Antivirus - APT Malware Signature
Detects a highly relevant Antivirus alert that reports APT malware. (...)
Generic experimental antivirus - - - Arnim Rupp (Nextron Systems) 2026-06-15 — 101a1877-2cf4-474d-abfd-7f6ac4788d1a
1 Antivirus - Exploitation Framework Signature
Detects a highly relevant Antivirus alert that reports an exploitation framework. (...)
Generic stable antivirus - - - Florian Roth (Nextron Systems), Arnim Rupp 2018-09-09 2026-06-15 238527ad-3c2c-4e4f-a1f6-92fd63adb864
4 Antivirus - Remote Access Tools Signature
Detects a highly relevant Antivirus alert that reports a remote access tool. (...)
Generic experimental antivirus - - - Arnim Rupp (Nextron Systems) 2026-06-15 — 97233998-3838-4581-88c6-f1d19d3993fb
2 AppLocker Application Would Have Been Blocked
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Generic experimental - windows AppLocker - heyyanu 2026-03-26 — 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
4 AppLocker Prevented Application or Script from Running
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Generic test - windows AppLocker - Pushkarev Dmitry 2020-06-28 2025-12-03 401e5d00-b944-11ea-8f9a-00163ecd60ae
3 Audit CVE Event
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)
Generic test - windows WinEventLog Application Florian Roth (Nextron Systems), Zach Mathis 2020-01-15 2022-10-22 48d91a3a-2363-43ba-a456-ca71ac3da5c2
5 Automated Turla Group Lateral Movement
Detects automated lateral movement by Turla group
Unsupported unsupported process_creation windows Sysmon · WinEventLog Security - Markus Neis 2017-11-07 2023-02-24 75925535-ca97-4e0a-a850-00b5c00779dc
1 Splunk
Batch File Write to System32
The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...)
Anomaly stable file_event windows Sysmon - Steven Dick, Michael Haag, Rico Valdez, Splunk 2020-04-29 2026-07-02 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
- Capabilities Discovery - Linux
Detects usage of "getcap" binary. (...)
Generic test process_creation linux Sysmon - Nasreddine Bencherchali (Nextron Systems) 2022-12-28 2026-01-24 d8d97d51-122d-4cdd-9e2f-01b4b4933530
3 Cisco Discovery
Find information about network devices that is not stored in config files
Generic test authentication - Cisco AAA · Cisco - Austin Clark 2019-08-12 2023-01-04 9705a6a1-6db6-4a16-a987-15b7151e299b
1 Splunk
Cisco NVM - Non-Network Binary Making Network Connection
This analytic detects network connections initiated by binaries that are not typically associated wi (...)
Anomaly stable network_connection - Cisco NVM · Cisco - Nasreddine Bencherchali, Splunk 2025-07-01 2026-09-22 c6db35af-8a0e-4b61-88ed-738e66f15715
2 Splunk
Cisco NVM - Susp Script From Archive Triggering Network Activity
This analytic detects script execution (`wscript.exe` or `cscript.exe`) triggered from compressed fi (...)
Anomaly stable network_connection - Cisco NVM · Cisco - Nasreddine Bencherchali, Splunk 2025-07-01 2026-09-22 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777
1 Splunk
Cisco Secure Firewall - Binary File Type Download
The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-09 2026-09-22 24b2c2e3-2ff7-4a23-b814-87f8a62028cd
1 Splunk
Cisco Secure Firewall - Blocked Connection
The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-03 2026-05-13 17e9b764-3a2b-4d36-9751-32d13ce4718b
1 Splunk
Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt
This analytic detects exploitation activity of CVE-2025-5777 using Cisco Secure Firewall Intrusion Events. (...)
Generic stable firewall - Cisco Secure Firewall · Cisco Michael Haag, Nasreddine Bencherchali, Splunk, Talos NTDR 2025-07-17 2026-05-13 93db24a0-fd21-45d7-9daf-84afd5a8cca2
7 Splunk
Cisco Secure Firewall - Connection to File Sharing Domain
The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-03 2026-05-13 f7e5e792-d907-46c1-a58e-4ff974dc462a
1 Splunk
Cisco Secure Firewall - High Priority Intrusion Classification
This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. (...)
Generic stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-16 2026-05-13 ec99bb81-c31b-4837-8c7d-1b32aa70b337
1 Splunk
Cisco Secure Firewall - Malware File Downloaded
The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-09 2026-09-22 3cc93f52-5aa6-4b7f-83b9-3430b1436813
1 Splunk
Cisco Secure Firewall - Possibly Compromised Host
The following analytic highlights high-impact intrusion events assigned by Cisco Secure Firewall. (...)
Anomaly experimental firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-16 2026-05-13 244a77bb-3b2a-46f1-bf2c-b4f7cd29276d
1 Splunk
Cisco Secure Firewall - Repeated Blocked Connections
The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-03 2026-05-13 1f57f10e-1dc5-47ea-852c-2e85b2503d79
1 CLR DLL Loaded Via Office Applications
Detects CLR DLL being loaded by an Office Product
Generic test image_load windows Sysmon - Antonlovesdnb 2020-02-19 2023-03-29 d13c43f0-f66b-4279-8b2c-5912077c1780
1 CodePage Modification Via MODE.COM
Detects a CodePage modification using the "mode.com" utility. (...)
Hunting test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk 2024-01-19 — d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e
4 CodePage Modification Via MODE.COM To Russian Language
Detects a CodePage modification using the "mode.com" utility to Russian language. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Joseliyo Sanchez, @Joseliyo_Jstnk 2024-01-17 — 12fbff88-16b5-4b42-9754-cd001a789fb3
4 Conti Volume Shadow Listing
Detects a command used by conti to find volume shadow backups
Emerging test process_creation windows Sysmon · WinEventLog Security - Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) 2021-08-09 — 7b30e0a7-c675-4b24-8a46-82fa67e2433d
2 CreateDump Process Dump
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) 2022-01-04 2022-08-19 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
2 Creation of an Executable by an Executable
Detects the creation of an executable by another executable.
Hunting test file_event windows Sysmon - frack113 2022-03-09 2025-02-24 297afac9-5d02-4138-8c58-b977bac60556
1 CVE-2021-26858 Exchange Exploitation
Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking fo (...)
Emerging test file_event windows Sysmon Bhabesh Raj 2021-03-03 2022-10-09 b06335b3-55ac-4b41-937e-16b7f5d57dfd
1 CVE-2021-31979 CVE-2021-33771 Exploits
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability a (...)
Emerging test registry_set windows Sysmon · WinEventLog Security Sittikorn S, frack113 2021-07-16 2023-08-17 32b5db62-cb5f-4266-9639-0fa48376ac00
2 CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability a (...)
Emerging test file_event windows Sysmon Sittikorn S 2021-07-16 2022-10-09 ad7085ac-92e4-4b76-8ce2-276d2c0e68ef
2 CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process
Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.
Emerging test process_creation windows Sysmon · WinEventLog Security Nasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io) 2023-08-30 2024-01-22 ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
2 Splunk
Detect Windows DNS SIGRed via Splunk Stream
The following analytic detects attempts to exploit the SIGRed vulnerability (CVE-2020-1350) in Windows DNS servers. (...)
Generic experimental network_connection - Splunk Stream Shannon Davis, Splunk 2020-08-04 2026-05-13 babd8d10-d073-11ea-87d0-0242ac130003
- Splunk
Detect Windows DNS SIGRed via Zeek
The following analytic detects the presence of SIGRed, a critical DNS vulnerability, using Zeek DNS and Zeek Conn data. (...)
Generic experimental dns - - Shannon Davis, Splunk 2020-08-04 2026-05-13 c5c622e4-d073-11ea-87d0-0242ac130003
- Dfsvc.EXE Initiated Network Connection Over Uncommon Port
Detects an initiated network connection over uncommon ports from "dfsvc.exe". (...)
Hunting test network_connection windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2023-06-12 2024-01-31 4c5fba4a-9ef6-4f16-823d-606246054741
1 Dfsvc.EXE Network Connection To Non-Local IPs
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
Hunting test network_connection windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2023-06-12 2024-03-12 3c21219b-49b5-4268-bce6-c914ed50f09c
1 DirLister Execution
Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2022-08-20 2023-02-04 b4dc61f5-6cce-468e-a608-b48b469feaa2
2 DotNET Assembly DLL Loaded Via Office Application
Detects any assembly DLL being loaded by an Office Product
Generic test image_load windows Sysmon - Antonlovesdnb 2020-02-19 2023-03-29 ff0f2b05-09db-4095-b96d-1b75ca24894a
1 Download From Suspicious TLD - Blacklist
Detects download of certain file types from hosts in suspicious TLDs
Generic test proxy - - - Florian Roth (Nextron Systems) 2017-11-07 2023-05-18 00d0b5ab-1f55-4120-8e83-487c0a7baf19
4 Download From Suspicious TLD - Whitelist
Detects executable downloads from suspicious remote systems
Generic test proxy - - - Florian Roth (Nextron Systems) 2017-03-13 2023-05-18 b5de2919-b74a-4805-91a7-5049accbaefe
1 Splunk
Drop IcedID License dat
The following analytic detects the dropping of a suspicious file named "license.dat" in %appdata% or %programdata%. (...)
Hunting stable file_event windows Sysmon - Teoderick Contreras, Splunk 2021-08-05 2026-05-13 b7a045fc-f14a-11eb-8e79-acde48001122
1 Droppers Exploiting CVE-2017-11882
Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.ex (...)
Emerging stable process_creation windows Sysmon · WinEventLog Security Florian Roth (Nextron Systems) 2017-11-23 2021-11-27 678eb5f4-8597-4be6-8be7-905e4234b53a
3 DumpMinitool Execution
Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of t (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) 2022-04-06 2023-04-12 dee0a7a3-f200-4112-a99b-952196d81e42
4 Splunk
Executables Or Script Creation In Suspicious Path
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. (...)
Anomaly stable file_event windows Sysmon - Teoderick Contreras, Splunk 2021-05-07 2026-08-14 a7e3f0f0-ae42-11eb-b245-acde48001122
4 Splunk
Executables Or Script Creation In Temp Path
The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. (...)
Anomaly stable file_event windows Sysmon - Teoderick Contreras, Splunk 2021-05-07 2026-08-14 e0422b71-2c05-4f32-8754-01fb415f49c9
4 Exploit for CVE-2017-0261
Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and C (...)
Emerging test process_creation windows Sysmon · WinEventLog Security Florian Roth (Nextron Systems) 2018-02-22 2021-11-27 864403a1-36c9-40a2-a982-4c9a45f7d833
1 Exploit for CVE-2017-8759
Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759
Emerging test process_creation windows Sysmon · WinEventLog Security Florian Roth (Nextron Systems) 2017-09-15 2021-11-27 fdd84c68-a1f6-47c9-9477-920584f94905
2 Exploitation Activity of CVE-2025-59287 - WSUS Deserialization
Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS.
Emerging experimental - windows WinEventLog Application Swachchhanda Shrawan Poudel (Nextron Systems) 2025-10-31 — e5f66e87-7d6b-404f-92fe-7aa67814b5cd
4 Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process
Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. (...)
Emerging experimental process_creation windows Sysmon · WinEventLog Security Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems) 2025-10-31 — 43259cc4-1b80-4931-bd98-baea01afc196
3 Explorer Process Tree Break
Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries,
whic (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber 2019-06-29 2025-10-31 949f1ffb-6e85-4f00-ae1e-c3c5b190d605
4 External Disk Drive Or USB Storage Device Was Recognized By The System
Detects external disk drives or plugged-in USB devices.
Generic test - windows WinEventLog Security - Keith Wright 2019-11-20 2024-02-09 f69a87ea-955e-4fb4-adb2-bb9fd6685632
1 File and Directory Discovery - Linux
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.
Generic test process_creation linux Sysmon - Daniil Yugoslavskiy, oscd.community, CheraghiMilad 2020-10-19 2024-12-01 d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
1