Execution Detections

Name Data Source Technique Type Analytic Story Date
Detect Risky SPL using Pretrained ML Model Command and Scripting Interpreter Anomaly Splunk Vulnerabilities 2025-05-02
Splunk Command and Scripting Interpreter Delete Usage Splunk Command and Scripting Interpreter Anomaly Splunk Vulnerabilities 2025-05-02
Splunk Command and Scripting Interpreter Risky Commands Splunk Command and Scripting Interpreter Hunting Splunk Vulnerabilities 2025-05-02
Splunk Command and Scripting Interpreter Risky SPL MLTK Splunk Command and Scripting Interpreter Anomaly Splunk Vulnerabilities 2025-05-02
ASL AWS ECR Container Upload Outside Business Hours ASL AWS CloudTrail Malicious Image Anomaly Dev Sec Ops 2025-05-02
ASL AWS ECR Container Upload Unknown User ASL AWS CloudTrail Malicious Image Anomaly Dev Sec Ops 2025-05-02
AWS ECR Container Scanning Findings High AWS CloudTrail DescribeImageScanFindings Malicious Image TTP Dev Sec Ops 2025-05-02
AWS ECR Container Scanning Findings Low Informational Unknown AWS CloudTrail DescribeImageScanFindings Malicious Image Anomaly Dev Sec Ops 2025-05-02
AWS ECR Container Scanning Findings Medium AWS CloudTrail DescribeImageScanFindings Malicious Image Anomaly Dev Sec Ops 2025-05-02
AWS ECR Container Upload Outside Business Hours AWS CloudTrail PutImage Malicious Image Anomaly Dev Sec Ops 2025-05-02
AWS ECR Container Upload Unknown User AWS CloudTrail PutImage Malicious Image Anomaly Dev Sec Ops 2025-05-02
AWS Lambda UpdateFunctionCode AWS CloudTrail User Execution Hunting Suspicious Cloud User Activities 2025-05-02
Kubernetes Anomalous Inbound Network Activity from Process User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Anomalous Inbound Outbound Network IO User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Anomalous Inbound to Outbound Network IO Ratio User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Anomalous Outbound Network Activity from Process User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Anomalous Traffic on Network Edge User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Create or Update Privileged Pod Kubernetes Audit User Execution Anomaly Kubernetes Security 2025-05-02
Kubernetes Cron Job Creation Kubernetes Audit Container Orchestration Job Anomaly Kubernetes Security 2025-05-02
Kubernetes DaemonSet Deployed Kubernetes Audit User Execution Anomaly Kubernetes Security 2025-05-02
Kubernetes Falco Shell Spawned Kubernetes Falco User Execution Anomaly Kubernetes Security 2025-05-02
Kubernetes newly seen TCP edge User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes newly seen UDP edge User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Node Port Creation Kubernetes Audit User Execution Anomaly Kubernetes Security 2025-05-02
Kubernetes Pod Created in Default Namespace Kubernetes Audit User Execution Anomaly Kubernetes Security 2025-05-02
Kubernetes Pod With Host Network Attachment Kubernetes Audit User Execution Anomaly Kubernetes Security 2025-05-02
Kubernetes Previously Unseen Container Image Name User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Previously Unseen Process User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Process Running From New Path User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Process with Anomalous Resource Utilisation User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Process with Resource Ratio Anomalies User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Shell Running on Worker Node User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Shell Running on Worker Node with CPU Activity User Execution Anomaly Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring 2025-05-02
Kubernetes Unauthorized Access Kubernetes Audit User Execution Anomaly Kubernetes Security 2025-05-02
Microsoft Intune Device Health Scripts Azure Monitor Activity Software Deployment Tools Cloud Services Indirect Command Execution Ingress Tool Transfer Hunting Azure Active Directory Account Takeover 2025-05-02
Microsoft Intune DeviceManagementConfigurationPolicies Azure Monitor Activity Software Deployment Tools Domain or Tenant Policy Modification Cloud Services Disable or Modify Tools Disable or Modify System Firewall Hunting Azure Active Directory Account Takeover 2025-05-02
Microsoft Intune Manual Device Management Azure Monitor Activity Cloud Services Software Deployment Tools System Shutdown/Reboot Hunting Azure Active Directory Account Takeover 2025-05-02
Microsoft Intune Mobile Apps Azure Monitor Activity Software Deployment Tools Cloud Services Indirect Command Execution Ingress Tool Transfer Hunting Azure Active Directory Account Takeover 2025-05-02
O365 SharePoint Malware Detection Office 365 Universal Audit Log Malicious File TTP Azure Active Directory Persistence, Office 365 Account Takeover, Ransomware Cloud 2025-05-02
O365 Threat Intelligence Suspicious File Detected Office 365 Universal Audit Log Malicious File TTP Azure Active Directory Account Takeover, Office 365 Account Takeover, Ransomware Cloud 2025-05-02
Risk Rule for Dev Sec Ops by Repository Malicious Image Correlation Dev Sec Ops 2025-05-02
Any Powershell DownloadFile CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 PowerShell Ingress Tool Transfer TTP Braodo Stealer, China-Nexus Threat Activity, Crypto Stealer, DarkCrystal RAT, Data Destruction, Hermetic Wiper, Ingress Tool Transfer, Log4Shell CVE-2021-44228, Malicious PowerShell, PHP-CGI RCE Attack on Japanese Organizations, PXA Stealer, Phemedrone Stealer, Salt Typhoon 2025-05-02
Any Powershell DownloadString CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 PowerShell Ingress Tool Transfer TTP Data Destruction, HAFNIUM Group, Hermetic Wiper, IcedID, Ingress Tool Transfer, Malicious PowerShell, PHP-CGI RCE Attack on Japanese Organizations, Phemedrone Stealer, SysAid On-Prem Software CVE-2023-47246 Vulnerability, Winter Vivern 2025-05-02
Batch File Write to System32 Sysmon EventID 11 Malicious File TTP Compromised Windows Host, SamSam Ransomware 2025-05-02
CHCP Command Execution CrowdStrike ProcessRollup2, Sysmon EventID 1 Command and Scripting Interpreter Anomaly Azorult, Crypto Stealer, Forest Blizzard, IcedID 2025-05-02
Clop Common Exec Parameter CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 User Execution TTP Clop Ransomware, Compromised Windows Host 2025-05-02
CMD Carry Out String Command Parameter CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Command Shell Hunting AsyncRAT, Azorult, CISA AA23-347A, Chaos Ransomware, Crypto Stealer, DarkCrystal RAT, DarkGate Malware, Data Destruction, Hermetic Wiper, IcedID, Living Off The Land, Log4Shell CVE-2021-44228, NjRAT, PlugX, ProxyNotShell, Qakbot, RedLine Stealer, Rhysida Ransomware, Warzone RAT, WhisperGate, Winter Vivern 2025-05-02
CMD Echo Pipe - Escalation CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Command Shell Windows Service TTP BlackByte Ransomware, Cobalt Strike, Compromised Windows Host, Graceful Wipe Out Attack 2025-05-02
Conti Common Exec parameter CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 User Execution TTP Compromised Windows Host, Ransomware 2025-05-02
Detect Certify With PowerShell Script Block Logging Powershell Script Block Logging 4104 PowerShell Steal or Forge Authentication Certificates TTP Malicious PowerShell, Windows Certificate Services 2025-05-02
Detect Empire with PowerShell Script Block Logging Powershell Script Block Logging 4104 PowerShell TTP Data Destruction, Hermetic Wiper, Malicious PowerShell 2025-05-02
Detect Mimikatz With PowerShell Script Block Logging Powershell Script Block Logging 4104 OS Credential Dumping PowerShell TTP CISA AA22-264A, CISA AA22-320A, CISA AA23-347A, Data Destruction, Hermetic Wiper, Malicious PowerShell, Sandworm Tools 2025-05-02
Detect Prohibited Applications Spawning cmd exe CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Command Shell Hunting NOBELIUM Group, Suspicious Command-Line Executions, Suspicious MSHTA Activity, Suspicious Zoom Child Processes 2025-05-02
Detect Rare Executables CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 User Execution Anomaly China-Nexus Threat Activity, Crypto Stealer, Rhysida Ransomware, Salt Typhoon, SnappyBee, Unusual Processes 2025-05-02
Detect Renamed PSExec CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Service Execution Hunting Active Directory Lateral Movement, BlackByte Ransomware, CISA AA22-320A, Cactus Ransomware, China-Nexus Threat Activity, DHS Report TA18-074A, DarkGate Malware, DarkSide Ransomware, HAFNIUM Group, Medusa Ransomware, Rhysida Ransomware, Salt Typhoon, SamSam Ransomware, Sandworm Tools, VanHelsing Ransomware 2025-05-02
Detect suspicious processnames using pretrained model in DSDL Sysmon EventID 1 Command and Scripting Interpreter Anomaly Suspicious Command-Line Executions 2025-05-02
Detect Use of cmd exe to Launch Script Interpreters CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Command Shell TTP Azorult, Emotet Malware DHS Report TA18-201A, Suspicious Command-Line Executions 2025-05-02
Detection of tools built by NirSoft CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Software Deployment Tools Anomaly Emotet Malware DHS Report TA18-201A 2025-05-02
Drop IcedID License dat Sysmon EventID 11 Malicious File Hunting IcedID 2025-05-02
Excessive distinct processes from Windows Temp CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Command and Scripting Interpreter Anomaly Meterpreter 2025-05-02
Excessive number of taskhost processes CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Command and Scripting Interpreter Anomaly Meterpreter 2025-05-02
Excessive Usage Of SC Service Utility Sysmon EventID 1 Service Execution Anomaly Azorult, Crypto Stealer, Ransomware 2025-05-02
Exchange PowerShell Module Usage Powershell Script Block Logging 4104 PowerShell TTP BlackByte Ransomware, CISA AA22-264A, CISA AA22-277A, ProxyNotShell, ProxyShell 2025-05-02
Execute Javascript With Jscript COM CLSID CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Visual Basic TTP Ransomware 2025-05-02
First Time Seen Running Windows Service Windows Event Log System 7036 Service Execution Anomaly NOBELIUM Group, Orangeworm Attack Group, Windows Service Abuse 2025-05-02
Get-ForestTrust with PowerShell Script Block Powershell Script Block Logging 4104 Domain Trust Discovery PowerShell TTP Active Directory Discovery 2025-05-02
GetLocalUser with PowerShell Script Block Powershell Script Block Logging 4104 PowerShell Local Account Hunting Active Directory Discovery, Malicious PowerShell 2025-05-02
GetWmiObject User Account with PowerShell Script Block Powershell Script Block Logging 4104 PowerShell Local Account Hunting Active Directory Discovery, Malicious PowerShell, Winter Vivern 2025-05-02
Impacket Lateral Movement Commandline Parameters CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 SMB/Windows Admin Shares Distributed Component Object Model Windows Management Instrumentation Windows Service TTP Active Directory Lateral Movement, CISA AA22-277A, Compromised Windows Host, Data Destruction, Gozi Malware, Graceful Wipe Out Attack, Industroyer2, Prestige Ransomware, Volt Typhoon, WhisperGate 2025-05-02
Impacket Lateral Movement smbexec CommandLine Parameters CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 SMB/Windows Admin Shares Distributed Component Object Model Windows Management Instrumentation Windows Service TTP Active Directory Lateral Movement, CISA AA22-277A, Compromised Windows Host, Data Destruction, Graceful Wipe Out Attack, Industroyer2, Prestige Ransomware, Volt Typhoon, WhisperGate 2025-05-02
Impacket Lateral Movement WMIExec Commandline Parameters CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 SMB/Windows Admin Shares Distributed Component Object Model Windows Management Instrumentation Windows Service TTP Active Directory Lateral Movement, CISA AA22-277A, Compromised Windows Host, Data Destruction, Gozi Malware, Graceful Wipe Out Attack, Industroyer2, Prestige Ransomware, Volt Typhoon, WhisperGate 2025-05-02
Jscript Execution Using Cscript App CrowdStrike ProcessRollup2, Sysmon EventID 1 JavaScript TTP FIN7, Remcos 2025-05-02
Linux Add Files In Known Crontab Directories Sysmon for Linux EventID 11 Cron Anomaly Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks, XorDDos 2025-05-02
Linux Adding Crontab Using List Parameter Sysmon for Linux EventID 1 Cron Hunting Data Destruction, Gomir, Industroyer2, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks 2025-05-02
Linux At Allow Config File Creation Sysmon for Linux EventID 11 Cron Anomaly Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks 2025-05-02
Linux At Application Execution Sysmon for Linux EventID 1 At Anomaly Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks 2025-05-02
Linux Auditd At Application Execution Linux Auditd Syscall At Anomaly Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks 2025-05-02
Linux Auditd Edit Cron Table Parameter Linux Auditd Syscall Cron Anomaly Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks 2025-05-02
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File Linux Auditd Path Cron Hunting Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks, XorDDos 2025-05-02
Linux Auditd Service Restarted Linux Auditd Proctitle Systemd Timers Anomaly AwfulShred, Compromised Linux Host, Data Destruction, Gomir, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks 2025-05-02
Linux Auditd Service Started Linux Auditd Proctitle Service Execution Anomaly Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation 2025-05-02
Linux Decode Base64 to Shell Sysmon for Linux EventID 1 Obfuscated Files or Information Unix Shell TTP Linux Living Off The Land 2025-05-02
Linux Edit Cron Table Parameter Sysmon for Linux EventID 1 Cron Hunting Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks 2025-05-02
Linux Possible Append Command To At Allow Config File Sysmon for Linux EventID 1 At Anomaly Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks 2025-05-02
Linux Possible Append Cronjob Entry on Existing Cronjob File Sysmon for Linux EventID 1 Cron Hunting Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks, XorDDos 2025-05-02
Linux Possible Cronjob Modification With Editor Sysmon for Linux EventID 1 Cron Hunting Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks, XorDDos 2025-05-02
Linux Service File Created In Systemd Directory Sysmon for Linux EventID 11 Systemd Timers Anomaly Gomir, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks 2025-05-02
Linux Service Restarted Sysmon for Linux EventID 1 Systemd Timers Anomaly AwfulShred, Data Destruction, Gomir, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks 2025-05-02
Linux Service Started Or Enabled Sysmon for Linux EventID 1 Systemd Timers Anomaly Gomir, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks 2025-05-02
Linux Unix Shell Enable All SysRq Functions Sysmon for Linux EventID 1 Unix Shell Anomaly AwfulShred, Data Destruction 2025-05-02
Living Off The Land Detection Ingress Tool Transfer Exploit Public-Facing Application Command and Scripting Interpreter External Remote Services Correlation Living Off The Land 2025-05-02
Log4Shell CVE-2021-44228 Exploitation Ingress Tool Transfer Exploit Public-Facing Application Command and Scripting Interpreter External Remote Services Correlation CISA AA22-320A, Log4Shell CVE-2021-44228 2025-05-02
MacOS AMOS Stealer - Virtual Machine Check Activity osquery AppleScript Anomaly AMOS Stealer 2025-04-25
MacOS LOLbin osquery Unix Shell TTP Living Off The Land 2025-05-05
Malicious Powershell Executed As A Service Windows Event Log System 7045 Service Execution TTP Compromised Windows Host, Malicious PowerShell, Rhysida Ransomware 2025-05-02
Malicious PowerShell Process - Execution Policy Bypass CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 PowerShell Anomaly AsyncRAT, China-Nexus Threat Activity, DHS Report TA18-074A, DarkCrystal RAT, HAFNIUM Group, Salt Typhoon, Volt Typhoon 2025-05-02
Malicious PowerShell Process With Obfuscation Techniques Sysmon EventID 1 PowerShell TTP Data Destruction, Hermetic Wiper, Malicious PowerShell 2025-05-02
MS Scripting Process Loading Ldap Module Sysmon EventID 7 JavaScript Anomaly FIN7 2025-05-02
MS Scripting Process Loading WMI Module Sysmon EventID 7 JavaScript Anomaly FIN7 2025-05-02
Nishang PowershellTCPOneLine CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 PowerShell TTP Cleo File Transfer Software, HAFNIUM Group 2025-05-02
Possible Lateral Movement PowerShell Spawn CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Distributed Component Object Model Windows Remote Management Windows Management Instrumentation Scheduled Task PowerShell MMC Windows Service TTP Active Directory Lateral Movement, CISA AA24-241A, Data Destruction, Hermetic Wiper, Malicious PowerShell, Scheduled Tasks 2025-05-02
Potentially malicious code on commandline CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Command Shell Anomaly Suspicious Command-Line Executions 2025-05-02
PowerShell 4104 Hunting Powershell Script Block Logging 4104 PowerShell Hunting Braodo Stealer, CISA AA23-347A, CISA AA24-241A, Cactus Ransomware, China-Nexus Threat Activity, Cleo File Transfer Software, DarkGate Malware, Data Destruction, Flax Typhoon, Hermetic Wiper, Lumma Stealer, Malicious PowerShell, Medusa Ransomware, PHP-CGI RCE Attack on Japanese Organizations, Rhysida Ransomware, Salt Typhoon, SystemBC, Water Gamayun 2025-05-02
PowerShell - Connect To Internet With Hidden Window CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 PowerShell Hunting AgentTesla, Data Destruction, HAFNIUM Group, Hermetic Wiper, Log4Shell CVE-2021-44228, Malicious PowerShell, Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns 2025-05-02
Powershell COM Hijacking InprocServer32 Modification Powershell Script Block Logging 4104 PowerShell Component Object Model Hijacking TTP Malicious PowerShell 2025-05-02
Powershell Creating Thread Mutex Powershell Script Block Logging 4104 Indicator Removal from Tools PowerShell TTP Malicious PowerShell, Water Gamayun 2025-05-02
PowerShell Domain Enumeration Powershell Script Block Logging 4104 PowerShell TTP CISA AA23-347A, Data Destruction, Hermetic Wiper, Malicious PowerShell 2025-05-02
PowerShell Enable PowerShell Remoting Powershell Script Block Logging 4104 PowerShell Anomaly Malicious PowerShell 2025-05-02
Powershell Execute COM Object Powershell Script Block Logging 4104 PowerShell Component Object Model Hijacking TTP Data Destruction, Hermetic Wiper, Malicious PowerShell, Ransomware 2025-05-02
Powershell Fileless Process Injection via GetProcAddress Powershell Script Block Logging 4104 Process Injection PowerShell TTP Data Destruction, Hermetic Wiper, Malicious PowerShell 2025-05-02
Powershell Fileless Script Contains Base64 Encoded Content Powershell Script Block Logging 4104 Obfuscated Files or Information PowerShell TTP AsyncRAT, Data Destruction, Hermetic Wiper, IcedID, Malicious PowerShell, Medusa Ransomware, NjRAT, Winter Vivern 2025-05-02
PowerShell Invoke CIMMethod CIMSession Powershell Script Block Logging 4104 Windows Management Instrumentation Anomaly Active Directory Lateral Movement, Malicious PowerShell 2025-05-02
PowerShell Invoke WmiExec Usage Powershell Script Block Logging 4104 Windows Management Instrumentation TTP Suspicious WMI Use 2025-05-02
Powershell Load Module in Meterpreter Powershell Script Block Logging 4104 PowerShell TTP MetaSploit 2025-05-02
PowerShell Loading DotNET into Memory via Reflection Powershell Script Block Logging 4104 PowerShell Anomaly AgentTesla, AsyncRAT, Data Destruction, Hermetic Wiper, Malicious PowerShell, Winter Vivern 2025-05-02
Powershell Processing Stream Of Data Powershell Script Block Logging 4104 PowerShell TTP AsyncRAT, Braodo Stealer, Data Destruction, Hermetic Wiper, IcedID, Malicious PowerShell, Medusa Ransomware, MoonPeak, PXA Stealer 2025-05-02
PowerShell Script Block With URL Chain Powershell Script Block Logging 4104 PowerShell Ingress Tool Transfer TTP Malicious PowerShell 2025-05-02
PowerShell Start or Stop Service Powershell Script Block Logging 4104 PowerShell Anomaly Active Directory Lateral Movement 2025-05-02
Powershell Using memory As Backing Store Powershell Script Block Logging 4104 PowerShell TTP Data Destruction, Hermetic Wiper, IcedID, Malicious PowerShell, Medusa Ransomware, MoonPeak 2025-05-02
PowerShell WebRequest Using Memory Stream Powershell Script Block Logging 4104 PowerShell Ingress Tool Transfer Fileless Storage TTP Malicious PowerShell, Medusa Ransomware, MoonPeak, PHP-CGI RCE Attack on Japanese Organizations 2025-05-02
Process Execution via WMI CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Management Instrumentation TTP Suspicious WMI Use 2025-05-02
Process Writing DynamicWrapperX Sysmon EventID 11 Command and Scripting Interpreter Component Object Model Hunting Remcos 2025-05-02
Randomly Generated Scheduled Task Name Windows Event Log Security 4698 Scheduled Task Hunting Active Directory Lateral Movement, CISA AA22-257A, Scheduled Tasks 2025-05-02
Recon Using WMI Class Powershell Script Block Logging 4104 Gather Victim Host Information PowerShell Anomaly AsyncRAT, Data Destruction, Hermetic Wiper, Industroyer2, LockBit Ransomware, Malicious PowerShell, MoonPeak, Qakbot 2025-05-02
Remote Process Instantiation via WMI CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Management Instrumentation TTP Active Directory Lateral Movement, CISA AA23-347A, China-Nexus Threat Activity, Ransomware, Salt Typhoon, Suspicious WMI Use 2025-05-02
Remote Process Instantiation via WMI and PowerShell CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Management Instrumentation TTP Active Directory Lateral Movement, Compromised Windows Host 2025-05-02
Remote Process Instantiation via WMI and PowerShell Script Block Powershell Script Block Logging 4104 Windows Management Instrumentation TTP Active Directory Lateral Movement 2025-05-02
Remote WMI Command Attempt CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Management Instrumentation TTP CISA AA23-347A, Graceful Wipe Out Attack, IcedID, Living Off The Land, Suspicious WMI Use, Volt Typhoon 2025-05-02
Revil Common Exec Parameter CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 User Execution TTP Ransomware, Revil Ransomware 2025-05-02
Ryuk Wake on LAN Command CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Command Shell TTP Compromised Windows Host, Ryuk Ransomware 2025-05-02
Schedule Task with HTTP Command Arguments Windows Event Log Security 4698 Scheduled Task/Job TTP Compromised Windows Host, Living Off The Land, Scheduled Tasks, Windows Persistence Techniques, Winter Vivern 2025-05-02
Schedule Task with Rundll32 Command Trigger Windows Event Log Security 4698 Scheduled Task/Job TTP Compromised Windows Host, IcedID, Living Off The Land, Scheduled Tasks, Trickbot, Windows Persistence Techniques 2025-05-02
Scheduled Task Creation on Remote Endpoint using At CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 At TTP Active Directory Lateral Movement, Living Off The Land, Scheduled Tasks 2025-05-02
Scheduled Task Deleted Or Created via CMD CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Scheduled Task TTP AgentTesla, Amadey, AsyncRAT, Azorult, CISA AA22-257A, CISA AA23-347A, CISA AA24-241A, China-Nexus Threat Activity, DHS Report TA18-074A, DarkCrystal RAT, Living Off The Land, Medusa Ransomware, MoonPeak, NOBELIUM Group, NjRAT, Phemedrone Stealer, Prestige Ransomware, Qakbot, RedLine Stealer, Rhysida Ransomware, Salt Typhoon, Sandworm Tools, Scheduled Tasks, ShrinkLocker, Trickbot, Windows Persistence Techniques, Winter Vivern 2025-05-02
Scheduled Task Initiation on Remote Endpoint CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Scheduled Task TTP Active Directory Lateral Movement, Living Off The Land, Medusa Ransomware, Scheduled Tasks, Seashell Blizzard 2025-05-02
Schtasks Run Task On Demand CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Scheduled Task/Job TTP CISA AA22-257A, Data Destruction, Industroyer2, Medusa Ransomware, Qakbot, Scheduled Tasks, XMRig 2025-05-02
Schtasks scheduling job on remote system CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Scheduled Task TTP Active Directory Lateral Movement, Compromised Windows Host, Living Off The Land, NOBELIUM Group, Phemedrone Stealer, Prestige Ransomware, RedLine Stealer, Scheduled Tasks 2025-05-02
Schtasks used for forcing a reboot CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Scheduled Task TTP Ransomware, Scheduled Tasks, Windows Persistence Techniques 2025-05-02
Script Execution via WMI CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Management Instrumentation TTP Suspicious WMI Use 2025-05-02
Set Default PowerShell Execution Policy To Unrestricted or Bypass Sysmon EventID 12, Sysmon EventID 13 PowerShell TTP Credential Dumping, DarkGate Malware, Data Destruction, HAFNIUM Group, Hermetic Wiper, Malicious PowerShell, SystemBC 2025-05-02
Short Lived Scheduled Task Windows Event Log Security 4698, Windows Event Log Security 4699 Scheduled Task TTP Active Directory Lateral Movement, CISA AA22-257A, CISA AA23-347A, Compromised Windows Host, Scheduled Tasks 2025-05-02
Single Letter Process On Endpoint CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Malicious File TTP Compromised Windows Host, DHS Report TA18-074A 2025-05-02
Sunburst Correlation DLL and Network Event Sysmon EventID 22, Sysmon EventID 7 Exploitation for Client Execution TTP NOBELIUM Group 2025-05-02
Suspicious Linux Discovery Commands Sysmon for Linux EventID 1 Unix Shell TTP Linux Post-Exploitation 2025-05-02
Suspicious Process Executed From Container File CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Malicious File Masquerade File Type TTP Amadey, Remcos, Snake Keylogger, Unusual Processes, Water Gamayun 2025-05-02
Suspicious Scheduled Task from Public Directory CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Scheduled Task Anomaly Azorult, CISA AA23-347A, CISA AA24-241A, China-Nexus Threat Activity, Crypto Stealer, DarkCrystal RAT, Living Off The Land, Medusa Ransomware, MoonPeak, Ransomware, Ryuk Ransomware, Salt Typhoon, Scheduled Tasks, Windows Persistence Techniques 2025-05-02
Svchost LOLBAS Execution Process Spawn CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Scheduled Task TTP Active Directory Lateral Movement, Living Off The Land, Scheduled Tasks 2025-05-02
Unloading AMSI via Reflection Powershell Script Block Logging 4104 PowerShell Impair Defenses TTP Data Destruction, Hermetic Wiper, Malicious PowerShell 2025-05-02
Vbscript Execution Using Wscript App CrowdStrike ProcessRollup2, Sysmon EventID 1 Visual Basic TTP AsyncRAT, FIN7, Remcos 2025-05-02
Wermgr Process Spawned CMD Or Powershell Process CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Command and Scripting Interpreter TTP Qakbot, Trickbot 2025-05-02
Windows Account Access Removal via Logoff Exec Sysmon EventID 1 PowerShell Account Access Removal Anomaly Crypto Stealer 2025-05-02
Windows Anonymous Pipe Activity Sysmon EventID 17, Sysmon EventID 18 Inter-Process Communication Hunting China-Nexus Threat Activity, Salt Typhoon, SnappyBee 2025-05-02
Windows Apache Benchmark Binary CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Command and Scripting Interpreter Anomaly MetaSploit 2025-05-02
Windows AutoIt3 Execution CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Command and Scripting Interpreter TTP Crypto Stealer, DarkGate Malware, Handala Wiper 2025-05-02
Windows Cmdline Tool Execution From Non-Shell Process CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 JavaScript Anomaly CISA AA22-277A, CISA AA23-347A, DarkGate Malware, FIN7, Gozi Malware, Medusa Ransomware, Qakbot, Rhysida Ransomware, Volt Typhoon, Water Gamayun 2025-05-02
Windows Command and Scripting Interpreter Hunting Path Traversal CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Command and Scripting Interpreter Hunting Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190, Windows Defense Evasion Tactics 2025-05-02
Windows Command and Scripting Interpreter Path Traversal Exec CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Command and Scripting Interpreter TTP Compromised Windows Host, Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190, Windows Defense Evasion Tactics 2025-05-02
Windows Command Shell DCRat ForkBomb Payload CrowdStrike ProcessRollup2, Sysmon EventID 1 Windows Command Shell TTP Compromised Windows Host, DarkCrystal RAT 2025-05-02
Windows Common Abused Cmd Shell Risk Behavior File and Directory Permissions Modification System Network Connections Discovery System Owner/User Discovery System Shutdown/Reboot System Network Configuration Discovery Command and Scripting Interpreter Correlation Azorult, CISA AA23-347A, DarkCrystal RAT, Disabling Security Tools, FIN7, Netsh Abuse, Qakbot, Sandworm Tools, Volt Typhoon, Windows Defense Evasion Tactics, Windows Post-Exploitation 2025-05-02
Windows Compatibility Telemetry Suspicious Child Process CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Event Triggered Execution Scheduled Task TTP Windows Persistence Techniques 2025-05-02
Windows Compatibility Telemetry Tampering Through Registry Sysmon EventID 13 Event Triggered Execution Scheduled Task TTP Windows Persistence Techniques 2025-05-02
Windows Defender ASR Audit Events Windows Event Log Defender 1122, Windows Event Log Defender 1125, Windows Event Log Defender 1126, Windows Event Log Defender 1132, Windows Event Log Defender 1134 Command and Scripting Interpreter Spearphishing Attachment Spearphishing Link Anomaly Windows Attack Surface Reduction 2025-05-02
Windows Defender ASR Block Events Windows Event Log Defender 1121, Windows Event Log Defender 1126, Windows Event Log Defender 1129, Windows Event Log Defender 1131, Windows Event Log Defender 1133 Command and Scripting Interpreter Spearphishing Attachment Spearphishing Link Anomaly Windows Attack Surface Reduction 2025-05-02
Windows Defender ASR Rules Stacking Windows Event Log Defender 1121, Windows Event Log Defender 1122, Windows Event Log Defender 1125, Windows Event Log Defender 1126, Windows Event Log Defender 1129, Windows Event Log Defender 1131, Windows Event Log Defender 1133, Windows Event Log Defender 1134, Windows Event Log Defender 5007 Spearphishing Attachment Spearphishing Link Command and Scripting Interpreter Hunting Windows Attack Surface Reduction 2025-05-02
Windows Enable PowerShell Web Access Powershell Script Block Logging 4104 PowerShell TTP CISA AA24-241A, Malicious PowerShell 2025-05-02
Windows Enable Win32 ScheduledJob via Registry Sysmon EventID 13 Scheduled Task Anomaly Active Directory Lateral Movement, Scheduled Tasks 2025-05-02
Windows Executable in Loaded Modules Sysmon EventID 7 Shared Modules TTP NjRAT 2025-05-02
Windows Explorer.exe Spawning PowerShell or Cmd Sysmon EventID 1, Windows Event Log Security 4688 PowerShell Malicious File Hunting ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day 2025-05-02
Windows Explorer LNK Exploit Process Launch With Padding Sysmon EventID 1, Windows Event Log Security 4688 PowerShell Malicious File TTP ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day 2025-05-02
Windows Hidden Schedule Task Settings Windows Event Log Security 4698 Scheduled Task/Job TTP Active Directory Discovery, CISA AA22-257A, Cactus Ransomware, Compromised Windows Host, Data Destruction, Industroyer2, Scheduled Tasks 2025-05-02
Windows Identify Protocol Handlers CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Command and Scripting Interpreter Hunting Living Off The Land 2025-05-02
Windows ISO LNK File Creation Sysmon EventID 11 Malicious Link Spearphishing Attachment Hunting AgentTesla, Amadey, Azorult, Brute Ratel C4, Gozi Malware, IcedID, Qakbot, Remcos, Spearphishing Attachments, Warzone RAT 2025-05-02
Windows MSC EvilTwin Directory Path Manipulation CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 System Binary Proxy Execution Match Legitimate Resource Name or Location Exploitation for Client Execution TTP Living Off The Land, Water Gamayun, Windows Defense Evasion Tactics 2025-05-02
Windows MSExchange Management Mailbox Cmdlet Usage PowerShell Anomaly BlackByte Ransomware, ProxyNotShell, ProxyShell 2025-05-02
Windows PaperCut NG Spawn Shell CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Command and Scripting Interpreter Exploit Public-Facing Application External Remote Services TTP Compromised Windows Host, PaperCut MF NG Vulnerability 2025-05-02
Windows Powershell Cryptography Namespace Powershell Script Block Logging 4104 PowerShell Anomaly AsyncRAT 2025-05-02
Windows PowerShell Get CIMInstance Remote Computer Powershell Script Block Logging 4104 PowerShell Anomaly Active Directory Lateral Movement 2025-05-02
Windows Powershell History File Deletion Powershell Script Block Logging 4104 Windows Command Shell Clear Command History Anomaly Medusa Ransomware 2025-05-02
Windows Powershell Import Applocker Policy Powershell Script Block Logging 4104 PowerShell Disable or Modify Tools TTP Azorult 2025-05-02
Windows PowerShell Invoke-RestMethod IP Information Collection Powershell Script Block Logging 4104 System Information Discovery System Network Configuration Discovery PowerShell Anomaly Water Gamayun 2025-05-02
Windows PowerShell Invoke-Sqlcmd Execution Powershell Script Block Logging 4104 PowerShell Windows Command Shell Hunting SQL Server Abuse 2025-05-02
Windows Powershell Logoff User via Quser Powershell Script Block Logging 4104 PowerShell Account Access Removal Anomaly Crypto Stealer 2025-05-02
Windows PowerShell Process With Malicious String CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 PowerShell TTP Malicious PowerShell 2025-05-02
Windows Powershell RemoteSigned File CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 PowerShell Anomaly Amadey 2025-05-02
Windows PowerShell ScheduleTask Powershell Script Block Logging 4104 Scheduled Task PowerShell Anomaly Scheduled Tasks 2025-05-02
Windows PowerShell Script Block With Malicious String Powershell Script Block Logging 4104 PowerShell TTP Malicious PowerShell 2025-05-02
Windows PowerShell WMI Win32 ScheduledJob Powershell Script Block Logging 4104 PowerShell TTP Active Directory Lateral Movement 2025-05-02
Windows Registry Delete Task SD Sysmon EventID 13 Scheduled Task Impair Defenses Anomaly Scheduled Tasks, Windows Persistence Techniques, Windows Registry Abuse 2025-05-02
Windows Scheduled Task Created Via XML CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Scheduled Task TTP CISA AA23-347A, MoonPeak, Scheduled Tasks, Winter Vivern 2025-05-02
Windows Scheduled Task DLL Module Loaded Sysmon EventID 7 Scheduled Task/Job TTP ValleyRAT 2025-05-02
Windows Scheduled Task Service Spawned Shell CrowdStrike ProcessRollup2, Sysmon EventID 1 Scheduled Task Command and Scripting Interpreter TTP Windows Persistence Techniques 2025-05-02
Windows Scheduled Task with Highest Privileges CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Scheduled Task TTP AsyncRAT, CISA AA23-347A, Compromised Windows Host, RedLine Stealer, Scheduled Tasks 2025-05-02
Windows Scheduled Task with Suspicious Command Windows Event Log Security 4698, Windows Event Log Security 4700, Windows Event Log Security 4702 Scheduled Task TTP Ransomware, Ryuk Ransomware, Scheduled Tasks, Seashell Blizzard, Windows Persistence Techniques 2025-05-02
Windows Scheduled Task with Suspicious Name Windows Event Log Security 4698, Windows Event Log Security 4700, Windows Event Log Security 4702 Scheduled Task TTP Ransomware, Ryuk Ransomware, Scheduled Tasks, Windows Persistence Techniques 2025-05-02
Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr Windows Event Log Security 4698 Scheduled Task/Job TTP ValleyRAT, Water Gamayun 2025-05-02
Windows Schtasks Create Run As System CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Scheduled Task TTP Medusa Ransomware, Qakbot, Scheduled Tasks, Windows Persistence Techniques 2025-05-02
Windows ScManager Security Descriptor Tampering Via Sc.EXE CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Service Execution TTP Defense Evasion or Unauthorized Access Via SDDL Tampering 2025-05-02
Windows Service Create SliverC2 Windows Event Log System 7045 Service Execution TTP BishopFox Sliver Adversary Emulation Framework, Compromised Windows Host 2025-05-02
Windows Service Created with Suspicious Service Name Windows Event Log System 7045 Service Execution Anomaly Active Directory Lateral Movement, Brute Ratel C4, CISA AA23-347A, Clop Ransomware, Flax Typhoon, PlugX, Qakbot, Snake Malware 2025-05-02
Windows Service Created with Suspicious Service Path Windows Event Log System 7045 Service Execution TTP Active Directory Lateral Movement, Brute Ratel C4, CISA AA23-347A, China-Nexus Threat Activity, Clop Ransomware, Crypto Stealer, Derusbi, Flax Typhoon, PlugX, Qakbot, Salt Typhoon, Snake Malware 2025-05-02
Windows Service Execution RemCom CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Service Execution TTP Active Directory Discovery 2025-05-02
Windows Shell Process from CrushFTP CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 PowerShell Windows Command Shell Exploit Public-Facing Application Server Software Component TTP CrushFTP Vulnerabilities 2025-05-02
Windows Snake Malware Service Create Windows Event Log System 7045 Kernel Modules and Extensions Service Execution TTP Compromised Windows Host, Snake Malware 2025-05-02
Windows SQL Server Extended Procedure DLL Loading Hunt Windows Event Log Application 8128 SQL Stored Procedures Cloud API Hunting SQL Server Abuse 2025-05-02
Windows SQLCMD Execution CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Command Shell Hunting SQL Server Abuse 2025-05-02
Windows SSH Proxy Command Sysmon EventID 1, Windows Event Log Security 4688 Protocol Tunneling PowerShell Ingress Tool Transfer Anomaly Living Off The Land, ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day 2025-05-02
Windows Suspect Process With Authentication Traffic Sysmon EventID 3 Domain Account Malicious File Anomaly Active Directory Discovery 2025-05-02
Windows User Execution Malicious URL Shortcut File Sysmon EventID 11 Malicious File Anomaly Chaos Ransomware, NjRAT, Snake Keylogger 2025-05-02
Windows WinDBG Spawning AutoIt3 CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Command and Scripting Interpreter TTP Compromised Windows Host, DarkGate Malware 2025-05-02
Windows WMI Impersonate Token Sysmon EventID 10 Windows Management Instrumentation Anomaly Qakbot, Water Gamayun 2025-05-02
Windows WMI Process And Service List CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Management Instrumentation Anomaly Prestige Ransomware, Windows Post-Exploitation 2025-05-02
Windows WMI Process Call Create CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Management Instrumentation Hunting CISA AA23-347A, Cactus Ransomware, IcedID, Qakbot, Suspicious WMI Use, Volt Typhoon 2025-05-02
WinEvent Scheduled Task Created to Spawn Shell Windows Event Log Security 4698 Scheduled Task TTP CISA AA22-257A, China-Nexus Threat Activity, Compromised Windows Host, Medusa Ransomware, Ransomware, Ryuk Ransomware, Salt Typhoon, Scheduled Tasks, SystemBC, Windows Error Reporting Service Elevation of Privilege Vulnerability, Windows Persistence Techniques, Winter Vivern 2025-05-02
WinEvent Scheduled Task Created Within Public Path Windows Event Log Security 4698 Scheduled Task TTP Active Directory Lateral Movement, AsyncRAT, CISA AA22-257A, CISA AA23-347A, China-Nexus Threat Activity, Compromised Windows Host, Data Destruction, IcedID, Industroyer2, Medusa Ransomware, Prestige Ransomware, Ransomware, Ryuk Ransomware, Salt Typhoon, Scheduled Tasks, SystemBC, Windows Persistence Techniques, Winter Vivern 2025-05-02
WinEvent Windows Task Scheduler Event Action Started Windows Event Log TaskScheduler 200, Windows Event Log TaskScheduler 201 Scheduled Task Hunting Amadey, AsyncRAT, BlackSuit Ransomware, CISA AA22-257A, CISA AA24-241A, DarkCrystal RAT, Data Destruction, IcedID, Industroyer2, Prestige Ransomware, Qakbot, Sandworm Tools, Scheduled Tasks, SystemBC, ValleyRAT, Windows Persistence Techniques, Winter Vivern, Winter Vivern 2025-05-02
WMI Permanent Event Subscription Windows Management Instrumentation TTP Suspicious WMI Use 2025-05-02
WMI Temporary Event Subscription Windows Management Instrumentation TTP Suspicious WMI Use 2025-05-02
Wmiprsve LOLBAS Execution Process Spawn CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Windows Management Instrumentation TTP Active Directory Lateral Movement 2025-05-02
Cisco Secure Firewall - Binary File Type Download Cisco Secure Firewall Threat Defense File Event Exploitation for Client Execution Command and Scripting Interpreter Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Blocked Connection Cisco Secure Firewall Threat Defense Connection Event Remote System Discovery Network Service Discovery Brute Force Exploitation for Client Execution Vulnerability Scanning Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Communication Over Suspicious Ports Cisco Secure Firewall Threat Defense Connection Event Remote Services Process Injection PowerShell Ingress Tool Transfer Remote Access Tools Non-Standard Port Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - High Volume of Intrusion Events Per Host Cisco Secure Firewall Threat Defense Intrusion Event Command and Scripting Interpreter Application Layer Protocol Vulnerability Scanning Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Malware File Downloaded Cisco Secure Firewall Threat Defense File Event Exploitation for Client Execution Ingress Tool Transfer Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Possibly Compromised Host Cisco Secure Firewall Threat Defense Intrusion Event Exploitation for Client Execution Command and Scripting Interpreter Malware Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Repeated Blocked Connections Cisco Secure Firewall Threat Defense Connection Event Remote System Discovery Network Service Discovery Brute Force Exploitation for Client Execution Vulnerability Scanning Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Wget or Curl Download Cisco Secure Firewall Threat Defense Connection Event Cron Command and Scripting Interpreter Web Protocols Ingress Tool Transfer Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Detect Outbound LDAP Traffic Palo Alto Network Traffic Exploit Public-Facing Application Command and Scripting Interpreter Hunting Log4Shell CVE-2021-44228 2025-05-02
Detect Windows DNS SIGRed via Splunk Stream Exploitation for Client Execution TTP Windows DNS SIGRed CVE-2020-1350 2025-05-02
Detect Windows DNS SIGRed via Zeek Exploitation for Client Execution TTP Windows DNS SIGRed CVE-2020-1350 2025-05-02
Suspicious Process DNS Query Known Abuse Web Services Sysmon EventID 22 Visual Basic TTP Cactus Ransomware, Data Destruction, Meduza Stealer, PXA Stealer, Phemedrone Stealer, Remcos, Snake Keylogger, WhisperGate 2025-05-02
Suspicious Process With Discord DNS Query Sysmon EventID 22 Visual Basic Anomaly Cactus Ransomware, Data Destruction, PXA Stealer, WhisperGate 2025-05-02
CrushFTP Authentication Bypass Exploitation CrushFTP Exploit Public-Facing Application Windows Command Shell PowerShell TTP CrushFTP Vulnerabilities 2025-05-02
Juniper Networks Remote Code Execution Exploit Detection Suricata Exploit Public-Facing Application Ingress Tool Transfer Command and Scripting Interpreter TTP Juniper JunOS Remote Code Execution 2025-05-02
OSZAR »