Access To .Reg/.Hive Files By Uncommon Applications
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.
Hunting test file_access windows - - frack113 2023-09-15 2024-07-29 337a31c6-46c4-46be-886a-260d7aa78cac
1 Access To Browser Credential Files By Uncommon Applications - Security
Detects file access requests to browser credential stores by uncommon processes. (...)
Hunting test file_event windows WinEventLog Security - Daniel Koifman (@Koifsec), Nasreddine Bencherchali 2024-10-21 — 4b60e527-ec73-4b47-8cb3-f02ad927ca65
1 Access to Browser Login Data
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)
Generic test ps_script windows PowerShell - frack113 2022-01-30 — fc028194-969d-4122-8abe-0470d5b8f12f
1 Account Lockout
Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.
Generic test authentication - Azure Sign-in Logs · Azure - AlertIQ 2021-10-10 2022-12-25 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a
1 Activate Suppression of Windows Security Center Notifications
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 0c93308a-3f1b-40a9-b649-57ea1a1c1d63
1 Active Directory Computers Enumeration With Get-AdComputer
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
Generic test ps_script windows PowerShell - frack113 2022-03-17 2023-07-08 36bed6b2-e9a0-4fff-beeb-413a92b86138
3 Active Directory Database Snapshot Via ADExplorer
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-03-14 2025-07-09 9212f354-7775-4e28-9c9f-8f0a4544e664
6 Splunk
Active Directory Lateral Movement Identified
The following analytic identifies potential lateral movement activities within an organization's Active Directory (AD) environment. (...)
Correlation stable - - - - Michael Haag, Splunk 2023-04-19 2026-05-13 6aa6f9dd-adfe-45a8-8f74-c4c7a0d7d037
2 AD Groups Or Users Enumeration Using PowerShell - PoshModule
Adversaries may attempt to find domain-level groups and permission settings. (...)
Generic test ps_module windows PowerShell - frack113 2021-12-15 2023-01-20 815bfc17-7fc6-4908-a55e-2f37b98cedb4
1 AD Groups Or Users Enumeration Using PowerShell - ScriptBlock
Adversaries may attempt to find domain-level groups and permission settings. (...)
Generic test ps_script windows PowerShell - frack113 2021-12-15 2022-12-25 88f0884b-331d-403d-a3a1-b668cf035603
1 Add DisallowRun Execution to Registry
Detect set DisallowRun to 1 to prevent user running specific computer program
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 275641a5-a492-45e2-a817-7c81e9d9d3e9
1 Splunk
Add or Set Windows Defender Exclusion
The following analytic detects the use of commands to add or set exclusions
in Windows Defender. It (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Teoderick Contreras, Nasreddine Bencherchali, Splunk 2021-11-25 2026-06-08 773b66fe-4dd9-11ec-8289-acde48001122
4 Add SafeBoot Keys Via Reg Utility
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2022-09-02 2024-03-19 d7662ff6-9e97-4596-a61d-9839e32dee8d
1 ADExplorer Writing Complete AD Snapshot Into .dat File
Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)
Generic experimental file_event windows Sysmon - Arnim Rupp (Nextron Systems), Thomas Patzke 2025-07-09 — 0a1255c5-d732-4b62-ac02-b5152d34fb83
5 ADFS Database Named Pipe Connection By Uncommon Tool
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)
Generic test pipe_created windows Sysmon - Roberto Rodriguez @Cyb3rWard0g 2021-10-08 2023-11-30 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
3 ADS Zone.Identifier Deleted
Detects the deletion of the "Zone.Identifier" ADS. (...)
Hunting test file_delete windows Sysmon - frack113 2023-09-04 — 7eac0a16-5832-4e81-865f-0268a6d19e4b
1 ADS Zone.Identifier Deleted By Uncommon Application
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)
Generic test file_delete windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2023-09-04 2025-07-04 3109530e-ab47-4cc6-a953-cac5ebcc93ae
2 Splunk
Advanced IP or Port Scanner Execution
The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)
Anomaly stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Nasreddine Bencherchali, Splunk 2025-10-24 2026-05-13 9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
5 Adwind RAT / JRAT
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community 2017-11-10 2022-10-09 1fac1481-2dbc-48b2-9096-753c49b4ec71
2 Adwind RAT / JRAT File Artifact
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Generic test file_event windows Sysmon - Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community 2017-11-10 2022-12-02 0bcfabcb-7929-47f4-93d6-b33fb67d34d1
2 Allow RDP Remote Assistance Feature
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
1 Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-02-28 2025-10-22 6c8fbee5-dee8-49bc-851d-c3142d02aa47
3 Alternate PowerShell Hosts - PowerShell Module
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test ps_module windows PowerShell - Roberto Rodriguez @Cyb3rWard0g 2019-08-11 2025-10-17 64e8e417-c19a-475a-8d19-98ea705394cc
1 Alternate PowerShell Hosts Pipe
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test pipe_created windows Sysmon - Roberto Rodriguez @Cyb3rWard0g, Tim Shelton 2019-09-12 2025-10-07 58cb02d5-78ce-4692-b3e1-dce850aae41a
2 AMSI Bypass Pattern Assembly GetType
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts
Generic test ps_script windows PowerShell - Florian Roth (Nextron Systems) 2022-11-09 — e0d6c087-2d1c-47fd-8799-3904103c5a98
2 AMSI Disabled via Registry Modification
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...)
Generic experimental registry_set windows Sysmon · WinEventLog Security - Swachchhanda Shrawan Poudel (Nextron Systems) 2025-12-25 — aa37cbb0-da36-42cb-a90f-fdf216fc7467
3 Antivirus Filter Driver Disallowed On Dev Drive - Registry
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".
Generic test registry_set windows Sysmon · WinEventLog Security - @kostastsale, Nasreddine Bencherchali (Nextron Systems) 2023-11-05 2024-08-16 31e124fb-5dc4-42a0-83b3-44a69c77b271
1 Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection
Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .
Emerging stable antivirus - - Sittikorn S, Nuttakorn T, Tim Shelton 2021-07-01 2023-10-23 6fe1719e-ecdf-4caf-bffe-4f501cb0a561
3 Apache Threading Error
Detects an issue in apache logs that reports threading related errors
Generic test - - Apache - Florian Roth (Nextron Systems) 2019-01-22 2021-11-27 e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
1 Application Removed Via Wmic.EXE
Detects the removal or uninstallation of an application via "Wmic.EXE".
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2022-01-28 2024-07-02 b53317a0-8acf-4fd1-8de8-a5401e776b96
1 Application Termination Attempt via Wmic.EXE
Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-09-11 — 49d9671b-0a0a-4c09-8280-d215bfd30662
2 AppLocker Application Would Have Been Blocked
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Generic experimental - windows AppLocker - heyyanu 2026-03-26 — 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
4 AppLocker Prevented Application or Script from Running
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Generic test - windows AppLocker - Pushkarev Dmitry 2020-06-28 2025-12-03 401e5d00-b944-11ea-8f9a-00163ecd60ae
3 AppX Package Installation Attempts Via AppInstaller.EXE
Detects DNS queries made by "AppInstaller.EXE". (...)
Generic test dns windows Sysmon - frack113 2021-11-24 2023-11-09 7cff77e1-9663-46a3-8260-17f2e1aa9d0a
2 APT PRIVATELOG Image Load Pattern
Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under (...)
Emerging test image_load windows Sysmon - Florian Roth (Nextron Systems) 2021-09-07 2022-10-09 33a2d1dd-f3b0-40bd-8baf-7974468927cc
1 APT User Agent
Detects suspicious user agent strings used in APT malware in proxy logs
Generic test proxy - - - Florian Roth (Nextron Systems), Markus Neis 2019-11-12 2024-02-15 6ec820f2-e963-4801-9127-d8b2dce4d31b
1 APT27 - Emissary Panda Activity
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2018-09-03 2023-03-09 9aa01d62-7667-4d3b-acb8-8cb5103e2014
3 APT29 2018 Phishing Campaign CommandLine Indicators
Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant
Emerging stable process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), @41thexplorer 2018-11-20 2023-03-08 7453575c-a747-40b9-839b-125a0aae324b
3 APT29 2018 Phishing Campaign File Indicators
Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant
Emerging stable file_event windows Sysmon - @41thexplorer 2018-11-20 2023-02-20 3a3f81ca-652c-482b-adeb-b1c804727f74
2 APT29 Google Update Service Install
This method detects malicious services mentioned in APT29 report by FireEye. (...)
Unsupported unsupported process_creation windows WinEventLog System - Thomas Patzke 2017-11-01 2022-03-21 c069f460-2b87-4010-8dcf-e45bab362624
1 APT40 Dropbox Tool User Agent
Detects suspicious user agent string of APT40 Dropbox tool
Emerging test proxy - - - Thomas Patzke 2019-11-12 2023-05-18 5ba715b6-71b7-44fd-8245-f66893e81b3d
1 Arbitrary File Download Via GfxDownloadWrapper.EXE
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.
Generic test process_creation windows Sysmon · WinEventLog Security - Victor Sergeev, oscd.community 2020-10-09 2023-10-18 eee00933-a761-4cd0-be70-c42fe91731e7
1 Arbitrary Shell Command Execution Via Settingcontent-Ms
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Sreeman 2020-03-13 2022-04-14 24de4f3b-804c-4165-b442-5a06a2302c7e
1 Aruba Network Service Potential DLL Sideloading
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...)
Generic test image_load windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2023-01-22 2023-03-15 90ae0469-0cee-4509-b67f-e5efcef040f7
1 Splunk
ASL AWS Concurrent Sessions From Different Ips
The following analytic identifies an AWS IAM account with concurrent sessions originating from more than one unique IP address within a 5-minute span. (...)
Anomaly stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2023-02-01 2026-05-13 b3424bbe-3204-4469-887b-ec144483a336
3 Splunk
ASL AWS Credential Access RDS Password reset
The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2022-08-07 2026-05-13 d15e9bd9-ef64-4d84-bc04-f62955a9fee8
1 Splunk
ASL AWS IAM Assume Role Policy Brute Force
The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Patrick Bareiss, Splunk 2022-10-04 2026-05-13 726959fe-316d-445c-a584-fa187d64e295
3 ASLR Disabled Via Sysctl or Direct Syscall - Linux
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use (...)
Generic experimental process_creation linux Linux Auditd - Milad Cheraghi 2025-05-26 2025-12-05 e497a24e-9345-4a62-9803-b06d7d7cb132
4 Atomic MacOS Stealer - Persistence Indicators
Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. (...)
Emerging experimental file_event macos - - Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital) 2025-11-22 — e710a880-1f18-4417-b6a0-b5afdf7e3023
2 Audit CVE Event
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)
Generic test - windows WinEventLog Application Florian Roth (Nextron Systems), Zach Mathis 2020-01-15 2022-10-22 48d91a3a-2363-43ba-a456-ca71ac3da5c2
5