APT27 - Emissary Panda Activity
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2018-09-03 2023-03-09 9aa01d62-7667-4d3b-acb8-8cb5103e2014
3 Aruba Network Service Potential DLL Sideloading
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...)
Generic test image_load windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2023-01-22 2023-03-15 90ae0469-0cee-4509-b67f-e5efcef040f7
1 Automated Turla Group Lateral Movement
Detects automated lateral movement by Turla group
Unsupported unsupported process_creation windows Sysmon · WinEventLog Security - Markus Neis 2017-11-07 2023-02-24 75925535-ca97-4e0a-a850-00b5c00779dc
1 Base64 Encoded PowerShell Command Detected
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2020-01-29 2023-01-26 e32d4572-9826-4738-b651-95fa63747e8a
1 BPFDoor Abnormal Process ID or Lock File Accessed
detects BPFDoor .lock and .pid files access in temporary file storage facility
Generic test file_event linux Linux Auditd - Rafal Piasecki 2022-08-10 2026-03-30 808146b2-9332-4d78-9416-d7e47012d83d
4 Capabilities Discovery - Linux
Detects usage of "getcap" binary. (...)
Generic test process_creation linux Sysmon - Nasreddine Bencherchali (Nextron Systems) 2022-12-28 2026-01-24 d8d97d51-122d-4cdd-9e2f-01b4b4933530
3 Certificate Exported Via Certutil.EXE
Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) 2023-02-15 2024-03-05 3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
1 Splunk
CertUtil With Decode Argument
The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Michael Haag, Splunk 2021-03-25 2026-10-02 bfe94226-8c10-11eb-a4b3-acde48001122
5 Cisco Discovery
Find information about network devices that is not stored in config files
Generic test authentication - Cisco AAA · Cisco - Austin Clark 2019-08-12 2023-01-04 9705a6a1-6db6-4a16-a987-15b7151e299b
1 Splunk
Cisco Secure Firewall - Lumma Stealer Activity
This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)
Generic stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk, Talos NTDR 2025-04-16 2026-05-13 96bce783-c22e-4e48-8cf1-3eb2794c5083
1 Splunk
Cisco Secure Firewall - Repeated Malware Downloads
The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-09 2026-09-22 aeff2bb5-3483-48d4-9be8-c8976194be1e
1 Splunk
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts
This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-16 2026-05-13 a4c76d0a-56b6-44be-814b-939746c4d406
1 ConvertTo-SecureString Cmdlet Usage Via CommandLine
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton 2020-10-11 2023-02-01 74403157-20f5-415d-89a7-c505779585cf
2 Creation Of Non-Existent System DLL
Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. (...)
Generic test file_event windows Sysmon Nasreddine Bencherchali (Nextron Systems), fornotes 2022-12-01 2026-01-24 df6ecb8b-7822-4f4b-b412-08f524b4576c
13 Creation of WerFault.exe/Wer.dll in Unusual Folder
Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.
Generic test file_event windows Sysmon - frack113 2022-05-09 2026-05-18 28a452f3-786c-4fd8-b8f2-bddbe9d616d1
1 Splunk
Curl Execution with Percent Encoded URL
The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...)
Anomaly stable process_creation windows · linux CrowdStrike · Sysmon · WinEventLog Security - Nasreddine Bencherchali, Splunk 2026-03-03 2026-05-13 9a8d5516-4c5e-11ef-9d42-acde48001122
4 Decode Base64 Encoded Text
Detects usage of base64 utility to decode arbitrary base64-encoded text
Generic test process_creation linux Sysmon - Daniil Yugoslavskiy, oscd.community 2020-10-19 2021-11-27 e2072cab-8c9a-459b-b63c-40ae79e27031
1 Decode Base64 Encoded Text -MacOs
Detects usage of base64 utility to decode arbitrary base64-encoded text
Generic test process_creation macos - - Daniil Yugoslavskiy, oscd.community 2020-10-19 2022-11-26 719c22d7-c11a-4f2c-93a6-2cfdd5412f68
1 DHCP Callout DLL Installation
Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)
Generic test registry_set windows Sysmon · WinEventLog Security - Dimitrios Slamaris 2017-05-15 2023-08-17 9d3436ef-9476-4c43-acca-90ce06bdf33a
3 DHCP Server Error Failed Loading the CallOut DLL
This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be lo (...)
Generic test - windows WinEventLog System - Dimitrios Slamaris, @atc_project (fix) 2017-05-15 2022-12-25 75edd3fd-7146-48e5-9848-3013d7f0282c
3 DHCP Server Loaded the CallOut DLL
This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded
Generic test - windows WinEventLog System - Dimitrios Slamaris 2017-05-15 2022-12-25 13fc89a9-971e-4ca6-b9dc-aa53a445bf40
3 Diamond Sleet APT DLL Sideloading Indicators
Detects DLL sideloading activity seen used by Diamond Sleet APT
Emerging test image_load windows Sysmon Nasreddine Bencherchali (Nextron Systems) 2023-10-24 — d1b65d98-37d7-4ff6-b139-2d87c1af3042
1 DirLister Execution
Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2022-08-20 2023-02-04 b4dc61f5-6cce-468e-a608-b48b469feaa2
2 DLL Names Used By SVR For GraphicalProton Backdoor
Hunts known SVR-specific DLL names.
Emerging test image_load windows Sysmon - CISA 2023-12-18 — e64c8ef3-9f98-40c8-b71e-96110991cb4c
1 DLL Search Order Hijackig Via Additional Space in Path
Detects when an attacker create a similar folder structure to windows system folders such as (Window (...)
Generic test file_event windows Sysmon - frack113, Nasreddine Bencherchali (Nextron Systems) 2022-07-30 — b6f91281-20aa-446a-b986-38a92813a18f
2 DLL Sideloading by VMware Xfer Utility
Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which m (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2022-08-02 — ebea773c-a8f1-42ad-a856-00cb221966e8
1 DLL Sideloading Of ShellChromeAPI.DLL
Detects processes loading the non-existent DLL "ShellChromeAPI". (...)
Generic test image_load windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2022-12-01 — ee4c5d06-3abc-48cc-8885-77f1c20f4451
2 DNS Server Error Failed Loading the ServerLevelPluginDLL
Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded
Generic test - windows DNS Server - Florian Roth (Nextron Systems) 2017-05-08 2023-02-05 cbe51394-cd93-4473-b555-edf0144952d9
3 DNS-over-HTTPS Enabled by Registry
Detects when a user enables DNS-over-HTTPS. (...)
Generic test registry_set windows Sysmon · WinEventLog Security - Austin Songer 2021-07-22 2023-08-17 04b45a8a-d11d-49e4-9acc-4a1b524407a5
4 Fax Service DLL Search Order Hijack
The Fax service attempts to load ualapi.dll, which is non-existent. (...)
Generic test image_load windows Sysmon - NVISO 2020-05-04 2022-06-02 828af599-4c53-4ed2-ba4a-a9f835c434ea
1 File and Directory Discovery - Linux
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.
Generic test process_creation linux Sysmon - Daniil Yugoslavskiy, oscd.community, CheraghiMilad 2020-10-19 2024-12-01 d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
1 File and Directory Discovery - MacOS
Detects usage of system utilities to discover files and directories
Generic test process_creation macos - - Daniil Yugoslavskiy, oscd.community 2020-10-19 2022-11-25 089dbdf6-b960-4bcc-90e3-ffc3480c20f6
1 File Decoded From Base64/Hex Via Certutil.EXE
Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community 2023-02-15 2025-06-04 cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7
6 File Encoded To Base64 Via Certutil.EXE
Detects the execution of certutil with the "encode" flag to encode a file to base64. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) 2019-02-24 2024-03-05 e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
3 File In Suspicious Location Encoded To Base64 Via Certutil.EXE
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-05-15 2024-03-05 82a6714f-4899-4f16-9c1e-9a333544d4c3
4 HackTool - CobaltStrike BOF Injection Pattern
Detects a typical pattern of a CobaltStrike BOF which inject into other processes
Generic test process_access windows Sysmon - Christian Burkard (Nextron Systems) 2021-08-04 2023-11-28 09706624-b7f6-455d-9d02-adee024cee1d
2 HackTool - HandleKatz Duplicating LSASS Handle
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening an (...)
Generic test process_access windows Sysmon - Bhabesh Raj (rule), @thefLinkk 2022-06-27 2023-11-28 b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5
1 HackTool - PCHunter Execution
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Nasreddine Bencherchali 2022-10-10 2024-11-23 fca949cc-79ca-446e-8064-01aa7e52ece5
3 HackTool - Powerup Write Hijack DLL
Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. (...)
Generic test file_event windows Sysmon - Subhash Popuri (@pbssubhash) 2021-08-21 2024-06-27 602a1f13-c640-4d73-b053-be9a2fa58b96
1 HackTool - RedMimicry Winnti Playbook Execution
Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
Generic test process_creation windows Sysmon · WinEventLog Security - Alexander Rausch 2020-06-24 2023-03-01 95022b85-ff2a-49fa-939a-d7b8f56eeb9b
1 HackTool - WinPwn Execution
Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Swachchhanda Shrawan Poudel 2023-12-04 — d557dc06-62e8-4468-a8e8-7984124908ce
5 HackTool - WinPwn Execution - ScriptBlock
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)
Generic test ps_script windows PowerShell - Swachchhanda Shrawan Poudel 2023-12-04 — 851fd622-b675-4d26-b803-14bc7baa517a
5 Invoke-Obfuscation CLIP+ Launcher
Detects Obfuscated use of Clip.exe to execute PowerShell
Unsupported unsupported driver_load windows Sysmon - Jonathan Cheong, oscd.community 2020-10-13 2021-09-16 21e4b3c1-4985-4aa4-a6c0-f8639590a5f3
1 Invoke-Obfuscation CLIP+ Launcher
Detects Obfuscated use of Clip.exe to execute PowerShell
Generic test process_creation windows Sysmon · WinEventLog Security - Jonathan Cheong, oscd.community 2020-10-13 2022-11-17 b222df08-0e07-11eb-adc1-0242ac120002
1 Invoke-Obfuscation CLIP+ Launcher - PowerShell
Detects Obfuscated use of Clip.exe to execute PowerShell
Generic test ps_script windows PowerShell - Jonathan Cheong, oscd.community 2020-10-13 2024-04-05 73e67340-0d25-11eb-adc1-0242ac120002
1 Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
Detects Obfuscated use of Clip.exe to execute PowerShell
Generic test ps_module windows PowerShell - Jonathan Cheong, oscd.community 2020-10-13 2024-04-05 a136cde0-61ad-4a61-9b82-8dc490e60dd2
1 Invoke-Obfuscation CLIP+ Launcher - Security
Detects Obfuscated use of Clip.exe to execute PowerShell
Generic test service windows WinEventLog Security - Jonathan Cheong, oscd.community 2020-10-13 2022-11-27 4edf51e1-cb83-4e1a-bc39-800e396068e3
1 Invoke-Obfuscation CLIP+ Launcher - System
Detects Obfuscated use of Clip.exe to execute PowerShell
Generic test service windows WinEventLog System - Jonathan Cheong, oscd.community 2020-10-13 2023-02-20 f7385ee2-0e0c-11eb-adc1-0242ac120002
1 Invoke-Obfuscation COMPRESS OBFUSCATION
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Generic test process_creation windows Sysmon · WinEventLog Security - Timur Zinniatullin, oscd.community 2020-10-18 2022-12-29 7eedcc9d-9fdb-4d94-9c54-474e8affc0c7
1 Invoke-Obfuscation COMPRESS OBFUSCATION
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Unsupported unsupported driver_load windows Sysmon - Timur Zinniatullin, oscd.community 2020-10-18 2023-03-04 c70731dd-0097-40ff-b112-f7032f29c16c
1