Active Directory Replication from Non Machine Account - DcSync Indicator
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
Generic test account_management windows WinEventLog Security - Roberto Rodriguez @Cyb3rWard0g 2019-07-26 2026-07-30 17d619c1-e020-4347-957e-1d1207455c93
3 ADFS Database Named Pipe Connection By Uncommon Tool
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)
Generic test pipe_created windows Sysmon - Roberto Rodriguez @Cyb3rWard0g 2021-10-08 2023-11-30 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
3 APT27 - Emissary Panda Activity
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2018-09-03 2023-03-09 9aa01d62-7667-4d3b-acb8-8cb5103e2014
3 Aruba Network Service Potential DLL Sideloading
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...)
Generic test image_load windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2023-01-22 2023-03-15 90ae0469-0cee-4509-b67f-e5efcef040f7
1 Splunk
Attacker Tools On Endpoint
The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco - Bhavin Patel, Splunk, sventec, Github Community 2021-07-12 2026-09-22 a51bfe1a-94f0-48cc-b4e4-16a110145893
- AWS EC2 VM Export Failure
An attempt to export an AWS EC2 instance has been detected. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - Diogo Braz 2020-04-16 2022-10-05 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
1 Splunk
Cisco ASA - Device File Copy Activity
This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-11-21 2026-05-13 4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
1 Splunk
Cisco ASA - Device File Copy to Remote Location
This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-11-21 2026-05-13 8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
2 Cisco Collect Data
Collect pertinent data from the configuration files
Generic test authentication - Cisco AAA · Cisco - Austin Clark 2019-08-11 2023-01-04 cd072b25-a418-4f98-8ebc-5093fb38fe1a
3 Splunk
Cisco TFTP Server Configuration for Data Exfiltration
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...)
Generic stable configuration_change - Cisco IOS · Cisco Bhavin Patel, Michael Haag, Splunk 2025-08-21 2026-05-13 1abce487-f480-4d5f-a551-01de0bece0bd
3 Crash Dump Created By Operating System
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
Generic experimental - windows WinEventLog System - Jason Mull 2025-05-12 — 882fbe50-d8d7-4e29-ae80-0648a8556866
2 Creation Of Non-Existent System DLL
Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. (...)
Generic test file_event windows Sysmon Nasreddine Bencherchali (Nextron Systems), fornotes 2022-12-01 2026-01-24 df6ecb8b-7822-4f4b-b412-08f524b4576c
13 Creation Of Pod In System Namespace
Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...)
Generic test - - Kubernetes Audit · Kubernetes - Leo Tsaousis (@laripping) 2024-03-26 — a80d927d-ac6e-443f-a867-e8d6e3897318
1 Creation of WerFault.exe/Wer.dll in Unusual Folder
Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.
Generic test file_event windows Sysmon - frack113 2022-05-09 2026-05-18 28a452f3-786c-4fd8-b8f2-bddbe9d616d1
1 Credential Dumping Tools Service Execution - Security
Detects well-known credential dumping tools execution via service execution events
Generic test service windows WinEventLog Security - Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community 2017-03-05 2022-11-29 f0d1feba-4344-4ca9-8121-a6c97bd6df52
1 Credential Dumping Tools Service Execution - System
Detects well-known credential dumping tools execution via service execution events
Generic test service windows WinEventLog System - Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community 2017-03-05 2022-11-29 4976aa50-8f41-45c6-8b15-ab3fc10e79ed
1 DHCP Callout DLL Installation
Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)
Generic test registry_set windows Sysmon · WinEventLog Security - Dimitrios Slamaris 2017-05-15 2023-08-17 9d3436ef-9476-4c43-acca-90ce06bdf33a
3 DHCP Server Error Failed Loading the CallOut DLL
This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be lo (...)
Generic test - windows WinEventLog System - Dimitrios Slamaris, @atc_project (fix) 2017-05-15 2022-12-25 75edd3fd-7146-48e5-9848-3013d7f0282c
3 DHCP Server Loaded the CallOut DLL
This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded
Generic test - windows WinEventLog System - Dimitrios Slamaris 2017-05-15 2022-12-25 13fc89a9-971e-4ca6-b9dc-aa53a445bf40
3 Diamond Sleet APT DLL Sideloading Indicators
Detects DLL sideloading activity seen used by Diamond Sleet APT
Emerging test image_load windows Sysmon Nasreddine Bencherchali (Nextron Systems) 2023-10-24 — d1b65d98-37d7-4ff6-b139-2d87c1af3042
1 DLL Names Used By SVR For GraphicalProton Backdoor
Hunts known SVR-specific DLL names.
Emerging test image_load windows Sysmon - CISA 2023-12-18 — e64c8ef3-9f98-40c8-b71e-96110991cb4c
1 DLL Search Order Hijackig Via Additional Space in Path
Detects when an attacker create a similar folder structure to windows system folders such as (Window (...)
Generic test file_event windows Sysmon - frack113, Nasreddine Bencherchali (Nextron Systems) 2022-07-30 — b6f91281-20aa-446a-b986-38a92813a18f
2 DLL Sideloading by VMware Xfer Utility
Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which m (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2022-08-02 — ebea773c-a8f1-42ad-a856-00cb221966e8
1 DLL Sideloading Of ShellChromeAPI.DLL
Detects processes loading the non-existent DLL "ShellChromeAPI". (...)
Generic test image_load windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2022-12-01 — ee4c5d06-3abc-48cc-8885-77f1c20f4451
2 DNS Server Error Failed Loading the ServerLevelPluginDLL
Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded
Generic test - windows DNS Server - Florian Roth (Nextron Systems) 2017-05-08 2023-02-05 cbe51394-cd93-4473-b555-edf0144952d9
3 Esentutl Steals Browser Information
One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and M (...)
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2022-02-13 2024-03-05 6a69f62d-ce75-4b57-8dce-6351eb55b362
3 Splunk
ESXi Sensitive Files Accessed
This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. (...)
Generic stable - esxi VMware ESXi · VMware - Raven Tait, Splunk 2025-07-11 2026-05-13 6fa0073d-6ca0-4f93-913d-fb420c9de15b
- Splunk
ESXi VM Exported via Remote Tool
This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. (...)
Generic stable - esxi VMware ESXi · VMware - Raven Tait, Splunk 2025-07-11 2026-05-13 2e155547-aaac-49d3-b0ef-ceabc31fd364
- Exploit for CVE-2015-1641
Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641
Emerging stable process_creation windows Sysmon · WinEventLog Security Florian Roth (Nextron Systems) 2018-02-22 2021-11-27 7993792c-5ce2-4475-a3db-a3a5539827ef
2 Fax Service DLL Search Order Hijack
The Fax service attempts to load ualapi.dll, which is non-existent. (...)
Generic test image_load windows Sysmon - NVISO 2020-05-04 2022-06-02 828af599-4c53-4ed2-ba4a-a9f835c434ea
1 Files With System DLL Name In Unsuspected Locations
Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (...)
Generic test file_event windows Sysmon - Nasreddine Bencherchali (Nextron Systems) 2024-06-24 — 13c02350-4177-4e45-ac17-cf7ca628ff5e
1 Files With System Process Name In Unsuspected Locations
Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). (...)
Generic test file_event windows Sysmon - Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) 2020-05-26 2026-07-28 d5866ddf-ce8f-4aea-b28e-d96485a20d3d
1 Flash Player Update from Suspicious Location
Detects a flashplayer update from an unofficial location
Generic test proxy - - - Florian Roth (Nextron Systems) 2017-10-25 2022-08-08 4922a5dd-6743-4fc2-8e81-144374280997
1 Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems), frack113 2021-07-20 2022-10-09 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98
2 Greenbug Espionage Group Indicators
Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Syma (...)
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2020-05-20 2023-03-09 3711eee4-a808-4849-8a14-faf733da3612
1 HackTool - Mimikatz Execution
Detection well-known mimikatz command line arguments
Generic test process_creation windows Sysmon · WinEventLog Security - Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton 2019-10-22 2023-02-21 a642964e-bead-4bed-8910-1bb4d63e3b4d
2 HackTool - Powerup Write Hijack DLL
Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. (...)
Generic test file_event windows Sysmon - Subhash Popuri (@pbssubhash) 2021-08-21 2024-06-27 602a1f13-c640-4d73-b053-be9a2fa58b96
1 Lazarus APT DLL Sideloading Activity
Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospa (...)
Emerging test image_load windows Sysmon - Thurein Oo, Nasreddine Bencherchali (Nextron Systems) 2023-10-18 — 24007168-a26b-4049-90d0-ce138e13a5cf
2 Lazarus System Binary Masquerading
Detects binaries used by the Lazarus group which use system names but are executed and launched from (...)
Emerging test process_creation windows Sysmon · WinEventLog Security - Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1) 2020-06-03 2023-03-10 3f7f5b0b-5b16-476c-a85f-ab477f6dd24b
1 Malicious DLL File Dropped in the Teams or OneDrive Folder
Detects creation of a malicious DLL file in the location where the OneDrive or Team applications
Upo (...)
Generic test file_event windows Sysmon - frack113 2022-08-12 — 1908fcc1-1b92-4272-8214-0fbaf2fa5163
1 Microsoft Defender Blocked from Loading Unsigned DLL
Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) fro (...)
Generic test - windows Security Mitigations - Bhabesh Raj 2022-08-02 2022-09-28 0b0ea3cc-99c8-4730-9c53-45deee2a4c86
1 Microsoft Office DLL Sideload
Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
Generic test image_load windows Sysmon - Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) 2022-08-17 2023-03-15 829a3bdf-34da-4051-9cf4-8ed221a8ae4f
1 Mimikatz Use
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimi (...)
Generic test - windows - - Florian Roth (Nextron Systems), David ANDRE (additional keywords) 2017-01-10 2022-01-05 06d71506-7beb-4f22-8888-e2e5e2ca7fd8
1 Splunk
MSI Module Loaded by Non-System Binary
The following analytic detects the loading of `msi.dll` by a binary not located in `system32`, `syswow64`, `winsxs`, or `windows` directories. (...)
Hunting stable image_load windows Sysmon Michael Haag, Splunk 2021-12-08 2026-05-13 ccb98a66-5851-11ec-b91c-acde48001122
3 Splunk
Msmpeng Application DLL Side Loading
The following analytic detects the suspicious creation of msmpeng.exe or mpsvc.dll in non-default Windows Defender folders. (...)
Generic stable file_event windows Sysmon - Teoderick Contreras, Splunk, Sanjay Govind 2021-07-05 2026-05-13 8bb3f280-dd9b-11eb-84d5-acde48001122
1 New DNS ServerLevelPluginDll Installed
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which c (...)
Generic test registry_set windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2017-05-08 2023-08-17 e61e8a88-59a9-451c-874e-70fcc9740d67
2 New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which c (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2017-05-08 2023-02-05 f63b56ee-3f79-4b8a-97fb-5c48007e8573
2 OpenCanary - SMB File Open Request
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Generic test - - OpenCanary - Security Onion Solutions 2024-03-08 — 22777c9e-873a-4b49-855f-6072ab861a52
2 Pingback Backdoor Activity
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave r (...)
Emerging test process_creation windows Sysmon · WinEventLog Security - Bhabesh Raj 2021-05-05 2023-02-17 b2400ffb-7680-47c0-b08a-098a7de7e7a9
2 Pingback Backdoor DLL Loading Activity
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave r (...)
Emerging test image_load windows Sysmon - Bhabesh Raj 2021-05-05 2023-02-17 35a7dc42-bc6f-46e0-9f83-81f8e56c8d4b
2