicious WAV file in Appdata Folder	Windows Event Log Security 4688, Sysmon EventID 1, Sysmon EventID 11	T1113	TTP	Remcos	2026-05-13
Windows Modify Registry wuStatusServer	Sysmon EventID 13	T1112	Hunting	RedLine Stealer	2026-05-13
Windows Impair Defense Disable Win Defender Signature Retirement	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Scattered Lapsus$ Hunters, Windows Registry Abuse	2026-05-13
Single Letter Process On Endpoint	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1204.002	TTP	DHS Report TA18-074A, Compromised Windows Host	2026-05-13
Network Discovery Using Route Windows App	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1016.001	Hunting	CISA AA22-277A, Qakbot, Windows Post-Exploitation, Prestige Ransomware, Active Directory Discovery	2026-05-13
Windows Office Product Spawned MSDT	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1566.001	TTP	Spearphishing Attachments, Compromised Windows Host, Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190	2026-05-13
Rundll32 Shimcache Flush	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1112	TTP	Living Off The Land, Unusual Processes, Compromised Windows Host	2026-05-13
Windows Wmic CPU Discovery	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1082	Anomaly	LAMEHUG	2026-05-13
Windows Rundll32 WebDav With Network Connection	Sysmon EventID 1, Sysmon EventID 3	T1048.003	TTP	CVE-2023-23397 Outlook Elevation of Privilege	2026-05-13
Windows Impair Defense Override SmartScreen Prompt	Sysmon EventID 13	T1685	TTP	Windows Defense Evasion Tactics, Windows Registry Abuse	2026-05-13
Linux Shred Overwrite Command	Sysmon for Linux EventID 1	T1485	TTP	Linux Persistence Techniques, Data Destruction, Industroyer2, Linux Privilege Escalation, AwfulShred	2026-05-13
Windows Devtunnels Execution	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1090	Anomaly	Reverse Network Proxy	2026-05-13
SLUI RunAs Elevated	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1548.002	TTP	Compromised Windows Host, Windows Defense Evasion Tactics, DarkSide Ransomware	2026-05-13
Windows Global Object Access Audit List Cleared Via Auditpol	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685.001	TTP	Windows Audit Policy Tampering	2026-05-13
Windows Security Support Provider Reg Query	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1547.005	Anomaly	Sneaky Active Directory Persistence Tricks, Prestige Ransomware, Windows Post-Exploitation	2026-05-13
Shai-Hulud Workflow File Creation or Modification	Sysmon for Linux EventID 11, Sysmon EventID 11	T1195 T1554 T1574.006	TTP	NPM Supply Chain Compromise	2026-05-13
Print Processor Registry Autostart	Sysmon EventID 13	T1547.012	TTP	Hermetic Wiper, Windows Persistence Techniques, Data Destruction, Windows Privilege Escalation	2026-05-13
Linux SSH Remote Services Script Execute	Sysmon for Linux EventID 1	T1021.004	TTP	Linux Living Off The Land, Hellcat Ransomware, VoidLink Cloud-Native Linux Malware	2026-05-13
Script Execution via WMI	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1047	TTP	Suspicious WMI Use, Scattered Spider	2026-05-13
Windows EFI Volume Mount Attempt Via Mountvol	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1204.002 T1542 T1688	Anomaly	Compromised Windows Host	2026-05-13
Windows Chrome Enable Extension Loading via Command-Line	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1185	Anomaly	Browser Hijacking	2026-05-13
Windows Modify Registry Risk Behavior		T1112	Correlation	Windows Registry Abuse	2026-05-13
Logon Script Event Trigger Execution	Sysmon EventID 13	T1037.001	TTP	Hermetic Wiper, VIP Keylogger, Data Destruction, Windows Privilege Escalation, Windows Persistence Techniques	2026-05-13
Windows PowGoop Beacon Decoding	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1001 T1059.001	TTP	Compromised Windows Host	2026-05-13
Windows Audit Policy Disabled via Auditpol	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1685.001	Anomaly	Windows Audit Policy Tampering	2026-05-13
Windows Registry SIP Provider Modification	Sysmon EventID 13	T1553.003	TTP	Subvert Trust Controls SIP and Trust Provider Hijacking	2026-05-13
Clear Unallocated Sector Using Cipher App	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1070.004	TTP	Compromised Windows Host, Scattered Spider, Ransomware	2026-05-13
MS Exchange Mailbox Replication service writing Active Server Pages	Sysmon EventID 1, Sysmon EventID 11	T1133 T1190 T1505.003	TTP	ProxyShell, Ransomware, BlackByte Ransomware	2026-05-13
Internal Horizontal Port Scan	AWS CloudWatchLogs VPCflow, Cisco Secure Firewall Threat Defense Connection Event	T1046	TTP	Scattered Lapsus$ Hunters, Network Discovery, Cisco Secure Firewall Threat Defense Analytics, China-Nexus Threat Activity	2026-05-13
Detect Outbound LDAP Traffic	Cisco Secure Access Firewall, Palo Alto Network Traffic, Cisco Secure Firewall Threat Defense Connection Event	T1059 T1190	Hunting	Cisco Secure Access Analytics, Cisco Secure Firewall Threat Defense Analytics, Log4Shell CVE-2021-44228	2026-05-13
Cisco IOS Suspicious Privileged Account Creation	Cisco IOS Logs	T1078 T1136	Anomaly	Cisco Smart Install Remote Code Execution CVE-2018-0171	2026-05-13
Cisco Network Interface Modifications	Cisco IOS Logs	T1021 T1133 T1556	Anomaly	Cisco Smart Install Remote Code Execution CVE-2018-0171	2026-05-13
TOR Traffic	Palo Alto Network Traffic, Cisco Secure Firewall Threat Defense Connection Event	T1090.003	TTP	Interlock Ransomware, Cisco Secure Firewall Threat Defense Analytics, Command And Control, Prohibited Traffic Allowed or Protocol Mismatch, Ransomware, NOBELIUM Group	2026-05-13
Cisco Privileged Account Creation with Suspicious SSH Activity		T1021.004 T1078 T1136	Correlation	Cisco Secure Firewall Threat Defense Analytics, Salt Typhoon	2026-05-13
Cisco SNMP Community String Configuration Changes	Cisco IOS Logs	T1040 T1552 T1685	Anomaly	Cisco Smart Install Remote Code Execution CVE-2018-0171	2026-05-13
Cisco Privileged Account Creation with HTTP Command Execution		T1021.004 T1078 T1136	Correlation	Cisco Secure Firewall Threat Defense Analytics, Salt Typhoon	2026-05-13
F5 BIG-IP iControl REST Vulnerability CVE-2022-1388	Palo Alto Network Threat	T1133 T1190	TTP	CISA AA24-241A, F5 BIG-IP Vulnerability CVE-2022-1388	2026-05-13
Protocol or Port Mismatch	Cisco Secure Firewall Threat Defense Connection Event	T1048.003	Anomaly	Cisco Secure Firewall Threat Defense Analytics, Prohibited Traffic Allowed or Protocol Mismatch, Command And Control	2026-05-13
Cisco TFTP Server Configuration for Data Exfiltration	Cisco IOS Logs	T1005 T1567	TTP	Cisco Smart Install Remote Code Execution CVE-2018-0171	2026-05-13
SSL Certificates with Punycode		T1573	Hunting	OpenSSL CVE-2022-3602	2026-05-13
Excessive DNS Failures		T1071.004	Anomaly	Suspicious DNS Traffic, Command And Control	2026-05-13
Hosts receiving high volume of network traffic from email server		T1114.002	Anomaly	Collection and Staging	2026-05-13
Detect DNS Query to Decommissioned S3 Bucket	Sysmon EventID 22	T1485	Anomaly	AWS S3 Bucket Security Monitoring, Data Destruction	2026-05-13
Internal Vulnerability Scan		T1046 T1595.002	TTP	Network Discovery, Scattered Lapsus$ Hunters	2026-05-13
Ngrok Reverse Proxy on Network	Sysmon EventID 22	T1090 T1102 T1572	Anomaly	Reverse Network Proxy, CISA AA24-241A, CISA AA22-320A	2026-05-13
Detect Windows DNS SIGRed via Zeek		T1203	TTP	Windows DNS SIGRed CVE-2020-1350	2026-05-13
Internal Vertical Port Scan	AWS CloudWatchLogs VPCflow, Cisco Secure Firewall Threat Defense Connection Event	T1046	TTP	Scattered Lapsus$ Hunters, Network Discovery, Cisco Secure Firewall Threat Defense Analytics, China-Nexus Threat Activity	2026-05-13
Cisco Configuration Archive Logging Analysis	Cisco IOS Logs	T1098 T1505.003 T1685	Hunting	Cisco Smart Install Remote Code Execution CVE-2018-0171	2026-05-13
Detect Software Download To Network Device		T1542.005	TTP	Router and Infrastructure Security	2026-05-13
Cisco Smart Install Oversized Packet Detection	Splunk Stream TCP	T1190	TTP	Cisco Smart Install Remote Code Execution CVE-2018-0171	2026-05-13
DNS Query Length With High Standard Deviation	Sysmon EventID 22	T1048.003	Anomaly	Hidden Cobra Malware, Suspicious DNS Traffic, Command And Control	2026-05-13
SMB Traffic Spike		T1021.002	Anomaly	Emotet Malware DHS Report TA18-201A, DHS Report TA18-074A, Hidden Cobra Malware, Ransomware	2026-05-13
Protocols passing authentication in cleartext	Cisco Secure Firewall Threat Defense Connection Event	N/A	Anomaly	Cisco Secure Firewall Threat Defense Analytics, Scattered Lapsus$ Hunters, Use of Cleartext Protocols	2026-05-13
Detect Unauthorized Assets by MAC address		N/A	TTP	Asset Tracking	2026-05-13
Windows Remote Desktop Network Bruteforce Attempt	Cisco Secure Access Firewall, Sysmon EventID 3	T1110.001	Anomaly	SamSam Ransomware, Compromised User Account, Windows RDP Artifacts and Defense Evasion, Ryuk Ransomware, Cisco Secure Access Analytics	2026-05-13
Windows AD Replication Service Traffic		T1003.006 T1207	TTP	Sneaky Active Directory Persistence Tricks	2026-05-13
Large Volume of DNS ANY Queries		T1498.002	Anomaly	DNS Amplification Attacks	2026-05-13
Detect Outbound SMB Traffic	Cisco Secure Access Firewall, Cisco Secure Firewall Threat Defense Connection Event	T1071.002	TTP	Cisco Secure Firewall Threat Defense Analytics, DHS Report TA18-074A, Hidden Cobra Malware, NOBELIUM Group, Cisco Secure Access Analytics	2026-05-13
Cisco Smart Install Port Discovery and Status	Splunk Stream TCP	T1190	TTP	Cisco Smart Install Remote Code Execution CVE-2018-0171, Scattered Lapsus$ Hunters	2026-05-13
Email servers sending high volume traffic to hosts		T1114.002	Anomaly	HAFNIUM Group, Collection and Staging	2026-05-13
Okta Multiple Users Failing To Authenticate From Ip	Okta	T1110.003	Anomaly	Okta Account Takeover	2026-05-13
Okta Multiple Accounts Locked Out	Okta	T1110	Anomaly	Okta Account Takeover	2026-05-13
Detect New Login Attempts to Routers		N/A	TTP	Router and Infrastructure Security, Scattered Lapsus$ Hunters	2026-05-13
Email Attachments With Lots Of Spaces		T1036.008 T1566.001	Anomaly	Hermetic Wiper, Emotet Malware DHS Report TA18-201A, Suspicious Emails, Data Destruction	2026-05-13
Detect Distributed Password Spray Attempts	Azure Active Directory Sign-in activity	T1110.003	Hunting	Compromised User Account, Active Directory Password Spraying	2026-05-13
Okta New API Token Created	Okta	T1078.001	TTP	Okta Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
Detect Password Spray Attempts	Windows Event Log Security 4625	T1110.003	TTP	Compromised User Account, Active Directory Password Spraying	2026-05-13
Okta New Device Enrolled on Account	Okta	T1098.005	TTP	Okta Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
Okta Risk Threshold Exceeded	Okta	T1078 T1110	Correlation	Suspicious Okta Activity, Okta Account Takeover, Okta MFA Exhaustion	2026-05-13
Okta Authentication Failed During MFA Challenge	Okta	T1078.004 T1586.003 T1621	TTP	Okta Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
Okta User Logins from Multiple Cities	Okta	T1586.003	Anomaly	Okta Account Takeover	2026-05-13
Suspicious Email Attachment Extensions		T1566.001	Anomaly	Hermetic Wiper, Emotet Malware DHS Report TA18-201A, Suspicious Emails, Data Destruction	2026-05-13
Okta Multi-Factor Authentication Disabled	Okta	T1556.006	TTP	Okta Account Takeover, Scattered Lapsus$ Hunters	2026-05-13
Monitor Web Traffic For Brand Abuse		N/A	TTP	Brand Monitoring	2026-05-13
Remote Desktop Network Traffic	Zeek Conn	T1021.001	Anomaly	SamSam Ransomware, Windows RDP Artifacts and Defense Evasion, Hidden Cobra Malware, Ryuk Ransomware, Active Directory Lateral Movement	2026-05-13
Monitor Email For Brand Abuse		N/A	TTP	Suspicious Emails, Brand Monitoring, Scattered Lapsus$ Hunters	2026-05-13
No Windows Updates in a time frame		N/A	Hunting	Monitor for Updates	2026-05-13
Linux Suspicious Namespace Creation	Linux Auditd Syscall, Sysmon for Linux EventID 1	T1068	TTP	Linux Privilege Escalation	2026-05-12
Powershell Defender Threat Actions Set to Allow	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001	TTP	Salat Stealer	2026-05-12
Linux Malformed Auth Entry	Linux Secure	T1068	Anomaly	Linux Privilege Escalation	2026-05-06
Windows Cloud Files Filter Log Created by Non-System Process	Sysmon EventID 11	T1068	TTP	RedSun, Windows Privilege Escalation	2026-05-01
Windows VSSVC Process Accessing Defender Engine	Sysmon EventID 10	T1068	TTP	RedSun, Windows Privilege Escalation	2026-05-01
Windows Suspicious Child Process of TieringEngineService.exe	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1068	TTP	RedSun, Windows Privilege Escalation	2026-05-01
Windows Suspicious Burst of Password Changes	Windows Event Log Security 4724, Windows Event Log Security 4723	T1068	TTP	BlueHammer, Windows Privilege Escalation	2026-04-29
Windows MsMpEng Writing to System32	Sysmon EventID 15, Sysmon EventID 11	T1068 T1543.003	TTP	Windows Drivers, BlueHammer, RedSun, Windows Privilege Escalation	2026-04-27
Windows Suspicious Defender Engine or Signature Files Created	Sysmon EventID 11	T1068	Anomaly	BlueHammer, Windows Privilege Escalation	2026-04-27