A Member Was Added to a Security-Enabled Global Group
Detects activity when a member is added to a security-enabled global group
Generic stable account_management windows WinEventLog Security - Alexandr Yampolskyi, SOC Prime 2023-04-26 — c43c26be-2e87-46c7-8661-284588c5a53e
5 A Member Was Removed From a Security-Enabled Global Group
Detects activity when a member is removed from a security-enabled global group
Generic stable - windows WinEventLog Security - Alexandr Yampolskyi, SOC Prime 2023-04-26 — 02c39d30-02b5-45d2-b435-8aebfe5a8629
5 A New Trust Was Created To A Domain
Addition of domains is seldom and should be verified for legitimacy.
Generic stable - windows WinEventLog Security - Thomas Patzke 2019-12-03 2024-01-16 0255a820-e564-4e40-af2b-6ac61160335c
1 A Security-Enabled Global Group Was Deleted
Detects activity when a security-enabled global group is deleted
Generic stable account_management windows WinEventLog Security - Alexandr Yampolskyi, SOC Prime 2023-04-26 — b237c54b-0f15-4612-a819-44b735e0de27
5 Splunk
Access LSASS Memory for Dump Creation
The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. (...)
Generic stable process_access windows Sysmon - Patrick Bareiss, Splunk 2019-12-11 2026-10-09 fb4c31b0-13e8-4155-8aa5-24de4b8d6717
2 Access To ADMIN$ Network Share
Detects access to ADMIN$ network share
Generic test network_connection windows WinEventLog Security - Florian Roth (Nextron Systems) 2017-03-04 2024-01-16 098d7118-55bc-4912-a836-dc6483a8d150
1 Account Lockout
Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.
Generic test authentication - Azure Sign-in Logs · Azure - AlertIQ 2021-10-10 2022-12-25 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a
1 Active Directory Computers Enumeration With Get-AdComputer
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
Generic test ps_script windows PowerShell - frack113 2022-03-17 2023-07-08 36bed6b2-e9a0-4fff-beeb-413a92b86138
3 Active Directory User Backdoors
Detects scenarios where one can control another users or computers account without having to use their credentials.
Generic test account_management windows WinEventLog Security - @neu5ron 2017-04-13 2024-02-26 300bac00-e041-4ee2-9c36-e262656a6ecc
3 ADCS - Certighost Ghost Machine Account Creation
Detects the creation of a machine account whose name starts with 'GHOST', which is the
naming conven (...)
Emerging experimental account_management windows WinEventLog Security Swachchhanda Shrawan Poudel (Nextron Systems) 2026-07-30 — fa0bac5f-d170-4a91-9780-1ad71dc1f49e
2 Adwind RAT / JRAT
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community 2017-11-10 2022-10-09 1fac1481-2dbc-48b2-9096-753c49b4ec71
2 Adwind RAT / JRAT File Artifact
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Generic test file_event windows Sysmon - Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community 2017-11-10 2022-12-02 0bcfabcb-7929-47f4-93d6-b33fb67d34d1
2 Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-02-28 2025-10-22 6c8fbee5-dee8-49bc-851d-c3142d02aa47
3 Alternate PowerShell Hosts - PowerShell Module
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test ps_module windows PowerShell - Roberto Rodriguez @Cyb3rWard0g 2019-08-11 2025-10-17 64e8e417-c19a-475a-8d19-98ea705394cc
1 Alternate PowerShell Hosts Pipe
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test pipe_created windows Sysmon - Roberto Rodriguez @Cyb3rWard0g, Tim Shelton 2019-09-12 2025-10-07 58cb02d5-78ce-4692-b3e1-dce850aae41a
2 Anomalous User Activity
Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.
Generic test - - Azure Risk Detection · Azure - Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' 2023-09-03 — 258b6593-215d-4a26-a141-c8e31c1299a6
2 Antivirus - Password Dumper Signature
Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)
Generic stable antivirus - - - Florian Roth (Nextron Systems), Arnim Rupp 2018-09-09 2026-06-15 78cc2dd2-7d20-4d32-93ff-057084c38b93
3 Application Removed Via Wmic.EXE
Detects the removal or uninstallation of an application via "Wmic.EXE".
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2022-01-28 2024-07-02 b53317a0-8acf-4fd1-8de8-a5401e776b96
1 Application Termination Attempt via Wmic.EXE
Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-09-11 — 49d9671b-0a0a-4c09-8280-d215bfd30662
2 AppLocker Application Would Have Been Blocked
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Generic experimental - windows AppLocker - heyyanu 2026-03-26 — 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
4 AppLocker Prevented Application or Script from Running
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Generic test - windows AppLocker - Pushkarev Dmitry 2020-06-28 2025-12-03 401e5d00-b944-11ea-8f9a-00163ecd60ae
3 APT29 Google Update Service Install
This method detects malicious services mentioned in APT29 report by FireEye. (...)
Unsupported unsupported process_creation windows WinEventLog System - Thomas Patzke 2017-11-01 2022-03-21 c069f460-2b87-4010-8dcf-e45bab362624
1 APT31 Judgement Panda Activity
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2019-02-21 2023-03-10 03e2746e-2b31-42f1-ab7a-eb39365b2422
1 Splunk
ASL AWS Credential Access RDS Password reset
The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2022-08-07 2026-05-13 d15e9bd9-ef64-4d84-bc04-f62955a9fee8
1 Splunk
ASL AWS IAM Assume Role Policy Brute Force
The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2022-10-04 2026-05-13 726959fe-316d-445c-a584-fa187d64e295
3 Splunk
ASL AWS IAM Delete Policy
The following analytic identifies when a policy is deleted in AWS. (...)
Hunting stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2021-04-06 2026-05-13 609ced68-d420-4ff7-8164-ae98b4b4018c
2 Splunk
ASL AWS IAM Failure Group Deletion
The following analytic detects failed attempts to delete AWS IAM groups, triggered by access denial, conflicts, or non-existent groups. (...)
Anomaly stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2024-05-22 2026-05-13 8d12f268-c567-4557-9813-f8389e235c06
2 Splunk
ASL AWS IAM Successful Group Deletion
The following analytic detects the successful deletion of a group within AWS IAM, leveraging CloudTrail IAM events. (...)
Hunting stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2024-05-22 2026-05-13 1bbe54f1-93d7-4764-8a01-ddaa12ece7ac
2 Splunk
Attacker Tools On Endpoint
The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco - Bhavin Patel, Splunk, sventec, Github Community 2021-07-12 2026-09-22 a51bfe1a-94f0-48cc-b4e4-16a110145893
- Audit Policy Tampering Via Auditpol
Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Janantha Marasinghe (https://github.com/blueteam0ps) 2021-02-02 2023-02-22 0a13e132-651d-11eb-ae93-0242ac130002
1 Audit Policy Tampering Via NT Resource Kit Auditpol
Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2021-12-18 2023-02-21 c6c56ada-612b-42d1-9a29-adad3c5c2c1e
1 Automated Turla Group Lateral Movement
Detects automated lateral movement by Turla group
Unsupported unsupported process_creation windows Sysmon · WinEventLog Security - Markus Neis 2017-11-07 2023-02-24 75925535-ca97-4e0a-a850-00b5c00779dc
1 AWS ConsoleLogin Failed Authentication
Detects failed AWS console login attempts due to authentication failures. (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - Ivan Saakov, Nasreddine Bencherchali 2025-10-19 — 6393e346-1977-46ef-8987-ad414a145fad
3 Splunk
AWS Credential Access RDS Password reset
The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Gowthamaraj Rajendran, Splunk 2022-08-07 2026-05-13 6153c5ea-ed30-4878-81e6-21ecdb198189
1 AWS EC2 Startup Shell Script Change
Detects changes to the EC2 instance startup script. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - faloker 2020-02-12 2022-06-07 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
1 AWS ElastiCache Security Group Created
Detects when an ElastiCache security group has been created.
Generic test cloud_audit - AWS CloudTrail · AWS - Austin Songer @austinsonger 2021-07-24 2022-10-09 4ae68615-866f-4304-b24b-ba048dfa5ca7
1 Splunk
AWS IAM Assume Role Policy Brute Force
The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Michael Haag, Splunk 2021-04-06 2026-05-13 f19e09b0-9308-11eb-b7ec-acde48001122
3 AWS IAM Backdoor Users Keys
Detects AWS API key creation for a user by another user. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - faloker 2020-02-12 2026-08-14 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2
2 Splunk
AWS IAM Delete Policy
The following analytic detects the deletion of an IAM policy in AWS. (...)
Hunting stable cloud_audit - AWS CloudTrail · AWS - Michael Haag, Splunk 2021-04-06 2026-05-13 ec3a9362-92fe-11eb-99d0-acde48001122
2 Splunk
AWS IAM Failure Group Deletion
The following analytic identifies failed attempts to delete AWS IAM groups. (...)
Anomaly stable account_management - AWS CloudTrail · AWS - Michael Haag, Splunk 2021-04-06 2026-05-13 723b861a-92eb-11eb-93b8-acde48001122
2 Splunk
AWS IAM Successful Group Deletion
The following analytic identifies the successful deletion of an IAM group in AWS. (...)
Hunting stable account_management - AWS CloudTrail · AWS - Michael Haag, Splunk 2021-04-06 2026-05-13 e776d06c-9267-11eb-819b-acde48001122
2 AWS Route 53 Domain Transfer Lock Disabled
Detects when a transfer lock was removed from a Route 53 domain. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - Elastic, Austin Songer @austinsonger 2021-07-22 2022-10-09 3940b5f1-3f46-44aa-b746-ebe615b879e0
3 AWS Route 53 Domain Transferred to Another Account
Detects when a request has been made to transfer a Route 53 domain to another AWS account.
Generic test cloud_audit - AWS CloudTrail · AWS - Elastic, Austin Songer @austinsonger 2021-07-22 2022-10-09 b056de1a-6e6e-4e40-a67e-97c9808cf41b
1 AWS User Login Profile Was Modified
Detects activity when someone is changing passwords on behalf of other users. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - toffeebr33k 2021-08-09 2024-04-26 055fb148-60f8-462d-ad16-26926ce050f1
1 Axios NPM Compromise Indicators - Windows
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)
Emerging experimental process_creation windows Sysmon · WinEventLog Security - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — f6c27ecc-d890-4452-80e6-2e274a10e097
5 Splunk
Azure AD Service Principal Owner Added
The following analytic detects the addition of a new owner to a Service Principal within an Azure AD tenant. (...)
Generic stable account_management - Microsoft 365 - Mauricio Velazco, Gowthamaraj Rajendran, Splunk 2022-08-30 2026-05-13 7ddf2084-6cf3-4a44-be83-474f7b73c701
1 Splunk
Azure AD User Enabled And Password Reset
The following analytic detects an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. (...)
Generic stable authentication - Microsoft 365 - Mauricio Velazco, Gowthamaraj Rajendran, Splunk 2022-08-30 2026-05-13 1347b9e8-2daa-4a6f-be73-b421d3d9e268
1 Splunk
Azure AD User ImmutableId Attribute Updated
The following analytic identifies the modification of the SourceAnchor (ImmutableId) attribute for an Azure Active Directory user. (...)
Generic stable account_management - Microsoft 365 - Mauricio Velazco, Gowthamaraj Rajendran, Splunk 2022-09-02 2026-05-13 0c0badad-4536-4a84-a561-5ff760f3c00e
6 Bad Opsec Powershell Code Artifacts
focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including
Cob (...)
Generic test ps_module windows PowerShell - ok @securonix invrep_de, oscd.community 2020-10-09 2022-12-25 8d31a8ce-46b5-4dd6-bdc3-680931f1db86
3 Base64 Encoded PowerShell Command Detected
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2020-01-29 2023-01-26 e32d4572-9826-4738-b651-95fa63747e8a
1