Access To .Reg/.Hive Files By Uncommon Applications
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.
Hunting test file_access windows - - frack113 2023-09-15 2024-07-29 337a31c6-46c4-46be-886a-260d7aa78cac
1 Activate Suppression of Windows Security Center Notifications
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 0c93308a-3f1b-40a9-b649-57ea1a1c1d63
1 AD Object WriteDAC Access
Detects WRITE_DAC access to a domain object
Generic test account_management windows WinEventLog Security - Roberto Rodriguez @Cyb3rWard0g 2019-09-12 2021-11-27 028c7842-4243-41cd-be6f-12f3cf1a26c7
3 Add DisallowRun Execution to Registry
Detect set DisallowRun to 1 to prevent user running specific computer program
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 275641a5-a492-45e2-a817-7c81e9d9d3e9
1 Splunk
Advanced IP or Port Scanner Execution
The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)
Anomaly stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Nasreddine Bencherchali, Splunk 2025-10-24 2026-05-13 9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
5 All Backups Deleted Via Wbadmin.EXE
Detects the deletion of all backups or system state backups via "wbadmin.exe". (...)
Generic test process_creation windows Sysmon · WinEventLog Security - frack113, Nasreddine Bencherchali (Nextron Systems) 2021-12-13 2024-05-10 639c9081-f482-47d3-a0bd-ddee3d4ecd76
6 Allow RDP Remote Assistance Feature
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
1 Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-02-28 2025-10-22 6c8fbee5-dee8-49bc-851d-c3142d02aa47
3 Always Install Elevated MSI Spawned Cmd And Powershell
Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"
Generic test process_creation windows Sysmon · WinEventLog Security - Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community 2020-10-13 2022-10-20 1e53dd56-8d83-4eb4-a43e-b790a05510aa
1 Always Install Elevated Parent Child Correlated
This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe (...)
Unsupported unsupported process_creation windows Sysmon · WinEventLog Security - Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community 2020-10-13 — 078235c5-6ec5-48e7-94b2-f8b5474379ea
1 Always Install Elevated Windows Installer
Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege
Generic test process_creation windows Sysmon · WinEventLog Security - Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community 2020-10-13 2024-12-01 cd951fdc-4b2f-47f5-ba99-a33bf61e3770
1 Amsi.DLL Load By Uncommon Process
Detects loading of Amsi.dll by uncommon processes
Hunting test image_load windows Sysmon - frack113 2023-03-12 2026-06-29 facd1549-e416-48e0-b8c4-41d7215eedc8
3 Antivirus - Ransomware Signature
Detects a highly relevant Antivirus alert that reports ransomware. (...)
Generic test antivirus - - - Florian Roth (Nextron Systems), Arnim Rupp 2022-05-12 2026-06-15 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
7 AppLocker Application Would Have Been Blocked
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Generic experimental - windows AppLocker - heyyanu 2026-03-26 — 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
4 AppLocker Prevented Application or Script from Running
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Generic test - windows AppLocker - Pushkarev Dmitry 2020-06-28 2025-12-03 401e5d00-b944-11ea-8f9a-00163ecd60ae
3 APT27 - Emissary Panda Activity
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2018-09-03 2023-03-09 9aa01d62-7667-4d3b-acb8-8cb5103e2014
3 APT29 Google Update Service Install
This method detects malicious services mentioned in APT29 report by FireEye. (...)
Unsupported unsupported process_creation windows WinEventLog System - Thomas Patzke 2017-11-01 2022-03-21 c069f460-2b87-4010-8dcf-e45bab362624
1 Aruba Network Service Potential DLL Sideloading
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...)
Generic test image_load windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2023-01-22 2023-03-15 90ae0469-0cee-4509-b67f-e5efcef040f7
1 Splunk
ASL AWS Detect Users creating keys with encrypt policy without MFA
The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2020-10-27 2026-05-13 16ae9076-d1d5-411c-8fdd-457504b33dac
3 Splunk
ASL AWS Disable Bucket Versioning
The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)
Anomaly stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2022-10-04 2026-05-13 f32598bb-fa5f-4afd-8ab3-0263cc28efbc
2 Atomic MacOS Stealer - Persistence Indicators
Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. (...)
Emerging experimental file_event macos - - Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital) 2025-11-22 — e710a880-1f18-4417-b6a0-b5afdf7e3023
2 Automated Turla Group Lateral Movement
Detects automated lateral movement by Turla group
Unsupported unsupported process_creation windows Sysmon · WinEventLog Security - Markus Neis 2017-11-07 2023-02-24 75925535-ca97-4e0a-a850-00b5c00779dc
1 Splunk
AWS Detect Users creating keys with encrypt policy without MFA
The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Rod Soto, Patrick Bareiss Splunk 2020-10-27 2026-05-13 c79c164f-4b21-4847-98f9-cf6a9f49179e
3 Splunk
AWS Detect Users with KMS keys performing encryption S3
The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...)
Anomaly stable cloud_audit - AWS CloudTrail · AWS - Rod Soto, Patrick Bareiss Splunk 2020-10-27 2026-05-13 884a5f59-eec7-4f4a-948b-dbde18225fdc
3 Splunk
AWS Disable Bucket Versioning
The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)
Anomaly stable cloud_audit - AWS CloudTrail · AWS - Bhavin Patel, Splunk 2023-05-01 2026-05-13 657902a9-987d-4879-a1b2-e7a65512824b
2 AWS EC2 Disable EBS Encryption
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Sittikorn S 2021-06-29 2021-08-20 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
1 AWS EC2 Startup Shell Script Change
Detects changes to the EC2 instance startup script. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - faloker 2020-02-12 2022-06-07 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
1 AWS KMS Imported Key Material Usage
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - toopricey 2025-10-18 — 1279262f-1464-422f-ac0d-5b545320c526
3 AWS S3 Bucket Versioning Disable
Detects when S3 bucket versioning is disabled. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - Sean Johnstone | Unit 42 2023-10-28 — a136ac98-b2bc-4189-a14d-f0d0388e57a7
1 Axios NPM Compromise Indicators - Windows
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)
Emerging experimental process_creation windows Sysmon · WinEventLog Security - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — f6c27ecc-d890-4452-80e6-2e274a10e097
5 Azure AD Health Monitoring Agent Registry Keys Access
This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...)
Generic test - windows WinEventLog Security - Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC 2021-08-26 2022-10-09 ff151c33-45fa-475d-af4f-c2f93571f4fe
2 Azure AD Health Service Agents Registry Keys Access
This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...)
Generic test - windows WinEventLog Security - Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC 2021-08-26 2022-10-09 1d2ab8ac-1a01-423b-9c39-001510eae8e8
2 Backup Files Deleted
Detects deletion of files with extensions often used for backup files. (...)
Generic test file_delete windows Sysmon - frack113 2022-01-02 2023-02-15 06125661-3814-4e03-bfa2-1e4411c60ac3
1 Base64 Encoded PowerShell Command Detected
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2020-01-29 2023-01-26 e32d4572-9826-4738-b651-95fa63747e8a
1 Splunk
Bcdedit Command Back To Normal Mode Boot
The following analytic detects the execution of a suspicious `bcdedit` command that reconfigures a host from safe mode back to normal boot. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Teoderick Contreras, Splunk 2021-09-07 2026-05-13 dc7a8004-0f18-11ec-8c54-acde48001122
1 Splunk
BCDEdit Failure Recovery Modification
The following analytic detects modifications to the Windows error recovery boot configurations using bcdedit.exe with flags such as "recoveryenabled" and "no". (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Michael Haag, Splunk 2021-01-11 2026-10-02 809b31d2-5462-11eb-ae93-0242ac130002
2 Blackbyte Ransomware Registry
Detects specific windows registry modifications made by BlackByte ransomware variants. (...)
Emerging test registry_set windows Sysmon · WinEventLog Security - frack113 2022-01-24 2025-10-21 83314318-052a-4c90-a1ad-660ece38d276
2 Blue Mockingbird
Attempts to detect system changes made by Blue Mockingbird
Emerging test process_creation windows Sysmon · WinEventLog Security - Trent Liffick (@tliffick) 2020-05-14 2022-10-09 c3198a27-23a0-4c2c-af19-e5328d49680e
1 Blue Mockingbird - Registry
Attempts to detect system changes made by Blue Mockingbird
Emerging test registry_set windows Sysmon · WinEventLog Security - Trent Liffick (@tliffick) 2020-05-14 2023-08-17 92b0b372-a939-44ed-a11b-5136cf680e27
1 BlueSky Ransomware Artefacts
Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.
Emerging test file_event windows WinEventLog Security - j4son 2023-05-23 — eee8311f-a752-44f0-bf2f-6b007db16300
1 Boot Configuration Tampering Via Bcdedit.EXE
Detects the use of the bcdedit command to tamper with the boot configuration data. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security - E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community 2019-10-24 2023-02-15 1444443e-6757-43e4-9ea4-c8fc705f79a2
2 BPFDoor Abnormal Process ID or Lock File Accessed
detects BPFDoor .lock and .pid files access in temporary file storage facility
Generic test file_event linux Linux Auditd - Rafal Piasecki 2022-08-10 2026-03-30 808146b2-9332-4d78-9416-d7e47012d83d
4 Bypass UAC Using DelegateExecute
Bypasses User Account Control using a fileless method
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-01-05 2023-08-17 46dd5308-4572-4d12-aa43-8938f0184d4f
3 Bypass UAC Using SilentCleanup Task
Detects the setting of the environement variable "windir" to a non default value. (...)
Generic test registry_set windows Sysmon · WinEventLog Security - frack113, Nextron Systems 2022-01-06 2024-01-30 724ea201-6514-4f38-9739-e5973c34f49a
3 Bypass UAC via CMSTP
Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install sp (...)
Generic test process_creation windows Sysmon · WinEventLog Security - E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community 2019-10-24 2022-08-30 e66779cc-383e-4224-a3a4-267eeb585c40
3 Bypass UAC via Fodhelper.exe
Identifies use of Fodhelper.exe to bypass User Account Control. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community 2019-10-24 2021-11-27 7f741dcf-fc22-4759-87b4-9ae8376676a2
2 Bypass UAC via WSReset.exe
Detects use of WSReset.exe to bypass User Account Control (UAC). (...)
Generic test process_creation windows Sysmon · WinEventLog Security - E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth 2019-10-24 2022-05-13 d797268e-28a9-49a7-b9a8-2f5039011c5c
4 Capabilities Discovery - Linux
Detects usage of "getcap" binary. (...)
Generic test process_creation linux Sysmon - Nasreddine Bencherchali (Nextron Systems) 2022-12-28 2026-01-24 d8d97d51-122d-4cdd-9e2f-01b4b4933530
3 Splunk
CertUtil With Decode Argument
The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Michael Haag, Splunk 2021-03-25 2026-10-02 bfe94226-8c10-11eb-a4b3-acde48001122
5 Change the Fax Dll
Detect possible persistence using Fax DLL load when service restart
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-07-17 2022-12-30 9e3357ba-09d4-4fbd-a7c5-ad6386314513
2