Endpoint

Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...

Set Default PowerShell Execution Policy To Unrestricted or Bypass

Command and Scripting Interpreter, PowerShell

Linux Hardware Addition SwapOff

Hardware Additions

Linux Shred Overwrite Command

Data Destruction

Windows NirSoft AdvancedRun

Tool

Schtasks Run Task On Demand

Scheduled Task/Job

Linux Data Destruction Command

Data Destruction

Child Processes of Spoolsv exe

Exploitation for Privilege Escalation

Linux DD File Overwrite

Data Destruction

Dump LSASS via comsvcs DLL

LSASS Memory, OS Credential Dumping

Linux Java Spawning Shell

Exploit Public-Facing Application, External Remote Services

Add or Set Windows Defender Exclusion

Disable or Modify Tools, Impair Defenses

Linux Indicator Removal Service File Deletion

File Deletion, Indicator Removal

Windows NirSoft Utilities

Tool

Screensaver Event Trigger Execution

Event Triggered Execution, Screensaver

Linux System Network Discovery

System Network Configuration Discovery

Linux Adding Crontab Using List Parameter

Cron, Scheduled Task/Job

Logon Script Event Trigger Execution

Boot or Logon Initialization Scripts, Logon Script (Windows)

Runas Execution in CommandLine

Access Token Manipulation, Token Impersonation/Theft

Change Default File Association

Change Default File Association, Event Triggered Execution

Linux Impair Defenses Process Kill

Disable or Modify Tools, Impair Defenses

Linux Deleting Critical Directory Using RM Command

Data Destruction

Print Processor Registry Autostart

Print Processors, Boot or Logon Autostart Execution

Wscript Or Cscript Suspicious Child Process

Process Injection, Create or Modify System Process, Parent PID Spoofing, Access Token Manipulation

Any Powershell DownloadFile

Command and Scripting Interpreter, PowerShell, Ingress Tool Transfer

Windows Deleted Registry By A Non Critical Process File Path

Modify Registry

Overwriting Accessibility Binaries

Event Triggered Execution, Accessibility Features

Windows File Without Extension In Critical Folder

Data Destruction

Linux Service Restarted

Systemd Timers, Scheduled Task/Job

Windows Impair Defenses Disable HVCI

Disable or Modify Tools, Impair Defenses

Linux Iptables Firewall Modification

Disable or Modify System Firewall, Impair Defenses

Linux Kworker Process In Writable Process Path

Masquerade Task or Service, Masquerading

Batch File Write to System32

User Execution, Malicious File

Disable Defender MpEngine Registry

Disable or Modify Tools, Impair Defenses

Disable Defender AntiVirus Registry

Disable or Modify Tools, Impair Defenses

Disable AMSI Through Registry

Disable or Modify Tools, Impair Defenses

Disable Defender BlockAtFirstSeen Feature

Disable or Modify Tools, Impair Defenses

Auto Admin Logon Registry Entry

Credentials in Registry, Unsecured Credentials

Scheduled Task Deleted Or Created via CMD

Scheduled Task, Scheduled Task/Job

GetWmiObject User Account with PowerShell

Account Discovery, Local Account

System User Discovery With Whoami

System Owner/User Discovery

Windows Scheduled Task Created Via XML

Scheduled Task, Scheduled Task/Job

CMD Carry Out String Command Parameter

Windows Command Shell, Command and Scripting Interpreter

Any Powershell DownloadString

Command and Scripting Interpreter, PowerShell, Ingress Tool Transfer

Windows DNS Gather Network Info

DNS

Hunting 3CXDesktopApp Software

Compromise Software Supply Chain

Add DefaultUser And Password In Registry

Credentials in Registry, Unsecured Credentials

Windows Service Create with Tscon

RDP Hijacking, Remote Service Session Hijacking, Windows Service

Allow Operation with Consent Admin

Abuse Elevation Control Mechanism

Allow Inbound Traffic By Firewall Rule Registry

Remote Desktop Protocol, Remote Services

Windows Enable Win32 ScheduledJob via Registry

Scheduled Task

Windows Lateral Tool Transfer RemCom

Lateral Tool Transfer

Windows Remote Create Service

Create or Modify System Process, Windows Service

Clop Common Exec Parameter

User Execution

Windows Rundll32 WebDav With Network Connection

Exfiltration Over Unencrypted Non-C2 Protocol

Windows Findstr GPP Discovery

Unsecured Credentials, Group Policy Preferences

Msmpeng Application DLL Side Loading

DLL Side-Loading, Hijack Execution Flow

Windows Rundll32 WebDAV Request

Exfiltration Over Unencrypted Non-C2 Protocol

Linux SSH Remote Services Script Execute

SSH

Suspicious Regsvr32 Register Suspicious Path

System Binary Proxy Execution, Regsvr32

Notepad with no Command Line Arguments

Process Injection

Office Product Writing cab or inf

Phishing, Spearphishing Attachment

Office Application Spawn rundll32 process

Phishing, Spearphishing Attachment

Office Application Drop Executable

Phishing, Spearphishing Attachment

Office Application Spawn Regsvr32 process

Phishing, Spearphishing Attachment

Windows Office Product Spawning MSDT

Phishing, Spearphishing Attachment

Office Spawning Control

Phishing, Spearphishing Attachment

Detect Outlook exe writing a zip file

Phishing, Spearphishing Attachment

Windows Mimikatz Crypto Export File Extensions

Steal or Forge Authentication Certificates

Windows Steal Authentication Certificates CertUtil Backup

Steal or Forge Authentication Certificates

Windows Steal Authentication Certificates Export Certificate

Steal or Forge Authentication Certificates

Windows Steal Authentication Certificates Export PfxCertificate

Steal or Forge Authentication Certificates

Windows Scheduled Task with Highest Privileges

Scheduled Task/Job, Scheduled Task

Windows Spearphishing Attachment Onenote Spawn Mshta

Spearphishing Attachment, Phishing

Windows Credential Dumping LSASS Memory Createdump

LSASS Memory

Detect suspicious processnames using pretrained model in DSDL

Command and Scripting Interpreter

Windows Java Spawning Shells

Exploit Public-Facing Application, External Remote Services

Windows Phishing PDF File Executes URL Link

Spearphishing Attachment, Phishing

Windows Server Software Component GACUtil Install to GAC

Server Software Component, IIS Components

Windows Modify Registry Default Icon Setting

Modify Registry

Windows Ngrok Reverse Proxy Usage

Protocol Tunneling, Proxy, Web Service

Linux Ngrok Reverse Proxy Usage

Protocol Tunneling, Proxy, Web Service

Windows Boot or Logon Autostart Execution In Startup Folder

Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution

Windows User Execution Malicious URL Shortcut File

Malicious File, User Execution

Account Discovery With Net App

Domain Account, Account Discovery

Windows DLL Search Order Hijacking Hunt

DLL Search Order Hijacking, Hijack Execution Flow

Windows Disable Windows Event Logging Disable HTTP Logging

Disable Windows Event Logging, Impair Defenses, Server Software Component, IIS Components

Windows IIS Components Add New Module

Server Software Component, IIS Components

Windows Modify Registry Reg Restore

Query Registry

Windows Query Registry Reg Save

Query Registry

Windows WMI Process And Service List

Windows Management Instrumentation

Windows System Network Config Discovery Display DNS

System Network Configuration Discovery

Windows Change Default File Association For No File Ext

Change Default File Association, Event Triggered Execution

Windows Credentials from Password Stores Query

Credentials from Password Stores

Windows Indirect Command Execution Via Series Of Forfiles

Indirect Command Execution

Windows System Network Connections Discovery Netsh

System Network Connections Discovery

Windows Credentials in Registry Reg Query

Credentials in Registry, Unsecured Credentials

Windows Password Managers Discovery

Password Managers

Windows Private Keys Discovery

Private Keys, Unsecured Credentials

Windows Cached Domain Credentials Reg Query

Cached Domain Credentials, OS Credential Dumping

Windows Security Support Provider Reg Query

Security Support Provider, Boot or Logon Autostart Execution

Windows Information Discovery Fsutil

System Information Discovery

Windows System User Discovery Via Quser

System Owner/User Discovery

Windows Steal or Forge Kerberos Tickets Klist

Steal or Forge Kerberos Tickets

BITSAdmin Download File

BITS Jobs, Ingress Tool Transfer

Windows Apache Benchmark Binary

Command and Scripting Interpreter

Windows Mimikatz Binary Execution

OS Credential Dumping

Remcos client registry install entry

Modify Registry

Revil Registry Entry

Modify Registry

Disable Defender Enhanced Notification

Disable or Modify Tools, Impair Defenses

Sdclt UAC Bypass

Bypass User Account Control, Abuse Elevation Control Mechanism

Eventvwr UAC Bypass

Bypass User Account Control, Abuse Elevation Control Mechanism

WSReset UAC Bypass

Bypass User Account Control, Abuse Elevation Control Mechanism

SilentCleanup UAC Bypass

Bypass User Account Control, Abuse Elevation Control Mechanism

Recursive Delete of Directory In Batch CMD

File Deletion, Indicator Removal

Common Ransomware Extensions

Data Destruction

Detect Rare Executables

Windows Modify Registry Qakbot Binary Data Registry

Modify Registry

Windows Regsvr32 Renamed Binary

Regsvr32, System Binary Proxy Execution

Cmdline Tool Not Executed In CMD Shell

Command and Scripting Interpreter, JavaScript

Windows Process Injection Wermgr Child Process

Process Injection

Windows Command Shell Fetch Env Variables

Process Injection

Windows System Discovery Using Qwinsta

System Owner/User Discovery

Windows System Discovery Using ldap Nslookup

System Owner/User Discovery

Windows Masquerading Explorer As Child Process

DLL Side-Loading, Hijack Execution Flow

Windows DLL Side-Loading Process Child Of Calc

DLL Side-Loading, Hijack Execution Flow

Windows Mshta Execution In Registry

Mshta

Detect SharpHound File Modifications

Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery

Windows COM Hijacking InprocServer32 Modification

Component Object Model Hijacking, Event Triggered Execution

Windows System Script Proxy Execution Syncappvpublishingserver

System Script Proxy Execution, System Binary Proxy Execution

Windows ISO LNK File Creation

Spearphishing Attachment, Phishing, Malicious Link, User Execution

Windows Phishing Recent ISO Exec Registry

Spearphishing Attachment, Phishing

Windows Protocol Tunneling with Plink

Protocol Tunneling, SSH

Windows Identify Protocol Handlers

Command and Scripting Interpreter

Disabling Windows Local Security Authority Defences via Registry

Modify Authentication Process

Windows AD DSRM Account Changes

Account Manipulation

Dump LSASS via procdump

LSASS Memory, OS Credential Dumping

Windows System Binary Proxy Execution Compiled HTML File Decompile

Compiled HTML File, System Binary Proxy Execution

Windows Ingress Tool Transfer Using Explorer

Ingress Tool Transfer

Windows Defacement Modify Transcodedwallpaper File

Defacement

Windows Service Deletion In Registry

Service Stop

Windows Remote Access Software Hunt

Remote Access Software

Windows Autostart Execution LSASS Driver Registry Modification

LSASS Driver

Linux Csvtool Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux c99 Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux apt-get Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Cpulimit Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux OpenVPN Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Sqlite3 Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Composer Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Octave Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux c89 Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux APT Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Busybox Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Puppet Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux RPM Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux MySQL Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Emacs Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Make Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux PHP Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux GDB Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Find Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux GNU Awk Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Ruby Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Gem Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux AWK Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Docker Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Node Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Windows DLL Search Order Hijacking with iscsicpl

DLL Search Order Hijacking

Linux Curl Upload File

Ingress Tool Transfer

Linux Proxy Socks Curl

Proxy, Non-Application Layer Protocol

Linux Ingress Tool Transfer with Curl

Ingress Tool Transfer

Linux Ingress Tool Transfer Hunting

Ingress Tool Transfer

Windows System Time Discovery W32tm Delay

System Time Discovery

Linux Clipboard Data Copy

Clipboard Data

Windows Command Shell DCRat ForkBomb Payload

Windows Command Shell, Command and Scripting Interpreter

Linux SSH Authorized Keys Modification

SSH Authorized Keys

Windows System Reboot CommandLine

System Shutdown/Reboot

Windows System LogOff Commandline

System Shutdown/Reboot

Linux Kernel Module Enumeration

System Information Discovery, Rootkit

Linux Decode Base64 to Shell

Obfuscated Files or Information, Unix Shell

Linux Obfuscated Files or Information Base64 Decode

Obfuscated Files or Information

Wmic NonInteractive App Uninstallation

Disable or Modify Tools, Impair Defenses

Windows MOF Event Triggered Execution via WMI

Windows Management Instrumentation Event Subscription

Powershell Disable Security Monitoring

Disable or Modify Tools, Impair Defenses

Certutil exe certificate extraction

Suspicious Image Creation In Appdata Folder

Screen Capture

Windows Binary Proxy Execution Mavinject DLL Injection

Mavinject, System Binary Proxy Execution

Suspicious WAV file in Appdata Folder

Screen Capture

Windows Odbcconf Load Response File

Odbcconf

Windows Odbcconf Hunting

Odbcconf

Windows Execute Arbitrary Commands with MSDT

System Binary Proxy Execution

Outbound Network Connection from Java Using Default Ports

Exploit Public-Facing Application, External Remote Services

Windows Odbcconf Load DLL

Odbcconf

Windows Impair Defense Deny Security Software With Applocker

Disable or Modify Tools, Impair Defenses

Windows Remote Service Rdpwinst Tool Execution

Remote Desktop Protocol, Remote Services

Windows Modify Registry Regedit Silent Reg Import

Modify Registry

Windows Impair Defense Add Xml Applocker Rules

Disable or Modify Tools, Impair Defenses

Windows Valid Account With Never Expires Password

Service Stop

Windows Modify Registry Disable Win Defender Raw Write Notif

Modify Registry

Windows Modify Registry Disable Toast Notifications

Modify Registry

Windows Remote Access Software RMS Registry

Remote Access Software

Windows Modify Registry Suppress Win Defender Notif

Modify Registry

Windows Modify Registry DisAllow Windows App

Modify Registry

Windows Modify Registry Disable Windows Security Center Notif

Modify Registry

Windows Modify Registry Disabling WER Settings

Modify Registry

Windows Remote Services Allow Remote Assistance

Remote Desktop Protocol, Remote Services

Windows Remote Services Allow Rdp In Firewall

Remote Desktop Protocol, Remote Services

Windows Remote Services Rdp Enable

Remote Desktop Protocol, Remote Services

Windows MSIExec With Network Connections

Msiexec

Windows MSIExec Remote Download

Msiexec

Windows MSIExec DLLRegisterServer

Msiexec

Windows MSIExec Unregister DLLRegisterServer

Msiexec

Windows MSIExec Spawn Discovery Command

Msiexec

Windows Impair Defenses Disable Win Defender Auto Logging

Disable or Modify Tools, Impair Defenses

Windows Impair Defense Delete Win Defender Profile Registry

Disable or Modify Tools, Impair Defenses

Windows Impair Defense Delete Win Defender Context Menu

Disable or Modify Tools, Impair Defenses

Java Writing JSP File

Exploit Public-Facing Application, External Remote Services

Unload Sysmon Filter Driver

Disable or Modify Tools, Impair Defenses

Windows Command and Scripting Interpreter Hunting Path Traversal

Command and Scripting Interpreter

Windows Command and Scripting Interpreter Path Traversal Exec

Command and Scripting Interpreter

Linux At Application Execution

At, Scheduled Task/Job

Linux Possible Append Command To At Allow Config File

At, Scheduled Task/Job

Schtasks scheduling job on remote system

Scheduled Task, Scheduled Task/Job

Windows System File on Disk

Exploitation for Privilege Escalation

Windows Service Create Kernel Mode Driver

Windows Service, Create or Modify System Process, Exploitation for Privilege Escalation

NLTest Domain Trust Discovery

Domain Trust Discovery

Windows Registry Delete Task SD

Scheduled Task, Impair Defenses

Detect mshta renamed

System Binary Proxy Execution, Mshta

Suspicious Rundll32 Rename

System Binary Proxy Execution, Masquerading, Rundll32, Rename System Utilities

Detect Renamed PSExec

System Services, Service Execution

Detect HTML Help Renamed

System Binary Proxy Execution, Compiled HTML File

Windows Indirect Command Execution Via pcalua

Indirect Command Execution

Windows Indirect Command Execution Via forfiles

Indirect Command Execution

Modify ACL permission To Files Or Folder

File and Directory Permissions Modification

Windows InstallUtil Remote Network Connection

InstallUtil, System Binary Proxy Execution

Windows InstallUtil Uninstall Option with Network

InstallUtil, System Binary Proxy Execution

Detect Regasm with no Command Line Arguments

System Binary Proxy Execution, Regsvcs/Regasm

Detect Regsvcs with No Command Line Arguments

System Binary Proxy Execution, Regsvcs/Regasm

Unknown Process Using The Kerberos Protocol

Use Alternate Authentication Material

Excessive distinct processes from Windows Temp

Command and Scripting Interpreter

Windows Process With NamedPipe CommandLine

Process Injection

Windows WMI Process Call Create

Windows Management Instrumentation

NET Profiler UAC bypass

Bypass User Account Control, Abuse Elevation Control Mechanism

Windows Rasautou DLL Execution

Dynamic-link Library Injection, System Binary Proxy Execution, Process Injection

Windows Diskshadow Proxy Execution

System Binary Proxy Execution

RunDLL Loading DLL By Ordinal

System Binary Proxy Execution, Rundll32

Windows Remote Assistance Spawning Process

Process Injection

Windows Schtasks Create Run As System

Scheduled Task, Scheduled Task/Job

CertUtil Download With VerifyCtl and Split Arguments

Ingress Tool Transfer

CertUtil Download With URLCache and Split Arguments

Ingress Tool Transfer

Rubeus Command Line Parameters

Use Alternate Authentication Material, Pass the Ticket, Steal or Forge Kerberos Tickets, Kerberoasting, AS-REP Roasting

Mimikatz PassTheTicket CommandLine Parameters

Use Alternate Authentication Material, Pass the Ticket

Linux pkexec Privilege Escalation

Exploitation for Privilege Escalation

Malicious PowerShell Process - Encoded Command

Obfuscated Files or Information

Potentially malicious code on commandline

Windows Command Shell

Linux Possible Ssh Key File Creation

SSH Authorized Keys, Account Manipulation

Linux Possible Access Or Modification Of sshd Config File

SSH Authorized Keys, Account Manipulation

Linux Possible Access To Sudoers File

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Possible Access To Credential Files

/etc/passwd and /etc/shadow, OS Credential Dumping

Linux Doas Conf File Creation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Doas Tool Execution

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Sudo OR Su Execution

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Sudoers Tmp File Creation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Common Process For Elevation Control

Setuid and Setgid, Abuse Elevation Control Mechanism

Linux Preload Hijack Library Calls

Dynamic Linker Hijacking, Hijack Execution Flow

Linux File Created In Kernel Driver Directory

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Linux Install Kernel Module Using Modprobe Utility

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Linux Insert Kernel Module Using Insmod Utility

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Linux Change File Owner To Root

Linux and Mac File and Directory Permissions Modification, File and Directory Permissions Modification

Linux Setuid Using Chmod Utility

Setuid and Setgid, Abuse Elevation Control Mechanism

Linux NOPASSWD Entry In Sudoers File

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Setuid Using Setcap Utility

Setuid and Setgid, Abuse Elevation Control Mechanism

Linux Add User Account

Local Account, Create Account

Linux Visudo Utility Execution

Sudo and Sudo Caching, Abuse Elevation Control Mechanism

Linux Service Started Or Enabled

Systemd Timers, Scheduled Task/Job

Linux Service File Created In Systemd Directory

Systemd Timers, Scheduled Task/Job

Linux Possible Append Command To Profile Config File

Unix Shell Configuration Modification, Event Triggered Execution

Linux File Creation In Init Boot Directory

RC Scripts, Boot or Logon Initialization Scripts

Linux File Creation In Profile Directory

Unix Shell Configuration Modification, Event Triggered Execution

Linux Possible Cronjob Modification With Editor

Cron, Scheduled Task/Job

Linux Possible Append Cronjob Entry on Existing Cronjob File

Cron, Scheduled Task/Job

Linux At Allow Config File Creation

Cron, Scheduled Task/Job

Linux Edit Cron Table Parameter

Cron, Scheduled Task/Job

Linux Add Files In Known Crontab Directories

Cron, Scheduled Task/Job

Wget Download and Bash Execution

Ingress Tool Transfer

Curl Download and Bash Execution

Ingress Tool Transfer

Windows Raccine Scheduled Task Deletion

Disable or Modify Tools

Suspicious Linux Discovery Commands

Unix Shell

Detect RClone Command-Line Usage

Automated Exfiltration

Mmc LOLBAS Execution Process Spawn

Remote Services, Distributed Component Object Model, MMC

Services LOLBAS Execution Process Spawn

Create or Modify System Process, Windows Service

Wmiprsve LOLBAS Execution Process Spawn

Windows Management Instrumentation

Possible Browser Pass View Parameter

Credentials from Web Browsers, Credentials from Password Stores

Wsmprovhost LOLBAS Execution Process Spawn

Remote Services, Windows Remote Management

Svchost LOLBAS Execution Process Spawn

Scheduled Task/Job, Scheduled Task

System Info Gathering Using Dxdiag Application

Gather Victim Host Information

Windows DISM Remove Defender

Disable or Modify Tools, Impair Defenses

Remote Process Instantiation via WinRM and PowerShell

Remote Services, Windows Remote Management

Windows DiskCryptor Usage

Data Encrypted for Impact

Remote Process Instantiation via DCOM and PowerShell

Remote Services, Distributed Component Object Model

Remote Process Instantiation via WMI and PowerShell

Windows Management Instrumentation

CSC Net On The Fly Compilation

Compile After Delivery, Obfuscated Files or Information

Network Discovery Using Route Windows App

System Network Configuration Discovery, Internet Connection Discovery

Remote Process Instantiation via WMI

Windows Management Instrumentation

Windows InstallUtil Uninstall Option

InstallUtil, System Binary Proxy Execution

Firewall Allowed Program Enable

Disable or Modify System Firewall, Impair Defenses

Windows InstallUtil URL in Command Line

InstallUtil, System Binary Proxy Execution

Scheduled Task Initiation on Remote Endpoint

Scheduled Task/Job, Scheduled Task

WMIC XSL Execution via URL

XSL Script Processing

Scheduled Task Creation on Remote Endpoint using At

Scheduled Task/Job, At

Remote Process Instantiation via WinRM and Winrs

Remote Services, Windows Remote Management

Windows Service Creation on Remote Endpoint

Create or Modify System Process, Windows Service

Windows Curl Upload to Remote Destination

Ingress Tool Transfer

Windows Service Initiation on Remote Endpoint

Create or Modify System Process, Windows Service

Attacker Tools On Endpoint

Match Legitimate Name or Location, Masquerading, OS Credential Dumping, Active Scanning

Windows Curl Download to Suspicious Path

Ingress Tool Transfer

Disable Schedule Task

Disable or Modify Tools, Impair Defenses

ServicePrincipalNames Discovery with SetSPN

Kerberoasting

Suspicious wevtutil Usage

Clear Windows Event Logs, Indicator Removal

Sdelete Application Execution

Data Destruction, File Deletion, Indicator Removal

Winhlp32 Spawning a Process

Process Injection

Process Writing DynamicWrapperX

Command and Scripting Interpreter, Component Object Model

Rundll32 Shimcache Flush

Modify Registry

Malicious InProcServer32 Modification

Regsvr32, Modify Registry

MSBuild Suspicious Spawned By Script Process

MSBuild, Trusted Developer Utilities Proxy Execution

Vbscript Execution Using Wscript App

Visual Basic, Command and Scripting Interpreter

Verclsid CLSID Execution

Verclsid, System Binary Proxy Execution

Remcos RAT File Creation in Remcos Folder

Screen Capture

BITS Job Persistence

BITS Jobs

Credential Dumping via Copy Command from Shadow Copy

NTDS, OS Credential Dumping

Credential Dumping via Symlink to Shadow Copy

NTDS, OS Credential Dumping

Processes launching netsh

Disable or Modify System Firewall, Impair Defenses

Detect mshta inline hta execution

System Binary Proxy Execution, Mshta

Detect MSHTA Url in Command Line

System Binary Proxy Execution, Mshta

Detect HTML Help URL in Command Line

System Binary Proxy Execution, Compiled HTML File

Detect Renamed RClone

Automated Exfiltration

Attempt To Add Certificate To Untrusted Store

Install Root Certificate, Subvert Trust Controls

Local Account Discovery with Net

Account Discovery, Local Account

Local Account Discovery With Wmic

Account Discovery, Local Account

Detect Renamed 7-Zip

Archive via Utility, Archive Collected Data

Creation of Shadow Copy with wmic and powershell

NTDS, OS Credential Dumping

Detect PsExec With accepteula Flag

Remote Services, SMB/Windows Admin Shares

Detect Renamed WinRAR

Archive via Utility, Archive Collected Data

Detect HTML Help Using InfoTech Storage Handlers

System Binary Proxy Execution, Compiled HTML File

Check Elevated CMD using whoami

System Owner/User Discovery

PowerShell Get LocalGroup Discovery

Permission Groups Discovery, Local Groups

Wmic Group Discovery

Permission Groups Discovery, Local Groups

Get WMIObject Group Discovery

Permission Groups Discovery, Local Groups

System User Discovery With Query

System Owner/User Discovery

GetCurrent User with PowerShell

System Owner/User Discovery

User Discovery With Env Vars PowerShell

System Owner/User Discovery

XSL Script Execution With WMIC

XSL Script Processing

Jscript Execution Using Cscript App

Command and Scripting Interpreter, JavaScript

Network Connection Discovery With Arp

System Network Connections Discovery

Network Connection Discovery With Net

System Network Connections Discovery

Network Connection Discovery With Netstat

System Network Connections Discovery

Extraction of Registry Hives

Security Account Manager, OS Credential Dumping

Rundll32 Control RunDLL Hunt

System Binary Proxy Execution, Rundll32

Create local admin accounts using net exe

Local Account, Create Account

Rundll32 Control RunDLL World Writable Directory

System Binary Proxy Execution, Rundll32

Control Loading from World Writable Directory

System Binary Proxy Execution, Control Panel

GetDomainComputer with PowerShell

Remote System Discovery

GetAdComputer with PowerShell

Remote System Discovery

System Information Discovery Detection

System Information Discovery

GetDomainController with PowerShell

Remote System Discovery

GetWmiObject Ds Computer with PowerShell

Remote System Discovery

Bcdedit Command Back To Normal Mode Boot

Inhibit System Recovery

Change To Safe Mode With Network Config

Inhibit System Recovery

Get-ForestTrust with PowerShell

Domain Trust Discovery

Domain Group Discovery With Dsquery

Permission Groups Discovery, Domain Groups

Remote System Discovery with Wmic

Remote System Discovery

Domain Controller Discovery with Wmic

Remote System Discovery

Remote System Discovery with Dsquery

Remote System Discovery

Remote System Discovery with Net

Remote System Discovery

Domain Controller Discovery with Nltest

Remote System Discovery

Get DomainPolicy with Powershell

Password Policy Discovery

Get ADUserResultantPasswordPolicy with Powershell

Password Policy Discovery

Process Creating LNK file in Suspicious Location

Phishing, Spearphishing Link

Get ADDefaultDomainPasswordPolicy with Powershell

Password Policy Discovery

Password Policy Discovery with Net

Password Policy Discovery

GetNetTcpconnection with PowerShell

System Network Connections Discovery

GetWmiObject Ds Group with PowerShell

Permission Groups Discovery, Domain Groups

Domain Group Discovery With Wmic

Permission Groups Discovery, Domain Groups

Elevated Group Discovery With Net

Permission Groups Discovery, Domain Groups

GetDomainGroup with PowerShell

Permission Groups Discovery, Domain Groups

GetAdGroup with PowerShell

Permission Groups Discovery, Domain Groups

Elevated Group Discovery With Wmic

Permission Groups Discovery, Domain Groups

Domain Account Discovery with Dsquery

Domain Account, Account Discovery

Get DomainUser with PowerShell

Domain Account, Account Discovery

Get-DomainTrust with PowerShell

Domain Trust Discovery

Domain Account Discovery with Wmic

Domain Account, Account Discovery

GetWmiObject DS User with PowerShell

Domain Account, Account Discovery

Get ADUser with PowerShell

Domain Account, Account Discovery

GetLocalUser with PowerShell

Account Discovery, Local Account

Esentutl SAM Copy

Security Account Manager, OS Credential Dumping

7zip CommandLine To SMB Share Path

Archive via Utility, Archive Collected Data

Fsutil Zeroing File

Indicator Removal

Rundll32 LockWorkStation

System Binary Proxy Execution, Rundll32

Uninstall App Using MsiExec

Msiexec, System Binary Proxy Execution

Regsvr32 with Known Silent Switch Cmdline

System Binary Proxy Execution, Regsvr32

CHCP Command Execution

Command and Scripting Interpreter

Suspicious IcedID Rundll32 Cmdline

System Binary Proxy Execution, Rundll32

Suspicious Rundll32 PluginInit

System Binary Proxy Execution, Rundll32

Mshta spawning Rundll32 OR Regsvr32 Process

System Binary Proxy Execution, Mshta

Spoolsv Writing a DLL

Print Processors, Boot or Logon Autostart Execution

Spoolsv Spawning Rundll32

Print Processors, Boot or Logon Autostart Execution

Excessive number of service control start as disabled

Disable or Modify Tools, Impair Defenses

Allow File And Printing Sharing In Firewall

Disable or Modify Cloud Firewall, Impair Defenses

Allow Network Discovery In Firewall

Disable or Modify Cloud Firewall, Impair Defenses

Execute Javascript With Jscript COM CLSID

Command and Scripting Interpreter, Visual Basic

Permission Modification using Takeown App

File and Directory Permissions Modification

Clear Unallocated Sector Using Cipher App

File Deletion, Indicator Removal

Prevent Automatic Repair Mode using Bcdedit

Inhibit System Recovery

Disable Logs Using WevtUtil

Indicator Removal, Clear Windows Event Logs

Excessive number of taskhost processes

Command and Scripting Interpreter

Revil Common Exec Parameter

User Execution

Conti Common Exec parameter

User Execution

Detect SharpHound Command-Line Arguments

Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery

Detect AzureHound Command-Line Arguments

Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery

Detect AzureHound File Modifications

Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery

Detect SharpHound Usage

Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery

WinRM Spawning a Process

Exploit Public-Facing Application

SLUI RunAs Elevated

Bypass User Account Control, Abuse Elevation Control Mechanism

SLUI Spawning a Process

Bypass User Account Control, Abuse Elevation Control Mechanism

Excessive Usage Of Cacls App

File and Directory Permissions Modification

Excessive Usage Of Taskkill

Disable or Modify Tools, Impair Defenses

Disabling Net User Account

Account Access Removal

Excessive Service Stop Attempt

Service Stop

Excessive Attempt To Disable Services

Service Stop

Process Kill Base On File Path

Disable or Modify Tools, Impair Defenses

Winword Spawning Cmd

Phishing, Spearphishing Attachment

Wermgr Process Spawned CMD Or Powershell Process

Command and Scripting Interpreter

DNS Exfiltration Using Nslookup App

Exfiltration Over Alternative Protocol

Winword Spawning PowerShell

Phishing, Spearphishing Attachment

Winword Spawning Windows Script Host

Phishing, Spearphishing Attachment

Excel Spawning Windows Script Host

Security Account Manager, OS Credential Dumping

Excel Spawning PowerShell

Security Account Manager, OS Credential Dumping

DSQuery Domain Discovery

Domain Trust Discovery

Disabling Firewall with Netsh

Disable or Modify Tools, Impair Defenses

PowerShell Start-BitsTransfer

BITS Jobs

CertUtil With Decode Argument

Deobfuscate/Decode Files or Information

Resize ShadowStorage volume

Inhibit System Recovery

Nishang PowershellTCPOneLine

Command and Scripting Interpreter, PowerShell

FodHelper UAC Bypass

Modify Registry, Bypass User Account Control, Abuse Elevation Control Mechanism

Suspicious Scheduled Task from Public Directory

Scheduled Task, Scheduled Task/Job

Ryuk Wake on LAN Command

Command and Scripting Interpreter, Windows Command Shell

Suspicious SQLite3 LSQuarantine Behavior

Data Staged

Suspicious PlistBuddy Usage

Launch Agent, Create or Modify System Process

Suspicious Curl Network Connection

Ingress Tool Transfer

Detect Regsvcs Spawning a Process

System Binary Proxy Execution, Regsvcs/Regasm

Detect Regasm Spawning a Process

System Binary Proxy Execution, Regsvcs/Regasm

Detect HTML Help Spawn Child Process

System Binary Proxy Execution, Compiled HTML File

Suspicious Rundll32 dllregisterserver

System Binary Proxy Execution, Rundll32

Detect Rundll32 Application Control Bypass - syssetup

System Binary Proxy Execution, Rundll32

Detect Rundll32 Application Control Bypass - setupapi

System Binary Proxy Execution, Rundll32

Detect Rundll32 Application Control Bypass - advpack

System Binary Proxy Execution, Rundll32

Ntdsutil Export NTDS

NTDS, OS Credential Dumping

WBAdmin Delete System Backups

Inhibit System Recovery

Detect Rundll32 Inline HTA Execution

System Binary Proxy Execution, Mshta

Suspicious mshta spawn

System Binary Proxy Execution, Mshta

Suspicious Powershell Command-Line Arguments

PowerShell

Suspicious MSBuild Spawn

Trusted Developer Utilities Proxy Execution, MSBuild

Suspicious microsoft workflow compiler usage

Trusted Developer Utilities Proxy Execution

Suspicious mshta child process

System Binary Proxy Execution, Mshta

BCDEdit Failure Recovery Modification

Inhibit System Recovery

Unusually Long Command Line

Single Letter Process On Endpoint

User Execution, Malicious File

System Processes Run From Unexpected Locations

Masquerading, Rename System Utilities

Shim Database File Creation

Application Shimming, Event Triggered Execution

Schtasks used for forcing a reboot

Scheduled Task, Scheduled Task/Job

Reg exe Manipulating Windows Services Registry Keys

Services Registry Permissions Weakness, Hijack Execution Flow

Processes created by netsh

Disable or Modify System Firewall

Shim Database Installation With Suspicious Parameters

Application Shimming, Event Triggered Execution

Execution of File With Spaces Before Extension

Rename System Utilities

Disabling Remote User Account Control

Bypass User Account Control, Abuse Elevation Control Mechanism

Execution of File with Multiple Extensions

Masquerading, Rename System Utilities

Detect Prohibited Applications Spawning cmd exe

Command and Scripting Interpreter, Windows Command Shell

Detect processes used for System Network Configuration Discovery

System Network Configuration Discovery

Deleting Shadow Copies

Inhibit System Recovery

Common Ransomware Notes

Data Destruction

Windows connhost exe started forcefully

Windows Command Shell

Windows Security Account Manager Stopped

Service Stop

Ryuk Test Files Detected

Data Encrypted for Impact

Create or delete windows shares using net exe

Indicator Removal, Network Share Connection Removal

Suspicious writes to windows Recycle Bin

Masquerading

Suspicious Reg exe Process

Modify Registry

Uncommon Processes On Endpoint

Malicious File

Suspicious Changes to File Associations

Change Default File Association

Remote Desktop Process Running On System

Remote Desktop Protocol, Remote Services

Sc exe Manipulating Windows Services

Windows Service, Create or Modify System Process

Detect Use of cmd exe to Launch Script Interpreters

Command and Scripting Interpreter, Windows Command Shell

First time seen command line argument

PowerShell, Windows Command Shell

Malicious PowerShell Process - Execution Policy Bypass

Command and Scripting Interpreter, PowerShell

Email files written outside of the Outlook directory

Email Collection, Local Email Collection

Hiding Files And Directories With Attrib exe

File and Directory Permissions Modification, Windows File and Directory Permissions Modification