GitHub Repo

Defense Impairment Detections

Name Data Source Technique Type Analytic Story Date
Windows Impair Defense Set Win Defender Smart Screen Level To Warn Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Linux Auditd File Permission Modification Via Chmod Linux Auditd Proctitle T1222.002 Anomaly Compromised Linux Host, Axios Supply Chain Post Compromise, China-Nexus Threat Activity, Salt Typhoon, Linux Persistence Techniques, Linux Privilege Escalation, XorDDos, Linux Living Off The Land 2026-05-13
Windows Anomalous Registry Value Length in Environment Key Sysmon EventID 13 T1112 Anomaly VIP Keylogger 2026-05-13
Windows Impair Defense Disable Controlled Folder Access Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, BlankGrabber Stealer 2026-05-13
Windows Defender ASR or Threat Configuration Tamper Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 TTP Windows Defense Evasion Tactics 2026-05-13
ICACLS Grant Command Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1222 Anomaly Ransomware, Crypto Stealer, Defense Evasion or Unauthorized Access Via SDDL Tampering, XMRig, NetSupport RMM Tool Abuse 2026-05-13
Disable Windows App Hotkeys Sysmon EventID 13 T1112 T1685 TTP Windows Registry Abuse, XMRig 2026-05-13
Windows Impair Defense Disable Win Defender Signature Retirement Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, Scattered Lapsus$ Hunters 2026-05-13
Windows Audit Policy Auditing Option Disabled via Auditpol Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685.001 TTP Windows Audit Policy Tampering 2026-05-13
Windows AD Suspicious Attribute Modification Windows Event Log Security 5136 T1222.001 T1550 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Impair Defense Define Win Defender Threat Action Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Modify Registry Do Not Connect To Win Update Sysmon EventID 13 T1112 Anomaly RedLine Stealer 2026-05-13
Windows Outlook Dialogs Disabled from Unusual Process Sysmon EventID 13 T1112 T1685 TTP Windows Registry Abuse, NotDoor Malware 2026-05-13
Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Anomaly Security Solution Tampering 2026-05-13
Windows SIP WinVerifyTrust Failed Trust Validation Windows Event Log CAPI2 81 T1553.003 Anomaly Subvert Trust Controls SIP and Trust Provider Hijacking 2026-05-13
Windows Modify Registry WuServer Sysmon EventID 13 T1112 Hunting RedLine Stealer 2026-05-13
Disable Defender BlockAtFirstSeen Feature Sysmon EventID 13 T1685 TTP IcedID, SolarWinds WHD RCE Post Exploitation, Windows Registry Abuse, Azorult, CISA AA23-347A 2026-05-13
Unload Sysmon Filter Driver Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 TTP Disabling Security Tools, CISA AA23-347A 2026-05-13
Windows Modify Registry DisAllow Windows App Sysmon EventID 13 T1112 TTP Azorult 2026-05-13
Windows Modify Registry EnableLinkedConnections Sysmon EventID 13 T1112 TTP BlackByte Ransomware 2026-05-13
Windows Impair Defense Override SmartScreen Prompt Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Impair Defense Overide Win Defender Phishing Filter Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows New Custom Security Descriptor Set On EventLog Channel Sysmon EventID 13 T1685.001 Anomaly Defense Evasion or Unauthorized Access Via SDDL Tampering, LockBit Ransomware 2026-05-13
Windows File and Directory Permissions Enable Inheritance Windows Event Log Security 4688, Sysmon EventID 1 T1222.001 Hunting Crypto Stealer, NetSupport RMM Tool Abuse 2026-05-13
Windows Impair Defense Delete Win Defender Context Menu Sysmon EventID 13 T1685 Hunting Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Impair Defenses Disable HVCI Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, BlackLotus Campaign 2026-05-13
Windows InProcServer32 New Outlook Form Sysmon EventID 13 T1112 T1566 Anomaly Outlook RCE CVE-2024-21378 2026-05-13
Disabling Firewall with Netsh Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Anomaly Windows Defense Evasion Tactics, BlackByte Ransomware 2026-05-13
Windows Audit Policy Cleared via Auditpol Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685.001 TTP Windows Audit Policy Tampering 2026-05-13
Windows Admon Default Group Policy Object Modified Windows Active Directory Admon T1484.001 TTP Active Directory Privilege Escalation, Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Modify Registry Disable WinDefender Notifications Sysmon EventID 13 T1112 TTP CISA AA23-347A, RedLine Stealer, SolarWinds WHD RCE Post Exploitation 2026-05-13
Windows AppX Deployment Full Trust Package Installation Windows Event Log AppXDeployment-Server 400 T1204.002 T1553.005 Hunting MSIX Package Abuse 2026-05-13
Windows Impair Defense Delete Win Defender Profile Registry Sysmon EventID 13 T1685 Anomaly Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows AD Object Owner Updated Windows Event Log Security 5136 T1222.001 T1484 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Disable Defender Enhanced Notification Sysmon EventID 13 T1685 TTP Windows Registry Abuse, IcedID, CISA AA23-347A, Azorult 2026-05-13
Modify ACL permission To Files Or Folder Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1222 Anomaly Crypto Stealer, XMRig, Defense Evasion or Unauthorized Access Via SDDL Tampering 2026-05-13
Windows Global Object Access Audit List Cleared Via Auditpol Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685.001 TTP Windows Audit Policy Tampering 2026-05-13
Windows Modify Registry to Add or Modify Firewall Rule Sysmon EventID 13, Sysmon EventID 14 T1112 Anomaly CISA AA24-241A, NetSupport RMM Tool Abuse, ShrinkLocker 2026-05-13
Windows Modify Registry DisableSecuritySettings Sysmon EventID 13 T1112 TTP DarkGate Malware, CISA AA23-347A 2026-05-13
Disable Show Hidden Files Sysmon EventID 13 T1112 T1564.001 T1685 Anomaly Windows Registry Abuse, Windows Defense Evasion Tactics, Azorult 2026-05-13
Windows AD Domain Root ACL Deletion Windows Event Log Security 5136 T1222.001 T1484 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Filtering Platform Policy Added to Block EDR Process Sysmon EventID 13 T1685 TTP Security Solution Tampering, Disabling Security Tools 2026-05-13
Windows AD Domain Controller Promotion Windows Event Log Security 4742 T1207 TTP Sneaky Active Directory Persistence Tricks, Compromised Windows Host 2026-05-13
Windows Terminating Lsass Process Sysmon EventID 10 T1685 Anomaly Data Destruction, Scattered Lapsus$ Hunters, Double Zero Destructor 2026-05-13
Windows Impair Defense Disable Win Defender App Guard Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Impair Defense Disable Win Defender Report Infection Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Impair Defense Disable Realtime Signature Delivery Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Hiding Files And Directories With Attrib exe Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1222.001 TTP Windows Defense Evasion Tactics, Compromised Windows Host, VIP Keylogger, Crypto Stealer, Windows Persistence Techniques, Malicious Inno Setup Loader, Azorult 2026-05-13
Hide User Account From Sign-In Screen Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Warzone RAT, XMRig, Azorult 2026-05-13
Windows Modify Registry Disable Restricted Admin Sysmon EventID 13 T1112 TTP Medusa Ransomware, CISA AA23-347A, GhostRedirector IIS Module and Rungan Backdoor 2026-05-13
Windows Audit Policy Restored via Auditpol Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685.001 Anomaly Windows Audit Policy Tampering 2026-05-13
Windows Modify Registry ValleyRat PWN Reg Entry Sysmon EventID 13 T1112 TTP ValleyRAT 2026-05-13
Excessive number of service control start as disabled Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Anomaly Windows Defense Evasion Tactics 2026-05-13
Windows Audit Policy Excluded Category via Auditpol Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685.001 Anomaly Windows Audit Policy Tampering 2026-05-13
Active Directory Privilege Escalation Identified T1484 Correlation Active Directory Privilege Escalation 2026-05-13
Windows Increase in User Modification Activity Windows Event Log Security 4720 T1098 T1685 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Downdate Registry Activity Sysmon EventID 13, Sysmon EventID 12, Sysmon EventID 14 T1112 T1689 Anomaly Windows Persistence Techniques 2026-05-13
Windows Disable Change Password Through Registry Sysmon EventID 13 T1112 Anomaly Windows Defense Evasion Tactics, Ransomware 2026-05-13
Windows AD Self DACL Assignment Windows Event Log Security 5136 T1098 T1484 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Powershell Disable Security Monitoring Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 TTP CISA AA24-241A, Revil Ransomware, BlankGrabber Stealer, Ransomware 2026-05-13
Add or Set Windows Defender Exclusion Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 TTP WhisperGate, Windows Defense Evasion Tactics, Compromised Windows Host, XWorm, Crypto Stealer, AgentTesla, ValleyRAT, Data Destruction, CISA AA22-320A, Remcos, NetSupport RMM Tool Abuse 2026-05-13
Firewall Allowed Program Enable Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1686 Anomaly Windows Defense Evasion Tactics, NjRAT, Azorult, BlackByte Ransomware, Medusa Ransomware, PlugX 2026-05-13
Windows Default Group Policy Object Modified with GPME Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1484.001 TTP Active Directory Privilege Escalation, Sneaky Active Directory Persistence Tricks 2026-05-13
Windows AD Dangerous User ACL Modification Windows Event Log Security 5136 T1222.001 T1484 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Impair Defense Disable Win Defender Scan On Update Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Disable Windows Event Logging Disable HTTP Logging Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1505.004 T1685.001 Anomaly Windows Defense Evasion Tactics, IIS Components, CISA AA23-347A, Compromised Windows Host 2026-05-13
Windows Modify Registry Regedit Silent Reg Import Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1112 Anomaly Azorult 2026-05-13
Windows Modify Registry With MD5 Reg Key Name Sysmon EventID 13 T1112 TTP NjRAT 2026-05-13
Excessive Usage Of Taskkill Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Anomaly CISA AA22-264A, Crypto Stealer, NjRAT, AgentTesla, XMRig, CISA AA22-277A, Azorult, BlankGrabber Stealer 2026-05-13
Windows AD Domain Replication ACL Addition Windows Event Log Security 5136 T1484 TTP Sneaky Active Directory Persistence Tricks, Compromised Windows Host 2026-05-13
Windows Increase in Group or Object Modification Activity Windows Event Log Security 4663 T1098 T1685 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Firewall Rule Deletion Windows Event Log Security 4948 T1686 Anomaly Medusa Ransomware, NetSupport RMM Tool Abuse, ShrinkLocker 2026-05-13
Linux Auditd Disable Or Modify System Firewall Linux Auditd Service Stop T1686 Anomaly Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Linux Living Off The Land 2026-05-13
Windows Cisco Secure Endpoint Unblock File Via Sfc Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Anomaly Security Solution Tampering 2026-05-13
Disable Defender Submit Samples Consent Feature Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Azorult, IcedID, BlankGrabber Stealer, CISA AA23-347A 2026-05-13
Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Anomaly Security Solution Tampering 2026-05-13
Windows Advanced Installer MSIX with AI_STUBS Execution Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1204.002 T1218 T1553.005 TTP MSIX Package Abuse 2026-05-13
Windows Event For Service Disabled Windows Event Log System 7040 T1685 Hunting Windows Defense Evasion Tactics, RedLine Stealer 2026-05-13
Windows SIP Provider Inventory T1553.003 Hunting Subvert Trust Controls SIP and Trust Provider Hijacking 2026-05-13
Windows Impair Defense Disable PUA Protection Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, Scattered Lapsus$ Hunters 2026-05-13
Linux Auditd File Permissions Modification Via Chattr Linux Auditd Execve T1222.002 Anomaly Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Linux Living Off The Land 2026-05-13
Windows AD GPO Deleted Windows Event Log Security 5136 T1484.001 T1685 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Disable ETW Through Registry Sysmon EventID 13 T1685 TTP Windows Registry Abuse, CISA AA23-347A, Ransomware 2026-05-13
Windows Modify Registry No Auto Update Sysmon EventID 13 T1112 Anomaly CISA AA23-347A, RedLine Stealer 2026-05-13
Windows Defender ASR Registry Modification Windows Event Log Defender 5007 T1112 Hunting Windows Attack Surface Reduction 2026-05-13
Windows Developer-Signed MSIX Package Installation Windows Event Log AppXDeployment-Server 855 T1204.002 T1553.005 Anomaly MSIX Package Abuse 2026-05-13
Windows SnappyBee Create Test Registry Sysmon EventID 13 T1112 TTP Salt Typhoon, SnappyBee, China-Nexus Threat Activity 2026-05-13
Windows New InProcServer32 Added Sysmon EventID 13 T1112 Hunting Hellcat Ransomware, Outlook RCE CVE-2024-21378 2026-05-13
Windows AD Dangerous Group ACL Modification Windows Event Log Security 5136 T1222.001 T1484 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Defender Exclusion Registry Entry Sysmon EventID 13 T1685 TTP Qakbot, Windows Defense Evasion Tactics, XWorm, Warzone RAT, ValleyRAT, Remcos, Azorult, NetSupport RMM Tool Abuse 2026-05-13
Windows SubInAcl Execution Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1222.001 Anomaly Defense Evasion or Unauthorized Access Via SDDL Tampering 2026-05-13
Windows Event Log Cleared Windows Event Log System 104, Windows Event Log Security 1102 T1685.005 TTP CISA AA22-264A, Compromised Windows Host, Ransomware, Windows Log Manipulation, Clop Ransomware, ShrinkLocker 2026-05-13
Windows Impair Defense Disable Win Defender Compute File Hashes Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Impair Defense Change Win Defender Quick Scan Interval Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Disabling Defender Services Sysmon EventID 13 T1685 TTP Windows Registry Abuse, RedLine Stealer, IcedID 2026-05-13
MacOS plutil Osquery Results T1647 TTP Living Off The Land 2026-05-13
Windows Modify Registry ProxyServer Sysmon EventID 13 T1112 Anomaly DarkGate Malware 2026-05-13
Windows Registry Delete Task SD Sysmon EventID 12 T1053.005 T1685 Anomaly Windows Registry Abuse, Windows Persistence Techniques, Scheduled Tasks 2026-05-13
Disable Registry Tool Sysmon EventID 13 T1112 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, NjRAT 2026-05-13
Windows Outlook LoadMacroProviderOnBoot Persistence Sysmon EventID 13 T1112 T1137 TTP Windows Registry Abuse, NotDoor Malware 2026-05-13
Windows Impair Defense Disable Win Defender Network Protection Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, Scattered Lapsus$ Hunters, BlankGrabber Stealer 2026-05-13
Windows Routing and Remote Access Service Registry Key Change Sysmon EventID 13 T1112 Anomaly Gh0st RAT 2026-05-13
Linux Auditd Change File Owner To Root Linux Auditd Proctitle T1222.002 Anomaly Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Linux Living Off The Land 2026-05-13
Disabling FolderOptions Windows Feature Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, CISA AA23-347A 2026-05-13
Linux Impair Defenses Process Kill Sysmon for Linux EventID 1 T1685 Hunting Data Destruction, AwfulShred, Scattered Lapsus$ Hunters 2026-05-13
Linux Change File Owner To Root Sysmon for Linux EventID 1 T1222.002 Anomaly Linux Persistence Techniques, Linux Privilege Escalation, Linux Living Off The Land 2026-05-13
Windows Powershell Import Applocker Policy Powershell Script Block Logging 4104 T1059.001 T1685 TTP Azorult 2026-05-13
Disable Schedule Task Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Anomaly Living Off The Land, IcedID 2026-05-13
Windows Modify Registry Qakbot Binary Data Registry Sysmon EventID 13, Sysmon EventID 1 T1112 Anomaly Qakbot 2026-05-13
Windows Scheduled Task Created in a Group Policy Object Windows Event Log Security 5145 T1053.005 T1484.001 TTP Windows Persistence Techniques, Scheduled Tasks, Living Off The Land 2026-05-13
Disabling ControlPanel Sysmon EventID 13 T1112 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Modify Registry AuthenticationLevelOverride Sysmon EventID 13 T1112 Anomaly DarkGate Malware 2026-05-13
Windows Files and Dirs Access Rights Modification Via Icacls Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1222.001 Anomaly Defense Evasion or Unauthorized Access Via SDDL Tampering, Amadey 2026-05-13
Windows Mark Of The Web Bypass Sysmon EventID 23 T1553.005 TTP Warzone RAT, Quasar RAT 2026-05-13
Enable WDigest UseLogonCredential Registry Sysmon EventID 13 T1003 T1112 TTP Windows Registry Abuse, Credential Dumping, CISA AA22-320A 2026-05-13
Windows Registry Dotnet ETW Disabled Via ENV Variable Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Impair Defense Deny Security Software With Applocker Sysmon EventID 13 T1685 TTP Scattered Lapsus$ Hunters, Azorult 2026-05-13
Windows Disable LogOff Button Through Registry Sysmon EventID 13 T1112 Anomaly Windows Registry Abuse, Ransomware 2026-05-13
Windows AD Hidden OU Creation Windows Event Log Security 5136 T1222.001 T1484 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Disable Lock Workstation Feature Through Registry Sysmon EventID 13 T1112 Anomaly Windows Registry Abuse, Windows Defense Evasion Tactics, Ransomware 2026-05-13
Windows Impair Defense Change Win Defender Throttle Rate Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Impair Defense Disable Defender Protocol Recognition Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, Scattered Lapsus$ Hunters 2026-05-13
Windows Outlook WebView Registry Modification Sysmon EventID 13 T1112 Anomaly Suspicious Windows Registry Activities 2026-05-13
Windows Impair Defense Disable Defender Firewall And Network Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, Scattered Lapsus$ Hunters 2026-05-13
Linux Auditd Auditd Daemon Shutdown Linux Auditd Daemon End T1685.004 Anomaly Compromised Linux Host 2026-05-13
Unloading AMSI via Reflection Powershell Script Block Logging 4104 T1059.001 T1685 TTP Data Destruction, Malicious PowerShell, Hermetic Wiper 2026-05-13
Rundll32 Shimcache Flush Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1112 TTP Living Off The Land, Unusual Processes, Compromised Windows Host 2026-05-13
Windows New EventLog ChannelAccess Registry Value Set Sysmon EventID 13 T1685.001 Anomaly Defense Evasion or Unauthorized Access Via SDDL Tampering, LockBit Ransomware 2026-05-13
Windows Modify Registry UpdateServiceUrlAlternate Sysmon EventID 13 T1112 Anomaly RedLine Stealer 2026-05-13
Windows Attempt To Stop Security Service Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 TTP WhisperGate, Disabling Security Tools, Graceful Wipe Out Attack, Data Destruction, Trickbot, Azorult 2026-05-13
Windows AD DCShadow Privileges ACL Addition Windows Event Log Security 5136 T1207 T1222.001 T1484 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows AD GPO Disabled Windows Event Log Security 5136 T1484.001 T1685 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows AD Short Lived Domain Controller SPN Attribute Windows Event Log Security 4624, Windows Event Log Security 5136 T1207 TTP Sneaky Active Directory Persistence Tricks, Compromised Windows Host 2026-05-13
Windows Modify Registry Risk Behavior T1112 Correlation Windows Registry Abuse 2026-05-13
Windows EFI Volume Mount Attempt Via Mountvol Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1204.002 T1542 T1688 Anomaly Compromised Windows Host 2026-05-13
Revil Registry Entry Sysmon EventID 13, Sysmon EventID 12 T1112 TTP Windows Registry Abuse, Revil Ransomware, Ransomware 2026-05-13
Windows Eventlog Cleared Via Wevtutil Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685.005 Anomaly Ransomware, Rhysida Ransomware, Windows Log Manipulation, Clop Ransomware, CISA AA23-347A, ShrinkLocker 2026-05-13
Powershell Windows Defender Exclusion Commands Powershell Script Block Logging 4104 T1685 TTP Windows Defense Evasion Tactics, WhisperGate, Warzone RAT, AgentTesla, CISA AA22-320A, Data Destruction, Remcos, NetSupport RMM Tool Abuse, BlankGrabber Stealer 2026-05-13
Windows Modify Registry Utilize ProgIDs Sysmon EventID 13 T1112 Anomaly ValleyRAT 2026-05-13
Windows Event Logging Service Has Shutdown Windows Event Log Security 1100 T1685.005 Hunting Clop Ransomware, Scattered Lapsus$ Hunters, Ransomware, Windows Log Manipulation 2026-05-13
Allow Network Discovery In Firewall Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1686.001 TTP Ransomware, NjRAT, BlackByte Ransomware, Medusa Ransomware, Revil Ransomware, Hellcat Ransomware 2026-05-13
Disabling Task Manager Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, NjRAT 2026-05-13
Windows Firewall Rule Modification Windows Event Log Security 4947 T1686 Anomaly Medusa Ransomware, NetSupport RMM Tool Abuse, ShrinkLocker 2026-05-13
Windows Registry SIP Provider Modification Sysmon EventID 13 T1553.003 TTP Subvert Trust Controls SIP and Trust Provider Hijacking 2026-05-13
Windows Modify Registry MaxConnectionPerServer Sysmon EventID 13 T1112 Anomaly Warzone RAT 2026-05-13
Windows Registry Certificate Added Sysmon EventID 13 T1553.004 Anomaly Windows Registry Abuse, Windows Drivers 2026-05-13
Malicious InProcServer32 Modification Sysmon EventID 13, Sysmon EventID 12 T1112 T1218.010 TTP Suspicious Regsvr32 Activity, Remcos 2026-05-13
Disable Logs Using WevtUtil Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685.005 TTP Rhysida Ransomware, CISA AA23-347A, Ransomware 2026-05-13
Windows AD Domain Root ACL Modification Windows Event Log Security 5136 T1222.001 T1484 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Modify Registry USeWuServer Sysmon EventID 13 T1112 Hunting RedLine Stealer 2026-05-13
Windows Delete or Modify System Firewall Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1686 Hunting NjRAT, ShrinkLocker 2026-05-13
Linux Auditd Auditd Daemon Abort Linux Auditd Daemon Abort T1685.004 Anomaly Compromised Linux Host 2026-05-13
Allow File And Printing Sharing In Firewall Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1686.001 TTP Ransomware, Hellcat Ransomware, BlackByte Ransomware 2026-05-13
Disable Defender Spynet Reporting Sysmon EventID 13 T1685 TTP Qakbot, Windows Registry Abuse, Azorult, IcedID, CISA AA23-347A 2026-05-13
Disable Defender AntiVirus Registry Sysmon EventID 13 T1685 TTP Black Basta Ransomware, CISA AA24-241A, SolarWinds WHD RCE Post Exploitation, Windows Registry Abuse, Cactus Ransomware, IcedID 2026-05-13
Linux Stdout Redirection To Dev Null File Sysmon for Linux EventID 1 T1686 Anomaly Cyclops Blink, Data Destruction, Industroyer2 2026-05-13
Windows Modify Registry Tamper Protection Sysmon EventID 13 T1112 TTP Scattered Lapsus$ Hunters, RedLine Stealer 2026-05-13
Windows RunMRU Registry Key or Value Deleted Sysmon EventID 12 T1112 Anomaly NetSupport RMM Tool Abuse 2026-05-13
Windows Disable Shutdown Button Through Registry Sysmon EventID 13 T1112 Anomaly Windows Registry Abuse, Ransomware 2026-05-13
MacOS Gatekeeper Bypass Osquery Results T1553.001 Anomaly MacOS Post-Exploitation, MacOS Privilege Escalation, MacOS Persistence Techniques 2026-05-13
Disabling Windows Local Security Authority Defences via Registry Sysmon EventID 13 T1556 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Modify Registry Suppress Win Defender Notif Sysmon EventID 13 T1112 Anomaly CISA AA23-347A, Azorult 2026-05-13
Suspicious Reg exe Process Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1112 Anomaly Windows Defense Evasion Tactics, Disabling Security Tools, DHS Report TA18-074A 2026-05-13
Windows Group Policy Object Created Windows Event Log Security 5137, Windows Event Log Security 5136 T1078.002 T1484.001 TTP Active Directory Privilege Escalation, Sneaky Active Directory Persistence Tricks 2026-05-13
Windows AD Short Lived Server Object Windows Event Log Security 5137, Windows Event Log Security 5141 T1207 TTP Sneaky Active Directory Persistence Tricks, Compromised Windows Host 2026-05-13
Windows Admon Group Policy Object Created Windows Active Directory Admon T1484.001 TTP Active Directory Privilege Escalation, Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Modify Registry ProxyEnable Sysmon EventID 13 T1112 Anomaly DarkGate Malware 2026-05-13
Windows File and Directory Enable ReadOnly Permissions Windows Event Log Security 4688, Sysmon EventID 1 T1222.001 TTP Crypto Stealer, NetSupport RMM Tool Abuse 2026-05-13
Excessive Usage Of Cacls App Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1222 Anomaly Crypto Stealer, Defense Evasion or Unauthorized Access Via SDDL Tampering, XMRig, Windows Post-Exploitation, Prestige Ransomware, Azorult 2026-05-13
Windows Defender ASR Rule Disabled Windows Event Log Defender 5007 T1112 TTP Windows Attack Surface Reduction 2026-05-13
Windows Impair Defense Configure App Install Control Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Modify Registry DisableRemoteDesktopAntiAlias Sysmon EventID 13 T1112 TTP DarkGate Malware 2026-05-13
Remcos client registry install entry Sysmon EventID 13, Sysmon EventID 12 T1112 TTP Windows Registry Abuse, Remcos 2026-05-13
Windows File and Directory Permissions Remove Inheritance Windows Event Log Security 4688, Sysmon EventID 1 T1222.001 Anomaly Crypto Stealer 2026-05-13
Permission Modification using Takeown App Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1222 Anomaly Crypto Stealer, Scattered Lapsus$ Hunters, Sandworm Tools, Ransomware 2026-05-13
Windows Impair Defense Change Win Defender Health Check Intervals Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Suspicious wevtutil Usage Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685.005 TTP Ransomware, Rhysida Ransomware, Storm-2460 CLFS Zero Day Exploitation, Windows Log Manipulation, Clop Ransomware, Storm-0501 Ransomware, VoidLink Cloud-Native Linux Malware, Scattered Spider, CISA AA23-347A, ShrinkLocker 2026-05-13
Windows Impair Defense Disable Win Defender Gen reports Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Modify Registry Configure BitLocker Sysmon EventID 13 T1112 TTP ShrinkLocker 2026-05-13
Windows Important Audit Policy Disabled Windows Event Log Security 4719 T1685 TTP Windows Audit Policy Tampering 2026-05-13
Windows Modify Registry on Smart Card Group Policy Sysmon EventID 13 T1112 Anomaly ShrinkLocker 2026-05-13
Windows Modify Registry Disable Toast Notifications Sysmon EventID 13 T1112 Anomaly Azorult 2026-05-13
Disable Security Logs Using MiniNt Registry Sysmon EventID 13 T1112 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, CISA AA23-347A 2026-05-13
Windows Modify Registry Disable RDP Sysmon EventID 13 T1112 Anomaly Windows RDP Artifacts and Defense Evasion, ShrinkLocker 2026-05-13
Windows Modify Registry Auto Update Notif Sysmon EventID 13 T1112 Anomaly RedLine Stealer 2026-05-13
Linux Iptables Firewall Modification Sysmon for Linux EventID 1 T1686 Anomaly Cyclops Blink, Sandworm Tools, Backdoor Pingpong, China-Nexus Threat Activity 2026-05-13
Windows Symlink Evaluation Change via Fsutil Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1222.001 Anomaly Windows Post-Exploitation 2026-05-13
Windows Audit Policy Disabled via Legacy Auditpol Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685.001 Anomaly Windows Audit Policy Tampering 2026-05-13
Powershell Remove Windows Defender Directory Powershell Script Block Logging 4104 T1685 TTP Data Destruction, WhisperGate 2026-05-13
Windows SymbolicLink-Testing-Tools Utility Execution Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1222 T1564.004 TTP Windows Persistence Techniques, Windows Privilege Escalation, Windows Post-Exploitation 2026-05-13
Windows Impair Defenses Disable Win Defender Auto Logging Sysmon EventID 13 T1685 Anomaly Windows Registry Abuse, Windows Defense Evasion Tactics, CISA AA23-347A 2026-05-13
Windows Impair Defense Disable Web Evaluation Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
FodHelper UAC Bypass Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1112 T1548.002 TTP Windows Defense Evasion Tactics, Compromised Windows Host, ValleyRAT, IcedID, BlankGrabber Stealer 2026-05-13
Windows PowerShell Disable HTTP Logging Powershell Script Block Logging 4104 T1505.004 T1685.001 TTP Windows Defense Evasion Tactics, IIS Components 2026-05-13
Windows MpCmdRun RemoveDefinitions Execution Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Anomaly BlankGrabber Stealer 2026-05-13
Windows Modify Registry Disable Windows Security Center Notif Sysmon EventID 13 T1112 Anomaly CISA AA23-347A, Azorult 2026-05-13
Windows Disable or Stop Browser Process Sysmon EventID 1 T1685 TTP Braodo Stealer, Castle RAT, Scattered Lapsus$ Hunters, BlankGrabber Stealer, Hellcat Ransomware 2026-05-13
Windows Modify Registry No Auto Reboot With Logon User Sysmon EventID 13 T1112 Anomaly RedLine Stealer 2026-05-13
Windows Modify Registry Auto Minor Updates Sysmon EventID 13 T1112 Hunting RedLine Stealer 2026-05-13
Windows Modify Registry Default Icon Setting Sysmon EventID 13 T1112 Anomaly LockBit Ransomware 2026-05-13
Windows Snake Malware Registry Modification wav OpenWithProgIds Sysmon EventID 13 T1112 TTP Snake Malware 2026-05-13
Disabling CMD Application Sysmon EventID 13 T1112 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, NjRAT 2026-05-13
Windows AD Dangerous Deny ACL Modification Windows Event Log Security 5136 T1222.001 T1484 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Modify Show Compress Color And Info Tip Registry Sysmon EventID 13 T1112 TTP Data Destruction, Windows Defense Evasion Tactics, Windows Registry Abuse, Hermetic Wiper 2026-05-13
Windows Disable Notification Center Sysmon EventID 13 T1112 Anomaly Windows Registry Abuse, Windows Defense Evasion Tactics, CISA AA23-347A 2026-05-13
Windows Impair Defenses Disable Auto Logger Session Sysmon EventID 13 T1685 Anomaly Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Deleted Registry By A Non Critical Process File Path Sysmon EventID 12, Sysmon EventID 1 T1112 Anomaly Data Destruction, Double Zero Destructor 2026-05-13
Process Kill Base On File Path Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 TTP XMRig 2026-05-13
Windows AD Domain Controller Audit Policy Disabled Windows Event Log Security 4719 T1685 TTP Windows Audit Policy Tampering 2026-05-13
Disable Windows Behavior Monitoring Sysmon EventID 13 T1685 TTP Windows Defense Evasion Tactics, Black Basta Ransomware, Ransomware, Scattered Lapsus$ Hunters, SolarWinds WHD RCE Post Exploitation, Windows Registry Abuse, Cactus Ransomware, Storm-0501 Ransomware, Azorult, NetSupport RMM Tool Abuse, Revil Ransomware, BlankGrabber Stealer, CISA AA23-347A, RedLine Stealer 2026-05-13
Windows Hide Notification Features Through Registry Sysmon EventID 13 T1112 Anomaly Windows Registry Abuse, Windows Defense Evasion Tactics, Ransomware 2026-05-13
Windows Excessive Disabled Services Event Windows Event Log System 7040 T1685 TTP Windows Defense Evasion Tactics, CISA AA23-347A, Compromised Windows Host 2026-05-13
Icacls Deny Command Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1222 Anomaly Sandworm Tools, Compromised Windows Host, Crypto Stealer, Defense Evasion or Unauthorized Access Via SDDL Tampering, XMRig, Azorult 2026-05-13
Windows AppX Deployment Unsigned Package Installation Windows Event Log AppXDeployment-Server 855 T1204.002 T1553.005 TTP MSIX Package Abuse 2026-05-13
Windows AD GPO New CSE Addition Windows Event Log Security 5136 T1222.001 T1484.001 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows Audit Policy Security Descriptor Tampering via Auditpol Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685.001 Anomaly Windows Audit Policy Tampering 2026-05-13
Windows Raccine Scheduled Task Deletion Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 TTP Compromised Windows Host, Ransomware 2026-05-13
Windows Disable Windows Group Policy Features Through Registry Sysmon EventID 13 T1112 Anomaly Windows Registry Abuse, Windows Defense Evasion Tactics, CISA AA23-347A, Ransomware 2026-05-13
Disable Defender MpEngine Registry Sysmon EventID 13 T1685 TTP Windows Registry Abuse, IcedID 2026-05-13
Windows Firewall Rule Added Windows Event Log Security 4946 T1686 Anomaly Medusa Ransomware, NetSupport RMM Tool Abuse, ShrinkLocker 2026-05-13
Disabling NoRun Windows App Sysmon EventID 13 T1112 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Default Group Policy Object Modified Windows Event Log Security 5136 T1484.001 TTP Active Directory Privilege Escalation, Sneaky Active Directory Persistence Tricks 2026-05-13
Wmic NonInteractive App Uninstallation Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Hunting Azorult, IcedID 2026-05-13
Windows Modify Registry Disabling WER Settings Sysmon EventID 13 T1112 TTP CISA AA23-347A, Azorult 2026-05-13
Windows Modify Registry wuStatusServer Sysmon EventID 13 T1112 Hunting RedLine Stealer 2026-05-13
Windows Impair Defense Change Win Defender Tracing Level Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics 2026-05-13
Windows Modify Registry Disable Win Defender Raw Write Notif Sysmon EventID 13 T1112 Anomaly CISA AA23-347A, Azorult 2026-05-13
Windows Disable or Modify Tools Via Taskkill Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Anomaly Crypto Stealer, NjRAT, BlankGrabber Stealer, PXA Stealer 2026-05-13
Windows Common Abused Cmd Shell Risk Behavior T1016 T1033 T1049 T1059 T1222 T1529 Correlation Qakbot, Windows Defense Evasion Tactics, Disabling Security Tools, Sandworm Tools, FIN7, Windows Post-Exploitation, Volt Typhoon, DarkCrystal RAT, Azorult, Microsoft WSUS CVE-2025-59287, Netsh Abuse, CISA AA23-347A 2026-05-13
Windows Modify Registry DontShowUI Sysmon EventID 13 T1112 TTP DarkGate Malware 2026-05-13
ETW Registry Disabled Sysmon EventID 13 T1127 T1685 TTP Windows Persistence Techniques, Windows Registry Abuse, Data Destruction, Windows Privilege Escalation, Hermetic Wiper, CISA AA23-347A 2026-05-13
Disable Windows SmartScreen Protection Sysmon EventID 13 T1685 TTP Windows Registry Abuse, Windows Defense Evasion Tactics, CISA AA23-347A 2026-05-13
Windows Modify Registry NoChangingWallPaper Sysmon EventID 13 T1112 TTP Rhysida Ransomware 2026-05-13
Windows Modify Registry Delete Firewall Rules Sysmon EventID 12 T1112 TTP CISA AA24-241A, NetSupport RMM Tool Abuse, ShrinkLocker 2026-05-13
Windows DISM Remove Defender Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 TTP Windows Defense Evasion Tactics, CISA AA23-347A, Compromised Windows Host 2026-05-13
Windows Impair Defense Add Xml Applocker Rules Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Hunting Azorult 2026-05-13
Linux Auditd Auditd Daemon Start Linux Auditd Daemon Start T1685.004 Anomaly Compromised Linux Host 2026-05-13
Windows Modify System Firewall with Notable Process Path Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1686 TTP Medusa Ransomware, NjRAT, Compromised Windows Host 2026-05-13
Windows Impair Defenses Disable AV AutoStart via Registry Sysmon EventID 13 T1112 TTP Scattered Lapsus$ Hunters, ValleyRAT 2026-05-13
Windows Set Network Profile Category to Private via Registry Sysmon EventID 13 T1112 Anomaly Secret Blizzard 2026-05-13
Windows Modify Registry LongPathsEnabled Sysmon EventID 13 T1112 Anomaly BlackByte Ransomware 2026-05-13
Disable AMSI Through Registry Sysmon EventID 13 T1685 TTP Windows Registry Abuse, CISA AA23-347A, Ransomware 2026-05-13
Windows CrowdStrike Agent Registry Key Removal Sysmon EventID 12 T1685 Anomaly Security Solution Tampering, Windows Defense Evasion Tactics 2026-05-13
Windows Modify Registry ValleyRAT C2 Config Sysmon EventID 13 T1112 TTP ValleyRAT 2026-05-13
Windows EDRSilencer Execution Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685 Anomaly Security Solution Tampering 2026-05-13
Windows Audit Policy Disabled via Auditpol Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1685.001 Anomaly Windows Audit Policy Tampering 2026-05-13
Windows DisableAntiSpyware Registry Sysmon EventID 13 T1685 TTP CISA AA22-264A, Windows Defense Evasion Tactics, Ryuk Ransomware, SolarWinds WHD RCE Post Exploitation, Windows Registry Abuse, Azorult, CISA AA23-347A, RedLine Stealer 2026-05-13
Processes launching netsh Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1686 Anomaly Disabling Security Tools, DHS Report TA18-074A, Volt Typhoon, Azorult, Snake Keylogger, Netsh Abuse, ShrinkLocker, Hellcat Ransomware 2026-05-13
Attempt To Add Certificate To Untrusted Store Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2 T1553.004 Anomaly Disabling Security Tools 2026-05-13
M365 Copilot Impersonation Jailbreak Attack M365 Exported eDiscovery Prompts T1685 TTP Suspicious Microsoft 365 Copilot Activities 2026-05-13
ESXi Syslog Config Change VMWare ESXi Syslog T1690 TTP ESXi Post Compromise, Black Basta Ransomware 2026-05-13
ESXi Lockdown Mode Disabled VMWare ESXi Syslog T1685 TTP ESXi Post Compromise, Black Basta Ransomware 2026-05-13
ESXi Loghost Config Tampering VMWare ESXi Syslog T1685 TTP ESXi Post Compromise, Black Basta Ransomware 2026-05-13
Cisco ASA - Logging Disabled via CLI Cisco ASA Logs T1685 TTP Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
ESXi Encryption Settings Modified VMWare ESXi Syslog T1685 TTP ESXi Post Compromise, Black Basta Ransomware 2026-05-13
ESXi Firewall Disabled VMWare ESXi Syslog T1686 TTP ESXi Post Compromise, Black Basta Ransomware, China-Nexus Threat Activity 2026-05-13
PingID New MFA Method Registered For User PingID T1098.005 T1556.006 T1621 TTP Compromised User Account 2026-05-13
Okta Multi-Factor Authentication Disabled Okta T1556.006 TTP Scattered Lapsus$ Hunters, Okta Account Takeover 2026-05-13
Cisco Duo Policy Allow Old Java Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco Duo Admin Login Unusual Os Cisco Duo Activity T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco Duo Policy Allow Devices Without Screen Lock Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
M365 Copilot Non Compliant Devices Accessing M365 Copilot M365 Copilot Graph API T1685 Anomaly Suspicious Microsoft 365 Copilot Activities 2026-05-13
Cisco Duo Policy Allow Old Flash Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco Duo Admin Login Unusual Country Cisco Duo Activity T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
M365 Copilot Jailbreak Attempts M365 Exported eDiscovery Prompts T1685 Anomaly Suspicious Microsoft 365 Copilot Activities 2026-05-13
Okta Phishing Detection with FastPass Origin Check Okta T1078.001 T1556 TTP Okta Account Takeover 2026-05-13
Cisco ASA - AAA Policy Tampering Cisco ASA Logs T1556.004 Anomaly Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Cisco Duo Bypass Code Generation Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco ASA - Logging Message Suppression Cisco ASA Logs T1070 T1685.001 Anomaly ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Cisco Duo Policy Skip 2FA for Other Countries Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco ASA - Core Syslog Message Volume Drop Cisco ASA Logs T1685 Hunting ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
PingID New MFA Method After Credential Reset PingID T1098.005 T1556.006 T1621 TTP Compromised User Account, Scattered Lapsus$ Hunters 2026-05-13
Cisco Duo Bulk Policy Deletion Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
ESXi VIB Acceptance Level Tampering VMWare ESXi Syslog T1685 TTP ESXi Post Compromise, Black Basta Ransomware, China-Nexus Threat Activity 2026-05-13
Cisco Duo Policy Allow Tampered Devices Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco Duo Set User Status to Bypass 2FA Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
M365 Copilot Information Extraction Jailbreak Attack M365 Exported eDiscovery Prompts T1685 TTP Suspicious Microsoft 365 Copilot Activities 2026-05-13
Cisco Duo Policy Deny Access Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco Duo Policy Bypass 2FA Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco ASA - Logging Filters Configuration Tampering Cisco ASA Logs T1685 Anomaly Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
ESXi Audit Tampering VMWare ESXi Syslog T1070 T1690 TTP ESXi Post Compromise, Black Basta Ransomware 2026-05-13
M365 Copilot Agentic Jailbreak Attack M365 Exported eDiscovery Prompts T1685 Anomaly Suspicious Microsoft 365 Copilot Activities 2026-05-13
Cisco Duo Policy Allow Network Bypass 2FA Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
PingID Mismatch Auth Source and Verification Response PingID T1098.005 T1556.006 T1621 TTP Compromised User Account 2026-05-13
Cisco Duo Admin Login Unusual Browser Cisco Duo Activity T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
ESXi Download Errors VMWare ESXi Syslog T1601.001 T1685 Anomaly ESXi Post Compromise, Black Basta Ransomware 2026-05-13
AWS Defense Evasion Impair Security Services AWS CloudTrail DeleteRule, AWS CloudTrail DeleteIPSet, AWS CloudTrail DeleteRuleGroup, AWS CloudTrail DeleteAlarms, AWS CloudTrail DeleteWebACL, AWS CloudTrail DeleteDetector, AWS CloudTrail DeleteLoggingConfiguration, AWS CloudTrail DeleteLogStream T1685.002 TTP AWS Defense Evasion 2026-05-13
O365 Excessive SSO logon errors O365 UserLoginFailed T1556 Anomaly Office 365 Account Takeover, Cloud Federated Credential Abuse 2026-05-13
O365 Advanced Audit Disabled O365 Change user license. T1685.002 TTP Office 365 Persistence Mechanisms 2026-05-13
AWS Network Access Control List Created with All Open Ports AWS CloudTrail ReplaceNetworkAclEntry, AWS CloudTrail CreateNetworkAclEntry T1686.001 TTP AWS Network ACL Activity 2026-05-13
O365 Cross-Tenant Access Change Office 365 Universal Audit Log T1484.002 TTP Azure Active Directory Persistence 2026-05-13
ASL AWS New MFA Method Registered For User ASL AWS CloudTrail T1556.006 TTP AWS Identity and Access Management Account Takeover 2026-05-13
O365 Email Security Feature Changed Office 365 Universal Audit Log T1685.002 TTP Office 365 Account Takeover, Office 365 Persistence Mechanisms 2026-05-13
GitHub Organizations Disable Dependabot GitHub Organizations Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
Azure AD New Federated Domain Added Azure Active Directory Set domain authentication T1484.002 TTP Azure Active Directory Persistence, Storm-0501 Ransomware, Scattered Lapsus$ Hunters, Hellcat Ransomware 2026-05-13
ASL AWS Defense Evasion Delete CloudWatch Log Group ASL AWS CloudTrail T1685.002 TTP AWS Defense Evasion 2026-05-13
O365 Bypass MFA via Trusted IP O365 Set Company Information. T1686.001 TTP Office 365 Persistence Mechanisms 2026-05-13
AWS Bedrock Delete Model Invocation Logging Configuration AWS CloudTrail DeleteModelInvocationLoggingConfiguration T1685.002 TTP AWS Bedrock Security 2026-05-13
ASL AWS Multi-Factor Authentication Disabled ASL AWS CloudTrail T1556.006 T1586.003 T1621 TTP AWS Identity and Access Management Account Takeover 2026-05-13
GitHub Enterprise Disable IP Allow List GitHub Enterprise Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
AWS Defense Evasion Update Cloudtrail AWS CloudTrail UpdateTrail T1685.002 TTP AWS Defense Evasion 2026-05-13
AWS Network Access Control List Deleted AWS CloudTrail DeleteNetworkAclEntry T1686.001 Anomaly AWS Network ACL Activity 2026-05-13
GitHub Organizations Delete Branch Ruleset GitHub Organizations Audit Logs T1195 T1685 Anomaly NPM Supply Chain Compromise, GitHub Malicious Activity 2026-05-13
ASL AWS Network Access Control List Created with All Open Ports ASL AWS CloudTrail T1686.001 TTP AWS Network ACL Activity 2026-05-13
GitHub Enterprise Register Self Hosted Runner GitHub Enterprise Audit Logs T1195 T1685 Anomaly NPM Supply Chain Compromise, GitHub Malicious Activity 2026-05-13
ASL AWS Defense Evasion Update Cloudtrail ASL AWS CloudTrail T1685.002 TTP AWS Defense Evasion 2026-05-13
AWS Defense Evasion Delete CloudWatch Log Group AWS CloudTrail DeleteLogGroup T1685.002 TTP AWS Defense Evasion 2026-05-13
GCP Multi-Factor Authentication Disabled Google Workspace T1556.006 T1586.003 TTP Scattered Lapsus$ Hunters, GCP Account Takeover 2026-05-13
ASL AWS Defense Evasion Stop Logging Cloudtrail ASL AWS CloudTrail T1685.002 TTP AWS Defense Evasion 2026-05-13
GitHub Enterprise Delete Branch Ruleset GitHub Enterprise Audit Logs T1195 T1685 Anomaly NPM Supply Chain Compromise, GitHub Malicious Activity 2026-05-13
GitHub Organizations Disable 2FA Requirement GitHub Organizations Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
O365 Block User Consent For Risky Apps Disabled O365 Update authorization policy. T1685 TTP Office 365 Account Takeover 2026-05-13
GitHub Enterprise Disable Audit Log Event Stream GitHub Enterprise Audit Logs T1195 T1685.002 Anomaly NPM Supply Chain Compromise, GitHub Malicious Activity 2026-05-13
O365 Disable MFA O365 Disable Strong Authentication. T1556 TTP Office 365 Persistence Mechanisms 2026-05-13
AWS Bedrock Delete GuardRails AWS CloudTrail DeleteGuardrail T1685.002 TTP AWS Bedrock Security 2026-05-13
ASL AWS Defense Evasion Impair Security Services ASL AWS CloudTrail T1685.002 Hunting AWS Defense Evasion 2026-05-13
ASL AWS Network Access Control List Deleted ASL AWS CloudTrail T1686.001 Anomaly Scattered Lapsus$ Hunters, AWS Network ACL Activity 2026-05-13
Cloud Compute Instance Created With Previously Unseen Instance Type AWS CloudTrail T1578.002 Anomaly Cloud Cryptomining 2026-05-13
Azure AD Block User Consent For Risky Apps Disabled Azure Active Directory Update authorization policy T1685 TTP Azure Active Directory Account Takeover 2026-05-13
AWS Defense Evasion Delete Cloudtrail AWS CloudTrail DeleteTrail T1685.002 TTP AWS Defense Evasion 2026-05-13
GitHub Organizations Disable Classic Branch Protection Rule GitHub Organizations Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
GitHub Enterprise Modify Audit Log Event Stream GitHub Enterprise Audit Logs T1195 T1685.002 Anomaly NPM Supply Chain Compromise, GitHub Malicious Activity 2026-05-13
GitHub Enterprise Disable Dependabot GitHub Enterprise Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
AWS New MFA Method Registered For User AWS CloudTrail CreateVirtualMFADevice T1556.006 TTP AWS Identity and Access Management Account Takeover 2026-05-13
Azure AD New Custom Domain Added Azure Active Directory Add unverified domain T1484.002 TTP Azure Active Directory Persistence 2026-05-13
GitHub Enterprise Pause Audit Log Event Stream GitHub Enterprise Audit Logs T1195 T1685.002 Anomaly NPM Supply Chain Compromise, GitHub Malicious Activity 2026-05-13
AWS Defense Evasion PutBucketLifecycle AWS CloudTrail PutBucketLifecycle T1485.001 T1685.002 Hunting AWS Defense Evasion 2026-05-13
Azure AD Multi-Factor Authentication Disabled Azure Active Directory Disable Strong Authentication T1556.006 T1586.003 TTP Azure Active Directory Account Takeover, Scattered Lapsus$ Hunters 2026-05-13
AWS Defense Evasion Stop Logging Cloudtrail AWS CloudTrail StopLogging T1685.002 TTP AWS Defense Evasion 2026-05-13
GitHub Enterprise Disable Classic Branch Protection Rule GitHub Enterprise Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
ASL AWS Defense Evasion PutBucketLifecycle ASL AWS CloudTrail T1485.001 T1685.002 Hunting AWS Defense Evasion 2026-05-13
Azure AD New MFA Method Registered For User Azure Active Directory User registered security info T1556.006 TTP Compromised User Account, Scattered Lapsus$ Hunters, Azure Active Directory Account Takeover 2026-05-13
ASL AWS Defense Evasion Delete Cloudtrail ASL AWS CloudTrail T1685.002 TTP AWS Defense Evasion 2026-05-13
Microsoft Intune DeviceManagementConfigurationPolicies Azure Monitor Activity T1021.007 T1072 T1484 T1685 T1686 Hunting Azure Active Directory Account Takeover 2026-05-13
AWS Multi-Factor Authentication Disabled AWS CloudTrail DeactivateMFADevice, AWS CloudTrail DeleteVirtualMFADevice T1556.006 T1586.003 T1621 TTP Scattered Lapsus$ Hunters, AWS Identity and Access Management Account Takeover 2026-05-13
GitHub Enterprise Disable 2FA Requirement GitHub Enterprise Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
Cloud Security Groups Modifications by User AWS CloudTrail T1578.005 Anomaly Suspicious Cloud User Activities 2026-05-13
Cisco Configuration Archive Logging Analysis Cisco IOS Logs T1098 T1505.003 T1685 Hunting Cisco Smart Install Remote Code Execution CVE-2018-0171 2026-05-13
Windows AD Replication Service Traffic T1003.006 T1207 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Windows AD Rogue Domain Controller Network Activity T1207 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Cisco Network Interface Modifications Cisco IOS Logs T1021 T1133 T1556 Anomaly Cisco Smart Install Remote Code Execution CVE-2018-0171 2026-05-13
Cisco SNMP Community String Configuration Changes Cisco IOS Logs T1040 T1552 T1685 Anomaly Cisco Smart Install Remote Code Execution CVE-2018-0171 2026-05-13