WinEvent Windows Task Scheduler Event Action Started
Scheduled Task
Persistence
Wscript Or Cscript Suspicious Child Process
Process Injection, Create or Modify System Process, Parent PID Spoofing, Access Token Manipulation
Detect Exchange Web Shell
Server Software Component, Web Shell
Detect Exchange Web Shell
Server Software Component, Web Shell
Time Provider Persistence Registry
Time Providers, Boot or Logon Autostart Execution
Time Provider Persistence Registry
Time Providers, Boot or Logon Autostart Execution
Print Processor Registry Autostart
Print Processors, Boot or Logon Autostart Execution
Print Processor Registry Autostart
Print Processors, Boot or Logon Autostart Execution
Active Setup Registry Autostart
Active Setup, Boot or Logon Autostart Execution
Active Setup Registry Autostart
Active Setup, Boot or Logon Autostart Execution
Screensaver Event Trigger Execution
Event Triggered Execution, Screensaver
Screensaver Event Trigger Execution
Event Triggered Execution, Screensaver
Logon Script Event Trigger Execution
Boot or Logon Initialization Scripts, Logon Script (Windows)
Logon Script Event Trigger Execution
Boot or Logon Initialization Scripts, Logon Script (Windows)
Change Default File Association
Change Default File Association, Event Triggered Execution
Change Default File Association
Change Default File Association, Event Triggered Execution
BITSAdmin Download File
BITS Jobs, Ingress Tool Transfer
BITS Job Persistence
BITS Jobs
Create local admin accounts using net exe
Local Account, Create Account
Create local admin accounts using net exe
Local Account, Create Account
Registry Keys Used For Persistence
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Registry Keys Used For Persistence
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Circle CI Disable Security Job
Compromise Client Software Binary
Circle CI Disable Security Step
Compromise Client Software Binary
Powershell Execute COM Object
Component Object Model Hijacking, Event Triggered Execution
Powershell Execute COM Object
Component Object Model Hijacking, Event Triggered Execution
AWS UpdateLoginProfile
Cloud Account, Create Account
AWS UpdateLoginProfile
Cloud Account, Create Account
AWS CreateLoginProfile
Cloud Account, Create Account
AWS CreateLoginProfile
Cloud Account, Create Account
AWS CreateAccessKey
Cloud Account, Create Account
AWS CreateAccessKey
Cloud Account, Create Account
Cloud Compute Instance Created By Previously Unseen User
Cloud Accounts, Valid Accounts
Cloud Compute Instance Created By Previously Unseen User
Cloud Accounts, Valid Accounts
Msmpeng Application DLL Side Loading
DLL Side-Loading, Hijack Execution Flow
Msmpeng Application DLL Side Loading
DLL Side-Loading, Hijack Execution Flow
Spoolsv Writing a DLL - Sysmon
Print Processors, Boot or Logon Autostart Execution
Spoolsv Writing a DLL - Sysmon
Print Processors, Boot or Logon Autostart Execution
Spoolsv Writing a DLL
Print Processors, Boot or Logon Autostart Execution
Spoolsv Writing a DLL
Print Processors, Boot or Logon Autostart Execution
Spoolsv Suspicious Loaded Modules
Print Processors, Boot or Logon Autostart Execution
Spoolsv Suspicious Loaded Modules
Print Processors, Boot or Logon Autostart Execution
Spoolsv Spawning Rundll32
Print Processors, Boot or Logon Autostart Execution
Spoolsv Spawning Rundll32
Print Processors, Boot or Logon Autostart Execution
Print Spooler Failed to Load a Plug-in
Print Processors, Boot or Logon Autostart Execution
Print Spooler Failed to Load a Plug-in
Print Processors, Boot or Logon Autostart Execution
Print Spooler Adding A Printer Driver
Print Processors, Boot or Logon Autostart Execution
Print Spooler Adding A Printer Driver
Print Processors, Boot or Logon Autostart Execution
Detect WMI Event Subscription Persistence
Windows Management Instrumentation Event Subscription, Event Triggered Execution
Detect WMI Event Subscription Persistence
Windows Management Instrumentation Event Subscription, Event Triggered Execution
Start Up During Safe Mode Boot
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Start Up During Safe Mode Boot
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Rare Parent-Child Process Relationship
Exploitation for Client Execution, Command and Scripting Interpreter, Scheduled Task/Job, Software Deployment Tools
CMD Echo Pipe - Escalation
Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process
CMD Echo Pipe - Escalation
Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process
Schtasks Run Task On Demand
Scheduled Task/Job
Suspicious Process File Path
Create or Modify System Process
XMRIG Driver Loaded
Windows Service, Create or Modify System Process
XMRIG Driver Loaded
Windows Service, Create or Modify System Process
Suspicious Driver Loaded Path
Windows Service, Create or Modify System Process
Suspicious Driver Loaded Path
Windows Service, Create or Modify System Process
Schedule Task with Rundll32 Command Trigger
Scheduled Task/Job
Schedule Task with HTTP Command Arguments
Scheduled Task/Job
WinEvent Scheduled Task Created to Spawn Shell
Scheduled Task, Scheduled Task/Job
WinEvent Scheduled Task Created to Spawn Shell
Scheduled Task, Scheduled Task/Job
WinEvent Scheduled Task Created Within Public Path
Scheduled Task, Scheduled Task/Job
WinEvent Scheduled Task Created Within Public Path
Scheduled Task, Scheduled Task/Job
AWS IAM Failure Group Deletion
Account Manipulation
AWS IAM Delete Policy
Account Manipulation
AWS IAM Successful Group Deletion
Cloud Groups, Account Manipulation, Permission Groups Discovery
PowerShell Start-BitsTransfer
BITS Jobs
Clop Ransomware Known Service Name
Create or Modify System Process
W3WP Spawning Shell
Server Software Component, Web Shell
W3WP Spawning Shell
Server Software Component, Web Shell
AWS SetDefaultPolicyVersion
Cloud Accounts, Valid Accounts
AWS SetDefaultPolicyVersion
Cloud Accounts, Valid Accounts
Suspicious Scheduled Task from Public Directory
Scheduled Task, Scheduled Task/Job
Suspicious Scheduled Task from Public Directory
Scheduled Task, Scheduled Task/Job
Suspicious PlistBuddy Usage via OSquery
Launch Agent, Create or Modify System Process
Suspicious PlistBuddy Usage via OSquery
Launch Agent, Create or Modify System Process
Suspicious PlistBuddy Usage
Launch Agent, Create or Modify System Process
Suspicious PlistBuddy Usage
Launch Agent, Create or Modify System Process
AWS Create Policy Version to allow all resources
Cloud Accounts, Valid Accounts
AWS Create Policy Version to allow all resources
Cloud Accounts, Valid Accounts
O365 New Federated Domain Added
Cloud Account, Create Account
O365 New Federated Domain Added
Cloud Account, Create Account
O365 Excessive SSO logon errors
Modify Authentication Process
O365 Added Service Principal
Cloud Account, Create Account
O365 Added Service Principal
Cloud Account, Create Account
O365 Add App Role Assignment Grant User
Cloud Account, Create Account
O365 Add App Role Assignment Grant User
Cloud Account, Create Account
AWS SAML Update identity provider
Valid Accounts
AWS SAML Access by Provider User and Principal
Valid Accounts
Supernova Webshell
Web Shell
Scheduled Task Deleted Or Created via CMD
Scheduled Task, Scheduled Task/Job
Scheduled Task Deleted Or Created via CMD
Scheduled Task, Scheduled Task/Job
O365 Disable MFA
Modify Authentication Process
WMI Permanent Event Subscription - Sysmon
Windows Management Instrumentation Event Subscription, Event Triggered Execution
WMI Permanent Event Subscription - Sysmon
Windows Management Instrumentation Event Subscription, Event Triggered Execution
Shim Database File Creation
Application Shimming, Event Triggered Execution
Shim Database File Creation
Application Shimming, Event Triggered Execution
Schtasks used for forcing a reboot
Scheduled Task, Scheduled Task/Job
Schtasks used for forcing a reboot
Scheduled Task, Scheduled Task/Job
Registry Keys Used For Privilege Escalation
Image File Execution Options Injection, Event Triggered Execution
Registry Keys Used For Privilege Escalation
Image File Execution Options Injection, Event Triggered Execution
Registry Keys for Creating SHIM Databases
Application Shimming, Event Triggered Execution
Registry Keys for Creating SHIM Databases
Application Shimming, Event Triggered Execution
Reg exe Manipulating Windows Services Registry Keys
Services Registry Permissions Weakness, Hijack Execution Flow
Reg exe Manipulating Windows Services Registry Keys
Services Registry Permissions Weakness, Hijack Execution Flow
Shim Database Installation With Suspicious Parameters
Application Shimming, Event Triggered Execution
Shim Database Installation With Suspicious Parameters
Application Shimming, Event Triggered Execution
Monitor Registry Keys for Print Monitors
Port Monitors, Boot or Logon Autostart Execution
Monitor Registry Keys for Print Monitors
Port Monitors, Boot or Logon Autostart Execution
Illegal Privilege Elevation and Persistence via PowerSploit modules
Scheduled Task/Job, Access Token Manipulation, Abuse Elevation Control Mechanism
Illegal Management of Computers and Active Directory Elements via PowerSploit modules
Account Manipulation, Rogue Domain Controller, Domain Policy Modification
Illegal Management of Active Directory Elements and Policies via DSInternals modules
Account Manipulation, Rogue Domain Controller, Domain Policy Modification
Illegal Enabling or Disabling of Accounts via DSInternals modules
Valid Accounts, Account Manipulation
Illegal Enabling or Disabling of Accounts via DSInternals modules
Valid Accounts, Account Manipulation
Detect Excessive Account Lockouts From Endpoint
Valid Accounts, Domain Accounts
Detect Excessive Account Lockouts From Endpoint
Valid Accounts, Domain Accounts
Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
Create or Modify System Process, Process Injection, Hijack Execution Flow
Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
Create or Modify System Process, Process Injection, Hijack Execution Flow
Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Executi...
Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Executi...
Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Executi...
Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Executi...
Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Executi...
Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules
Valid Accounts, Account Discovery, Domain Policy Modification
Reconnaissance and Access to Accounts and Groups via Mimikatz modules
Valid Accounts, Account Discovery, Domain Policy Modification
Probing Access with Stolen Credentials via PowerSploit modules
Valid Accounts, Account Manipulation
Probing Access with Stolen Credentials via PowerSploit modules
Valid Accounts, Account Manipulation
Setting Credentials via PowerSploit modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Setting Credentials via PowerSploit modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Setting Credentials via Mimikatz modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Setting Credentials via Mimikatz modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Setting Credentials via DSInternals modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Setting Credentials via DSInternals modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Reconnaissance of Credential Stores and Services via Mimikatz modules
Account Manipulation, Domain Properties, Valid Accounts, Credentials, Gather Victim Network Information, Exploitation for Privilege Escalation, Gather Victim...
Reconnaissance of Credential Stores and Services via Mimikatz modules
Account Manipulation, Domain Properties, Valid Accounts, Credentials, Gather Victim Network Information, Exploitation for Privilege Escalation, Gather Victim...
Assessment of Credential Strength via DSInternals modules
Valid Accounts, Account Manipulation, Account Discovery, Password Policy Discovery, Unsecured Credentials, Credentials from Password Stores
Assessment of Credential Strength via DSInternals modules
Valid Accounts, Account Manipulation, Account Discovery, Password Policy Discovery, Unsecured Credentials, Credentials from Password Stores
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Detect Software Download To Network Device
TFTP Boot, Pre-OS Boot
Detect Software Download To Network Device
TFTP Boot, Pre-OS Boot
Cloud Provisioning Activity From Previously Unseen Country
Valid Accounts
Cloud Provisioning Activity From Previously Unseen City
Valid Accounts
GCP Detect gcploit framework
Valid Accounts
Abnormally High Number Of Cloud Security Group API Calls
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Security Group API Calls
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Infrastructure API Calls
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Infrastructure API Calls
Cloud Accounts, Valid Accounts
Cloud API Calls From Previously Unseen User Roles
Valid Accounts
More than usual number of LOLBAS applications in short time period
Command and Scripting Interpreter, Scheduled Task/Job
Abnormally High Number Of Cloud Instances Launched
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Instances Launched
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Instances Destroyed
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Instances Destroyed
Cloud Accounts, Valid Accounts
Cloud Provisioning Activity From Previously Unseen Region
Valid Accounts
Cloud Instance Modified By Previously Unseen User
Cloud Accounts, Valid Accounts
Cloud Instance Modified By Previously Unseen User
Cloud Accounts, Valid Accounts
aws detect sts assume role abuse
Valid Accounts
aws detect role creation
Valid Accounts
aws detect permanent key creation
Valid Accounts
aws detect attach to role policy
Valid Accounts
Schtasks scheduling job on remote system
Scheduled Task, Scheduled Task/Job
Schtasks scheduling job on remote system
Scheduled Task, Scheduled Task/Job
Sc exe Manipulating Windows Services
Windows Service, Create or Modify System Process
Sc exe Manipulating Windows Services
Windows Service, Create or Modify System Process
Overwriting Accessibility Binaries
Event Triggered Execution, Accessibility Features
Overwriting Accessibility Binaries
Event Triggered Execution, Accessibility Features
Okta User Logins From Multiple Cities
Valid Accounts, Default Accounts
Okta User Logins From Multiple Cities
Valid Accounts, Default Accounts
Okta Failed SSO Attempts
Valid Accounts, Default Accounts
Okta Failed SSO Attempts
Valid Accounts, Default Accounts
Okta Account Lockout Events
Valid Accounts, Default Accounts
Okta Account Lockout Events
Valid Accounts, Default Accounts
Multiple Okta Users With Invalid Credentials From The Same IP
Valid Accounts, Default Accounts
Multiple Okta Users With Invalid Credentials From The Same IP
Valid Accounts, Default Accounts
Detect Excessive User Account Lockouts
Valid Accounts, Local Accounts
Detect Excessive User Account Lockouts
Valid Accounts, Local Accounts
Detect New Local Admin account
Local Account, Create Account
Detect New Local Admin account
Local Account, Create Account
Short Lived Windows Accounts
Local Account, Create Account
Short Lived Windows Accounts
Local Account, Create Account
Detect Path Interception By Creation Of program exe
Path Interception by Unquoted Path, Hijack Execution Flow
Detect Path Interception By Creation Of program exe
Path Interception by Unquoted Path, Hijack Execution Flow
New container uploaded to AWS ECR
Implant Internal Image