ADFS Database Named Pipe Connection By Uncommon Tool
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)
Generic test pipe_created windows Sysmon - Roberto Rodriguez @Cyb3rWard0g 2021-10-08 2023-11-30 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
3 Automated Collection Command PowerShell
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Generic test ps_script windows PowerShell - frack113 2021-07-28 2022-12-25 c1dda054-d638-4c16-afc8-53e007f3fbc5
1 Automated Collection Command Prompt
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2021-07-28 2022-11-11 f576a613-2392-4067-9d1a-9345fb58d8d1
2 AWS EC2 VM Export Failure
An attempt to export an AWS EC2 instance has been detected. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - Diogo Braz 2020-04-16 2022-10-05 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
1 Splunk
AWS Exfiltration via Anomalous GetObject API Activity
The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. (...)
Anomaly stable cloud_audit - AWS CloudTrail · AWS - Bhavin Patel, Splunk 2023-04-10 2026-05-13 e4384bbf-5835-4831-8d85-694de6ad2cc6
3 Splunk
AWS Exfiltration via Batch Service
The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. (...)
Generic stable scheduled_job - AWS CloudTrail · AWS - Bhavin Patel, Splunk 2023-04-24 2026-05-13 04455dd3-ced7-480f-b8e6-5469b99e98e2
2 Splunk
AWS Exfiltration via DataSync Task
The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. (...)
Generic stable scheduled_job - AWS CloudTrail · AWS - Bhavin Patel, Splunk 2023-04-10 2026-05-13 05c4b09f-ea28-4c7c-a7aa-a246f665c8a2
2 Base64 Encoded PowerShell Command Detected
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2020-01-29 2023-01-26 e32d4572-9826-4738-b651-95fa63747e8a
1 BPFDoor Abnormal Process ID or Lock File Accessed
detects BPFDoor .lock and .pid files access in temporary file storage facility
Generic test file_event linux Linux Auditd - Rafal Piasecki 2022-08-10 2026-03-30 808146b2-9332-4d78-9416-d7e47012d83d
4 Splunk
CertUtil With Decode Argument
The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Michael Haag, Splunk 2021-03-25 2026-10-02 bfe94226-8c10-11eb-a4b3-acde48001122
5 Splunk
Cisco ASA - Device File Copy Activity
This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-11-21 2026-05-13 4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
1 Splunk
Cisco ASA - Device File Copy to Remote Location
This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-11-21 2026-05-13 8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
2 Cisco Collect Data
Collect pertinent data from the configuration files
Generic test authentication - Cisco AAA · Cisco - Austin Clark 2019-08-11 2023-01-04 cd072b25-a418-4f98-8ebc-5093fb38fe1a
3 Cisco Discovery
Find information about network devices that is not stored in config files
Generic test authentication - Cisco AAA · Cisco - Austin Clark 2019-08-12 2023-01-04 9705a6a1-6db6-4a16-a987-15b7151e299b
1 Splunk
Cisco TFTP Server Configuration for Data Exfiltration
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...)
Generic stable configuration_change - Cisco IOS · Cisco Bhavin Patel, Michael Haag, Splunk 2025-08-21 2026-05-13 1abce487-f480-4d5f-a551-01de0bece0bd
3 Crash Dump Created By Operating System
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
Generic experimental - windows WinEventLog System - Jason Mull 2025-05-12 — 882fbe50-d8d7-4e29-ae80-0648a8556866
2 Discovery of a System Time
Identifies use of various commands to query a systems time. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community 2019-10-24 2022-06-28 b243b280-65fe-48df-ba07-6ddea7646427
2 DNS-over-HTTPS Enabled by Registry
Detects when a user enables DNS-over-HTTPS. (...)
Generic test registry_set windows Sysmon · WinEventLog Security - Austin Songer 2021-07-22 2023-08-17 04b45a8a-d11d-49e4-9acc-4a1b524407a5
4 Esentutl Steals Browser Information
One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and M (...)
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2022-02-13 2024-03-05 6a69f62d-ce75-4b57-8dce-6351eb55b362
3 Splunk
ESXi Sensitive Files Accessed
This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. (...)
Generic stable - esxi VMware ESXi · VMware - Raven Tait, Splunk 2025-07-11 2026-05-13 6fa0073d-6ca0-4f93-913d-fb420c9de15b
- Splunk
ESXi VM Exported via Remote Tool
This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. (...)
Generic stable - esxi VMware ESXi · VMware - Raven Tait, Splunk 2025-07-11 2026-05-13 2e155547-aaac-49d3-b0ef-ceabc31fd364
- Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems), frack113 2021-07-20 2022-10-09 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98
2 HackTool - CobaltStrike BOF Injection Pattern
Detects a typical pattern of a CobaltStrike BOF which inject into other processes
Generic test process_access windows Sysmon - Christian Burkard (Nextron Systems) 2021-08-04 2023-11-28 09706624-b7f6-455d-9d02-adee024cee1d
2 HackTool - HandleKatz Duplicating LSASS Handle
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening an (...)
Generic test process_access windows Sysmon - Bhabesh Raj (rule), @thefLinkk 2022-06-27 2023-11-28 b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5
1 HackTool - RedMimicry Winnti Playbook Execution
Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
Generic test process_creation windows Sysmon · WinEventLog Security - Alexander Rausch 2020-06-24 2023-03-01 95022b85-ff2a-49fa-939a-d7b8f56eeb9b
1 HackTool - WinPwn Execution
Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Swachchhanda Shrawan Poudel 2023-12-04 — d557dc06-62e8-4468-a8e8-7984124908ce
5 HackTool - WinPwn Execution - ScriptBlock
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)
Generic test ps_script windows PowerShell - Swachchhanda Shrawan Poudel 2023-12-04 — 851fd622-b675-4d26-b803-14bc7baa517a
5 Splunk
Linux Auditd Base64 Decode Files
The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)
Anomaly stable process_creation linux Linux Auditd - Teoderick Contreras, Splunk 2024-08-12 2026-05-13 5890ba10-4e48-4dc0-8a40-3e1ebe75e737
2 Linux Base64 Encoded Pipe to Shell
Detects suspicious process command line that uses base64 encoded input for execution with a shell
Generic test process_creation linux Sysmon - pH-T (Nextron Systems) 2022-07-26 2023-06-16 ba592c6d-6888-43c3-b8c6-689b8fe47337
2 Linux Base64 Encoded Shebang In CLI
Detects the presence of a base64 version of the shebang in the commandline, which could indicate a m (...)
Generic test process_creation linux Sysmon - Nasreddine Bencherchali (Nextron Systems) 2022-09-15 — fe2f9663-41cb-47e2-b954-8a228f3b9dff
2 Linux Shell Pipe to Shell
Detects suspicious process command line that starts with a shell that executes something and finally (...)
Generic test process_creation linux Sysmon - Florian Roth (Nextron Systems) 2022-03-14 2022-07-26 880973f3-9708-491c-a77b-2a35a1921158
1 MSHTA Execution with Suspicious File Extensions
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA ( (...)
Generic test process_creation windows Sysmon · WinEventLog Security Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems) 2019-02-22 2025-05-12 cc7abbd0-762b-41e3-8a26-57ad50d2eea3
6 OpenCanary - SMB File Open Request
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Generic test - - OpenCanary - Security Onion Solutions 2024-03-08 — 22777c9e-873a-4b49-855f-6072ab861a52
2 Payload Decoded and Decrypted via Built-in Utilities
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. (...)
Generic test process_creation macos - - Tim Rauch (rule), Elastic (idea) 2022-10-17 — 234dc5df-40b5-49d1-bf53-0d44ce778eca
1 Periodic Backup For System Registry Hives Enabled
Detects the enabling of the "EnablePeriodicBackup" registry value. (...)
Generic test registry_set windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2024-07-01 — 973ef012-8f1a-4c40-93b4-7e659a5cd17f
1 Ping Hex IP
Detects a ping command that uses a hex encoded IP address
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2018-03-23 2025-10-17 1a0d4aba-7668-4365-9ce4-6d79ab088dfd
2 Potential Base64 Decoded From Images
Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. (...)
Generic test process_creation macos - - Joseliyo Sanchez, @Joseliyo_Jstnk 2023-12-20 — 09a910bf-f71f-4737-9c40-88880ba5913d
2 Potential Binary Proxy Execution Via Cdb.EXE
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Generic test process_creation windows Sysmon · WinEventLog Security - Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) 2019-10-26 2024-04-22 b5c7395f-e501-4a08-94d4-57fe7a9da9d2
3 Potential BlackByte Ransomware Activity
Detects command line patterns used by BlackByte ransomware in different operations
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2022-02-25 2023-02-08 999e8307-a775-4d5f-addc-4855632335be
1 Potential Commandline Obfuscation Using Escape Characters
Detects potential commandline obfuscation using known escape characters
Generic test process_creation windows Sysmon · WinEventLog Security - juju4 2018-12-11 2023-03-03 f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd
5 Potential Conti Ransomware Database Dumping Activity Via SQLCmd
Detects a command used by conti to dump database
Emerging test process_creation windows Sysmon · WinEventLog Security - frack113 2021-08-16 2023-05-04 2f47f1fd-0901-466e-a770-3b7092834a1b
3 Potential Direct Syscall of NtOpenProcess
Detects potential calls to NtOpenProcess directly from NTDLL.
Generic test process_access windows Sysmon - Christian Burkard (Nextron Systems), Tim Shelton (FP) 2021-07-28 2023-12-13 3f3f3506-1895-401b-9cc3-e86b16e630d0
1 Potential Exfiltration of Compressed Files
This rule detects potential exfiltration by looking for a few compression extensions in the uri and (...)
Unsupported unsupported - - HTTP · Zeek - Greg Howell, OTR (Open Threat Research) 2020-04-05 2023-03-24 0d47e3f6-357f-4534-928c-202631d065fa
1 Potential WinAPI Calls Via CommandLine
Detects the use of WinAPI Functions via the commandline. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2022-09-06 2025-03-06 ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
1 Potential WinAPI Calls Via PowerShell Scripts
Detects usage of WinAPI functions in PowerShell scripts. (...)
Generic test ps_script windows PowerShell - Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community 2020-10-06 2026-04-29 03d83090-8cba-44a0-b02f-0b756a050306
3 PowerShell Base64 Encoded FromBase64String Cmdlet
Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2019-08-24 2023-04-06 fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c
1 PowerShell Decompress Commands
A General detection for specific decompress commands in PowerShell logs. (...)
Generic test ps_module windows PowerShell - Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) 2020-05-02 2022-12-25 1ddc1472-8e52-4f7d-9f11-eab14fc171f5
2 Splunk
PTC Windchill Gateway Command Execution
This analytic detects Windchill MethodServer log4j events showing suspicious `c=` command execution or `p=` file read parameters sent to Windchill gateway paths associated with CVE-2026-4681 exploitation. (...)
Anomaly stable network_connection - Windchill Log4j Nasreddine Bencherchali, Splunk 2026-06-14 2026-06-14 d725b390-fe86-47df-b9a1-57497915403e
3 Recon Information for Export with Command Prompt
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2021-07-30 2022-09-13 aa2efee7-34dd-446e-8a37-40790a66efd7
1 Recon Information for Export with PowerShell
Once established within a system or network, an adversary may use automated techniques for collectin (...)
Generic test ps_script windows PowerShell - frack113 2021-07-30 2022-12-25 a9723fcc-881c-424c-8709-fd61442ab3c3
1