ADS Zone.Identifier Deleted
Detects the deletion of the "Zone.Identifier" ADS. (...)
Hunting test file_delete windows Sysmon - frack113 2023-09-04 — 7eac0a16-5832-4e81-865f-0268a6d19e4b
1 ADS Zone.Identifier Deleted By Uncommon Application
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)
Generic test file_delete windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2023-09-04 2025-07-04 3109530e-ab47-4cc6-a953-cac5ebcc93ae
2 Antivirus - Ransomware Signature
Detects a highly relevant Antivirus alert that reports ransomware. (...)
Generic test antivirus - - - Florian Roth (Nextron Systems), Arnim Rupp 2022-05-12 2026-06-15 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
7 AppLocker Application Would Have Been Blocked
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Generic experimental - windows AppLocker - heyyanu 2026-03-26 — 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
4 AppLocker Prevented Application or Script from Running
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Generic test - windows AppLocker - Pushkarev Dmitry 2020-06-28 2025-12-03 401e5d00-b944-11ea-8f9a-00163ecd60ae
3 Splunk
ASL AWS Detect Users creating keys with encrypt policy without MFA
The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2020-10-27 2026-05-13 16ae9076-d1d5-411c-8fdd-457504b33dac
3 Splunk
AWS Detect Users creating keys with encrypt policy without MFA
The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Rod Soto, Patrick Bareiss Splunk 2020-10-27 2026-05-13 c79c164f-4b21-4847-98f9-cf6a9f49179e
3 Splunk
AWS Detect Users with KMS keys performing encryption S3
The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...)
Anomaly stable cloud_audit - AWS CloudTrail · AWS - Rod Soto, Patrick Bareiss Splunk 2020-10-27 2026-05-13 884a5f59-eec7-4f4a-948b-dbde18225fdc
3 AWS EC2 Disable EBS Encryption
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Sittikorn S 2021-06-29 2021-08-20 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
1 AWS EC2 Startup Shell Script Change
Detects changes to the EC2 instance startup script. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - faloker 2020-02-12 2022-06-07 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
1 AWS KMS Imported Key Material Usage
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - toopricey 2025-10-18 — 1279262f-1464-422f-ac0d-5b545320c526
3 Axios NPM Compromise Indicators - Windows
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)
Emerging experimental process_creation windows Sysmon · WinEventLog Security - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — f6c27ecc-d890-4452-80e6-2e274a10e097
5 Backup Catalog Deleted
Detects backup catalog deletions
Generic test - windows WinEventLog Application - Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) 2017-05-12 2022-12-25 9703792d-fd9a-456d-a672-ff92efe4806a
2 BlueSky Ransomware Artefacts
Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.
Emerging test file_event windows WinEventLog Security - j4son 2023-05-23 — eee8311f-a752-44f0-bf2f-6b007db16300
1 Cisco File Deletion
See what files are being deleted from flash file systems
Generic test authentication - Cisco AAA · Cisco - Austin Clark 2019-08-12 2023-01-04 71d65515-c436-43c0-841b-236b1f32c21e
- Splunk
Clear Unallocated Sector Using Cipher App
The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Teoderick Contreras, Splunk 2021-06-10 2026-05-13 cd80a6ac-c9d9-11eb-8839-acde48001122
2 Splunk
CMD Carry Out String Command Parameter
The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...)
Hunting stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike Teoderick Contreras, Bhavin Patel, Splunk 2021-10-21 2026-05-13 54a6ed00-3256-11ec-b031-acde48001122
2 Splunk
CMD Echo Pipe - Escalation
The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Michael Haag, Splunk 2021-05-27 2026-05-13 eb277ba0-b96b-11eb-b00e-acde48001122
2 Command Line Execution with Suspicious URL and AppData Strings
Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community 2019-01-16 2021-11-27 1ac8666b-046f-4201-8aba-1951aaec03a3
2 Conhost.exe CommandLine Path Traversal
detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2022-06-14 — ee5e119b-1f75-4b34-add8-3be976961e39
1 Splunk
CrushFTP Authentication Bypass Exploitation
The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)
Generic stable file_event - CrushFTP Michael Haag, Splunk 2025-04-14 2026-09-08 82eb7f64-d219-4e21-acfe-956de84c1a35
3 Splunk
Detect Prohibited Applications Spawning cmd exe
The following analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. (...)
Hunting stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Bhavin Patel, Splunk 2020-04-29 2026-05-13 dcfd6b40-42f9-469d-a433-2e53f7486664
- Splunk
Detect Use of cmd exe to Launch Script Interpreters
The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. (...)
Anomaly stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Bhavin Patel, Mauricio Velazco, Splunk 2020-04-29 2026-05-13 b89919ed-fe5f-492c-b139-95dbb162039e
2 Directory Removal Via Rmdir
Detects execution of the builtin "rmdir" command in order to delete directories. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2022-01-15 2023-03-07 41ca393d-538c-408a-ac27-cf1e038be80c
2 DNS Query by Finger Utility
Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. (...)
Generic experimental dns windows Sysmon - Swachchhanda Shrawan Poudel (Nextron Systems) 2025-11-19 — c082c2b0-525b-4dbc-9a26-a57dc4692074
1 Elise Backdoor Activity
Detects Elise backdoor activity used by APT32
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) 2018-01-31 2023-03-09 e507feb7-5f73-4ef6-a970-91bb6f6d744f
2 Exploited CVE-2020-10189 Zoho ManageEngine
Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability rep (...)
Emerging test process_creation windows Sysmon · WinEventLog Security Florian Roth (Nextron Systems) 2020-03-25 2023-01-21 846b866e-2a57-46ee-8e16-85fa92759be7
2 Exploiting SetupComplete.cmd CVE-2019-1378
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and Partner (...)
Emerging test process_creation windows Sysmon · WinEventLog Security Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro 2019-11-15 2021-11-27 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
1 File Deleted Via Sysinternals SDelete
Detects the deletion of files by the Sysinternals SDelete utility. (...)
Generic test file_delete windows Sysmon - Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) 2020-05-02 2023-02-15 6ddab845-b1b8-49c2-bbf7-1a11967f64bc
2 File Deletion
Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries t (...)
Generic stable process_creation linux Sysmon - Ömer Günal, oscd.community 2020-10-07 2022-09-15 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57
1 File Deletion Via Del
Detects execution of the builtin "del"/"erase" commands in order to delete files. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2022-01-15 2024-03-05 379fa130-190e-4c3f-b7bc-6c8e834485f3
2 FunkLocker Ransomware File Creation
Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.
Emerging experimental file_event windows Sysmon - Saiprashanth Pulisetti ( @Prashanthblogs) 2025-08-08 — 2c76a22b-702d-48fd-8fa9-e41e2fe203b3
2 Greedy File Deletion Using Del
Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 , X__Junior (Nextron Systems) 2021-12-02 2023-09-11 204b17ae-4007-471b-917b-b917b315c5db
2 HackTool - CrackMapExec Execution
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2022-02-25 2023-03-08 42a993dd-bb3e-48c8-b372-4d6684c4106c
4 HackTool - CrackMapExec Execution Patterns
Detects various execution patterns of the CrackMapExec pentesting framework
Generic stable process_creation windows Sysmon · WinEventLog Security - Thomas Patzke 2020-05-22 2023-11-06 058f4380-962d-40a5-afce-50207d36d7e2
1 HackTool - Jlaive In-Memory Assembly Execution
Detects the use of Jlaive to execute assemblies in a copied PowerShell
Generic test process_creation windows Sysmon · WinEventLog Security - Jose Luis Sanchez Martinez (@Joseliyo_Jstnk) 2022-05-24 2023-02-22 0a99eb3e-1617-41bd-b095-13dc767f3def
2 HackTool - Koadic Execution
Detects command line parameters used by Koadic hack tool
Generic test process_creation windows Sysmon · WinEventLog Security - wagga, Jonhnathan Ribeiro, oscd.community 2020-01-12 2023-02-11 5cddf373-ef00-4112-ad72-960ac29bac34
3 HackTool - RedMimicry Winnti Playbook Execution
Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
Generic test process_creation windows Sysmon · WinEventLog Security - Alexander Rausch 2020-06-24 2023-03-01 95022b85-ff2a-49fa-939a-d7b8f56eeb9b
1 Headless Process Launched Via Conhost.EXE
Detects the launch of a child process via "conhost.exe" with the "--headless" flag. (...)
Hunting test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2024-07-23 — 00ca75ab-d5ce-43be-b86c-55ff39c6abfc
1 Splunk
High Process Termination Frequency
The following analytic identifies a high frequency of process termination events on a computer within a short period. (...)
Anomaly stable process_creation windows Sysmon - Teoderick Contreras 2021-03-19 2026-05-13 17cd75b2-8666-11eb-9ab4-acde48001122
2 HTML Help HH.EXE Suspicious Child Process
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Generic test process_creation windows Sysmon · WinEventLog Security - Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) 2020-04-01 2023-04-12 52cad028-0ff0-4854-8f67-d25dfcbc78b4
4 Splunk
Linux Account Manipulation Of SSH Config and Keys
The following analytic detects the deletion of SSH keys on a Linux machine. (...)
Anomaly stable file_event linux Sysmon - Teoderick Contreras, Splunk 2022-04-12 2026-05-13 73a56508-1cf5-4df7-b8d9-5737fbdc27d2
1 Splunk
Linux Deletion Of Cron Jobs
The following analytic detects the deletion of cron jobs on a Linux machine. (...)
Anomaly stable file_event linux Sysmon - Teoderick Contreras, Splunk 2022-04-12 2026-05-13 3b132a71-9335-4f33-9932-00bb4f6ac7e8
1 Splunk
Linux Deletion Of Init Daemon Script
The following analytic detects the deletion of init daemon scripts on a Linux machine. (...)
Generic stable file_event linux Sysmon - Teoderick Contreras, Splunk 2022-04-12 2026-05-13 729aab57-d26f-4156-b97f-ab8dda8f44b1
1 Splunk
Linux Deletion Of Services
The following analytic detects the deletion of services on a Linux machine. (...)
Generic stable file_event linux Sysmon - Teoderick Contreras, Splunk 2022-04-12 2026-05-13 b509bbd3-0331-4aaa-8e4a-d2affe100af6
3 Splunk
Linux Deletion of SSL Certificate
The following analytic detects the deletion of SSL certificates on a Linux machine. (...)
Anomaly stable file_event linux Sysmon - Teoderick Contreras, Splunk 2022-04-12 2026-05-13 839ab790-a60a-4f81-bfb3-02567063f615
1 Splunk
Linux High Frequency Of File Deletion In Boot Folder
The following analytic detects a high frequency of file deletions in the /boot/ folder on Linux systems. (...)
Generic stable file_event linux Sysmon - Teoderick Contreras, Splunk 2022-04-12 2026-05-13 e27fbc5d-0445-4c4a-bc39-87f060d5c602
2 Splunk
Linux High Frequency Of File Deletion In Etc Folder
The following analytic detects a high frequency of file deletions in the /etc/ folder on Linux systems. (...)
Anomaly stable file_event linux Sysmon - Teoderick Contreras, Splunk 2022-04-12 2026-05-13 9d867448-2aff-4d07-876c-89409a752ff8
1 Splunk
Linux Indicator Removal Service File Deletion
The following analytic detects the deletion of Linux service unit configuration files by suspicious processes. (...)
Anomaly stable process_creation linux Sysmon - Teoderick Contreras, Splunk 2023-02-08 2026-05-13 6c077f81-2a83-4537-afbc-0e62e3215d55
2 Load Of RstrtMgr.DLL By A Suspicious Process
Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. (...)
Generic test image_load windows Sysmon - Luc Génaux 2023-11-28 — b48492dc-c5ef-4572-8dff-32bc241c15c8
4