Deprecated Detections

Name Data Source Technique Type Analytic Story Date
Abnormally High AWS Instances Launched by User Cloud Accounts Anomaly AWS Cryptomining, Suspicious AWS EC2 Activities 2024-11-14
Abnormally High AWS Instances Launched by User - MLTK Cloud Accounts Anomaly AWS Cryptomining, Suspicious AWS EC2 Activities 2024-11-14
Abnormally High AWS Instances Terminated by User Cloud Accounts Anomaly Suspicious AWS EC2 Activities 2024-11-14
Abnormally High AWS Instances Terminated by User - MLTK Cloud Accounts Anomaly Suspicious AWS EC2 Activities 2024-11-14
Account Discovery With Net App CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Domain Account Account Discovery TTP IcedID, Trickbot 2025-01-13
ASL AWS CreateAccessKey Valid Accounts Hunting AWS IAM Privilege Escalation 2024-11-14
ASL AWS Excessive Security Scanning Cloud Service Discovery Anomaly AWS User Monitoring 2024-11-14
ASL AWS Password Policy Changes Password Policy Discovery Hunting AWS IAM Privilege Escalation, Compromised User Account 2024-11-14
Attempt To Stop Security Service CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Disable or Modify Tools Impair Defenses TTP Azorult, Data Destruction, Disabling Security Tools, Graceful Wipe Out Attack, Trickbot, WhisperGate 2025-01-24
Attempted Credential Dump From Registry via Reg exe CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Security Account Manager OS Credential Dumping TTP CISA AA23-347A, Compromised Windows Host, Credential Dumping, DarkSide Ransomware, Data Destruction, Industroyer2, Windows Registry Abuse 2025-01-15
AWS Cloud Provisioning From Previously Unseen City Unused/Unsupported Cloud Regions Anomaly AWS Suspicious Provisioning Activities 2024-11-14
AWS Cloud Provisioning From Previously Unseen Country Unused/Unsupported Cloud Regions Anomaly AWS Suspicious Provisioning Activities 2024-11-14
AWS Cloud Provisioning From Previously Unseen IP Address N/A Anomaly AWS Suspicious Provisioning Activities 2024-11-14
AWS Cloud Provisioning From Previously Unseen Region Unused/Unsupported Cloud Regions Anomaly AWS Suspicious Provisioning Activities 2024-11-14
AWS EKS Kubernetes cluster sensitive object access N/A Hunting Kubernetes Sensitive Object Access Activity 2024-11-14
Change Default File Association Sysmon EventID 12, Sysmon EventID 13 Change Default File Association Event Triggered Execution TTP Data Destruction, Hermetic Wiper, Prestige Ransomware, Windows Persistence Techniques, Windows Privilege Escalation, Windows Registry Abuse 2025-01-24
Clients Connecting to Multiple DNS Servers Exfiltration Over Unencrypted Non-C2 Protocol TTP Command And Control, DNS Hijacking, Host Redirection, Suspicious DNS Traffic 2024-11-14
Cloud Network Access Control List Deleted N/A Anomaly AWS Network ACL Activity 2024-11-14
Cmdline Tool Not Executed In CMD Shell CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Command and Scripting Interpreter JavaScript TTP CISA AA22-277A, CISA AA23-347A, DarkGate Malware, FIN7, Gozi Malware, Qakbot, Rhysida Ransomware, Volt Typhoon 2025-01-24
Correlation by Repository and Risk Malicious Image User Execution Correlation Dev Sec Ops 2024-11-14
Correlation by User and Risk Malicious Image User Execution Correlation Dev Sec Ops 2024-11-14
Create local admin accounts using net exe CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Local Account Create Account TTP Azorult, CISA AA22-257A, CISA AA24-241A, DHS Report TA18-074A, DarkGate Malware 2025-01-24
Deleting Of Net Users CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Account Access Removal TTP DarkGate Malware, Graceful Wipe Out Attack, XMRig 2025-01-24
Detect Activity Related to Pass the Hash Attacks Windows Event Log Security 4624 Use Alternate Authentication Material Pass the Hash Hunting Active Directory Lateral Movement, BlackSuit Ransomware 2024-11-14
Detect API activity from users without MFA N/A Hunting AWS User Monitoring 2024-11-14
Detect AWS API Activities From Unapproved Accounts Cloud Accounts Hunting AWS User Monitoring 2024-11-14
Detect Critical Alerts from Security Tools MS365 Defender Incident Alerts, Windows Defender Alerts N/A TTP Critical Alerts 2025-01-13
Detect DNS requests to Phishing Sites leveraging EvilGinx2 Spearphishing via Service TTP Common Phishing Frameworks 2024-11-14
Detect Long DNS TXT Record Response Exfiltration Over Unencrypted Non-C2 Protocol TTP Command And Control, Suspicious DNS Traffic 2024-11-14
Detect Mimikatz Using Loaded Images Sysmon EventID 7 LSASS Memory OS Credential Dumping TTP CISA AA22-257A, CISA AA22-264A, CISA AA22-320A, Cloud Federated Credential Abuse, Credential Dumping, DarkSide Ransomware, Detect Zerologon Attack, Sandworm Tools 2024-11-14
Detect Mimikatz Via PowerShell And EventCode 4703 LSASS Memory TTP Cloud Federated Credential Abuse 2024-11-14
Detect new API calls from user roles Cloud Accounts Anomaly AWS User Monitoring 2024-11-14
Detect new user AWS Console Login Cloud Accounts Hunting Suspicious AWS Login Activities 2024-11-14
Detect processes used for System Network Configuration Discovery CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 System Network Configuration Discovery TTP Unusual Processes 2025-01-24
Detect Spike in AWS API Activity Cloud Accounts Anomaly AWS User Monitoring 2024-11-14
Detect Spike in Network ACL Activity Disable or Modify Cloud Firewall Anomaly AWS Network ACL Activity 2024-11-14
Detect Spike in Security Group Activity Cloud Accounts Anomaly AWS User Monitoring 2024-11-14
Detect USB device insertion N/A TTP Data Protection 2024-11-14
Detect web traffic to dynamic domain providers Web Protocols TTP Dynamic DNS 2024-11-14
Detect Webshell Exploit Behavior CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Server Software Component Web Shell TTP BlackByte Ransomware, CISA AA22-257A, CISA AA22-264A, Citrix ShareFile RCE CVE-2023-24489, Compromised Windows Host, Flax Typhoon, HAFNIUM Group, ProxyNotShell, ProxyShell, SysAid On-Prem Software CVE-2023-47246 Vulnerability, WS FTP Server Critical Vulnerabilities 2025-01-24
Detection of DNS Tunnels Exfiltration Over Unencrypted Non-C2 Protocol TTP Command And Control, Data Protection, Suspicious DNS Traffic 2024-11-14
Disabling Net User Account CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Account Access Removal TTP XMRig 2025-01-24
DNS Query Requests Resolved by Unauthorized DNS Servers DNS TTP Command And Control, DNS Hijacking, Host Redirection, Suspicious DNS Traffic 2024-11-14
DNS record changed DNS TTP DNS Hijacking 2024-11-14
Domain Account Discovery With Net App CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Domain Account Account Discovery TTP Active Directory Discovery, Graceful Wipe Out Attack, Rhysida Ransomware 2025-01-13
Domain Group Discovery With Net CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Permission Groups Discovery Domain Groups Hunting Active Directory Discovery, Cleo File Transfer Software, Graceful Wipe Out Attack, Prestige Ransomware, Rhysida Ransomware, Windows Post-Exploitation 2025-01-13
Dump LSASS via procdump Rename Sysmon EventID 1 LSASS Memory Hunting CISA AA22-257A, Credential Dumping, HAFNIUM Group 2024-11-14
EC2 Instance Modified With Previously Unseen User Cloud Accounts Anomaly Unusual AWS EC2 Modifications 2024-11-14
EC2 Instance Started In Previously Unseen Region Unused/Unsupported Cloud Regions Hunting AWS Cryptomining, Suspicious AWS EC2 Activities 2024-11-14
EC2 Instance Started With Previously Unseen AMI N/A Anomaly AWS Cryptomining 2025-01-16
EC2 Instance Started With Previously Unseen Instance Type N/A Anomaly AWS Cryptomining 2025-01-16
EC2 Instance Started With Previously Unseen User Cloud Accounts Anomaly AWS Cryptomining, Suspicious AWS EC2 Activities 2025-01-16
Elevated Group Discovery With Net CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Permission Groups Discovery Domain Groups TTP Active Directory Discovery, BlackSuit Ransomware, Rhysida Ransomware, Volt Typhoon 2025-01-24
Excel Spawning PowerShell CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Security Account Manager OS Credential Dumping TTP Compromised Windows Host, Spearphishing Attachments 2025-01-13
Excel Spawning Windows Script Host CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Security Account Manager OS Credential Dumping TTP Compromised Windows Host, Spearphishing Attachments 2025-01-13
Excessive Service Stop Attempt CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Service Stop Anomaly BlackByte Ransomware, Ransomware, XMRig 2025-01-24
Excessive Usage Of Net App CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Account Access Removal Anomaly Azorult, Graceful Wipe Out Attack, Prestige Ransomware, Ransomware, Rhysida Ransomware, Windows Post-Exploitation, XMRig 2025-01-24
Execution of File With Spaces Before Extension Sysmon EventID 1 Rename System Utilities TTP Masquerading - Rename System Utilities, Windows File Extension and Association Abuse 2024-11-14
Extended Period Without Successful Netbackup Backups N/A Hunting Monitor Backup Solution 2024-11-14
Extraction of Registry Hives CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Security Account Manager OS Credential Dumping TTP CISA AA22-257A, CISA AA23-347A, Credential Dumping, DarkSide Ransomware, Volt Typhoon 2025-01-24
First time seen command line argument Sysmon EventID 1 PowerShell Windows Command Shell Hunting DHS Report TA18-074A, Hidden Cobra Malware, Orangeworm Attack Group, Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns, Suspicious Command-Line Executions 2024-11-14
GCP Detect accounts with high risk roles by project Valid Accounts Hunting GCP Cross Account Activity 2024-11-14
GCP Detect high risk permissions by resource and account Valid Accounts Hunting GCP Cross Account Activity 2024-11-14
gcp detect oauth token abuse Valid Accounts Hunting GCP Cross Account Activity 2024-11-14
GCP Kubernetes cluster scan detection Cloud Service Discovery TTP Kubernetes Scanning Activity 2024-11-14
Identify New User Accounts Domain Accounts Hunting N/A 2024-11-14
Kubernetes AWS detect most active service accounts by pod N/A Hunting Kubernetes Sensitive Role Activity 2024-11-14
Kubernetes AWS detect RBAC authorization by account N/A Hunting Kubernetes Sensitive Role Activity 2024-11-14
Kubernetes AWS detect sensitive role access N/A Hunting Kubernetes Sensitive Role Activity 2024-11-14
Kubernetes AWS detect service accounts forbidden failure access N/A Hunting Kubernetes Sensitive Object Access Activity 2024-11-14
Kubernetes Azure active service accounts by pod namespace N/A Hunting Kubernetes Sensitive Role Activity 2024-11-14
Kubernetes Azure detect RBAC authorization by account N/A Hunting Kubernetes Sensitive Role Activity 2024-11-14
Kubernetes Azure detect sensitive object access N/A Hunting Kubernetes Sensitive Object Access Activity 2024-11-14
Kubernetes Azure detect sensitive role access N/A Hunting Kubernetes Sensitive Role Activity 2024-11-14
Kubernetes Azure detect service accounts forbidden failure access N/A Hunting Kubernetes Sensitive Object Access Activity 2024-11-14
Kubernetes Azure detect suspicious kubectl calls N/A Hunting Kubernetes Sensitive Object Access Activity 2024-11-14
Kubernetes Azure pod scan fingerprint N/A Hunting Kubernetes Scanning Activity 2024-11-14
Kubernetes Azure scan fingerprint Cloud Service Discovery Hunting Kubernetes Scanning Activity 2024-11-14
Kubernetes GCP detect most active service accounts by pod N/A Hunting Kubernetes Sensitive Role Activity 2024-11-14
Kubernetes GCP detect RBAC authorizations by account N/A Hunting Kubernetes Sensitive Role Activity 2024-11-14
Kubernetes GCP detect sensitive object access N/A Hunting Kubernetes Sensitive Object Access Activity 2024-11-14
Kubernetes GCP detect sensitive role access N/A Hunting Kubernetes Sensitive Role Activity 2024-11-14
Kubernetes GCP detect service accounts forbidden failure access N/A Hunting Kubernetes Sensitive Object Access Activity 2024-11-14
Kubernetes GCP detect suspicious kubectl calls N/A Hunting Kubernetes Sensitive Object Access Activity 2024-11-14
Linux Auditd Find Private Keys Linux Auditd Execve Private Keys Unsecured Credentials TTP Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation 2025-01-24
Local Account Discovery with Net CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Account Discovery Local Account Hunting Active Directory Discovery, Sandworm Tools 2025-01-24
Monitor DNS For Brand Abuse N/A TTP Brand Monitoring 2024-11-14
MSHTML Module Load in Office Product Sysmon EventID 7 Phishing Spearphishing Attachment TTP CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Microsoft MSHTML Remote Code Execution CVE-2021-40444, Spearphishing Attachments 2025-01-24
Multiple Okta Users With Invalid Credentials From The Same IP Password Spraying Valid Accounts Default Accounts TTP Suspicious Okta Activity 2024-11-14
Net Localgroup Discovery CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Permission Groups Discovery Local Groups Hunting Active Directory Discovery, Azorult, Graceful Wipe Out Attack, IcedID, Prestige Ransomware, Rhysida Ransomware, Volt Typhoon, Windows Discovery Techniques, Windows Post-Exploitation 2025-01-13
Network Connection Discovery With Net CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 System Network Connections Discovery Hunting Active Directory Discovery, Azorult, Prestige Ransomware, Windows Post-Exploitation 2025-01-24
O365 Suspicious Admin Email Forwarding Email Forwarding Rule Email Collection Anomaly Data Exfiltration, Office 365 Collection Techniques 2024-11-14
O365 Suspicious Rights Delegation Remote Email Collection Email Collection Additional Email Delegate Permissions Account Manipulation TTP Office 365 Collection Techniques 2024-11-14
O365 Suspicious User Email Forwarding Email Forwarding Rule Email Collection Anomaly Data Exfiltration, Office 365 Collection Techniques 2024-11-14
Office Application Drop Executable Sysmon EventID 1, Sysmon EventID 11 Phishing Spearphishing Attachment TTP AgentTesla, CVE-2023-21716 Word RTF Heap Corruption, Compromised Windows Host, FIN7, PlugX, Warzone RAT 2025-01-24
Office Application Spawn Regsvr32 process CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP Compromised Windows Host, IcedID, Qakbot 2025-01-13
Office Application Spawn rundll32 process CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP AgentTesla, Compromised Windows Host, IcedID, NjRAT, Spearphishing Attachments, Trickbot 2025-01-13
Office Document Creating Schedule Task Sysmon EventID 7 Phishing Spearphishing Attachment TTP Spearphishing Attachments 2025-01-24
Office Document Executing Macro Code Sysmon EventID 7 Phishing Spearphishing Attachment TTP AgentTesla, Azorult, DarkCrystal RAT, IcedID, NjRAT, PlugX, Qakbot, Remcos, Spearphishing Attachments, Trickbot 2025-01-24
Office Document Spawned Child Process To Download CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP CVE-2023-36884 Office and Windows HTML RCE Vulnerability, NjRAT, PlugX, Spearphishing Attachments 2025-01-24
Office Product Spawn CMD Process CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP AgentTesla, Azorult, CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability, DarkCrystal RAT, NjRAT, PlugX, Qakbot, Remcos, Trickbot, Warzone RAT 2025-01-13
Office Product Spawning BITSAdmin CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Compromised Windows Host, Spearphishing Attachments 2025-01-13
Office Product Spawning CertUtil CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP AgentTesla, CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Compromised Windows Host, Spearphishing Attachments, Trickbot 2025-01-13
Office Product Spawning MSHTA CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP Azorult, CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Compromised Windows Host, IcedID, NjRAT, Spearphishing Attachments 2025-01-13
Office Product Spawning Rundll32 with no DLL CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Compromised Windows Host, Spearphishing Attachments 2025-01-24
Office Product Spawning Windows Script Host CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Compromised Windows Host, Remcos, Spearphishing Attachments 2025-01-13
Office Product Spawning Wmic CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Compromised Windows Host, FIN7, Spearphishing Attachments 2025-01-13
Office Product Writing cab or inf CrowdStrike ProcessRollup2, Sysmon EventID 1, Sysmon EventID 11, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP Compromised Windows Host, Microsoft MSHTML Remote Code Execution CVE-2021-40444, Spearphishing Attachments 2025-01-24
Office Spawning Control CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP Compromised Windows Host, Microsoft MSHTML Remote Code Execution CVE-2021-40444, Spearphishing Attachments 2025-01-24
Okta Account Locked Out Brute Force Anomaly Okta MFA Exhaustion, Suspicious Okta Activity 2024-11-14
Okta Account Lockout Events Valid Accounts Default Accounts Anomaly Suspicious Okta Activity 2024-11-14
Okta Failed SSO Attempts Valid Accounts Default Accounts Anomaly Suspicious Okta Activity 2024-11-14
Okta ThreatInsight Login Failure with High Unknown users Valid Accounts Default Accounts Credential Stuffing TTP Suspicious Okta Activity 2024-11-14
Okta ThreatInsight Suspected PasswordSpray Attack Valid Accounts Default Accounts Password Spraying TTP Suspicious Okta Activity 2024-11-14
Okta Two or More Rejected Okta Pushes Brute Force TTP Okta MFA Exhaustion, Suspicious Okta Activity 2024-11-14
Open Redirect in Splunk Web N/A TTP Splunk Vulnerabilities 2024-12-17
Osquery pack - ColdRoot detection N/A TTP ColdRoot MacOS RAT 2024-11-14
Password Policy Discovery with Net CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Password Policy Discovery Hunting Active Directory Discovery 2025-01-24
Processes created by netsh Sysmon EventID 1 Disable or Modify System Firewall TTP Netsh Abuse 2024-11-14
Prohibited Software On Endpoint Sysmon EventID 1 N/A Hunting Emotet Malware DHS Report TA18-201A, Monitor for Unauthorized Software, SamSam Ransomware 2024-11-14
Reg exe used to hide files directories via registry keys Sysmon EventID 1 Hidden Files and Directories TTP Suspicious Windows Registry Activities, Windows Defense Evasion Tactics, Windows Persistence Techniques 2024-11-14
Remote Registry Key modifications Sysmon EventID 13 N/A TTP Suspicious Windows Registry Activities, Windows Defense Evasion Tactics, Windows Persistence Techniques 2024-11-14
Remote System Discovery with Net CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Remote System Discovery Hunting Active Directory Discovery, IcedID 2025-01-13
Scheduled tasks used in BadRabbit ransomware Sysmon EventID 1 Scheduled Task TTP Ransomware 2024-11-14
Spectre and Meltdown Vulnerable Systems N/A TTP Spectre And Meltdown Vulnerabilities 2024-11-14
Splunk Enterprise Information Disclosure N/A TTP Splunk Vulnerabilities 2024-12-17
Suspicious Changes to File Associations Sysmon EventID 1 Change Default File Association TTP Suspicious Windows Registry Activities, Windows File Extension and Association Abuse 2024-11-14
Suspicious Email - UBA Anomaly Phishing Anomaly Suspicious Emails 2024-11-14
Suspicious File Write Sysmon EventID 11 N/A Hunting Hidden Cobra Malware 2024-11-14
Suspicious Powershell Command-Line Arguments Sysmon EventID 1 PowerShell TTP CISA AA22-320A, Hermetic Wiper, Malicious PowerShell 2024-11-14
Suspicious Rundll32 Rename Sysmon EventID 1 System Binary Proxy Execution Masquerading Rundll32 Rename System Utilities Hunting Masquerading - Rename System Utilities, Suspicious Rundll32 Activity 2024-11-14
Suspicious writes to System Volume Information Sysmon EventID 1 Masquerading Hunting Collection and Staging 2024-11-14
Uncommon Processes On Endpoint Sysmon EventID 1 Malicious File Hunting Hermetic Wiper, Unusual Processes, Windows Privilege Escalation 2024-11-14
Unsigned Image Loaded by LSASS Sysmon EventID 7 LSASS Memory TTP Credential Dumping 2024-11-14
Unsuccessful Netbackup backups N/A Hunting Monitor Backup Solution 2024-11-14
Web Fraud - Account Harvesting Create Account TTP Web Fraud Detection 2024-11-14
Web Fraud - Anomalous User Clickspeed Valid Accounts Anomaly Web Fraud Detection 2024-11-14
Web Fraud - Password Sharing Across Accounts N/A Anomaly Web Fraud Detection 2024-11-14
Windows Command Shell Fetch Env Variables CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Process Injection TTP Qakbot 2025-01-24
Windows connhost exe started forcefully Sysmon EventID 1 Windows Command Shell TTP Ryuk Ransomware 2024-11-14
Windows DLL Search Order Hijacking Hunt CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 DLL Search Order Hijacking Hijack Execution Flow Hunting Living Off The Land, Windows Defense Evasion Tactics 2024-11-14
Windows hosts file modification Sysmon EventID 11 N/A TTP Host Redirection 2024-11-14
Windows Lateral Tool Transfer RemCom CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Lateral Tool Transfer TTP Active Directory Discovery 2024-12-10
Windows Modify Registry Reg Restore CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Query Registry Hunting Prestige Ransomware, Windows Post-Exploitation 2025-01-24
Windows MSIExec With Network Connections Sysmon EventID 1, Sysmon EventID 3 Msiexec TTP Windows System Binary Proxy Execution MSIExec 2025-01-24
Windows Network Share Interaction With Net Sysmon EventID 1 Network Share Discovery Data from Network Shared Drive TTP Active Directory Discovery, Active Directory Privilege Escalation, Network Discovery 2025-01-24
Windows Office Product Spawning MSDT CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP Compromised Windows Host, Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190, Spearphishing Attachments 2025-01-24
Windows Query Registry Reg Save CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Query Registry Hunting CISA AA23-347A, Prestige Ransomware, Windows Post-Exploitation 2025-01-24
Windows Service Stop Via Net and SC Application CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Service Stop Anomaly Graceful Wipe Out Attack, Prestige Ransomware 2025-01-24
Windows Valid Account With Never Expires Password CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Service Stop TTP Azorult, Compromised Windows Host 2025-01-24
Winword Spawning Cmd CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP CVE-2023-21716 Word RTF Heap Corruption, Compromised Windows Host, DarkCrystal RAT, Spearphishing Attachments 2025-01-13
Winword Spawning PowerShell CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP CVE-2023-21716 Word RTF Heap Corruption, Compromised Windows Host, DarkCrystal RAT, Spearphishing Attachments 2025-01-13
Winword Spawning Windows Script Host CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Phishing Spearphishing Attachment TTP CVE-2023-21716 Word RTF Heap Corruption, Compromised Windows Host, Spearphishing Attachments 2025-01-13