Alternate PowerShell Hosts - PowerShell Module
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test ps_module windows PowerShell - Roberto Rodriguez @Cyb3rWard0g 2019-08-11 2025-10-17 64e8e417-c19a-475a-8d19-98ea705394cc
1 Alternate PowerShell Hosts Pipe
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test pipe_created windows Sysmon - Roberto Rodriguez @Cyb3rWard0g, Tim Shelton 2019-09-12 2025-10-07 58cb02d5-78ce-4692-b3e1-dce850aae41a
2 Antivirus - Web Shell Detection Signature
Detects a highly relevant Antivirus alert that reports a web shell. (...)
Generic test antivirus - - - Florian Roth (Nextron Systems), Arnim Rupp 2018-09-09 2026-06-29 fdf135a2-9241-4f96-a114-bb404948f736
10 AppLocker Application Would Have Been Blocked
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Generic experimental - windows AppLocker - heyyanu 2026-03-26 — 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
4 AppLocker Prevented Application or Script from Running
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Generic test - windows AppLocker - Pushkarev Dmitry 2020-06-28 2025-12-03 401e5d00-b944-11ea-8f9a-00163ecd60ae
3 Splunk
AWS Bedrock Delete Knowledge Base
The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Bhavin Patel, Splunk 2025-03-25 2026-05-13 8b4e3d62-f743-11ee-9f6e-acde48001123
2 AWS EC2 Startup Shell Script Change
Detects changes to the EC2 instance startup script. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - faloker 2020-02-12 2022-06-07 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
1 AWS EFS Fileshare Mount Modified or Deleted
Detects when a EFS Fileshare Mount is modified or deleted. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - Austin Songer @austinsonger 2021-08-15 2022-10-09 6a7ba45c-63d8-473e-9736-2eaabff79964
1 AWS EKS Cluster Created or Deleted
Identifies when an EKS cluster is created or deleted.
Generic test cloud_audit - AWS CloudTrail · AWS - Austin Songer 2021-08-16 2022-10-09 33d50d03-20ec-4b74-a74e-1e65a38af1c0
1 Azure Container Registry Created or Deleted
Detects when a Container Registry is created or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 93e0ef48-37c8-49ed-a02c-038aab23628e
4 Azure Device or Configuration Modified or Deleted
Identifies when a device or device configuration in azure is modified or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-09-03 2022-10-09 46530378-f9db-4af9-a9e5-889c177d3881
1 Azure Kubernetes Cluster Created or Deleted
Detects when a Azure Kubernetes Cluster is created or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 9541f321-7cba-4b43-80fc-fbd1fb922808
4 Azure Kubernetes Network Policy Change
Identifies when a Azure Kubernetes network policy is modified or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 08d6ac24-c927-4469-b3b7-2e422d6e3c43
4 Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 25cb259b-bbdc-4b87-98b7-90d7c72f8743
4 Azure Kubernetes Secret or Config Object Access
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
4 Azure Kubernetes Sensitive Role Access
Identifies when ClusterRoles/Roles are being modified or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 818fee0c-e0ec-4e45-824e-83e4817b0887
4 Azure Kubernetes Service Account Modified or Deleted
Identifies when a service account is modified or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 12d027c3-b48c-4d9d-8bb6-a732200034b2
4 Bad Opsec Powershell Code Artifacts
focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including
Cob (...)
Generic test ps_module windows PowerShell - ok @securonix invrep_de, oscd.community 2020-10-09 2022-12-25 8d31a8ce-46b5-4dd6-bdc3-680931f1db86
3 Base64 Encoded PowerShell Command Detected
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2020-01-29 2023-01-26 e32d4572-9826-4738-b651-95fa63747e8a
1 BloodHound Collection Files
Detects default file names outputted by the BloodHound collection tool SharpHound
Generic test file_event windows Sysmon - C.J. May 2022-08-09 2026-02-19 02773bed-83bf-469f-b7ff-e676e7d78bab
1 bXOR Operator Usage In PowerShell Command Line - PowerShell Classic
Detects powershell execution with that make use of to the bxor (Bitwise XOR). (...)
Hunting test ps_classic_start windows PowerShell - Teymur Kheirkhabarov, Harish Segar 2020-06-29 2024-12-11 812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
2 Certificate Exported Via PowerShell
Detects calls to cmdlets that are used to export certificates from the local certificate store. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-05-18 — 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
3 Certificate Request Export to Exchange Webserver
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be u (...)
Generic test - windows Exchange - Max Altgelt (Nextron Systems) 2021-08-23 2023-01-23 b7bc7038-638b-4ffd-880c-292c692209ef
1 Change PowerShell Policies to an Insecure Level
Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2021-11-01 2025-10-07 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
4 Change PowerShell Policies to an Insecure Level - PowerShell
Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.
Generic test ps_script windows PowerShell - frack113 2021-10-20 2023-12-14 61d0475c-173f-4844-86f7-f3eebae1c66b
3 Chopper Webshell Process Pattern
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Generic test process_creation windows Sysmon · WinEventLog Security Florian Roth (Nextron Systems), MSTI (query) 2022-10-01 — fa3c117a-bc0d-416e-a31b-0c0e80653efb
1 ChromeLoader Malware Execution
Detects execution of ChromeLoader malware via a registered scheduled task
Emerging test process_creation windows Sysmon · WinEventLog Security - @kostastsale 2022-01-10 — 0a74c5a9-1b71-4475-9af2-7829d320d5c2
4 Splunk
Cisco Configuration Archive Logging Analysis
This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. (...)
Hunting stable configuration_change - Cisco IOS · Cisco Bhavin Patel, Michael Haag, Splunk 2025-08-21 2026-05-13 f52d5c0b-d45d-4304-b300-a4f6a1130dec
3 Splunk
Cisco IOS XE Tunnel Interface Configuration
This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. (...)
Anomaly stable network_device - Cisco IOS · Cisco - Nasreddine Bencherchali 2026-05-19 2026-05-20 8654314d-8e4d-4971-9f35-b9d477bf668e
2 Splunk
Cisco Secure Firewall - Communication Over Suspicious Ports
The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-03 2026-05-13 d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
1 Splunk
Cisco Secure Firewall - Privileged Command Execution via HTTP
This analytic detects HTTP requests to privileged execution paths on Cisco routers, specifically targeting the `/level/15/exec/-/*` endpoint using Cisco Secure Firewall Intrusion Events. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Michael Haag, Splunk 2026-01-12 2026-05-13 0c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
1 Splunk
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity
This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)
Generic stable firewall - Cisco Secure Firewall · Cisco Nasreddine Bencherchali, Splunk, Talos NTDR 2025-04-16 2026-05-13 7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
2 Cloudflared Tunnel Connections Cleanup
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-05-17 2023-12-21 7050bba1-1aed-454e-8f73-3f46f09ce56a
2 Cloudflared Tunnel Execution
Detects execution of the "cloudflared" tool to connect back to a tunnel. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems) 2023-05-17 2023-12-20 9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
3 Cloudflared Tunnels Related DNS Requests
Detects DNS requests to Cloudflared tunnels domains. (...)
Generic test dns windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2023-12-20 — a1d9eec5-33b2-4177-8d24-27fe754d0812
2 Cmd.EXE Missing Space Characters Execution Anomaly
Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2022-08-23 2026-05-13 a16980c2-0c56-4de0-9a79-17971979efdd
2 Command Line Execution with Suspicious URL and AppData Strings
Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community 2019-01-16 2021-11-27 1ac8666b-046f-4201-8aba-1951aaec03a3
2 Splunk
Common Ransomware Extensions
The following analytic detects modifications to files with extensions commonly associated with ransomware. (...)
Generic stable file_event windows Sysmon - David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick 2019-10-16 2026-09-22 a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
1 Splunk
Common Ransomware Notes
The following analytic detects the creation of files with names commonly associated with ransomware notes. (...)
Hunting stable file_event windows Sysmon - David Dorsey, Splunk 2019-10-16 2026-07-02 ada0f478-84a8-4641-a3f1-d82362d6bd71
- Communication To LocaltoNet Tunneling Service Initiated
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)
Generic test network_connection windows Sysmon - Andreas Braathen (mnemonic.io) 2024-06-17 — 3ab65069-d82a-4d44-a759-466661a082d1
2 Communication To LocaltoNet Tunneling Service Initiated - Linux
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)
Generic test network_connection linux Sysmon - Andreas Braathen (mnemonic.io) 2024-06-17 — c4568f5d-131f-4e78-83d4-45b2da0ec4f1
2 Communication To Ngrok Tunneling Service - Linux
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfi (...)
Generic test network_connection linux Sysmon - Florian Roth (Nextron Systems) 2022-11-03 — 19bf6fdb-7721-4f3d-867f-53467f6a5db6
2 Communication To Ngrok Tunneling Service Initiated
Detects an executable initiating a network connection to "ngrok" tunneling domains. (...)
Generic test network_connection windows Sysmon - Florian Roth (Nextron Systems) 2022-11-03 2024-02-02 1d08ac94-400d-4469-a82f-daee9a908849
2 Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)
Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. (...)
Emerging experimental process_creation windows Sysmon · WinEventLog Security Swachchhanda Shrawan Poudel (Nextron Systems) 2025-10-20 — bd3b3fff-a018-4994-9876-68af5809160f
1 ConvertTo-SecureString Cmdlet Usage Via CommandLine
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton 2020-10-11 2023-02-01 74403157-20f5-415d-89a7-c505779585cf
2 Splunk
CrushFTP Authentication Bypass Exploitation
The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)
Generic stable file_event - CrushFTP Michael Haag, Splunk 2025-04-14 2026-09-08 82eb7f64-d219-4e21-acfe-956de84c1a35
3 CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit
Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).
Emerging test webserver - - Sittikorn S, Nuttakorn Tungpoonsup 2021-09-10 2023-01-02 fcbb4a77-f368-4945-b046-4499a1da69d1
3 CVE-2022-24527 Microsoft Connected Cache LPE
Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected (...)
Emerging test file_event windows Sysmon Florian Roth (Nextron Systems) 2022-04-13 — e0a41412-c69a-446f-8e6e-0e6d7483dad7
1 DD File Overwrite
Detects potential overwriting and deletion of a file using DD.
Generic test process_creation linux Sysmon - Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC 2021-10-15 2022-07-07 2953194b-e33c-4859-b9e8-05948c167447
1 Defrag Deactivation
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot AP (...)
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1) 2019-03-04 2022-10-09 958d81aa-8566-4cea-a565-59ccd4df27b0
1