Splunk
Add or Set Windows Defender Exclusion
The following analytic detects the use of commands to add or set exclusions
in Windows Defender. It (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Teoderick Contreras, Nasreddine Bencherchali, Splunk 2021-11-25 2026-06-08 773b66fe-4dd9-11ec-8289-acde48001122
4 Add SafeBoot Keys Via Reg Utility
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2022-09-02 2024-03-19 d7662ff6-9e97-4596-a61d-9839e32dee8d
1 AMSI Bypass Pattern Assembly GetType
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts
Generic test ps_script windows PowerShell - Florian Roth (Nextron Systems) 2022-11-09 — e0d6c087-2d1c-47fd-8799-3904103c5a98
2 AMSI Disabled via Registry Modification
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...)
Generic experimental registry_set windows Sysmon · WinEventLog Security - Swachchhanda Shrawan Poudel (Nextron Systems) 2025-12-25 — aa37cbb0-da36-42cb-a90f-fdf216fc7467
3 Antivirus - Web Shell Detection Signature
Detects a highly relevant Antivirus alert that reports a web shell. (...)
Generic test antivirus - - - Florian Roth (Nextron Systems), Arnim Rupp 2018-09-09 2026-06-29 fdf135a2-9241-4f96-a114-bb404948f736
10 Antivirus Filter Driver Disallowed On Dev Drive - Registry
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".
Generic test registry_set windows Sysmon · WinEventLog Security - @kostastsale, Nasreddine Bencherchali (Nextron Systems) 2023-11-05 2024-08-16 31e124fb-5dc4-42a0-83b3-44a69c77b271
1 Application Uninstalled
An application has been removed. (...)
Generic test - windows WinEventLog Application - frack113 2022-01-28 2022-09-17 570ae5ec-33dc-427c-b815-db86228ad43e
2 AppX Package Installation Attempts Via AppInstaller.EXE
Detects DNS queries made by "AppInstaller.EXE". (...)
Generic test dns windows Sysmon - frack113 2021-11-24 2023-11-09 7cff77e1-9663-46a3-8260-17f2e1aa9d0a
2 Arbitrary File Download Via GfxDownloadWrapper.EXE
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.
Generic test process_creation windows Sysmon · WinEventLog Security - Victor Sergeev, oscd.community 2020-10-09 2023-10-18 eee00933-a761-4cd0-be70-c42fe91731e7
1 ASLR Disabled Via Sysctl or Direct Syscall - Linux
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use (...)
Generic experimental process_creation linux Linux Auditd - Milad Cheraghi 2025-05-26 2025-12-05 e497a24e-9345-4a62-9803-b06d7d7cb132
4 Auditing Configuration Changes on Linux Host
Detect changes in auditd configuration files
Generic test file_event linux Linux Auditd - Mikhail Larin, oscd.community 2019-10-25 2021-11-27 977ef627-4539-4875-adf4-ed8f780c4922
2 AWS Bedrock Guardrail Deleted
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - Marco Pedrinazzi (@pedrinazziM) (InTheCyber) 2026-07-10 — 59b70e4d-dd17-44a9-b740-acf07ae3eb6a
1 AWS Bedrock Guardrail Updated
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety c (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - Marco Pedrinazzi (@pedrinazziM) (InTheCyber) 2026-07-10 — 1c722651-254a-4b04-a9f4-99b62a2d0a1f
1 AWS EC2 Disable EBS Encryption
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...)
Generic stable cloud_audit - AWS CloudTrail · AWS - Sittikorn S 2021-06-29 2021-08-20 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
1 AWS GuardDuty Detector Deleted Or Updated
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)
Generic experimental cloud_audit - AWS CloudTrail · AWS - suktech24 2025-11-27 — d2656e78-c069-4571-8220-9e0ab5913f19
12 AWS GuardDuty Important Change
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.
Generic test cloud_audit - AWS CloudTrail · AWS - faloker 2020-02-11 2022-10-09 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3
1 AWS Macie Evasion
Detects evade to Macie detection.
Unsupported unsupported cloud_audit - AWS CloudTrail · AWS - Sittikorn S 2021-07-06 2023-03-24 91f6a16c-ef71-437a-99ac-0b070e3ad221
1 AWS SecurityHub Findings Evasion
Detects the modification of the findings on SecurityHub.
Generic stable cloud_audit - AWS CloudTrail · AWS - Sittikorn S 2021-06-28 — a607e1fe-74bf-4440-a3ec-b059b9103157
1 Axios NPM Compromise File Creation Indicators - Linux
Detects file creation events linked to the Axios NPM supply chain compromise. (...)
Emerging experimental file_event linux Sysmon - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — b7cb840c-11f6-47f7-b3ef-5524739c9077
5 Axios NPM Compromise File Creation Indicators - MacOS
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)
Emerging experimental file_event macos - - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — 2db0458c-05c9-4069-a26f-77becd9c8c13
5 Axios NPM Compromise Indicators - Linux
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)
Emerging experimental process_creation linux Sysmon - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — 0a23a62d-c5b3-468b-a072-25064a9a8c87
5 Axios NPM Compromise Indicators - macOS
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
Emerging experimental process_creation macos - - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — a09ee860-31b3-4586-8a68-0ebd74ce0e5f
5 Axios NPM Compromise Indicators - Windows
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)
Emerging experimental process_creation windows Sysmon · WinEventLog Security - Swachchhanda Shrawan Poudel (Nextron Systems) 2026-04-01 — f6c27ecc-d890-4452-80e6-2e274a10e097
5 Splunk
Azure AD Block User Consent For Risky Apps Disabled
The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...)
Generic stable account_management - Microsoft 365 - Mauricio Velazco, Splunk 2023-11-16 2026-05-13 875de3d7-09bc-4916-8c0a-0929f4ced3d8
4 Azure Application Deleted
Identifies when a application is deleted in Azure.
Generic test cloud_audit - Azure Audit Logs · Azure - Austin Songer @austinsonger 2021-09-03 2026-04-30 410d2a41-1e6d-452f-85e5-abdd8257a823
3 Azure Container Registry Created or Deleted
Detects when a Container Registry is created or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 93e0ef48-37c8-49ed-a02c-038aab23628e
4 Azure Kubernetes Cluster Created or Deleted
Detects when a Azure Kubernetes Cluster is created or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 9541f321-7cba-4b43-80fc-fbd1fb922808
4 Azure Kubernetes Events Deleted
Detects when Events are deleted in Azure Kubernetes. (...)
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-07-24 2022-08-23 225d8b09-e714-479c-a0e4-55e6f29adf35
2 Azure Kubernetes Network Policy Change
Identifies when a Azure Kubernetes network policy is modified or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 08d6ac24-c927-4469-b3b7-2e422d6e3c43
4 Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 25cb259b-bbdc-4b87-98b7-90d7c72f8743
4 Azure Kubernetes Secret or Config Object Access
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
4 Azure Kubernetes Sensitive Role Access
Identifies when ClusterRoles/Roles are being modified or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 818fee0c-e0ec-4e45-824e-83e4817b0887
4 Azure Kubernetes Service Account Modified or Deleted
Identifies when a service account is modified or deleted.
Generic test cloud_audit - Azure Activity Logs · Azure - Austin Songer @austinsonger 2021-08-07 2022-08-23 12d027c3-b48c-4d9d-8bb6-a732200034b2
4 Base64 Encoded PowerShell Command Detected
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2020-01-29 2023-01-26 e32d4572-9826-4738-b651-95fa63747e8a
1 Bitbucket Audit Log Configuration Updated
Detects changes to the bitbucket audit log configuration.
Generic test cloud_audit - Bitbucket Audit · Bitbucket - Muhammad Faisal (@faisalusuf) 2024-02-25 — 6aa12161-235a-4dfb-9c74-fe08df8d8da1
1 Bitbucket Global Secret Scanning Rule Deleted
Detects Bitbucket global secret scanning rule deletion activity.
Generic test cloud_audit - Bitbucket Audit · Bitbucket - Muhammad Faisal (@faisalusuf) 2024-02-25 — e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05
2 Bitbucket Global SSH Settings Changed
Detects Bitbucket global SSH access configuration changes.
Generic test cloud_audit - Bitbucket Audit · Bitbucket - Muhammad Faisal (@faisalusuf) 2024-02-25 — 16ab6143-510a-44e2-a615-bdb80b8317fc
2 Bitbucket Project Secret Scanning Allowlist Added
Detects when a secret scanning allowlist rule is added for projects.
Generic test cloud_audit - Bitbucket Audit · Bitbucket - Muhammad Faisal (@faisalusuf) 2024-02-25 — 42ccce6d-7bd3-4930-95cd-e4d83fa94a30
2 Bitbucket Secret Scanning Exempt Repository Added
Detects when a repository is exempted from secret scanning feature.
Generic test cloud_audit - Bitbucket Audit · Bitbucket - Muhammad Faisal (@faisalusuf) 2024-02-25 — b91e8d5e-0033-44fe-973f-b730316f23a1
2 Bitbucket Secret Scanning Rule Deleted
Detects when secret scanning rule is deleted for the project or repository.
Generic test cloud_audit - Bitbucket Audit · Bitbucket - Muhammad Faisal (@faisalusuf) 2024-02-25 — ff91e3f0-ad15-459f-9a85-1556390c138d
2 Splunk
BITSAdmin Download File
The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Michael Haag, Sittikorn S 2021-03-30 2026-10-02 80630ff4-8e4c-11eb-aab5-acde48001122
5 Browser Execution In Headless Mode
Detects execution of Chromium based browser in headless mode
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-09-12 — ef9dcfed-690c-4c5d-a9d1-482cd422225c
2 Certificate Request Export to Exchange Webserver
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be u (...)
Generic test - windows Exchange - Max Altgelt (Nextron Systems) 2021-08-23 2023-01-23 b7bc7038-638b-4ffd-880c-292c692209ef
1 Splunk
CertUtil With Decode Argument
The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Michael Haag, Splunk 2021-03-25 2026-10-02 bfe94226-8c10-11eb-a4b3-acde48001122
5 Chopper Webshell Process Pattern
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Generic test process_creation windows Sysmon · WinEventLog Security Florian Roth (Nextron Systems), MSTI (query) 2022-10-01 — fa3c117a-bc0d-416e-a31b-0c0e80653efb
1 Splunk
Cisco ASA - Core Syslog Message Volume Drop
Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. (...)
Hunting stable firewall - Cisco Secure Firewall · Cisco Bhavin Patel, Micheal Haag, Splunk 2025-09-25 2026-05-13 4b4f8fdd-1f9e-45d8-9b0f-1f64c0b297a4
8 Splunk
Cisco ASA - Device File Copy to Remote Location
This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-11-21 2026-05-13 8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
2 Splunk
Cisco ASA - Logging Disabled via CLI
This analytic detects the disabling of logging functionality on a Cisco ASA device
through CLI comma (...)
Generic stable firewall - Cisco Secure Firewall · Cisco - Bhavin Patel, Micheal Haag, Nasreddine Bencherchali, Splunk 2025-09-25 2026-05-13 7b4c9f3e-5a88-4b7b-9c4b-94d8e5d67201
2 Splunk
Cisco ASA - Logging Filters Configuration Tampering
This analytic detects tampering with logging filter configurations on Cisco ASA devices via CLI or ASDM. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-11-21 2026-05-13 b87b48a8-6d1a-4280-9cf1-16a950dbf901
1 Splunk
Cisco Configuration Archive Logging Analysis
This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. (...)
Hunting stable configuration_change - Cisco IOS · Cisco Bhavin Patel, Michael Haag, Splunk 2025-08-21 2026-05-13 f52d5c0b-d45d-4304-b300-a4f6a1130dec
3