Persistence

Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...

Possible Lateral Movement PowerShell Spawn

Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...

Randomly Generated Scheduled Task Name

Scheduled Task/Job, Scheduled Task

Randomly Generated Scheduled Task Name

Scheduled Task/Job, Scheduled Task

Randomly Generated Windows Service Name

Create or Modify System Process, Windows Service

Randomly Generated Windows Service Name

Create or Modify System Process, Windows Service

Attempt To Delete Services

Service Stop, Create or Modify System Process, Windows Service

Attempt To Delete Services

Service Stop, Create or Modify System Process, Windows Service

Services LOLBAS Execution Process Spawn

Create or Modify System Process, Windows Service

Services LOLBAS Execution Process Spawn

Create or Modify System Process, Windows Service

Windows Service Created Within Public Path

Create or Modify System Process, Windows Service

Windows Service Created Within Public Path

Create or Modify System Process, Windows Service

Svchost LOLBAS Execution Process Spawn

Scheduled Task/Job, Scheduled Task

Svchost LOLBAS Execution Process Spawn

Scheduled Task/Job, Scheduled Task

Scheduled Task Initiation on Remote Endpoint

Scheduled Task/Job, Scheduled Task

Scheduled Task Initiation on Remote Endpoint

Scheduled Task/Job, Scheduled Task

Scheduled Task Creation on Remote Endpoint using At

Scheduled Task/Job, At

Scheduled Task Creation on Remote Endpoint using At

Scheduled Task/Job, At

Windows Service Creation on Remote Endpoint

Create or Modify System Process, Windows Service

Windows Service Creation on Remote Endpoint

Create or Modify System Process, Windows Service

Windows Service Initiation on Remote Endpoint

Create or Modify System Process, Windows Service

Windows Service Initiation on Remote Endpoint

Create or Modify System Process, Windows Service

WinEvent Windows Task Scheduler Event Action Started

Scheduled Task

Wscript Or Cscript Suspicious Child Process

Process Injection, Create or Modify System Process, Parent PID Spoofing, Access Token Manipulation

Detect Exchange Web Shell

Server Software Component, Web Shell, Exploit Public-Facing Application

Detect Exchange Web Shell

Server Software Component, Web Shell, Exploit Public-Facing Application

Print Processor Registry Autostart

Print Processors, Boot or Logon Autostart Execution

Print Processor Registry Autostart

Print Processors, Boot or Logon Autostart Execution

Screensaver Event Trigger Execution

Event Triggered Execution, Screensaver

Screensaver Event Trigger Execution

Event Triggered Execution, Screensaver

Logon Script Event Trigger Execution

Boot or Logon Initialization Scripts, Logon Script (Windows)

Logon Script Event Trigger Execution

Boot or Logon Initialization Scripts, Logon Script (Windows)

Change Default File Association

Change Default File Association, Event Triggered Execution

Change Default File Association

Change Default File Association, Event Triggered Execution

BITS Job Persistence

BITS Jobs

BITSAdmin Download File

BITS Jobs, Ingress Tool Transfer

Create local admin accounts using net exe

Local Account, Create Account

Create local admin accounts using net exe

Local Account, Create Account

Circle CI Disable Security Job

Compromise Client Software Binary

Circle CI Disable Security Step

Compromise Client Software Binary

AWS CreateLoginProfile

Cloud Account, Create Account

AWS CreateLoginProfile

Cloud Account, Create Account

Cloud Compute Instance Created By Previously Unseen User

Cloud Accounts, Valid Accounts

Cloud Compute Instance Created By Previously Unseen User

Cloud Accounts, Valid Accounts

Msmpeng Application DLL Side Loading

DLL Side-Loading, Hijack Execution Flow

Msmpeng Application DLL Side Loading

DLL Side-Loading, Hijack Execution Flow

Spoolsv Writing a DLL

Print Processors, Boot or Logon Autostart Execution

Spoolsv Writing a DLL

Print Processors, Boot or Logon Autostart Execution

Spoolsv Suspicious Loaded Modules

Print Processors, Boot or Logon Autostart Execution

Spoolsv Suspicious Loaded Modules

Print Processors, Boot or Logon Autostart Execution

Spoolsv Writing a DLL - Sysmon

Print Processors, Boot or Logon Autostart Execution

Spoolsv Writing a DLL - Sysmon

Print Processors, Boot or Logon Autostart Execution

Print Spooler Adding A Printer Driver

Print Processors, Boot or Logon Autostart Execution

Print Spooler Adding A Printer Driver

Print Processors, Boot or Logon Autostart Execution

Print Spooler Failed to Load a Plug-in

Print Processors, Boot or Logon Autostart Execution

Print Spooler Failed to Load a Plug-in

Print Processors, Boot or Logon Autostart Execution

Spoolsv Spawning Rundll32

Print Processors, Boot or Logon Autostart Execution

Spoolsv Spawning Rundll32

Print Processors, Boot or Logon Autostart Execution

Detect WMI Event Subscription Persistence

Windows Management Instrumentation Event Subscription, Event Triggered Execution

Detect WMI Event Subscription Persistence

Windows Management Instrumentation Event Subscription, Event Triggered Execution

CMD Echo Pipe - Escalation

Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process

CMD Echo Pipe - Escalation

Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process

Schtasks Run Task On Demand

Scheduled Task/Job

Suspicious Process File Path

Create or Modify System Process

Suspicious Driver Loaded Path

Windows Service, Create or Modify System Process

Suspicious Driver Loaded Path

Windows Service, Create or Modify System Process

XMRIG Driver Loaded

Windows Service, Create or Modify System Process

XMRIG Driver Loaded

Windows Service, Create or Modify System Process

Schedule Task with Rundll32 Command Trigger

Scheduled Task/Job

Schedule Task with HTTP Command Arguments

Scheduled Task/Job

WinEvent Scheduled Task Created to Spawn Shell

Scheduled Task, Scheduled Task/Job

WinEvent Scheduled Task Created to Spawn Shell

Scheduled Task, Scheduled Task/Job

WinEvent Scheduled Task Created Within Public Path

Scheduled Task, Scheduled Task/Job

WinEvent Scheduled Task Created Within Public Path

Scheduled Task, Scheduled Task/Job

AWS IAM Delete Policy

Account Manipulation

AWS IAM Failure Group Deletion

Account Manipulation

AWS IAM Successful Group Deletion

Cloud Groups, Account Manipulation, Permission Groups Discovery

PowerShell Start-BitsTransfer

BITS Jobs

Clop Ransomware Known Service Name

Create or Modify System Process

W3WP Spawning Shell

Server Software Component, Web Shell

W3WP Spawning Shell

Server Software Component, Web Shell

AWS SetDefaultPolicyVersion

Cloud Accounts, Valid Accounts

AWS SetDefaultPolicyVersion

Cloud Accounts, Valid Accounts

Suspicious Scheduled Task from Public Directory

Scheduled Task, Scheduled Task/Job

Suspicious Scheduled Task from Public Directory

Scheduled Task, Scheduled Task/Job

Suspicious PlistBuddy Usage

Launch Agent, Create or Modify System Process

Suspicious PlistBuddy Usage

Launch Agent, Create or Modify System Process

Suspicious PlistBuddy Usage via OSquery

Launch Agent, Create or Modify System Process

Suspicious PlistBuddy Usage via OSquery

Launch Agent, Create or Modify System Process

O365 New Federated Domain Added

Cloud Account, Create Account

O365 New Federated Domain Added

Cloud Account, Create Account

AWS SAML Access by Provider User and Principal

Valid Accounts

O365 Add App Role Assignment Grant User

Cloud Account, Create Account

O365 Add App Role Assignment Grant User

Cloud Account, Create Account

O365 Excessive SSO logon errors

Modify Authentication Process

AWS SAML Update identity provider

Valid Accounts

Supernova Webshell

Web Shell

WMI Permanent Event Subscription - Sysmon

Windows Management Instrumentation Event Subscription, Event Triggered Execution

WMI Permanent Event Subscription - Sysmon

Windows Management Instrumentation Event Subscription, Event Triggered Execution

Shim Database File Creation

Application Shimming, Event Triggered Execution

Shim Database File Creation

Application Shimming, Event Triggered Execution

Schtasks used for forcing a reboot

Scheduled Task, Scheduled Task/Job

Schtasks used for forcing a reboot

Scheduled Task, Scheduled Task/Job

Reg exe Manipulating Windows Services Registry Keys

Services Registry Permissions Weakness, Hijack Execution Flow

Reg exe Manipulating Windows Services Registry Keys

Services Registry Permissions Weakness, Hijack Execution Flow

Shim Database Installation With Suspicious Parameters

Application Shimming, Event Triggered Execution

Shim Database Installation With Suspicious Parameters

Application Shimming, Event Triggered Execution

Detect Software Download To Network Device

TFTP Boot, Pre-OS Boot

Detect Software Download To Network Device

TFTP Boot, Pre-OS Boot

Cloud Provisioning Activity From Previously Unseen City

Valid Accounts

Cloud Provisioning Activity From Previously Unseen Country

Valid Accounts

GCP Detect high risk permissions by resource and account

Valid Accounts

GCP Detect accounts with high risk roles by project

Valid Accounts

GCP Detect gcploit framework

Valid Accounts

Abnormally High Number Of Cloud Security Group API Calls

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Security Group API Calls

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Infrastructure API Calls

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Infrastructure API Calls

Cloud Accounts, Valid Accounts

Cloud API Calls From Previously Unseen User Roles

Valid Accounts

gcp detect oauth token abuse

Valid Accounts

Unusual LOLBAS in short period of time

Command and Scripting Interpreter, Scheduled Task/Job

Abnormally High Number Of Cloud Instances Launched

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Instances Launched

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Instances Destroyed

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Instances Destroyed

Cloud Accounts, Valid Accounts

Cloud Provisioning Activity From Previously Unseen IP Address

Valid Accounts

Cloud Provisioning Activity From Previously Unseen Region

Valid Accounts

Cloud Instance Modified By Previously Unseen User

Cloud Accounts, Valid Accounts

Cloud Instance Modified By Previously Unseen User

Cloud Accounts, Valid Accounts

aws detect sts assume role abuse

Valid Accounts

aws detect attach to role policy

Valid Accounts

aws detect role creation

Valid Accounts

aws detect permanent key creation

Valid Accounts

Suspicious Changes to File Associations

Change Default File Association

Sc exe Manipulating Windows Services

Windows Service, Create or Modify System Process

Sc exe Manipulating Windows Services

Windows Service, Create or Modify System Process

Abnormally High AWS Instances Launched by User - MLTK

Cloud Accounts

Detect new user AWS Console Login

Cloud Accounts

Detect AWS API Activities From Unapproved Accounts

Cloud Accounts

Detect Spike in AWS API Activity

Cloud Accounts

Abnormally High AWS Instances Terminated by User

Cloud Accounts

Okta User Logins From Multiple Cities

Valid Accounts, Default Accounts

Okta User Logins From Multiple Cities

Valid Accounts, Default Accounts

EC2 Instance Modified With Previously Unseen User

Cloud Accounts

Abnormally High AWS Instances Launched by User

Cloud Accounts

EC2 Instance Started With Previously Unseen User

Cloud Accounts

Abnormally High AWS Instances Terminated by User - MLTK

Cloud Accounts

Overwriting Accessibility Binaries

Event Triggered Execution, Accessibility Features

Overwriting Accessibility Binaries

Event Triggered Execution, Accessibility Features

Scheduled tasks used in BadRabbit ransomware

Scheduled Task

Detect New Local Admin account

Local Account, Create Account

Detect New Local Admin account

Local Account, Create Account

Short Lived Windows Accounts

Local Account, Create Account

Short Lived Windows Accounts

Local Account, Create Account

Detect Path Interception By Creation Of program exe

Path Interception by Unquoted Path, Hijack Execution Flow

Detect Path Interception By Creation Of program exe

Path Interception by Unquoted Path, Hijack Execution Flow

Monitor Registry Keys for Print Monitors

Port Monitors, Boot or Logon Autostart Execution

Monitor Registry Keys for Print Monitors

Port Monitors, Boot or Logon Autostart Execution

Registry Keys for Creating SHIM Databases

Application Shimming, Event Triggered Execution

Registry Keys for Creating SHIM Databases

Application Shimming, Event Triggered Execution

Web Fraud - Account Harvesting

Create Account

Web Fraud - Anomalous User Clickspeed

Valid Accounts

Detect Spike in Security Group Activity

Cloud Accounts

Detect new API calls from user roles

Cloud Accounts

Identify New User Accounts

Domain Accounts