Active Directory Computers Enumeration With Get-AdComputer
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
Generic test ps_script windows PowerShell - frack113 2022-03-17 2023-07-08 36bed6b2-e9a0-4fff-beeb-413a92b86138
3 Splunk
Active Directory Lateral Movement Identified
The following analytic identifies potential lateral movement activities within an organization's Active Directory (AD) environment. (...)
Correlation stable - - - - Michael Haag, Splunk 2023-04-19 2026-05-13 6aa6f9dd-adfe-45a8-8f74-c4c7a0d7d037
2 AD Object WriteDAC Access
Detects WRITE_DAC access to a domain object
Generic test account_management windows WinEventLog Security - Roberto Rodriguez @Cyb3rWard0g 2019-09-12 2021-11-27 028c7842-4243-41cd-be6f-12f3cf1a26c7
3 All Backups Deleted Via Wbadmin.EXE
Detects the deletion of all backups or system state backups via "wbadmin.exe". (...)
Generic test process_creation windows Sysmon · WinEventLog Security - frack113, Nasreddine Bencherchali (Nextron Systems) 2021-12-13 2024-05-10 639c9081-f482-47d3-a0bd-ddee3d4ecd76
6 Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-02-28 2025-10-22 6c8fbee5-dee8-49bc-851d-c3142d02aa47
3 Amsi.DLL Load By Uncommon Process
Detects loading of Amsi.dll by uncommon processes
Hunting test image_load windows Sysmon - frack113 2023-03-12 2026-06-29 facd1549-e416-48e0-b8c4-41d7215eedc8
3 Antivirus - Ransomware Signature
Detects a highly relevant Antivirus alert that reports ransomware. (...)
Generic test antivirus - - - Florian Roth (Nextron Systems), Arnim Rupp 2022-05-12 2026-06-15 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
7 Apache Threading Error
Detects an issue in apache logs that reports threading related errors
Generic test - - Apache - Florian Roth (Nextron Systems) 2019-01-22 2021-11-27 e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
1 Application Removed Via Wmic.EXE
Detects the removal or uninstallation of an application via "Wmic.EXE".
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2022-01-28 2024-07-02 b53317a0-8acf-4fd1-8de8-a5401e776b96
1 Application Termination Attempt via Wmic.EXE
Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-09-11 — 49d9671b-0a0a-4c09-8280-d215bfd30662
2 Application Uninstalled
An application has been removed. (...)
Generic test - windows WinEventLog Application - frack113 2022-01-28 2022-09-17 570ae5ec-33dc-427c-b815-db86228ad43e
2 APT29 Google Update Service Install
This method detects malicious services mentioned in APT29 report by FireEye. (...)
Unsupported unsupported process_creation windows WinEventLog System - Thomas Patzke 2017-11-01 2022-03-21 c069f460-2b87-4010-8dcf-e45bab362624
1 Splunk
ASL AWS Detect Users creating keys with encrypt policy without MFA
The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2020-10-27 2026-05-13 16ae9076-d1d5-411c-8fdd-457504b33dac
3 Splunk
ASL AWS Disable Bucket Versioning
The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)
Anomaly stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2022-10-04 2026-05-13 f32598bb-fa5f-4afd-8ab3-0263cc28efbc
2 Atomic MacOS Stealer - Persistence Indicators
Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. (...)
Emerging experimental file_event macos - - Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital) 2025-11-22 — e710a880-1f18-4417-b6a0-b5afdf7e3023
2 Audit CVE Event
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)
Generic test - windows WinEventLog Application Florian Roth (Nextron Systems), Zach Mathis 2020-01-15 2022-10-22 48d91a3a-2363-43ba-a456-ca71ac3da5c2
5 Automated Turla Group Lateral Movement
Detects automated lateral movement by Turla group
Unsupported unsupported process_creation windows Sysmon · WinEventLog Security - Markus Neis 2017-11-07 2023-02-24 75925535-ca97-4e0a-a850-00b5c00779dc
1 Splunk
AWS Detect Users creating keys with encrypt policy without MFA
The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Rod Soto, Patrick Bareiss Splunk 2020-10-27 2026-05-13 c79c164f-4b21-4847-98f9-cf6a9f49179e
3 Splunk
AWS Detect Users with KMS keys performing encryption S3
The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...)
Anomaly stable cloud_audit - AWS CloudTrail · AWS - Rod Soto, Patrick Bareiss Splunk 2020-10-27 2026-05-13 884a5f59-eec7-4f4a-948b-dbde18225fdc
3 Splunk
AWS Disable Bucket Versioning
The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)
Anomaly stable cloud_audit - AWS CloudTrail · AWS - Bhavin Patel, Splunk 2023-05-01 2026-05-13 657902a9-987d-4879-a1b2-e7a65512824b
2 AWS EC2 Disable EBS Encryption
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Sittikorn S 2021-06-29 2021-08-20 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
1 AWS KMS Imported Key Material Usage
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - toopricey 2025-10-18 — 1279262f-1464-422f-ac0d-5b545320c526
3 AWS S3 Bucket Versioning Disable
Detects when S3 bucket versioning is disabled. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - Sean Johnstone | Unit 42 2023-10-28 — a136ac98-b2bc-4189-a14d-f0d0388e57a7
1 Azure Application Deleted
Identifies when a application is deleted in Azure.
Generic test cloud_audit - Azure Audit Logs · Azure - Austin Songer @austinsonger 2021-09-03 2026-04-30 410d2a41-1e6d-452f-85e5-abdd8257a823
3 Azure Container Registry Created or Deleted
Detects when a Container Registry is created or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 93e0ef48-37c8-49ed-a02c-038aab23628e
4 Azure Kubernetes Cluster Created or Deleted
Detects when a Azure Kubernetes Cluster is created or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 9541f321-7cba-4b43-80fc-fbd1fb922808
4 Azure Kubernetes Network Policy Change
Identifies when a Azure Kubernetes network policy is modified or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 08d6ac24-c927-4469-b3b7-2e422d6e3c43
4 Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 25cb259b-bbdc-4b87-98b7-90d7c72f8743
4 Azure Kubernetes Secret or Config Object Access
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
4 Azure Kubernetes Sensitive Role Access
Identifies when ClusterRoles/Roles are being modified or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 818fee0c-e0ec-4e45-824e-83e4817b0887
4 Azure Kubernetes Service Account Modified or Deleted
Identifies when a service account is modified or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 12d027c3-b48c-4d9d-8bb6-a732200034b2
4 Backup Files Deleted
Detects deletion of files with extensions often used for backup files. (...)
Generic test file_delete windows Sysmon - frack113 2022-01-02 2023-02-15 06125661-3814-4e03-bfa2-1e4411c60ac3
1 Splunk
Bcdedit Command Back To Normal Mode Boot
The following analytic detects the execution of a suspicious `bcdedit` command that reconfigures a host from safe mode back to normal boot. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Teoderick Contreras, Splunk 2021-09-07 2026-05-13 dc7a8004-0f18-11ec-8c54-acde48001122
1 Splunk
BCDEdit Failure Recovery Modification
The following analytic detects modifications to the Windows error recovery boot configurations using bcdedit.exe with flags such as "recoveryenabled" and "no". (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Michael Haag, Splunk 2021-01-11 2026-10-02 809b31d2-5462-11eb-ae93-0242ac130002
2 Blue Mockingbird
Attempts to detect system changes made by Blue Mockingbird
Emerging test process_creation windows Sysmon · WinEventLog Security - Trent Liffick (@tliffick) 2020-05-14 2022-10-09 c3198a27-23a0-4c2c-af19-e5328d49680e
1 Blue Mockingbird - Registry
Attempts to detect system changes made by Blue Mockingbird
Emerging test registry_set windows Sysmon · WinEventLog Security - Trent Liffick (@tliffick) 2020-05-14 2023-08-17 92b0b372-a939-44ed-a11b-5136cf680e27
1 BlueSky Ransomware Artefacts
Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.
Emerging test file_event windows WinEventLog Security - j4son 2023-05-23 — eee8311f-a752-44f0-bf2f-6b007db16300
1 Boot Configuration Tampering Via Bcdedit.EXE
Detects the use of the bcdedit command to tamper with the boot configuration data. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security - E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community 2019-10-24 2023-02-15 1444443e-6757-43e4-9ea4-c8fc705f79a2
2 Capabilities Discovery - Linux
Detects usage of "getcap" binary. (...)
Generic test process_creation linux Sysmon - Nasreddine Bencherchali (Nextron Systems) 2022-12-28 2026-01-24 d8d97d51-122d-4cdd-9e2f-01b4b4933530
3 Splunk
Change To Safe Mode With Network Config
The following analytic detects the execution of a suspicious `bcdedit` command that configures a host to boot in safe mode with network support. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Teoderick Contreras, Splunk 2021-09-07 2026-05-13 81f1dce0-0f18-11ec-a5d7-acde48001122
1 Chopper Webshell Process Pattern
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Generic test process_creation windows Sysmon · WinEventLog Security Florian Roth (Nextron Systems), MSTI (query) 2022-10-01 — fa3c117a-bc0d-416e-a31b-0c0e80653efb
1 Cisco Discovery
Find information about network devices that is not stored in config files
Generic test authentication - Cisco AAA · Cisco - Austin Clark 2019-08-12 2023-01-04 9705a6a1-6db6-4a16-a987-15b7151e299b
1 Splunk
Cisco IOS XE Reconnaissance Command Activity
This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)
Anomaly stable network_device - Cisco IOS · Cisco - Nasreddine Bencherchali 2026-05-19 2026-05-20 71ac5328-2364-40cf-8381-92b8dc531399
2 Splunk
Cisco IOS XE Remote Access Probe Burst
This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)
Anomaly stable network_device - Cisco IOS · Cisco - Nasreddine Bencherchali 2026-05-19 2026-05-20 efb20922-17bc-4fb0-880c-be50cfc100dd
2 Cisco Modify Configuration
Modifications to a config that will serve an adversary's impacts or persistence
Generic test authentication - Cisco AAA · Cisco - Austin Clark 2019-08-12 2025-04-28 671ffc77-50a7-464f-9e3d-9ea2b493b26b
- Splunk
Cisco NVM - Suspicious Network Connection to IP Lookup Service API
This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...)
Anomaly stable network_connection - Cisco NVM · Cisco - Nasreddine Bencherchali, Splunk, Janantha Marasinghe 2025-07-01 2026-09-22 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
2 Splunk
Cisco SA - Access to Anonymizer Services
This analytic detects attempts to access proxy-evasion or anonymizer services using Cisco Secure Access DNS and secure web proxy telemetry. (...)
Anomaly stable network_device - Cisco - Mahamudul Chowdhury, Bhavin Patel, Splunk 2026-05-06 2026-06-09 a7c8613a-92e2-4232-b64d-bd39d33dee8b
1 Splunk
Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint
The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...)
Generic stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-03 2026-09-22 c43f7b49-2dab-4e76-892e-7f971c2f20f1
1 Splunk
Cisco Secure Firewall - Blocked Connection
The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-03 2026-05-13 17e9b764-3a2b-4d36-9751-32d13ce4718b
1 Splunk
Cisco Secure Firewall - High EVE Threat Confidence
The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-03 2026-05-13 8c15183e-2e70-4db4-86c3-88f8d9129b66
1