Privilege Escalation

Remote Services , Distributed Component Object Model , Windows Remote Management , Windows Management Instrumentation , Scheduled Task , Windows Service , Po...

Possible Lateral Movement PowerShell Spawn

Remote Services , Distributed Component Object Model , Windows Remote Management , Windows Management Instrumentation , Scheduled Task , Windows Service , Po...

Attempt To Delete Services

Service Stop, Create or Modify System Process, Windows Service

Attempt To Delete Services

Service Stop, Create or Modify System Process, Windows Service

Windows Service Created Within Public Path

Create or Modify System Process , Windows Service

Windows Service Created Within Public Path

Create or Modify System Process , Windows Service

Svchost LOLBAS Execution Process Spawn

Scheduled Task/Job , Scheduled Task

Svchost LOLBAS Execution Process Spawn

Scheduled Task/Job , Scheduled Task

Services LOLBAS Execution Process Spawn

Create or Modify System Process , Windows Service

Services LOLBAS Execution Process Spawn

Create or Modify System Process , Windows Service

Loading Of Dynwrapx Module

Process Injection , Dynamic-link Library Injection

Loading Of Dynwrapx Module

Process Injection , Dynamic-link Library Injection

Runas Execution in CommandLine

Access Token Manipulation , Token Impersonation/Theft

Runas Execution in CommandLine

Access Token Manipulation , Token Impersonation/Theft

Schtasks scheduling job on remote system

Scheduled Task , Scheduled Task/Job

Schtasks scheduling job on remote system

Scheduled Task , Scheduled Task/Job

Scheduled Task Initiation on Remote Endpoint

Scheduled Task/Job , Scheduled Task

Scheduled Task Initiation on Remote Endpoint

Scheduled Task/Job , Scheduled Task

Scheduled Task Creation on Remote Endpoint using At

Scheduled Task/Job , At (Windows)

Scheduled Task Creation on Remote Endpoint using At

Scheduled Task/Job , At (Windows)

Windows Service Initiation on Remote Endpoint

Create or Modify System Process , Windows Service

Windows Service Initiation on Remote Endpoint

Create or Modify System Process , Windows Service

Windows Service Creation on Remote Endpoint

Create or Modify System Process , Windows Service

Windows Service Creation on Remote Endpoint

Create or Modify System Process , Windows Service

WinEvent Windows Task Scheduler Event Action Started

Scheduled Task

SearchProtocolHost with no Command Line with Network

Process Injection

DLLHost with no Command Line Arguments with Network

Process Injection

Wscript Or Cscript Suspicious Child Process

Process Injection , Create or Modify System Process , Parent PID Spoofing , Access Token Manipulation

Wscript Or Cscript Suspicious Child Process

Process Injection , Create or Modify System Process , Parent PID Spoofing , Access Token Manipulation

Wscript Or Cscript Suspicious Child Process

Process Injection , Create or Modify System Process , Parent PID Spoofing , Access Token Manipulation

Wscript Or Cscript Suspicious Child Process

Process Injection , Create or Modify System Process , Parent PID Spoofing , Access Token Manipulation

Winhlp32 Spawning a Process

Process Injection

Print Processor Registry Autostart

Print Processors , Boot or Logon Autostart Execution

Print Processor Registry Autostart

Print Processors , Boot or Logon Autostart Execution

Screensaver Event Trigger Execution

Event Triggered Execution , Screensaver

Screensaver Event Trigger Execution

Event Triggered Execution , Screensaver

Logon Script Event Trigger Execution

Boot or Logon Initialization Scripts , Logon Script (Windows)

Logon Script Event Trigger Execution

Boot or Logon Initialization Scripts , Logon Script (Windows)

Change Default File Association

Change Default File Association , Event Triggered Execution

Change Default File Association

Change Default File Association , Event Triggered Execution

Suspicious SearchProtocolHost no Command Line Arguments

Process Injection

Suspicious GPUpdate no Command Line Arguments

Process Injection

Suspicious DLLHost no Command Line Arguments

Process Injection

Powershell Execute COM Object

Component Object Model Hijacking , Event Triggered Execution

Powershell Execute COM Object

Component Object Model Hijacking , Event Triggered Execution

Create Remote Thread In Shell Application

Process Injection

Rundll32 Create Remote Thread To A Process

Process Injection

Rundll32 CreateRemoteThread In Browser

Process Injection

Cloud Compute Instance Created By Previously Unseen User

Cloud Accounts , Valid Accounts

Cloud Compute Instance Created By Previously Unseen User

Cloud Accounts , Valid Accounts

UAC Bypass MMC Load Unsigned Dll

Bypass User Account Control , Abuse Elevation Control Mechanism

UAC Bypass MMC Load Unsigned Dll

Bypass User Account Control , Abuse Elevation Control Mechanism

Msmpeng Application DLL Side Loading

DLL Side-Loading , Hijack Execution Flow

Msmpeng Application DLL Side Loading

DLL Side-Loading , Hijack Execution Flow

Spoolsv Writing a DLL - Sysmon

Print Processors , Boot or Logon Autostart Execution

Spoolsv Writing a DLL - Sysmon

Print Processors , Boot or Logon Autostart Execution

Spoolsv Writing a DLL

Print Processors , Boot or Logon Autostart Execution

Spoolsv Writing a DLL

Print Processors , Boot or Logon Autostart Execution

Spoolsv Suspicious Process Access

Exploitation for Privilege Escalation

Spoolsv Suspicious Loaded Modules

Print Processors , Boot or Logon Autostart Execution

Spoolsv Suspicious Loaded Modules

Print Processors , Boot or Logon Autostart Execution

Spoolsv Spawning Rundll32

Print Processors , Boot or Logon Autostart Execution

Spoolsv Spawning Rundll32

Print Processors , Boot or Logon Autostart Execution

Print Spooler Failed to Load a Plug-in

Print Processors , Boot or Logon Autostart Execution

Print Spooler Failed to Load a Plug-in

Print Processors , Boot or Logon Autostart Execution

Print Spooler Adding A Printer Driver

Print Processors , Boot or Logon Autostart Execution

Print Spooler Adding A Printer Driver

Print Processors , Boot or Logon Autostart Execution

Detect WMI Event Subscription Persistence

Windows Management Instrumentation Event Subscription , Event Triggered Execution

Detect WMI Event Subscription Persistence

Windows Management Instrumentation Event Subscription , Event Triggered Execution

Powershell Fileless Process Injection via GetProcAddress

Command and Scripting Interpreter , Process Injection , PowerShell

CMD Echo Pipe - Escalation

Command and Scripting Interpreter , Windows Command Shell , Windows Service , Create or Modify System Process

CMD Echo Pipe - Escalation

Command and Scripting Interpreter , Windows Command Shell , Windows Service , Create or Modify System Process

Services Escalate Exe

Abuse Elevation Control Mechanism

SLUI Spawning a Process

Bypass User Account Control , Abuse Elevation Control Mechanism

SLUI Spawning a Process

Bypass User Account Control , Abuse Elevation Control Mechanism

SLUI RunAs Elevated

Bypass User Account Control , Abuse Elevation Control Mechanism

SLUI RunAs Elevated

Bypass User Account Control , Abuse Elevation Control Mechanism

Schtasks Run Task On Demand

Scheduled Task/Job

Suspicious Process File Path

Create or Modify System Process

XMRIG Driver Loaded

Windows Service , Create or Modify System Process

XMRIG Driver Loaded

Windows Service , Create or Modify System Process

Suspicious Driver Loaded Path

Windows Service , Create or Modify System Process

Suspicious Driver Loaded Path

Windows Service , Create or Modify System Process

Trickbot Named Pipe

Process Injection

Schedule Task with Rundll32 Command Trigger

Scheduled Task/Job

Schedule Task with HTTP Command Arguments

Scheduled Task/Job

Powershell Remote Thread To Known Windows Process

Process Injection

GPUpdate with no Command Line Arguments with Network

Process Injection

WinEvent Scheduled Task Created to Spawn Shell

Scheduled Task , Scheduled Task/Job

WinEvent Scheduled Task Created to Spawn Shell

Scheduled Task , Scheduled Task/Job

WinEvent Scheduled Task Created Within Public Path

Scheduled Task , Scheduled Task/Job

WinEvent Scheduled Task Created Within Public Path

Scheduled Task , Scheduled Task/Job

Clop Ransomware Known Service Name

Create or Modify System Process

AWS SetDefaultPolicyVersion

Cloud Accounts , Valid Accounts

AWS SetDefaultPolicyVersion

Cloud Accounts , Valid Accounts

Suspicious Scheduled Task from Public Directory

Scheduled Task , Scheduled Task/Job

Suspicious Scheduled Task from Public Directory

Scheduled Task , Scheduled Task/Job

FodHelper UAC Bypass

Modify Registry , Bypass User Account Control , Abuse Elevation Control Mechanism

FodHelper UAC Bypass

Modify Registry , Bypass User Account Control , Abuse Elevation Control Mechanism

Suspicious PlistBuddy Usage via OSquery

Launch Agent , Create or Modify System Process

Suspicious PlistBuddy Usage via OSquery

Launch Agent , Create or Modify System Process

Suspicious PlistBuddy Usage

Launch Agent , Create or Modify System Process

Suspicious PlistBuddy Usage

Launch Agent , Create or Modify System Process

Cobalt Strike Named Pipes

Process Injection

AWS Create Policy Version to allow all resources

Cloud Accounts , Valid Accounts

AWS Create Policy Version to allow all resources

Cloud Accounts , Valid Accounts

Detect Baron Samedit CVE-2021-3156 Segfault

Exploitation for Privilege Escalation

Detect Baron Samedit CVE-2021-3156 via OSQuery

Exploitation for Privilege Escalation

Detect Baron Samedit CVE-2021-3156

Exploitation for Privilege Escalation

AWS SAML Update identity provider

Valid Accounts

AWS SAML Access by Provider User and Principal

Valid Accounts

WMI Permanent Event Subscription - Sysmon

Windows Management Instrumentation Event Subscription , Event Triggered Execution

WMI Permanent Event Subscription - Sysmon

Windows Management Instrumentation Event Subscription , Event Triggered Execution

Shim Database File Creation

Application Shimming , Event Triggered Execution

Shim Database File Creation

Application Shimming , Event Triggered Execution

Schtasks used for forcing a reboot

Scheduled Task , Scheduled Task/Job

Schtasks used for forcing a reboot

Scheduled Task , Scheduled Task/Job

Reg exe Manipulating Windows Services Registry Keys

Services Registry Permissions Weakness , Hijack Execution Flow

Reg exe Manipulating Windows Services Registry Keys

Services Registry Permissions Weakness , Hijack Execution Flow

Shim Database Installation With Suspicious Parameters

Application Shimming , Event Triggered Execution

Shim Database Installation With Suspicious Parameters

Application Shimming , Event Triggered Execution

Disabling Remote User Account Control

Bypass User Account Control , Abuse Elevation Control Mechanism

Disabling Remote User Account Control

Bypass User Account Control , Abuse Elevation Control Mechanism

Detect Excessive Account Lockouts From Endpoint

Valid Accounts , Domain Accounts

Detect Excessive Account Lockouts From Endpoint

Valid Accounts , Domain Accounts

GCP Detect high risk permissions by resource and account

Valid Accounts

GCP Detect accounts with high risk roles by project

Valid Accounts

Cloud Provisioning Activity From Previously Unseen Country

Valid Accounts

Cloud Provisioning Activity From Previously Unseen City

Valid Accounts

GCP Detect gcploit framework

Valid Accounts

Abnormally High Number Of Cloud Security Group API Calls

Cloud Accounts , Valid Accounts

Abnormally High Number Of Cloud Security Group API Calls

Cloud Accounts , Valid Accounts

Abnormally High Number Of Cloud Infrastructure API Calls

Cloud Accounts , Valid Accounts

Abnormally High Number Of Cloud Infrastructure API Calls

Cloud Accounts , Valid Accounts

Cloud API Calls From Previously Unseen User Roles

Valid Accounts

gcp detect oauth token abuse

Valid Accounts

Unusual LOLBAS in short period of time

Command and Scripting Interpreter, Scheduled Task/Job

Abnormally High Number Of Cloud Instances Launched

Cloud Accounts , Valid Accounts

Abnormally High Number Of Cloud Instances Launched

Cloud Accounts , Valid Accounts

Abnormally High Number Of Cloud Instances Destroyed

Cloud Accounts , Valid Accounts

Abnormally High Number Of Cloud Instances Destroyed

Cloud Accounts , Valid Accounts

Cloud Provisioning Activity From Previously Unseen Region

Valid Accounts

Cloud Provisioning Activity From Previously Unseen IP Address

Valid Accounts

Cloud Instance Modified By Previously Unseen User

Cloud Accounts , Valid Accounts

Cloud Instance Modified By Previously Unseen User

Cloud Accounts , Valid Accounts

aws detect sts assume role abuse

Valid Accounts

aws detect role creation

Valid Accounts

aws detect permanent key creation

Valid Accounts

aws detect attach to role policy

Valid Accounts

Suspicious Changes to File Associations

Change Default File Association

Scheduled tasks used in BadRabbit ransomware

Scheduled Task

Sc exe Manipulating Windows Services

Windows Service , Create or Modify System Process

Sc exe Manipulating Windows Services

Windows Service , Create or Modify System Process

Overwriting Accessibility Binaries

Event Triggered Execution , Accessibility Features

Overwriting Accessibility Binaries

Event Triggered Execution , Accessibility Features

Okta User Logins From Multiple Cities

Valid Accounts , Default Accounts

Okta User Logins From Multiple Cities

Valid Accounts , Default Accounts

Okta Failed SSO Attempts

Valid Accounts , Default Accounts

Okta Failed SSO Attempts

Valid Accounts , Default Accounts

Okta Account Lockout Events

Valid Accounts , Default Accounts

Okta Account Lockout Events

Valid Accounts , Default Accounts

Multiple Okta Users With Invalid Credentials From The Same IP

Valid Accounts , Default Accounts

Multiple Okta Users With Invalid Credentials From The Same IP

Valid Accounts , Default Accounts

EC2 Instance Started With Previously Unseen User

Cloud Accounts

EC2 Instance Modified With Previously Unseen User

Cloud Accounts

Detect Spike in AWS API Activity

Cloud Accounts

Detect new user AWS Console Login

Cloud Accounts

Detect Excessive User Account Lockouts

Valid Accounts , Local Accounts

Detect Excessive User Account Lockouts

Valid Accounts , Local Accounts

Detect AWS API Activities From Unapproved Accounts

Cloud Accounts

Abnormally High AWS Instances Terminated by User - MLTK

Cloud Accounts

Abnormally High AWS Instances Terminated by User

Cloud Accounts

Abnormally High AWS Instances Launched by User - MLTK

Cloud Accounts

Abnormally High AWS Instances Launched by User

Cloud Accounts

Detect Path Interception By Creation Of program exe

Path Interception by Unquoted Path , Hijack Execution Flow

Detect Path Interception By Creation Of program exe

Path Interception by Unquoted Path , Hijack Execution Flow

First Time Seen Child Process of Zoom

Exploitation for Privilege Escalation

Child Processes of Spoolsv exe

Exploitation for Privilege Escalation

WSReset UAC Bypass

Bypass User Account Control , Abuse Elevation Control Mechanism

WSReset UAC Bypass

Bypass User Account Control , Abuse Elevation Control Mechanism

SilentCleanup UAC Bypass

Bypass User Account Control , Abuse Elevation Control Mechanism

SilentCleanup UAC Bypass

Bypass User Account Control , Abuse Elevation Control Mechanism

Sdclt UAC Bypass

Bypass User Account Control , Abuse Elevation Control Mechanism

Sdclt UAC Bypass

Bypass User Account Control , Abuse Elevation Control Mechanism

Registry Keys for Creating SHIM Databases

Application Shimming , Event Triggered Execution

Registry Keys for Creating SHIM Databases

Application Shimming , Event Triggered Execution

Monitor Registry Keys for Print Monitors

Port Monitors , Boot or Logon Autostart Execution

Monitor Registry Keys for Print Monitors

Port Monitors , Boot or Logon Autostart Execution

Web Fraud - Anomalous User Clickspeed

Valid Accounts

Detect Spike in Security Group Activity

Cloud Accounts

Detect new API calls from user roles

Cloud Accounts

Identify New User Accounts

Domain Accounts