Splunk
7zip CommandLine To SMB Share Path
The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. (...)
Hunting stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Teoderick Contreras, Splunk 2021-08-17 2026-05-13 01d29b48-ff6f-11eb-b81e-acde48001123
1 7Zip Compressing Dump Files
Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2022-09-27 2026-06-05 ec570e53-4c76-45a9-804d-dc3f355ff7a7
1 Splunk
Access LSASS Memory for Dump Creation
The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. (...)
Generic stable process_access windows Sysmon - Patrick Bareiss, Splunk 2019-12-11 2026-10-09 fb4c31b0-13e8-4155-8aa5-24de4b8d6717
2 Active Directory Computers Enumeration With Get-AdComputer
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
Generic test ps_script windows PowerShell - frack113 2022-03-17 2023-07-08 36bed6b2-e9a0-4fff-beeb-413a92b86138
3 Active Directory Database Snapshot Via ADExplorer
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-03-14 2025-07-09 9212f354-7775-4e28-9c9f-8f0a4544e664
6 Active Directory Structure Export Via Csvde.EXE
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-03-14 — e5d36acd-acb4-4c6f-a13f-9eb203d50099
4 AD Privileged Users or Groups Reconnaissance
Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs
Generic test - windows WinEventLog Security - Samir Bousseaden 2019-04-03 2022-07-13 35ba1d85-724d-42a3-889f-2e2362bcaf23
1 Splunk
Add or Set Windows Defender Exclusion
The following analytic detects the use of commands to add or set exclusions
in Windows Defender. It (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Teoderick Contreras, Nasreddine Bencherchali, Splunk 2021-11-25 2026-06-08 773b66fe-4dd9-11ec-8289-acde48001122
4 Add SafeBoot Keys Via Reg Utility
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2022-09-02 2024-03-19 d7662ff6-9e97-4596-a61d-9839e32dee8d
1 ADExplorer Writing Complete AD Snapshot Into .dat File
Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)
Generic experimental file_event windows Sysmon - Arnim Rupp (Nextron Systems), Thomas Patzke 2025-07-09 — 0a1255c5-d732-4b62-ac02-b5152d34fb83
5 ADFS Database Named Pipe Connection By Uncommon Tool
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)
Generic test pipe_created windows Sysmon - Roberto Rodriguez @Cyb3rWard0g 2021-10-08 2023-11-30 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
3 ADS Zone.Identifier Deleted
Detects the deletion of the "Zone.Identifier" ADS. (...)
Hunting test file_delete windows Sysmon - frack113 2023-09-04 — 7eac0a16-5832-4e81-865f-0268a6d19e4b
1 ADS Zone.Identifier Deleted By Uncommon Application
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)
Generic test file_delete windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2023-09-04 2025-07-04 3109530e-ab47-4cc6-a953-cac5ebcc93ae
2 Splunk
AdsiSearcher Account Discovery
The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. (...)
Generic stable ps_script windows PowerShell - Teoderick Contreras, Mauricio Velazco, Splunk 2021-08-25 2026-10-02 de7fcadc-04f3-11ec-a241-acde48001122
4 Adwind RAT / JRAT
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community 2017-11-10 2022-10-09 1fac1481-2dbc-48b2-9096-753c49b4ec71
2 Adwind RAT / JRAT File Artifact
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Generic test file_event windows Sysmon - Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community 2017-11-10 2022-12-02 0bcfabcb-7929-47f4-93d6-b33fb67d34d1
2 Alternate PowerShell Hosts - PowerShell Module
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test ps_module windows PowerShell - Roberto Rodriguez @Cyb3rWard0g 2019-08-11 2025-10-17 64e8e417-c19a-475a-8d19-98ea705394cc
1 Alternate PowerShell Hosts Pipe
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test pipe_created windows Sysmon - Roberto Rodriguez @Cyb3rWard0g, Tim Shelton 2019-09-12 2025-10-07 58cb02d5-78ce-4692-b3e1-dce850aae41a
2 Always Install Elevated MSI Spawned Cmd And Powershell
Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"
Generic test process_creation windows Sysmon · WinEventLog Security - Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community 2020-10-13 2022-10-20 1e53dd56-8d83-4eb4-a43e-b790a05510aa
1 Always Install Elevated Parent Child Correlated
This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe (...)
Unsupported unsupported process_creation windows Sysmon · WinEventLog Security - Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community 2020-10-13 — 078235c5-6ec5-48e7-94b2-f8b5474379ea
1 Always Install Elevated Windows Installer
Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege
Generic test process_creation windows Sysmon · WinEventLog Security - Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community 2020-10-13 2024-12-01 cd951fdc-4b2f-47f5-ba99-a33bf61e3770
1 AMSI Bypass Pattern Assembly GetType
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts
Generic test ps_script windows PowerShell - Florian Roth (Nextron Systems) 2022-11-09 — e0d6c087-2d1c-47fd-8799-3904103c5a98
2 AMSI Disabled via Registry Modification
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...)
Generic experimental registry_set windows Sysmon · WinEventLog Security - Swachchhanda Shrawan Poudel (Nextron Systems) 2025-12-25 — aa37cbb0-da36-42cb-a90f-fdf216fc7467
3 Splunk
Anomalous usage of 7zip
The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. (...)
Anomaly stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Michael Haag, Teoderick Contreras, Splunk 2021-04-22 2026-05-13 9364ee8e-a39a-11eb-8f1d-acde48001122
3 Antivirus - APT Malware Signature
Detects a highly relevant Antivirus alert that reports APT malware. (...)
Generic experimental antivirus - - - Arnim Rupp (Nextron Systems) 2026-06-15 — 101a1877-2cf4-474d-abfd-7f6ac4788d1a
1 Antivirus - Exploitation Framework Signature
Detects a highly relevant Antivirus alert that reports an exploitation framework. (...)
Generic stable antivirus - - - Florian Roth (Nextron Systems), Arnim Rupp 2018-09-09 2026-06-15 238527ad-3c2c-4e4f-a1f6-92fd63adb864
4 Antivirus - Password Dumper Signature
Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)
Generic stable antivirus - - - Florian Roth (Nextron Systems), Arnim Rupp 2018-09-09 2026-06-15 78cc2dd2-7d20-4d32-93ff-057084c38b93
3 Antivirus - Remote Access Tools Signature
Detects a highly relevant Antivirus alert that reports a remote access tool. (...)
Generic experimental antivirus - - - Arnim Rupp (Nextron Systems) 2026-06-15 — 97233998-3838-4581-88c6-f1d19d3993fb
2 Antivirus Filter Driver Disallowed On Dev Drive - Registry
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".
Generic test registry_set windows Sysmon · WinEventLog Security - @kostastsale, Nasreddine Bencherchali (Nextron Systems) 2023-11-05 2024-08-16 31e124fb-5dc4-42a0-83b3-44a69c77b271
1 AppLocker Application Would Have Been Blocked
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Generic experimental - windows AppLocker - heyyanu 2026-03-26 — 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
4 AppLocker Prevented Application or Script from Running
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Generic test - windows AppLocker - Pushkarev Dmitry 2020-06-28 2025-12-03 401e5d00-b944-11ea-8f9a-00163ecd60ae
3 AppX Package Installation Attempts Via AppInstaller.EXE
Detects DNS queries made by "AppInstaller.EXE". (...)
Generic test dns windows Sysmon - frack113 2021-11-24 2023-11-09 7cff77e1-9663-46a3-8260-17f2e1aa9d0a
2 APT User Agent
Detects suspicious user agent strings used in APT malware in proxy logs
Generic test proxy - - - Florian Roth (Nextron Systems), Markus Neis 2019-11-12 2024-02-15 6ec820f2-e963-4801-9127-d8b2dce4d31b
1 APT27 - Emissary Panda Activity
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2018-09-03 2023-03-09 9aa01d62-7667-4d3b-acb8-8cb5103e2014
3 APT31 Judgement Panda Activity
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2019-02-21 2023-03-10 03e2746e-2b31-42f1-ab7a-eb39365b2422
1 APT40 Dropbox Tool User Agent
Detects suspicious user agent string of APT40 Dropbox tool
Emerging test proxy - - - Thomas Patzke 2019-11-12 2023-05-18 5ba715b6-71b7-44fd-8245-f66893e81b3d
1 Arbitrary File Download Via GfxDownloadWrapper.EXE
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.
Generic test process_creation windows Sysmon · WinEventLog Security - Victor Sergeev, oscd.community 2020-10-09 2023-10-18 eee00933-a761-4cd0-be70-c42fe91731e7
1 Arbitrary Shell Command Execution Via Settingcontent-Ms
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Sreeman 2020-03-13 2022-04-14 24de4f3b-804c-4165-b442-5a06a2302c7e
1 Aruba Network Service Potential DLL Sideloading
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...)
Generic test image_load windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2023-01-22 2023-03-15 90ae0469-0cee-4509-b67f-e5efcef040f7
1 ASLR Disabled Via Sysctl or Direct Syscall - Linux
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use (...)
Generic experimental process_creation linux Linux Auditd - Milad Cheraghi 2025-05-26 2025-12-05 e497a24e-9345-4a62-9803-b06d7d7cb132
4 Splunk
Attacker Tools On Endpoint
The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco - Bhavin Patel, Splunk, sventec, Github Community 2021-07-12 2026-09-22 a51bfe1a-94f0-48cc-b4e4-16a110145893
- Audit CVE Event
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)
Generic test - windows WinEventLog Application Florian Roth (Nextron Systems), Zach Mathis 2020-01-15 2022-10-22 48d91a3a-2363-43ba-a456-ca71ac3da5c2
5 Auditing Configuration Changes on Linux Host
Detect changes in auditd configuration files
Generic test file_event linux Linux Auditd - Mikhail Larin, oscd.community 2019-10-25 2021-11-27 977ef627-4539-4875-adf4-ed8f780c4922
2 Automated Turla Group Lateral Movement
Detects automated lateral movement by Turla group
Unsupported unsupported process_creation windows Sysmon · WinEventLog Security - Markus Neis 2017-11-07 2023-02-24 75925535-ca97-4e0a-a850-00b5c00779dc
1 AWS Bedrock Guardrail Deleted
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - Marco Pedrinazzi (@pedrinazziM) (InTheCyber) 2026-07-10 — 59b70e4d-dd17-44a9-b740-acf07ae3eb6a
1 AWS Bedrock Guardrail Updated
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety c (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - Marco Pedrinazzi (@pedrinazziM) (InTheCyber) 2026-07-10 — 1c722651-254a-4b04-a9f4-99b62a2d0a1f
1 AWS EC2 Startup Shell Script Change
Detects changes to the EC2 instance startup script. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - faloker 2020-02-12 2022-06-07 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
1 AWS EC2 VM Export Failure
An attempt to export an AWS EC2 instance has been detected. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - Diogo Braz 2020-04-16 2022-10-05 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
1 AWS GuardDuty Detector Deleted Or Updated
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - suktech24 2025-11-27 — d2656e78-c069-4571-8220-9e0ab5913f19
12 AWS GuardDuty Important Change
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.
Generic test cloud_audit - AWS CloudTrail · AWS - faloker 2020-02-11 2022-10-09 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3
1