WinEvent Windows Task Scheduler Event Action Started
Scheduled Task
Privilege Escalation
SearchProtocolHost with no Command Line with Network
Process Injection
DLLHost with no Command Line Arguments with Network
Process Injection
Wscript Or Cscript Suspicious Child Process
Process Injection, Create or Modify System Process, Parent PID Spoofing, Access Token Manipulation
Wscript Or Cscript Suspicious Child Process
Process Injection, Create or Modify System Process, Parent PID Spoofing, Access Token Manipulation
Wscript Or Cscript Suspicious Child Process
Process Injection, Create or Modify System Process, Parent PID Spoofing, Access Token Manipulation
Wscript Or Cscript Suspicious Child Process
Process Injection, Create or Modify System Process, Parent PID Spoofing, Access Token Manipulation
Winhlp32 Spawning a Process
Process Injection
Time Provider Persistence Registry
Time Providers, Boot or Logon Autostart Execution
Time Provider Persistence Registry
Time Providers, Boot or Logon Autostart Execution
Disable UAC Remote Restriction
Bypass User Account Control, Abuse Elevation Control Mechanism
Disable UAC Remote Restriction
Bypass User Account Control, Abuse Elevation Control Mechanism
Print Processor Registry Autostart
Print Processors, Boot or Logon Autostart Execution
Print Processor Registry Autostart
Print Processors, Boot or Logon Autostart Execution
Active Setup Registry Autostart
Active Setup, Boot or Logon Autostart Execution
Active Setup Registry Autostart
Active Setup, Boot or Logon Autostart Execution
Screensaver Event Trigger Execution
Event Triggered Execution, Screensaver
Screensaver Event Trigger Execution
Event Triggered Execution, Screensaver
Logon Script Event Trigger Execution
Boot or Logon Initialization Scripts, Logon Script (Windows)
Logon Script Event Trigger Execution
Boot or Logon Initialization Scripts, Logon Script (Windows)
Change Default File Association
Change Default File Association, Event Triggered Execution
Change Default File Association
Change Default File Association, Event Triggered Execution
Suspicious SearchProtocolHost no Command Line Arguments
Process Injection
Suspicious GPUpdate no Command Line Arguments
Process Injection
Suspicious DLLHost no Command Line Arguments
Process Injection
Registry Keys Used For Persistence
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Registry Keys Used For Persistence
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Powershell Execute COM Object
Component Object Model Hijacking, Event Triggered Execution
Powershell Execute COM Object
Component Object Model Hijacking, Event Triggered Execution
Create Remote Thread In Shell Application
Process Injection
Rundll32 Create Remote Thread To A Process
Process Injection
Rundll32 CreateRemoteThread In Browser
Process Injection
Cloud Compute Instance Created By Previously Unseen User
Cloud Accounts, Valid Accounts
Cloud Compute Instance Created By Previously Unseen User
Cloud Accounts, Valid Accounts
UAC Bypass MMC Load Unsigned Dll
Bypass User Account Control, Abuse Elevation Control Mechanism
UAC Bypass MMC Load Unsigned Dll
Bypass User Account Control, Abuse Elevation Control Mechanism
NET Profiler UAC bypass
Bypass User Account Control, Abuse Elevation Control Mechanism
NET Profiler UAC bypass
Bypass User Account Control, Abuse Elevation Control Mechanism
Msmpeng Application DLL Side Loading
DLL Side-Loading, Hijack Execution Flow
Msmpeng Application DLL Side Loading
DLL Side-Loading, Hijack Execution Flow
WSReset UAC Bypass
Bypass User Account Control, Abuse Elevation Control Mechanism
WSReset UAC Bypass
Bypass User Account Control, Abuse Elevation Control Mechanism
Spoolsv Writing a DLL - Sysmon
Print Processors, Boot or Logon Autostart Execution
Spoolsv Writing a DLL - Sysmon
Print Processors, Boot or Logon Autostart Execution
Spoolsv Writing a DLL
Print Processors, Boot or Logon Autostart Execution
Spoolsv Writing a DLL
Print Processors, Boot or Logon Autostart Execution
Spoolsv Suspicious Process Access
Exploitation for Privilege Escalation
Spoolsv Suspicious Loaded Modules
Print Processors, Boot or Logon Autostart Execution
Spoolsv Suspicious Loaded Modules
Print Processors, Boot or Logon Autostart Execution
Spoolsv Spawning Rundll32
Print Processors, Boot or Logon Autostart Execution
Spoolsv Spawning Rundll32
Print Processors, Boot or Logon Autostart Execution
SilentCleanup UAC Bypass
Bypass User Account Control, Abuse Elevation Control Mechanism
SilentCleanup UAC Bypass
Bypass User Account Control, Abuse Elevation Control Mechanism
Sdclt UAC Bypass
Bypass User Account Control, Abuse Elevation Control Mechanism
Sdclt UAC Bypass
Bypass User Account Control, Abuse Elevation Control Mechanism
Print Spooler Failed to Load a Plug-in
Print Processors, Boot or Logon Autostart Execution
Print Spooler Failed to Load a Plug-in
Print Processors, Boot or Logon Autostart Execution
Print Spooler Adding A Printer Driver
Print Processors, Boot or Logon Autostart Execution
Print Spooler Adding A Printer Driver
Print Processors, Boot or Logon Autostart Execution
Detect WMI Event Subscription Persistence
Windows Management Instrumentation Event Subscription, Event Triggered Execution
Detect WMI Event Subscription Persistence
Windows Management Instrumentation Event Subscription, Event Triggered Execution
Start Up During Safe Mode Boot
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Start Up During Safe Mode Boot
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Allow Operation with Consent Admin
Abuse Elevation Control Mechanism
Powershell Fileless Process Injection via GetProcAddress
Command and Scripting Interpreter, Process Injection, PowerShell
Rare Parent-Child Process Relationship
Exploitation for Client Execution, Command and Scripting Interpreter, Scheduled Task/Job, Software Deployment Tools
CMD Echo Pipe - Escalation
Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process
CMD Echo Pipe - Escalation
Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process
Services Escalate Exe
Abuse Elevation Control Mechanism
SLUI Spawning a Process
Bypass User Account Control, Abuse Elevation Control Mechanism
SLUI Spawning a Process
Bypass User Account Control, Abuse Elevation Control Mechanism
SLUI RunAs Elevated
Bypass User Account Control, Abuse Elevation Control Mechanism
SLUI RunAs Elevated
Bypass User Account Control, Abuse Elevation Control Mechanism
Schtasks Run Task On Demand
Scheduled Task/Job
Suspicious Process File Path
Create or Modify System Process
XMRIG Driver Loaded
Windows Service, Create or Modify System Process
XMRIG Driver Loaded
Windows Service, Create or Modify System Process
Suspicious Driver Loaded Path
Windows Service, Create or Modify System Process
Suspicious Driver Loaded Path
Windows Service, Create or Modify System Process
Trickbot Named Pipe
Process Injection
Schedule Task with Rundll32 Command Trigger
Scheduled Task/Job
Schedule Task with HTTP Command Arguments
Scheduled Task/Job
Powershell Remote Thread To Known Windows Process
Process Injection
GPUpdate with no Command Line Arguments with Network
Process Injection
WinEvent Scheduled Task Created to Spawn Shell
Scheduled Task, Scheduled Task/Job
WinEvent Scheduled Task Created to Spawn Shell
Scheduled Task, Scheduled Task/Job
WinEvent Scheduled Task Created Within Public Path
Scheduled Task, Scheduled Task/Job
WinEvent Scheduled Task Created Within Public Path
Scheduled Task, Scheduled Task/Job
Clop Ransomware Known Service Name
Create or Modify System Process
AWS SetDefaultPolicyVersion
Cloud Accounts, Valid Accounts
AWS SetDefaultPolicyVersion
Cloud Accounts, Valid Accounts
Suspicious Scheduled Task from Public Directory
Scheduled Task, Scheduled Task/Job
Suspicious Scheduled Task from Public Directory
Scheduled Task, Scheduled Task/Job
FodHelper UAC Bypass
Modify Registry, Bypass User Account Control, Abuse Elevation Control Mechanism
FodHelper UAC Bypass
Modify Registry, Bypass User Account Control, Abuse Elevation Control Mechanism
Eventvwr UAC Bypass
Bypass User Account Control, Abuse Elevation Control Mechanism
Eventvwr UAC Bypass
Bypass User Account Control, Abuse Elevation Control Mechanism
Suspicious PlistBuddy Usage via OSquery
Launch Agent, Create or Modify System Process
Suspicious PlistBuddy Usage via OSquery
Launch Agent, Create or Modify System Process
Suspicious PlistBuddy Usage
Launch Agent, Create or Modify System Process
Suspicious PlistBuddy Usage
Launch Agent, Create or Modify System Process
Cobalt Strike Named Pipes
Process Injection
AWS Create Policy Version to allow all resources
Cloud Accounts, Valid Accounts
AWS Create Policy Version to allow all resources
Cloud Accounts, Valid Accounts
Detect Baron Samedit CVE-2021-3156 Segfault
Exploitation for Privilege Escalation
Detect Baron Samedit CVE-2021-3156 via OSQuery
Exploitation for Privilege Escalation
Detect Baron Samedit CVE-2021-3156
Exploitation for Privilege Escalation
AWS SAML Update identity provider
Valid Accounts
AWS SAML Access by Provider User and Principal
Valid Accounts
Scheduled Task Deleted Or Created via CMD
Scheduled Task, Scheduled Task/Job
Scheduled Task Deleted Or Created via CMD
Scheduled Task, Scheduled Task/Job
WMI Permanent Event Subscription - Sysmon
Windows Management Instrumentation Event Subscription, Event Triggered Execution
WMI Permanent Event Subscription - Sysmon
Windows Management Instrumentation Event Subscription, Event Triggered Execution
Shim Database File Creation
Application Shimming, Event Triggered Execution
Shim Database File Creation
Application Shimming, Event Triggered Execution
Schtasks used for forcing a reboot
Scheduled Task, Scheduled Task/Job
Schtasks used for forcing a reboot
Scheduled Task, Scheduled Task/Job
Registry Keys Used For Privilege Escalation
Image File Execution Options Injection, Event Triggered Execution
Registry Keys Used For Privilege Escalation
Image File Execution Options Injection, Event Triggered Execution
Registry Keys for Creating SHIM Databases
Application Shimming, Event Triggered Execution
Registry Keys for Creating SHIM Databases
Application Shimming, Event Triggered Execution
Reg exe Manipulating Windows Services Registry Keys
Services Registry Permissions Weakness, Hijack Execution Flow
Reg exe Manipulating Windows Services Registry Keys
Services Registry Permissions Weakness, Hijack Execution Flow
Shim Database Installation With Suspicious Parameters
Application Shimming, Event Triggered Execution
Shim Database Installation With Suspicious Parameters
Application Shimming, Event Triggered Execution
Monitor Registry Keys for Print Monitors
Port Monitors, Boot or Logon Autostart Execution
Monitor Registry Keys for Print Monitors
Port Monitors, Boot or Logon Autostart Execution
Disabling Remote User Account Control
Bypass User Account Control, Abuse Elevation Control Mechanism
Disabling Remote User Account Control
Bypass User Account Control, Abuse Elevation Control Mechanism
Illegal Service and Process Control via PowerSploit modules
Process Injection, Native API, System Services
Illegal Service and Process Control via Mimikatz modules
Process Injection, Native API, System Services
Illegal Privilege Elevation via Mimikatz modules
Access Token Manipulation, Abuse Elevation Control Mechanism
Illegal Privilege Elevation via Mimikatz modules
Access Token Manipulation, Abuse Elevation Control Mechanism
Illegal Privilege Elevation and Persistence via PowerSploit modules
Scheduled Task/Job, Access Token Manipulation, Abuse Elevation Control Mechanism
Illegal Privilege Elevation and Persistence via PowerSploit modules
Scheduled Task/Job, Access Token Manipulation, Abuse Elevation Control Mechanism
Illegal Privilege Elevation and Persistence via PowerSploit modules
Scheduled Task/Job, Access Token Manipulation, Abuse Elevation Control Mechanism
Illegal Management of Computers and Active Directory Elements via PowerSploit modules
Account Manipulation, Rogue Domain Controller, Domain Policy Modification
Illegal Management of Active Directory Elements and Policies via DSInternals modules
Account Manipulation, Rogue Domain Controller, Domain Policy Modification
Illegal Enabling or Disabling of Accounts via DSInternals modules
Valid Accounts, Account Manipulation
Detect Excessive Account Lockouts From Endpoint
Valid Accounts, Domain Accounts
Detect Excessive Account Lockouts From Endpoint
Valid Accounts, Domain Accounts
Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
Create or Modify System Process, Process Injection, Hijack Execution Flow
Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
Create or Modify System Process, Process Injection, Hijack Execution Flow
Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
Create or Modify System Process, Process Injection, Hijack Execution Flow
Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Executi...
Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Executi...
Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Executi...
Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Executi...
Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Executi...
Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Executi...
Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules
Valid Accounts, Account Discovery, Domain Policy Modification
Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules
Valid Accounts, Account Discovery, Domain Policy Modification
Reconnaissance and Access to Accounts and Groups via Mimikatz modules
Valid Accounts, Account Discovery, Domain Policy Modification
Reconnaissance and Access to Accounts and Groups via Mimikatz modules
Valid Accounts, Account Discovery, Domain Policy Modification
Probing Access with Stolen Credentials via PowerSploit modules
Valid Accounts, Account Manipulation
Setting Credentials via PowerSploit modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Setting Credentials via PowerSploit modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Setting Credentials via Mimikatz modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Setting Credentials via Mimikatz modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Setting Credentials via DSInternals modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Setting Credentials via DSInternals modules
Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation
Reconnaissance of Credential Stores and Services via Mimikatz modules
Account Manipulation, Domain Properties, Valid Accounts, Credentials, Gather Victim Network Information, Exploitation for Privilege Escalation, Gather Victim...
Reconnaissance of Credential Stores and Services via Mimikatz modules
Account Manipulation, Domain Properties, Valid Accounts, Credentials, Gather Victim Network Information, Exploitation for Privilege Escalation, Gather Victim...
Assessment of Credential Strength via DSInternals modules
Valid Accounts, Account Manipulation, Account Discovery, Password Policy Discovery, Unsecured Credentials, Credentials from Password Stores
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via PowerSploit modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Applying Stolen Credentials via Mimikatz modules
Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, B...
Cloud Provisioning Activity From Previously Unseen Country
Valid Accounts
Cloud Provisioning Activity From Previously Unseen City
Valid Accounts
GCP Detect gcploit framework
Valid Accounts
Abnormally High Number Of Cloud Security Group API Calls
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Security Group API Calls
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Infrastructure API Calls
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Infrastructure API Calls
Cloud Accounts, Valid Accounts
Cloud API Calls From Previously Unseen User Roles
Valid Accounts
More than usual number of LOLBAS applications in short time period
Command and Scripting Interpreter, Scheduled Task/Job
Abnormally High Number Of Cloud Instances Launched
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Instances Launched
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Instances Destroyed
Cloud Accounts, Valid Accounts
Abnormally High Number Of Cloud Instances Destroyed
Cloud Accounts, Valid Accounts
Cloud Provisioning Activity From Previously Unseen Region
Valid Accounts
Cloud Instance Modified By Previously Unseen User
Cloud Accounts, Valid Accounts
Cloud Instance Modified By Previously Unseen User
Cloud Accounts, Valid Accounts
aws detect sts assume role abuse
Valid Accounts
aws detect role creation
Valid Accounts
aws detect permanent key creation
Valid Accounts
aws detect attach to role policy
Valid Accounts
Schtasks scheduling job on remote system
Scheduled Task, Scheduled Task/Job
Schtasks scheduling job on remote system
Scheduled Task, Scheduled Task/Job
Sc exe Manipulating Windows Services
Windows Service, Create or Modify System Process
Sc exe Manipulating Windows Services
Windows Service, Create or Modify System Process
Overwriting Accessibility Binaries
Event Triggered Execution, Accessibility Features
Overwriting Accessibility Binaries
Event Triggered Execution, Accessibility Features
Okta User Logins From Multiple Cities
Valid Accounts, Default Accounts
Okta User Logins From Multiple Cities
Valid Accounts, Default Accounts
Okta Failed SSO Attempts
Valid Accounts, Default Accounts
Okta Failed SSO Attempts
Valid Accounts, Default Accounts
Okta Account Lockout Events
Valid Accounts, Default Accounts
Okta Account Lockout Events
Valid Accounts, Default Accounts
Multiple Okta Users With Invalid Credentials From The Same IP
Valid Accounts, Default Accounts
Multiple Okta Users With Invalid Credentials From The Same IP
Valid Accounts, Default Accounts
Detect Excessive User Account Lockouts
Valid Accounts, Local Accounts
Detect Excessive User Account Lockouts
Valid Accounts, Local Accounts
Detect Path Interception By Creation Of program exe
Path Interception by Unquoted Path, Hijack Execution Flow
Detect Path Interception By Creation Of program exe
Path Interception by Unquoted Path, Hijack Execution Flow
First Time Seen Child Process of Zoom
Exploitation for Privilege Escalation
Child Processes of Spoolsv exe
Exploitation for Privilege Escalation