Persistence

Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...

Possible Lateral Movement PowerShell Spawn

Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...

Windows WinLogon with Public Network Connection

Bootkit

Azure AD FullAccessAsApp Permission Assigned

Additional Email Delegate Permissions, Additional Cloud Roles

Azure AD FullAccessAsApp Permission Assigned

Additional Email Delegate Permissions, Additional Cloud Roles

O365 FullAccessAsApp Permission Assigned

Additional Email Delegate Permissions, Additional Cloud Roles

O365 FullAccessAsApp Permission Assigned

Additional Email Delegate Permissions, Additional Cloud Roles

Linux Service Started Or Enabled

Systemd Timers, Scheduled Task/Job

Linux Service Started Or Enabled

Systemd Timers, Scheduled Task/Job

GCP Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication

GCP Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication

GCP Successful Single-Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

GCP Successful Single-Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

GCP Authentication Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

GCP Authentication Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

Impacket Lateral Movement smbexec CommandLine Parameters

Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service

Registry Keys Used For Persistence

Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution

Registry Keys Used For Persistence

Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution

Scheduled Task Deleted Or Created via CMD

Scheduled Task, Scheduled Task/Job

Scheduled Task Deleted Or Created via CMD

Scheduled Task, Scheduled Task/Job

Suspicious Process File Path

Create or Modify System Process

Suspicious Scheduled Task from Public Directory

Scheduled Task, Scheduled Task/Job

Suspicious Scheduled Task from Public Directory

Scheduled Task, Scheduled Task/Job

Windows Scheduled Task Created Via XML

Scheduled Task, Scheduled Task/Job

Windows Scheduled Task Created Via XML

Scheduled Task, Scheduled Task/Job

Short Lived Scheduled Task

Scheduled Task

Windows Scheduled Task with Highest Privileges

Scheduled Task/Job, Scheduled Task

Windows Scheduled Task with Highest Privileges

Scheduled Task/Job, Scheduled Task

Windows Disable Windows Event Logging Disable HTTP Logging

Disable Windows Event Logging, Impair Defenses, Server Software Component, IIS Components

Windows Disable Windows Event Logging Disable HTTP Logging

Disable Windows Event Logging, Impair Defenses, Server Software Component, IIS Components

Azure AD PIM Role Assigned

Account Manipulation, Additional Cloud Roles

Azure AD PIM Role Assigned

Account Manipulation, Additional Cloud Roles

Azure AD Application Administrator Role Assigned

Account Manipulation, Additional Cloud Roles

Azure AD Application Administrator Role Assigned

Account Manipulation, Additional Cloud Roles

Azure Runbook Webhook Created

Valid Accounts, Cloud Accounts

Azure Runbook Webhook Created

Valid Accounts, Cloud Accounts

Azure AD Authentication Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

Azure AD Authentication Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

Azure AD Service Principal New Client Credentials

Account Manipulation, Additional Cloud Credentials

Azure AD Service Principal New Client Credentials

Account Manipulation, Additional Cloud Credentials

Azure AD External Guest User Invited

Cloud Account

Azure AD Successful Single-Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

Azure AD Successful Single-Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

Azure AD Privileged Role Assigned

Account Manipulation, Additional Cloud Roles

Azure AD Privileged Role Assigned

Account Manipulation, Additional Cloud Roles

Azure AD PIM Role Assignment Activated

Account Manipulation, Additional Cloud Roles

Azure AD PIM Role Assignment Activated

Account Manipulation, Additional Cloud Roles

Azure Automation Account Created

Create Account, Cloud Account

Azure Automation Account Created

Create Account, Cloud Account

Azure AD Global Administrator Role Assigned

Additional Cloud Roles

Azure AD Service Principal Owner Added

Account Manipulation

Azure AD Successful PowerShell Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

Azure AD Successful PowerShell Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

Azure AD Privileged Role Assigned to Service Principal

Account Manipulation, Additional Cloud Roles

Azure AD Privileged Role Assigned to Service Principal

Account Manipulation, Additional Cloud Roles

Azure AD Multiple AppIDs and UserAgents Authentication Spike

Valid Accounts

Azure AD Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication

Azure AD Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication

Azure AD Multiple Failed MFA Requests For User

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts

Azure AD Multiple Failed MFA Requests For User

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts

Azure AD New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

Azure AD New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

Azure AD User Enabled And Password Reset

Account Manipulation

Azure AD New MFA Method Registered

Account Manipulation, Device Registration

Azure AD New MFA Method Registered

Account Manipulation, Device Registration

Windows Known GraphicalProton Loaded Modules

DLL Side-Loading, Hijack Execution Flow

Windows Known GraphicalProton Loaded Modules

DLL Side-Loading, Hijack Execution Flow

Kubernetes Cron Job Creation

Container Orchestration Job

Spoolsv Writing a DLL

Print Processors, Boot or Logon Autostart Execution

Spoolsv Writing a DLL

Print Processors, Boot or Logon Autostart Execution

Detect Path Interception By Creation Of program exe

Path Interception by Unquoted Path, Hijack Execution Flow

Detect Path Interception By Creation Of program exe

Path Interception by Unquoted Path, Hijack Execution Flow

WMI Permanent Event Subscription - Sysmon

Windows Management Instrumentation Event Subscription, Event Triggered Execution

WMI Permanent Event Subscription - Sysmon

Windows Management Instrumentation Event Subscription, Event Triggered Execution

Detect Exchange Web Shell

Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services

Detect Exchange Web Shell

Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services

Detect Exchange Web Shell

Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services

Windows AD ServicePrincipalName Added To Domain Account

Account Manipulation

Windows DLL Search Order Hijacking Hunt

DLL Search Order Hijacking, Hijack Execution Flow

Windows DLL Search Order Hijacking Hunt

DLL Search Order Hijacking, Hijack Execution Flow

AWS IAM Failure Group Deletion

Account Manipulation

Windows DnsAdmins New Member Added

Account Manipulation

Azure Automation Runbook Created

Create Account, Cloud Account

Azure Automation Runbook Created

Create Account, Cloud Account

Windows AD DSRM Account Changes

Account Manipulation

O365 Multiple AppIDs and UserAgents Authentication Spike

Valid Accounts

O365 High Privilege Role Granted

Account Manipulation, Additional Cloud Roles

O365 High Privilege Role Granted

Account Manipulation, Additional Cloud Roles

O365 New MFA Method Registered

Account Manipulation, Device Registration

O365 New MFA Method Registered

Account Manipulation, Device Registration

O365 ApplicationImpersonation Role Assigned

Account Manipulation, Additional Email Delegate Permissions

O365 ApplicationImpersonation Role Assigned

Account Manipulation, Additional Email Delegate Permissions

PingID Multiple Failed MFA Requests For User

Multi-Factor Authentication Request Generation, Valid Accounts, Brute Force

PingID New MFA Method Registered For User

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

PingID New MFA Method Registered For User

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

PingID New MFA Method After Credential Reset

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

PingID New MFA Method After Credential Reset

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

PingID Mismatch Auth Source and Verification Response

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

PingID Mismatch Auth Source and Verification Response

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

Azure AD Tenant Wide Admin Consent Granted

Account Manipulation, Additional Cloud Roles

Azure AD Tenant Wide Admin Consent Granted

Account Manipulation, Additional Cloud Roles

O365 Application Registration Owner Added

Account Manipulation

O365 Tenant Wide Admin Consent Granted

Account Manipulation, Additional Cloud Roles

O365 Tenant Wide Admin Consent Granted

Account Manipulation, Additional Cloud Roles

O365 Mailbox Read Access Granted to Application

Remote Email Collection, Email Collection, Account Manipulation, Additional Cloud Roles

O365 Mailbox Read Access Granted to Application

Remote Email Collection, Email Collection, Account Manipulation, Additional Cloud Roles

O365 Service Principal New Client Credentials

Account Manipulation, Additional Cloud Credentials

O365 Service Principal New Client Credentials

Account Manipulation, Additional Cloud Credentials

Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082

Exploit Public-Facing Application, External Remote Services

O365 New Federated Domain Added

Cloud Account, Create Account

O365 New Federated Domain Added

Cloud Account, Create Account

O365 Excessive SSO logon errors

Modify Authentication Process

O365 Added Service Principal

Cloud Account, Create Account

O365 Added Service Principal

Cloud Account, Create Account

Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078

Exploit Public-Facing Application, External Remote Services

Windows Unsigned DLL Side-Loading

DLL Side-Loading

O365 Add App Role Assignment Grant User

Cloud Account, Create Account

O365 Add App Role Assignment Grant User

Cloud Account, Create Account

CMD Echo Pipe - Escalation

Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process

CMD Echo Pipe - Escalation

Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process

Windows Exchange Autodiscover SSRF Abuse

Exploit Public-Facing Application, External Remote Services

ProxyShell ProxyNotShell Behavior Detected

Exploit Public-Facing Application, External Remote Services

MS Exchange Mailbox Replication service writing Active Server Pages

Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services

MS Exchange Mailbox Replication service writing Active Server Pages

Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services

MS Exchange Mailbox Replication service writing Active Server Pages

Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services

Exchange PowerShell Abuse via SSRF

Exploit Public-Facing Application, External Remote Services

Detect Webshell Exploit Behavior

Server Software Component, Web Shell

Detect Webshell Exploit Behavior

Server Software Component, Web Shell

W3WP Spawning Shell

Server Software Component, Web Shell

W3WP Spawning Shell

Server Software Component, Web Shell

VMWare Aria Operations Exploit Attempt

External Remote Services, Exploit Public-Facing Application, Exploitation of Remote Services, Exploitation for Privilege Escalation

Windows Scheduled Task Service Spawned Shell

Scheduled Task, Command and Scripting Interpreter

Impacket Lateral Movement WMIExec Commandline Parameters

Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service

Impacket Lateral Movement smbexec CommandLine Parameters

Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service

Impacket Lateral Movement Commandline Parameters

Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service

Windows PowerShell ScheduleTask

Scheduled Task, PowerShell, Command and Scripting Interpreter

ASL AWS IAM Delete Policy

Account Manipulation

ASL AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

ASL AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

Windows MOVEit Transfer Writing ASPX

Exploit Public-Facing Application, External Remote Services

ASL AWS New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

ASL AWS New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

Windows PaperCut NG Spawn Shell

Command and Scripting Interpreter, Exploit Public-Facing Application, External Remote Services

PaperCut NG Remote Web Access Attempt

Exploit Public-Facing Application, External Remote Services

PaperCut NG Suspicious Behavior Debug Log

Exploit Public-Facing Application, External Remote Services

Windows Snake Malware Service Create

Kernel Modules and Extensions, Service Execution

Windows Snake Malware Kernel Driver Comadmin

Kernel Modules and Extensions

Windows Registry BootExecute Modification

Pre-OS Boot, Registry Run Keys / Startup Folder

Windows Registry BootExecute Modification

Pre-OS Boot, Registry Run Keys / Startup Folder

Active Setup Registry Autostart

Active Setup, Boot or Logon Autostart Execution

Active Setup Registry Autostart

Active Setup, Boot or Logon Autostart Execution

Monitor Registry Keys for Print Monitors

Port Monitors, Boot or Logon Autostart Execution

Monitor Registry Keys for Print Monitors

Port Monitors, Boot or Logon Autostart Execution

Registry Keys for Creating SHIM Databases

Application Shimming, Event Triggered Execution

Registry Keys for Creating SHIM Databases

Application Shimming, Event Triggered Execution

Registry Keys Used For Privilege Escalation

Image File Execution Options Injection, Event Triggered Execution

Registry Keys Used For Privilege Escalation

Image File Execution Options Injection, Event Triggered Execution

Windows Registry Modification for Safe Mode Persistence

Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution

Windows Registry Modification for Safe Mode Persistence

Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution

Time Provider Persistence Registry

Time Providers, Boot or Logon Autostart Execution

Time Provider Persistence Registry

Time Providers, Boot or Logon Autostart Execution

Windows Service Creation Using Registry Entry

Services Registry Permissions Weakness

Windows PowerView AD Access Control List Enumeration

Domain Accounts, Permission Groups Discovery

MSI Module Loaded by Non-System Binary

DLL Side-Loading, Hijack Execution Flow

MSI Module Loaded by Non-System Binary

DLL Side-Loading, Hijack Execution Flow

Possible Lateral Movement PowerShell Spawn

Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...

Possible Lateral Movement PowerShell Spawn

Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...

Schtasks Run Task On Demand

Scheduled Task/Job

Linux Java Spawning Shell

Exploit Public-Facing Application, External Remote Services

Powershell Execute COM Object

Component Object Model Hijacking, Event Triggered Execution, PowerShell

Powershell Execute COM Object

Component Object Model Hijacking, Event Triggered Execution, PowerShell

Screensaver Event Trigger Execution

Event Triggered Execution, Screensaver

Screensaver Event Trigger Execution

Event Triggered Execution, Screensaver

Linux Adding Crontab Using List Parameter

Cron, Scheduled Task/Job

Linux Adding Crontab Using List Parameter

Cron, Scheduled Task/Job

Windows BootLoader Inventory

System Firmware, Pre-OS Boot

Windows BootLoader Inventory

System Firmware, Pre-OS Boot

Logon Script Event Trigger Execution

Boot or Logon Initialization Scripts, Logon Script (Windows)

Logon Script Event Trigger Execution

Boot or Logon Initialization Scripts, Logon Script (Windows)

Change Default File Association

Change Default File Association, Event Triggered Execution

Change Default File Association

Change Default File Association, Event Triggered Execution

Wscript Or Cscript Suspicious Child Process

Process Injection, Create or Modify System Process, Parent PID Spoofing, Access Token Manipulation

Overwriting Accessibility Binaries

Event Triggered Execution, Accessibility Features

Overwriting Accessibility Binaries

Event Triggered Execution, Accessibility Features

Windows Hidden Schedule Task Settings

Scheduled Task/Job

Linux Service Restarted

Systemd Timers, Scheduled Task/Job

Linux Service Restarted

Systemd Timers, Scheduled Task/Job

Schedule Task with HTTP Command Arguments

Scheduled Task/Job

Windows Service Create with Tscon

RDP Hijacking, Remote Service Session Hijacking, Windows Service

Windows Group Policy Object Created

Domain or Tenant Policy Modification, Group Policy Modification, Domain Accounts

Windows Enable Win32 ScheduledJob via Registry

Scheduled Task

Windows Large Number of Computer Service Tickets Requested

Network Share Discovery, Valid Accounts

Windows Remote Create Service

Create or Modify System Process, Windows Service

Windows Remote Create Service

Create or Modify System Process, Windows Service

Windows Service Create RemComSvc

Windows Service, Create or Modify System Process

Windows Service Create RemComSvc

Windows Service, Create or Modify System Process

Msmpeng Application DLL Side Loading

DLL Side-Loading, Hijack Execution Flow

Msmpeng Application DLL Side Loading

DLL Side-Loading, Hijack Execution Flow

Okta Phishing Detection with FastPass Origin Check

Valid Accounts, Default Accounts, Modify Authentication Process

Okta Phishing Detection with FastPass Origin Check

Valid Accounts, Default Accounts, Modify Authentication Process

Okta Phishing Detection with FastPass Origin Check

Valid Accounts, Default Accounts, Modify Authentication Process

Okta ThreatInsight Login Failure with High Unknown users

Valid Accounts, Default Accounts, Credential Stuffing

Okta ThreatInsight Login Failure with High Unknown users

Valid Accounts, Default Accounts, Credential Stuffing

Okta ThreatInsight Suspected PasswordSpray Attack

Valid Accounts, Default Accounts, Password Spraying

Okta ThreatInsight Suspected PasswordSpray Attack

Valid Accounts, Default Accounts, Password Spraying

Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952

Exploit Public-Facing Application, External Remote Services

AWS New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

AWS New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

Windows Java Spawning Shells

Exploit Public-Facing Application, External Remote Services

Exploit Public Facing Application via Apache Commons Text

Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services

Exploit Public Facing Application via Apache Commons Text

Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services

Exploit Public Facing Application via Apache Commons Text

Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services

Windows PowerShell Add Module to Global Assembly Cache

Server Software Component, IIS Components

Windows PowerShell Add Module to Global Assembly Cache

Server Software Component, IIS Components

Windows Server Software Component GACUtil Install to GAC

Server Software Component, IIS Components

Windows Server Software Component GACUtil Install to GAC

Server Software Component, IIS Components

Windows Boot or Logon Autostart Execution In Startup Folder

Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution

Windows Boot or Logon Autostart Execution In Startup Folder

Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution

Windows PowerShell IIS Components WebGlobalModule Usage

Server Software Component, IIS Components

Windows PowerShell IIS Components WebGlobalModule Usage

Server Software Component, IIS Components

Windows PowerShell Disable HTTP Logging

Impair Defenses, Disable Windows Event Logging, Server Software Component, IIS Components

Windows PowerShell Disable HTTP Logging

Impair Defenses, Disable Windows Event Logging, Server Software Component, IIS Components

Windows IIS Components Module Failed to Load

Server Software Component, IIS Components

Windows IIS Components Module Failed to Load

Server Software Component, IIS Components

Windows IIS Components Get-WebGlobalModule Module Query

IIS Components, Server Software Component

Windows IIS Components Get-WebGlobalModule Module Query

IIS Components, Server Software Component

Windows IIS Components New Module Added

Server Software Component, IIS Components

Windows IIS Components New Module Added

Server Software Component, IIS Components

Windows IIS Components Add New Module

Server Software Component, IIS Components

Windows IIS Components Add New Module

Server Software Component, IIS Components

Windows Vulnerable Driver Loaded

Windows Service

Windows Change Default File Association For No File Ext

Change Default File Association, Event Triggered Execution

Windows Change Default File Association For No File Ext

Change Default File Association, Event Triggered Execution

Windows Security Support Provider Reg Query

Security Support Provider, Boot or Logon Autostart Execution

Windows Security Support Provider Reg Query

Security Support Provider, Boot or Logon Autostart Execution

BITSAdmin Download File

BITS Jobs, Ingress Tool Transfer

Windows AD Short Lived Domain Account ServicePrincipalName

Account Manipulation

Windows AD AdminSDHolder ACL Modified

Event Triggered Execution

Windows DLL Side-Loading In Calc

DLL Side-Loading, Hijack Execution Flow

Windows DLL Side-Loading In Calc

DLL Side-Loading, Hijack Execution Flow

Windows DLL Side-Loading Process Child Of Calc

DLL Side-Loading, Hijack Execution Flow

Windows DLL Side-Loading Process Child Of Calc

DLL Side-Loading, Hijack Execution Flow

GCP Multiple Failed MFA Requests For User

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts

GCP Multiple Failed MFA Requests For User

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts

Fortinet Appliance Auth bypass

Exploit Public-Facing Application, External Remote Services

Windows COM Hijacking InprocServer32 Modification

Component Object Model Hijacking, Event Triggered Execution

Windows COM Hijacking InprocServer32 Modification

Component Object Model Hijacking, Event Triggered Execution

AWS Successful Single-Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

AWS Successful Single-Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

Powershell COM Hijacking InprocServer32 Modification

Component Object Model Hijacking, Command and Scripting Interpreter, PowerShell

Windows COM Hijacking InprocServer32 Modification

Component Object Model Hijacking, Event Triggered Execution

Windows COM Hijacking InprocServer32 Modification

Component Object Model Hijacking, Event Triggered Execution

Okta New API Token Created

Valid Accounts, Default Accounts

Okta New API Token Created

Valid Accounts, Default Accounts

Okta Suspicious Activity Reported

Valid Accounts, Default Accounts

Okta Suspicious Activity Reported

Valid Accounts, Default Accounts

Okta Failed SSO Attempts

Valid Accounts, Default Accounts

Okta Failed SSO Attempts

Valid Accounts, Default Accounts

Okta ThreatInsight Threat Detected

Valid Accounts, Cloud Accounts

Okta ThreatInsight Threat Detected

Valid Accounts, Cloud Accounts

Okta Account Lockout Events

Valid Accounts, Default Accounts

Okta Account Lockout Events

Valid Accounts, Default Accounts

Log4Shell CVE-2021-44228 Exploitation

Ingress Tool Transfer, Exploit Public-Facing Application, Command and Scripting Interpreter, External Remote Services

Living Off The Land Detection

Ingress Tool Transfer, Exploit Public-Facing Application, Command and Scripting Interpreter, External Remote Services

Windows Event Triggered Image File Execution Options Injection

Image File Execution Options Injection

Windows AD DSRM Password Reset

Account Manipulation

Azure AD User ImmutableId Attribute Updated

Account Manipulation

Windows Hijack Execution Flow Version Dll Side Load

DLL Search Order Hijacking, Hijack Execution Flow

Windows Hijack Execution Flow Version Dll Side Load

DLL Search Order Hijacking, Hijack Execution Flow

Windows Autostart Execution LSASS Driver Registry Modification

LSASS Driver

Azure AD Service Principal Created

Cloud Account

Windows DLL Search Order Hijacking with iscsicpl

DLL Search Order Hijacking

Linux SSH Authorized Keys Modification

SSH Authorized Keys

Windows MOF Event Triggered Execution via WMI

Windows Management Instrumentation Event Subscription

Spring4Shell Payload URL Request

Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services

Spring4Shell Payload URL Request

Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services

Spring4Shell Payload URL Request

Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services

Outbound Network Connection from Java Using Default Ports

Exploit Public-Facing Application, External Remote Services

Confluence Unauthenticated Remote Code Execution CVE-2022-26134

Server Software Component, Exploit Public-Facing Application, External Remote Services

Confluence Unauthenticated Remote Code Execution CVE-2022-26134

Server Software Component, Exploit Public-Facing Application, External Remote Services

Java Writing JSP File

Exploit Public-Facing Application, External Remote Services

Linux At Application Execution

At, Scheduled Task/Job

Linux At Application Execution

At, Scheduled Task/Job

Linux Possible Append Command To At Allow Config File

At, Scheduled Task/Job

Linux Possible Append Command To At Allow Config File

At, Scheduled Task/Job

ASL AWS CreateAccessKey

Valid Accounts

Schtasks scheduling job on remote system

Scheduled Task, Scheduled Task/Job

Schtasks scheduling job on remote system

Scheduled Task, Scheduled Task/Job

VMware Workspace ONE Freemarker Server-side Template Injection

Exploit Public-Facing Application, External Remote Services

VMware Server Side Template Injection Hunt

Exploit Public-Facing Application, External Remote Services

Potential password in username

Local Accounts, Credentials In Files

F5 BIG-IP iControl REST Vulnerability CVE-2022-1388

Exploit Public-Facing Application, External Remote Services

Windows Service Create Kernel Mode Driver

Windows Service, Create or Modify System Process, Exploitation for Privilege Escalation

Windows Service Create Kernel Mode Driver

Windows Service, Create or Modify System Process, Exploitation for Privilege Escalation

Windows Registry Delete Task SD

Scheduled Task, Impair Defenses

Web Spring4Shell HTTP Request Class Module

Exploit Public-Facing Application, External Remote Services

Web Spring Cloud Function FunctionRouter

Exploit Public-Facing Application, External Remote Services

Web JSP Request via URL

Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services

Web JSP Request via URL

Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services

Web JSP Request via URL

Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services

AWS UpdateLoginProfile

Cloud Account, Create Account

AWS UpdateLoginProfile

Cloud Account, Create Account

AWS CreateAccessKey

Cloud Account, Create Account

AWS CreateAccessKey

Cloud Account, Create Account

Windows Bitsadmin Download File

BITS Jobs, Ingress Tool Transfer

Windows PowerShell Start-BitsTransfer

BITS Jobs, Ingress Tool Transfer

Windows Bits Job Persistence

BITS Jobs

Windows Schtasks Create Run As System

Scheduled Task, Scheduled Task/Job

Windows Schtasks Create Run As System

Scheduled Task, Scheduled Task/Job

O365 Disable MFA

Modify Authentication Process

Linux Possible Ssh Key File Creation

SSH Authorized Keys, Account Manipulation

Linux Possible Ssh Key File Creation

SSH Authorized Keys, Account Manipulation

Linux Possible Access Or Modification Of sshd Config File

SSH Authorized Keys, Account Manipulation

Linux Possible Access Or Modification Of sshd Config File

SSH Authorized Keys, Account Manipulation

Linux Preload Hijack Library Calls

Dynamic Linker Hijacking, Hijack Execution Flow

Linux Preload Hijack Library Calls

Dynamic Linker Hijacking, Hijack Execution Flow

Linux File Created In Kernel Driver Directory

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Linux File Created In Kernel Driver Directory

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Linux Install Kernel Module Using Modprobe Utility

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Linux Install Kernel Module Using Modprobe Utility

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Linux Insert Kernel Module Using Insmod Utility

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Linux Insert Kernel Module Using Insmod Utility

Kernel Modules and Extensions, Boot or Logon Autostart Execution

Linux Add User Account

Local Account, Create Account

Linux Add User Account

Local Account, Create Account

Linux Service File Created In Systemd Directory

Systemd Timers, Scheduled Task/Job

Linux Service File Created In Systemd Directory

Systemd Timers, Scheduled Task/Job

Linux Possible Append Command To Profile Config File

Unix Shell Configuration Modification, Event Triggered Execution

Linux Possible Append Command To Profile Config File

Unix Shell Configuration Modification, Event Triggered Execution

Linux File Creation In Init Boot Directory

RC Scripts, Boot or Logon Initialization Scripts

Linux File Creation In Init Boot Directory

RC Scripts, Boot or Logon Initialization Scripts

Linux File Creation In Profile Directory

Unix Shell Configuration Modification, Event Triggered Execution

Linux File Creation In Profile Directory

Unix Shell Configuration Modification, Event Triggered Execution

Linux Possible Cronjob Modification With Editor

Cron, Scheduled Task/Job

Linux Possible Cronjob Modification With Editor

Cron, Scheduled Task/Job

Linux Possible Append Cronjob Entry on Existing Cronjob File

Cron, Scheduled Task/Job

Linux Possible Append Cronjob Entry on Existing Cronjob File

Cron, Scheduled Task/Job

Linux At Allow Config File Creation

Cron, Scheduled Task/Job

Linux At Allow Config File Creation

Cron, Scheduled Task/Job

Linux Edit Cron Table Parameter

Cron, Scheduled Task/Job

Linux Edit Cron Table Parameter

Cron, Scheduled Task/Job

Linux Add Files In Known Crontab Directories

Cron, Scheduled Task/Job

Linux Add Files In Known Crontab Directories

Cron, Scheduled Task/Job

Hunting for Log4Shell

Exploit Public-Facing Application, External Remote Services

Log4Shell JNDI Payload Injection Attempt

Exploit Public-Facing Application, External Remote Services

Log4Shell JNDI Payload Injection with Outbound Connection

Exploit Public-Facing Application, External Remote Services

Unusual Number of Remote Endpoint Authentication Events

Valid Accounts

Unusual Number of Computer Service Tickets Requested

Valid Accounts

Disable Net User Account

Service Stop, Valid Accounts

Randomly Generated Scheduled Task Name

Scheduled Task/Job, Scheduled Task

Randomly Generated Scheduled Task Name

Scheduled Task/Job, Scheduled Task

Randomly Generated Windows Service Name

Create or Modify System Process, Windows Service

Randomly Generated Windows Service Name

Create or Modify System Process, Windows Service

Attempt To Delete Services

Service Stop, Create or Modify System Process, Windows Service

Attempt To Delete Services

Service Stop, Create or Modify System Process, Windows Service

Services LOLBAS Execution Process Spawn

Create or Modify System Process, Windows Service

Services LOLBAS Execution Process Spawn

Create or Modify System Process, Windows Service

Scheduled Task Initiation on Remote Endpoint

Scheduled Task/Job, Scheduled Task

Scheduled Task Initiation on Remote Endpoint

Scheduled Task/Job, Scheduled Task

Scheduled Task Creation on Remote Endpoint using At

Scheduled Task/Job, At

Scheduled Task Creation on Remote Endpoint using At

Scheduled Task/Job, At

Windows Service Creation on Remote Endpoint

Create or Modify System Process, Windows Service

Windows Service Creation on Remote Endpoint

Create or Modify System Process, Windows Service

Windows Service Initiation on Remote Endpoint

Create or Modify System Process, Windows Service

Windows Service Initiation on Remote Endpoint

Create or Modify System Process, Windows Service

BITS Job Persistence

BITS Jobs

Circle CI Disable Security Job

Compromise Host Software Binary

Circle CI Disable Security Step

Compromise Host Software Binary

AWS CreateLoginProfile

Cloud Account, Create Account

AWS CreateLoginProfile

Cloud Account, Create Account

Cloud Compute Instance Created By Previously Unseen User

Cloud Accounts, Valid Accounts

Cloud Compute Instance Created By Previously Unseen User

Cloud Accounts, Valid Accounts

Spoolsv Suspicious Loaded Modules

Print Processors, Boot or Logon Autostart Execution

Spoolsv Suspicious Loaded Modules

Print Processors, Boot or Logon Autostart Execution

Spoolsv Writing a DLL - Sysmon

Print Processors, Boot or Logon Autostart Execution

Spoolsv Writing a DLL - Sysmon

Print Processors, Boot or Logon Autostart Execution

Print Spooler Adding A Printer Driver

Print Processors, Boot or Logon Autostart Execution

Print Spooler Adding A Printer Driver

Print Processors, Boot or Logon Autostart Execution

Print Spooler Failed to Load a Plug-in

Print Processors, Boot or Logon Autostart Execution

Print Spooler Failed to Load a Plug-in

Print Processors, Boot or Logon Autostart Execution

Spoolsv Spawning Rundll32

Print Processors, Boot or Logon Autostart Execution

Spoolsv Spawning Rundll32

Print Processors, Boot or Logon Autostart Execution

Detect WMI Event Subscription Persistence

Windows Management Instrumentation Event Subscription, Event Triggered Execution

Detect WMI Event Subscription Persistence

Windows Management Instrumentation Event Subscription, Event Triggered Execution

Suspicious Driver Loaded Path

Windows Service, Create or Modify System Process

Suspicious Driver Loaded Path

Windows Service, Create or Modify System Process

XMRIG Driver Loaded

Windows Service, Create or Modify System Process

XMRIG Driver Loaded

Windows Service, Create or Modify System Process

Schedule Task with Rundll32 Command Trigger

Scheduled Task/Job

AWS IAM Delete Policy

Account Manipulation

AWS IAM Successful Group Deletion

Cloud Groups, Account Manipulation, Permission Groups Discovery

PowerShell Start-BitsTransfer

BITS Jobs

AWS SetDefaultPolicyVersion

Cloud Accounts, Valid Accounts

AWS SetDefaultPolicyVersion

Cloud Accounts, Valid Accounts

Suspicious PlistBuddy Usage

Launch Agent, Create or Modify System Process

Suspicious PlistBuddy Usage

Launch Agent, Create or Modify System Process

Suspicious PlistBuddy Usage via OSquery

Launch Agent, Create or Modify System Process

Suspicious PlistBuddy Usage via OSquery

Launch Agent, Create or Modify System Process

AWS SAML Access by Provider User and Principal

Valid Accounts

AWS SAML Update identity provider

Valid Accounts

Supernova Webshell

Web Shell, External Remote Services

Supernova Webshell

Web Shell, External Remote Services

O365 Suspicious Rights Delegation

Remote Email Collection, Email Collection, Additional Email Delegate Permissions, Account Manipulation

O365 Suspicious Rights Delegation

Remote Email Collection, Email Collection, Additional Email Delegate Permissions, Account Manipulation

Shim Database File Creation

Application Shimming, Event Triggered Execution

Shim Database File Creation

Application Shimming, Event Triggered Execution

Schtasks used for forcing a reboot

Scheduled Task, Scheduled Task/Job

Schtasks used for forcing a reboot

Scheduled Task, Scheduled Task/Job

Reg exe Manipulating Windows Services Registry Keys

Services Registry Permissions Weakness, Hijack Execution Flow

Reg exe Manipulating Windows Services Registry Keys

Services Registry Permissions Weakness, Hijack Execution Flow

Shim Database Installation With Suspicious Parameters

Application Shimming, Event Triggered Execution

Shim Database Installation With Suspicious Parameters

Application Shimming, Event Triggered Execution

Detect Software Download To Network Device

TFTP Boot, Pre-OS Boot

Detect Software Download To Network Device

TFTP Boot, Pre-OS Boot

Cloud Provisioning Activity From Previously Unseen City

Valid Accounts

Cloud Provisioning Activity From Previously Unseen Country

Valid Accounts

GCP Detect high risk permissions by resource and account

Valid Accounts

GCP Detect accounts with high risk roles by project

Valid Accounts

GCP Detect gcploit framework

Valid Accounts

Abnormally High Number Of Cloud Security Group API Calls

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Security Group API Calls

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Infrastructure API Calls

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Infrastructure API Calls

Cloud Accounts, Valid Accounts

Cloud API Calls From Previously Unseen User Roles

Valid Accounts

gcp detect oauth token abuse

Valid Accounts

Abnormally High Number Of Cloud Instances Launched

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Instances Launched

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Instances Destroyed

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Instances Destroyed

Cloud Accounts, Valid Accounts

Cloud Provisioning Activity From Previously Unseen IP Address

Valid Accounts

Cloud Provisioning Activity From Previously Unseen Region

Valid Accounts

Cloud Instance Modified By Previously Unseen User

Cloud Accounts, Valid Accounts

Cloud Instance Modified By Previously Unseen User

Cloud Accounts, Valid Accounts

aws detect sts assume role abuse

Valid Accounts

aws detect attach to role policy

Valid Accounts

aws detect role creation

Valid Accounts

aws detect permanent key creation

Valid Accounts

Suspicious Changes to File Associations

Change Default File Association

Sc exe Manipulating Windows Services

Windows Service, Create or Modify System Process

Sc exe Manipulating Windows Services

Windows Service, Create or Modify System Process

Abnormally High AWS Instances Launched by User - MLTK

Cloud Accounts

Detect new user AWS Console Login

Cloud Accounts

Detect AWS API Activities From Unapproved Accounts

Cloud Accounts

Detect Spike in AWS API Activity

Cloud Accounts

Abnormally High AWS Instances Terminated by User

Cloud Accounts

EC2 Instance Modified With Previously Unseen User

Cloud Accounts

Abnormally High AWS Instances Launched by User

Cloud Accounts

EC2 Instance Started With Previously Unseen User

Cloud Accounts

Abnormally High AWS Instances Terminated by User - MLTK

Cloud Accounts

Scheduled tasks used in BadRabbit ransomware

Scheduled Task

Web Fraud - Account Harvesting

Create Account

Web Fraud - Anomalous User Clickspeed

Valid Accounts

Detect Spike in Security Group Activity

Cloud Accounts

Detect new API calls from user roles

Cloud Accounts

Detect attackers scanning for vulnerable JBoss servers

System Information Discovery, External Remote Services

Identify New User Accounts

Domain Accounts