Detect MSHTA Url in Command Line
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.005
|
TTP
|
Compromised Windows Host, Living Off The Land, Lumma Stealer, Suspicious MSHTA Activity, XWorm
|
2025-05-19
|
LOLBAS With Network Traffic
|
Sysmon EventID 3
|
T1105
T1567
T1218
|
TTP
|
Fake CAPTCHA Campaigns, Living Off The Land, Water Gamayun
|
2025-05-19
|
Ping Sleep Batch Command
|
CrowdStrike ProcessRollup2, Sysmon EventID 1
|
T1497.003
|
Anomaly
|
BlackByte Ransomware, Data Destruction, Meduza Stealer, Warzone RAT, WhisperGate
|
2025-05-19
|
Schtasks scheduling job on remote system
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1053.005
|
TTP
|
Active Directory Lateral Movement, Compromised Windows Host, Living Off The Land, NOBELIUM Group, Phemedrone Stealer, Prestige Ransomware, RedLine Stealer, Scheduled Tasks
|
2025-05-19
|
Windows MSIExec DLLRegisterServer
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.007
|
TTP
|
Water Gamayun, Windows System Binary Proxy Execution MSIExec
|
2025-05-19
|
Windows Process Commandline Discovery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1057
|
Hunting
|
CISA AA23-347A
|
2025-05-19
|
WinEvent Windows Task Scheduler Event Action Started
|
Windows Event Log TaskScheduler 200, Windows Event Log TaskScheduler 201
|
T1053.005
|
Hunting
|
Amadey, AsyncRAT, BlackSuit Ransomware, CISA AA22-257A, CISA AA24-241A, DarkCrystal RAT, Data Destruction, IcedID, Industroyer2, Prestige Ransomware, Qakbot, Sandworm Tools, Scheduled Tasks, SystemBC, ValleyRAT, Windows Persistence Techniques, Winter Vivern
|
2025-05-19
|
First Time Seen Child Process of Zoom
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1068
|
Anomaly
|
Suspicious Zoom Child Processes
|
2025-05-15
|
Windows PowerShell FakeCAPTCHA Clipboard Execution
|
Sysmon EventID 1
|
T1059.001
T1204.001
T1059.003
|
TTP
|
Fake CAPTCHA Campaigns
|
2025-05-14
|
Windows RunMRU Command Execution
|
Sysmon EventID 12, Sysmon EventID 13
|
T1202
|
Anomaly
|
Fake CAPTCHA Campaigns, Lumma Stealer
|
2025-05-14
|
Cisco Secure Firewall - Intrusion Events by Threat Activity
|
Cisco Secure Firewall Threat Defense Intrusion Event
|
T1041
T1573.002
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-12
|
Fsutil Zeroing File
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1070
|
TTP
|
LockBit Ransomware, Ransomware
|
2025-05-08
|
Windows Renamed Powershell Execution
|
Sysmon EventID 1
|
T1036.003
|
TTP
|
XWorm
|
2025-05-07
|
Add or Set Windows Defender Exclusion
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
TTP
|
AgentTesla, CISA AA22-320A, Compromised Windows Host, Crypto Stealer, Data Destruction, Remcos, ValleyRAT, WhisperGate, Windows Defense Evasion Tactics, XWorm
|
2025-05-06
|
Any Powershell DownloadFile
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.001
T1105
|
TTP
|
Braodo Stealer, China-Nexus Threat Activity, Crypto Stealer, DarkCrystal RAT, Data Destruction, Hermetic Wiper, Ingress Tool Transfer, Log4Shell CVE-2021-44228, Malicious PowerShell, PHP-CGI RCE Attack on Japanese Organizations, PXA Stealer, Phemedrone Stealer, Salt Typhoon, XWorm
|
2025-05-06
|
Any Powershell DownloadString
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.001
T1105
|
TTP
|
Data Destruction, HAFNIUM Group, Hermetic Wiper, IcedID, Ingress Tool Transfer, Malicious PowerShell, PHP-CGI RCE Attack on Japanese Organizations, Phemedrone Stealer, SysAid On-Prem Software CVE-2023-47246 Vulnerability, Winter Vivern, XWorm
|
2025-05-06
|
CMD Carry Out String Command Parameter
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.003
|
Hunting
|
AsyncRAT, Azorult, CISA AA23-347A, Chaos Ransomware, Crypto Stealer, DarkCrystal RAT, DarkGate Malware, Data Destruction, Hermetic Wiper, IcedID, Living Off The Land, Log4Shell CVE-2021-44228, NjRAT, PlugX, ProxyNotShell, Qakbot, RedLine Stealer, Rhysida Ransomware, Warzone RAT, WhisperGate, Winter Vivern
|
2025-05-06
|
Detect mshta inline hta execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.005
|
TTP
|
Compromised Windows Host, Gozi Malware, Living Off The Land, Suspicious MSHTA Activity, XWorm
|
2025-05-06
|
Executables Or Script Creation In Suspicious Path
|
Sysmon EventID 11
|
T1036
|
Anomaly
|
AcidPour, AgentTesla, Amadey, AsyncRAT, Azorult, BlackByte Ransomware, Brute Ratel C4, CISA AA23-347A, Cactus Ransomware, Chaos Ransomware, China-Nexus Threat Activity, Crypto Stealer, DarkCrystal RAT, DarkGate Malware, Data Destruction, Derusbi, Double Zero Destructor, Earth Alux, Graceful Wipe Out Attack, Handala Wiper, Hermetic Wiper, IcedID, Industroyer2, LockBit Ransomware, Meduza Stealer, MoonPeak, NjRAT, PlugX, Qakbot, RedLine Stealer, Remcos, Rhysida Ransomware, Salt Typhoon, Snake Keylogger, SnappyBee, Swift Slicer, SystemBC, Trickbot, ValleyRAT, Volt Typhoon, Warzone RAT, WhisperGate, WinDealer RAT, XMRig
|
2025-05-06
|
Executables Or Script Creation In Temp Path
|
Sysmon EventID 11
|
T1036
|
Anomaly
|
AcidPour, AgentTesla, Amadey, AsyncRAT, Azorult, BlackByte Ransomware, Brute Ratel C4, CISA AA23-347A, Chaos Ransomware, China-Nexus Threat Activity, Crypto Stealer, DarkCrystal RAT, DarkGate Malware, Data Destruction, Derusbi, Double Zero Destructor, Graceful Wipe Out Attack, Handala Wiper, Hermetic Wiper, IcedID, Industroyer2, LockBit Ransomware, Meduza Stealer, MoonPeak, NjRAT, PlugX, Qakbot, RedLine Stealer, Remcos, Rhysida Ransomware, Salt Typhoon, Snake Keylogger, SnappyBee, Swift Slicer, Trickbot, ValleyRAT, Volt Typhoon, Warzone RAT, WhisperGate, WinDealer RAT, XMRig
|
2025-05-06
|
Malicious PowerShell Process - Execution Policy Bypass
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.001
|
Anomaly
|
AsyncRAT, China-Nexus Threat Activity, DHS Report TA18-074A, DarkCrystal RAT, HAFNIUM Group, Salt Typhoon, Volt Typhoon, XWorm
|
2025-05-06
|
Powershell Fileless Script Contains Base64 Encoded Content
|
Powershell Script Block Logging 4104
|
T1027
T1059.001
|
TTP
|
AsyncRAT, Data Destruction, Hermetic Wiper, IcedID, Malicious PowerShell, Medusa Ransomware, NjRAT, Winter Vivern, XWorm
|
2025-05-06
|
PowerShell Loading DotNET into Memory via Reflection
|
Powershell Script Block Logging 4104
|
T1059.001
|
Anomaly
|
AgentTesla, AsyncRAT, Data Destruction, Hermetic Wiper, Malicious PowerShell, Winter Vivern
|
2025-05-06
|
Powershell Processing Stream Of Data
|
Powershell Script Block Logging 4104
|
T1059.001
|
TTP
|
AsyncRAT, Braodo Stealer, Data Destruction, Hermetic Wiper, IcedID, Malicious PowerShell, Medusa Ransomware, MoonPeak, PXA Stealer, XWorm
|
2025-05-06
|
Recon AVProduct Through Pwh or WMI
|
Powershell Script Block Logging 4104
|
T1592
|
TTP
|
Data Destruction, Hermetic Wiper, Malicious PowerShell, MoonPeak, Prestige Ransomware, Qakbot, Ransomware, Windows Post-Exploitation, XWorm
|
2025-05-06
|
Registry Keys Used For Persistence
|
Sysmon EventID 13
|
T1547.001
|
TTP
|
Amadey, AsyncRAT, Azorult, BlackByte Ransomware, BlackSuit Ransomware, Braodo Stealer, CISA AA23-347A, Cactus Ransomware, Chaos Ransomware, China-Nexus Threat Activity, DHS Report TA18-074A, DarkGate Malware, Derusbi, Emotet Malware DHS Report TA18-201A, IcedID, MoonPeak, NjRAT, Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns, Qakbot, Ransomware, RedLine Stealer, Remcos, Salt Typhoon, Snake Keylogger, SnappyBee, Sneaky Active Directory Persistence Tricks, Suspicious MSHTA Activity, Suspicious Windows Registry Activities, SystemBC, Warzone RAT, WinDealer RAT, Windows Persistence Techniques, Windows Registry Abuse, XWorm
|
2025-05-06
|
Scheduled Task Deleted Or Created via CMD
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1053.005
|
TTP
|
AgentTesla, Amadey, AsyncRAT, Azorult, CISA AA22-257A, CISA AA23-347A, CISA AA24-241A, China-Nexus Threat Activity, DHS Report TA18-074A, DarkCrystal RAT, Living Off The Land, Medusa Ransomware, MoonPeak, NOBELIUM Group, NjRAT, Phemedrone Stealer, Prestige Ransomware, Qakbot, RedLine Stealer, Rhysida Ransomware, Salt Typhoon, Sandworm Tools, Scheduled Tasks, ShrinkLocker, Trickbot, Windows Persistence Techniques, Winter Vivern, XWorm
|
2025-05-06
|
Suspicious mshta child process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.005
|
TTP
|
Living Off The Land, Lumma Stealer, Suspicious MSHTA Activity
|
2025-05-06
|
Suspicious Scheduled Task from Public Directory
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1053.005
|
Anomaly
|
Azorult, CISA AA23-347A, CISA AA24-241A, China-Nexus Threat Activity, Crypto Stealer, DarkCrystal RAT, Living Off The Land, Medusa Ransomware, MoonPeak, Ransomware, Ryuk Ransomware, Salt Typhoon, Scheduled Tasks, Windows Persistence Techniques, XWorm
|
2025-05-06
|
Windows Boot or Logon Autostart Execution In Startup Folder
|
Sysmon EventID 11
|
T1547.001
|
Anomaly
|
Chaos Ransomware, Crypto Stealer, Gozi Malware, NjRAT, RedLine Stealer, XWorm
|
2025-05-06
|
Windows Cmdline Tool Execution From Non-Shell Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.007
|
Anomaly
|
CISA AA22-277A, CISA AA23-347A, DarkGate Malware, FIN7, Gozi Malware, Medusa Ransomware, Qakbot, Rhysida Ransomware, Volt Typhoon, Water Gamayun
|
2025-05-06
|
Windows Defender Exclusion Registry Entry
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Azorult, Qakbot, Remcos, ValleyRAT, Warzone RAT, Windows Defense Evasion Tactics, XWorm
|
2025-05-06
|
Windows Hijack Execution Flow Version Dll Side Load
|
Sysmon EventID 7
|
T1574.001
|
Anomaly
|
Brute Ratel C4, XWorm
|
2025-05-06
|
Windows MSHTA Writing to World Writable Path
|
Sysmon EventID 11
|
T1218.005
|
TTP
|
APT29 Diplomatic Deceptions with WINELOADER, Suspicious MSHTA Activity, XWorm
|
2025-05-06
|
Windows Powershell Cryptography Namespace
|
Powershell Script Block Logging 4104
|
T1059.001
|
Anomaly
|
AsyncRAT, XWorm
|
2025-05-06
|
Windows Process Execution From ProgramData
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.005
|
Anomaly
|
China-Nexus Threat Activity, Salt Typhoon, SnappyBee, XWorm
|
2025-05-06
|
Windows Process Execution in Temp Dir
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1543
T1036.005
|
Anomaly
|
AgentTesla, NjRAT, Qakbot, Ransomware, Remcos, Ryuk Ransomware, Trickbot, XWorm
|
2025-05-06
|
Windows Replication Through Removable Media
|
Sysmon EventID 11
|
T1091
|
TTP
|
Chaos Ransomware, China-Nexus Threat Activity, Derusbi, NjRAT, PlugX, Salt Typhoon
|
2025-05-06
|
Windows Scheduled Task with Highest Privileges
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1053.005
|
TTP
|
AsyncRAT, CISA AA23-347A, Compromised Windows Host, RedLine Stealer, Scheduled Tasks, XWorm
|
2025-05-06
|
Windows Suspicious Process File Path
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1543
T1036.005
|
TTP
|
AgentTesla, Amadey, AsyncRAT, Azorult, BlackByte Ransomware, Brute Ratel C4, CISA AA23-347A, Chaos Ransomware, China-Nexus Threat Activity, DarkCrystal RAT, DarkGate Malware, Data Destruction, Double Zero Destructor, Earth Alux, Graceful Wipe Out Attack, Handala Wiper, Hermetic Wiper, IcedID, Industroyer2, LockBit Ransomware, Meduza Stealer, MoonPeak, Phemedrone Stealer, PlugX, Prestige Ransomware, Qakbot, RedLine Stealer, Remcos, Rhysida Ransomware, Salt Typhoon, SnappyBee, Swift Slicer, SystemBC, Trickbot, ValleyRAT, Volt Typhoon, Warzone RAT, Water Gamayun, WhisperGate, XMRig, XWorm
|
2025-05-06
|
Windows System LogOff Commandline
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1529
|
Anomaly
|
DarkCrystal RAT, NjRAT, XWorm
|
2025-05-06
|
Windows System Reboot CommandLine
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1529
|
Anomaly
|
DarkCrystal RAT, DarkGate Malware, MoonPeak, NjRAT, XWorm
|
2025-05-06
|
Windows System Shutdown CommandLine
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1529
|
Anomaly
|
DarkCrystal RAT, DarkGate Malware, MoonPeak, NjRAT, Sandworm Tools, XWorm
|
2025-05-06
|
Windows Unsigned DLL Side-Loading In Same Process Path
|
Sysmon EventID 7
|
T1574.001
|
TTP
|
China-Nexus Threat Activity, DarkGate Malware, Derusbi, PlugX, Salt Typhoon, SnappyBee, XWorm
|
2025-05-06
|
Windows Unsigned MS DLL Side-Loading
|
Sysmon EventID 7
|
T1574.001
T1547
|
Anomaly
|
APT29 Diplomatic Deceptions with WINELOADER, China-Nexus Threat Activity, Derusbi, Earth Alux, Salt Typhoon, XWorm
|
2025-05-06
|
Windows User Execution Malicious URL Shortcut File
|
Sysmon EventID 11
|
T1204.002
|
Anomaly
|
Chaos Ransomware, NjRAT, Snake Keylogger, XWorm
|
2025-05-06
|
WinEvent Scheduled Task Created Within Public Path
|
Windows Event Log Security 4698
|
T1053.005
|
TTP
|
Active Directory Lateral Movement, AsyncRAT, CISA AA22-257A, CISA AA23-347A, China-Nexus Threat Activity, Compromised Windows Host, Data Destruction, IcedID, Industroyer2, Medusa Ransomware, Prestige Ransomware, Ransomware, Ryuk Ransomware, Salt Typhoon, Scheduled Tasks, SystemBC, Windows Persistence Techniques, Winter Vivern, XWorm
|
2025-05-06
|
Wscript Or Cscript Suspicious Child Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055
T1134.004
T1543
|
TTP
|
Data Destruction, FIN7, NjRAT, Remcos, ShrinkLocker, Unusual Processes, WhisperGate, XWorm
|
2025-05-06
|
MacOS - Re-opened Applications
|
Sysmon EventID 1
|
|
TTP
|
ColdRoot MacOS RAT
|
2025-05-05
|
MacOS LOLbin
|
osquery
|
T1059.004
|
TTP
|
Living Off The Land
|
2025-05-05
|
Windows AD Replication Request Initiated from Unsanctioned Location
|
Windows Event Log Security 4624, Windows Event Log Security 4662
|
T1003.006
|
TTP
|
Compromised Windows Host, Credential Dumping, Sneaky Active Directory Persistence Tricks
|
2025-05-05
|
Cisco AI Defense Security Alerts by Application Name
|
Cisco AI Defense Alerts
|
|
Anomaly
|
Critical Alerts
|
2025-05-02
|
Cisco Secure Application Alerts
|
Cisco Secure Application AppDynamics Alerts
|
|
Anomaly
|
Critical Alerts
|
2025-05-02
|
CrushFTP Server Side Template Injection
|
CrushFTP
|
T1190
|
TTP
|
CrushFTP Vulnerabilities
|
2025-05-02
|
Detect Distributed Password Spray Attempts
|
Azure Active Directory Sign-in activity
|
T1110.003
|
Hunting
|
Active Directory Password Spraying, Compromised User Account
|
2025-05-02
|
Detect HTML Help Spawn Child Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.001
|
TTP
|
AgentTesla, Compromised Windows Host, Living Off The Land, Suspicious Compiled HTML Activity
|
2025-05-02
|
Detect New Login Attempts to Routers
|
|
|
TTP
|
Router and Infrastructure Security
|
2025-05-02
|
Detect Password Spray Attempts
|
Windows Event Log Security 4625
|
T1110.003
|
TTP
|
Active Directory Password Spraying, Compromised User Account
|
2025-05-02
|
Detect Risky SPL using Pretrained ML Model
|
|
T1059
|
Anomaly
|
Splunk Vulnerabilities
|
2025-05-02
|
Email Attachments With Lots Of Spaces
|
|
|
Anomaly
|
Data Destruction, Emotet Malware DHS Report TA18-201A, Hermetic Wiper, Suspicious Emails
|
2025-05-02
|
Email files written outside of the Outlook directory
|
Sysmon EventID 11
|
T1114.001
|
TTP
|
Collection and Staging
|
2025-05-02
|
Email servers sending high volume traffic to hosts
|
|
T1114.002
|
Anomaly
|
Collection and Staging, HAFNIUM Group
|
2025-05-02
|
Ivanti VTM New Account Creation
|
Ivanti VTM Audit
|
T1190
|
TTP
|
Ivanti Virtual Traffic Manager CVE-2024-7593
|
2025-05-02
|
Monitor Email For Brand Abuse
|
|
|
TTP
|
Brand Monitoring, Suspicious Emails
|
2025-05-02
|
No Windows Updates in a time frame
|
|
|
Hunting
|
Monitor for Updates
|
2025-05-02
|
Okta Authentication Failed During MFA Challenge
|
Okta
|
T1078.004
T1586.003
T1621
|
TTP
|
Okta Account Takeover
|
2025-05-02
|
Okta IDP Lifecycle Modifications
|
Okta
|
T1087.004
|
Anomaly
|
Suspicious Okta Activity
|
2025-05-02
|
Okta MFA Exhaustion Hunt
|
Okta
|
T1110
|
Hunting
|
Okta Account Takeover, Okta MFA Exhaustion
|
2025-05-02
|
Okta Mismatch Between Source and Response for Verify Push Request
|
Okta
|
T1621
|
TTP
|
Okta Account Takeover, Okta MFA Exhaustion
|
2025-05-02
|
Okta Multi-Factor Authentication Disabled
|
Okta
|
T1556.006
|
TTP
|
Okta Account Takeover
|
2025-05-02
|
Okta Multiple Accounts Locked Out
|
Okta
|
T1110
|
Anomaly
|
Okta Account Takeover
|
2025-05-02
|
Okta Multiple Failed MFA Requests For User
|
Okta
|
T1621
|
Anomaly
|
Okta Account Takeover
|
2025-05-02
|
Okta Multiple Failed Requests to Access Applications
|
Okta
|
T1550.004
T1538
|
Hunting
|
Okta Account Takeover
|
2025-05-02
|
Okta Multiple Users Failing To Authenticate From Ip
|
Okta
|
T1110.003
|
Anomaly
|
Okta Account Takeover
|
2025-05-02
|
Okta New API Token Created
|
Okta
|
T1078.001
|
TTP
|
Okta Account Takeover
|
2025-05-02
|
Okta New Device Enrolled on Account
|
Okta
|
T1098.005
|
TTP
|
Okta Account Takeover
|
2025-05-02
|
Okta Phishing Detection with FastPass Origin Check
|
Okta
|
T1078.001
T1556
|
TTP
|
Okta Account Takeover
|
2025-05-02
|
Okta Risk Threshold Exceeded
|
Okta
|
T1078
T1110
|
Correlation
|
Okta Account Takeover, Okta MFA Exhaustion, Suspicious Okta Activity
|
2025-05-02
|
Okta Successful Single Factor Authentication
|
Okta
|
T1078.004
T1586.003
T1621
|
Anomaly
|
Okta Account Takeover
|
2025-05-02
|
Okta Suspicious Activity Reported
|
Okta
|
T1078.001
|
TTP
|
Okta Account Takeover
|
2025-05-02
|
Okta Suspicious Use of a Session Cookie
|
Okta
|
T1539
|
Anomaly
|
Okta Account Takeover, Suspicious Okta Activity
|
2025-05-02
|
Okta ThreatInsight Threat Detected
|
Okta
|
T1078.004
|
Anomaly
|
Okta Account Takeover
|
2025-05-02
|
Okta Unauthorized Access to Application
|
Okta
|
T1087.004
|
Anomaly
|
Okta Account Takeover
|
2025-05-02
|
Okta User Logins from Multiple Cities
|
Okta
|
T1586.003
|
Anomaly
|
Okta Account Takeover
|
2025-05-02
|
PingID Mismatch Auth Source and Verification Response
|
PingID
|
T1621
T1556.006
T1098.005
|
TTP
|
Compromised User Account
|
2025-05-02
|
PingID Multiple Failed MFA Requests For User
|
PingID
|
T1621
T1078
T1110
|
TTP
|
Compromised User Account
|
2025-05-02
|
PingID New MFA Method After Credential Reset
|
PingID
|
T1621
T1556.006
T1098.005
|
TTP
|
Compromised User Account
|
2025-05-02
|
PingID New MFA Method Registered For User
|
PingID
|
T1621
T1556.006
T1098.005
|
TTP
|
Compromised User Account
|
2025-05-02
|
Splunk App for Lookup File Editing RCE via User XSLT
|
|
T1210
|
Hunting
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk Authentication Token Exposure in Debug Log
|
|
T1654
|
TTP
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk Code Injection via custom dashboard leading to RCE
|
|
T1210
|
Hunting
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk Command and Scripting Interpreter Delete Usage
|
Splunk
|
T1059
|
Anomaly
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk Command and Scripting Interpreter Risky Commands
|
Splunk
|
T1059
|
Hunting
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk Command and Scripting Interpreter Risky SPL MLTK
|
Splunk
|
T1059
|
Anomaly
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk Enterprise KV Store Incorrect Authorization
|
Splunk
|
T1548
|
Hunting
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk Improperly Formatted Parameter Crashes splunkd
|
Splunk
|
T1499
|
TTP
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk Information Disclosure on Account Login
|
Splunk
|
T1087
|
Hunting
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk Path Traversal In Splunk App For Lookup File Edit
|
Splunk
|
T1083
|
Hunting
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk RCE PDFgen Render
|
Splunk
|
T1210
|
TTP
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk RCE Through Arbitrary File Write to Windows System Root
|
Splunk
|
T1210
|
Hunting
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk RCE via User XSLT
|
|
T1210
|
Hunting
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk Sensitive Information Disclosure in DEBUG Logging Channels
|
Splunk
|
T1552
|
Hunting
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk User Enumeration Attempt
|
Splunk
|
T1078
|
TTP
|
Splunk Vulnerabilities
|
2025-05-02
|
Splunk XSS Privilege Escalation via Custom Urls in Dashboard
|
Splunk
|
T1189
|
Hunting
|
Splunk Vulnerabilities
|
2025-05-02
|
Suspicious Email Attachment Extensions
|
|
T1566.001
|
Anomaly
|
Data Destruction, Emotet Malware DHS Report TA18-201A, Hermetic Wiper, Suspicious Emails
|
2025-05-02
|
Suspicious Java Classes
|
|
|
Anomaly
|
Apache Struts Vulnerability
|
2025-05-02
|
Abnormally High Number Of Cloud Infrastructure API Calls
|
AWS CloudTrail
|
T1078.004
|
Anomaly
|
Compromised User Account, Suspicious Cloud User Activities
|
2025-05-02
|
Abnormally High Number Of Cloud Instances Destroyed
|
AWS CloudTrail
|
T1078.004
|
Anomaly
|
Suspicious Cloud Instance Activities
|
2025-05-02
|
Abnormally High Number Of Cloud Instances Launched
|
AWS CloudTrail
|
T1078.004
|
Anomaly
|
Cloud Cryptomining, Suspicious Cloud Instance Activities
|
2025-05-02
|
Abnormally High Number Of Cloud Security Group API Calls
|
AWS CloudTrail
|
T1078.004
|
Anomaly
|
Suspicious Cloud User Activities
|
2025-05-02
|
Amazon EKS Kubernetes cluster scan detection
|
|
T1526
|
Hunting
|
Kubernetes Scanning Activity
|
2025-05-02
|
Amazon EKS Kubernetes Pod scan detection
|
|
T1526
|
Hunting
|
Kubernetes Scanning Activity
|
2025-05-02
|
ASL AWS Concurrent Sessions From Different Ips
|
ASL AWS CloudTrail
|
T1185
|
Anomaly
|
AWS Identity and Access Management Account Takeover, Compromised User Account
|
2025-05-02
|
ASL AWS Create Access Key
|
ASL AWS CloudTrail
|
T1136.003
|
Hunting
|
AWS IAM Privilege Escalation
|
2025-05-02
|
ASL AWS Create Policy Version to allow all resources
|
ASL AWS CloudTrail
|
T1078.004
|
TTP
|
AWS IAM Privilege Escalation
|
2025-05-02
|
ASL AWS Credential Access GetPasswordData
|
ASL AWS CloudTrail
|
T1110.001
T1586.003
|
Anomaly
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
ASL AWS Credential Access RDS Password reset
|
ASL AWS CloudTrail
|
T1110
T1586.003
|
TTP
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
ASL AWS Defense Evasion Delete Cloudtrail
|
ASL AWS CloudTrail
|
T1562.008
|
TTP
|
AWS Defense Evasion
|
2025-05-02
|
ASL AWS Defense Evasion Delete CloudWatch Log Group
|
ASL AWS CloudTrail
|
T1562.008
|
TTP
|
AWS Defense Evasion
|
2025-05-02
|
ASL AWS Defense Evasion Impair Security Services
|
ASL AWS CloudTrail
|
T1562.008
|
Hunting
|
AWS Defense Evasion
|
2025-05-02
|
ASL AWS Defense Evasion PutBucketLifecycle
|
ASL AWS CloudTrail
|
T1485.001
T1562.008
|
Hunting
|
AWS Defense Evasion
|
2025-05-02
|
ASL AWS Defense Evasion Stop Logging Cloudtrail
|
ASL AWS CloudTrail
|
T1562.008
|
TTP
|
AWS Defense Evasion
|
2025-05-02
|
ASL AWS Defense Evasion Update Cloudtrail
|
ASL AWS CloudTrail
|
T1562.008
|
TTP
|
AWS Defense Evasion
|
2025-05-02
|
ASL AWS Detect Users creating keys with encrypt policy without MFA
|
ASL AWS CloudTrail
|
T1486
|
TTP
|
Ransomware Cloud
|
2025-05-02
|
ASL AWS Disable Bucket Versioning
|
ASL AWS CloudTrail
|
T1490
|
Anomaly
|
Data Exfiltration, Suspicious AWS S3 Activities
|
2025-05-02
|
ASL AWS EC2 Snapshot Shared Externally
|
ASL AWS CloudTrail
|
T1537
|
TTP
|
Data Exfiltration, Suspicious Cloud Instance Activities
|
2025-05-02
|
ASL AWS ECR Container Upload Outside Business Hours
|
ASL AWS CloudTrail
|
T1204.003
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
ASL AWS ECR Container Upload Unknown User
|
ASL AWS CloudTrail
|
T1204.003
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
ASL AWS IAM AccessDenied Discovery Events
|
ASL AWS CloudTrail
|
T1580
|
Anomaly
|
Suspicious Cloud User Activities
|
2025-05-02
|
ASL AWS IAM Assume Role Policy Brute Force
|
ASL AWS CloudTrail
|
T1580
T1110
|
TTP
|
AWS IAM Privilege Escalation
|
2025-05-02
|
ASL AWS IAM Delete Policy
|
ASL AWS CloudTrail
|
T1098
|
Hunting
|
AWS IAM Privilege Escalation
|
2025-05-02
|
ASL AWS IAM Failure Group Deletion
|
ASL AWS CloudTrail
|
T1098
|
Anomaly
|
AWS IAM Privilege Escalation
|
2025-05-02
|
ASL AWS IAM Successful Group Deletion
|
ASL AWS CloudTrail
|
T1069.003
T1098
|
Hunting
|
AWS IAM Privilege Escalation
|
2025-05-02
|
ASL AWS Multi-Factor Authentication Disabled
|
ASL AWS CloudTrail
|
T1556.006
T1586.003
T1621
|
TTP
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
ASL AWS Network Access Control List Created with All Open Ports
|
ASL AWS CloudTrail
|
T1562.007
|
TTP
|
AWS Network ACL Activity
|
2025-05-02
|
ASL AWS Network Access Control List Deleted
|
ASL AWS CloudTrail
|
T1562.007
|
Anomaly
|
AWS Network ACL Activity
|
2025-05-02
|
ASL AWS New MFA Method Registered For User
|
ASL AWS CloudTrail
|
T1556.006
|
TTP
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
ASL AWS SAML Update identity provider
|
ASL AWS CloudTrail
|
T1078
|
TTP
|
Cloud Federated Credential Abuse
|
2025-05-02
|
ASL AWS UpdateLoginProfile
|
ASL AWS CloudTrail
|
T1136.003
|
TTP
|
AWS IAM Privilege Escalation
|
2025-05-02
|
AWS AMI Attribute Modification for Exfiltration
|
AWS CloudTrail ModifyImageAttribute
|
T1537
|
TTP
|
Data Exfiltration, Suspicious Cloud Instance Activities
|
2025-05-02
|
AWS Bedrock Delete GuardRails
|
AWS CloudTrail DeleteGuardrail
|
T1562.008
|
TTP
|
AWS Bedrock Security
|
2025-05-02
|
AWS Bedrock Delete Knowledge Base
|
AWS CloudTrail DeleteKnowledgeBase
|
T1485
|
TTP
|
AWS Bedrock Security
|
2025-05-02
|
AWS Bedrock Delete Model Invocation Logging Configuration
|
AWS CloudTrail DeleteModelInvocationLoggingConfiguration
|
T1562.008
|
TTP
|
AWS Bedrock Security
|
2025-05-02
|
AWS Bedrock High Number List Foundation Model Failures
|
AWS CloudTrail
|
T1580
|
TTP
|
AWS Bedrock Security
|
2025-05-02
|
AWS Bedrock Invoke Model Access Denied
|
AWS CloudTrail
|
T1078
T1550
|
TTP
|
AWS Bedrock Security
|
2025-05-02
|
AWS Concurrent Sessions From Different Ips
|
AWS CloudTrail DescribeEventAggregates
|
T1185
|
TTP
|
AWS Identity and Access Management Account Takeover, Compromised User Account
|
2025-05-02
|
AWS Console Login Failed During MFA Challenge
|
AWS CloudTrail ConsoleLogin
|
T1586.003
T1621
|
TTP
|
AWS Identity and Access Management Account Takeover, Compromised User Account
|
2025-05-02
|
AWS Create Policy Version to allow all resources
|
AWS CloudTrail CreatePolicyVersion
|
T1078.004
|
TTP
|
AWS IAM Privilege Escalation
|
2025-05-02
|
AWS CreateAccessKey
|
AWS CloudTrail CreateAccessKey
|
T1136.003
|
Hunting
|
AWS IAM Privilege Escalation
|
2025-05-02
|
AWS CreateLoginProfile
|
AWS CloudTrail ConsoleLogin, AWS CloudTrail CreateLoginProfile
|
T1136.003
|
TTP
|
AWS IAM Privilege Escalation
|
2025-05-02
|
AWS Credential Access Failed Login
|
AWS CloudTrail ConsoleLogin
|
T1110.001
T1586.003
|
TTP
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
AWS Credential Access GetPasswordData
|
AWS CloudTrail GetPasswordData
|
T1110.001
T1586.003
|
Anomaly
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
AWS Credential Access RDS Password reset
|
AWS CloudTrail ModifyDBInstance
|
T1110
T1586.003
|
TTP
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
AWS Defense Evasion Delete Cloudtrail
|
AWS CloudTrail DeleteTrail
|
T1562.008
|
TTP
|
AWS Defense Evasion
|
2025-05-02
|
AWS Defense Evasion Delete CloudWatch Log Group
|
AWS CloudTrail DeleteLogGroup
|
T1562.008
|
TTP
|
AWS Defense Evasion
|
2025-05-02
|
AWS Defense Evasion Impair Security Services
|
AWS CloudTrail DeleteAlarms, AWS CloudTrail DeleteDetector, AWS CloudTrail DeleteIPSet, AWS CloudTrail DeleteLogStream, AWS CloudTrail DeleteLoggingConfiguration, AWS CloudTrail DeleteRule, AWS CloudTrail DeleteRuleGroup, AWS CloudTrail DeleteWebACL
|
T1562.008
|
Hunting
|
AWS Defense Evasion
|
2025-05-02
|
AWS Defense Evasion PutBucketLifecycle
|
AWS CloudTrail PutBucketLifecycle
|
T1485.001
T1562.008
|
Hunting
|
AWS Defense Evasion
|
2025-05-02
|
AWS Defense Evasion Stop Logging Cloudtrail
|
AWS CloudTrail StopLogging
|
T1562.008
|
TTP
|
AWS Defense Evasion
|
2025-05-02
|
AWS Defense Evasion Update Cloudtrail
|
AWS CloudTrail UpdateTrail
|
T1562.008
|
TTP
|
AWS Defense Evasion
|
2025-05-02
|
AWS Detect Users creating keys with encrypt policy without MFA
|
AWS CloudTrail CreateKey, AWS CloudTrail PutKeyPolicy
|
T1486
|
TTP
|
Ransomware Cloud
|
2025-05-02
|
AWS Detect Users with KMS keys performing encryption S3
|
AWS CloudTrail
|
T1486
|
Anomaly
|
Ransomware Cloud
|
2025-05-02
|
AWS Disable Bucket Versioning
|
AWS CloudTrail PutBucketVersioning
|
T1490
|
Anomaly
|
Data Exfiltration, Suspicious AWS S3 Activities
|
2025-05-02
|
AWS EC2 Snapshot Shared Externally
|
AWS CloudTrail ModifySnapshotAttribute
|
T1537
|
TTP
|
Data Exfiltration, Suspicious Cloud Instance Activities
|
2025-05-02
|
AWS ECR Container Scanning Findings High
|
AWS CloudTrail DescribeImageScanFindings
|
T1204.003
|
TTP
|
Dev Sec Ops
|
2025-05-02
|
AWS ECR Container Scanning Findings Low Informational Unknown
|
AWS CloudTrail DescribeImageScanFindings
|
T1204.003
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
AWS ECR Container Scanning Findings Medium
|
AWS CloudTrail DescribeImageScanFindings
|
T1204.003
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
AWS ECR Container Upload Outside Business Hours
|
AWS CloudTrail PutImage
|
T1204.003
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
AWS ECR Container Upload Unknown User
|
AWS CloudTrail PutImage
|
T1204.003
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
AWS Excessive Security Scanning
|
AWS CloudTrail
|
T1526
|
TTP
|
AWS User Monitoring
|
2025-05-02
|
AWS Exfiltration via Anomalous GetObject API Activity
|
AWS CloudTrail GetObject
|
T1119
|
Anomaly
|
Data Exfiltration
|
2025-05-02
|
AWS Exfiltration via Batch Service
|
AWS CloudTrail JobCreated
|
T1119
|
TTP
|
Data Exfiltration
|
2025-05-02
|
AWS Exfiltration via Bucket Replication
|
AWS CloudTrail PutBucketReplication
|
T1537
|
TTP
|
Data Exfiltration, Suspicious AWS S3 Activities
|
2025-05-02
|
AWS Exfiltration via DataSync Task
|
AWS CloudTrail CreateTask
|
T1119
|
TTP
|
Data Exfiltration, Suspicious AWS S3 Activities
|
2025-05-02
|
AWS Exfiltration via EC2 Snapshot
|
AWS CloudTrail CreateSnapshot, AWS CloudTrail DeleteSnapshot, AWS CloudTrail DescribeSnapshotAttribute, AWS CloudTrail ModifySnapshotAttribute
|
T1537
|
TTP
|
Data Exfiltration, Suspicious Cloud Instance Activities
|
2025-05-02
|
AWS High Number Of Failed Authentications For User
|
AWS CloudTrail ConsoleLogin
|
T1201
|
Anomaly
|
AWS Identity and Access Management Account Takeover, Compromised User Account
|
2025-05-02
|
AWS High Number Of Failed Authentications From Ip
|
AWS CloudTrail ConsoleLogin
|
T1110.003
T1110.004
|
Anomaly
|
AWS Identity and Access Management Account Takeover, Compromised User Account
|
2025-05-02
|
AWS IAM AccessDenied Discovery Events
|
AWS CloudTrail
|
T1580
|
Anomaly
|
Suspicious Cloud User Activities
|
2025-05-02
|
AWS IAM Assume Role Policy Brute Force
|
AWS CloudTrail
|
T1580
T1110
|
TTP
|
AWS IAM Privilege Escalation
|
2025-05-02
|
AWS IAM Delete Policy
|
AWS CloudTrail DeletePolicy
|
T1098
|
Hunting
|
AWS IAM Privilege Escalation
|
2025-05-02
|
AWS IAM Failure Group Deletion
|
AWS CloudTrail DeleteGroup
|
T1098
|
Anomaly
|
AWS IAM Privilege Escalation
|
2025-05-02
|
AWS IAM Successful Group Deletion
|
AWS CloudTrail DeleteGroup
|
T1069.003
T1098
|
Hunting
|
AWS IAM Privilege Escalation
|
2025-05-02
|
AWS Lambda UpdateFunctionCode
|
AWS CloudTrail
|
T1204
|
Hunting
|
Suspicious Cloud User Activities
|
2025-05-02
|
AWS Multi-Factor Authentication Disabled
|
AWS CloudTrail DeactivateMFADevice, AWS CloudTrail DeleteVirtualMFADevice
|
T1556.006
T1586.003
T1621
|
TTP
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
AWS Multiple Failed MFA Requests For User
|
AWS CloudTrail ConsoleLogin
|
T1586.003
T1621
|
Anomaly
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
AWS Multiple Users Failing To Authenticate From Ip
|
AWS CloudTrail ConsoleLogin
|
T1110.003
T1110.004
|
Anomaly
|
AWS Identity and Access Management Account Takeover, Compromised User Account
|
2025-05-02
|
AWS Network Access Control List Created with All Open Ports
|
AWS CloudTrail CreateNetworkAclEntry, AWS CloudTrail ReplaceNetworkAclEntry
|
T1562.007
|
TTP
|
AWS Network ACL Activity
|
2025-05-02
|
AWS Network Access Control List Deleted
|
AWS CloudTrail DeleteNetworkAclEntry
|
T1562.007
|
Anomaly
|
AWS Network ACL Activity
|
2025-05-02
|
AWS New MFA Method Registered For User
|
AWS CloudTrail CreateVirtualMFADevice
|
T1556.006
|
TTP
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
AWS Password Policy Changes
|
AWS CloudTrail DeleteAccountPasswordPolicy, AWS CloudTrail GetAccountPasswordPolicy, AWS CloudTrail UpdateAccountPasswordPolicy
|
T1201
|
Hunting
|
AWS IAM Privilege Escalation, Compromised User Account
|
2025-05-02
|
AWS S3 Exfiltration Behavior Identified
|
|
T1537
|
Correlation
|
Data Exfiltration, Suspicious Cloud Instance Activities
|
2025-05-02
|
AWS SAML Update identity provider
|
AWS CloudTrail UpdateSAMLProvider
|
T1078
|
TTP
|
Cloud Federated Credential Abuse
|
2025-05-02
|
AWS SetDefaultPolicyVersion
|
AWS CloudTrail SetDefaultPolicyVersion
|
T1078.004
|
TTP
|
AWS IAM Privilege Escalation
|
2025-05-02
|
AWS Successful Console Authentication From Multiple IPs
|
AWS CloudTrail ConsoleLogin
|
T1586
T1535
|
Anomaly
|
Compromised User Account, Suspicious AWS Login Activities
|
2025-05-02
|
AWS Successful Single-Factor Authentication
|
AWS CloudTrail ConsoleLogin
|
T1078.004
T1586.003
|
TTP
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
AWS Unusual Number of Failed Authentications From Ip
|
AWS CloudTrail ConsoleLogin
|
T1110.003
T1110.004
T1586.003
|
Anomaly
|
AWS Identity and Access Management Account Takeover
|
2025-05-02
|
AWS UpdateLoginProfile
|
AWS CloudTrail UpdateLoginProfile
|
T1136.003
|
TTP
|
AWS IAM Privilege Escalation
|
2025-05-02
|
Azure Active Directory High Risk Sign-in
|
Azure Active Directory
|
T1110.003
T1586.003
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD Admin Consent Bypassed by Service Principal
|
Azure Active Directory Add app role assignment to service principal
|
T1098.003
|
TTP
|
Azure Active Directory Privilege Escalation, NOBELIUM Group
|
2025-05-02
|
Azure AD Application Administrator Role Assigned
|
Azure Active Directory Add member to role
|
T1098.003
|
TTP
|
Azure Active Directory Privilege Escalation
|
2025-05-02
|
Azure AD Authentication Failed During MFA Challenge
|
Azure Active Directory
|
T1078.004
T1586.003
T1621
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD AzureHound UserAgent Detected
|
Azure Active Directory MicrosoftGraphActivityLogs, Azure Active Directory NonInteractiveUserSignInLogs
|
T1087.004
T1526
|
TTP
|
Azure Active Directory Privilege Escalation, Compromised User Account
|
2025-05-02
|
Azure AD Block User Consent For Risky Apps Disabled
|
Azure Active Directory Update authorization policy
|
T1562
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD Concurrent Sessions From Different Ips
|
Azure Active Directory
|
T1185
|
TTP
|
Azure Active Directory Account Takeover, Compromised User Account
|
2025-05-02
|
Azure AD Device Code Authentication
|
Azure Active Directory
|
T1528
T1566.002
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD External Guest User Invited
|
Azure Active Directory Invite external user
|
T1136.003
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Azure AD FullAccessAsApp Permission Assigned
|
Azure Active Directory Update application
|
T1098.002
T1098.003
|
TTP
|
Azure Active Directory Persistence, NOBELIUM Group
|
2025-05-02
|
Azure AD Global Administrator Role Assigned
|
Azure Active Directory Add member to role
|
T1098.003
|
TTP
|
Azure Active Directory Persistence, Azure Active Directory Privilege Escalation
|
2025-05-02
|
Azure AD High Number Of Failed Authentications For User
|
Azure Active Directory
|
T1110.001
|
TTP
|
Azure Active Directory Account Takeover, Compromised User Account
|
2025-05-02
|
Azure AD High Number Of Failed Authentications From Ip
|
Azure Active Directory
|
T1110.001
T1110.003
|
TTP
|
Azure Active Directory Account Takeover, Compromised User Account, NOBELIUM Group
|
2025-05-02
|
Azure AD Multi-Factor Authentication Disabled
|
Azure Active Directory Disable Strong Authentication
|
T1556.006
T1586.003
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD Multi-Source Failed Authentications Spike
|
Azure Active Directory
|
T1110.003
T1110.004
T1586.003
|
Hunting
|
Azure Active Directory Account Takeover, NOBELIUM Group
|
2025-05-02
|
Azure AD Multiple AppIDs and UserAgents Authentication Spike
|
Azure Active Directory Sign-in activity
|
T1078
|
Anomaly
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD Multiple Denied MFA Requests For User
|
Azure Active Directory Sign-in activity
|
T1621
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD Multiple Failed MFA Requests For User
|
Azure Active Directory Sign-in activity
|
T1078.004
T1586.003
T1621
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD Multiple Service Principals Created by SP
|
Azure Active Directory Add service principal
|
T1136.003
|
Anomaly
|
Azure Active Directory Persistence, NOBELIUM Group
|
2025-05-02
|
Azure AD Multiple Service Principals Created by User
|
Azure Active Directory Add service principal
|
T1136.003
|
Anomaly
|
Azure Active Directory Persistence, NOBELIUM Group
|
2025-05-02
|
Azure AD Multiple Users Failing To Authenticate From Ip
|
Azure Active Directory
|
T1110.003
T1110.004
T1586.003
|
Anomaly
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD New Custom Domain Added
|
Azure Active Directory Add unverified domain
|
T1484.002
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Azure AD New Federated Domain Added
|
Azure Active Directory Set domain authentication
|
T1484.002
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Azure AD New MFA Method Registered
|
Azure Active Directory Update user
|
T1098.005
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Azure AD New MFA Method Registered For User
|
Azure Active Directory User registered security info
|
T1556.006
|
TTP
|
Azure Active Directory Account Takeover, Compromised User Account
|
2025-05-02
|
Azure AD OAuth Application Consent Granted By User
|
Azure Active Directory Consent to application
|
T1528
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD PIM Role Assigned
|
Azure Active Directory
|
T1098.003
|
TTP
|
Azure Active Directory Persistence, Azure Active Directory Privilege Escalation
|
2025-05-02
|
Azure AD PIM Role Assignment Activated
|
Azure Active Directory
|
T1098.003
|
TTP
|
Azure Active Directory Persistence, Azure Active Directory Privilege Escalation
|
2025-05-02
|
Azure AD Privileged Authentication Administrator Role Assigned
|
Azure Active Directory Add member to role
|
T1003.002
|
TTP
|
Azure Active Directory Privilege Escalation
|
2025-05-02
|
Azure AD Privileged Graph API Permission Assigned
|
Azure Active Directory Update application
|
T1003.002
|
TTP
|
Azure Active Directory Persistence, NOBELIUM Group
|
2025-05-02
|
Azure AD Privileged Role Assigned
|
Azure Active Directory Add member to role
|
T1098.003
|
TTP
|
Azure Active Directory Persistence, NOBELIUM Group
|
2025-05-02
|
Azure AD Privileged Role Assigned to Service Principal
|
Azure Active Directory Add member to role
|
T1098.003
|
TTP
|
Azure Active Directory Privilege Escalation, NOBELIUM Group
|
2025-05-02
|
Azure AD Service Principal Authentication
|
Azure Active Directory Sign-in activity
|
T1078.004
|
TTP
|
Azure Active Directory Account Takeover, NOBELIUM Group
|
2025-05-02
|
Azure AD Service Principal Created
|
Azure Active Directory Add service principal
|
T1136.003
|
TTP
|
Azure Active Directory Persistence, NOBELIUM Group
|
2025-05-02
|
Azure AD Service Principal Enumeration
|
Azure Active Directory MicrosoftGraphActivityLogs
|
T1087.004
T1526
|
TTP
|
Azure Active Directory Privilege Escalation, Compromised User Account
|
2025-05-02
|
Azure AD Service Principal New Client Credentials
|
Azure Active Directory
|
T1098.001
|
TTP
|
Azure Active Directory Persistence, Azure Active Directory Privilege Escalation, NOBELIUM Group
|
2025-05-02
|
Azure AD Service Principal Owner Added
|
Azure Active Directory Add owner to application
|
T1098
|
TTP
|
Azure Active Directory Persistence, Azure Active Directory Privilege Escalation, NOBELIUM Group
|
2025-05-02
|
Azure AD Service Principal Privilege Escalation
|
Azure Active Directory Add app role assignment to service principal
|
T1098.003
|
TTP
|
Azure Active Directory Privilege Escalation
|
2025-05-02
|
Azure AD Successful Authentication From Different Ips
|
Azure Active Directory
|
T1110.001
T1110.003
|
TTP
|
Azure Active Directory Account Takeover, Compromised User Account
|
2025-05-02
|
Azure AD Successful PowerShell Authentication
|
Azure Active Directory
|
T1078.004
T1586.003
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD Successful Single-Factor Authentication
|
Azure Active Directory
|
T1078.004
T1586.003
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD Tenant Wide Admin Consent Granted
|
Azure Active Directory Consent to application
|
T1098.003
|
TTP
|
Azure Active Directory Persistence, NOBELIUM Group
|
2025-05-02
|
Azure AD Unusual Number of Failed Authentications From Ip
|
Azure Active Directory
|
T1110.003
T1110.004
T1586.003
|
Anomaly
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD User Consent Blocked for Risky Application
|
Azure Active Directory Consent to application
|
T1528
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD User Consent Denied for OAuth Application
|
Azure Active Directory Sign-in activity
|
T1528
|
TTP
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Azure AD User Enabled And Password Reset
|
Azure Active Directory Enable account, Azure Active Directory Reset password (by admin), Azure Active Directory Update user
|
T1098
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Azure AD User ImmutableId Attribute Updated
|
Azure Active Directory Update user
|
T1098
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Azure Automation Account Created
|
Azure Audit Create or Update an Azure Automation account
|
T1136.003
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Azure Automation Runbook Created
|
Azure Audit Create or Update an Azure Automation Runbook
|
T1136.003
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Azure Runbook Webhook Created
|
Azure Audit Create or Update an Azure Automation webhook
|
T1078.004
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Circle CI Disable Security Job
|
CircleCI
|
T1554
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
Circle CI Disable Security Step
|
CircleCI
|
T1554
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
Cloud API Calls From Previously Unseen User Roles
|
AWS CloudTrail
|
T1078
|
Anomaly
|
Suspicious Cloud User Activities
|
2025-05-02
|
Cloud Compute Instance Created By Previously Unseen User
|
AWS CloudTrail
|
T1078.004
|
Anomaly
|
Cloud Cryptomining
|
2025-05-02
|
Cloud Compute Instance Created In Previously Unused Region
|
AWS CloudTrail
|
T1535
|
Anomaly
|
Cloud Cryptomining
|
2025-05-02
|
Cloud Compute Instance Created With Previously Unseen Image
|
AWS CloudTrail
|
|
Anomaly
|
Cloud Cryptomining
|
2025-05-02
|
Cloud Compute Instance Created With Previously Unseen Instance Type
|
AWS CloudTrail
|
|
Anomaly
|
Cloud Cryptomining
|
2025-05-02
|
Cloud Instance Modified By Previously Unseen User
|
AWS CloudTrail
|
T1078.004
|
Anomaly
|
Suspicious Cloud Instance Activities
|
2025-05-02
|
Cloud Provisioning Activity From Previously Unseen City
|
AWS CloudTrail
|
T1078
|
Anomaly
|
Suspicious Cloud Provisioning Activities
|
2025-05-02
|
Cloud Provisioning Activity From Previously Unseen Country
|
AWS CloudTrail
|
T1078
|
Anomaly
|
Suspicious Cloud Provisioning Activities
|
2025-05-02
|
Cloud Provisioning Activity From Previously Unseen IP Address
|
AWS CloudTrail
|
T1078
|
Anomaly
|
Suspicious Cloud Provisioning Activities
|
2025-05-02
|
Cloud Provisioning Activity From Previously Unseen Region
|
AWS CloudTrail
|
T1078
|
Anomaly
|
Suspicious Cloud Provisioning Activities
|
2025-05-02
|
Cloud Security Groups Modifications by User
|
AWS CloudTrail
|
T1578.005
|
Anomaly
|
Suspicious Cloud User Activities
|
2025-05-02
|
Detect AWS Console Login by New User
|
AWS CloudTrail
|
T1552
T1586.003
|
Hunting
|
AWS Identity and Access Management Account Takeover, Suspicious Cloud Authentication Activities
|
2025-05-02
|
Detect AWS Console Login by User from New City
|
AWS CloudTrail
|
T1535
T1586.003
|
Hunting
|
AWS Identity and Access Management Account Takeover, Compromised User Account, Suspicious AWS Login Activities, Suspicious Cloud Authentication Activities
|
2025-05-02
|
Detect AWS Console Login by User from New Country
|
AWS CloudTrail
|
T1535
T1586.003
|
Hunting
|
AWS Identity and Access Management Account Takeover, Compromised User Account, Suspicious AWS Login Activities, Suspicious Cloud Authentication Activities
|
2025-05-02
|
Detect AWS Console Login by User from New Region
|
AWS CloudTrail
|
T1535
T1586.003
|
Hunting
|
AWS Identity and Access Management Account Takeover, Compromised User Account, Suspicious AWS Login Activities, Suspicious Cloud Authentication Activities
|
2025-05-02
|
Detect GCP Storage access from a new IP
|
|
T1530
|
Anomaly
|
Suspicious GCP Storage Activities
|
2025-05-02
|
Detect New Open GCP Storage Buckets
|
|
T1530
|
TTP
|
Suspicious GCP Storage Activities
|
2025-05-02
|
Detect New Open S3 buckets
|
AWS CloudTrail
|
T1530
|
TTP
|
Suspicious AWS S3 Activities
|
2025-05-02
|
Detect New Open S3 Buckets over AWS CLI
|
AWS CloudTrail
|
T1530
|
TTP
|
Suspicious AWS S3 Activities
|
2025-05-02
|
Detect S3 access from a new IP
|
|
T1530
|
Anomaly
|
Suspicious AWS S3 Activities
|
2025-05-02
|
Detect Spike in AWS Security Hub Alerts for EC2 Instance
|
AWS Security Hub
|
|
Anomaly
|
AWS Security Hub Alerts, Critical Alerts
|
2025-05-02
|
Detect Spike in AWS Security Hub Alerts for User
|
AWS Security Hub
|
|
Anomaly
|
AWS Security Hub Alerts, Critical Alerts
|
2025-05-02
|
Detect Spike in blocked Outbound Traffic from your AWS
|
|
|
Anomaly
|
AWS Network ACL Activity, Command And Control, Suspicious AWS Traffic
|
2025-05-02
|
Detect Spike in S3 Bucket deletion
|
AWS CloudTrail
|
T1530
|
Anomaly
|
Suspicious AWS S3 Activities
|
2025-05-02
|
GCP Authentication Failed During MFA Challenge
|
Google Workspace login_failure
|
T1078.004
T1586.003
T1621
|
TTP
|
GCP Account Takeover
|
2025-05-02
|
GCP Detect gcploit framework
|
|
T1078
|
TTP
|
GCP Cross Account Activity
|
2025-05-02
|
GCP Kubernetes cluster pod scan detection
|
|
T1526
|
Hunting
|
Kubernetes Scanning Activity
|
2025-05-02
|
GCP Multi-Factor Authentication Disabled
|
Google Workspace
|
T1556.006
T1586.003
|
TTP
|
GCP Account Takeover
|
2025-05-02
|
GCP Multiple Failed MFA Requests For User
|
Google Workspace
|
T1078.004
T1586.003
T1621
|
TTP
|
GCP Account Takeover
|
2025-05-02
|
GCP Multiple Users Failing To Authenticate From Ip
|
Google Workspace
|
T1110.003
T1110.004
T1586.003
|
Anomaly
|
GCP Account Takeover
|
2025-05-02
|
GCP Successful Single-Factor Authentication
|
Google Workspace
|
T1078.004
T1586.003
|
TTP
|
GCP Account Takeover
|
2025-05-02
|
GCP Unusual Number of Failed Authentications From Ip
|
Google Workspace
|
T1110.003
T1110.004
T1586.003
|
Anomaly
|
GCP Account Takeover
|
2025-05-02
|
Gdrive suspicious file sharing
|
|
T1566
|
Hunting
|
Data Exfiltration, Spearphishing Attachments
|
2025-05-02
|
GitHub Enterprise Delete Branch Ruleset
|
GitHub Enterprise Audit Logs
|
T1562.001
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Enterprise Disable 2FA Requirement
|
GitHub Enterprise Audit Logs
|
T1562.001
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Enterprise Disable Audit Log Event Stream
|
GitHub Enterprise Audit Logs
|
T1562.008
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Enterprise Disable Classic Branch Protection Rule
|
GitHub Enterprise Audit Logs
|
T1562.001
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Enterprise Disable Dependabot
|
GitHub Enterprise Audit Logs
|
T1562.001
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Enterprise Disable IP Allow List
|
GitHub Enterprise Audit Logs
|
T1562.001
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Enterprise Modify Audit Log Event Stream
|
GitHub Enterprise Audit Logs
|
T1562.008
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Enterprise Pause Audit Log Event Stream
|
GitHub Enterprise Audit Logs
|
T1562.008
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Enterprise Register Self Hosted Runner
|
GitHub Enterprise Audit Logs
|
T1562.001
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Enterprise Remove Organization
|
GitHub Enterprise Audit Logs
|
T1485
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Enterprise Repository Archived
|
GitHub Enterprise Audit Logs
|
T1485
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Enterprise Repository Deleted
|
GitHub Enterprise Audit Logs
|
T1485
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Organizations Delete Branch Ruleset
|
GitHub Organizations Audit Logs
|
T1562.001
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Organizations Disable 2FA Requirement
|
GitHub Organizations Audit Logs
|
T1562.001
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Organizations Disable Classic Branch Protection Rule
|
GitHub Organizations Audit Logs
|
T1562.001
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Organizations Disable Dependabot
|
GitHub Organizations Audit Logs
|
T1562.001
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Organizations Repository Archived
|
GitHub Organizations Audit Logs
|
T1485
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
GitHub Organizations Repository Deleted
|
GitHub Organizations Audit Logs
|
T1485
T1195
|
Anomaly
|
GitHub Malicious Activity
|
2025-05-02
|
Gsuite Drive Share In External Email
|
G Suite Drive
|
T1567.002
|
Anomaly
|
Dev Sec Ops, Insider Threat
|
2025-05-02
|
GSuite Email Suspicious Attachment
|
G Suite Gmail
|
T1566.001
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
Gsuite Email Suspicious Subject With Attachment
|
G Suite Gmail
|
T1566.001
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
Gsuite Email With Known Abuse Web Service Link
|
G Suite Gmail
|
T1566.001
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
Gsuite Outbound Email With Attachment To External Domain
|
G Suite Gmail
|
T1048.003
|
Hunting
|
Dev Sec Ops, Insider Threat
|
2025-05-02
|
Gsuite suspicious calendar invite
|
|
T1566
|
Hunting
|
Spearphishing Attachments
|
2025-05-02
|
Gsuite Suspicious Shared File Name
|
G Suite Drive
|
T1566.001
|
Anomaly
|
Dev Sec Ops
|
2025-05-02
|
High Number of Login Failures from a single source
|
O365 UserLoginFailed
|
T1110.001
|
Anomaly
|
Office 365 Account Takeover
|
2025-05-02
|
Kubernetes Abuse of Secret by Unusual Location
|
Kubernetes Audit
|
T1552.007
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Abuse of Secret by Unusual User Agent
|
Kubernetes Audit
|
T1552.007
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Abuse of Secret by Unusual User Group
|
Kubernetes Audit
|
T1552.007
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Abuse of Secret by Unusual User Name
|
Kubernetes Audit
|
T1552.007
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Access Scanning
|
Kubernetes Audit
|
T1046
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Anomalous Inbound Network Activity from Process
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Anomalous Inbound Outbound Network IO
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Anomalous Inbound to Outbound Network IO Ratio
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Anomalous Outbound Network Activity from Process
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Anomalous Traffic on Network Edge
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes AWS detect suspicious kubectl calls
|
Kubernetes Audit
|
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Create or Update Privileged Pod
|
Kubernetes Audit
|
T1204
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Cron Job Creation
|
Kubernetes Audit
|
T1053.007
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes DaemonSet Deployed
|
Kubernetes Audit
|
T1204
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Falco Shell Spawned
|
Kubernetes Falco
|
T1204
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes newly seen TCP edge
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes newly seen UDP edge
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Nginx Ingress LFI
|
|
T1212
|
TTP
|
Dev Sec Ops
|
2025-05-02
|
Kubernetes Nginx Ingress RFI
|
|
T1212
|
TTP
|
Dev Sec Ops
|
2025-05-02
|
Kubernetes Node Port Creation
|
Kubernetes Audit
|
T1204
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Pod Created in Default Namespace
|
Kubernetes Audit
|
T1204
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Pod With Host Network Attachment
|
Kubernetes Audit
|
T1204
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Previously Unseen Container Image Name
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Previously Unseen Process
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Process Running From New Path
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Process with Anomalous Resource Utilisation
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Process with Resource Ratio Anomalies
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Scanner Image Pulling
|
|
T1526
|
TTP
|
Dev Sec Ops
|
2025-05-02
|
Kubernetes Scanning by Unauthenticated IP Address
|
Kubernetes Audit
|
T1046
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Shell Running on Worker Node
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Shell Running on Worker Node with CPU Activity
|
|
T1204
|
Anomaly
|
Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
|
2025-05-02
|
Kubernetes Suspicious Image Pulling
|
Kubernetes Audit
|
T1526
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Kubernetes Unauthorized Access
|
Kubernetes Audit
|
T1204
|
Anomaly
|
Kubernetes Security
|
2025-05-02
|
Microsoft Intune Device Health Scripts
|
Azure Monitor Activity
|
T1072
T1021.007
T1202
T1105
|
Hunting
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Microsoft Intune DeviceManagementConfigurationPolicies
|
Azure Monitor Activity
|
T1072
T1484
T1021.007
T1562.001
T1562.004
|
Hunting
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Microsoft Intune Manual Device Management
|
Azure Monitor Activity
|
T1021.007
T1072
T1529
|
Hunting
|
Azure Active Directory Account Takeover
|
2025-05-02
|
Microsoft Intune Mobile Apps
|
Azure Monitor Activity
|
T1072
T1021.007
T1202
T1105
|
Hunting
|
Azure Active Directory Account Takeover
|
2025-05-02
|
O365 Add App Role Assignment Grant User
|
O365 Add app role assignment grant to user.
|
T1136.003
|
TTP
|
Cloud Federated Credential Abuse, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Added Service Principal
|
O365
|
T1136.003
|
TTP
|
Cloud Federated Credential Abuse, NOBELIUM Group, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Admin Consent Bypassed by Service Principal
|
O365 Add app role assignment to service principal.
|
T1098.003
|
TTP
|
Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Advanced Audit Disabled
|
O365 Change user license.
|
T1562.008
|
TTP
|
Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Application Available To Other Tenants
|
Office 365 Universal Audit Log
|
T1098.003
|
TTP
|
Azure Active Directory Account Takeover, Azure Active Directory Persistence, Data Exfiltration
|
2025-05-02
|
O365 Application Registration Owner Added
|
O365 Add owner to application.
|
T1098
|
TTP
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 ApplicationImpersonation Role Assigned
|
O365
|
T1098.002
|
TTP
|
NOBELIUM Group, Office 365 Collection Techniques, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 BEC Email Hiding Rule Created
|
|
T1564.008
|
TTP
|
Office 365 Account Takeover
|
2025-05-02
|
O365 Block User Consent For Risky Apps Disabled
|
O365 Update authorization policy.
|
T1562
|
TTP
|
Office 365 Account Takeover
|
2025-05-02
|
O365 Bypass MFA via Trusted IP
|
O365 Set Company Information.
|
T1562.007
|
TTP
|
Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Compliance Content Search Exported
|
|
T1114.002
|
TTP
|
Office 365 Collection Techniques
|
2025-05-02
|
O365 Compliance Content Search Started
|
|
T1114.002
|
TTP
|
Office 365 Collection Techniques
|
2025-05-02
|
O365 Concurrent Sessions From Different Ips
|
O365 UserLoggedIn
|
T1185
|
TTP
|
Office 365 Account Takeover
|
2025-05-02
|
O365 Cross-Tenant Access Change
|
Office 365 Universal Audit Log
|
T1484.002
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
O365 Disable MFA
|
O365 Disable Strong Authentication.
|
T1556
|
TTP
|
Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 DLP Rule Triggered
|
Office 365 Universal Audit Log
|
T1048
T1567
|
Anomaly
|
Data Exfiltration
|
2025-05-02
|
O365 Elevated Mailbox Permission Assigned
|
|
T1098.002
|
TTP
|
Office 365 Collection Techniques
|
2025-05-02
|
O365 Email Access By Security Administrator
|
Office 365 Universal Audit Log
|
T1114.002
T1567
|
TTP
|
Azure Active Directory Account Takeover, Data Exfiltration, Office 365 Account Takeover
|
2025-05-02
|
O365 Email Hard Delete Excessive Volume
|
Office 365 Universal Audit Log
|
T1070.008
T1485
|
Anomaly
|
Data Destruction, Office 365 Account Takeover, Suspicious Emails
|
2025-05-02
|
O365 Email New Inbox Rule Created
|
Office 365 Universal Audit Log
|
T1114.003
T1564.008
|
Anomaly
|
Office 365 Collection Techniques
|
2025-05-02
|
O365 Email Password and Payroll Compromise Behavior
|
Office 365 Reporting Message Trace, Office 365 Universal Audit Log
|
T1070.008
T1485
T1114.001
|
TTP
|
Data Destruction, Office 365 Account Takeover, Office 365 Collection Techniques, Suspicious Emails
|
2025-05-02
|
O365 Email Receive and Hard Delete Takeover Behavior
|
Office 365 Reporting Message Trace, Office 365 Universal Audit Log
|
T1070.008
T1485
T1114.001
|
Anomaly
|
Data Destruction, Office 365 Account Takeover, Office 365 Collection Techniques, Suspicious Emails
|
2025-05-02
|
O365 Email Reported By Admin Found Malicious
|
Office 365 Universal Audit Log
|
T1566.001
T1566.002
|
TTP
|
Spearphishing Attachments, Suspicious Emails
|
2025-05-02
|
O365 Email Reported By User Found Malicious
|
Office 365 Universal Audit Log
|
T1566.001
T1566.002
|
TTP
|
Spearphishing Attachments, Suspicious Emails
|
2025-05-02
|
O365 Email Security Feature Changed
|
Office 365 Universal Audit Log
|
T1562.001
T1562.008
|
TTP
|
Office 365 Account Takeover, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Email Send and Hard Delete Exfiltration Behavior
|
Office 365 Reporting Message Trace, Office 365 Universal Audit Log
|
T1114.001
T1070.008
T1485
|
Anomaly
|
Data Destruction, Office 365 Account Takeover, Office 365 Collection Techniques, Suspicious Emails
|
2025-05-02
|
O365 Email Send and Hard Delete Suspicious Behavior
|
Office 365 Universal Audit Log
|
T1114.001
T1070.008
T1485
|
Anomaly
|
Data Destruction, Office 365 Account Takeover, Office 365 Collection Techniques, Suspicious Emails
|
2025-05-02
|
O365 Email Send Attachments Excessive Volume
|
Office 365 Universal Audit Log
|
T1070.008
T1485
|
Anomaly
|
Office 365 Account Takeover, Suspicious Emails
|
2025-05-02
|
O365 Email Suspicious Behavior Alert
|
Office 365 Universal Audit Log
|
T1114.003
|
TTP
|
Office 365 Account Takeover, Office 365 Collection Techniques, Suspicious Emails
|
2025-05-02
|
O365 Email Suspicious Search Behavior
|
Office 365 Universal Audit Log
|
T1114.002
T1552
|
Anomaly
|
CISA AA22-320A, Compromised User Account, Office 365 Account Takeover, Office 365 Collection Techniques
|
2025-05-02
|
O365 Email Transport Rule Changed
|
Office 365 Universal Audit Log
|
T1114.003
T1564.008
|
Anomaly
|
Data Exfiltration, Office 365 Account Takeover
|
2025-05-02
|
O365 Excessive Authentication Failures Alert
|
|
T1110
|
Anomaly
|
Office 365 Account Takeover
|
2025-05-02
|
O365 Excessive SSO logon errors
|
O365 UserLoginFailed
|
T1556
|
Anomaly
|
Cloud Federated Credential Abuse, Office 365 Account Takeover
|
2025-05-02
|
O365 Exfiltration via File Access
|
Office 365 Universal Audit Log
|
T1567
T1530
|
Anomaly
|
Data Exfiltration, Office 365 Account Takeover
|
2025-05-02
|
O365 Exfiltration via File Download
|
Office 365 Universal Audit Log
|
T1567
T1530
|
Anomaly
|
Data Exfiltration, Office 365 Account Takeover
|
2025-05-02
|
O365 Exfiltration via File Sync Download
|
Office 365 Universal Audit Log
|
T1567
T1530
|
Anomaly
|
Data Exfiltration, Office 365 Account Takeover
|
2025-05-02
|
O365 External Guest User Invited
|
Office 365 Universal Audit Log
|
T1136.003
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
O365 External Identity Policy Changed
|
Office 365 Universal Audit Log
|
T1136.003
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
O365 File Permissioned Application Consent Granted by User
|
O365 Consent to application.
|
T1528
|
TTP
|
Office 365 Account Takeover
|
2025-05-02
|
O365 FullAccessAsApp Permission Assigned
|
O365 Update application.
|
T1098.002
T1098.003
|
TTP
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 High Number Of Failed Authentications for User
|
O365 UserLoginFailed
|
T1110.001
|
TTP
|
Office 365 Account Takeover
|
2025-05-02
|
O365 High Privilege Role Granted
|
O365 Add member to role.
|
T1098.003
|
TTP
|
Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Mail Permissioned Application Consent Granted by User
|
O365 Consent to application.
|
T1528
|
TTP
|
Office 365 Account Takeover
|
2025-05-02
|
O365 Mailbox Email Forwarding Enabled
|
|
T1114.003
|
TTP
|
Office 365 Collection Techniques
|
2025-05-02
|
O365 Mailbox Folder Read Permission Assigned
|
|
T1098.002
|
TTP
|
Office 365 Collection Techniques
|
2025-05-02
|
O365 Mailbox Folder Read Permission Granted
|
|
T1098.002
|
TTP
|
Office 365 Collection Techniques
|
2025-05-02
|
O365 Mailbox Inbox Folder Shared with All Users
|
O365 ModifyFolderPermissions
|
T1114.002
|
TTP
|
Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Mailbox Read Access Granted to Application
|
O365 Update application.
|
T1098.003
T1114.002
|
TTP
|
Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Multi-Source Failed Authentications Spike
|
O365 UserLoginFailed
|
T1110.003
T1110.004
T1586.003
|
Hunting
|
NOBELIUM Group, Office 365 Account Takeover
|
2025-05-02
|
O365 Multiple AppIDs and UserAgents Authentication Spike
|
O365 UserLoggedIn, O365 UserLoginFailed
|
T1078
|
Anomaly
|
Office 365 Account Takeover
|
2025-05-02
|
O365 Multiple Failed MFA Requests For User
|
O365 UserLoginFailed
|
T1621
|
TTP
|
Office 365 Account Takeover
|
2025-05-02
|
O365 Multiple Mailboxes Accessed via API
|
O365 MailItemsAccessed
|
T1114.002
|
TTP
|
NOBELIUM Group, Office 365 Collection Techniques
|
2025-05-02
|
O365 Multiple OS Vendors Authenticating From User
|
Office 365 Universal Audit Log
|
T1110
|
TTP
|
Office 365 Account Takeover
|
2025-05-02
|
O365 Multiple Service Principals Created by SP
|
O365 Add service principal.
|
T1136.003
|
Anomaly
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Multiple Service Principals Created by User
|
O365 Add service principal.
|
T1136.003
|
Anomaly
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Multiple Users Failing To Authenticate From Ip
|
O365 UserLoginFailed
|
T1110.003
T1110.004
T1586.003
|
TTP
|
NOBELIUM Group, Office 365 Account Takeover
|
2025-05-02
|
O365 New Email Forwarding Rule Created
|
|
T1114.003
|
TTP
|
Office 365 Collection Techniques
|
2025-05-02
|
O365 New Email Forwarding Rule Enabled
|
|
T1114.003
|
TTP
|
Office 365 Collection Techniques
|
2025-05-02
|
O365 New Federated Domain Added
|
O365
|
T1136.003
|
TTP
|
Cloud Federated Credential Abuse, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 New Forwarding Mailflow Rule Created
|
|
T1114
|
TTP
|
Office 365 Collection Techniques
|
2025-05-02
|
O365 New MFA Method Registered
|
O365 Update user.
|
T1098.005
|
TTP
|
Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 OAuth App Mailbox Access via EWS
|
O365 MailItemsAccessed
|
T1114.002
|
TTP
|
NOBELIUM Group, Office 365 Collection Techniques
|
2025-05-02
|
O365 OAuth App Mailbox Access via Graph API
|
O365 MailItemsAccessed
|
T1114.002
|
TTP
|
NOBELIUM Group, Office 365 Collection Techniques
|
2025-05-02
|
O365 Privileged Graph API Permission Assigned
|
O365 Update application.
|
T1003.002
|
TTP
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Privileged Role Assigned
|
Office 365 Universal Audit Log
|
T1098.003
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
O365 Privileged Role Assigned To Service Principal
|
Office 365 Universal Audit Log
|
T1098.003
|
TTP
|
Azure Active Directory Privilege Escalation
|
2025-05-02
|
O365 PST export alert
|
O365
|
T1114
|
TTP
|
Data Exfiltration, Office 365 Collection Techniques
|
2025-05-02
|
O365 Safe Links Detection
|
Office 365 Universal Audit Log
|
T1566.001
|
TTP
|
Office 365 Account Takeover, Spearphishing Attachments
|
2025-05-02
|
O365 Security And Compliance Alert Triggered
|
|
T1078.004
|
TTP
|
Office 365 Account Takeover
|
2025-05-02
|
O365 Service Principal New Client Credentials
|
O365
|
T1098.001
|
TTP
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Service Principal Privilege Escalation
|
O365 Add app role assignment grant to user.
|
T1098.003
|
TTP
|
Azure Active Directory Privilege Escalation, Office 365 Account Takeover
|
2025-05-02
|
O365 SharePoint Allowed Domains Policy Changed
|
Office 365 Universal Audit Log
|
T1136.003
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
O365 SharePoint Malware Detection
|
Office 365 Universal Audit Log
|
T1204.002
|
TTP
|
Azure Active Directory Persistence, Office 365 Account Takeover, Ransomware Cloud
|
2025-05-02
|
O365 SharePoint Suspicious Search Behavior
|
Office 365 Universal Audit Log
|
T1213.002
T1552
|
Anomaly
|
CISA AA22-320A, Compromised User Account, Office 365 Account Takeover, Office 365 Collection Techniques
|
2025-05-02
|
O365 Tenant Wide Admin Consent Granted
|
O365 Consent to application.
|
T1098.003
|
TTP
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2025-05-02
|
O365 Threat Intelligence Suspicious Email Delivered
|
Office 365 Universal Audit Log
|
T1566.001
T1566.002
|
Anomaly
|
Spearphishing Attachments, Suspicious Emails
|
2025-05-02
|
O365 Threat Intelligence Suspicious File Detected
|
Office 365 Universal Audit Log
|
T1204.002
|
TTP
|
Azure Active Directory Account Takeover, Office 365 Account Takeover, Ransomware Cloud
|
2025-05-02
|
O365 User Consent Blocked for Risky Application
|
O365 Consent to application.
|
T1528
|
TTP
|
Office 365 Account Takeover
|
2025-05-02
|
O365 User Consent Denied for OAuth Application
|
O365
|
T1528
|
TTP
|
Office 365 Account Takeover
|
2025-05-02
|
O365 ZAP Activity Detection
|
Office 365 Universal Audit Log
|
T1566.001
T1566.002
|
Anomaly
|
Spearphishing Attachments, Suspicious Emails
|
2025-05-02
|
Risk Rule for Dev Sec Ops by Repository
|
|
T1204.003
|
Correlation
|
Dev Sec Ops
|
2025-05-02
|
CertUtil Download With URLCache and Split Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
TTP
|
CISA AA22-277A, Compromised Windows Host, DarkSide Ransomware, Flax Typhoon, Forest Blizzard, Ingress Tool Transfer, Living Off The Land, ProxyNotShell, Storm-2460 CLFS Zero Day Exploitation
|
2025-05-02
|
CertUtil Download With VerifyCtl and Split Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
TTP
|
Compromised Windows Host, DarkSide Ransomware, Ingress Tool Transfer, Living Off The Land, Storm-2460 CLFS Zero Day Exploitation
|
2025-05-02
|
Windows CertUtil Download With URL Argument
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
TTP
|
Ingress Tool Transfer, Living Off The Land, Storm-2460 CLFS Zero Day Exploitation
|
2025-05-02
|
Windows Remote Access Software Hunt
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1219
|
Hunting
|
Cactus Ransomware, Command And Control, Insider Threat, Ransomware
|
2025-05-02
|
7zip CommandLine To SMB Share Path
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1560.001
|
Hunting
|
Ransomware
|
2025-05-02
|
Access LSASS Memory for Dump Creation
|
Sysmon EventID 10
|
T1003.001
|
TTP
|
CISA AA23-347A, Cactus Ransomware, Credential Dumping
|
2025-05-02
|
Active Directory Lateral Movement Identified
|
|
T1210
|
Correlation
|
Active Directory Lateral Movement
|
2025-05-02
|
Active Directory Privilege Escalation Identified
|
|
T1484
|
Correlation
|
Active Directory Privilege Escalation
|
2025-05-02
|
Active Setup Registry Autostart
|
Sysmon EventID 13
|
T1547.014
|
TTP
|
Data Destruction, Hermetic Wiper, Windows Persistence Techniques, Windows Privilege Escalation
|
2025-05-02
|
Add DefaultUser And Password In Registry
|
Sysmon EventID 12, Sysmon EventID 13
|
T1552.002
|
Anomaly
|
BlackMatter Ransomware
|
2025-05-02
|
AdsiSearcher Account Discovery
|
Powershell Script Block Logging 4104
|
T1087.002
|
TTP
|
Active Directory Discovery, CISA AA23-347A, Data Destruction, Industroyer2
|
2025-05-02
|
Allow File And Printing Sharing In Firewall
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.007
|
TTP
|
BlackByte Ransomware, Ransomware
|
2025-05-02
|
Allow Inbound Traffic By Firewall Rule Registry
|
Sysmon EventID 13
|
T1021.001
|
TTP
|
Azorult, Medusa Ransomware, NjRAT, PlugX, Prohibited Traffic Allowed or Protocol Mismatch, Windows Registry Abuse
|
2025-05-02
|
Allow Inbound Traffic In Firewall Rule
|
Powershell Script Block Logging 4104
|
T1021.001
|
TTP
|
Prohibited Traffic Allowed or Protocol Mismatch
|
2025-05-02
|
Allow Network Discovery In Firewall
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.007
|
TTP
|
BlackByte Ransomware, Medusa Ransomware, NjRAT, Ransomware, Revil Ransomware
|
2025-05-02
|
Allow Operation with Consent Admin
|
Sysmon EventID 13
|
T1548
|
TTP
|
Azorult, MoonPeak, Ransomware, Windows Registry Abuse
|
2025-05-02
|
Anomalous usage of 7zip
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1560.001
|
Anomaly
|
BlackByte Ransomware, BlackSuit Ransomware, Cobalt Strike, Graceful Wipe Out Attack, NOBELIUM Group
|
2025-05-02
|
Attacker Tools On Endpoint
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003
T1036.005
T1595
|
TTP
|
CISA AA22-264A, Compromised Windows Host, PHP-CGI RCE Attack on Japanese Organizations, SamSam Ransomware, Unusual Processes, XMRig
|
2025-05-02
|
Attempt To Add Certificate To Untrusted Store
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1553.004
|
TTP
|
Disabling Security Tools
|
2025-05-02
|
Auto Admin Logon Registry Entry
|
Sysmon EventID 13
|
T1552.002
|
TTP
|
BlackMatter Ransomware, Windows Registry Abuse
|
2025-05-02
|
Batch File Write to System32
|
Sysmon EventID 11
|
T1204.002
|
TTP
|
Compromised Windows Host, SamSam Ransomware
|
2025-05-02
|
Bcdedit Command Back To Normal Mode Boot
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1490
|
TTP
|
Black Basta Ransomware, BlackMatter Ransomware
|
2025-05-02
|
BCDEdit Failure Recovery Modification
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1490
|
TTP
|
Compromised Windows Host, Ransomware, Ryuk Ransomware, Storm-2460 CLFS Zero Day Exploitation
|
2025-05-02
|
BITS Job Persistence
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1197
|
TTP
|
BITS Jobs, Living Off The Land
|
2025-05-02
|
BITSAdmin Download File
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1197
T1105
|
TTP
|
BITS Jobs, DarkSide Ransomware, Flax Typhoon, Gozi Malware, Ingress Tool Transfer, Living Off The Land
|
2025-05-02
|
Certutil exe certificate extraction
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
|
TTP
|
Cloud Federated Credential Abuse, Compromised Windows Host, Living Off The Land, Storm-2460 CLFS Zero Day Exploitation, Windows Certificate Services, Windows Persistence Techniques
|
2025-05-02
|
CertUtil With Decode Argument
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1140
|
TTP
|
APT29 Diplomatic Deceptions with WINELOADER, Deobfuscate-Decode Files or Information, Forest Blizzard, Living Off The Land, Storm-2460 CLFS Zero Day Exploitation
|
2025-05-02
|
Change To Safe Mode With Network Config
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1490
|
TTP
|
Black Basta Ransomware, BlackMatter Ransomware
|
2025-05-02
|
CHCP Command Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1
|
T1059
|
Anomaly
|
Azorult, Crypto Stealer, Forest Blizzard, IcedID
|
2025-05-02
|
Check Elevated CMD using whoami
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1033
|
TTP
|
FIN7
|
2025-05-02
|
Child Processes of Spoolsv exe
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1068
|
TTP
|
Data Destruction, Hermetic Wiper, Windows Privilege Escalation
|
2025-05-02
|
Clear Unallocated Sector Using Cipher App
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1070.004
|
TTP
|
Compromised Windows Host, Ransomware
|
2025-05-02
|
Clop Common Exec Parameter
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1204
|
TTP
|
Clop Ransomware, Compromised Windows Host
|
2025-05-02
|
Clop Ransomware Known Service Name
|
Windows Event Log System 7045
|
T1543
|
TTP
|
Clop Ransomware, Compromised Windows Host
|
2025-05-02
|
CMD Echo Pipe - Escalation
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.003
T1543.003
|
TTP
|
BlackByte Ransomware, Cobalt Strike, Compromised Windows Host, Graceful Wipe Out Attack
|
2025-05-02
|
CMLUA Or CMSTPLUA UAC Bypass
|
Sysmon EventID 7
|
T1218.003
|
TTP
|
DarkSide Ransomware, LockBit Ransomware, Ransomware, ValleyRAT
|
2025-05-02
|
Cobalt Strike Named Pipes
|
Sysmon EventID 17, Sysmon EventID 18
|
T1055
|
TTP
|
BlackByte Ransomware, Cobalt Strike, DarkSide Ransomware, Gozi Malware, Graceful Wipe Out Attack, LockBit Ransomware, Trickbot
|
2025-05-02
|
Common Ransomware Extensions
|
Sysmon EventID 11
|
T1485
|
TTP
|
Black Basta Ransomware, Clop Ransomware, LockBit Ransomware, Medusa Ransomware, Prestige Ransomware, Ransomware, Rhysida Ransomware, Ryuk Ransomware, SamSam Ransomware, Termite Ransomware
|
2025-05-02
|
Common Ransomware Notes
|
Sysmon EventID 11
|
T1485
|
Hunting
|
Black Basta Ransomware, Chaos Ransomware, Clop Ransomware, LockBit Ransomware, Medusa Ransomware, Ransomware, Rhysida Ransomware, Ryuk Ransomware, SamSam Ransomware, Termite Ransomware
|
2025-05-02
|
ConnectWise ScreenConnect Path Traversal
|
Sysmon EventID 11
|
T1190
|
TTP
|
ConnectWise ScreenConnect Vulnerabilities, Seashell Blizzard
|
2025-05-02
|
ConnectWise ScreenConnect Path Traversal Windows SACL
|
Windows Event Log Security 4663
|
T1190
|
TTP
|
Compromised Windows Host, ConnectWise ScreenConnect Vulnerabilities, Seashell Blizzard
|
2025-05-02
|
Conti Common Exec parameter
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1204
|
TTP
|
Compromised Windows Host, Ransomware
|
2025-05-02
|
Control Loading from World Writable Directory
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.002
|
TTP
|
Compromised Windows Host, Living Off The Land, Microsoft MSHTML Remote Code Execution CVE-2021-40444
|
2025-05-02
|
Create or delete windows shares using net exe
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1070.005
|
TTP
|
CISA AA22-277A, DarkGate Malware, Hidden Cobra Malware, Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Create Remote Thread In Shell Application
|
Sysmon EventID 8
|
T1055
|
TTP
|
IcedID, Qakbot, Warzone RAT
|
2025-05-02
|
Create Remote Thread into LSASS
|
Sysmon EventID 8
|
T1003.001
|
TTP
|
BlackSuit Ransomware, Credential Dumping
|
2025-05-02
|
Creation of lsass Dump with Taskmgr
|
Sysmon EventID 11
|
T1003.001
|
TTP
|
CISA AA22-257A, Cactus Ransomware, Credential Dumping, Seashell Blizzard
|
2025-05-02
|
Creation of Shadow Copy
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.003
|
TTP
|
Compromised Windows Host, Credential Dumping, Volt Typhoon
|
2025-05-02
|
Creation of Shadow Copy with wmic and powershell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.003
|
TTP
|
Compromised Windows Host, Credential Dumping, Living Off The Land, Volt Typhoon
|
2025-05-02
|
Credential Dumping via Copy Command from Shadow Copy
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.003
|
TTP
|
Compromised Windows Host, Credential Dumping
|
2025-05-02
|
Credential Dumping via Symlink to Shadow Copy
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.003
|
TTP
|
Compromised Windows Host, Credential Dumping
|
2025-05-02
|
Crowdstrike Admin Weak Password Policy
|
|
T1110
|
TTP
|
Compromised Windows Host
|
2025-05-02
|
Crowdstrike Admin With Duplicate Password
|
|
T1110
|
TTP
|
Compromised Windows Host
|
2025-05-02
|
Crowdstrike High Identity Risk Severity
|
|
T1110
|
TTP
|
Compromised Windows Host
|
2025-05-02
|
Crowdstrike Medium Identity Risk Severity
|
|
T1110
|
TTP
|
Compromised Windows Host
|
2025-05-02
|
Crowdstrike Medium Severity Alert
|
|
T1110
|
Anomaly
|
Compromised Windows Host
|
2025-05-02
|
Crowdstrike Multiple LOW Severity Alerts
|
|
T1110
|
Anomaly
|
Compromised Windows Host
|
2025-05-02
|
Crowdstrike Privilege Escalation For Non-Admin User
|
|
T1110
|
Anomaly
|
Compromised Windows Host
|
2025-05-02
|
Crowdstrike User Weak Password Policy
|
|
T1110
|
Anomaly
|
Compromised Windows Host
|
2025-05-02
|
Crowdstrike User with Duplicate Password
|
|
T1110
|
Anomaly
|
Compromised Windows Host
|
2025-05-02
|
CSC Net On The Fly Compilation
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1027.004
|
Hunting
|
Windows Defense Evasion Tactics
|
2025-05-02
|
Curl Download and Bash Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
TTP
|
Compromised Windows Host, Ingress Tool Transfer, Linux Living Off The Land, Log4Shell CVE-2021-44228
|
2025-05-02
|
Delete ShadowCopy With PowerShell
|
Powershell Script Block Logging 4104
|
T1490
|
TTP
|
Cactus Ransomware, DarkGate Malware, DarkSide Ransomware, Ransomware, Revil Ransomware, VanHelsing Ransomware
|
2025-05-02
|
Deleting Shadow Copies
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1490
|
TTP
|
Black Basta Ransomware, CISA AA22-264A, Cactus Ransomware, Chaos Ransomware, Clop Ransomware, Compromised Windows Host, DarkGate Malware, LockBit Ransomware, Medusa Ransomware, Prestige Ransomware, Ransomware, Rhysida Ransomware, SamSam Ransomware, Storm-2460 CLFS Zero Day Exploitation, Termite Ransomware, VanHelsing Ransomware, Windows Log Manipulation
|
2025-05-02
|
Detect AzureHound Command-Line Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.001
T1069.002
T1087.001
T1087.002
T1482
|
TTP
|
Compromised Windows Host, Windows Discovery Techniques
|
2025-05-02
|
Detect AzureHound File Modifications
|
Sysmon EventID 11
|
T1069.001
T1069.002
T1087.001
T1087.002
T1482
|
TTP
|
Windows Discovery Techniques
|
2025-05-02
|
Detect Baron Samedit CVE-2021-3156
|
|
T1068
|
TTP
|
Baron Samedit CVE-2021-3156
|
2025-05-02
|
Detect Baron Samedit CVE-2021-3156 Segfault
|
|
T1068
|
TTP
|
Baron Samedit CVE-2021-3156
|
2025-05-02
|
Detect Baron Samedit CVE-2021-3156 via OSQuery
|
|
T1068
|
TTP
|
Baron Samedit CVE-2021-3156
|
2025-05-02
|
Detect Certify Command Line Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1649
T1105
|
TTP
|
Compromised Windows Host, Ingress Tool Transfer, Windows Certificate Services
|
2025-05-02
|
Detect Certify With PowerShell Script Block Logging
|
Powershell Script Block Logging 4104
|
T1059.001
T1649
|
TTP
|
Malicious PowerShell, Windows Certificate Services
|
2025-05-02
|
Detect Certipy File Modifications
|
Sysmon EventID 11
|
T1649
T1560
|
TTP
|
Data Exfiltration, Ingress Tool Transfer, Windows Certificate Services
|
2025-05-02
|
Detect Computer Changed with Anonymous Account
|
Windows Event Log Security 4624, Windows Event Log Security 4742
|
T1210
|
Hunting
|
Detect Zerologon Attack
|
2025-05-02
|
Detect Copy of ShadowCopy with Script Block Logging
|
Powershell Script Block Logging 4104
|
T1003.002
|
TTP
|
Credential Dumping, VanHelsing Ransomware
|
2025-05-02
|
Detect Credential Dumping through LSASS access
|
Sysmon EventID 10
|
T1003.001
|
TTP
|
BlackSuit Ransomware, CISA AA23-347A, Credential Dumping, Detect Zerologon Attack
|
2025-05-02
|
Detect Empire with PowerShell Script Block Logging
|
Powershell Script Block Logging 4104
|
T1059.001
|
TTP
|
Data Destruction, Hermetic Wiper, Malicious PowerShell
|
2025-05-02
|
Detect Excessive Account Lockouts From Endpoint
|
|
T1078.002
|
Anomaly
|
Active Directory Password Spraying
|
2025-05-02
|
Detect Excessive User Account Lockouts
|
|
T1078.003
|
Anomaly
|
Active Directory Password Spraying
|
2025-05-02
|
Detect Exchange Web Shell
|
Sysmon EventID 11
|
T1133
T1190
T1505.003
|
TTP
|
BlackByte Ransomware, CISA AA22-257A, Compromised Windows Host, HAFNIUM Group, ProxyNotShell, ProxyShell, Seashell Blizzard
|
2025-05-02
|
Detect HTML Help Renamed
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.001
|
Hunting
|
Living Off The Land, Suspicious Compiled HTML Activity
|
2025-05-02
|
Detect HTML Help URL in Command Line
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.001
|
TTP
|
Compromised Windows Host, Living Off The Land, Suspicious Compiled HTML Activity
|
2025-05-02
|
Detect HTML Help Using InfoTech Storage Handlers
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.001
|
TTP
|
Compromised Windows Host, Living Off The Land, Suspicious Compiled HTML Activity
|
2025-05-02
|
Detect Mimikatz With PowerShell Script Block Logging
|
Powershell Script Block Logging 4104
|
T1003
T1059.001
|
TTP
|
CISA AA22-264A, CISA AA22-320A, CISA AA23-347A, Data Destruction, Hermetic Wiper, Malicious PowerShell, Sandworm Tools
|
2025-05-02
|
Detect mshta renamed
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.005
|
Hunting
|
Living Off The Land, Suspicious MSHTA Activity
|
2025-05-02
|
Detect New Local Admin account
|
Windows Event Log Security 4720, Windows Event Log Security 4732
|
T1136.001
|
TTP
|
CISA AA22-257A, CISA AA24-241A, DHS Report TA18-074A, HAFNIUM Group
|
2025-05-02
|
Detect Outlook exe writing a zip file
|
Sysmon EventID 1, Sysmon EventID 11
|
T1566.001
|
TTP
|
Amadey, Meduza Stealer, PXA Stealer, Remcos, Spearphishing Attachments
|
2025-05-02
|
Detect Password Spray Attack Behavior From Source
|
Windows Event Log Security 4624, Windows Event Log Security 4625
|
T1110.003
|
TTP
|
Compromised User Account
|
2025-05-02
|
Detect Password Spray Attack Behavior On User
|
Windows Event Log Security 4624, Windows Event Log Security 4625
|
T1110.003
|
TTP
|
Compromised User Account, Crypto Stealer
|
2025-05-02
|
Detect Path Interception By Creation Of program exe
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1574.009
|
TTP
|
Windows Persistence Techniques
|
2025-05-02
|
Detect Prohibited Applications Spawning cmd exe
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.003
|
Hunting
|
NOBELIUM Group, Suspicious Command-Line Executions, Suspicious MSHTA Activity, Suspicious Zoom Child Processes
|
2025-05-02
|
Detect PsExec With accepteula Flag
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.002
|
TTP
|
Active Directory Lateral Movement, BlackByte Ransomware, CISA AA22-320A, Cactus Ransomware, DHS Report TA18-074A, DarkGate Malware, DarkSide Ransomware, HAFNIUM Group, IcedID, Medusa Ransomware, Rhysida Ransomware, SamSam Ransomware, Sandworm Tools, Seashell Blizzard, VanHelsing Ransomware, Volt Typhoon
|
2025-05-02
|
Detect Rare Executables
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1204
|
Anomaly
|
China-Nexus Threat Activity, Crypto Stealer, Rhysida Ransomware, Salt Typhoon, SnappyBee, Unusual Processes
|
2025-05-02
|
Detect RClone Command-Line Usage
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1020
|
TTP
|
Black Basta Ransomware, Cactus Ransomware, DarkSide Ransomware, Ransomware
|
2025-05-02
|
Detect Regasm Spawning a Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.009
|
TTP
|
Compromised Windows Host, DarkGate Malware, Handala Wiper, Living Off The Land, Snake Keylogger, Suspicious Regsvcs Regasm Activity
|
2025-05-02
|
Detect Regasm with Network Connection
|
Sysmon EventID 3
|
T1218.009
|
TTP
|
Handala Wiper, Living Off The Land, Suspicious Regsvcs Regasm Activity
|
2025-05-02
|
Detect Regasm with no Command Line Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.009
|
TTP
|
Handala Wiper, Living Off The Land, Suspicious Regsvcs Regasm Activity
|
2025-05-02
|
Detect Regsvcs Spawning a Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.009
|
TTP
|
Compromised Windows Host, Living Off The Land, Suspicious Regsvcs Regasm Activity
|
2025-05-02
|
Detect Regsvcs with Network Connection
|
Sysmon EventID 3
|
T1218.009
|
TTP
|
Living Off The Land, Suspicious Regsvcs Regasm Activity
|
2025-05-02
|
Detect Regsvcs with No Command Line Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.009
|
TTP
|
Living Off The Land, Suspicious Regsvcs Regasm Activity
|
2025-05-02
|
Detect Regsvr32 Application Control Bypass
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.010
|
TTP
|
BlackByte Ransomware, Cobalt Strike, Compromised Windows Host, Graceful Wipe Out Attack, Living Off The Land, PHP-CGI RCE Attack on Japanese Organizations, Suspicious Regsvr32 Activity
|
2025-05-02
|
Detect Remote Access Software Usage File
|
Sysmon EventID 11
|
T1219
|
Anomaly
|
CISA AA24-241A, Cactus Ransomware, Command And Control, Gozi Malware, Insider Threat, Ransomware, Remote Monitoring and Management Software, Seashell Blizzard
|
2025-05-02
|
Detect Remote Access Software Usage FileInfo
|
Sysmon EventID 1
|
T1219
|
Anomaly
|
Cactus Ransomware, Command And Control, Gozi Malware, Insider Threat, Ransomware, Remote Monitoring and Management Software, Seashell Blizzard
|
2025-05-02
|
Detect Remote Access Software Usage Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1219
|
Anomaly
|
CISA AA24-241A, Cactus Ransomware, Command And Control, Gozi Malware, Insider Threat, Ransomware, Remote Monitoring and Management Software, Seashell Blizzard
|
2025-05-02
|
Detect Remote Access Software Usage Registry
|
Sysmon EventID 12, Sysmon EventID 13
|
T1219
|
Anomaly
|
CISA AA24-241A, Cactus Ransomware, Command And Control, Gozi Malware, Insider Threat, Ransomware, Remote Monitoring and Management Software, Seashell Blizzard
|
2025-05-02
|
Detect Renamed 7-Zip
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1560.001
|
Hunting
|
Collection and Staging
|
2025-05-02
|
Detect Renamed PSExec
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1569.002
|
Hunting
|
Active Directory Lateral Movement, BlackByte Ransomware, CISA AA22-320A, Cactus Ransomware, China-Nexus Threat Activity, DHS Report TA18-074A, DarkGate Malware, DarkSide Ransomware, HAFNIUM Group, Medusa Ransomware, Rhysida Ransomware, Salt Typhoon, SamSam Ransomware, Sandworm Tools, VanHelsing Ransomware
|
2025-05-02
|
Detect Renamed RClone
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1020
|
Hunting
|
Black Basta Ransomware, Cactus Ransomware, DarkSide Ransomware, Ransomware
|
2025-05-02
|
Detect Renamed WinRAR
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1560.001
|
Hunting
|
CISA AA22-277A, China-Nexus Threat Activity, Collection and Staging, Salt Typhoon
|
2025-05-02
|
Detect RTLO In File Name
|
Sysmon EventID 11
|
T1036.002
|
TTP
|
Spearphishing Attachments
|
2025-05-02
|
Detect RTLO In Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.002
|
TTP
|
Spearphishing Attachments
|
2025-05-02
|
Detect Rundll32 Application Control Bypass - advpack
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
TTP
|
Compromised Windows Host, Living Off The Land, Suspicious Rundll32 Activity
|
2025-05-02
|
Detect Rundll32 Application Control Bypass - setupapi
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
TTP
|
Compromised Windows Host, Living Off The Land, Suspicious Rundll32 Activity
|
2025-05-02
|
Detect Rundll32 Application Control Bypass - syssetup
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
TTP
|
Compromised Windows Host, Living Off The Land, Suspicious Rundll32 Activity
|
2025-05-02
|
Detect Rundll32 Inline HTA Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.005
|
TTP
|
Living Off The Land, NOBELIUM Group, Suspicious MSHTA Activity
|
2025-05-02
|
Detect SharpHound Command-Line Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.001
T1069.002
T1087.001
T1087.002
T1482
|
TTP
|
BlackSuit Ransomware, Ransomware, Windows Discovery Techniques
|
2025-05-02
|
Detect SharpHound File Modifications
|
Sysmon EventID 11
|
T1069.001
T1069.002
T1087.001
T1087.002
T1482
|
TTP
|
BlackSuit Ransomware, Ransomware, Windows Discovery Techniques
|
2025-05-02
|
Detect SharpHound Usage
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.001
T1069.002
T1087.001
T1087.002
T1482
|
TTP
|
Ransomware, Windows Discovery Techniques
|
2025-05-02
|
Detect suspicious processnames using pretrained model in DSDL
|
Sysmon EventID 1
|
T1059
|
Anomaly
|
Suspicious Command-Line Executions
|
2025-05-02
|
Detect Use of cmd exe to Launch Script Interpreters
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.003
|
TTP
|
Azorult, Emotet Malware DHS Report TA18-201A, Suspicious Command-Line Executions
|
2025-05-02
|
Detect WMI Event Subscription Persistence
|
Sysmon EventID 20
|
T1546.003
|
TTP
|
Suspicious WMI Use
|
2025-05-02
|
Detection of tools built by NirSoft
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1072
|
Anomaly
|
Emotet Malware DHS Report TA18-201A
|
2025-05-02
|
Disable AMSI Through Registry
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
CISA AA23-347A, Ransomware, Windows Registry Abuse
|
2025-05-02
|
Disable Defender AntiVirus Registry
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Black Basta Ransomware, CISA AA24-241A, Cactus Ransomware, IcedID, Windows Registry Abuse
|
2025-05-02
|
Disable Defender BlockAtFirstSeen Feature
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Azorult, CISA AA23-347A, IcedID, Windows Registry Abuse
|
2025-05-02
|
Disable Defender Enhanced Notification
|
Sysmon EventID 12, Sysmon EventID 13
|
T1562.001
|
TTP
|
Azorult, CISA AA23-347A, IcedID, Windows Registry Abuse
|
2025-05-02
|
Disable Defender MpEngine Registry
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
IcedID, Windows Registry Abuse
|
2025-05-02
|
Disable Defender Spynet Reporting
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Azorult, CISA AA23-347A, IcedID, Qakbot, Windows Registry Abuse
|
2025-05-02
|
Disable Defender Submit Samples Consent Feature
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Azorult, CISA AA23-347A, IcedID, Windows Registry Abuse
|
2025-05-02
|
Disable ETW Through Registry
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
CISA AA23-347A, Ransomware, Windows Registry Abuse
|
2025-05-02
|
Disable Logs Using WevtUtil
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1070.001
|
TTP
|
CISA AA23-347A, Ransomware, Rhysida Ransomware
|
2025-05-02
|
Disable Registry Tool
|
Sysmon EventID 13
|
T1112
T1562.001
|
TTP
|
NjRAT, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disable Schedule Task
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
TTP
|
IcedID, Living Off The Land
|
2025-05-02
|
Disable Security Logs Using MiniNt Registry
|
Sysmon EventID 13
|
T1112
|
TTP
|
CISA AA23-347A, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disable Show Hidden Files
|
Sysmon EventID 13
|
T1112
T1562.001
T1564.001
|
Anomaly
|
Azorult, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disable UAC Remote Restriction
|
Sysmon EventID 13
|
T1548.002
|
TTP
|
CISA AA23-347A, Suspicious Windows Registry Activities, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disable Windows App Hotkeys
|
Sysmon EventID 13
|
T1112
T1562.001
|
TTP
|
Windows Registry Abuse, XMRig
|
2025-05-02
|
Disable Windows Behavior Monitoring
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Azorult, Black Basta Ransomware, CISA AA23-347A, Cactus Ransomware, Ransomware, RedLine Stealer, Revil Ransomware, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disable Windows SmartScreen Protection
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
CISA AA23-347A, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
|
Powershell Script Block Logging 4104
|
T1558.004
|
TTP
|
Active Directory Kerberos Attacks, BlackSuit Ransomware, CISA AA23-347A
|
2025-05-02
|
Disabled Kerberos Pre-Authentication Discovery With PowerView
|
Powershell Script Block Logging 4104
|
T1558.004
|
TTP
|
Active Directory Kerberos Attacks
|
2025-05-02
|
Disabling CMD Application
|
Sysmon EventID 13
|
T1112
T1562.001
|
TTP
|
NjRAT, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disabling ControlPanel
|
Sysmon EventID 13
|
T1112
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disabling Defender Services
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
IcedID, RedLine Stealer, Windows Registry Abuse
|
2025-05-02
|
Disabling Firewall with Netsh
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
Anomaly
|
BlackByte Ransomware, Windows Defense Evasion Tactics
|
2025-05-02
|
Disabling FolderOptions Windows Feature
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
CISA AA23-347A, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disabling NoRun Windows App
|
Sysmon EventID 13
|
T1112
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disabling Remote User Account Control
|
Sysmon EventID 13
|
T1548.002
|
TTP
|
AgentTesla, Azorult, Remcos, Suspicious Windows Registry Activities, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disabling SystemRestore In Registry
|
Sysmon EventID 13
|
T1490
|
TTP
|
NjRAT, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disabling Task Manager
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
NjRAT, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Disabling Windows Local Security Authority Defences via Registry
|
Sysmon EventID 13
|
T1556
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
DLLHost with no Command Line Arguments with Network
|
Sysmon EventID 1, Sysmon EventID 3
|
T1055
|
TTP
|
BlackByte Ransomware, Cactus Ransomware, Cobalt Strike, Earth Alux, Graceful Wipe Out Attack, Storm-2460 CLFS Zero Day Exploitation
|
2025-05-02
|
DNS Exfiltration Using Nslookup App
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1048
|
TTP
|
Command And Control, Compromised Windows Host, Data Exfiltration, Dynamic DNS, Suspicious DNS Traffic
|
2025-05-02
|
Domain Account Discovery with Dsquery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1087.002
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Domain Account Discovery with Wmic
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1087.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Domain Controller Discovery with Nltest
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1018
|
TTP
|
Active Directory Discovery, BlackSuit Ransomware, CISA AA23-347A, Medusa Ransomware, Rhysida Ransomware
|
2025-05-02
|
Domain Controller Discovery with Wmic
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1018
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Domain Group Discovery with Adsisearcher
|
Powershell Script Block Logging 4104
|
T1069.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Domain Group Discovery With Dsquery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.002
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Domain Group Discovery With Wmic
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.002
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Download Files Using Telegram
|
Sysmon EventID 15
|
T1105
|
TTP
|
Crypto Stealer, Phemedrone Stealer, Snake Keylogger, Water Gamayun, XMRig
|
2025-05-02
|
Drop IcedID License dat
|
Sysmon EventID 11
|
T1204.002
|
Hunting
|
IcedID
|
2025-05-02
|
DSQuery Domain Discovery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1482
|
TTP
|
Active Directory Discovery, Compromised Windows Host, Domain Trust Discovery
|
2025-05-02
|
Dump LSASS via comsvcs DLL
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.001
|
TTP
|
CISA AA22-257A, CISA AA22-264A, Compromised Windows Host, Credential Dumping, Data Destruction, Flax Typhoon, HAFNIUM Group, Industroyer2, Living Off The Land, Prestige Ransomware, Suspicious Rundll32 Activity, Volt Typhoon
|
2025-05-02
|
Dump LSASS via procdump
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.001
|
TTP
|
CISA AA22-257A, Compromised Windows Host, Credential Dumping, HAFNIUM Group, Seashell Blizzard, Storm-2460 CLFS Zero Day Exploitation
|
2025-05-02
|
Elevated Group Discovery with PowerView
|
Powershell Script Block Logging 4104
|
T1069.002
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Elevated Group Discovery With Wmic
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Enable RDP In Other Port Number
|
Sysmon EventID 13
|
T1021
|
TTP
|
Prohibited Traffic Allowed or Protocol Mismatch, Windows Registry Abuse
|
2025-05-02
|
Enable WDigest UseLogonCredential Registry
|
Sysmon EventID 13
|
T1112
T1003
|
TTP
|
CISA AA22-320A, Credential Dumping, Windows Registry Abuse
|
2025-05-02
|
Enumerate Users Local Group Using Telegram
|
Windows Event Log Security 4798
|
T1087
|
TTP
|
Compromised Windows Host, Water Gamayun, XMRig
|
2025-05-02
|
Esentutl SAM Copy
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.002
|
Hunting
|
Credential Dumping, Living Off The Land
|
2025-05-02
|
ETW Registry Disabled
|
Sysmon EventID 13
|
T1127
T1562.006
|
TTP
|
CISA AA23-347A, Data Destruction, Hermetic Wiper, Windows Persistence Techniques, Windows Privilege Escalation, Windows Registry Abuse
|
2025-05-02
|
Eventvwr UAC Bypass
|
Sysmon EventID 13
|
T1548.002
|
TTP
|
IcedID, Living Off The Land, ValleyRAT, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Excessive Attempt To Disable Services
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1489
|
Anomaly
|
Azorult, XMRig
|
2025-05-02
|
Excessive distinct processes from Windows Temp
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059
|
Anomaly
|
Meterpreter
|
2025-05-02
|
Excessive File Deletion In WinDefender Folder
|
Sysmon EventID 23, Sysmon EventID 26
|
T1485
|
TTP
|
BlackByte Ransomware, Data Destruction, WhisperGate
|
2025-05-02
|
Excessive number of service control start as disabled
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
Anomaly
|
Windows Defense Evasion Tactics
|
2025-05-02
|
Excessive number of taskhost processes
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059
|
Anomaly
|
Meterpreter
|
2025-05-02
|
Excessive Usage Of Cacls App
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1222
|
Anomaly
|
Azorult, Crypto Stealer, Defense Evasion or Unauthorized Access Via SDDL Tampering, Prestige Ransomware, Windows Post-Exploitation, XMRig
|
2025-05-02
|
Excessive Usage of NSLOOKUP App
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1048
|
Anomaly
|
Command And Control, Data Exfiltration, Dynamic DNS, Suspicious DNS Traffic
|
2025-05-02
|
Excessive Usage Of SC Service Utility
|
Sysmon EventID 1
|
T1569.002
|
Anomaly
|
Azorult, Crypto Stealer, Ransomware
|
2025-05-02
|
Excessive Usage Of Taskkill
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
Anomaly
|
AgentTesla, Azorult, CISA AA22-264A, CISA AA22-277A, Crypto Stealer, NjRAT, XMRig
|
2025-05-02
|
Exchange PowerShell Abuse via SSRF
|
|
T1190
T1133
|
TTP
|
BlackByte Ransomware, ProxyNotShell, ProxyShell, Seashell Blizzard
|
2025-05-02
|
Exchange PowerShell Module Usage
|
Powershell Script Block Logging 4104
|
T1059.001
|
TTP
|
BlackByte Ransomware, CISA AA22-264A, CISA AA22-277A, ProxyNotShell, ProxyShell
|
2025-05-02
|
Executable File Written in Administrative SMB Share
|
Windows Event Log Security 5145
|
T1021.002
|
TTP
|
Active Directory Lateral Movement, BlackSuit Ransomware, Compromised Windows Host, Data Destruction, Graceful Wipe Out Attack, Hermetic Wiper, IcedID, Industroyer2, Prestige Ransomware, Trickbot, VanHelsing Ransomware
|
2025-05-02
|
Execute Javascript With Jscript COM CLSID
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.005
|
TTP
|
Ransomware
|
2025-05-02
|
Execution of File with Multiple Extensions
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.003
|
TTP
|
AsyncRAT, DarkGate Malware, Masquerading - Rename System Utilities, Windows File Extension and Association Abuse
|
2025-05-02
|
File with Samsam Extension
|
Sysmon EventID 11
|
|
TTP
|
SamSam Ransomware
|
2025-05-02
|
Firewall Allowed Program Enable
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.004
|
Anomaly
|
Azorult, BlackByte Ransomware, Medusa Ransomware, NjRAT, PlugX, Windows Defense Evasion Tactics
|
2025-05-02
|
First Time Seen Running Windows Service
|
Windows Event Log System 7036
|
T1569.002
|
Anomaly
|
NOBELIUM Group, Orangeworm Attack Group, Windows Service Abuse
|
2025-05-02
|
FodHelper UAC Bypass
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1112
T1548.002
|
TTP
|
Compromised Windows Host, IcedID, ValleyRAT, Windows Defense Evasion Tactics
|
2025-05-02
|
Get ADDefaultDomainPasswordPolicy with Powershell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1201
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Get ADDefaultDomainPasswordPolicy with Powershell Script Block
|
Powershell Script Block Logging 4104
|
T1201
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Get ADUser with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1087.002
|
Hunting
|
Active Directory Discovery, CISA AA23-347A
|
2025-05-02
|
Get ADUser with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1087.002
|
Hunting
|
Active Directory Discovery, CISA AA23-347A
|
2025-05-02
|
Get ADUserResultantPasswordPolicy with Powershell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1201
|
TTP
|
Active Directory Discovery, CISA AA23-347A
|
2025-05-02
|
Get ADUserResultantPasswordPolicy with Powershell Script Block
|
Powershell Script Block Logging 4104
|
T1201
|
TTP
|
Active Directory Discovery, CISA AA23-347A
|
2025-05-02
|
Get DomainPolicy with Powershell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1201
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Get DomainPolicy with Powershell Script Block
|
Powershell Script Block Logging 4104
|
T1201
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Get-DomainTrust with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1482
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Get-DomainTrust with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1482
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Get DomainUser with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1087.002
|
TTP
|
Active Directory Discovery, CISA AA23-347A
|
2025-05-02
|
Get DomainUser with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1087.002
|
TTP
|
Active Directory Discovery, CISA AA23-347A
|
2025-05-02
|
Get-ForestTrust with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1482
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Get-ForestTrust with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1482
T1059.001
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Get WMIObject Group Discovery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.001
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Get WMIObject Group Discovery with Script Block Logging
|
Powershell Script Block Logging 4104
|
T1069.001
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
GetAdComputer with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1018
|
Hunting
|
Active Directory Discovery, Medusa Ransomware
|
2025-05-02
|
GetAdComputer with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1018
|
Hunting
|
Active Directory Discovery, CISA AA22-320A, Gozi Malware, Medusa Ransomware
|
2025-05-02
|
GetAdGroup with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.002
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
GetAdGroup with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1069.002
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
GetCurrent User with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1033
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
GetCurrent User with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1033
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
GetDomainComputer with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1018
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
GetDomainComputer with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1018
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
GetDomainController with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1018
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
GetDomainController with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1018
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
GetDomainGroup with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
GetDomainGroup with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1069.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
GetLocalUser with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1087.001
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
GetLocalUser with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1059.001
T1087.001
|
Hunting
|
Active Directory Discovery, Malicious PowerShell
|
2025-05-02
|
GetNetTcpconnection with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1049
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
GetNetTcpconnection with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1049
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
GetWmiObject Ds Computer with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1018
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
GetWmiObject Ds Computer with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1018
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
GetWmiObject Ds Group with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
GetWmiObject Ds Group with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1069.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
GetWmiObject DS User with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1087.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
GetWmiObject DS User with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1087.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
GetWmiObject User Account with PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1087.001
|
Hunting
|
Active Directory Discovery, Water Gamayun, Winter Vivern
|
2025-05-02
|
GetWmiObject User Account with PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1059.001
T1087.001
|
Hunting
|
Active Directory Discovery, Malicious PowerShell, Winter Vivern
|
2025-05-02
|
GPUpdate with no Command Line Arguments with Network
|
Sysmon EventID 1, Sysmon EventID 3
|
T1055
|
TTP
|
BlackByte Ransomware, Cobalt Strike, Compromised Windows Host, Graceful Wipe Out Attack
|
2025-05-02
|
Headless Browser Mockbin or Mocky Request
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1564.003
|
TTP
|
Forest Blizzard
|
2025-05-02
|
Headless Browser Usage
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1564.003
|
Hunting
|
Forest Blizzard
|
2025-05-02
|
Hide User Account From Sign-In Screen
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Azorult, Warzone RAT, Windows Registry Abuse, XMRig
|
2025-05-02
|
Hiding Files And Directories With Attrib exe
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1222.001
|
TTP
|
Azorult, Compromised Windows Host, Crypto Stealer, Windows Defense Evasion Tactics, Windows Persistence Techniques
|
2025-05-02
|
High Frequency Copy Of Files In Network Share
|
Windows Event Log Security 5145
|
T1537
|
Anomaly
|
Information Sabotage, Insider Threat
|
2025-05-02
|
High Process Termination Frequency
|
Sysmon EventID 5
|
T1486
|
Anomaly
|
BlackByte Ransomware, Clop Ransomware, Crypto Stealer, LockBit Ransomware, Medusa Ransomware, Rhysida Ransomware, Snake Keylogger, Termite Ransomware
|
2025-05-02
|
Hunting 3CXDesktopApp Software
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1195.002
|
Hunting
|
3CX Supply Chain Attack
|
2025-05-02
|
Icacls Deny Command
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1222
|
TTP
|
Azorult, Compromised Windows Host, Crypto Stealer, Defense Evasion or Unauthorized Access Via SDDL Tampering, Sandworm Tools, XMRig
|
2025-05-02
|
ICACLS Grant Command
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1222
|
Anomaly
|
Crypto Stealer, Defense Evasion or Unauthorized Access Via SDDL Tampering, Ransomware, XMRig
|
2025-05-02
|
IcedID Exfiltrated Archived File Creation
|
Sysmon EventID 11
|
T1560.001
|
Hunting
|
IcedID
|
2025-05-02
|
Impacket Lateral Movement Commandline Parameters
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.002
T1021.003
T1047
T1543.003
|
TTP
|
Active Directory Lateral Movement, CISA AA22-277A, Compromised Windows Host, Data Destruction, Gozi Malware, Graceful Wipe Out Attack, Industroyer2, Prestige Ransomware, Volt Typhoon, WhisperGate
|
2025-05-02
|
Impacket Lateral Movement smbexec CommandLine Parameters
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.002
T1021.003
T1047
T1543.003
|
TTP
|
Active Directory Lateral Movement, CISA AA22-277A, Compromised Windows Host, Data Destruction, Graceful Wipe Out Attack, Industroyer2, Prestige Ransomware, Volt Typhoon, WhisperGate
|
2025-05-02
|
Impacket Lateral Movement WMIExec Commandline Parameters
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.002
T1021.003
T1047
T1543.003
|
TTP
|
Active Directory Lateral Movement, CISA AA22-277A, Compromised Windows Host, Data Destruction, Gozi Malware, Graceful Wipe Out Attack, Industroyer2, Prestige Ransomware, Volt Typhoon, WhisperGate
|
2025-05-02
|
Interactive Session on Remote Endpoint with PowerShell
|
Powershell Script Block Logging 4104
|
T1021.006
|
TTP
|
Active Directory Lateral Movement
|
2025-05-02
|
Java Writing JSP File
|
Sysmon for Linux EventID 1, Sysmon for Linux EventID 11
|
T1190
T1133
|
TTP
|
Atlassian Confluence Server and Data Center CVE-2022-26134, SAP NetWeaver Exploitation, Spring4Shell CVE-2022-22965, SysAid On-Prem Software CVE-2023-47246 Vulnerability
|
2025-05-02
|
Jscript Execution Using Cscript App
|
CrowdStrike ProcessRollup2, Sysmon EventID 1
|
T1059.007
|
TTP
|
FIN7, Remcos
|
2025-05-02
|
Kerberoasting spn request with RC4 encryption
|
Windows Event Log Security 4769
|
T1558.003
|
TTP
|
Active Directory Kerberos Attacks, Compromised Windows Host, Data Destruction, Hermetic Wiper, Windows Privilege Escalation
|
2025-05-02
|
Kerberos Pre-Authentication Flag Disabled in UserAccountControl
|
Windows Event Log Security 4738
|
T1558.004
|
TTP
|
Active Directory Kerberos Attacks, BlackSuit Ransomware
|
2025-05-02
|
Kerberos Pre-Authentication Flag Disabled with PowerShell
|
Powershell Script Block Logging 4104
|
T1558.004
|
TTP
|
Active Directory Kerberos Attacks
|
2025-05-02
|
Kerberos Service Ticket Request Using RC4 Encryption
|
Windows Event Log Security 4769
|
T1558.001
|
TTP
|
Active Directory Kerberos Attacks, Active Directory Privilege Escalation
|
2025-05-02
|
Kerberos TGT Request Using RC4 Encryption
|
Windows Event Log Security 4768
|
T1550
|
TTP
|
Active Directory Kerberos Attacks
|
2025-05-02
|
Kerberos User Enumeration
|
Windows Event Log Security 4768
|
T1589.002
|
Anomaly
|
Active Directory Kerberos Attacks
|
2025-05-02
|
Linux Account Manipulation Of SSH Config and Keys
|
Sysmon for Linux EventID 11
|
T1070.004
T1485
|
Anomaly
|
AcidRain
|
2025-05-02
|
Linux Add Files In Known Crontab Directories
|
Sysmon for Linux EventID 11
|
T1053.003
|
Anomaly
|
Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks, XorDDos
|
2025-05-02
|
Linux Add User Account
|
Sysmon for Linux EventID 1
|
T1136.001
|
Hunting
|
Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Adding Crontab Using List Parameter
|
Sysmon for Linux EventID 1
|
T1053.003
|
Hunting
|
Data Destruction, Gomir, Industroyer2, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks
|
2025-05-02
|
Linux apt-get Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux APT Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux At Allow Config File Creation
|
Sysmon for Linux EventID 11
|
T1053.003
|
Anomaly
|
Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks
|
2025-05-02
|
Linux At Application Execution
|
Sysmon for Linux EventID 1
|
T1053.002
|
Anomaly
|
Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks
|
2025-05-02
|
Linux Auditd Add User Account
|
Linux Auditd Proctitle
|
T1136.001
|
Anomaly
|
Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Add User Account Type
|
Linux Auditd Add User
|
T1136.001
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd At Application Execution
|
Linux Auditd Syscall
|
T1053.002
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks
|
2025-05-02
|
Linux Auditd Auditd Service Stop
|
Linux Auditd Service Stop
|
T1489
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Base64 Decode Files
|
Linux Auditd Execve
|
T1140
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Change File Owner To Root
|
Linux Auditd Proctitle
|
T1222.002
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Clipboard Data Copy
|
Linux Auditd Execve
|
T1115
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land
|
2025-05-02
|
Linux Auditd Data Destruction Command
|
Linux Auditd Proctitle
|
T1485
|
TTP
|
AwfulShred, Compromised Linux Host, Data Destruction
|
2025-05-02
|
Linux Auditd Data Transfer Size Limits Via Split
|
Linux Auditd Execve
|
T1030
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Data Transfer Size Limits Via Split Syscall
|
Linux Auditd Syscall
|
T1030
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Database File And Directory Discovery
|
Linux Auditd Execve
|
T1083
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Dd File Overwrite
|
Linux Auditd Proctitle
|
T1485
|
TTP
|
Compromised Linux Host, Data Destruction, Industroyer2
|
2025-05-02
|
Linux Auditd Disable Or Modify System Firewall
|
Linux Auditd Service Stop
|
T1562.004
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Doas Conf File Creation
|
Linux Auditd Path
|
T1548.003
|
TTP
|
Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Doas Tool Execution
|
Linux Auditd Syscall
|
T1548.003
|
Anomaly
|
Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Edit Cron Table Parameter
|
Linux Auditd Syscall
|
T1053.003
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks
|
2025-05-02
|
Linux Auditd File And Directory Discovery
|
Linux Auditd Execve
|
T1083
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd File Permission Modification Via Chmod
|
Linux Auditd Proctitle
|
T1222.002
|
Anomaly
|
China-Nexus Threat Activity, Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Salt Typhoon, XorDDos
|
2025-05-02
|
Linux Auditd File Permissions Modification Via Chattr
|
Linux Auditd Execve
|
T1222.002
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Find Credentials From Password Managers
|
Linux Auditd Execve
|
T1555.005
|
TTP
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Find Credentials From Password Stores
|
Linux Auditd Execve
|
T1555.005
|
TTP
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Find Ssh Private Keys
|
Linux Auditd Execve
|
T1552.004
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Hardware Addition Swapoff
|
Linux Auditd Execve
|
T1200
|
Anomaly
|
AwfulShred, Compromised Linux Host, Data Destruction
|
2025-05-02
|
Linux Auditd Hidden Files And Directories Creation
|
Linux Auditd Execve
|
T1083
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Insert Kernel Module Using Insmod Utility
|
Linux Auditd Syscall
|
T1547.006
|
Anomaly
|
Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Linux Rootkit, XorDDos
|
2025-05-02
|
Linux Auditd Install Kernel Module Using Modprobe Utility
|
Linux Auditd Syscall
|
T1547.006
|
Anomaly
|
Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Linux Rootkit
|
2025-05-02
|
Linux Auditd Kernel Module Enumeration
|
Linux Auditd Syscall
|
T1082
T1014
|
Anomaly
|
Compromised Linux Host, Linux Rootkit, XorDDos
|
2025-05-02
|
Linux Auditd Kernel Module Using Rmmod Utility
|
Linux Auditd Syscall
|
T1547.006
|
TTP
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Nopasswd Entry In Sudoers File
|
Linux Auditd Proctitle
|
T1548.003
|
Anomaly
|
China-Nexus Threat Activity, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Salt Typhoon
|
2025-05-02
|
Linux Auditd Osquery Service Stop
|
Linux Auditd Service Stop
|
T1489
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Possible Access Or Modification Of Sshd Config File
|
Linux Auditd Path
|
T1098.004
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Possible Access To Credential Files
|
Linux Auditd Proctitle
|
T1003.008
|
Anomaly
|
China-Nexus Threat Activity, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Salt Typhoon
|
2025-05-02
|
Linux Auditd Possible Access To Sudoers File
|
Linux Auditd Path
|
T1548.003
|
Anomaly
|
China-Nexus Threat Activity, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Salt Typhoon
|
2025-05-02
|
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File
|
Linux Auditd Path
|
T1053.003
|
Hunting
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks, XorDDos
|
2025-05-02
|
Linux Auditd Preload Hijack Library Calls
|
Linux Auditd Execve
|
T1574.006
|
TTP
|
China-Nexus Threat Activity, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Salt Typhoon
|
2025-05-02
|
Linux Auditd Preload Hijack Via Preload File
|
Linux Auditd Path
|
T1574.006
|
TTP
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Private Keys and Certificate Enumeration
|
Linux Auditd Execve
|
T1552.004
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Service Restarted
|
Linux Auditd Proctitle
|
T1053.006
|
Anomaly
|
AwfulShred, Compromised Linux Host, Data Destruction, Gomir, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks
|
2025-05-02
|
Linux Auditd Service Started
|
Linux Auditd Proctitle
|
T1569.002
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Setuid Using Chmod Utility
|
Linux Auditd Proctitle
|
T1548.001
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Setuid Using Setcap Utility
|
Linux Auditd Execve
|
T1548.001
|
TTP
|
Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Shred Overwrite Command
|
Linux Auditd Proctitle
|
T1485
|
TTP
|
AwfulShred, Compromised Linux Host, Data Destruction, Industroyer2, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Stop Services
|
Linux Auditd Service Stop
|
T1489
|
Hunting
|
AwfulShred, Compromised Linux Host, Data Destruction, Industroyer2
|
2025-05-02
|
Linux Auditd Sudo Or Su Execution
|
Linux Auditd Proctitle
|
T1548.003
|
Anomaly
|
Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Sysmon Service Stop
|
Linux Auditd Service Stop
|
T1489
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd System Network Configuration Discovery
|
Linux Auditd Syscall
|
T1016
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Unix Shell Configuration Modification
|
Linux Auditd Path
|
T1546.004
|
TTP
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Unload Module Via Modprobe
|
Linux Auditd Execve
|
T1547.006
|
TTP
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Virtual Disk File And Directory Discovery
|
Linux Auditd Execve
|
T1083
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Auditd Whoami User Discovery
|
Linux Auditd Syscall
|
T1033
|
Anomaly
|
Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux AWK Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Busybox Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux c89 Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux c99 Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Change File Owner To Root
|
Sysmon for Linux EventID 1
|
T1222.002
|
Anomaly
|
Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Clipboard Data Copy
|
Sysmon for Linux EventID 1
|
T1115
|
Anomaly
|
Linux Living Off The Land
|
2025-05-02
|
Linux Common Process For Elevation Control
|
Sysmon for Linux EventID 1
|
T1548.001
|
Hunting
|
China-Nexus Threat Activity, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Salt Typhoon
|
2025-05-02
|
Linux Composer Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Cpulimit Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Csvtool Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Curl Upload File
|
Sysmon for Linux EventID 1
|
T1105
|
TTP
|
Data Exfiltration, Ingress Tool Transfer, Linux Living Off The Land
|
2025-05-02
|
Linux Data Destruction Command
|
Sysmon for Linux EventID 1
|
T1485
|
TTP
|
AwfulShred, Data Destruction
|
2025-05-02
|
Linux DD File Overwrite
|
Sysmon for Linux EventID 1
|
T1485
|
TTP
|
Data Destruction, Industroyer2
|
2025-05-02
|
Linux Decode Base64 to Shell
|
Sysmon for Linux EventID 1
|
T1027
T1059.004
|
TTP
|
Linux Living Off The Land
|
2025-05-02
|
Linux Deleting Critical Directory Using RM Command
|
Sysmon for Linux EventID 1
|
T1485
|
TTP
|
AwfulShred, Data Destruction, Industroyer2
|
2025-05-02
|
Linux Deletion Of Cron Jobs
|
Sysmon for Linux EventID 11
|
T1070.004
T1485
|
Anomaly
|
AcidPour, AcidRain, Data Destruction
|
2025-05-02
|
Linux Deletion Of Init Daemon Script
|
Sysmon for Linux EventID 11
|
T1070.004
T1485
|
TTP
|
AcidPour, AcidRain, Data Destruction
|
2025-05-02
|
Linux Deletion Of Services
|
Sysmon for Linux EventID 11
|
T1070.004
T1485
|
TTP
|
AcidPour, AcidRain, AwfulShred, Data Destruction
|
2025-05-02
|
Linux Deletion of SSL Certificate
|
Sysmon for Linux EventID 11
|
T1070.004
T1485
|
Anomaly
|
AcidPour, AcidRain
|
2025-05-02
|
Linux Disable Services
|
Sysmon for Linux EventID 1
|
T1489
|
TTP
|
AwfulShred, Data Destruction, Industroyer2
|
2025-05-02
|
Linux Doas Conf File Creation
|
Sysmon for Linux EventID 11
|
T1548.003
|
Anomaly
|
Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Doas Tool Execution
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Docker Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Edit Cron Table Parameter
|
Sysmon for Linux EventID 1
|
T1053.003
|
Hunting
|
Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks
|
2025-05-02
|
Linux Emacs Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux File Created In Kernel Driver Directory
|
Sysmon for Linux EventID 11
|
T1547.006
|
Anomaly
|
Linux Persistence Techniques, Linux Privilege Escalation, Linux Rootkit
|
2025-05-02
|
Linux File Creation In Init Boot Directory
|
Sysmon for Linux EventID 11
|
T1037.004
|
Anomaly
|
Backdoor Pingpong, China-Nexus Threat Activity, Linux Persistence Techniques, Linux Privilege Escalation, XorDDos
|
2025-05-02
|
Linux File Creation In Profile Directory
|
Sysmon for Linux EventID 11
|
T1546.004
|
Anomaly
|
Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Find Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux GDB Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Gem Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux GNU Awk Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Hardware Addition SwapOff
|
Sysmon for Linux EventID 1
|
T1200
|
Anomaly
|
AwfulShred, Data Destruction
|
2025-05-02
|
Linux High Frequency Of File Deletion In Boot Folder
|
Sysmon for Linux EventID 11
|
T1070.004
T1485
|
TTP
|
AcidPour, Data Destruction, Industroyer2
|
2025-05-02
|
Linux High Frequency Of File Deletion In Etc Folder
|
Sysmon for Linux EventID 11
|
T1070.004
T1485
|
Anomaly
|
AcidRain, Data Destruction
|
2025-05-02
|
Linux Impair Defenses Process Kill
|
Sysmon for Linux EventID 1
|
T1562.001
|
Hunting
|
AwfulShred, Data Destruction
|
2025-05-02
|
Linux Indicator Removal Clear Cache
|
Sysmon for Linux EventID 1
|
T1070
|
TTP
|
AwfulShred, Data Destruction
|
2025-05-02
|
Linux Indicator Removal Service File Deletion
|
Sysmon for Linux EventID 1
|
T1070.004
|
Anomaly
|
AwfulShred, Data Destruction
|
2025-05-02
|
Linux Ingress Tool Transfer Hunting
|
Sysmon for Linux EventID 1
|
T1105
|
Hunting
|
Ingress Tool Transfer, Linux Living Off The Land, XorDDos
|
2025-05-02
|
Linux Ingress Tool Transfer with Curl
|
Sysmon for Linux EventID 1
|
T1105
|
Anomaly
|
Ingress Tool Transfer, Linux Living Off The Land, XorDDos
|
2025-05-02
|
Linux Insert Kernel Module Using Insmod Utility
|
Sysmon for Linux EventID 1
|
T1547.006
|
Anomaly
|
Linux Persistence Techniques, Linux Privilege Escalation, Linux Rootkit, XorDDos
|
2025-05-02
|
Linux Install Kernel Module Using Modprobe Utility
|
Sysmon for Linux EventID 1
|
T1547.006
|
Anomaly
|
Linux Persistence Techniques, Linux Privilege Escalation, Linux Rootkit
|
2025-05-02
|
Linux Iptables Firewall Modification
|
Sysmon for Linux EventID 1
|
T1562.004
|
Anomaly
|
Backdoor Pingpong, China-Nexus Threat Activity, Cyclops Blink, Sandworm Tools
|
2025-05-02
|
Linux Java Spawning Shell
|
Sysmon for Linux EventID 1
|
T1190
T1133
|
TTP
|
Data Destruction, Hermetic Wiper, Log4Shell CVE-2021-44228, Spring4Shell CVE-2022-22965
|
2025-05-02
|
Linux Kernel Module Enumeration
|
Sysmon for Linux EventID 1
|
T1082
T1014
|
Anomaly
|
Linux Rootkit, XorDDos
|
2025-05-02
|
Linux Kworker Process In Writable Process Path
|
Sysmon for Linux EventID 1
|
T1036.004
|
Hunting
|
Cyclops Blink, Sandworm Tools
|
2025-05-02
|
Linux Make Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux MySQL Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Ngrok Reverse Proxy Usage
|
Sysmon for Linux EventID 1
|
T1572
T1090
T1102
|
Anomaly
|
Reverse Network Proxy
|
2025-05-02
|
Linux Node Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux NOPASSWD Entry In Sudoers File
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
China-Nexus Threat Activity, Linux Persistence Techniques, Linux Privilege Escalation, Salt Typhoon
|
2025-05-02
|
Linux Obfuscated Files or Information Base64 Decode
|
Sysmon for Linux EventID 1
|
T1027
|
Anomaly
|
Linux Living Off The Land
|
2025-05-02
|
Linux Octave Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux OpenVPN Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Persistence and Privilege Escalation Risk Behavior
|
|
T1548
|
Correlation
|
Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux PHP Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux pkexec Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1068
|
TTP
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Possible Access Or Modification Of sshd Config File
|
Sysmon for Linux EventID 1
|
T1098.004
|
Anomaly
|
Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Possible Access To Credential Files
|
Sysmon for Linux EventID 1
|
T1003.008
|
Anomaly
|
China-Nexus Threat Activity, Linux Persistence Techniques, Linux Privilege Escalation, Salt Typhoon, XorDDos
|
2025-05-02
|
Linux Possible Access To Sudoers File
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
China-Nexus Threat Activity, Linux Persistence Techniques, Linux Privilege Escalation, Salt Typhoon
|
2025-05-02
|
Linux Possible Append Command To At Allow Config File
|
Sysmon for Linux EventID 1
|
T1053.002
|
Anomaly
|
Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks
|
2025-05-02
|
Linux Possible Append Command To Profile Config File
|
Sysmon for Linux EventID 1
|
T1546.004
|
Anomaly
|
Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Possible Append Cronjob Entry on Existing Cronjob File
|
Sysmon for Linux EventID 1
|
T1053.003
|
Hunting
|
Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks, XorDDos
|
2025-05-02
|
Linux Possible Cronjob Modification With Editor
|
Sysmon for Linux EventID 1
|
T1053.003
|
Hunting
|
Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks, XorDDos
|
2025-05-02
|
Linux Possible Ssh Key File Creation
|
Sysmon for Linux EventID 11
|
T1098.004
|
Anomaly
|
Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Preload Hijack Library Calls
|
Sysmon for Linux EventID 1
|
T1574.006
|
TTP
|
China-Nexus Threat Activity, Linux Persistence Techniques, Linux Privilege Escalation, Salt Typhoon
|
2025-05-02
|
Linux Proxy Socks Curl
|
Sysmon for Linux EventID 1
|
T1090
T1095
|
TTP
|
Ingress Tool Transfer, Linux Living Off The Land
|
2025-05-02
|
Linux Puppet Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux RPM Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Ruby Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux Service File Created In Systemd Directory
|
Sysmon for Linux EventID 11
|
T1053.006
|
Anomaly
|
Gomir, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks
|
2025-05-02
|
Linux Service Restarted
|
Sysmon for Linux EventID 1
|
T1053.006
|
Anomaly
|
AwfulShred, Data Destruction, Gomir, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks
|
2025-05-02
|
Linux Service Started Or Enabled
|
Sysmon for Linux EventID 1
|
T1053.006
|
Anomaly
|
Gomir, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation, Scheduled Tasks
|
2025-05-02
|
Linux Setuid Using Chmod Utility
|
Sysmon for Linux EventID 1
|
T1548.001
|
Anomaly
|
Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Setuid Using Setcap Utility
|
Sysmon for Linux EventID 1
|
T1548.001
|
Anomaly
|
Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Shred Overwrite Command
|
Sysmon for Linux EventID 1
|
T1485
|
TTP
|
AwfulShred, Data Destruction, Industroyer2, Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Sqlite3 Privilege Escalation
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Living Off The Land, Linux Privilege Escalation
|
2025-05-02
|
Linux SSH Authorized Keys Modification
|
Sysmon for Linux EventID 1
|
T1098.004
|
Anomaly
|
Linux Living Off The Land
|
2025-05-02
|
Linux SSH Remote Services Script Execute
|
Sysmon for Linux EventID 1
|
T1021.004
|
TTP
|
Linux Living Off The Land
|
2025-05-02
|
Linux Stdout Redirection To Dev Null File
|
Sysmon for Linux EventID 1
|
T1562.004
|
Anomaly
|
Cyclops Blink, Data Destruction, Industroyer2
|
2025-05-02
|
Linux Stop Services
|
Sysmon for Linux EventID 1
|
T1489
|
TTP
|
AwfulShred, Data Destruction, Industroyer2
|
2025-05-02
|
Linux Sudo OR Su Execution
|
Sysmon for Linux EventID 1
|
T1548.003
|
Hunting
|
Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Linux Sudoers Tmp File Creation
|
Sysmon for Linux EventID 11
|
T1548.003
|
Anomaly
|
China-Nexus Threat Activity, Linux Persistence Techniques, Linux Privilege Escalation, Salt Typhoon
|
2025-05-02
|
Linux System Network Discovery
|
Sysmon for Linux EventID 1
|
T1016
|
Anomaly
|
Data Destruction, Industroyer2, Network Discovery
|
2025-05-02
|
Linux System Reboot Via System Request Key
|
Sysmon for Linux EventID 1
|
T1529
|
TTP
|
AwfulShred, Data Destruction
|
2025-05-02
|
Linux Unix Shell Enable All SysRq Functions
|
Sysmon for Linux EventID 1
|
T1059.004
|
Anomaly
|
AwfulShred, Data Destruction
|
2025-05-02
|
Linux Visudo Utility Execution
|
Sysmon for Linux EventID 1
|
T1548.003
|
Anomaly
|
Linux Persistence Techniques, Linux Privilege Escalation
|
2025-05-02
|
Living Off The Land Detection
|
|
T1105
T1190
T1059
T1133
|
Correlation
|
Living Off The Land
|
2025-05-02
|
Loading Of Dynwrapx Module
|
Sysmon EventID 7
|
T1055.001
|
TTP
|
AsyncRAT, Remcos
|
2025-05-02
|
Local Account Discovery With Wmic
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1087.001
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Log4Shell CVE-2021-44228 Exploitation
|
|
T1105
T1190
T1059
T1133
|
Correlation
|
CISA AA22-320A, Log4Shell CVE-2021-44228
|
2025-05-02
|
Logon Script Event Trigger Execution
|
Sysmon EventID 13
|
T1037.001
|
TTP
|
Data Destruction, Hermetic Wiper, Windows Persistence Techniques, Windows Privilege Escalation
|
2025-05-02
|
MacOS plutil
|
osquery
|
T1647
|
TTP
|
Living Off The Land
|
2025-05-02
|
Mailsniper Invoke functions
|
Powershell Script Block Logging 4104
|
T1114.001
|
TTP
|
Data Exfiltration
|
2025-05-02
|
Malicious InProcServer32 Modification
|
Sysmon EventID 12, Sysmon EventID 13
|
T1218.010
T1112
|
TTP
|
Remcos, Suspicious Regsvr32 Activity
|
2025-05-02
|
Malicious Powershell Executed As A Service
|
Windows Event Log System 7045
|
T1569.002
|
TTP
|
Compromised Windows Host, Malicious PowerShell, Rhysida Ransomware
|
2025-05-02
|
Malicious PowerShell Process - Encoded Command
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1027
|
Hunting
|
CISA AA22-320A, Crypto Stealer, DarkCrystal RAT, Data Destruction, Hermetic Wiper, Lumma Stealer, Malicious PowerShell, NOBELIUM Group, Qakbot, Sandworm Tools, Volt Typhoon, WhisperGate
|
2025-05-02
|
Malicious PowerShell Process With Obfuscation Techniques
|
Sysmon EventID 1
|
T1059.001
|
TTP
|
Data Destruction, Hermetic Wiper, Malicious PowerShell
|
2025-05-02
|
Microsoft Defender ATP Alerts
|
MS Defender ATP Alerts
|
|
TTP
|
Critical Alerts
|
2025-05-02
|
Microsoft Defender Incident Alerts
|
MS365 Defender Incident Alerts
|
|
TTP
|
Critical Alerts
|
2025-05-02
|
Mimikatz PassTheTicket CommandLine Parameters
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1550.003
|
TTP
|
Active Directory Kerberos Attacks, CISA AA22-320A, CISA AA23-347A, Sandworm Tools
|
2025-05-02
|
Mmc LOLBAS Execution Process Spawn
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.003
T1218.014
|
TTP
|
Active Directory Lateral Movement, Living Off The Land, Water Gamayun
|
2025-05-02
|
Modification Of Wallpaper
|
Sysmon EventID 13
|
T1491
|
TTP
|
Black Basta Ransomware, BlackMatter Ransomware, Brute Ratel C4, LockBit Ransomware, Ransomware, Revil Ransomware, Rhysida Ransomware, Windows Registry Abuse
|
2025-05-02
|
Modify ACL permission To Files Or Folder
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1222
|
Anomaly
|
Crypto Stealer, Defense Evasion or Unauthorized Access Via SDDL Tampering, XMRig
|
2025-05-02
|
Monitor Registry Keys for Print Monitors
|
Sysmon EventID 13
|
T1547.010
|
TTP
|
Suspicious Windows Registry Activities, Windows Persistence Techniques, Windows Registry Abuse
|
2025-05-02
|
MOVEit Certificate Store Access Failure
|
|
T1190
|
Hunting
|
MOVEit Transfer Authentication Bypass
|
2025-05-02
|
MOVEit Empty Key Fingerprint Authentication Attempt
|
|
T1190
|
Hunting
|
MOVEit Transfer Authentication Bypass
|
2025-05-02
|
MS Exchange Mailbox Replication service writing Active Server Pages
|
Sysmon EventID 1, Sysmon EventID 11
|
T1133
T1190
T1505.003
|
TTP
|
BlackByte Ransomware, ProxyShell, Ransomware
|
2025-05-02
|
MS Scripting Process Loading Ldap Module
|
Sysmon EventID 7
|
T1059.007
|
Anomaly
|
FIN7
|
2025-05-02
|
MS Scripting Process Loading WMI Module
|
Sysmon EventID 7
|
T1059.007
|
Anomaly
|
FIN7
|
2025-05-02
|
MSBuild Suspicious Spawned By Script Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1127.001
|
TTP
|
Storm-2460 CLFS Zero Day Exploitation, Trusted Developer Utilities Proxy Execution MSBuild
|
2025-05-02
|
Mshta spawning Rundll32 OR Regsvr32 Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.005
|
TTP
|
IcedID, Living Off The Land, Trickbot
|
2025-05-02
|
MSI Module Loaded by Non-System Binary
|
Sysmon EventID 7
|
T1574.001
|
Hunting
|
Data Destruction, Hermetic Wiper, Windows Privilege Escalation
|
2025-05-02
|
Msmpeng Application DLL Side Loading
|
Sysmon EventID 11
|
T1574.001
|
TTP
|
Ransomware, Revil Ransomware
|
2025-05-02
|
NET Profiler UAC bypass
|
Sysmon EventID 13
|
T1548.002
|
TTP
|
Windows Defense Evasion Tactics
|
2025-05-02
|
Network Connection Discovery With Arp
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1049
|
Hunting
|
Active Directory Discovery, IcedID, Prestige Ransomware, Qakbot, Volt Typhoon, Windows Post-Exploitation
|
2025-05-02
|
Network Connection Discovery With Netstat
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1049
|
Hunting
|
Active Directory Discovery, CISA AA22-277A, CISA AA23-347A, Medusa Ransomware, PlugX, Prestige Ransomware, Qakbot, Volt Typhoon, Windows Post-Exploitation
|
2025-05-02
|
Network Discovery Using Route Windows App
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1016.001
|
Hunting
|
Active Directory Discovery, CISA AA22-277A, Prestige Ransomware, Qakbot, Windows Post-Exploitation
|
2025-05-02
|
Network Share Discovery Via Dir Command
|
Windows Event Log Security 5140
|
T1135
|
Hunting
|
IcedID
|
2025-05-02
|
Network Traffic to Active Directory Web Services Protocol
|
Sysmon EventID 3
|
T1069.001
T1069.002
T1087.001
T1087.002
T1482
|
Hunting
|
Windows Discovery Techniques
|
2025-05-02
|
Nishang PowershellTCPOneLine
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.001
|
TTP
|
Cleo File Transfer Software, HAFNIUM Group
|
2025-05-02
|
NLTest Domain Trust Discovery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1482
|
TTP
|
Active Directory Discovery, Cleo File Transfer Software, Domain Trust Discovery, IcedID, Medusa Ransomware, Qakbot, Rhysida Ransomware, Ryuk Ransomware
|
2025-05-02
|
Non Chrome Process Accessing Chrome Default Dir
|
Windows Event Log Security 4663
|
T1555.003
|
Anomaly
|
3CX Supply Chain Attack, AgentTesla, CISA AA23-347A, China-Nexus Threat Activity, DarkGate Malware, FIN7, NjRAT, Phemedrone Stealer, RedLine Stealer, Remcos, Salt Typhoon, Snake Keylogger, SnappyBee, Warzone RAT
|
2025-05-02
|
Non Firefox Process Access Firefox Profile Dir
|
Windows Event Log Security 4663
|
T1555.003
|
Anomaly
|
3CX Supply Chain Attack, AgentTesla, Azorult, CISA AA23-347A, China-Nexus Threat Activity, DarkGate Malware, FIN7, NjRAT, Phemedrone Stealer, RedLine Stealer, Remcos, Salt Typhoon, Snake Keylogger, SnappyBee, Warzone RAT
|
2025-05-02
|
Notepad with no Command Line Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055
|
TTP
|
BishopFox Sliver Adversary Emulation Framework
|
2025-05-02
|
Ntdsutil Export NTDS
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.003
|
TTP
|
Credential Dumping, HAFNIUM Group, Living Off The Land, Prestige Ransomware, Rhysida Ransomware, Volt Typhoon
|
2025-05-02
|
Outbound Network Connection from Java Using Default Ports
|
Sysmon EventID 1, Sysmon EventID 3
|
T1190
T1133
|
TTP
|
Log4Shell CVE-2021-44228
|
2025-05-02
|
Overwriting Accessibility Binaries
|
Sysmon EventID 11
|
T1546.008
|
TTP
|
Data Destruction, Flax Typhoon, Hermetic Wiper, Windows Privilege Escalation
|
2025-05-02
|
PaperCut NG Suspicious Behavior Debug Log
|
|
T1190
T1133
|
Hunting
|
PaperCut MF NG Vulnerability
|
2025-05-02
|
Permission Modification using Takeown App
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1222
|
Anomaly
|
Crypto Stealer, Ransomware, Sandworm Tools
|
2025-05-02
|
PetitPotam Network Share Access Request
|
Windows Event Log Security 5145
|
T1187
|
TTP
|
PetitPotam NTLM Relay on Active Directory Certificate Services
|
2025-05-02
|
PetitPotam Suspicious Kerberos TGT Request
|
Windows Event Log Security 4768
|
T1003
|
TTP
|
Active Directory Kerberos Attacks, PetitPotam NTLM Relay on Active Directory Certificate Services
|
2025-05-02
|
Possible Browser Pass View Parameter
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1555.003
|
Hunting
|
Remcos
|
2025-05-02
|
Possible Lateral Movement PowerShell Spawn
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.003
T1021.006
T1047
T1053.005
T1059.001
T1218.014
T1543.003
|
TTP
|
Active Directory Lateral Movement, CISA AA24-241A, Data Destruction, Hermetic Wiper, Malicious PowerShell, Scheduled Tasks
|
2025-05-02
|
Potential password in username
|
Linux Secure
|
T1078.003
T1552.001
|
Hunting
|
Credential Dumping, Insider Threat
|
2025-05-02
|
Potential System Network Configuration Discovery Activity
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1016
|
Anomaly
|
Unusual Processes
|
2025-05-02
|
Potential Telegram API Request Via CommandLine
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1102.002
T1041
|
Anomaly
|
Water Gamayun, XMRig
|
2025-05-02
|
Potentially malicious code on commandline
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.003
|
Anomaly
|
Suspicious Command-Line Executions
|
2025-05-02
|
PowerShell 4104 Hunting
|
Powershell Script Block Logging 4104
|
T1059.001
|
Hunting
|
Braodo Stealer, CISA AA23-347A, CISA AA24-241A, Cactus Ransomware, China-Nexus Threat Activity, Cleo File Transfer Software, DarkGate Malware, Data Destruction, Flax Typhoon, Hermetic Wiper, Lumma Stealer, Malicious PowerShell, Medusa Ransomware, PHP-CGI RCE Attack on Japanese Organizations, Rhysida Ransomware, Salt Typhoon, SystemBC, Water Gamayun, XWorm
|
2025-05-02
|
PowerShell - Connect To Internet With Hidden Window
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.001
|
Hunting
|
AgentTesla, Data Destruction, HAFNIUM Group, Hermetic Wiper, Log4Shell CVE-2021-44228, Malicious PowerShell, Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
|
2025-05-02
|
Powershell COM Hijacking InprocServer32 Modification
|
Powershell Script Block Logging 4104
|
T1059.001
T1546.015
|
TTP
|
Malicious PowerShell
|
2025-05-02
|
Powershell Creating Thread Mutex
|
Powershell Script Block Logging 4104
|
T1027.005
T1059.001
|
TTP
|
Malicious PowerShell, Water Gamayun
|
2025-05-02
|
Powershell Disable Security Monitoring
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
TTP
|
CISA AA24-241A, Ransomware, Revil Ransomware
|
2025-05-02
|
PowerShell Domain Enumeration
|
Powershell Script Block Logging 4104
|
T1059.001
|
TTP
|
CISA AA23-347A, Data Destruction, Hermetic Wiper, Malicious PowerShell
|
2025-05-02
|
PowerShell Enable PowerShell Remoting
|
Powershell Script Block Logging 4104
|
T1059.001
|
Anomaly
|
Malicious PowerShell
|
2025-05-02
|
Powershell Enable SMB1Protocol Feature
|
Powershell Script Block Logging 4104
|
T1027.005
|
TTP
|
Data Destruction, Hermetic Wiper, Malicious PowerShell, Ransomware
|
2025-05-02
|
Powershell Execute COM Object
|
Powershell Script Block Logging 4104
|
T1059.001
T1546.015
|
TTP
|
Data Destruction, Hermetic Wiper, Malicious PowerShell, Ransomware
|
2025-05-02
|
Powershell Fileless Process Injection via GetProcAddress
|
Powershell Script Block Logging 4104
|
T1055
T1059.001
|
TTP
|
Data Destruction, Hermetic Wiper, Malicious PowerShell
|
2025-05-02
|
PowerShell Get LocalGroup Discovery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.001
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Powershell Get LocalGroup Discovery with Script Block Logging
|
Powershell Script Block Logging 4104
|
T1069.001
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
PowerShell Invoke CIMMethod CIMSession
|
Powershell Script Block Logging 4104
|
T1047
|
Anomaly
|
Active Directory Lateral Movement, Malicious PowerShell
|
2025-05-02
|
PowerShell Invoke WmiExec Usage
|
Powershell Script Block Logging 4104
|
T1047
|
TTP
|
Suspicious WMI Use
|
2025-05-02
|
Powershell Load Module in Meterpreter
|
Powershell Script Block Logging 4104
|
T1059.001
|
TTP
|
MetaSploit
|
2025-05-02
|
Powershell Remote Services Add TrustedHost
|
Powershell Script Block Logging 4104
|
T1021.006
|
TTP
|
DarkGate Malware
|
2025-05-02
|
Powershell Remote Thread To Known Windows Process
|
Sysmon EventID 8
|
T1055
|
TTP
|
Trickbot
|
2025-05-02
|
Powershell Remove Windows Defender Directory
|
Powershell Script Block Logging 4104
|
T1562.001
|
TTP
|
Data Destruction, WhisperGate
|
2025-05-02
|
PowerShell Script Block With URL Chain
|
Powershell Script Block Logging 4104
|
T1059.001
T1105
|
TTP
|
Malicious PowerShell
|
2025-05-02
|
PowerShell Start-BitsTransfer
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1197
|
TTP
|
BITS Jobs, Gozi Malware
|
2025-05-02
|
PowerShell Start or Stop Service
|
Powershell Script Block Logging 4104
|
T1059.001
|
Anomaly
|
Active Directory Lateral Movement
|
2025-05-02
|
Powershell Using memory As Backing Store
|
Powershell Script Block Logging 4104
|
T1059.001
|
TTP
|
Data Destruction, Hermetic Wiper, IcedID, Malicious PowerShell, Medusa Ransomware, MoonPeak
|
2025-05-02
|
PowerShell WebRequest Using Memory Stream
|
Powershell Script Block Logging 4104
|
T1059.001
T1105
T1027.011
|
TTP
|
Malicious PowerShell, Medusa Ransomware, MoonPeak, PHP-CGI RCE Attack on Japanese Organizations
|
2025-05-02
|
Powershell Windows Defender Exclusion Commands
|
Powershell Script Block Logging 4104
|
T1562.001
|
TTP
|
AgentTesla, CISA AA22-320A, Data Destruction, Remcos, Warzone RAT, WhisperGate, Windows Defense Evasion Tactics
|
2025-05-02
|
Prevent Automatic Repair Mode using Bcdedit
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1490
|
TTP
|
Chaos Ransomware, Ransomware
|
2025-05-02
|
Print Processor Registry Autostart
|
Sysmon EventID 13
|
T1547.012
|
TTP
|
Data Destruction, Hermetic Wiper, Windows Persistence Techniques, Windows Privilege Escalation
|
2025-05-02
|
Print Spooler Adding A Printer Driver
|
Windows Event Log Printservice 316
|
T1547.012
|
TTP
|
Black Basta Ransomware, PrintNightmare CVE-2021-34527
|
2025-05-02
|
Print Spooler Failed to Load a Plug-in
|
Windows Event Log Printservice 4909, Windows Event Log Printservice 808
|
T1547.012
|
TTP
|
Black Basta Ransomware, PrintNightmare CVE-2021-34527
|
2025-05-02
|
Process Creating LNK file in Suspicious Location
|
Sysmon EventID 11
|
T1566.002
|
TTP
|
Amadey, Gozi Malware, IcedID, Qakbot, Spearphishing Attachments
|
2025-05-02
|
Process Deleting Its Process File Path
|
Sysmon EventID 1
|
T1070
|
TTP
|
Clop Ransomware, Data Destruction, Remcos, WhisperGate
|
2025-05-02
|
Process Execution via WMI
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1047
|
TTP
|
Suspicious WMI Use
|
2025-05-02
|
Process Kill Base On File Path
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
TTP
|
XMRig
|
2025-05-02
|
Process Writing DynamicWrapperX
|
Sysmon EventID 11
|
T1059
T1559.001
|
Hunting
|
Remcos
|
2025-05-02
|
Processes launching netsh
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.004
|
Anomaly
|
Azorult, DHS Report TA18-074A, Disabling Security Tools, Netsh Abuse, ShrinkLocker, Snake Keylogger, Volt Typhoon
|
2025-05-02
|
Processes Tapping Keyboard Events
|
|
|
TTP
|
ColdRoot MacOS RAT
|
2025-05-02
|
Randomly Generated Scheduled Task Name
|
Windows Event Log Security 4698
|
T1053.005
|
Hunting
|
Active Directory Lateral Movement, CISA AA22-257A, Scheduled Tasks
|
2025-05-02
|
Randomly Generated Windows Service Name
|
Windows Event Log System 7045
|
T1543.003
|
Hunting
|
Active Directory Lateral Movement, BlackSuit Ransomware
|
2025-05-02
|
Ransomware Notes bulk creation
|
Sysmon EventID 11
|
T1486
|
Anomaly
|
Black Basta Ransomware, BlackMatter Ransomware, Cactus Ransomware, Chaos Ransomware, Clop Ransomware, DarkSide Ransomware, LockBit Ransomware, Medusa Ransomware, Rhysida Ransomware, Termite Ransomware
|
2025-05-02
|
Recon Using WMI Class
|
Powershell Script Block Logging 4104
|
T1592
T1059.001
|
Anomaly
|
AsyncRAT, Data Destruction, Hermetic Wiper, Industroyer2, LockBit Ransomware, Malicious PowerShell, MoonPeak, Qakbot
|
2025-05-02
|
Recursive Delete of Directory In Batch CMD
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1070.004
|
TTP
|
Ransomware
|
2025-05-02
|
Reg exe Manipulating Windows Services Registry Keys
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1574.011
|
TTP
|
Living Off The Land, Windows Persistence Techniques, Windows Service Abuse
|
2025-05-02
|
Registry Keys for Creating SHIM Databases
|
Sysmon EventID 13
|
T1546.011
|
TTP
|
Suspicious Windows Registry Activities, Windows Persistence Techniques, Windows Registry Abuse
|
2025-05-02
|
Registry Keys Used For Privilege Escalation
|
Sysmon EventID 13
|
T1546.012
|
TTP
|
Cloud Federated Credential Abuse, Data Destruction, Hermetic Wiper, Suspicious Windows Registry Activities, Windows Privilege Escalation, Windows Registry Abuse
|
2025-05-02
|
Regsvr32 Silent and Install Param Dll Loading
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.010
|
Anomaly
|
AsyncRAT, Data Destruction, Hermetic Wiper, Living Off The Land, Remcos, Suspicious Regsvr32 Activity
|
2025-05-02
|
Regsvr32 with Known Silent Switch Cmdline
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.010
|
Anomaly
|
AsyncRAT, IcedID, Living Off The Land, Qakbot, Remcos, Suspicious Regsvr32 Activity
|
2025-05-02
|
Remcos client registry install entry
|
Sysmon EventID 12, Sysmon EventID 13
|
T1112
|
TTP
|
Remcos, Windows Registry Abuse
|
2025-05-02
|
Remcos RAT File Creation in Remcos Folder
|
Sysmon EventID 11
|
T1113
|
TTP
|
Remcos
|
2025-05-02
|
Remote Desktop Process Running On System
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.001
|
Hunting
|
Active Directory Lateral Movement, Hidden Cobra Malware
|
2025-05-02
|
Remote Process Instantiation via DCOM and PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.003
|
TTP
|
Active Directory Lateral Movement, Compromised Windows Host
|
2025-05-02
|
Remote Process Instantiation via DCOM and PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1021.003
|
TTP
|
Active Directory Lateral Movement
|
2025-05-02
|
Remote Process Instantiation via WinRM and PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.006
|
TTP
|
Active Directory Lateral Movement
|
2025-05-02
|
Remote Process Instantiation via WinRM and PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1021.006
|
TTP
|
Active Directory Lateral Movement
|
2025-05-02
|
Remote Process Instantiation via WinRM and Winrs
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.006
|
TTP
|
Active Directory Lateral Movement
|
2025-05-02
|
Remote Process Instantiation via WMI
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1047
|
TTP
|
Active Directory Lateral Movement, CISA AA23-347A, China-Nexus Threat Activity, Ransomware, Salt Typhoon, Suspicious WMI Use
|
2025-05-02
|
Remote Process Instantiation via WMI and PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1047
|
TTP
|
Active Directory Lateral Movement, Compromised Windows Host
|
2025-05-02
|
Remote Process Instantiation via WMI and PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1047
|
TTP
|
Active Directory Lateral Movement
|
2025-05-02
|
Remote System Discovery with Adsisearcher
|
Powershell Script Block Logging 4104
|
T1018
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Remote System Discovery with Dsquery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1018
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Remote System Discovery with Wmic
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1018
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Remote WMI Command Attempt
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1047
|
TTP
|
CISA AA23-347A, Graceful Wipe Out Attack, IcedID, Living Off The Land, Suspicious WMI Use, Volt Typhoon
|
2025-05-02
|
Resize ShadowStorage volume
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1490
|
TTP
|
BlackByte Ransomware, Clop Ransomware, Compromised Windows Host, Medusa Ransomware, VanHelsing Ransomware
|
2025-05-02
|
Revil Common Exec Parameter
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1204
|
TTP
|
Ransomware, Revil Ransomware
|
2025-05-02
|
Revil Registry Entry
|
Sysmon EventID 12, Sysmon EventID 13
|
T1112
|
TTP
|
Ransomware, Revil Ransomware, Windows Registry Abuse
|
2025-05-02
|
Rubeus Command Line Parameters
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1550.003
T1558.003
T1558.004
|
TTP
|
Active Directory Kerberos Attacks, Active Directory Privilege Escalation, BlackSuit Ransomware, CISA AA23-347A
|
2025-05-02
|
Rubeus Kerberos Ticket Exports Through Winlogon Access
|
Sysmon EventID 10
|
T1550.003
|
TTP
|
Active Directory Kerberos Attacks, BlackSuit Ransomware, CISA AA23-347A
|
2025-05-02
|
Runas Execution in CommandLine
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1134.001
|
Hunting
|
Data Destruction, Hermetic Wiper, Windows Privilege Escalation
|
2025-05-02
|
Rundll32 Control RunDLL Hunt
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
Hunting
|
Living Off The Land, Microsoft MSHTML Remote Code Execution CVE-2021-40444, Suspicious Rundll32 Activity
|
2025-05-02
|
Rundll32 Control RunDLL World Writable Directory
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
TTP
|
Compromised Windows Host, Living Off The Land, Microsoft MSHTML Remote Code Execution CVE-2021-40444, Suspicious Rundll32 Activity
|
2025-05-02
|
Rundll32 Create Remote Thread To A Process
|
Sysmon EventID 8
|
T1055
|
TTP
|
IcedID, Living Off The Land
|
2025-05-02
|
Rundll32 CreateRemoteThread In Browser
|
Sysmon EventID 8
|
T1055
|
TTP
|
IcedID, Living Off The Land
|
2025-05-02
|
Rundll32 LockWorkStation
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
Anomaly
|
Ransomware
|
2025-05-02
|
Rundll32 Process Creating Exe Dll Files
|
Sysmon EventID 11
|
T1218.011
|
TTP
|
IcedID, Living Off The Land
|
2025-05-02
|
Rundll32 Shimcache Flush
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1112
|
TTP
|
Compromised Windows Host, Living Off The Land, Unusual Processes
|
2025-05-02
|
Rundll32 with no Command Line Arguments with Network
|
Sysmon EventID 1, Sysmon EventID 3
|
T1218.011
|
TTP
|
BlackByte Ransomware, BlackSuit Ransomware, Cactus Ransomware, Cobalt Strike, Compromised Windows Host, Graceful Wipe Out Attack, PrintNightmare CVE-2021-34527, Suspicious Rundll32 Activity
|
2025-05-02
|
RunDLL Loading DLL By Ordinal
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
TTP
|
IcedID, Living Off The Land, Suspicious Rundll32 Activity, Unusual Processes
|
2025-05-02
|
Ryuk Test Files Detected
|
Sysmon EventID 11
|
T1486
|
TTP
|
Ryuk Ransomware
|
2025-05-02
|
Ryuk Wake on LAN Command
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.003
|
TTP
|
Compromised Windows Host, Ryuk Ransomware
|
2025-05-02
|
SAM Database File Access Attempt
|
Windows Event Log Security 4663
|
T1003.002
|
Hunting
|
Credential Dumping, Graceful Wipe Out Attack, Rhysida Ransomware
|
2025-05-02
|
Samsam Test File Write
|
Sysmon EventID 11
|
T1486
|
TTP
|
SamSam Ransomware
|
2025-05-02
|
Sc exe Manipulating Windows Services
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1543.003
|
TTP
|
Azorult, Crypto Stealer, DHS Report TA18-074A, Disabling Security Tools, NOBELIUM Group, Orangeworm Attack Group, Windows Drivers, Windows Persistence Techniques, Windows Service Abuse
|
2025-05-02
|
SchCache Change By App Connect And Create ADSI Object
|
Sysmon EventID 11
|
T1087.002
|
Anomaly
|
BlackMatter Ransomware
|
2025-05-02
|
Schedule Task with HTTP Command Arguments
|
Windows Event Log Security 4698
|
T1053
|
TTP
|
Compromised Windows Host, Living Off The Land, Scheduled Tasks, Windows Persistence Techniques, Winter Vivern
|
2025-05-02
|
Schedule Task with Rundll32 Command Trigger
|
Windows Event Log Security 4698
|
T1053
|
TTP
|
Compromised Windows Host, IcedID, Living Off The Land, Scheduled Tasks, Trickbot, Windows Persistence Techniques
|
2025-05-02
|
Scheduled Task Creation on Remote Endpoint using At
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1053.002
|
TTP
|
Active Directory Lateral Movement, Living Off The Land, Scheduled Tasks
|
2025-05-02
|
Scheduled Task Initiation on Remote Endpoint
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1053.005
|
TTP
|
Active Directory Lateral Movement, Living Off The Land, Medusa Ransomware, Scheduled Tasks, Seashell Blizzard
|
2025-05-02
|
Schtasks Run Task On Demand
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1053
|
TTP
|
CISA AA22-257A, Data Destruction, Industroyer2, Medusa Ransomware, Qakbot, Scheduled Tasks, XMRig
|
2025-05-02
|
Schtasks used for forcing a reboot
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1053.005
|
TTP
|
Ransomware, Scheduled Tasks, Windows Persistence Techniques
|
2025-05-02
|
Screensaver Event Trigger Execution
|
Sysmon EventID 13
|
T1546.002
|
TTP
|
Data Destruction, Hermetic Wiper, Windows Persistence Techniques, Windows Privilege Escalation, Windows Registry Abuse
|
2025-05-02
|
Script Execution via WMI
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1047
|
TTP
|
Suspicious WMI Use
|
2025-05-02
|
Sdclt UAC Bypass
|
Sysmon EventID 12, Sysmon EventID 13
|
T1548.002
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Sdelete Application Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1070.004
T1485
|
TTP
|
Masquerading - Rename System Utilities
|
2025-05-02
|
SearchProtocolHost with no Command Line with Network
|
Sysmon EventID 1, Sysmon EventID 3
|
T1055
|
TTP
|
BlackByte Ransomware, Cactus Ransomware, Cobalt Strike, Compromised Windows Host, Graceful Wipe Out Attack
|
2025-05-02
|
SecretDumps Offline NTDS Dumping Tool
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.003
|
TTP
|
Compromised Windows Host, Credential Dumping, Graceful Wipe Out Attack, Rhysida Ransomware
|
2025-05-02
|
ServicePrincipalNames Discovery with PowerShell
|
Powershell Script Block Logging 4104
|
T1558.003
|
TTP
|
Active Directory Discovery, Active Directory Kerberos Attacks, Active Directory Privilege Escalation, Malicious PowerShell
|
2025-05-02
|
ServicePrincipalNames Discovery with SetSPN
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1558.003
|
TTP
|
Active Directory Discovery, Active Directory Kerberos Attacks, Active Directory Privilege Escalation, Compromised Windows Host
|
2025-05-02
|
Services Escalate Exe
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1548
|
TTP
|
BlackByte Ransomware, CISA AA23-347A, Cobalt Strike, Compromised Windows Host, Graceful Wipe Out Attack
|
2025-05-02
|
Services LOLBAS Execution Process Spawn
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1543.003
|
TTP
|
Active Directory Lateral Movement, CISA AA23-347A, Living Off The Land, Qakbot
|
2025-05-02
|
Set Default PowerShell Execution Policy To Unrestricted or Bypass
|
Sysmon EventID 12, Sysmon EventID 13
|
T1059.001
|
TTP
|
Credential Dumping, DarkGate Malware, Data Destruction, HAFNIUM Group, Hermetic Wiper, Malicious PowerShell, SystemBC
|
2025-05-02
|
Shim Database File Creation
|
Sysmon EventID 11
|
T1546.011
|
TTP
|
Windows Persistence Techniques
|
2025-05-02
|
Shim Database Installation With Suspicious Parameters
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1546.011
|
TTP
|
Compromised Windows Host, Windows Persistence Techniques
|
2025-05-02
|
Short Lived Scheduled Task
|
Windows Event Log Security 4698, Windows Event Log Security 4699
|
T1053.005
|
TTP
|
Active Directory Lateral Movement, CISA AA22-257A, CISA AA23-347A, Compromised Windows Host, Scheduled Tasks
|
2025-05-02
|
Short Lived Windows Accounts
|
Windows Event Log System 4720, Windows Event Log System 4726
|
T1078.003
T1136.001
|
TTP
|
Active Directory Lateral Movement
|
2025-05-02
|
SilentCleanup UAC Bypass
|
Sysmon EventID 12, Sysmon EventID 13
|
T1548.002
|
TTP
|
MoonPeak, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Single Letter Process On Endpoint
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1204.002
|
TTP
|
Compromised Windows Host, DHS Report TA18-074A
|
2025-05-02
|
SLUI RunAs Elevated
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1548.002
|
TTP
|
Compromised Windows Host, DarkSide Ransomware, Windows Defense Evasion Tactics
|
2025-05-02
|
SLUI Spawning a Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1548.002
|
TTP
|
Compromised Windows Host, DarkSide Ransomware, Windows Defense Evasion Tactics
|
2025-05-02
|
Spike in File Writes
|
Sysmon EventID 11
|
|
Anomaly
|
Ransomware, Rhysida Ransomware, Ryuk Ransomware, SamSam Ransomware
|
2025-05-02
|
Spoolsv Spawning Rundll32
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1547.012
|
TTP
|
Black Basta Ransomware, Compromised Windows Host, PrintNightmare CVE-2021-34527
|
2025-05-02
|
Spoolsv Suspicious Loaded Modules
|
Sysmon EventID 7
|
T1547.012
|
TTP
|
Black Basta Ransomware, PrintNightmare CVE-2021-34527
|
2025-05-02
|
Spoolsv Suspicious Process Access
|
Sysmon EventID 10
|
T1068
|
TTP
|
Black Basta Ransomware, PrintNightmare CVE-2021-34527
|
2025-05-02
|
Spoolsv Writing a DLL
|
Sysmon EventID 1, Sysmon EventID 11, Windows Event Log Security 4688
|
T1547.012
|
TTP
|
Black Basta Ransomware, Compromised Windows Host, PrintNightmare CVE-2021-34527
|
2025-05-02
|
Spoolsv Writing a DLL - Sysmon
|
Sysmon EventID 11
|
T1547.012
|
TTP
|
Black Basta Ransomware, PrintNightmare CVE-2021-34527
|
2025-05-02
|
Sqlite Module In Temp Folder
|
Sysmon EventID 11
|
T1005
|
TTP
|
IcedID
|
2025-05-02
|
Steal or Forge Authentication Certificates Behavior Identified
|
|
T1649
|
Correlation
|
Windows Certificate Services
|
2025-05-02
|
Sunburst Correlation DLL and Network Event
|
Sysmon EventID 22, Sysmon EventID 7
|
T1203
|
TTP
|
NOBELIUM Group
|
2025-05-02
|
Suspicious Computer Account Name Change
|
Windows Event Log Security 4781
|
T1078.002
|
TTP
|
Active Directory Privilege Escalation, Compromised Windows Host, sAMAccountName Spoofing and Domain Controller Impersonation
|
2025-05-02
|
Suspicious Copy on System32
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.003
|
TTP
|
AsyncRAT, Compromised Windows Host, IcedID, Qakbot, Sandworm Tools, Unusual Processes, Volt Typhoon, Water Gamayun
|
2025-05-02
|
Suspicious Curl Network Connection
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
TTP
|
Ingress Tool Transfer, Linux Living Off The Land, Silver Sparrow
|
2025-05-02
|
Suspicious DLLHost no Command Line Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055
|
TTP
|
BlackByte Ransomware, Cactus Ransomware, Cobalt Strike, Graceful Wipe Out Attack
|
2025-05-02
|
Suspicious GPUpdate no Command Line Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055
|
TTP
|
BlackByte Ransomware, Cobalt Strike, Graceful Wipe Out Attack
|
2025-05-02
|
Suspicious IcedID Rundll32 Cmdline
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
TTP
|
IcedID, Living Off The Land
|
2025-05-02
|
Suspicious Image Creation In Appdata Folder
|
Sysmon EventID 1, Sysmon EventID 11
|
T1113
|
TTP
|
Remcos
|
2025-05-02
|
Suspicious Kerberos Service Ticket Request
|
Windows Event Log Security 4769
|
T1078.002
|
TTP
|
Active Directory Kerberos Attacks, Active Directory Privilege Escalation, sAMAccountName Spoofing and Domain Controller Impersonation
|
2025-05-02
|
Suspicious Linux Discovery Commands
|
Sysmon for Linux EventID 1
|
T1059.004
|
TTP
|
Linux Post-Exploitation
|
2025-05-02
|
Suspicious microsoft workflow compiler rename
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.003
T1127
|
Hunting
|
BlackByte Ransomware, Cobalt Strike, Graceful Wipe Out Attack, Living Off The Land, Masquerading - Rename System Utilities, Trusted Developer Utilities Proxy Execution
|
2025-05-02
|
Suspicious microsoft workflow compiler usage
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1127
|
TTP
|
Living Off The Land, Trusted Developer Utilities Proxy Execution
|
2025-05-02
|
Suspicious msbuild path
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.003
T1127.001
|
TTP
|
BlackByte Ransomware, Cobalt Strike, Graceful Wipe Out Attack, Living Off The Land, Masquerading - Rename System Utilities, Storm-2460 CLFS Zero Day Exploitation, Trusted Developer Utilities Proxy Execution MSBuild
|
2025-05-02
|
Suspicious MSBuild Rename
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.003
T1127.001
|
Hunting
|
BlackByte Ransomware, Cobalt Strike, Graceful Wipe Out Attack, Living Off The Land, Masquerading - Rename System Utilities, Storm-2460 CLFS Zero Day Exploitation, Trusted Developer Utilities Proxy Execution MSBuild
|
2025-05-02
|
Suspicious MSBuild Spawn
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1127.001
|
TTP
|
Living Off The Land, Storm-2460 CLFS Zero Day Exploitation, Trusted Developer Utilities Proxy Execution MSBuild
|
2025-05-02
|
Suspicious mshta spawn
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.005
|
TTP
|
Living Off The Land, Suspicious MSHTA Activity
|
2025-05-02
|
Suspicious PlistBuddy Usage
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1543.001
|
TTP
|
Silver Sparrow
|
2025-05-02
|
Suspicious PlistBuddy Usage via OSquery
|
|
T1543.001
|
TTP
|
Silver Sparrow
|
2025-05-02
|
Suspicious Process Executed From Container File
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1204.002
T1036.008
|
TTP
|
Amadey, Remcos, Snake Keylogger, Unusual Processes, Water Gamayun
|
2025-05-02
|
Suspicious Reg exe Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1112
|
Anomaly
|
DHS Report TA18-074A, Disabling Security Tools, Windows Defense Evasion Tactics
|
2025-05-02
|
Suspicious Regsvr32 Register Suspicious Path
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.010
|
TTP
|
China-Nexus Threat Activity, Derusbi, IcedID, Living Off The Land, Qakbot, Salt Typhoon, Suspicious Regsvr32 Activity
|
2025-05-02
|
Suspicious Rundll32 dllregisterserver
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
TTP
|
IcedID, Living Off The Land, Suspicious Rundll32 Activity
|
2025-05-02
|
Suspicious Rundll32 no Command Line Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
TTP
|
BlackByte Ransomware, Cobalt Strike, Graceful Wipe Out Attack, PrintNightmare CVE-2021-34527, Suspicious Rundll32 Activity
|
2025-05-02
|
Suspicious Rundll32 PluginInit
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
TTP
|
IcedID
|
2025-05-02
|
Suspicious Rundll32 StartW
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
TTP
|
BlackByte Ransomware, Cobalt Strike, Graceful Wipe Out Attack, Suspicious Rundll32 Activity, Trickbot
|
2025-05-02
|
Suspicious SearchProtocolHost no Command Line Arguments
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055
|
TTP
|
BlackByte Ransomware, Cactus Ransomware, Cobalt Strike, Graceful Wipe Out Attack
|
2025-05-02
|
Suspicious SQLite3 LSQuarantine Behavior
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1074
|
TTP
|
Silver Sparrow
|
2025-05-02
|
Suspicious Ticket Granting Ticket Request
|
Windows Event Log Security 4768, Windows Event Log Security 4781
|
T1078.002
|
Hunting
|
Active Directory Kerberos Attacks, Active Directory Privilege Escalation, sAMAccountName Spoofing and Domain Controller Impersonation
|
2025-05-02
|
Suspicious WAV file in Appdata Folder
|
Sysmon EventID 1, Sysmon EventID 11, Windows Event Log Security 4688
|
T1113
|
TTP
|
Remcos
|
2025-05-02
|
Suspicious wevtutil Usage
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1070.001
|
TTP
|
CISA AA23-347A, Clop Ransomware, Ransomware, Rhysida Ransomware, ShrinkLocker, Storm-2460 CLFS Zero Day Exploitation, Windows Log Manipulation
|
2025-05-02
|
Suspicious writes to windows Recycle Bin
|
Sysmon EventID 1, Sysmon EventID 11
|
T1036
|
TTP
|
Collection and Staging, PlugX
|
2025-05-02
|
Svchost LOLBAS Execution Process Spawn
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1053.005
|
TTP
|
Active Directory Lateral Movement, Living Off The Land, Scheduled Tasks
|
2025-05-02
|
System Info Gathering Using Dxdiag Application
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1592
|
Hunting
|
Remcos
|
2025-05-02
|
System Information Discovery Detection
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1082
|
TTP
|
BlackSuit Ransomware, Cleo File Transfer Software, Gozi Malware, Medusa Ransomware, Windows Discovery Techniques
|
2025-05-02
|
System Processes Run From Unexpected Locations
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.003
|
Anomaly
|
DarkGate Malware, Masquerading - Rename System Utilities, Qakbot, Ransomware, Suspicious Command-Line Executions, Unusual Processes, Windows Error Reporting Service Elevation of Privilege Vulnerability
|
2025-05-02
|
System User Discovery With Query
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1033
|
Hunting
|
Active Directory Discovery, Medusa Ransomware
|
2025-05-02
|
System User Discovery With Whoami
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1033
|
Hunting
|
Active Directory Discovery, CISA AA23-347A, PHP-CGI RCE Attack on Japanese Organizations, Qakbot, Rhysida Ransomware, Winter Vivern
|
2025-05-02
|
Time Provider Persistence Registry
|
Sysmon EventID 13
|
T1547.003
|
TTP
|
Data Destruction, Hermetic Wiper, Windows Persistence Techniques, Windows Privilege Escalation, Windows Registry Abuse
|
2025-05-02
|
Trickbot Named Pipe
|
Sysmon EventID 17, Sysmon EventID 18
|
T1055
|
TTP
|
Trickbot
|
2025-05-02
|
UAC Bypass MMC Load Unsigned Dll
|
Sysmon EventID 7
|
T1218.014
T1548.002
|
TTP
|
Windows Defense Evasion Tactics
|
2025-05-02
|
UAC Bypass With Colorui COM Object
|
Sysmon EventID 7
|
T1218.003
|
TTP
|
LockBit Ransomware, Ransomware
|
2025-05-02
|
Uninstall App Using MsiExec
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.007
|
TTP
|
Ransomware
|
2025-05-02
|
Unknown Process Using The Kerberos Protocol
|
Sysmon EventID 1, Sysmon EventID 3
|
T1550
|
TTP
|
Active Directory Kerberos Attacks, BlackSuit Ransomware
|
2025-05-02
|
Unload Sysmon Filter Driver
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
TTP
|
CISA AA23-347A, Disabling Security Tools
|
2025-05-02
|
Unloading AMSI via Reflection
|
Powershell Script Block Logging 4104
|
T1059.001
T1562
|
TTP
|
Data Destruction, Hermetic Wiper, Malicious PowerShell
|
2025-05-02
|
Unusual Number of Computer Service Tickets Requested
|
Windows Event Log Security 4769
|
T1078
|
Hunting
|
Active Directory Kerberos Attacks, Active Directory Lateral Movement, Active Directory Privilege Escalation
|
2025-05-02
|
Unusual Number of Kerberos Service Tickets Requested
|
Windows Event Log Security 4769
|
T1558.003
|
Anomaly
|
Active Directory Kerberos Attacks
|
2025-05-02
|
Unusual Number of Remote Endpoint Authentication Events
|
Windows Event Log Security 4624
|
T1078
|
Hunting
|
Active Directory Lateral Movement, Active Directory Privilege Escalation
|
2025-05-02
|
Unusually Long Command Line
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
|
Anomaly
|
Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns, Ransomware, Suspicious Command-Line Executions, Unusual Processes
|
2025-05-02
|
Unusually Long Command Line - MLTK
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
|
Anomaly
|
Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns, Ransomware, Suspicious Command-Line Executions, Unusual Processes
|
2025-05-02
|
User Discovery With Env Vars PowerShell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1033
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
User Discovery With Env Vars PowerShell Script Block
|
Powershell Script Block Logging 4104
|
T1033
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
USN Journal Deletion
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1070
|
TTP
|
Ransomware, Windows Log Manipulation
|
2025-05-02
|
Vbscript Execution Using Wscript App
|
CrowdStrike ProcessRollup2, Sysmon EventID 1
|
T1059.005
|
TTP
|
AsyncRAT, FIN7, Remcos
|
2025-05-02
|
Verclsid CLSID Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.012
|
Hunting
|
Unusual Processes
|
2025-05-02
|
W3WP Spawning Shell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1505.003
|
TTP
|
BlackByte Ransomware, CISA AA22-257A, CISA AA22-264A, Data Destruction, Flax Typhoon, HAFNIUM Group, Hermetic Wiper, PHP-CGI RCE Attack on Japanese Organizations, ProxyNotShell, ProxyShell, WS FTP Server Critical Vulnerabilities
|
2025-05-02
|
WBAdmin Delete System Backups
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1490
|
TTP
|
Chaos Ransomware, Prestige Ransomware, Ransomware, Ryuk Ransomware, Storm-2460 CLFS Zero Day Exploitation
|
2025-05-02
|
Wbemprox COM Object Execution
|
Sysmon EventID 7
|
T1218.003
|
TTP
|
LockBit Ransomware, Ransomware, Revil Ransomware
|
2025-05-02
|
Web Servers Executing Suspicious Processes
|
Sysmon EventID 1
|
T1082
|
TTP
|
Apache Struts Vulnerability
|
2025-05-02
|
Wermgr Process Create Executable File
|
Sysmon EventID 11
|
T1027
|
TTP
|
Trickbot
|
2025-05-02
|
Wermgr Process Spawned CMD Or Powershell Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059
|
TTP
|
Qakbot, Trickbot
|
2025-05-02
|
Wget Download and Bash Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
TTP
|
Compromised Windows Host, Ingress Tool Transfer, Log4Shell CVE-2021-44228
|
2025-05-02
|
Windows Access Token Manipulation SeDebugPrivilege
|
Windows Event Log Security 4703
|
T1134.002
|
Anomaly
|
AsyncRAT, Brute Ratel C4, CISA AA23-347A, China-Nexus Threat Activity, DarkGate Malware, Derusbi, Meduza Stealer, PlugX, Salt Typhoon, SnappyBee, ValleyRAT, WinDealer RAT
|
2025-05-02
|
Windows Access Token Manipulation Winlogon Duplicate Token Handle
|
Sysmon EventID 10
|
T1134.001
|
Hunting
|
Brute Ratel C4
|
2025-05-02
|
Windows Access Token Winlogon Duplicate Handle In Uncommon Path
|
Sysmon EventID 10
|
T1134.001
|
Anomaly
|
Brute Ratel C4
|
2025-05-02
|
Windows Account Access Removal via Logoff Exec
|
Sysmon EventID 1
|
T1059.001
T1531
|
Anomaly
|
Crypto Stealer
|
2025-05-02
|
Windows Account Discovery for None Disable User Account
|
Powershell Script Block Logging 4104
|
T1087.001
|
Hunting
|
CISA AA23-347A
|
2025-05-02
|
Windows Account Discovery for Sam Account Name
|
Powershell Script Block Logging 4104
|
T1087
|
Anomaly
|
CISA AA23-347A
|
2025-05-02
|
Windows Account Discovery With NetUser PreauthNotRequire
|
Powershell Script Block Logging 4104
|
T1087
|
Hunting
|
CISA AA23-347A
|
2025-05-02
|
Windows AD Abnormal Object Access Activity
|
Windows Event Log Security 4662
|
T1087.002
|
Anomaly
|
Active Directory Discovery, BlackSuit Ransomware
|
2025-05-02
|
Windows AD add Self to Group
|
Windows Event Log Security 4728
|
T1098
|
TTP
|
Active Directory Privilege Escalation, Medusa Ransomware, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD AdminSDHolder ACL Modified
|
Windows Event Log Security 5136
|
T1546
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Cross Domain SID History Addition
|
Windows Event Log Security 4738, Windows Event Log Security 4742
|
T1134.005
|
TTP
|
Compromised Windows Host, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Dangerous Deny ACL Modification
|
Windows Event Log Security 5136
|
T1222.001
T1484
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Dangerous Group ACL Modification
|
Windows Event Log Security 5136
|
T1222.001
T1484
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Dangerous User ACL Modification
|
Windows Event Log Security 5136
|
T1222.001
T1484
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD DCShadow Privileges ACL Addition
|
Windows Event Log Security 5136
|
T1484
T1207
T1222.001
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Domain Controller Audit Policy Disabled
|
Windows Event Log Security 4719
|
T1562.001
|
TTP
|
Windows Audit Policy Tampering
|
2025-05-02
|
Windows AD Domain Controller Promotion
|
Windows Event Log Security 4742
|
T1207
|
TTP
|
Compromised Windows Host, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Domain Replication ACL Addition
|
Windows Event Log Security 5136
|
T1484
|
TTP
|
Compromised Windows Host, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Domain Root ACL Deletion
|
Windows Event Log Security 5136
|
T1222.001
T1484
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Domain Root ACL Modification
|
Windows Event Log Security 5136
|
T1222.001
T1484
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD DSRM Account Changes
|
Sysmon EventID 12, Sysmon EventID 13
|
T1098
|
TTP
|
Sneaky Active Directory Persistence Tricks, Windows Persistence Techniques, Windows Registry Abuse
|
2025-05-02
|
Windows AD DSRM Password Reset
|
Windows Event Log Security 4794
|
T1098
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD GPO Deleted
|
Windows Event Log Security 5136
|
T1562.001
T1484.001
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD GPO Disabled
|
Windows Event Log Security 5136
|
T1562.001
T1484.001
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD GPO New CSE Addition
|
Windows Event Log Security 5136
|
T1222.001
T1484.001
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Hidden OU Creation
|
Windows Event Log Security 5136
|
T1222.001
T1484
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Object Owner Updated
|
Windows Event Log Security 5136
|
T1222.001
T1484
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Privileged Account SID History Addition
|
Windows Event Log Security 4738, Windows Event Log Security 4742
|
T1134.005
|
TTP
|
Compromised Windows Host, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Privileged Group Modification
|
Windows Event Log Security 4728
|
T1098
|
TTP
|
Active Directory Privilege Escalation, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Privileged Object Access Activity
|
Windows Event Log Security 4662
|
T1087.002
|
TTP
|
Active Directory Discovery, BlackSuit Ransomware
|
2025-05-02
|
Windows AD Replication Request Initiated by User Account
|
Windows Event Log Security 4662
|
T1003.006
|
TTP
|
Compromised Windows Host, Credential Dumping, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Same Domain SID History Addition
|
Windows Event Log Security 4738, Windows Event Log Security 4742
|
T1134.005
|
TTP
|
Compromised Windows Host, Sneaky Active Directory Persistence Tricks, Windows Persistence Techniques
|
2025-05-02
|
Windows AD Self DACL Assignment
|
Windows Event Log Security 5136
|
T1484
T1098
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD ServicePrincipalName Added To Domain Account
|
Windows Event Log Security 5136
|
T1098
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Short Lived Domain Account ServicePrincipalName
|
Windows Event Log Security 5136
|
T1098
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Short Lived Domain Controller SPN Attribute
|
Windows Event Log Security 4624, Windows Event Log Security 5136
|
T1207
|
TTP
|
Compromised Windows Host, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Short Lived Server Object
|
Windows Event Log Security 5137, Windows Event Log Security 5141
|
T1207
|
TTP
|
Compromised Windows Host, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD SID History Attribute Modified
|
Windows Event Log Security 5136
|
T1134.005
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Suspicious Attribute Modification
|
Windows Event Log Security 5136
|
T1222.001
T1550
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Suspicious GPO Modification
|
Windows Event Log Security 5136, Windows Event Log Security 5145
|
T1222.001
T1484.001
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AdFind Exe
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1018
|
TTP
|
BlackSuit Ransomware, Domain Trust Discovery, Graceful Wipe Out Attack, IcedID, NOBELIUM Group
|
2025-05-02
|
Windows Admin Permission Discovery
|
Sysmon EventID 11
|
T1069.001
|
Anomaly
|
NjRAT
|
2025-05-02
|
Windows Administrative Shares Accessed On Multiple Hosts
|
Windows Event Log Security 5140, Windows Event Log Security 5145
|
T1135
|
TTP
|
Active Directory Lateral Movement, Active Directory Privilege Escalation
|
2025-05-02
|
Windows Admon Default Group Policy Object Modified
|
Windows Active Directory Admon
|
T1484.001
|
TTP
|
Active Directory Privilege Escalation, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows Admon Group Policy Object Created
|
Windows Active Directory Admon
|
T1484.001
|
TTP
|
Active Directory Privilege Escalation, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows Alternate DataStream - Base64 Content
|
Sysmon EventID 15
|
T1564.004
|
TTP
|
Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Alternate DataStream - Executable Content
|
Sysmon EventID 15
|
T1564.004
|
TTP
|
Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Alternate DataStream - Process Execution
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1564.004
|
TTP
|
Compromised Windows Host, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Anonymous Pipe Activity
|
Sysmon EventID 17, Sysmon EventID 18
|
T1559
|
Hunting
|
China-Nexus Threat Activity, Salt Typhoon, SnappyBee
|
2025-05-02
|
Windows Apache Benchmark Binary
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059
|
Anomaly
|
MetaSploit
|
2025-05-02
|
Windows App Layer Protocol Qakbot NamedPipe
|
Sysmon EventID 17, Sysmon EventID 18
|
T1071
|
Anomaly
|
Qakbot
|
2025-05-02
|
Windows App Layer Protocol Wermgr Connect To NamedPipe
|
Sysmon EventID 17, Sysmon EventID 18
|
T1071
|
Anomaly
|
Qakbot
|
2025-05-02
|
Windows Application Layer Protocol RMS Radmin Tool Namedpipe
|
Sysmon EventID 17, Sysmon EventID 18
|
T1071
|
TTP
|
Azorult
|
2025-05-02
|
Windows AppLocker Block Events
|
|
T1218
|
Anomaly
|
Windows AppLocker
|
2025-05-02
|
Windows AppLocker Execution from Uncommon Locations
|
|
T1218
|
Hunting
|
Windows AppLocker
|
2025-05-02
|
Windows AppLocker Privilege Escalation via Unauthorized Bypass
|
|
T1218
|
TTP
|
Windows AppLocker
|
2025-05-02
|
Windows AppLocker Rare Application Launch Detection
|
|
T1218
|
Hunting
|
Windows AppLocker
|
2025-05-02
|
Windows Archive Collected Data via Powershell
|
Powershell Script Block Logging 4104
|
T1560
|
Anomaly
|
CISA AA23-347A
|
2025-05-02
|
Windows Archive Collected Data via Rar
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1560.001
|
Anomaly
|
China-Nexus Threat Activity, DarkGate Malware, Salt Typhoon
|
2025-05-02
|
Windows Archived Collected Data In TEMP Folder
|
Sysmon EventID 11
|
T1560
|
TTP
|
Braodo Stealer
|
2025-05-02
|
Windows Attempt To Stop Security Service
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
TTP
|
Azorult, Data Destruction, Disabling Security Tools, Graceful Wipe Out Attack, Trickbot, WhisperGate
|
2025-05-02
|
Windows Audit Policy Auditing Option Disabled via Auditpol
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.002
|
TTP
|
Windows Audit Policy Tampering
|
2025-05-02
|
Windows Audit Policy Auditing Option Modified - Registry
|
Sysmon EventID 13
|
T1547.014
|
Anomaly
|
Windows Audit Policy Tampering
|
2025-05-02
|
Windows Audit Policy Cleared via Auditpol
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.002
|
TTP
|
Windows Audit Policy Tampering
|
2025-05-02
|
Windows Audit Policy Disabled via Auditpol
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.002
|
Anomaly
|
Windows Audit Policy Tampering
|
2025-05-02
|
Windows Audit Policy Disabled via Legacy Auditpol
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.002
|
Anomaly
|
Windows Audit Policy Tampering
|
2025-05-02
|
Windows Audit Policy Excluded Category via Auditpol
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.002
|
Anomaly
|
Windows Audit Policy Tampering
|
2025-05-02
|
Windows Audit Policy Restored via Auditpol
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.002
|
Anomaly
|
Windows Audit Policy Tampering
|
2025-05-02
|
Windows Audit Policy Security Descriptor Tampering via Auditpol
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.002
|
Anomaly
|
Windows Audit Policy Tampering
|
2025-05-02
|
Windows AutoIt3 Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059
|
TTP
|
Crypto Stealer, DarkGate Malware, Handala Wiper
|
2025-05-02
|
Windows Autostart Execution LSASS Driver Registry Modification
|
Sysmon EventID 13
|
T1547.008
|
TTP
|
Windows Registry Abuse
|
2025-05-02
|
Windows Binary Proxy Execution Mavinject DLL Injection
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.013
|
TTP
|
Living Off The Land
|
2025-05-02
|
Windows BitLocker Suspicious Command Usage
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1486
T1490
|
TTP
|
ShrinkLocker
|
2025-05-02
|
Windows BitLockerToGo Process Execution
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1218
|
Hunting
|
Lumma Stealer
|
2025-05-02
|
Windows BitLockerToGo with Network Activity
|
Sysmon EventID 22
|
T1218
|
Hunting
|
Lumma Stealer
|
2025-05-02
|
Windows BootLoader Inventory
|
|
T1542.001
|
Hunting
|
BlackLotus Campaign, Windows BootKits
|
2025-05-02
|
Windows Bypass UAC via Pkgmgr Tool
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1548.002
|
Anomaly
|
Warzone RAT
|
2025-05-02
|
Windows CAB File on Disk
|
Sysmon EventID 11
|
T1566.001
|
Anomaly
|
DarkGate Malware
|
2025-05-02
|
Windows Cached Domain Credentials Reg Query
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.005
|
Anomaly
|
Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows Change Default File Association For No File Ext
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1546.001
|
TTP
|
Compromised Windows Host, Prestige Ransomware
|
2025-05-02
|
Windows Cisco Secure Endpoint Related Service Stopped
|
Windows Event Log System 7036
|
T1490
|
Anomaly
|
Security Solution Tampering
|
2025-05-02
|
Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
Anomaly
|
Security Solution Tampering
|
2025-05-02
|
Windows Cisco Secure Endpoint Unblock File Via Sfc
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
Anomaly
|
Security Solution Tampering
|
2025-05-02
|
Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
Anomaly
|
Security Solution Tampering
|
2025-05-02
|
Windows ClipBoard Data via Get-ClipBoard
|
Powershell Script Block Logging 4104
|
T1115
|
Anomaly
|
Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows COM Hijacking InprocServer32 Modification
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1546.015
|
TTP
|
Compromised Windows Host, Living Off The Land
|
2025-05-02
|
Windows Command and Scripting Interpreter Hunting Path Traversal
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059
|
Hunting
|
Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Command and Scripting Interpreter Path Traversal Exec
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059
|
TTP
|
Compromised Windows Host, Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Command Shell DCRat ForkBomb Payload
|
CrowdStrike ProcessRollup2, Sysmon EventID 1
|
T1059.003
|
TTP
|
Compromised Windows Host, DarkCrystal RAT
|
2025-05-02
|
Windows Common Abused Cmd Shell Risk Behavior
|
|
T1222
T1049
T1033
T1529
T1016
T1059
|
Correlation
|
Azorult, CISA AA23-347A, DarkCrystal RAT, Disabling Security Tools, FIN7, Netsh Abuse, Qakbot, Sandworm Tools, Volt Typhoon, Windows Defense Evasion Tactics, Windows Post-Exploitation
|
2025-05-02
|
Windows Compatibility Telemetry Suspicious Child Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1546
T1053.005
|
TTP
|
Windows Persistence Techniques
|
2025-05-02
|
Windows Compatibility Telemetry Tampering Through Registry
|
Sysmon EventID 13
|
T1546
T1053.005
|
TTP
|
Windows Persistence Techniques
|
2025-05-02
|
Windows Computer Account Created by Computer Account
|
Windows Event Log Security 4741
|
T1558
|
TTP
|
Active Directory Kerberos Attacks, Local Privilege Escalation With KrbRelayUp
|
2025-05-02
|
Windows Computer Account Requesting Kerberos Ticket
|
Windows Event Log Security 4768
|
T1558
|
TTP
|
Active Directory Kerberos Attacks, Local Privilege Escalation With KrbRelayUp
|
2025-05-02
|
Windows Computer Account With SPN
|
Windows Event Log Security 4741
|
T1558
|
TTP
|
Active Directory Kerberos Attacks, Compromised Windows Host, Local Privilege Escalation With KrbRelayUp
|
2025-05-02
|
Windows ConHost with Headless Argument
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1564.003
T1564.006
|
TTP
|
Compromised Windows Host, Spearphishing Attachments
|
2025-05-02
|
Windows ConsoleHost History File Deletion
|
Sysmon EventID 23, Sysmon EventID 26
|
T1070.003
|
Anomaly
|
Medusa Ransomware
|
2025-05-02
|
Windows Create Local Account
|
|
T1136.001
|
Anomaly
|
Active Directory Password Spraying, CISA AA24-241A
|
2025-05-02
|
Windows Create Local Administrator Account Via Net
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1136.001
|
Anomaly
|
Azorult, CISA AA22-257A, CISA AA24-241A, DHS Report TA18-074A, DarkGate Malware, Medusa Ransomware
|
2025-05-02
|
Windows Credential Access From Browser Password Store
|
Windows Event Log Security 4663
|
T1012
|
Anomaly
|
Braodo Stealer, China-Nexus Threat Activity, Earth Alux, Meduza Stealer, MoonPeak, PXA Stealer, Salt Typhoon, Snake Keylogger, SnappyBee
|
2025-05-02
|
Windows Credential Dumping LSASS Memory Createdump
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.001
|
TTP
|
Compromised Windows Host, Credential Dumping
|
2025-05-02
|
Windows Credentials Access via VaultCli Module
|
Sysmon EventID 7
|
T1555.004
|
Anomaly
|
Meduza Stealer
|
2025-05-02
|
Windows Credentials from Password Stores Chrome Copied in TEMP Dir
|
Sysmon EventID 11
|
T1555.003
|
TTP
|
Braodo Stealer
|
2025-05-02
|
Windows Credentials from Password Stores Chrome Extension Access
|
Windows Event Log Security 4663
|
T1012
|
Anomaly
|
Amadey, Braodo Stealer, CISA AA23-347A, DarkGate Malware, Meduza Stealer, MoonPeak, Phemedrone Stealer, RedLine Stealer
|
2025-05-02
|
Windows Credentials from Password Stores Chrome LocalState Access
|
Windows Event Log Security 4663
|
T1012
|
Anomaly
|
Amadey, Braodo Stealer, China-Nexus Threat Activity, DarkGate Malware, Earth Alux, Meduza Stealer, MoonPeak, NjRAT, PXA Stealer, Phemedrone Stealer, RedLine Stealer, Salt Typhoon, Snake Keylogger, SnappyBee, Warzone RAT
|
2025-05-02
|
Windows Credentials from Password Stores Chrome Login Data Access
|
Windows Event Log Security 4663
|
T1012
|
Anomaly
|
Amadey, Braodo Stealer, China-Nexus Threat Activity, DarkGate Malware, Earth Alux, Meduza Stealer, MoonPeak, NjRAT, PXA Stealer, Phemedrone Stealer, RedLine Stealer, Salt Typhoon, Snake Keylogger, SnappyBee, Warzone RAT
|
2025-05-02
|
Windows Credentials from Password Stores Creation
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1555
|
TTP
|
Compromised Windows Host, DarkGate Malware
|
2025-05-02
|
Windows Credentials from Password Stores Deletion
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1555
|
TTP
|
Compromised Windows Host, DarkGate Malware
|
2025-05-02
|
Windows Credentials from Password Stores Query
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1555
|
Anomaly
|
DarkGate Malware, Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows Credentials from Web Browsers Saved in TEMP Folder
|
Sysmon EventID 11
|
T1555.003
|
TTP
|
Braodo Stealer
|
2025-05-02
|
Windows Credentials in Registry Reg Query
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1552.002
|
Anomaly
|
Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows Curl Download to Suspicious Path
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
TTP
|
Black Basta Ransomware, China-Nexus Threat Activity, Compromised Windows Host, Forest Blizzard, IcedID, Ingress Tool Transfer, Salt Typhoon
|
2025-05-02
|
Windows Curl Upload to Remote Destination
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
TTP
|
Compromised Windows Host, Ingress Tool Transfer
|
2025-05-02
|
Windows Data Destruction Recursive Exec Files Deletion
|
Sysmon EventID 23, Sysmon EventID 26
|
T1485
|
TTP
|
Data Destruction, Handala Wiper, Swift Slicer
|
2025-05-02
|
Windows Debugger Tool Execution
|
|
T1036
|
Hunting
|
DarkGate Malware, PlugX
|
2025-05-02
|
Windows Defacement Modify Transcodedwallpaper File
|
Sysmon EventID 1, Sysmon EventID 11
|
T1491
|
Anomaly
|
Brute Ratel C4
|
2025-05-02
|
Windows Default Group Policy Object Modified
|
Windows Event Log Security 5136
|
T1484.001
|
TTP
|
Active Directory Privilege Escalation, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows Default Group Policy Object Modified with GPME
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1484.001
|
TTP
|
Active Directory Privilege Escalation, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows Defender ASR Audit Events
|
Windows Event Log Defender 1122, Windows Event Log Defender 1125, Windows Event Log Defender 1126, Windows Event Log Defender 1132, Windows Event Log Defender 1134
|
T1059
T1566.001
T1566.002
|
Anomaly
|
Windows Attack Surface Reduction
|
2025-05-02
|
Windows Defender ASR Block Events
|
Windows Event Log Defender 1121, Windows Event Log Defender 1126, Windows Event Log Defender 1129, Windows Event Log Defender 1131, Windows Event Log Defender 1133
|
T1059
T1566.001
T1566.002
|
Anomaly
|
Windows Attack Surface Reduction
|
2025-05-02
|
Windows Defender ASR Registry Modification
|
Windows Event Log Defender 5007
|
T1112
|
Hunting
|
Windows Attack Surface Reduction
|
2025-05-02
|
Windows Defender ASR Rule Disabled
|
Windows Event Log Defender 5007
|
T1112
|
TTP
|
Windows Attack Surface Reduction
|
2025-05-02
|
Windows Defender ASR Rules Stacking
|
Windows Event Log Defender 1121, Windows Event Log Defender 1122, Windows Event Log Defender 1125, Windows Event Log Defender 1126, Windows Event Log Defender 1129, Windows Event Log Defender 1131, Windows Event Log Defender 1133, Windows Event Log Defender 1134, Windows Event Log Defender 5007
|
T1566.001
T1566.002
T1059
|
Hunting
|
Windows Attack Surface Reduction
|
2025-05-02
|
Windows Delete or Modify System Firewall
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.004
|
Anomaly
|
NjRAT, ShrinkLocker
|
2025-05-02
|
Windows Deleted Registry By A Non Critical Process File Path
|
Sysmon EventID 1, Sysmon EventID 12
|
T1112
|
Anomaly
|
Data Destruction, Double Zero Destructor
|
2025-05-02
|
Windows Detect Network Scanner Behavior
|
Sysmon EventID 3
|
T1595.001
T1595.002
|
Anomaly
|
Network Discovery, Windows Discovery Techniques
|
2025-05-02
|
Windows Disable Change Password Through Registry
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
Ransomware, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Disable Lock Workstation Feature Through Registry
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
Ransomware, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Disable LogOff Button Through Registry
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
Ransomware, Windows Registry Abuse
|
2025-05-02
|
Windows Disable Memory Crash Dump
|
Sysmon EventID 13
|
T1485
|
TTP
|
Data Destruction, Hermetic Wiper, Ransomware, Windows Registry Abuse
|
2025-05-02
|
Windows Disable Notification Center
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
CISA AA23-347A, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Disable or Modify Tools Via Taskkill
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
Anomaly
|
Crypto Stealer, NjRAT, PXA Stealer
|
2025-05-02
|
Windows Disable or Stop Browser Process
|
Sysmon EventID 1
|
T1562.001
|
TTP
|
Braodo Stealer
|
2025-05-02
|
Windows Disable Shutdown Button Through Registry
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
Ransomware, Windows Registry Abuse
|
2025-05-02
|
Windows Disable Windows Event Logging Disable HTTP Logging
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1505.004
T1562.002
|
TTP
|
CISA AA23-347A, Compromised Windows Host, IIS Components, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Disable Windows Group Policy Features Through Registry
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
CISA AA23-347A, Ransomware, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows DisableAntiSpyware Registry
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Azorult, CISA AA22-264A, CISA AA23-347A, RedLine Stealer, Ryuk Ransomware, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows DiskCryptor Usage
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1486
|
Hunting
|
Ransomware
|
2025-05-02
|
Windows Diskshadow Proxy Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218
|
TTP
|
Living Off The Land
|
2025-05-02
|
Windows DISM Install PowerShell Web Access
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1548.002
|
TTP
|
CISA AA24-241A
|
2025-05-02
|
Windows DISM Remove Defender
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
TTP
|
CISA AA23-347A, Compromised Windows Host, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows DLL Search Order Hijacking Hunt with Sysmon
|
Sysmon EventID 7
|
T1574.001
|
Hunting
|
Living Off The Land, Qakbot, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows DLL Search Order Hijacking with iscsicpl
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1574.001
|
TTP
|
Compromised Windows Host, Living Off The Land, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows DLL Side-Loading In Calc
|
Sysmon EventID 7
|
T1574.001
|
TTP
|
Earth Alux, Qakbot
|
2025-05-02
|
Windows DLL Side-Loading Process Child Of Calc
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1574.001
|
Anomaly
|
Earth Alux, Qakbot
|
2025-05-02
|
Windows DNS Gather Network Info
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1590.002
|
Anomaly
|
Sandworm Tools, Volt Typhoon
|
2025-05-02
|
Windows DnsAdmins New Member Added
|
Windows Event Log Security 4732
|
T1098
|
TTP
|
Active Directory Privilege Escalation
|
2025-05-02
|
Windows Domain Account Discovery Via Get-NetComputer
|
Powershell Script Block Logging 4104
|
T1087.002
|
Anomaly
|
CISA AA23-347A
|
2025-05-02
|
Windows Domain Admin Impersonation Indicator
|
Windows Event Log Security 4627
|
T1558
|
TTP
|
Active Directory Kerberos Attacks, Active Directory Privilege Escalation, Compromised Windows Host, Gozi Malware
|
2025-05-02
|
Windows DotNet Binary in Non Standard Path
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.003
T1218.004
|
TTP
|
Data Destruction, Masquerading - Rename System Utilities, Ransomware, Signed Binary Proxy Execution InstallUtil, Unusual Processes, WhisperGate
|
2025-05-02
|
Windows Driver Inventory
|
|
T1068
|
Hunting
|
Windows Drivers
|
2025-05-02
|
Windows Driver Load Non-Standard Path
|
Windows Event Log System 7045
|
T1014
T1068
|
TTP
|
AgentTesla, BlackByte Ransomware, BlackSuit Ransomware, CISA AA22-320A, Windows Drivers
|
2025-05-02
|
Windows Drivers Loaded by Signature
|
Sysmon EventID 6
|
T1014
T1068
|
Hunting
|
AgentTesla, BlackByte Ransomware, CISA AA22-320A, Windows Drivers
|
2025-05-02
|
Windows Enable PowerShell Web Access
|
Powershell Script Block Logging 4104
|
T1059.001
|
TTP
|
CISA AA24-241A, Malicious PowerShell
|
2025-05-02
|
Windows Enable Win32 ScheduledJob via Registry
|
Sysmon EventID 13
|
T1053.005
|
Anomaly
|
Active Directory Lateral Movement, Scheduled Tasks
|
2025-05-02
|
Windows ESX Admins Group Creation Security Event
|
Windows Event Log Security 4727, Windows Event Log Security 4730, Windows Event Log Security 4737
|
T1136.001
T1136.002
|
TTP
|
VMware ESXi AD Integration Authentication Bypass CVE-2024-37085
|
2025-05-02
|
Windows ESX Admins Group Creation via Net
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1136.002
T1136.001
|
TTP
|
VMware ESXi AD Integration Authentication Bypass CVE-2024-37085
|
2025-05-02
|
Windows ESX Admins Group Creation via PowerShell
|
Powershell Script Block Logging 4104
|
T1136.002
T1136.001
|
TTP
|
VMware ESXi AD Integration Authentication Bypass CVE-2024-37085
|
2025-05-02
|
Windows Event For Service Disabled
|
Windows Event Log System 7040
|
T1562.001
|
Hunting
|
RedLine Stealer, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Event Log Cleared
|
Windows Event Log Security 1102, Windows Event Log System 104
|
T1070.001
|
TTP
|
CISA AA22-264A, Clop Ransomware, Compromised Windows Host, Ransomware, ShrinkLocker, Windows Log Manipulation
|
2025-05-02
|
Windows Event Logging Service Has Shutdown
|
Windows Event Log Security 1100
|
T1070.001
|
Hunting
|
Clop Ransomware, Ransomware, Windows Log Manipulation
|
2025-05-02
|
Windows Event Triggered Image File Execution Options Injection
|
Windows Event Log Application 3000
|
T1546.012
|
Hunting
|
Windows Persistence Techniques
|
2025-05-02
|
Windows Eventlog Cleared Via Wevtutil
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1070.001
|
Anomaly
|
CISA AA23-347A, Clop Ransomware, Ransomware, Rhysida Ransomware, ShrinkLocker, Windows Log Manipulation
|
2025-05-02
|
Windows EventLog Recon Activity Using Log Query Utilities
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1654
|
Anomaly
|
Windows Discovery Techniques
|
2025-05-02
|
Windows Excessive Disabled Services Event
|
Windows Event Log System 7040
|
T1562.001
|
TTP
|
CISA AA23-347A, Compromised Windows Host, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Excessive Service Stop Attempt
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1489
|
TTP
|
BlackByte Ransomware, Ransomware, XMRig
|
2025-05-02
|
Windows Excessive Usage Of Net App
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1531
|
Anomaly
|
Azorult, Graceful Wipe Out Attack, Prestige Ransomware, Ransomware, Rhysida Ransomware, Windows Post-Exploitation, XMRig
|
2025-05-02
|
Windows Executable in Loaded Modules
|
Sysmon EventID 7
|
T1129
|
TTP
|
NjRAT
|
2025-05-02
|
Windows Execute Arbitrary Commands with MSDT
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218
|
TTP
|
Compromised Windows Host, Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
|
2025-05-02
|
Windows Exfiltration Over C2 Via Invoke RestMethod
|
Powershell Script Block Logging 4104
|
T1041
|
TTP
|
Water Gamayun, Winter Vivern
|
2025-05-02
|
Windows Exfiltration Over C2 Via Powershell UploadString
|
Powershell Script Block Logging 4104
|
T1041
|
TTP
|
Winter Vivern
|
2025-05-02
|
Windows Explorer.exe Spawning PowerShell or Cmd
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.001
T1204.002
|
Hunting
|
ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day
|
2025-05-02
|
Windows Explorer LNK Exploit Process Launch With Padding
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.001
T1204.002
|
TTP
|
ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day
|
2025-05-02
|
Windows Export Certificate
|
Windows Event Log CertificateServicesClient 1007
|
T1552.004
T1649
|
Anomaly
|
Windows Certificate Services
|
2025-05-02
|
Windows File and Directory Enable ReadOnly Permissions
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1222.001
|
TTP
|
Crypto Stealer
|
2025-05-02
|
Windows File and Directory Permissions Enable Inheritance
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1222.001
|
Hunting
|
Crypto Stealer
|
2025-05-02
|
Windows File and Directory Permissions Remove Inheritance
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1222.001
|
Anomaly
|
Crypto Stealer
|
2025-05-02
|
Windows File Download Via CertUtil
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
TTP
|
CISA AA22-277A, Compromised Windows Host, DarkSide Ransomware, Flax Typhoon, Forest Blizzard, Ingress Tool Transfer, Living Off The Land, ProxyNotShell
|
2025-05-02
|
Windows File Share Discovery With Powerview
|
Powershell Script Block Logging 4104
|
T1135
|
TTP
|
Active Directory Discovery, Active Directory Privilege Escalation
|
2025-05-02
|
Windows File Transfer Protocol In Non-Common Process Path
|
Sysmon EventID 3
|
T1071.003
|
Anomaly
|
AgentTesla, Snake Keylogger
|
2025-05-02
|
Windows File Without Extension In Critical Folder
|
Sysmon EventID 11
|
T1485
|
TTP
|
Data Destruction, Hermetic Wiper
|
2025-05-02
|
Windows Files and Dirs Access Rights Modification Via Icacls
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1222.001
|
TTP
|
Amadey, Defense Evasion or Unauthorized Access Via SDDL Tampering
|
2025-05-02
|
Windows Find Domain Organizational Units with GetDomainOU
|
Powershell Script Block Logging 4104
|
T1087.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Windows Find Interesting ACL with FindInterestingDomainAcl
|
Powershell Script Block Logging 4104
|
T1087.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Windows Findstr GPP Discovery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1552.006
|
TTP
|
Active Directory Privilege Escalation
|
2025-05-02
|
Windows Firewall Rule Added
|
Windows Event Log Security 4946
|
T1562.004
|
Anomaly
|
Medusa Ransomware, ShrinkLocker
|
2025-05-02
|
Windows Firewall Rule Deletion
|
Windows Event Log Security 4948
|
T1562.004
|
Anomaly
|
Medusa Ransomware, ShrinkLocker
|
2025-05-02
|
Windows Firewall Rule Modification
|
Windows Event Log Security 4947
|
T1562.004
|
Anomaly
|
Medusa Ransomware, ShrinkLocker
|
2025-05-02
|
Windows Forest Discovery with GetForestDomain
|
Powershell Script Block Logging 4104
|
T1087.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Windows Gather Victim Host Information Camera
|
Powershell Script Block Logging 4104
|
T1592.001
|
Anomaly
|
DarkCrystal RAT
|
2025-05-02
|
Windows Gather Victim Identity SAM Info
|
Sysmon EventID 7
|
T1589.001
|
Hunting
|
Brute Ratel C4
|
2025-05-02
|
Windows Get-AdComputer Unconstrained Delegation Discovery
|
Powershell Script Block Logging 4104
|
T1018
|
TTP
|
Active Directory Kerberos Attacks, Medusa Ransomware
|
2025-05-02
|
Windows Get Local Admin with FindLocalAdminAccess
|
Powershell Script Block Logging 4104
|
T1087.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Windows Global Object Access Audit List Cleared Via Auditpol
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.002
|
TTP
|
Windows Audit Policy Tampering
|
2025-05-02
|
Windows Group Discovery Via Net
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.001
T1069.002
|
Hunting
|
Active Directory Discovery, Azorult, Cleo File Transfer Software, Graceful Wipe Out Attack, IcedID, Medusa Ransomware, Prestige Ransomware, Rhysida Ransomware, Volt Typhoon, Windows Discovery Techniques, Windows Post-Exploitation
|
2025-05-02
|
Windows Group Policy Object Created
|
Windows Event Log Security 5136, Windows Event Log Security 5137
|
T1078.002
T1484.001
|
TTP
|
Active Directory Privilege Escalation, Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows Hidden Schedule Task Settings
|
Windows Event Log Security 4698
|
T1053
|
TTP
|
Active Directory Discovery, CISA AA22-257A, Cactus Ransomware, Compromised Windows Host, Data Destruction, Industroyer2, Scheduled Tasks
|
2025-05-02
|
Windows Hide Notification Features Through Registry
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
Ransomware, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows High File Deletion Frequency
|
Sysmon EventID 23, Sysmon EventID 26
|
T1485
|
Anomaly
|
Black Basta Ransomware, Clop Ransomware, DarkCrystal RAT, Data Destruction, Handala Wiper, Medusa Ransomware, Sandworm Tools, Swift Slicer, WhisperGate
|
2025-05-02
|
Windows HTTP Network Communication From MSIExec
|
Sysmon EventID 1, Sysmon EventID 3
|
T1218.007
|
Anomaly
|
Water Gamayun, Windows System Binary Proxy Execution MSIExec
|
2025-05-02
|
Windows Hunting System Account Targeting Lsass
|
Sysmon EventID 10
|
T1003.001
|
Hunting
|
CISA AA23-347A, Credential Dumping
|
2025-05-02
|
Windows Identify PowerShell Web Access IIS Pool
|
Windows Event Log Security 4648
|
T1190
|
Hunting
|
CISA AA24-241A
|
2025-05-02
|
Windows Identify Protocol Handlers
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059
|
Hunting
|
Living Off The Land
|
2025-05-02
|
Windows IIS Components Add New Module
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1505.004
|
Anomaly
|
IIS Components
|
2025-05-02
|
Windows IIS Components Get-WebGlobalModule Module Query
|
Powershell Installed IIS Modules
|
T1505.004
|
Hunting
|
IIS Components, WS FTP Server Critical Vulnerabilities
|
2025-05-02
|
Windows IIS Components Module Failed to Load
|
Windows Event Log Application 2282
|
T1505.004
|
Anomaly
|
IIS Components
|
2025-05-02
|
Windows IIS Components New Module Added
|
Windows IIS 29
|
T1505.004
|
TTP
|
IIS Components
|
2025-05-02
|
Windows Impair Defense Add Xml Applocker Rules
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
Hunting
|
Azorult
|
2025-05-02
|
Windows Impair Defense Change Win Defender Health Check Intervals
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Change Win Defender Quick Scan Interval
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Change Win Defender Throttle Rate
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Change Win Defender Tracing Level
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Configure App Install Control
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Define Win Defender Threat Action
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Delete Win Defender Context Menu
|
Sysmon EventID 13
|
T1562.001
|
Hunting
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Delete Win Defender Profile Registry
|
Sysmon EventID 13
|
T1562.001
|
Anomaly
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Deny Security Software With Applocker
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Azorult
|
2025-05-02
|
Windows Impair Defense Disable Controlled Folder Access
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable Defender Firewall And Network
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable Defender Protocol Recognition
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable PUA Protection
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable Realtime Signature Delivery
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable Web Evaluation
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable Win Defender App Guard
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable Win Defender Compute File Hashes
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable Win Defender Gen reports
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable Win Defender Network Protection
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable Win Defender Report Infection
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable Win Defender Scan On Update
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Disable Win Defender Signature Retirement
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Overide Win Defender Phishing Filter
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Override SmartScreen Prompt
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defense Set Win Defender Smart Screen Level To Warn
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defenses Disable Auto Logger Session
|
Sysmon EventID 13
|
T1562.001
|
Anomaly
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defenses Disable AV AutoStart via Registry
|
Sysmon EventID 13
|
T1112
|
TTP
|
ValleyRAT
|
2025-05-02
|
Windows Impair Defenses Disable HVCI
|
Sysmon EventID 13
|
T1562.001
|
TTP
|
BlackLotus Campaign, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Impair Defenses Disable Win Defender Auto Logging
|
Sysmon EventID 13
|
T1562.001
|
Anomaly
|
CISA AA23-347A, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Important Audit Policy Disabled
|
Windows Event Log Security 4719
|
T1562.001
|
TTP
|
Windows Audit Policy Tampering
|
2025-05-02
|
Windows Increase in Group or Object Modification Activity
|
Windows Event Log Security 4663
|
T1098
T1562
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows Increase in User Modification Activity
|
Windows Event Log Security 4720
|
T1098
T1562
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows Indicator Removal Via Rmdir
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1070
|
Anomaly
|
DarkGate Malware
|
2025-05-02
|
Windows Indirect Command Execution Via forfiles
|
CrowdStrike ProcessRollup2, Sysmon EventID 1
|
T1202
|
TTP
|
Living Off The Land, Windows Post-Exploitation
|
2025-05-02
|
Windows Indirect Command Execution Via pcalua
|
CrowdStrike ProcessRollup2, Sysmon EventID 1
|
T1202
|
TTP
|
Living Off The Land
|
2025-05-02
|
Windows Indirect Command Execution Via Series Of Forfiles
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1202
|
Anomaly
|
Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows Information Discovery Fsutil
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1082
|
Anomaly
|
Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows Ingress Tool Transfer Using Explorer
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
Anomaly
|
DarkCrystal RAT
|
2025-05-02
|
Windows InProcServer32 New Outlook Form
|
Sysmon EventID 13
|
T1566
T1112
|
Anomaly
|
Outlook RCE CVE-2024-21378
|
2025-05-02
|
Windows Input Capture Using Credential UI Dll
|
Sysmon EventID 7
|
T1056.002
|
Hunting
|
Brute Ratel C4
|
2025-05-02
|
Windows InstallUtil Credential Theft
|
Sysmon EventID 7
|
T1218.004
|
TTP
|
Signed Binary Proxy Execution InstallUtil
|
2025-05-02
|
Windows InstallUtil in Non Standard Path
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.003
T1218.004
|
TTP
|
Data Destruction, Living Off The Land, Masquerading - Rename System Utilities, Ransomware, Signed Binary Proxy Execution InstallUtil, Unusual Processes, WhisperGate
|
2025-05-02
|
Windows InstallUtil Remote Network Connection
|
Sysmon EventID 1, Sysmon EventID 3
|
T1218.004
|
TTP
|
Compromised Windows Host, Living Off The Land, Signed Binary Proxy Execution InstallUtil
|
2025-05-02
|
Windows InstallUtil Uninstall Option
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.004
|
TTP
|
Compromised Windows Host, Living Off The Land, Signed Binary Proxy Execution InstallUtil
|
2025-05-02
|
Windows InstallUtil Uninstall Option with Network
|
Sysmon EventID 1, Sysmon EventID 3
|
T1218.004
|
TTP
|
Compromised Windows Host, Living Off The Land, Signed Binary Proxy Execution InstallUtil
|
2025-05-02
|
Windows InstallUtil URL in Command Line
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.004
|
TTP
|
Compromised Windows Host, Living Off The Land, Signed Binary Proxy Execution InstallUtil
|
2025-05-02
|
Windows ISO LNK File Creation
|
Sysmon EventID 11
|
T1204.001
T1566.001
|
Hunting
|
AgentTesla, Amadey, Azorult, Brute Ratel C4, Gozi Malware, IcedID, Qakbot, Remcos, Spearphishing Attachments, Warzone RAT
|
2025-05-02
|
Windows Java Spawning Shells
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1190
T1133
|
TTP
|
Cleo File Transfer Software, Log4Shell CVE-2021-44228, SAP NetWeaver Exploitation, SysAid On-Prem Software CVE-2023-47246 Vulnerability
|
2025-05-02
|
Windows Kerberos Local Successful Logon
|
Windows Event Log Security 4624
|
T1558
|
TTP
|
Active Directory Kerberos Attacks, Compromised Windows Host, Local Privilege Escalation With KrbRelayUp
|
2025-05-02
|
Windows Known Abused DLL Created
|
Sysmon EventID 11
|
T1574.001
|
Anomaly
|
Living Off The Land, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Known Abused DLL Loaded Suspiciously
|
Sysmon EventID 7
|
T1574.001
|
TTP
|
Living Off The Land, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Known GraphicalProton Loaded Modules
|
Sysmon EventID 7
|
T1574.001
|
Anomaly
|
CISA AA23-347A, Water Gamayun
|
2025-05-02
|
Windows KrbRelayUp Service Creation
|
Windows Event Log System 7045
|
T1543.003
|
TTP
|
Compromised Windows Host, Local Privilege Escalation With KrbRelayUp
|
2025-05-02
|
Windows Large Number of Computer Service Tickets Requested
|
Windows Event Log Security 4769
|
T1135
T1078
|
Anomaly
|
Active Directory Lateral Movement, Active Directory Privilege Escalation
|
2025-05-02
|
Windows Ldifde Directory Object Behavior
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
T1069.002
|
TTP
|
Volt Typhoon
|
2025-05-02
|
Windows Linked Policies In ADSI Discovery
|
Powershell Script Block Logging 4104
|
T1087.002
|
Anomaly
|
Active Directory Discovery, Data Destruction, Industroyer2
|
2025-05-02
|
Windows List ENV Variables Via SET Command From Uncommon Parent
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055
|
Anomaly
|
Qakbot
|
2025-05-02
|
Windows Local Administrator Credential Stuffing
|
Windows Event Log Security 4624, Windows Event Log Security 4625
|
T1110.004
|
TTP
|
Active Directory Lateral Movement, Active Directory Privilege Escalation
|
2025-05-02
|
Windows LOLBAS Executed As Renamed File
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.003
T1218.011
|
TTP
|
Living Off The Land, Masquerading - Rename System Utilities, Water Gamayun, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows LOLBAS Executed Outside Expected Path
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.005
T1218.011
|
TTP
|
Living Off The Land, Masquerading - Rename System Utilities, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows LSA Secrets NoLMhash Registry
|
Sysmon EventID 13
|
T1003.004
|
TTP
|
CISA AA23-347A
|
2025-05-02
|
Windows Mail Protocol In Non-Common Process Path
|
Sysmon EventID 3
|
T1071.003
|
Anomaly
|
AgentTesla
|
2025-05-02
|
Windows Mark Of The Web Bypass
|
Sysmon EventID 23
|
T1553.005
|
TTP
|
Warzone RAT
|
2025-05-02
|
Windows Masquerading Explorer As Child Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1574.001
|
TTP
|
Compromised Windows Host, Qakbot, Water Gamayun
|
2025-05-02
|
Windows Masquerading Msdtc Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1036
|
TTP
|
Compromised Windows Host, PlugX
|
2025-05-02
|
Windows Mimikatz Binary Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003
|
TTP
|
CISA AA22-320A, CISA AA23-347A, Compromised Windows Host, Credential Dumping, Flax Typhoon, Sandworm Tools, Volt Typhoon
|
2025-05-02
|
Windows Mimikatz Crypto Export File Extensions
|
Sysmon EventID 11
|
T1649
|
Anomaly
|
CISA AA23-347A, Sandworm Tools, Windows Certificate Services
|
2025-05-02
|
Windows Modify Registry AuthenticationLevelOverride
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
DarkGate Malware
|
2025-05-02
|
Windows Modify Registry Auto Minor Updates
|
Sysmon EventID 13
|
T1112
|
Hunting
|
RedLine Stealer
|
2025-05-02
|
Windows Modify Registry Auto Update Notif
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
RedLine Stealer
|
2025-05-02
|
Windows Modify Registry Configure BitLocker
|
Sysmon EventID 13
|
T1112
|
TTP
|
ShrinkLocker
|
2025-05-02
|
Windows Modify Registry Default Icon Setting
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
LockBit Ransomware
|
2025-05-02
|
Windows Modify Registry Delete Firewall Rules
|
Sysmon EventID 12
|
T1112
|
TTP
|
CISA AA24-241A, ShrinkLocker
|
2025-05-02
|
Windows Modify Registry Disable RDP
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
ShrinkLocker
|
2025-05-02
|
Windows Modify Registry Disable Restricted Admin
|
Sysmon EventID 13
|
T1112
|
TTP
|
CISA AA23-347A, Medusa Ransomware
|
2025-05-02
|
Windows Modify Registry Disable Toast Notifications
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
Azorult
|
2025-05-02
|
Windows Modify Registry Disable Win Defender Raw Write Notif
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
Azorult, CISA AA23-347A
|
2025-05-02
|
Windows Modify Registry Disable WinDefender Notifications
|
Sysmon EventID 13
|
T1112
|
TTP
|
CISA AA23-347A, RedLine Stealer
|
2025-05-02
|
Windows Modify Registry Disable Windows Security Center Notif
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
Azorult, CISA AA23-347A
|
2025-05-02
|
Windows Modify Registry DisableRemoteDesktopAntiAlias
|
Sysmon EventID 13
|
T1112
|
TTP
|
DarkGate Malware
|
2025-05-02
|
Windows Modify Registry DisableSecuritySettings
|
Sysmon EventID 13
|
T1112
|
TTP
|
CISA AA23-347A, DarkGate Malware
|
2025-05-02
|
Windows Modify Registry Disabling WER Settings
|
Sysmon EventID 13
|
T1112
|
TTP
|
Azorult, CISA AA23-347A
|
2025-05-02
|
Windows Modify Registry DisAllow Windows App
|
Sysmon EventID 13
|
T1112
|
TTP
|
Azorult
|
2025-05-02
|
Windows Modify Registry Do Not Connect To Win Update
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
RedLine Stealer
|
2025-05-02
|
Windows Modify Registry DontShowUI
|
Sysmon EventID 13
|
T1112
|
TTP
|
DarkGate Malware
|
2025-05-02
|
Windows Modify Registry EnableLinkedConnections
|
Sysmon EventID 13
|
T1112
|
TTP
|
BlackByte Ransomware
|
2025-05-02
|
Windows Modify Registry LongPathsEnabled
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
BlackByte Ransomware
|
2025-05-02
|
Windows Modify Registry MaxConnectionPerServer
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
Warzone RAT
|
2025-05-02
|
Windows Modify Registry No Auto Reboot With Logon User
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
RedLine Stealer
|
2025-05-02
|
Windows Modify Registry No Auto Update
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
CISA AA23-347A, RedLine Stealer
|
2025-05-02
|
Windows Modify Registry NoChangingWallPaper
|
Sysmon EventID 13
|
T1112
|
TTP
|
Rhysida Ransomware
|
2025-05-02
|
Windows Modify Registry on Smart Card Group Policy
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
ShrinkLocker
|
2025-05-02
|
Windows Modify Registry ProxyEnable
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
DarkGate Malware
|
2025-05-02
|
Windows Modify Registry ProxyServer
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
DarkGate Malware
|
2025-05-02
|
Windows Modify Registry Qakbot Binary Data Registry
|
Sysmon EventID 1, Sysmon EventID 12, Sysmon EventID 13
|
T1112
|
Anomaly
|
Qakbot
|
2025-05-02
|
Windows Modify Registry Regedit Silent Reg Import
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1112
|
Anomaly
|
Azorult
|
2025-05-02
|
Windows Modify Registry Risk Behavior
|
|
T1112
|
Correlation
|
Windows Registry Abuse
|
2025-05-02
|
Windows Modify Registry Suppress Win Defender Notif
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
Azorult, CISA AA23-347A
|
2025-05-02
|
Windows Modify Registry Tamper Protection
|
Sysmon EventID 13
|
T1112
|
TTP
|
RedLine Stealer
|
2025-05-02
|
Windows Modify Registry to Add or Modify Firewall Rule
|
Sysmon EventID 13, Sysmon EventID 14
|
T1112
|
Anomaly
|
CISA AA24-241A, ShrinkLocker
|
2025-05-02
|
Windows Modify Registry UpdateServiceUrlAlternate
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
RedLine Stealer
|
2025-05-02
|
Windows Modify Registry USeWuServer
|
Sysmon EventID 13
|
T1112
|
Hunting
|
RedLine Stealer
|
2025-05-02
|
Windows Modify Registry Utilize ProgIDs
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
ValleyRAT
|
2025-05-02
|
Windows Modify Registry ValleyRAT C2 Config
|
Sysmon EventID 13
|
T1112
|
TTP
|
ValleyRAT
|
2025-05-02
|
Windows Modify Registry ValleyRat PWN Reg Entry
|
Sysmon EventID 13
|
T1112
|
TTP
|
ValleyRAT
|
2025-05-02
|
Windows Modify Registry With MD5 Reg Key Name
|
Sysmon EventID 13
|
T1112
|
TTP
|
NjRAT
|
2025-05-02
|
Windows Modify Registry WuServer
|
Sysmon EventID 13
|
T1112
|
Hunting
|
RedLine Stealer
|
2025-05-02
|
Windows Modify Registry wuStatusServer
|
Sysmon EventID 13
|
T1112
|
Hunting
|
RedLine Stealer
|
2025-05-02
|
Windows Modify Show Compress Color And Info Tip Registry
|
Sysmon EventID 13
|
T1112
|
TTP
|
Data Destruction, Hermetic Wiper, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Modify System Firewall with Notable Process Path
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.004
|
TTP
|
Compromised Windows Host, Medusa Ransomware, NjRAT
|
2025-05-02
|
Windows MOF Event Triggered Execution via WMI
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1546.003
|
TTP
|
Compromised Windows Host, Living Off The Land
|
2025-05-02
|
Windows MOVEit Transfer Writing ASPX
|
Sysmon EventID 1, Sysmon EventID 11
|
T1190
T1133
|
TTP
|
MOVEit Transfer Critical Vulnerability
|
2025-05-02
|
Windows MSC EvilTwin Directory Path Manipulation
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218
T1036.005
T1203
|
TTP
|
Living Off The Land, Water Gamayun, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows MSExchange Management Mailbox Cmdlet Usage
|
|
T1059.001
|
Anomaly
|
BlackByte Ransomware, ProxyNotShell, ProxyShell
|
2025-05-02
|
Windows Mshta Execution In Registry
|
Sysmon EventID 13
|
T1218.005
|
TTP
|
Suspicious Windows Registry Activities, Windows Persistence Techniques
|
2025-05-02
|
Windows MsiExec HideWindow Rundll32 Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.007
|
TTP
|
Qakbot, Water Gamayun
|
2025-05-02
|
Windows MSIExec Remote Download
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.007
|
TTP
|
Water Gamayun, Windows System Binary Proxy Execution MSIExec
|
2025-05-02
|
Windows MSIExec Spawn Discovery Command
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.007
|
TTP
|
Medusa Ransomware, Water Gamayun, Windows System Binary Proxy Execution MSIExec
|
2025-05-02
|
Windows MSIExec Spawn WinDBG
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.007
|
TTP
|
Compromised Windows Host, DarkGate Malware
|
2025-05-02
|
Windows MSIExec Unregister DLLRegisterServer
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.007
|
TTP
|
Windows System Binary Proxy Execution MSIExec
|
2025-05-02
|
Windows MSTSC RDP Commandline
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.001
|
Anomaly
|
Medusa Ransomware
|
2025-05-02
|
Windows Multiple Account Passwords Changed
|
Windows Event Log Security 4724
|
T1098
T1078
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Windows Multiple Accounts Deleted
|
Windows Event Log Security 4726
|
T1098
T1078
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Windows Multiple Accounts Disabled
|
Windows Event Log Security 4725
|
T1098
T1078
|
TTP
|
Azure Active Directory Persistence
|
2025-05-02
|
Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
|
Windows Event Log Security 4768
|
T1110.003
|
TTP
|
Active Directory Kerberos Attacks, Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
|
Windows Event Log Security 4768
|
T1110.003
|
TTP
|
Active Directory Kerberos Attacks, Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Multiple Invalid Users Failed To Authenticate Using NTLM
|
Windows Event Log Security 4776
|
T1110.003
|
TTP
|
Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Multiple NTLM Null Domain Authentications
|
NTLM Operational 8004, NTLM Operational 8005, NTLM Operational 8006
|
T1110.003
|
TTP
|
Active Directory Password Spraying
|
2025-05-02
|
Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials
|
Windows Event Log Security 4648
|
T1110.003
|
TTP
|
Active Directory Password Spraying, Insider Threat, Volt Typhoon
|
2025-05-02
|
Windows Multiple Users Failed To Authenticate From Host Using NTLM
|
Windows Event Log Security 4776
|
T1110.003
|
TTP
|
Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Multiple Users Failed To Authenticate From Process
|
Windows Event Log Security 4625
|
T1110.003
|
TTP
|
Active Directory Password Spraying, Insider Threat, Volt Typhoon
|
2025-05-02
|
Windows Multiple Users Failed To Authenticate Using Kerberos
|
Windows Event Log Security 4771
|
T1110.003
|
TTP
|
Active Directory Kerberos Attacks, Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Multiple Users Remotely Failed To Authenticate From Host
|
Windows Event Log Security 4625
|
T1110.003
|
TTP
|
Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Network Connection Discovery Via Net
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1049
|
Hunting
|
Active Directory Discovery, Azorult, Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows Network Share Interaction Via Net
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1135
T1039
|
Anomaly
|
Active Directory Discovery, Active Directory Privilege Escalation, Network Discovery
|
2025-05-02
|
Windows New Custom Security Descriptor Set On EventLog Channel
|
Sysmon EventID 13
|
T1562.002
|
Anomaly
|
Defense Evasion or Unauthorized Access Via SDDL Tampering, LockBit Ransomware
|
2025-05-02
|
Windows New Default File Association Value Set
|
Sysmon EventID 13
|
T1546.001
|
Hunting
|
Data Destruction, Hermetic Wiper, Prestige Ransomware, Windows Persistence Techniques, Windows Privilege Escalation, Windows Registry Abuse
|
2025-05-02
|
Windows New Deny Permission Set On Service SD Via Sc.EXE
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1564
|
Anomaly
|
Defense Evasion or Unauthorized Access Via SDDL Tampering
|
2025-05-02
|
Windows New EventLog ChannelAccess Registry Value Set
|
Sysmon EventID 13
|
T1562.002
|
Anomaly
|
Defense Evasion or Unauthorized Access Via SDDL Tampering, LockBit Ransomware
|
2025-05-02
|
Windows New InProcServer32 Added
|
Sysmon EventID 13
|
T1112
|
Hunting
|
Outlook RCE CVE-2024-21378
|
2025-05-02
|
Windows New Service Security Descriptor Set Via Sc.EXE
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1564
|
Anomaly
|
Defense Evasion or Unauthorized Access Via SDDL Tampering
|
2025-05-02
|
Windows Ngrok Reverse Proxy Usage
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1572
T1090
T1102
|
Anomaly
|
CISA AA22-320A, CISA AA24-241A, Reverse Network Proxy
|
2025-05-02
|
Windows NirSoft AdvancedRun
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1588.002
|
TTP
|
Data Destruction, Ransomware, Unusual Processes, WhisperGate
|
2025-05-02
|
Windows NirSoft Utilities
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1588.002
|
Hunting
|
Data Destruction, WhisperGate
|
2025-05-02
|
Windows Njrat Fileless Storage via Registry
|
Sysmon EventID 13
|
T1027.011
|
TTP
|
NjRAT
|
2025-05-02
|
Windows Non Discord App Access Discord LevelDB
|
Windows Event Log Security 4663
|
T1012
|
Anomaly
|
PXA Stealer, Snake Keylogger
|
2025-05-02
|
Windows Non-System Account Targeting Lsass
|
Sysmon EventID 10
|
T1003.001
|
TTP
|
CISA AA23-347A, Credential Dumping
|
2025-05-02
|
Windows Obfuscated Files or Information via RAR SFX
|
Sysmon EventID 11
|
T1027.013
|
Anomaly
|
Crypto Stealer
|
2025-05-02
|
Windows Odbcconf Hunting
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.008
|
Hunting
|
Living Off The Land
|
2025-05-02
|
Windows Odbcconf Load DLL
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.008
|
TTP
|
Living Off The Land
|
2025-05-02
|
Windows Odbcconf Load Response File
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.008
|
TTP
|
Living Off The Land
|
2025-05-02
|
Windows Office Product Dropped Cab or Inf File
|
Sysmon EventID 1, Sysmon EventID 11, Windows Event Log Security 4688
|
T1566.001
|
TTP
|
Compromised Windows Host, Microsoft MSHTML Remote Code Execution CVE-2021-40444, Spearphishing Attachments
|
2025-05-02
|
Windows Office Product Dropped Uncommon File
|
Sysmon EventID 1, Sysmon EventID 11
|
T1566.001
|
Anomaly
|
AgentTesla, CVE-2023-21716 Word RTF Heap Corruption, Compromised Windows Host, FIN7, PlugX, Warzone RAT
|
2025-05-02
|
Windows Office Product Loaded MSHTML Module
|
Sysmon EventID 7
|
T1566.001
|
Anomaly
|
CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Microsoft MSHTML Remote Code Execution CVE-2021-40444, Spearphishing Attachments
|
2025-05-02
|
Windows Office Product Loading Taskschd DLL
|
Sysmon EventID 7
|
T1566.001
|
Anomaly
|
Spearphishing Attachments
|
2025-05-02
|
Windows Office Product Loading VBE7 DLL
|
Sysmon EventID 7
|
T1566.001
|
Anomaly
|
AgentTesla, Azorult, DarkCrystal RAT, IcedID, NjRAT, PlugX, Qakbot, Remcos, Spearphishing Attachments, Trickbot
|
2025-05-02
|
Windows Office Product Spawned Child Process For Download
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1566.001
|
TTP
|
CVE-2023-36884 Office and Windows HTML RCE Vulnerability, NjRAT, PlugX, Spearphishing Attachments
|
2025-05-02
|
Windows Office Product Spawned Control
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1566.001
|
TTP
|
Compromised Windows Host, Microsoft MSHTML Remote Code Execution CVE-2021-40444, Spearphishing Attachments
|
2025-05-02
|
Windows Office Product Spawned MSDT
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1566.001
|
TTP
|
Compromised Windows Host, Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190, Spearphishing Attachments
|
2025-05-02
|
Windows Office Product Spawned Rundll32 With No DLL
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1566.001
|
TTP
|
CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Compromised Windows Host, Crypto Stealer, Graceful Wipe Out Attack, Prestige Ransomware, Spearphishing Attachments
|
2025-05-02
|
Windows Office Product Spawned Uncommon Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1566.001
|
TTP
|
AgentTesla, Azorult, CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability, Compromised Windows Host, DarkCrystal RAT, FIN7, IcedID, NjRAT, PlugX, Qakbot, Remcos, Spearphishing Attachments, Trickbot, Warzone RAT
|
2025-05-02
|
Windows Outlook WebView Registry Modification
|
Sysmon EventID 13
|
T1112
|
Anomaly
|
Suspicious Windows Registry Activities
|
2025-05-02
|
Windows PaperCut NG Spawn Shell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059
T1190
T1133
|
TTP
|
Compromised Windows Host, PaperCut MF NG Vulnerability
|
2025-05-02
|
Windows Parent PID Spoofing with Explorer
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1134.004
|
TTP
|
Compromised Windows Host, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Password Managers Discovery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1555.005
|
Anomaly
|
Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows Password Policy Discovery with Net
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1201
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Windows Phishing Outlook Drop Dll In FORM Dir
|
Sysmon EventID 1, Sysmon EventID 11
|
T1566
|
TTP
|
Outlook RCE CVE-2024-21378
|
2025-05-02
|
Windows Phishing PDF File Executes URL Link
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1566.001
|
Anomaly
|
Snake Keylogger, Spearphishing Attachments
|
2025-05-02
|
Windows Phishing Recent ISO Exec Registry
|
Sysmon EventID 13
|
T1566.001
|
Hunting
|
AgentTesla, Azorult, Brute Ratel C4, Gozi Malware, IcedID, Qakbot, Remcos, Warzone RAT
|
2025-05-02
|
Windows Possible Credential Dumping
|
Sysmon EventID 10
|
T1003.001
|
TTP
|
CISA AA22-257A, CISA AA22-264A, CISA AA23-347A, Credential Dumping, DarkSide Ransomware, Detect Zerologon Attack
|
2025-05-02
|
Windows Post Exploitation Risk Behavior
|
|
T1012
T1049
T1069
T1016
T1003
T1082
T1115
T1552
|
Correlation
|
Windows Post-Exploitation
|
2025-05-02
|
Windows PowerShell Add Module to Global Assembly Cache
|
Powershell Script Block Logging 4104
|
T1505.004
|
TTP
|
IIS Components
|
2025-05-02
|
Windows PowerShell Disable HTTP Logging
|
Powershell Script Block Logging 4104
|
T1505.004
T1562.002
|
TTP
|
IIS Components, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows PowerShell Export Certificate
|
Powershell Script Block Logging 4104
|
T1552.004
T1649
|
Anomaly
|
Windows Certificate Services
|
2025-05-02
|
Windows PowerShell Export PfxCertificate
|
Powershell Script Block Logging 4104
|
T1552.004
T1649
|
Anomaly
|
Water Gamayun, Windows Certificate Services
|
2025-05-02
|
Windows PowerShell Get CIMInstance Remote Computer
|
Powershell Script Block Logging 4104
|
T1059.001
|
Anomaly
|
Active Directory Lateral Movement
|
2025-05-02
|
Windows Powershell History File Deletion
|
Powershell Script Block Logging 4104
|
T1059.003
T1070.003
|
Anomaly
|
Medusa Ransomware
|
2025-05-02
|
Windows PowerShell IIS Components WebGlobalModule Usage
|
Powershell Script Block Logging 4104
|
T1505.004
|
Anomaly
|
IIS Components
|
2025-05-02
|
Windows Powershell Import Applocker Policy
|
Powershell Script Block Logging 4104
|
T1059.001
T1562.001
|
TTP
|
Azorult
|
2025-05-02
|
Windows PowerShell Invoke-RestMethod IP Information Collection
|
Powershell Script Block Logging 4104
|
T1082
T1016
T1059.001
|
Anomaly
|
Water Gamayun
|
2025-05-02
|
Windows PowerShell Invoke-Sqlcmd Execution
|
Powershell Script Block Logging 4104
|
T1059.001
T1059.003
|
Hunting
|
SQL Server Abuse
|
2025-05-02
|
Windows Powershell Logoff User via Quser
|
Powershell Script Block Logging 4104
|
T1059.001
T1531
|
Anomaly
|
Crypto Stealer
|
2025-05-02
|
Windows PowerShell Process With Malicious String
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.001
|
TTP
|
Malicious PowerShell
|
2025-05-02
|
Windows Powershell RemoteSigned File
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.001
|
Anomaly
|
Amadey
|
2025-05-02
|
Windows PowerShell ScheduleTask
|
Powershell Script Block Logging 4104
|
T1053.005
T1059.001
|
Anomaly
|
Scheduled Tasks
|
2025-05-02
|
Windows PowerShell Script Block With Malicious String
|
Powershell Script Block Logging 4104
|
T1059.001
|
TTP
|
Malicious PowerShell
|
2025-05-02
|
Windows PowerShell WMI Win32 ScheduledJob
|
Powershell Script Block Logging 4104
|
T1059.001
|
TTP
|
Active Directory Lateral Movement
|
2025-05-02
|
Windows PowerSploit GPP Discovery
|
Powershell Script Block Logging 4104
|
T1552.006
|
TTP
|
Active Directory Privilege Escalation
|
2025-05-02
|
Windows PowerView AD Access Control List Enumeration
|
Powershell Script Block Logging 4104
|
T1078.002
T1069
|
TTP
|
Active Directory Discovery, Active Directory Privilege Escalation, Rhysida Ransomware
|
2025-05-02
|
Windows PowerView Constrained Delegation Discovery
|
Powershell Script Block Logging 4104
|
T1018
|
TTP
|
Active Directory Kerberos Attacks, CISA AA23-347A, Rhysida Ransomware
|
2025-05-02
|
Windows PowerView Kerberos Service Ticket Request
|
Powershell Script Block Logging 4104
|
T1558.003
|
TTP
|
Active Directory Kerberos Attacks, Rhysida Ransomware
|
2025-05-02
|
Windows PowerView SPN Discovery
|
Powershell Script Block Logging 4104
|
T1558.003
|
TTP
|
Active Directory Kerberos Attacks, CISA AA23-347A, Rhysida Ransomware
|
2025-05-02
|
Windows PowerView Unconstrained Delegation Discovery
|
Powershell Script Block Logging 4104
|
T1018
|
TTP
|
Active Directory Kerberos Attacks, CISA AA23-347A, Rhysida Ransomware
|
2025-05-02
|
Windows Private Keys Discovery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1552.004
|
Anomaly
|
Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows Privilege Escalation Suspicious Process Elevation
|
Sysmon EventID 1
|
T1068
T1548
T1134
|
TTP
|
BlackSuit Ransomware, Windows Privilege Escalation
|
2025-05-02
|
Windows Privilege Escalation System Process Without System Parent
|
Sysmon EventID 1
|
T1068
T1548
T1134
|
TTP
|
BlackSuit Ransomware, Windows Privilege Escalation
|
2025-05-02
|
Windows Privilege Escalation User Process Spawn System Process
|
Sysmon EventID 1
|
T1068
T1548
T1134
|
TTP
|
BlackSuit Ransomware, Compromised Windows Host, Windows Privilege Escalation
|
2025-05-02
|
Windows Privileged Group Modification
|
Windows Event Log Security 4727, Windows Event Log Security 4731, Windows Event Log Security 4744, Windows Event Log Security 4749, Windows Event Log Security 4754, Windows Event Log Security 4759, Windows Event Log Security 4783, Windows Event Log Security 4790
|
T1136.001
T1136.002
|
TTP
|
VMware ESXi AD Integration Authentication Bypass CVE-2024-37085
|
2025-05-02
|
Windows Process Executed From Removable Media
|
Sysmon EventID 1, Sysmon EventID 12, Sysmon EventID 13
|
T1200
T1025
T1091
|
Anomaly
|
Data Protection
|
2025-05-02
|
Windows Process Injection In Non-Service SearchIndexer
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055
|
TTP
|
Qakbot
|
2025-05-02
|
Windows Process Injection into Commonly Abused Processes
|
Sysmon EventID 10
|
T1055.002
|
Anomaly
|
BishopFox Sliver Adversary Emulation Framework, Earth Alux, SAP NetWeaver Exploitation
|
2025-05-02
|
Windows Process Injection into Notepad
|
Sysmon EventID 10
|
T1055.002
|
Anomaly
|
BishopFox Sliver Adversary Emulation Framework, Earth Alux
|
2025-05-02
|
Windows Process Injection Of Wermgr to Known Browser
|
Sysmon EventID 8
|
T1055.001
|
TTP
|
Qakbot
|
2025-05-02
|
Windows Process Injection Remote Thread
|
Sysmon EventID 8
|
T1055.002
|
TTP
|
Earth Alux, Graceful Wipe Out Attack, Qakbot, Warzone RAT, Water Gamayun
|
2025-05-02
|
Windows Process Injection Wermgr Child Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055
|
Anomaly
|
Qakbot, Windows Error Reporting Service Elevation of Privilege Vulnerability
|
2025-05-02
|
Windows Process Injection With Public Source Path
|
Sysmon EventID 8
|
T1055.002
|
Hunting
|
Brute Ratel C4, Earth Alux
|
2025-05-02
|
Windows Process With NamedPipe CommandLine
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055
|
Anomaly
|
Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Process With NetExec Command Line Parameters
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1550.003
T1558.003
T1558.004
|
TTP
|
Active Directory Kerberos Attacks, Active Directory Privilege Escalation
|
2025-05-02
|
Windows Process Writing File to World Writable Path
|
|
T1218.005
|
Hunting
|
APT29 Diplomatic Deceptions with WINELOADER, PHP-CGI RCE Attack on Japanese Organizations
|
2025-05-02
|
Windows Processes Killed By Industroyer2 Malware
|
Sysmon EventID 5
|
T1489
|
Anomaly
|
Data Destruction, Industroyer2
|
2025-05-02
|
Windows Protocol Tunneling with Plink
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1572
T1021.004
|
TTP
|
CISA AA22-257A
|
2025-05-02
|
Windows Proxy Via Netsh
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1090.001
|
Anomaly
|
Volt Typhoon
|
2025-05-02
|
Windows Proxy Via Registry
|
Sysmon EventID 13
|
T1090.001
|
Anomaly
|
Volt Typhoon
|
2025-05-02
|
Windows Query Registry Browser List Application
|
Windows Event Log Security 4663
|
T1012
|
Anomaly
|
China-Nexus Threat Activity, RedLine Stealer, Salt Typhoon, SnappyBee
|
2025-05-02
|
Windows Query Registry UnInstall Program List
|
Windows Event Log Security 4663
|
T1012
|
Anomaly
|
Meduza Stealer, RedLine Stealer
|
2025-05-02
|
Windows Raccine Scheduled Task Deletion
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
TTP
|
Compromised Windows Host, Ransomware
|
2025-05-02
|
Windows Rapid Authentication On Multiple Hosts
|
Windows Event Log Security 4624
|
T1003.002
|
TTP
|
Active Directory Lateral Movement, Active Directory Privilege Escalation
|
2025-05-02
|
Windows Rasautou DLL Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055.001
T1218
|
TTP
|
Compromised Windows Host, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Raw Access To Disk Volume Partition
|
Sysmon EventID 9
|
T1561.002
|
Anomaly
|
BlackByte Ransomware, CISA AA22-264A, Caddy Wiper, Data Destruction, Graceful Wipe Out Attack, Hermetic Wiper, NjRAT
|
2025-05-02
|
Windows Raw Access To Master Boot Record Drive
|
Sysmon EventID 9
|
T1561.002
|
TTP
|
BlackByte Ransomware, CISA AA22-264A, Caddy Wiper, Data Destruction, Graceful Wipe Out Attack, Hermetic Wiper, NjRAT, WhisperGate
|
2025-05-02
|
Windows RDP Connection Successful
|
Windows Event Log RemoteConnectionManager 1149
|
T1563.002
|
Hunting
|
Active Directory Lateral Movement, BlackByte Ransomware
|
2025-05-02
|
Windows RDP File Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1598.002
T1021.001
|
TTP
|
Spearphishing Attachments
|
2025-05-02
|
Windows RDPClient Connection Sequence Events
|
Windows Event Log Microsoft Windows TerminalServices RDPClient 1024
|
T1133
|
Anomaly
|
Spearphishing Attachments
|
2025-05-02
|
Windows Registry BootExecute Modification
|
Sysmon EventID 13
|
T1542
T1547.001
|
TTP
|
Windows BootKits
|
2025-05-02
|
Windows Registry Certificate Added
|
Sysmon EventID 13
|
T1553.004
|
Anomaly
|
Windows Drivers, Windows Registry Abuse
|
2025-05-02
|
Windows Registry Delete Task SD
|
Sysmon EventID 13
|
T1053.005
T1562
|
Anomaly
|
Scheduled Tasks, Windows Persistence Techniques, Windows Registry Abuse
|
2025-05-02
|
Windows Registry Dotnet ETW Disabled Via ENV Variable
|
Sysmon EventID 13
|
T1562.006
|
TTP
|
Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
Windows Registry Entries Exported Via Reg
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1012
|
Hunting
|
CISA AA23-347A, Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows Registry Entries Restored Via Reg
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1012
|
Hunting
|
Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows Registry Modification for Safe Mode Persistence
|
Sysmon EventID 13
|
T1547.001
|
TTP
|
Ransomware, Windows Drivers, Windows Registry Abuse
|
2025-05-02
|
Windows Registry Payload Injection
|
Sysmon EventID 13
|
T1027.011
|
TTP
|
Unusual Processes
|
2025-05-02
|
Windows Registry SIP Provider Modification
|
Sysmon EventID 13
|
T1553.003
|
TTP
|
Subvert Trust Controls SIP and Trust Provider Hijacking
|
2025-05-02
|
Windows Regsvr32 Renamed Binary
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.010
|
TTP
|
Compromised Windows Host, Qakbot
|
2025-05-02
|
Windows Remote Access Software BRC4 Loaded Dll
|
Sysmon EventID 7
|
T1219
T1003
|
Anomaly
|
Brute Ratel C4
|
2025-05-02
|
Windows Remote Access Software RMS Registry
|
Sysmon EventID 13
|
T1219
|
TTP
|
Azorult
|
2025-05-02
|
Windows Remote Assistance Spawning Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055
|
TTP
|
Compromised Windows Host, Unusual Processes
|
2025-05-02
|
Windows Remote Create Service
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1543.003
|
Anomaly
|
Active Directory Lateral Movement, BlackSuit Ransomware, CISA AA23-347A
|
2025-05-02
|
Windows Remote Host Computer Management Access
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.006
|
Anomaly
|
Medusa Ransomware
|
2025-05-02
|
Windows Remote Management Execute Shell
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.006
|
Anomaly
|
Crypto Stealer
|
2025-05-02
|
Windows Remote Service Rdpwinst Tool Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.001
|
TTP
|
Azorult, Compromised Windows Host
|
2025-05-02
|
Windows Remote Services Allow Rdp In Firewall
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.001
|
Anomaly
|
Azorult
|
2025-05-02
|
Windows Remote Services Allow Remote Assistance
|
Sysmon EventID 13
|
T1021.001
|
Anomaly
|
Azorult
|
2025-05-02
|
Windows Remote Services Rdp Enable
|
Sysmon EventID 13
|
T1021.001
|
TTP
|
Azorult, BlackSuit Ransomware, Medusa Ransomware
|
2025-05-02
|
Windows Root Domain linked policies Discovery
|
Powershell Script Block Logging 4104
|
T1087.002
|
Anomaly
|
Active Directory Discovery, Data Destruction, Industroyer2
|
2025-05-02
|
Windows Rundll32 Apply User Settings Changes
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.011
|
TTP
|
Rhysida Ransomware
|
2025-05-02
|
Windows Rundll32 WebDAV Request
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1048.003
|
TTP
|
CVE-2023-23397 Outlook Elevation of Privilege
|
2025-05-02
|
Windows Rundll32 WebDav With Network Connection
|
|
T1048.003
|
TTP
|
CVE-2023-23397 Outlook Elevation of Privilege
|
2025-05-02
|
Windows Scheduled Task Created Via XML
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1053.005
|
TTP
|
CISA AA23-347A, MoonPeak, Scheduled Tasks, Winter Vivern
|
2025-05-02
|
Windows Scheduled Task DLL Module Loaded
|
Sysmon EventID 7
|
T1053
|
TTP
|
ValleyRAT
|
2025-05-02
|
Windows Scheduled Task Service Spawned Shell
|
CrowdStrike ProcessRollup2, Sysmon EventID 1
|
T1053.005
T1059
|
TTP
|
Windows Persistence Techniques
|
2025-05-02
|
Windows Scheduled Task with Suspicious Command
|
Windows Event Log Security 4698, Windows Event Log Security 4700, Windows Event Log Security 4702
|
T1053.005
|
TTP
|
Ransomware, Ryuk Ransomware, Scheduled Tasks, Seashell Blizzard, Windows Persistence Techniques
|
2025-05-02
|
Windows Scheduled Task with Suspicious Name
|
Windows Event Log Security 4698, Windows Event Log Security 4700, Windows Event Log Security 4702
|
T1053.005
|
TTP
|
Ransomware, Ryuk Ransomware, Scheduled Tasks, Windows Persistence Techniques
|
2025-05-02
|
Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr
|
Windows Event Log Security 4698
|
T1053
|
TTP
|
ValleyRAT, Water Gamayun
|
2025-05-02
|
Windows Schtasks Create Run As System
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1053.005
|
TTP
|
Medusa Ransomware, Qakbot, Scheduled Tasks, Windows Persistence Techniques
|
2025-05-02
|
Windows ScManager Security Descriptor Tampering Via Sc.EXE
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1569.002
|
TTP
|
Defense Evasion or Unauthorized Access Via SDDL Tampering
|
2025-05-02
|
Windows Screen Capture in TEMP folder
|
Sysmon EventID 11
|
T1113
|
TTP
|
Braodo Stealer, Crypto Stealer
|
2025-05-02
|
Windows Screen Capture Via Powershell
|
Powershell Script Block Logging 4104
|
T1113
|
TTP
|
Water Gamayun, Winter Vivern
|
2025-05-02
|
Windows Security Account Manager Stopped
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1489
|
TTP
|
Compromised Windows Host, Ryuk Ransomware
|
2025-05-02
|
Windows Security And Backup Services Stop
|
Windows Event Log System 7036
|
T1490
|
TTP
|
BlackMatter Ransomware, Compromised Windows Host, LockBit Ransomware, Ransomware, Termite Ransomware
|
2025-05-02
|
Windows Security Support Provider Reg Query
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1547.005
|
Anomaly
|
Prestige Ransomware, Sneaky Active Directory Persistence Tricks, Windows Post-Exploitation
|
2025-05-02
|
Windows Sensitive Group Discovery With Net
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.002
|
Anomaly
|
Active Directory Discovery, BlackSuit Ransomware, IcedID, Rhysida Ransomware, Volt Typhoon
|
2025-05-02
|
Windows Sensitive Registry Hive Dump Via CommandLine
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1003.002
|
TTP
|
CISA AA22-257A, CISA AA23-347A, Compromised Windows Host, Credential Dumping, DarkSide Ransomware, Data Destruction, Industroyer2, Seashell Blizzard, Volt Typhoon, Windows Registry Abuse
|
2025-05-02
|
Windows Server Software Component GACUtil Install to GAC
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1505.004
|
TTP
|
IIS Components
|
2025-05-02
|
Windows Service Create Kernel Mode Driver
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1068
T1543.003
|
TTP
|
CISA AA22-320A, Windows Drivers
|
2025-05-02
|
Windows Service Create RemComSvc
|
Windows Event Log System 7045
|
T1543.003
|
Anomaly
|
Active Directory Discovery
|
2025-05-02
|
Windows Service Create SliverC2
|
Windows Event Log System 7045
|
T1569.002
|
TTP
|
BishopFox Sliver Adversary Emulation Framework, Compromised Windows Host
|
2025-05-02
|
Windows Service Create with Tscon
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1543.003
T1563.002
|
TTP
|
Active Directory Lateral Movement, Compromised Windows Host
|
2025-05-02
|
Windows Service Created with Suspicious Service Name
|
Windows Event Log System 7045
|
T1569.002
|
Anomaly
|
Active Directory Lateral Movement, Brute Ratel C4, CISA AA23-347A, Clop Ransomware, Flax Typhoon, PlugX, Qakbot, Snake Malware
|
2025-05-02
|
Windows Service Created with Suspicious Service Path
|
Windows Event Log System 7045
|
T1569.002
|
TTP
|
Active Directory Lateral Movement, Brute Ratel C4, CISA AA23-347A, China-Nexus Threat Activity, Clop Ransomware, Crypto Stealer, Derusbi, Flax Typhoon, PlugX, Qakbot, Salt Typhoon, Snake Malware
|
2025-05-02
|
Windows Service Creation on Remote Endpoint
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1543.003
|
TTP
|
Active Directory Lateral Movement, CISA AA23-347A, China-Nexus Threat Activity, Salt Typhoon, SnappyBee
|
2025-05-02
|
Windows Service Creation Using Registry Entry
|
Sysmon EventID 13
|
T1574.011
|
Anomaly
|
Active Directory Lateral Movement, Brute Ratel C4, CISA AA23-347A, China-Nexus Threat Activity, Crypto Stealer, Derusbi, PlugX, Salt Typhoon, SnappyBee, Suspicious Windows Registry Activities, Windows Persistence Techniques, Windows Registry Abuse
|
2025-05-02
|
Windows Service Deletion In Registry
|
Sysmon EventID 13
|
T1489
|
Anomaly
|
Brute Ratel C4, Crypto Stealer, PlugX
|
2025-05-02
|
Windows Service Execution RemCom
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1569.002
|
TTP
|
Active Directory Discovery
|
2025-05-02
|
Windows Service Initiation on Remote Endpoint
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1543.003
|
TTP
|
Active Directory Lateral Movement, CISA AA23-347A
|
2025-05-02
|
Windows Service Stop Attempt
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1489
|
Hunting
|
Graceful Wipe Out Attack, Prestige Ransomware
|
2025-05-02
|
Windows Service Stop By Deletion
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1489
|
TTP
|
Azorult, Crypto Stealer, Graceful Wipe Out Attack
|
2025-05-02
|
Windows Service Stop Win Updates
|
Windows Event Log System 7040
|
T1489
|
Anomaly
|
CISA AA23-347A, RedLine Stealer
|
2025-05-02
|
Windows Set Account Password Policy To Unlimited Via Net
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1489
|
Anomaly
|
BlackByte Ransomware, Crypto Stealer, Ransomware, XMRig
|
2025-05-02
|
Windows Shell Process from CrushFTP
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.001
T1059.003
T1190
T1505
|
TTP
|
CrushFTP Vulnerabilities
|
2025-05-02
|
Windows SIP Provider Inventory
|
|
T1553.003
|
Hunting
|
Subvert Trust Controls SIP and Trust Provider Hijacking
|
2025-05-02
|
Windows SIP WinVerifyTrust Failed Trust Validation
|
Windows Event Log CAPI2 81
|
T1553.003
|
Anomaly
|
Subvert Trust Controls SIP and Trust Provider Hijacking
|
2025-05-02
|
Windows Snake Malware File Modification Crmlog
|
Sysmon EventID 11
|
T1027
|
TTP
|
Snake Malware
|
2025-05-02
|
Windows Snake Malware Kernel Driver Comadmin
|
Sysmon EventID 11
|
T1547.006
|
TTP
|
Snake Malware
|
2025-05-02
|
Windows Snake Malware Registry Modification wav OpenWithProgIds
|
Sysmon EventID 13
|
T1112
|
TTP
|
Snake Malware
|
2025-05-02
|
Windows Snake Malware Service Create
|
Windows Event Log System 7045
|
T1547.006
T1569.002
|
TTP
|
Compromised Windows Host, Snake Malware
|
2025-05-02
|
Windows SnappyBee Create Test Registry
|
Sysmon EventID 13
|
T1112
|
TTP
|
China-Nexus Threat Activity, Salt Typhoon, SnappyBee
|
2025-05-02
|
Windows SOAPHound Binary Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.001
T1069.002
T1087.001
T1087.002
T1482
|
TTP
|
Compromised Windows Host, Windows Discovery Techniques
|
2025-05-02
|
Windows Spearphishing Attachment Onenote Spawn Mshta
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1566.001
|
TTP
|
AsyncRAT, Compromised Windows Host, Spearphishing Attachments
|
2025-05-02
|
Windows Special Privileged Logon On Multiple Hosts
|
Windows Event Log Security 4672
|
T1087
T1021.002
T1135
|
TTP
|
Active Directory Lateral Movement, Active Directory Privilege Escalation, Compromised Windows Host
|
2025-05-02
|
Windows SQL Server Configuration Option Hunt
|
Windows Event Log Application 15457
|
T1505.001
|
Hunting
|
SQL Server Abuse
|
2025-05-02
|
Windows SQL Server Critical Procedures Enabled
|
Windows Event Log Application 15457
|
T1505.001
|
TTP
|
SQL Server Abuse
|
2025-05-02
|
Windows SQL Server Extended Procedure DLL Loading Hunt
|
Windows Event Log Application 8128
|
T1505.001
T1059.009
|
Hunting
|
SQL Server Abuse
|
2025-05-02
|
Windows SQL Server Startup Procedure
|
Windows Event Log Application 17135
|
T1505.001
|
Anomaly
|
SQL Server Abuse
|
2025-05-02
|
Windows SQL Server xp_cmdshell Config Change
|
Windows Event Log Application 15457
|
T1505.001
|
TTP
|
SQL Server Abuse, Seashell Blizzard
|
2025-05-02
|
Windows SQL Spawning CertUtil
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
TTP
|
Flax Typhoon, SQL Server Abuse, Storm-2460 CLFS Zero Day Exploitation
|
2025-05-02
|
Windows SQLCMD Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059.003
|
Hunting
|
SQL Server Abuse
|
2025-05-02
|
Windows Sqlservr Spawning Shell
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1505.001
|
TTP
|
SQL Server Abuse
|
2025-05-02
|
Windows SqlWriter SQLDumper DLL Sideload
|
Sysmon EventID 7
|
T1574.001
|
TTP
|
APT29 Diplomatic Deceptions with WINELOADER
|
2025-05-02
|
Windows SSH Proxy Command
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1572
T1059.001
T1105
|
Anomaly
|
Living Off The Land, ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day
|
2025-05-02
|
Windows Steal Authentication Certificates - ESC1 Abuse
|
Windows Event Log Security 4886, Windows Event Log Security 4887
|
T1649
|
TTP
|
Windows Certificate Services
|
2025-05-02
|
Windows Steal Authentication Certificates - ESC1 Authentication
|
Windows Event Log Security 4768, Windows Event Log Security 4887
|
T1649
T1550
|
TTP
|
Compromised Windows Host, Windows Certificate Services
|
2025-05-02
|
Windows Steal Authentication Certificates Certificate Issued
|
Windows Event Log Security 4887
|
T1649
|
Anomaly
|
Windows Certificate Services
|
2025-05-02
|
Windows Steal Authentication Certificates Certificate Request
|
Windows Event Log Security 4886
|
T1649
|
Anomaly
|
Windows Certificate Services
|
2025-05-02
|
Windows Steal Authentication Certificates CertUtil Backup
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1649
|
Anomaly
|
Storm-2460 CLFS Zero Day Exploitation, Windows Certificate Services
|
2025-05-02
|
Windows Steal Authentication Certificates CryptoAPI
|
Windows Event Log CAPI2 70
|
T1649
|
Anomaly
|
Windows Certificate Services
|
2025-05-02
|
Windows Steal Authentication Certificates CS Backup
|
Windows Event Log Security 4876
|
T1649
|
Anomaly
|
Windows Certificate Services
|
2025-05-02
|
Windows Steal Authentication Certificates Export Certificate
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1649
|
Anomaly
|
Windows Certificate Services
|
2025-05-02
|
Windows Steal Authentication Certificates Export PfxCertificate
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1649
|
Anomaly
|
Windows Certificate Services
|
2025-05-02
|
Windows Steal or Forge Kerberos Tickets Klist
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1558
|
Hunting
|
Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows SubInAcl Execution
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1222.001
|
Anomaly
|
Defense Evasion or Unauthorized Access Via SDDL Tampering
|
2025-05-02
|
Windows Suspect Process With Authentication Traffic
|
Sysmon EventID 3
|
T1087.002
T1204.002
|
Anomaly
|
Active Directory Discovery
|
2025-05-02
|
Windows Suspicious Child Process Spawned From WebServer
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1505.003
|
TTP
|
BlackByte Ransomware, CISA AA22-257A, CISA AA22-264A, Citrix ShareFile RCE CVE-2023-24489, Compromised Windows Host, Flax Typhoon, HAFNIUM Group, Medusa Ransomware, ProxyNotShell, ProxyShell, SysAid On-Prem Software CVE-2023-47246 Vulnerability, WS FTP Server Critical Vulnerabilities
|
2025-05-02
|
Windows Suspicious Driver Loaded Path
|
Sysmon EventID 6
|
T1543.003
|
TTP
|
AgentTesla, BlackByte Ransomware, CISA AA22-320A, Snake Keylogger, XMRig
|
2025-05-02
|
Windows Svchost.exe Parent Process Anomaly
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.009
|
Anomaly
|
China-Nexus Threat Activity, SnappyBee
|
2025-05-02
|
Windows System Binary Proxy Execution Compiled HTML File Decompile
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1218.001
|
TTP
|
Compromised Windows Host, Living Off The Land, Suspicious Compiled HTML Activity
|
2025-05-02
|
Windows System Discovery Using ldap Nslookup
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1033
|
Anomaly
|
Qakbot
|
2025-05-02
|
Windows System Discovery Using Qwinsta
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1033
|
Hunting
|
Qakbot
|
2025-05-02
|
Windows System File on Disk
|
Sysmon EventID 11
|
T1068
|
Hunting
|
CISA AA22-264A, Crypto Stealer, Windows Drivers
|
2025-05-02
|
Windows System Network Config Discovery Display DNS
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1016
|
Anomaly
|
Medusa Ransomware, Prestige Ransomware, Water Gamayun, Windows Post-Exploitation
|
2025-05-02
|
Windows System Network Connections Discovery Netsh
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1049
|
Anomaly
|
Prestige Ransomware, Snake Keylogger, Windows Post-Exploitation
|
2025-05-02
|
Windows System Remote Discovery With Query
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1033
|
Anomaly
|
Active Directory Discovery, Medusa Ransomware
|
2025-05-02
|
Windows System Script Proxy Execution Syncappvpublishingserver
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1216
T1218
|
TTP
|
Living Off The Land
|
2025-05-02
|
Windows System Time Discovery W32tm Delay
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1124
|
Anomaly
|
DarkCrystal RAT
|
2025-05-02
|
Windows System User Discovery Via Quser
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1033
|
Hunting
|
Crypto Stealer, Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows System User Privilege Discovery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1033
|
Hunting
|
CISA AA23-347A
|
2025-05-02
|
Windows Terminating Lsass Process
|
Sysmon EventID 10
|
T1562.001
|
Anomaly
|
Data Destruction, Double Zero Destructor
|
2025-05-02
|
Windows Time Based Evasion
|
CrowdStrike ProcessRollup2, Sysmon EventID 1
|
T1497.003
|
TTP
|
NjRAT
|
2025-05-02
|
Windows Time Based Evasion via Choice Exec
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1497.003
|
Anomaly
|
Snake Keylogger
|
2025-05-02
|
Windows UAC Bypass Suspicious Child Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1548.002
|
TTP
|
Living Off The Land, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows UAC Bypass Suspicious Escalation Behavior
|
Sysmon EventID 1
|
T1548.002
|
TTP
|
Compromised Windows Host, Living Off The Land, Windows Defense Evasion Tactics
|
2025-05-02
|
Windows Unsecured Outlook Credentials Access In Registry
|
Windows Event Log Security 4663
|
T1552
|
Anomaly
|
Meduza Stealer, Snake Keylogger
|
2025-05-02
|
Windows Unsigned DLL Side-Loading
|
Sysmon EventID 7
|
T1574.001
|
Anomaly
|
China-Nexus Threat Activity, Derusbi, Earth Alux, NjRAT, Salt Typhoon, Warzone RAT
|
2025-05-02
|
Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos
|
Windows Event Log Security 4768
|
T1110.003
|
Anomaly
|
Active Directory Kerberos Attacks, Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos
|
Windows Event Log Security 4768
|
T1110.003
|
Anomaly
|
Active Directory Kerberos Attacks, Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM
|
Windows Event Log Security 4776
|
T1110.003
|
Anomaly
|
Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials
|
Windows Event Log Security 4648
|
T1110.003
|
Anomaly
|
Active Directory Password Spraying, Insider Threat, Volt Typhoon
|
2025-05-02
|
Windows Unusual Count Of Users Failed To Auth Using Kerberos
|
Windows Event Log Security 4771
|
T1110.003
|
Anomaly
|
Active Directory Kerberos Attacks, Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Unusual Count Of Users Failed To Authenticate From Process
|
Windows Event Log Security 4625
|
T1110.003
|
Anomaly
|
Active Directory Password Spraying, Insider Threat, Volt Typhoon
|
2025-05-02
|
Windows Unusual Count Of Users Failed To Authenticate Using NTLM
|
Windows Event Log Security 4776
|
T1110.003
|
Anomaly
|
Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Unusual Count Of Users Remotely Failed To Auth From Host
|
Windows Event Log Security 4625
|
T1110.003
|
Anomaly
|
Active Directory Password Spraying, Volt Typhoon
|
2025-05-02
|
Windows Unusual NTLM Authentication Destinations By Source
|
NTLM Operational 8004, NTLM Operational 8005, NTLM Operational 8006
|
T1110.003
|
Anomaly
|
Active Directory Password Spraying
|
2025-05-02
|
Windows Unusual NTLM Authentication Destinations By User
|
NTLM Operational 8004, NTLM Operational 8005, NTLM Operational 8006
|
T1110.003
|
Anomaly
|
Active Directory Password Spraying
|
2025-05-02
|
Windows Unusual NTLM Authentication Users By Destination
|
NTLM Operational 8004, NTLM Operational 8005, NTLM Operational 8006
|
T1110.003
|
Anomaly
|
Active Directory Password Spraying
|
2025-05-02
|
Windows Unusual NTLM Authentication Users By Source
|
NTLM Operational 8004, NTLM Operational 8005, NTLM Operational 8006
|
T1110.003
|
Anomaly
|
Active Directory Password Spraying
|
2025-05-02
|
Windows Unusual SysWOW64 Process Run System32 Executable
|
Sysmon EventID 1, Windows Event Log Security 4688
|
T1036.009
|
Anomaly
|
China-Nexus Threat Activity, DarkGate Malware, Salt Typhoon
|
2025-05-02
|
Windows USBSTOR Registry Key Modification
|
Sysmon EventID 12, Sysmon EventID 13
|
T1200
T1025
T1091
|
Anomaly
|
Data Protection
|
2025-05-02
|
Windows User Deletion Via Net
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1531
|
Anomaly
|
DarkGate Malware, Graceful Wipe Out Attack, XMRig
|
2025-05-02
|
Windows User Disabled Via Net
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1531
|
Anomaly
|
XMRig
|
2025-05-02
|
Windows User Discovery Via Net
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1087.001
|
Hunting
|
Active Directory Discovery, Medusa Ransomware, Sandworm Tools
|
2025-05-02
|
Windows Vulnerable 3CX Software
|
Sysmon EventID 1
|
T1195.002
|
TTP
|
3CX Supply Chain Attack
|
2025-05-02
|
Windows Vulnerable Driver Installed
|
Windows Event Log System 7045
|
T1543.003
|
TTP
|
Windows Drivers
|
2025-05-02
|
Windows Vulnerable Driver Loaded
|
Sysmon EventID 6
|
T1543.003
|
Hunting
|
BlackByte Ransomware, Windows Drivers
|
2025-05-02
|
Windows WinDBG Spawning AutoIt3
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1059
|
TTP
|
Compromised Windows Host, DarkGate Malware
|
2025-05-02
|
Windows WinLogon with Public Network Connection
|
Sysmon EventID 1, Sysmon EventID 3
|
T1542.003
|
Hunting
|
BlackLotus Campaign
|
2025-05-02
|
Windows WMI Impersonate Token
|
Sysmon EventID 10
|
T1047
|
Anomaly
|
Qakbot, Water Gamayun
|
2025-05-02
|
Windows WMI Process And Service List
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1047
|
Anomaly
|
Prestige Ransomware, Windows Post-Exploitation
|
2025-05-02
|
Windows WMI Process Call Create
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1047
|
Hunting
|
CISA AA23-347A, Cactus Ransomware, IcedID, Qakbot, Suspicious WMI Use, Volt Typhoon
|
2025-05-02
|
Windows WMIC Shadowcopy Delete
|
Sysmon EventID 1
|
T1490
|
Anomaly
|
Cactus Ransomware, Suspicious WMI Use, Volt Typhoon
|
2025-05-02
|
Windows WPDBusEnum Registry Key Modification
|
Sysmon EventID 12, Sysmon EventID 13
|
T1200
T1025
T1091
|
Anomaly
|
Data Protection
|
2025-05-02
|
WinEvent Scheduled Task Created to Spawn Shell
|
Windows Event Log Security 4698
|
T1053.005
|
TTP
|
CISA AA22-257A, China-Nexus Threat Activity, Compromised Windows Host, Medusa Ransomware, Ransomware, Ryuk Ransomware, Salt Typhoon, Scheduled Tasks, SystemBC, Windows Error Reporting Service Elevation of Privilege Vulnerability, Windows Persistence Techniques, Winter Vivern
|
2025-05-02
|
Winhlp32 Spawning a Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1055
|
TTP
|
Compromised Windows Host, Remcos
|
2025-05-02
|
WinRAR Spawning Shell Application
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1105
|
TTP
|
Compromised Windows Host, WinRAR Spoofing Attack CVE-2023-38831
|
2025-05-02
|
WinRM Spawning a Process
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1190
|
TTP
|
CISA AA23-347A, Rhysida Ransomware, Unusual Processes
|
2025-05-02
|
WMI Permanent Event Subscription
|
|
T1047
|
TTP
|
Suspicious WMI Use
|
2025-05-02
|
WMI Permanent Event Subscription - Sysmon
|
Sysmon EventID 21
|
T1546.003
|
TTP
|
Suspicious WMI Use
|
2025-05-02
|
WMI Recon Running Process Or Services
|
Powershell Script Block Logging 4104
|
T1592
|
Anomaly
|
Data Destruction, Hermetic Wiper, Malicious PowerShell
|
2025-05-02
|
WMI Temporary Event Subscription
|
|
T1047
|
TTP
|
Suspicious WMI Use
|
2025-05-02
|
Wmic Group Discovery
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1069.001
|
Hunting
|
Active Directory Discovery
|
2025-05-02
|
Wmic NonInteractive App Uninstallation
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1562.001
|
Hunting
|
Azorult, IcedID
|
2025-05-02
|
WMIC XSL Execution via URL
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1220
|
TTP
|
Compromised Windows Host, Suspicious WMI Use
|
2025-05-02
|
Wmiprsve LOLBAS Execution Process Spawn
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1047
|
TTP
|
Active Directory Lateral Movement
|
2025-05-02
|
Wsmprovhost LOLBAS Execution Process Spawn
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1021.006
|
TTP
|
Active Directory Lateral Movement, CISA AA24-241A
|
2025-05-02
|
WSReset UAC Bypass
|
Sysmon EventID 12, Sysmon EventID 13
|
T1548.002
|
TTP
|
Living Off The Land, MoonPeak, Windows Defense Evasion Tactics, Windows Registry Abuse
|
2025-05-02
|
XMRIG Driver Loaded
|
Sysmon EventID 6
|
T1543.003
|
TTP
|
CISA AA22-320A, Crypto Stealer, XMRig
|
2025-05-02
|
XSL Script Execution With WMIC
|
CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688
|
T1220
|
TTP
|
FIN7, Suspicious WMI Use
|
2025-05-02
|
3CX Supply Chain Attack Network Indicators
|
Sysmon EventID 22
|
T1195.002
|
TTP
|
3CX Supply Chain Attack
|
2025-05-02
|
Cisco Secure Firewall - Binary File Type Download
|
Cisco Secure Firewall Threat Defense File Event
|
T1203
T1059
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Bits Network Activity
|
Cisco Secure Firewall Threat Defense Connection Event
|
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint
|
Cisco Secure Firewall Threat Defense Connection Event
|
T1587.002
T1588.004
T1071.001
T1573.002
|
TTP
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Blocked Connection
|
Cisco Secure Firewall Threat Defense Connection Event
|
T1018
T1046
T1110
T1203
T1595.002
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Communication Over Suspicious Ports
|
Cisco Secure Firewall Threat Defense Connection Event
|
T1021
T1055
T1059.001
T1105
T1219
T1571
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Connection to File Sharing Domain
|
Cisco Secure Firewall Threat Defense Connection Event
|
T1071.001
T1090.002
T1105
T1567.002
T1588.002
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - File Download Over Uncommon Port
|
Cisco Secure Firewall Threat Defense File Event
|
T1105
T1571
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - High EVE Threat Confidence
|
Cisco Secure Firewall Threat Defense Connection Event
|
T1041
T1071.001
T1105
T1573.002
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - High Volume of Intrusion Events Per Host
|
Cisco Secure Firewall Threat Defense Intrusion Event
|
T1059
T1071
T1595.002
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Malware File Downloaded
|
Cisco Secure Firewall Threat Defense File Event
|
T1203
T1105
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Possibly Compromised Host
|
Cisco Secure Firewall Threat Defense Intrusion Event
|
T1203
T1059
T1587.001
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Potential Data Exfiltration
|
Cisco Secure Firewall Threat Defense Connection Event
|
T1041
T1567.002
T1048.003
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Rare Snort Rule Triggered
|
Cisco Secure Firewall Threat Defense Intrusion Event
|
T1598
T1583.006
|
Hunting
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Repeated Blocked Connections
|
Cisco Secure Firewall Threat Defense Connection Event
|
T1018
T1046
T1110
T1203
T1595.002
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Repeated Malware Downloads
|
Cisco Secure Firewall Threat Defense File Event
|
T1105
T1027
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts
|
Cisco Secure Firewall Threat Defense Intrusion Event
|
T1105
T1027
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Cisco Secure Firewall - Wget or Curl Download
|
Cisco Secure Firewall Threat Defense Connection Event
|
T1053.003
T1059
T1071.001
T1105
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-05-02
|
Detect ARP Poisoning
|
|
T1200
T1498
T1557.002
|
TTP
|
Router and Infrastructure Security
|
2025-05-02
|
Detect DGA domains using pretrained model in DSDL
|
|
T1568.002
|
Anomaly
|
Command And Control, DNS Hijacking, Data Exfiltration, Dynamic DNS, Suspicious DNS Traffic
|
2025-05-02
|
Detect DNS Data Exfiltration using pretrained model in DSDL
|
|
T1048.003
|
Anomaly
|
Command And Control, DNS Hijacking, Suspicious DNS Traffic
|
2025-05-02
|
Detect DNS Query to Decommissioned S3 Bucket
|
Sysmon EventID 22
|
T1485
|
Anomaly
|
AWS S3 Bucket Security Monitoring, Data Destruction
|
2025-05-02
|
Detect hosts connecting to dynamic domain providers
|
Sysmon EventID 22
|
T1189
|
TTP
|
Command And Control, DNS Hijacking, Data Protection, Dynamic DNS, Prohibited Traffic Allowed or Protocol Mismatch, Suspicious DNS Traffic
|
2025-05-02
|
Detect IPv6 Network Infrastructure Threats
|
|
T1200
T1498
T1557.002
|
TTP
|
Router and Infrastructure Security
|
2025-05-02
|
Detect Large ICMP Traffic
|
Palo Alto Network Traffic
|
T1095
|
TTP
|
Backdoor Pingpong, China-Nexus Threat Activity, Command And Control
|
2025-05-02
|
Detect Outbound LDAP Traffic
|
Palo Alto Network Traffic
|
T1190
T1059
|
Hunting
|
Log4Shell CVE-2021-44228
|
2025-05-02
|
Detect Outbound SMB Traffic
|
Zeek Conn
|
T1071.002
|
TTP
|
DHS Report TA18-074A, Hidden Cobra Malware, NOBELIUM Group
|
2025-05-02
|
Detect Port Security Violation
|
|
T1200
T1498
T1557.002
|
TTP
|
Router and Infrastructure Security
|
2025-05-02
|
Detect Remote Access Software Usage DNS
|
Sysmon EventID 22
|
T1219
|
Anomaly
|
CISA AA24-241A, Command And Control, Insider Threat, Ransomware, Remote Monitoring and Management Software
|
2025-05-02
|
Detect Remote Access Software Usage Traffic
|
Palo Alto Network Traffic
|
T1219
|
Anomaly
|
Command And Control, Insider Threat, Ransomware, Remote Monitoring and Management Software
|
2025-05-02
|
Detect Rogue DHCP Server
|
|
T1200
T1498
T1557
|
TTP
|
Router and Infrastructure Security
|
2025-05-02
|
Detect SNICat SNI Exfiltration
|
|
T1041
|
TTP
|
Data Exfiltration
|
2025-05-02
|
Detect Software Download To Network Device
|
|
T1542.005
|
TTP
|
Router and Infrastructure Security
|
2025-05-02
|
Detect suspicious DNS TXT records using pretrained model in DSDL
|
|
T1568.002
|
Anomaly
|
Command And Control, DNS Hijacking, Suspicious DNS Traffic
|
2025-05-02
|
Detect Traffic Mirroring
|
|
T1020.001
T1200
T1498
|
TTP
|
Router and Infrastructure Security
|
2025-05-02
|
Detect Unauthorized Assets by MAC address
|
|
|
TTP
|
Asset Tracking
|
2025-05-02
|
Detect Windows DNS SIGRed via Splunk Stream
|
|
T1203
|
TTP
|
Windows DNS SIGRed CVE-2020-1350
|
2025-05-02
|
Detect Windows DNS SIGRed via Zeek
|
|
T1203
|
TTP
|
Windows DNS SIGRed CVE-2020-1350
|
2025-05-02
|
Detect Zerologon via Zeek
|
|
T1190
|
TTP
|
Black Basta Ransomware, Detect Zerologon Attack, Rhysida Ransomware
|
2025-05-02
|
DNS Query Length Outliers - MLTK
|
|
T1071.004
|
Anomaly
|
Command And Control, Hidden Cobra Malware, Suspicious DNS Traffic
|
2025-05-02
|
DNS Query Length With High Standard Deviation
|
Sysmon EventID 22
|
T1048.003
|
Anomaly
|
Command And Control, Hidden Cobra Malware, Suspicious DNS Traffic
|
2025-05-02
|
Excessive DNS Failures
|
|
T1071.004
|
Anomaly
|
Command And Control, Suspicious DNS Traffic
|
2025-05-02
|
F5 BIG-IP iControl REST Vulnerability CVE-2022-1388
|
Palo Alto Network Threat
|
T1190
T1133
|
TTP
|
CISA AA24-241A, F5 BIG-IP Vulnerability CVE-2022-1388
|
2025-05-02
|
Hosts receiving high volume of network traffic from email server
|
|
T1114.002
|
Anomaly
|
Collection and Staging
|
2025-05-02
|
Internal Horizontal Port Scan
|
AWS CloudWatchLogs VPCflow
|
T1046
|
TTP
|
Network Discovery
|
2025-05-02
|
Internal Horizontal Port Scan NMAP Top 20
|
AWS CloudWatchLogs VPCflow
|
T1046
|
TTP
|
Network Discovery
|
2025-05-02
|
Internal Vertical Port Scan
|
AWS CloudWatchLogs VPCflow
|
T1046
|
TTP
|
Network Discovery
|
2025-05-02
|
Internal Vulnerability Scan
|
|
T1595.002
T1046
|
TTP
|
Network Discovery
|
2025-05-02
|
Large Volume of DNS ANY Queries
|
|
T1498.002
|
Anomaly
|
DNS Amplification Attacks
|
2025-05-02
|
Ngrok Reverse Proxy on Network
|
Sysmon EventID 22
|
T1572
T1090
T1102
|
Anomaly
|
CISA AA22-320A, CISA AA24-241A, Reverse Network Proxy
|
2025-05-02
|
Prohibited Network Traffic Allowed
|
Zeek Conn
|
T1048
|
TTP
|
Command And Control, Prohibited Traffic Allowed or Protocol Mismatch, Ransomware
|
2025-05-02
|
Protocol or Port Mismatch
|
|
T1048.003
|
Anomaly
|
Command And Control, Prohibited Traffic Allowed or Protocol Mismatch
|
2025-05-02
|
Protocols passing authentication in cleartext
|
|
|
Anomaly
|
Use of Cleartext Protocols
|
2025-05-02
|
Remote Desktop Network Traffic
|
Zeek Conn
|
T1021.001
|
Anomaly
|
Active Directory Lateral Movement, Hidden Cobra Malware, Ryuk Ransomware, SamSam Ransomware
|
2025-05-02
|
Rundll32 DNSQuery
|
Sysmon EventID 22
|
T1218.011
|
TTP
|
IcedID, Living Off The Land
|
2025-05-02
|
SMB Traffic Spike
|
|
T1021.002
|
Anomaly
|
DHS Report TA18-074A, Emotet Malware DHS Report TA18-201A, Hidden Cobra Malware, Ransomware
|
2025-05-02
|
SMB Traffic Spike - MLTK
|
|
T1021.002
|
Anomaly
|
DHS Report TA18-074A, Emotet Malware DHS Report TA18-201A, Hidden Cobra Malware, Ransomware
|
2025-05-02
|
SSL Certificates with Punycode
|
|
T1573
|
Hunting
|
OpenSSL CVE-2022-3602
|
2025-05-02
|
Suspicious Process DNS Query Known Abuse Web Services
|
Sysmon EventID 22
|
T1059.005
|
TTP
|
Cactus Ransomware, Data Destruction, Meduza Stealer, PXA Stealer, Phemedrone Stealer, Remcos, Snake Keylogger, WhisperGate
|
2025-05-02
|
Suspicious Process With Discord DNS Query
|
Sysmon EventID 22
|
T1059.005
|
Anomaly
|
Cactus Ransomware, Data Destruction, PXA Stealer, WhisperGate
|
2025-05-02
|
TOR Traffic
|
Palo Alto Network Traffic
|
T1090.003
|
TTP
|
Command And Control, NOBELIUM Group, Prohibited Traffic Allowed or Protocol Mismatch, Ransomware
|
2025-05-02
|
Wermgr Process Connecting To IP Check Web Services
|
Sysmon EventID 22
|
T1590.005
|
TTP
|
Trickbot
|
2025-05-02
|
Windows Abused Web Services
|
Sysmon EventID 22
|
T1102
|
TTP
|
CISA AA24-241A, NjRAT
|
2025-05-02
|
Windows AD Replication Service Traffic
|
|
T1003.006
T1207
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows AD Rogue Domain Controller Network Activity
|
|
T1207
|
TTP
|
Sneaky Active Directory Persistence Tricks
|
2025-05-02
|
Windows DNS Query Request by Telegram Bot API
|
Sysmon EventID 22
|
T1071.004
T1102.002
|
Anomaly
|
Crypto Stealer
|
2025-05-02
|
Windows Gather Victim Network Info Through Ip Check Web Services
|
Sysmon EventID 22
|
T1590.005
|
Hunting
|
Azorult, DarkCrystal RAT, Handala Wiper, Meduza Stealer, PXA Stealer, Phemedrone Stealer, Snake Keylogger, Water Gamayun
|
2025-05-02
|
Windows Multi hop Proxy TOR Website Query
|
Sysmon EventID 22
|
T1071.003
|
Anomaly
|
AgentTesla
|
2025-05-02
|
Windows Remote Desktop Network Bruteforce Attempt
|
Sysmon EventID 3
|
T1110.001
|
Anomaly
|
Compromised User Account, Ryuk Ransomware, SamSam Ransomware
|
2025-05-02
|
Windows Spearphishing Attachment Connect To None MS Office Domain
|
Sysmon EventID 22
|
T1566.001
|
Hunting
|
AsyncRAT, Spearphishing Attachments
|
2025-05-02
|
Zeek x509 Certificate with Punycode
|
|
T1573
|
Hunting
|
OpenSSL CVE-2022-3602
|
2025-05-02
|
Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint
|
Suricata
|
T1190
|
TTP
|
CISA AA24-241A, Ivanti Connect Secure VPN Vulnerabilities
|
2025-05-02
|
Adobe ColdFusion Access Control Bypass
|
Suricata
|
T1190
|
TTP
|
Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360
|
2025-05-02
|
Adobe ColdFusion Unauthenticated Arbitrary File Read
|
Suricata
|
T1190
|
TTP
|
Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360
|
2025-05-02
|
Cisco IOS XE Implant Access
|
Suricata
|
T1190
|
TTP
|
Cisco IOS XE Software Web Management User Interface vulnerability
|
2025-05-02
|
Citrix ADC and Gateway Unauthorized Data Disclosure
|
Suricata
|
T1190
|
TTP
|
Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966
|
2025-05-02
|
Citrix ADC Exploitation CVE-2023-3519
|
Palo Alto Network Threat
|
T1190
|
Hunting
|
CISA AA24-241A, Citrix Netscaler ADC CVE-2023-3519
|
2025-05-02
|
Citrix ShareFile Exploitation CVE-2023-24489
|
Suricata
|
T1190
|
Hunting
|
Citrix ShareFile RCE CVE-2023-24489
|
2025-05-02
|
Confluence CVE-2023-22515 Trigger Vulnerability
|
Suricata
|
T1190
|
TTP
|
CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server
|
2025-05-02
|
Confluence Data Center and Server Privilege Escalation
|
Nginx Access
|
T1190
|
TTP
|
CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server, Confluence Data Center and Confluence Server Vulnerabilities
|
2025-05-02
|
Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527
|
Suricata
|
T1190
|
TTP
|
Confluence Data Center and Confluence Server Vulnerabilities
|
2025-05-02
|
Confluence Unauthenticated Remote Code Execution CVE-2022-26134
|
Palo Alto Network Threat
|
T1505
T1190
T1133
|
TTP
|
Atlassian Confluence Server and Data Center CVE-2022-26134, Confluence Data Center and Confluence Server Vulnerabilities
|
2025-05-02
|
ConnectWise ScreenConnect Authentication Bypass
|
Suricata
|
T1190
|
TTP
|
ConnectWise ScreenConnect Vulnerabilities, Seashell Blizzard
|
2025-05-02
|
CrushFTP Authentication Bypass Exploitation
|
CrushFTP
|
T1190
T1059.003
T1059.001
|
TTP
|
CrushFTP Vulnerabilities
|
2025-05-02
|
CrushFTP Max Simultaneous Users From IP
|
CrushFTP
|
T1110.001
T1110.004
|
Anomaly
|
CrushFTP Vulnerabilities
|
2025-05-02
|
Detect attackers scanning for vulnerable JBoss servers
|
|
T1082
T1133
|
TTP
|
JBoss Vulnerability, SamSam Ransomware
|
2025-05-02
|
Detect F5 TMUI RCE CVE-2020-5902
|
|
T1190
|
TTP
|
F5 TMUI RCE CVE-2020-5902
|
2025-05-02
|
Detect malicious requests to exploit JBoss servers
|
|
|
TTP
|
JBoss Vulnerability, SamSam Ransomware
|
2025-05-02
|
Detect Remote Access Software Usage URL
|
Palo Alto Network Threat
|
T1219
|
Anomaly
|
CISA AA24-241A, Command And Control, Insider Threat, Ransomware, Remote Monitoring and Management Software
|
2025-05-02
|
Detect Web Access to Decommissioned S3 Bucket
|
AWS Cloudfront
|
T1485
|
Anomaly
|
AWS S3 Bucket Security Monitoring, Data Destruction
|
2025-05-02
|
Exploit Public Facing Application via Apache Commons Text
|
Nginx Access
|
T1133
T1190
T1505.003
|
Anomaly
|
Text4Shell CVE-2022-42889
|
2025-05-02
|
Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952
|
Palo Alto Network Threat
|
T1190
T1133
|
TTP
|
Fortinet FortiNAC CVE-2022-39952
|
2025-05-02
|
F5 TMUI Authentication Bypass
|
Suricata
|
|
TTP
|
F5 Authentication Bypass with TMUI
|
2025-05-02
|
Fortinet Appliance Auth bypass
|
Palo Alto Network Threat
|
T1190
T1133
|
TTP
|
CVE-2022-40684 Fortinet Appliance Auth bypass
|
2025-05-02
|
High Volume of Bytes Out to Url
|
Nginx Access
|
T1567
|
Anomaly
|
Data Exfiltration
|
2025-05-02
|
Hunting for Log4Shell
|
Nginx Access
|
T1190
T1133
|
Hunting
|
CISA AA22-320A, Log4Shell CVE-2021-44228
|
2025-05-02
|
Ivanti Connect Secure Command Injection Attempts
|
Suricata
|
T1190
|
TTP
|
CISA AA24-241A, Ivanti Connect Secure VPN Vulnerabilities
|
2025-05-02
|
Ivanti Connect Secure SSRF in SAML Component
|
Suricata
|
T1190
|
TTP
|
Ivanti Connect Secure VPN Vulnerabilities
|
2025-05-02
|
Ivanti Connect Secure System Information Access via Auth Bypass
|
Suricata
|
T1190
|
Anomaly
|
CISA AA24-241A, Ivanti Connect Secure VPN Vulnerabilities
|
2025-05-02
|
Ivanti EPM SQL Injection Remote Code Execution
|
Suricata
|
T1190
|
TTP
|
Ivanti EPM Vulnerabilities
|
2025-05-02
|
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078
|
Suricata
|
T1190
T1133
|
TTP
|
Ivanti EPMM Remote Unauthenticated Access
|
2025-05-02
|
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082
|
Suricata
|
T1190
T1133
|
TTP
|
Ivanti EPMM Remote Unauthenticated Access
|
2025-05-02
|
Ivanti Sentry Authentication Bypass
|
Suricata
|
T1190
|
TTP
|
Ivanti Sentry Authentication Bypass CVE-2023-38035
|
2025-05-02
|
Java Class File download by Java User Agent
|
Splunk Stream HTTP
|
T1190
|
TTP
|
Log4Shell CVE-2021-44228
|
2025-05-02
|
Jenkins Arbitrary File Read CVE-2024-23897
|
Nginx Access
|
T1190
|
TTP
|
Jenkins Server Vulnerabilities
|
2025-05-02
|
JetBrains TeamCity Authentication Bypass CVE-2024-27198
|
Suricata
|
T1190
|
TTP
|
JetBrains TeamCity Vulnerabilities
|
2025-05-02
|
JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198
|
Suricata
|
T1190
|
TTP
|
JetBrains TeamCity Vulnerabilities
|
2025-05-02
|
JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199
|
Suricata
|
T1190
|
TTP
|
JetBrains TeamCity Vulnerabilities
|
2025-05-02
|
JetBrains TeamCity RCE Attempt
|
Suricata
|
T1190
|
TTP
|
CISA AA23-347A, JetBrains TeamCity Unauthenticated RCE, JetBrains TeamCity Vulnerabilities
|
2025-05-02
|
Juniper Networks Remote Code Execution Exploit Detection
|
Suricata
|
T1190
T1105
T1059
|
TTP
|
Juniper JunOS Remote Code Execution
|
2025-05-02
|
Log4Shell JNDI Payload Injection Attempt
|
Nginx Access
|
T1190
T1133
|
Anomaly
|
CISA AA22-257A, CISA AA22-320A, Log4Shell CVE-2021-44228
|
2025-05-02
|
Log4Shell JNDI Payload Injection with Outbound Connection
|
|
T1190
T1133
|
Anomaly
|
CISA AA22-320A, Log4Shell CVE-2021-44228
|
2025-05-02
|
Microsoft SharePoint Server Elevation of Privilege
|
Suricata
|
T1068
|
TTP
|
Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357
|
2025-05-02
|
Monitor Web Traffic For Brand Abuse
|
|
|
TTP
|
Brand Monitoring
|
2025-05-02
|
Multiple Archive Files Http Post Traffic
|
Splunk Stream HTTP
|
T1048.003
|
TTP
|
Command And Control, Data Exfiltration
|
2025-05-02
|
Nginx ConnectWise ScreenConnect Authentication Bypass
|
Nginx Access
|
T1190
|
TTP
|
ConnectWise ScreenConnect Vulnerabilities, Seashell Blizzard
|
2025-05-02
|
PaperCut NG Remote Web Access Attempt
|
Suricata
|
T1190
T1133
|
TTP
|
PaperCut MF NG Vulnerability
|
2025-05-02
|
Plain HTTP POST Exfiltrated Data
|
Splunk Stream HTTP
|
T1048.003
|
TTP
|
Command And Control, Data Exfiltration
|
2025-05-02
|
ProxyShell ProxyNotShell Behavior Detected
|
|
T1190
T1133
|
Correlation
|
ProxyNotShell, ProxyShell, Seashell Blizzard
|
2025-05-02
|
SAP NetWeaver Visual Composer Exploitation Attempt
|
Suricata
|
T1190
|
Hunting
|
SAP NetWeaver Exploitation
|
2025-05-02
|
Spring4Shell Payload URL Request
|
Nginx Access
|
T1133
T1190
T1505.003
|
TTP
|
Spring4Shell CVE-2022-22965
|
2025-05-02
|
SQL Injection with Long URLs
|
|
T1190
|
TTP
|
SQL Injection
|
2025-05-02
|
Supernova Webshell
|
|
T1505.003
T1133
|
TTP
|
Earth Alux, NOBELIUM Group
|
2025-05-02
|
Tomcat Session Deserialization Attempt
|
Nginx Access
|
T1190
T1505.003
|
Anomaly
|
Apache Tomcat Session Deserialization Attacks
|
2025-05-02
|
Tomcat Session File Upload Attempt
|
Nginx Access
|
T1190
T1505.003
|
Anomaly
|
Apache Tomcat Session Deserialization Attacks
|
2025-05-02
|
Unusually Long Content-Type Length
|
|
|
Anomaly
|
Apache Struts Vulnerability
|
2025-05-02
|
VMWare Aria Operations Exploit Attempt
|
Palo Alto Network Threat
|
T1133
T1190
T1210
T1068
|
TTP
|
VMware Aria Operations vRealize CVE-2023-20887
|
2025-05-02
|
VMware Server Side Template Injection Hunt
|
Palo Alto Network Threat
|
T1190
T1133
|
Hunting
|
VMware Server Side Injection and Privilege Escalation
|
2025-05-02
|
VMware Workspace ONE Freemarker Server-side Template Injection
|
Palo Alto Network Threat
|
T1190
T1133
|
Anomaly
|
VMware Server Side Injection and Privilege Escalation
|
2025-05-02
|
Web JSP Request via URL
|
Nginx Access
|
T1133
T1190
T1505.003
|
TTP
|
Earth Alux, Spring4Shell CVE-2022-22965
|
2025-05-02
|
Web Remote ShellServlet Access
|
Nginx Access
|
T1190
|
TTP
|
CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server
|
2025-05-02
|
Web Spring4Shell HTTP Request Class Module
|
Splunk Stream HTTP
|
T1190
T1133
|
TTP
|
Spring4Shell CVE-2022-22965
|
2025-05-02
|
Web Spring Cloud Function FunctionRouter
|
Splunk Stream HTTP
|
T1190
T1133
|
TTP
|
Spring4Shell CVE-2022-22965
|
2025-05-02
|
Windows Exchange Autodiscover SSRF Abuse
|
Windows IIS
|
T1190
T1133
|
TTP
|
BlackByte Ransomware, ProxyNotShell, ProxyShell, Seashell Blizzard
|
2025-05-02
|
Windows IIS Server PSWA Console Access
|
Windows IIS
|
T1190
|
Hunting
|
CISA AA24-241A
|
2025-05-02
|
WordPress Bricks Builder plugin RCE
|
Nginx Access
|
T1190
|
TTP
|
WordPress Vulnerabilities
|
2025-05-02
|
WS FTP Remote Code Execution
|
Suricata
|
T1190
|
TTP
|
WS FTP Server Critical Vulnerabilities
|
2025-05-02
|
Zscaler Adware Activities Threat Blocked
|
|
T1566
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Zscaler Behavior Analysis Threat Blocked
|
|
T1566
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Zscaler CryptoMiner Downloaded Threat Blocked
|
|
T1566
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Zscaler Employment Search Web Activity
|
|
T1566
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Zscaler Exploit Threat Blocked
|
|
T1566
|
TTP
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Zscaler Legal Liability Threat Blocked
|
|
T1566
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Zscaler Malware Activity Threat Blocked
|
|
T1566
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Zscaler Phishing Activity Threat Blocked
|
|
T1566
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Zscaler Potentially Abused File Download
|
|
T1566
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Zscaler Privacy Risk Destinations Threat Blocked
|
|
T1566
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Zscaler Scam Destinations Threat Blocked
|
|
T1566
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Zscaler Virus Download threat blocked
|
|
T1566
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2025-05-02
|
Cisco Secure Firewall - High Priority Intrusion Classification
|
Cisco Secure Firewall Threat Defense Intrusion Event
|
T1203
T1003
T1071
T1190
T1078
|
TTP
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-04-28
|
Cisco Secure Firewall - Lumma Stealer Activity
|
Cisco Secure Firewall Threat Defense Intrusion Event
|
T1190
T1210
T1027
T1204
|
TTP
|
Cisco Secure Firewall Threat Defense Analytics, Lumma Stealer
|
2025-04-28
|
Cisco Secure Firewall - Lumma Stealer Download Attempt
|
Cisco Secure Firewall Threat Defense Intrusion Event
|
T1041
T1573.002
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics, Lumma Stealer
|
2025-04-26
|
Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt
|
Cisco Secure Firewall Threat Defense Intrusion Event
|
T1041
T1573.002
|
Anomaly
|
Cisco Secure Firewall Threat Defense Analytics, Lumma Stealer
|
2025-04-26
|
MacOS AMOS Stealer - Virtual Machine Check Activity
|
osquery
|
T1059.002
|
Anomaly
|
AMOS Stealer
|
2025-04-25
|
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity
|
Cisco Secure Firewall Threat Defense Intrusion Event
|
T1190
T1210
T1059.001
T1003.001
|
TTP
|
Cisco Secure Firewall Threat Defense Analytics
|
2025-04-14
|