Access To .Reg/.Hive Files By Uncommon Applications
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.
Hunting test file_access windows - - frack113 2023-09-15 2024-07-29 337a31c6-46c4-46be-886a-260d7aa78cac
1 Access To Browser Credential Files By Uncommon Applications - Security
Detects file access requests to browser credential stores by uncommon processes. (...)
Hunting test file_event windows WinEventLog Security - Daniel Koifman (@Koifsec), Nasreddine Bencherchali 2024-10-21 — 4b60e527-ec73-4b47-8cb3-f02ad927ca65
1 Access to Browser Login Data
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)
Generic test ps_script windows PowerShell - frack113 2022-01-30 — fc028194-969d-4122-8abe-0470d5b8f12f
1 Activate Suppression of Windows Security Center Notifications
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 0c93308a-3f1b-40a9-b649-57ea1a1c1d63
1 Add DisallowRun Execution to Registry
Detect set DisallowRun to 1 to prevent user running specific computer program
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 275641a5-a492-45e2-a817-7c81e9d9d3e9
1 Splunk
Add or Set Windows Defender Exclusion
The following analytic detects the use of commands to add or set exclusions
in Windows Defender. It (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Teoderick Contreras, Nasreddine Bencherchali, Splunk 2021-11-25 2026-06-08 773b66fe-4dd9-11ec-8289-acde48001122
4 Add SafeBoot Keys Via Reg Utility
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2022-09-02 2024-03-19 d7662ff6-9e97-4596-a61d-9839e32dee8d
1 Admin User Remote Logon
Detect remote login by Administrator user (depending on internal pattern).
Generic test authentication windows WinEventLog Security - juju4 2017-10-29 2022-10-09 0f63e1ef-1eb9-4226-9d54-8927ca08520a
1 Adwind RAT / JRAT
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community 2017-11-10 2022-10-09 1fac1481-2dbc-48b2-9096-753c49b4ec71
2 Adwind RAT / JRAT File Artifact
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Generic test file_event windows Sysmon - Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community 2017-11-10 2022-12-02 0bcfabcb-7929-47f4-93d6-b33fb67d34d1
2 Allow RDP Remote Assistance Feature
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
1 Alternate PowerShell Hosts - PowerShell Module
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test ps_module windows PowerShell - Roberto Rodriguez @Cyb3rWard0g 2019-08-11 2025-10-17 64e8e417-c19a-475a-8d19-98ea705394cc
1 Alternate PowerShell Hosts Pipe
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test pipe_created windows Sysmon - Roberto Rodriguez @Cyb3rWard0g, Tim Shelton 2019-09-12 2025-10-07 58cb02d5-78ce-4692-b3e1-dce850aae41a
2 AMSI Bypass Pattern Assembly GetType
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts
Generic test ps_script windows PowerShell - Florian Roth (Nextron Systems) 2022-11-09 — e0d6c087-2d1c-47fd-8799-3904103c5a98
2 AMSI Disabled via Registry Modification
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...)
Generic experimental registry_set windows Sysmon · WinEventLog Security - Swachchhanda Shrawan Poudel (Nextron Systems) 2025-12-25 — aa37cbb0-da36-42cb-a90f-fdf216fc7467
3 Antivirus - Ransomware Signature
Detects a highly relevant Antivirus alert that reports ransomware. (...)
Generic test antivirus - - - Florian Roth (Nextron Systems), Arnim Rupp 2022-05-12 2026-06-15 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
7 Antivirus Filter Driver Disallowed On Dev Drive - Registry
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".
Generic test registry_set windows Sysmon · WinEventLog Security - @kostastsale, Nasreddine Bencherchali (Nextron Systems) 2023-11-05 2024-08-16 31e124fb-5dc4-42a0-83b3-44a69c77b271
1 AppLocker Application Would Have Been Blocked
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Generic experimental - windows AppLocker - heyyanu 2026-03-26 — 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
4 AppLocker Prevented Application or Script from Running
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Generic test - windows AppLocker - Pushkarev Dmitry 2020-06-28 2025-12-03 401e5d00-b944-11ea-8f9a-00163ecd60ae
3 AppX Package Installation Attempts Via AppInstaller.EXE
Detects DNS queries made by "AppInstaller.EXE". (...)
Generic test dns windows Sysmon - frack113 2021-11-24 2023-11-09 7cff77e1-9663-46a3-8260-17f2e1aa9d0a
2 APT User Agent
Detects suspicious user agent strings used in APT malware in proxy logs
Generic test proxy - - - Florian Roth (Nextron Systems), Markus Neis 2019-11-12 2024-02-15 6ec820f2-e963-4801-9127-d8b2dce4d31b
1 APT29 2018 Phishing Campaign CommandLine Indicators
Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant
Emerging stable process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), @41thexplorer 2018-11-20 2023-03-08 7453575c-a747-40b9-839b-125a0aae324b
3 APT29 2018 Phishing Campaign File Indicators
Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant
Emerging stable file_event windows Sysmon - @41thexplorer 2018-11-20 2023-02-20 3a3f81ca-652c-482b-adeb-b1c804727f74
2 APT40 Dropbox Tool User Agent
Detects suspicious user agent string of APT40 Dropbox tool
Emerging test proxy - - - Thomas Patzke 2019-11-12 2023-05-18 5ba715b6-71b7-44fd-8245-f66893e81b3d
1 Arbitrary File Download Via GfxDownloadWrapper.EXE
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.
Generic test process_creation windows Sysmon · WinEventLog Security - Victor Sergeev, oscd.community 2020-10-09 2023-10-18 eee00933-a761-4cd0-be70-c42fe91731e7
1 Arbitrary Shell Command Execution Via Settingcontent-Ms
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Sreeman 2020-03-13 2022-04-14 24de4f3b-804c-4165-b442-5a06a2302c7e
1 Splunk
ASL AWS Detect Users creating keys with encrypt policy without MFA
The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2020-10-27 2026-05-13 16ae9076-d1d5-411c-8fdd-457504b33dac
3 ASLR Disabled Via Sysctl or Direct Syscall - Linux
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use (...)
Generic experimental process_creation linux Linux Auditd - Milad Cheraghi 2025-05-26 2025-12-05 e497a24e-9345-4a62-9803-b06d7d7cb132
4 Auditing Configuration Changes on Linux Host
Detect changes in auditd configuration files
Generic test file_event linux Linux Auditd - Mikhail Larin, oscd.community 2019-10-25 2021-11-27 977ef627-4539-4875-adf4-ed8f780c4922
2 Automated Collection Command Prompt
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2021-07-28 2022-11-11 f576a613-2392-4067-9d1a-9345fb58d8d1
2 AWS Bedrock Guardrail Deleted
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - Marco Pedrinazzi (@pedrinazziM) (InTheCyber) 2026-07-10 — 59b70e4d-dd17-44a9-b740-acf07ae3eb6a
1 AWS Bedrock Guardrail Updated
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety c (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - Marco Pedrinazzi (@pedrinazziM) (InTheCyber) 2026-07-10 — 1c722651-254a-4b04-a9f4-99b62a2d0a1f
1 Splunk
AWS Detect Users creating keys with encrypt policy without MFA
The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Rod Soto, Patrick Bareiss Splunk 2020-10-27 2026-05-13 c79c164f-4b21-4847-98f9-cf6a9f49179e
3 Splunk
AWS Detect Users with KMS keys performing encryption S3
The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...)
Anomaly stable cloud_audit - AWS CloudTrail · AWS - Rod Soto, Patrick Bareiss Splunk 2020-10-27 2026-05-13 884a5f59-eec7-4f4a-948b-dbde18225fdc
3 AWS EC2 Disable EBS Encryption
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Sittikorn S 2021-06-29 2021-08-20 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
1 AWS EC2 Startup Shell Script Change
Detects changes to the EC2 instance startup script. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - faloker 2020-02-12 2022-06-07 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
1 AWS GuardDuty Detector Deleted Or Updated
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - suktech24 2025-11-27 — d2656e78-c069-4571-8220-9e0ab5913f19
12 AWS GuardDuty Important Change
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.
Generic test cloud_audit - AWS CloudTrail · AWS - faloker 2020-02-11 2022-10-09 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3
1 AWS KMS Imported Key Material Usage
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - toopricey 2025-10-18 — 1279262f-1464-422f-ac0d-5b545320c526
3 AWS Macie Evasion
Detects evade to Macie detection.
Unsupported unsupported cloud_audit - AWS CloudTrail · AWS - Sittikorn S 2021-07-06 2023-03-24 91f6a16c-ef71-437a-99ac-0b070e3ad221
1 AWS SecurityHub Findings Evasion
Detects the modification of the findings on SecurityHub.
Generic stable cloud_audit - AWS CloudTrail · AWS - Sittikorn S 2021-06-28 — a607e1fe-74bf-4440-a3ec-b059b9103157
1 Axios NPM Compromise File Creation Indicators - Linux
Detects file creation events linked to the Axios NPM supply chain compromise. (...)
Emerging experimental file_event linux Sysmon - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — b7cb840c-11f6-47f7-b3ef-5524739c9077
5 Axios NPM Compromise File Creation Indicators - MacOS
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)
Emerging experimental file_event macos - - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — 2db0458c-05c9-4069-a26f-77becd9c8c13
5 Axios NPM Compromise Indicators - Linux
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)
Emerging experimental process_creation linux Sysmon - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — 0a23a62d-c5b3-468b-a072-25064a9a8c87
5 Axios NPM Compromise Indicators - macOS
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
Emerging experimental process_creation macos - - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — a09ee860-31b3-4586-8a68-0ebd74ce0e5f
5 Axios NPM Compromise Indicators - Windows
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)
Emerging experimental process_creation windows Sysmon · WinEventLog Security - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — f6c27ecc-d890-4452-80e6-2e274a10e097
5 Axios NPM Compromise Malicious C2 Domain DNS Query
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...)
Emerging experimental dns - - - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — 73e5d24f-493f-4092-bd2f-c72cabda40ee
6 Splunk
Azure AD Block User Consent For Risky Apps Disabled
The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...)
Generic stable account_management - Microsoft 365 - Mauricio Velazco, Splunk 2023-11-16 2026-05-13 875de3d7-09bc-4916-8c0a-0929f4ced3d8
4 Splunk
Azure AD Device Code Authentication
The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). (...)
Generic stable authentication - Microsoft 365 - Mauricio Velazco, Gowthamaraj Rajendran, Splunk 2023-11-16 2026-05-13 d68d8732-6f7e-4ee5-a6eb-737f2b990b91
5 Azure Key Vault Modified or Deleted
Identifies when a key vault is modified or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-16 2022-08-23 459a2970-bb84-4e6a-a32e-ff0fbd99448d
1