Filter Rules
×Severity
Platform
Rule Type
MITRE ATT&CK
Data Components
Filter applied :
Platform: Windows ×
Clear all
1-20 of 1247
Rule Name
Severity
MITRE ATT&CK
Platform
Last Updated
HackTool - Koh Default Named Pipe
Critical
TA0004, TA0006, T1134.001
Windows
Last updated: September 15, 2025
View details
New PowerShell Instance Created
Attention
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
PUA - CSExec Default Named Pipe
Trouble
TA0008, TA0002, T1021.002
Windows
Last updated: September 15, 2025
View details
PUA - PAExec Default Named Pipe
Trouble
TA0002, T1569.002
Windows
Last updated: September 15, 2025
View details
PUA - RemCom Default Named Pipe
Trouble
TA0008, TA0002, T1021.002
Windows
Last updated: September 15, 2025
View details
PsExec Default Named Pipe
Attention
TA0002, T1569.002
Windows
Last updated: September 15, 2025
View details
Cryptocurrency mining software started
Critical
TA0040, T1496
Windows
Last updated: September 15, 2025
View details
Cryptocurrency wallet software started
Critical
TA0009, T1005
Windows
Last updated: September 15, 2025
View details
SharpShares Detection
Critical
TA0007, TA0008, TA0009, T1087
Windows
Last updated: September 15, 2025
View details
BloodHound Detection
Critical
TA0043, TA0005, T1595
Windows
Last updated: September 15, 2025
View details
VulnRecon Detection
Critical
TA0005, TA0004, TA0007, T1036
Windows
Last updated: September 15, 2025
View
details
PrintSpoofer Detection
Critical
TA0004, TA0005, TA0008, TA0002, T1548
Windows
Last updated: September 15, 2025
View details
WinPeas Detection
Critical
TA0004, TA0006, T1068
Windows
Last updated: September 15, 2025
View
details
BadPotato Detection
Critical
TA0004, TA0008, T1068
Windows
Last updated: September 15, 2025
View
details
SafetyKatz Detection
Critical
TA0006, TA0004, TA0005, TA0008, T1003
Windows
Last updated: September 15, 2025
View details
SharPersist Detection
Critical
TA0002, TA0003, TA0004, TA0005, T1053
Windows
Last updated: September 15, 2025
View details
SharpZeroLogon Detection
Critical
TA0006, TA0009, TA0001, TA0003, TA0004, TA0005, T1606
Windows
Last updated: September 15, 2025
View details
SharpDump Detection
Critical
TA0004, TA0005, TA0006, T1548
Windows
Last updated: September 15, 2025
View
details
SharpHound Detection
Critical
TA0004, TA0007, TA0008, T1068
Windows
Last updated: September 15, 2025
View
details
SharpUp Detection
Critical
TA0007, TA0005, T1069
Windows
Last updated: September 15, 2025
View
details
Spoolsv Spawning Rundll32
Critical
TA0002, TA0003, TA0004, TA0005, T1204
Windows
Last updated: September 15, 2025
View details
Excessive Attempt To Disable Services
Critical
TA0040, TA0005, T1485
Windows
Last updated: September 15, 2025
View details
Excel Spawning Windows Script Host
Critical
TA0002, TA0001, T1059
Windows
Last updated: September 15, 2025
View details
Excessive Usage Of Taskkill
Critical
TA0005, TA0040, TA0002, TA0003, TA0004, T1562
Windows
Last updated: September 15, 2025
View details
Detect Regasm Spawning a Process
Critical
TA0005, T1218.009
Windows
Last updated: September 15, 2025
View details
Office Product Spawning MSHTA
Critical
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Office Product Spawning Windows Script Host
Critical
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Windows Masquerading Explorer As Child Process
Critical
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Wsmprovhost LOLBAS Execution Process Spawn
Critical
TA0005, TA0003, TA0004, T1036
Windows
Last updated: September 15, 2025
View details
Ryuk Wake on LAN Command
Critical
TA0001, TA0003, TA0004, TA0006, T1189
Windows
Last updated: September 15, 2025
View details
Powershell Disable Security Monitoring
Critical
TA0006, TA0002, T1003
Windows
Last updated: September 15, 2025
View details
Add or Set Windows Defender Exclusion
Critical
TA0005, TA0003, TA0004, T1562
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning autochk
Critical
TA0002, TA0004, TA0005, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning fontdrvhost
Critical
TA0002, TA0004, TA0005, TA0003, TA0006, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning dwm
Critical
TA0002, TA0004, TA0005, TA0003, TA0011, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning Consent
Critical
TA0004, TA0005, TA0007, TA0006, T1134
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning tiworker
Critical
TA0004, TA0005, T1134
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning runtimebroker
Critical
TA0004, TA0005, T1134
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning searchindexer
Critical
TA0004, TA0005, TA0007, T1134
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning searchprotocolhost
Critical
TA0004, TA0005, TA0007, TA0006, T1134
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning dllhost
Critical
TA0004, TA0005, TA0003, T1055
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning smss
Critical
TA0004, TA0005, TA0003, T1055
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning csrss
Critical
TA0002, TA0005, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning wininit
Critical
TA0003, TA0004, T1543
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning winlogon
Critical
TA0004, TA0005, T1134
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning lsass
Critical
TA0004, TA0005, T1134
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning lsaIso
Critical
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning LogonUI
Critical
TA0004, TA0005, TA0002, T1134
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning services
Critical
TA0002, TA0004, TA0005, TA0003, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning svchost
Critical
TA0004, TA0005, T1134
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning spoolsv
Critical
TA0002, TA0005, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning taskhost
Critical
TA0006, TA0005, TA0004, TA0002, T1003
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning taskhostw
Critical
TA0005, T1055
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning userinit
Critical
TA0005, T1055
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning wmiprvse
Critical
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Suspicious parent spawning wsmprovhost
Critical
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
SearchProtocolHost Spawning Suspicious Child
Critical
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
taskhost Spawning Suspicious Child
Critical
TA0003, TA0004, T1546
Windows
Last updated: September 15, 2025
View details
csrss Spawning Suspicious Child
Critical
TA0003, TA0004, T1543
Windows
Last updated: September 15, 2025
View details
autochk Spawning Suspicious Child
Critical
TA0003, TA0004, T1543
Windows
Last updated: September 15, 2025
View details
smss Spawning Suspicious Child
Critical
TA0003, TA0004, T1546
Windows
Last updated: September 15, 2025
View details
wermgr Spawning Suspicious Child
Critical
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
conhost Spawning Suspicious Child
Critical
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Credential theft using Procdump or comsvcs
Critical
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Suspicious Encoded PowerShell Command Line
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Local privileged account group modification
Critical
TA0003, TA0004, T1098
Windows
Last updated: September 15, 2025
View details
Suspicious execution of CertOC
Critical
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious file creation with Colorcpl
Critical
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious execution of ConfigSecurityPolicy
Critical
TA0002, T1204
Windows
Last updated: September 15, 2025
View details
Metasploit detection
Critical
TA0002, TA0005, T1203
Windows
Last updated: September 15, 2025
View details
Petitpotam detection
Critical
TA0006, T1557.001
Windows
Last updated: September 15, 2025
View details
Crackmapexec detection
Critical
TA0007, TA0008, T1046
Windows
Last updated: September 15, 2025
View details
Suspicious Certreq command to Download or Upload
Critical
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
Volume Shadow Copy deleted using VSSADMIN or wmic
Critical
TA0040, T1490
Windows
Last updated: September 15, 2025
View
details
Suspicious Certutil Command
Critical
TA0005, T1140
Windows
Last updated: September 15, 2025
View
details
Bypass UAC via CMSTP
Trouble
TA0004, TA0005, T1548.002
Windows
Last updated: September 15, 2025
View
details
Bypassing Security controls
Critical
TA0004, TA0005, T1548
Windows
Last updated: September 15, 2025
View details
Potential Forfiles Misuse
Critical
TA0002, T1059.003
Windows
Last updated: September 15, 2025
View
details
Steganography Malware Creation
Critical
TA0005, T1027.003
Windows
Last updated: September 15, 2025
View details
Unauthorized Stream Exploit
Critical
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Unauthorized Stream Data Transfer
Critical
TA0010, T1048
Windows
Last updated: September 15, 2025
View details
RDP Session Hijacking Using tscon
Critical
TA0008, T1563.002
Windows
Last updated: September 15, 2025
View
details
Potential Defense Evasion via Hidden Files
Critical
TA0005, T1564.001
Windows
Last updated: September 15, 2025
View details
Attempt To Tamper the Audit Policy
Critical
TA0005, T1562.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - AnyDesk Piped Password Via CLI
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate
Trouble
TA0002, TA0001
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - AnyDesk Silent Installation
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - Anydesk Execution From Suspicious Folder
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - GoToAssist Execution
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - LogMeIn Execution
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - MeshAgent Command Execution via MeshCentral
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - NetSupport Execution
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - RURAT Execution From Unusual Location
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - ScreenConnect Execution
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - ScreenConnect Remote Command Execution
Attention
TA0002, T1059.003
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - ScreenConnect Server Web Shell Execution
Trouble
TA0001, T1190
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - Simple Help Execution
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - Team Viewer Session Started On Windows Host
Attention
TA0001, T1133
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - UltraViewer Execution
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Discovery of a System Time
Attention
TA0007, T1124
Windows
Last updated: September 15, 2025
View details
Renamed AutoHotkey.EXE Execution
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Renamed AutoIt Execution
Trouble
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
Potential Defense Evasion Via Binary Rename
Trouble
TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
Potential Defense Evasion Via Rename Of Highly Relevant Binaries
Trouble
TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
Renamed BOINC Client Execution
Trouble
TA0005, T1553
Windows
Last updated: September 15, 2025
View details
Renamed BrowserCore.EXE Execution
Trouble
TA0006, TA0005, T1528
Windows
Last updated: September 15, 2025
View details
Renamed Cloudflared.EXE Execution
Trouble
TA0011, T1090.001
Windows
Last updated: September 15, 2025
View details
Renamed CreateDump Utility Execution
Trouble
TA0005, TA0006, T1036
Windows
Last updated: September 15, 2025
View details
Renamed CURL.EXE Execution
Trouble
TA0002, TA0005, T1059
Windows
Last updated: September 15, 2025
View details
Renamed FTP.EXE Execution
Trouble
TA0002, TA0005, T1059
Windows
Last updated: September 15, 2025
View details
Renamed Gpg.EXE Execution
Trouble
TA0040, T1486
Windows
Last updated: September 15, 2025
View details
Renamed Jusched.EXE Execution
Trouble
TA0002, TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
Renamed Mavinject.EXE Execution
Trouble
TA0005, TA0004, T1055.001
Windows
Last updated: September 15, 2025
View details
Renamed MegaSync Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Renamed Msdt.EXE Execution
Trouble
TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
Renamed Microsoft Teams Execution
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Renamed NetSupport RAT Execution
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Renamed NirCmd.EXE Execution
Trouble
TA0002, TA0005, T1059
Windows
Last updated: September 15, 2025
View details
Renamed Office Binary Execution
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Renamed PAExec Execution
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Renamed PingCastle Binary Execution
Trouble
TA0002, TA0005, T1059
Windows
Last updated: September 15, 2025
View details
Visual Studio NodejsTools PressAnyKey Renamed Execution
Trouble
TA0002, TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential Renamed Rundll32 Execution
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Renamed Remote Utilities RAT (RURAT) Execution
Trouble
TA0005, TA0009, TA0011, TA0007
Windows
Last updated: September 15, 2025
View details
Renamed SysInternals DebugView Execution
Trouble
TA0042, T1588.002
Windows
Last updated: September 15, 2025
View details
Renamed ProcDump Execution
Trouble
TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
Renamed PsExec Service Execution
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Renamed Sysinternals Sdelete Execution
Trouble
TA0040, T1485
Windows
Last updated: September 15, 2025
View details
Renamed Vmnat.exe Execution
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Renamed Whoami Execution
Critical
TA0007, T1033
Windows
Last updated: September 15, 2025
View details
Capture Credentials with Rpcping.exe
Trouble
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Ruby Inline Command Execution
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious Advpack Call Via Rundll32.EXE
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Suspicious Rundll32 Invoking Inline VBScript
Trouble
TA0005, T1055
Windows
Last updated: September 15, 2025
View details
Rundll32 InstallScreenSaver Execution
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Suspicious Key Manager Access
Trouble
TA0006, T1555.004
Windows
Last updated: September 15, 2025
View details
Mshtml.DLL RunHTMLApplication Suspicious Usage
Trouble
TA0005, TA0002
Windows
Last updated: September 15, 2025
View details
Rundll32 Execution Without CommandLine Parameters
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Suspicious NTLM Authentication on the Printer Spooler Service
Trouble
TA0004, TA0006, T1212
Windows
Last updated: September 15, 2025
View details
Potential Obfuscated Ordinal Call Via Rundll32
Trouble
TA0005, T1027.010
Windows
Last updated: September 15, 2025
View details
Rundll32 Spawned Via Explorer.EXE
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Process Memory Dump Via Comsvcs.DLL
Trouble
TA0005, TA0006, T1036
Windows
Last updated: September 15, 2025
View details
Rundll32 Registered COM Objects
Trouble
TA0004, TA0003, T1546.015
Windows
Last updated: September 15, 2025
View details
Suspicious Process Start Locations
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Suspicious Rundll32 Setupapi.dll Activity
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Shell32 DLL Execution in Suspicious Directory
Trouble
TA0005, TA0002, T1218.011
Windows
Last updated: September 15, 2025
View details
Potential ShellDispatch.DLL Functionality Abuse
Trouble
TA0002, TA0005
Windows
Last updated: September 15, 2025
View details
RunDLL32 Spawning Explorer
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Suspicious Control Panel DLL Load
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Suspicious Rundll32 Execution With Image Extension
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Suspicious Usage Of ShellExec_RunDLL
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Suspicious ShellExec_RunDLL Call Via Ordinal
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Suspicious Rundll32 Activity Invoking Sys File
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Rundll32 UNC Path Execution
Trouble
TA0005, TA0002, TA0008, T1218.011
Windows
Last updated: September 15, 2025
View details
Suspicious Workstation Locking via Rundll32
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
WebDav Client Execution Via Rundll32.EXE
Trouble
TA0010, T1048.003
Windows
Last updated: September 15, 2025
View details
Run Once Task Execution as Configured in Registry
Attention
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Suspicious Schtasks Execution AppData Folder
Trouble
TA0002, TA0003, T1053.005
Windows
Last updated: September 15, 2025
View details
Suspicious Modification Of Scheduled Tasks
Trouble
TA0002, T1053.005
Windows
Last updated: September 15, 2025
View details
Suspicious Scheduled Task Creation Involving Temp Folder
Trouble
TA0002, TA0003, T1053.005
Windows
Last updated: September 15, 2025
View details
Delete Important Scheduled Task
Trouble
TA0040, T1489
Windows
Last updated: September 15, 2025
View details
Delete All Scheduled Tasks
Trouble
TA0040, T1489
Windows
Last updated: September 15, 2025
View details
Disable Important Scheduled Task
Trouble
TA0040, T1489
Windows
Last updated: September 15, 2025
View details
Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
Trouble
TA0002, T1053.005
Windows
Last updated: September 15, 2025
View details
Schtasks From Suspicious Folders
Trouble
TA0002, T1053.005
Windows
Last updated: September 15, 2025
View details
Uncommon One Time Only Scheduled Task At 00\\:00
Trouble
TA0002, TA0003, TA0004, T1053.005
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Microsoft Compatibility Appraiser
Trouble
TA0003, T1053.005
Windows
Last updated: September 15, 2025
View details
Scheduled Task Executing Payload from Registry
Trouble
TA0002, TA0003, T1053.005
Windows
Last updated: September 15, 2025
View details
Scheduled Task Executing Encoded Payload from Registry
Trouble
TA0002, TA0003, T1053.005
Windows
Last updated: September 15, 2025
View details
Suspicious Schtasks Schedule Types
Trouble
TA0002, T1053.005
Windows
Last updated: September 15, 2025
View details
Suspicious Schtasks Schedule Type With High Privileges
Trouble
TA0002, T1053.005
Windows
Last updated: September 15, 2025
View details
Suspicious Command Patterns In Scheduled Task Creation
Trouble
TA0002, T1053.005
Windows
Last updated: September 15, 2025
View details
Schtasks Creation Or Modification With SYSTEM Privileges
Trouble
TA0002, TA0003, T1053.005
Windows
Last updated: September 15, 2025
View details
Script Event Consumer Spawning Process
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
New Service Creation Using Sc.EXE
Attention
TA0003, TA0004, T1543.003
Windows
Last updated: September 15, 2025
View details
Service StartupType Change Via Sc.EXE
Trouble
TA0002, TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
New Kernel Driver Via SC.EXE
Trouble
TA0003, TA0004, T1543.003
Windows
Last updated: September 15, 2025
View details
Interesting Service Enumeration Via Sc.EXE
Attention
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
Trouble
TA0003, T1543.003
Windows
Last updated: September 15, 2025
View details
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
Trouble
TA0003, T1543.003
Windows
Last updated: September 15, 2025
View details
Service DACL Abuse To Hide Services Via Sc.EXE
Trouble
TA0003, TA0005, TA0004, T1574.011
Windows
Last updated: September 15, 2025
View details
Service Security Descriptor Tampering Via Sc.EXE
Trouble
TA0003, TA0005, TA0004, T1574.011
Windows
Last updated: September 15, 2025
View details
Suspicious Service Path Modification
Trouble
TA0003, TA0004, T1543.003
Windows
Last updated: September 15, 2025
View details
Potential Persistence Attempt Via Existing Service Tampering
Trouble
TA0003, T1543.003
Windows
Last updated: September 15, 2025
View details
Stop Windows Service Via Sc.EXE
Attention
TA0040, T1489
Windows
Last updated: September 15, 2025
View details
Potential Shim Database Persistence via Sdbinst.EXE
Trouble
TA0003, TA0004, T1546.011
Windows
Last updated: September 15, 2025
View details
Uncommon Extension Shim Database Installation Via Sdbinst.EXE
Trouble
TA0003, TA0004, T1546.011
Windows
Last updated: September 15, 2025
View details
Sdclt Child Processes
Trouble
TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
Sdiagnhost Calling Suspicious Child Process
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Potential Suspicious Activity Using SeCEdit
Trouble
TA0007, TA0003, TA0005, TA0006, TA0004, T1082
Windows
Last updated: September 15, 2025
View details
Suspicious Serv-U Process Pattern
Trouble
TA0006, T1555
Windows
Last updated: September 15, 2025
View details
Uncommon Child Process Of Setres.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential SPN Enumeration Via Setspn.EXE
Trouble
TA0006, T1558.003
Windows
Last updated: September 15, 2025
View details
Suspicious Execution of Shutdown
Trouble
TA0040, T1529
Windows
Last updated: September 15, 2025
View details
Suspicious Execution of Shutdown to Log Out
Trouble
TA0040, T1529
Windows
Last updated: September 15, 2025
View details
Uncommon Sigverif.EXE Child Process
Trouble
TA0005, T1216
Windows
Last updated: September 15, 2025
View details
Uncommon Child Processes Of SndVol.exe
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Audio Capture via SoundRecorder
Trouble
TA0009, T1123
Windows
Last updated: September 15, 2025
View details
Suspicious Splwow64 Without Params
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Veeam Backup Database Suspicious Query
Trouble
TA0009, T1005
Windows
Last updated: September 15, 2025
View details
VeeamBackup Database Credentials Dump Via Sqlcmd.EXE
Trouble
TA0009, T1005
Windows
Last updated: September 15, 2025
View details
SQLite Chromium Profile Data DB Access
Trouble
TA0006, TA0009, T1539
Windows
Last updated: September 15, 2025
View details
SQLite Firefox Profile Data DB Access
Trouble
TA0006, TA0009, T1539
Windows
Last updated: September 15, 2025
View details
Arbitrary File Download Via Squirrel.EXE
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Process Proxy Execution Via Squirrel.EXE
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Port Forwarding Activity Via SSH.EXE
Trouble
TA0011, TA0008, T1572
Windows
Last updated: September 15, 2025
View details
Potential RDP Tunneling Via SSH
Trouble
TA0011, T1572
Windows
Last updated: September 15, 2025
View details
Potential Amazon SSM Agent Hijacking
Trouble
TA0011, TA0003, T1219.002
Windows
Last updated: September 15, 2025
View details
Execution via stordiag.exe
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Start of NT Virtual DOS Machine
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
User Added to Local Administrators Group
Trouble
TA0003, T1098
Windows
Last updated: September 15, 2025
View details
User Added To Highly Privileged Group
Trouble
TA0003, T1098
Windows
Last updated: September 15, 2025
View details
User Added to Remote Desktop Users Group
Trouble
TA0003, TA0008, T1133
Windows
Last updated: September 15, 2025
View details
Execute From Alternate Data Streams
Trouble
TA0005, T1564.004
Windows
Last updated: September 15, 2025
View details
Arbitrary Shell Command Execution Via Settingcontent-Ms
Trouble
TA0002, TA0001, T1204
Windows
Last updated: September 15, 2025
View details
Phishing Pattern ISO in Archive
Trouble
TA0001, T1566
Windows
Last updated: September 15, 2025
View details
Automated Collection Command Prompt
Trouble
TA0009, TA0006, T1119
Windows
Last updated: September 15, 2025
View details
Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Potential Suspicious Browser Launch From Document Reader Process
Trouble
TA0002, T1204.002
Windows
Last updated: September 15, 2025
View details
Potential Commandline Obfuscation Using Escape Characters
Trouble
TA0005, T1140
Windows
Last updated: September 15, 2025
View details
Potential Command Line Path Traversal Evasion Attempt
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Potential Browser Data Stealing
Trouble
TA0006, T1555.003
Windows
Last updated: September 15, 2025
View details
Copy From Or To Admin Share Or Sysvol Folder
Trouble
TA0008, TA0009, TA0010, T1021.002
Windows
Last updated: September 15, 2025
View details
Suspicious Copy From or To System Directory
Trouble
TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
LOL-Binary Copied From System Directory
Trouble
TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
Potential Crypto Mining Activity
Trouble
TA0040, T1496
Windows
Last updated: September 15, 2025
View details
Potential Data Exfiltration Activity Via CommandLine Tools
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Suspicious Double Extension File Execution
Trouble
TA0001, T1566.001
Windows
Last updated: September 15, 2025
View details
Suspicious Parent Double Extension File Execution
Trouble
TA0005, T1036.007
Windows
Last updated: September 15, 2025
View details
DumpStack.log Defender Evasion
Critical
TA0005
Windows
Last updated: September 15, 2025
View details
Always Install Elevated MSI Spawned Cmd And Powershell
Trouble
TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
Suspicious Electron Application Child Processes
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Electron Application CommandLine
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
ETW Logging Tamper In .NET Processes Via CommandLine
Trouble
TA0005, T1562
Windows
Last updated: September 15, 2025
View details
ETW Trace Evasion Activity
Trouble
TA0005, T1070
Windows
Last updated: September 15, 2025
View details
Suspicious Eventlog Clearing or Configuration Change Activity
Trouble
TA0005, T1070.001
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities
Trouble
TA0006, TA0007, T1552
Windows
Last updated: September 15, 2025
View details
Process Execution From A Potentially Suspicious Folder
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS
Trouble
TA0007, TA0002, T1615
Windows
Last updated: September 15, 2025
View details
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI
Trouble
TA0005, T1564.004
Windows
Last updated: September 15, 2025
View details
Writing Of Malicious Files To The Fonts Folder
Trouble
TA0005, TA0003, TA0002, T1211
Windows
Last updated: September 15, 2025
View details
Base64 MZ Header In CommandLine
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Potential WinAPI Calls Via CommandLine
Trouble
TA0002, T1106
Windows
Last updated: September 15, 2025
View details
Local Accounts Discovery
Attention
TA0007, T1033
Windows
Last updated: September 15, 2025
View details
LSASS Dump Keyword In CommandLine
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Potential File Download Via MS-AppInstaller Protocol Handler
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious Network Command
Attention
TA0007, T1016
Windows
Last updated: September 15, 2025
View details
Suspicious Scan Loop Network
Trouble
TA0002, TA0007, T1059
Windows
Last updated: September 15, 2025
View details
Potential Network Sniffing Activity Using Network Tools
Trouble
TA0006, TA0007, T1040
Windows
Last updated: September 15, 2025
View details
Process Launched Without Image Name
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Call To Win32_NTEventlogFile Class
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Use Short Name Path in Command Line
Trouble
TA0005, T1564.004
Windows
Last updated: September 15, 2025
View details
Use Short Name Path in Image
Trouble
TA0005, T1564.004
Windows
Last updated: September 15, 2025
View details
Use NTFS Short Name in Command Line
Trouble
TA0005, T1564.004
Windows
Last updated: September 15, 2025
View details
Use NTFS Short Name in Image
Trouble
TA0005, T1564.004
Windows
Last updated: September 15, 2025
View details
Suspicious Process Parents
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Potential PowerShell Execution Via DLL
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Private Keys Reconnaissance Via CommandLine Tools
Trouble
TA0006, T1552.004
Windows
Last updated: September 15, 2025
View details
Privilege Escalation via Named Pipe Impersonation
Trouble
TA0008, T1021
Windows
Last updated: September 15, 2025
View details
Windows Processes Suspicious Parent Directory
Attention
TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
Suspicious Program Names
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious Process Execution From Fake Recycle.Bin Folder
Trouble
TA0003, TA0005
Windows
Last updated: September 15, 2025
View details
Potential Remote Desktop Tunneling
Trouble
TA0008, T1021
Windows
Last updated: September 15, 2025
View details
Script Interpreter Execution From Suspicious Folder
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious Script Execution From Temp Folder
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious New Service Creation
Trouble
TA0003, TA0004, T1543.003
Windows
Last updated: September 15, 2025
View details
Suspicious Service Binary Directory
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Shadow Copies Creation Using Operating Systems Utilities
Trouble
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Shadow Copies Deletion Using Operating Systems Utilities
Trouble
TA0005, TA0040, T1070
Windows
Last updated: September 15, 2025
View details
Windows Shell/Scripting Processes Spawning Suspicious Programs
Trouble
TA0002, TA0005, T1059.005
Windows
Last updated: September 15, 2025
View details
Process Creation Using Sysnative Folder
Trouble
TA0005, TA0004, T1055
Windows
Last updated: September 15, 2025
View details
Tasks Folder Evasion
Trouble
TA0005, TA0003, TA0002, T1574.001
Windows
Last updated: September 15, 2025
View details
Suspicious Userinit Child Process
Trouble
TA0005, T1055
Windows
Last updated: September 15, 2025
View details
Malicious Windows Script Components File Execution by TAEF Detection
Attention
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Weak or Abused Passwords In CLI
Trouble
TA0005, TA0002
Windows
Last updated: September 15, 2025
View details
Usage Of Web Request Commands And Cmdlets
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Execution via WorkFolders.exe
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Suspect Svchost Activity
Trouble
TA0005, TA0004, T1055
Windows
Last updated: September 15, 2025
View details
Suspicious Process Masquerading As SvcHost.EXE
Trouble
TA0005, T1036.005
Windows
Last updated: September 15, 2025
View details
SAM SECURITY Hive Dump Possible Credential Theft
Critical
TA0006, T1003.002
Windows
Last updated: September 15, 2025
View
details
Possible DLL Injection by Regasm activity
Critical
TA0005, T1055
Windows
Last updated: September 15, 2025
View details
Hidden Local Account Detection
Critical
TA0003, T1136.001
Windows
Last updated: September 15, 2025
View details
Multiple file permission changes
Critical
TA0005, T1222
Windows
Last updated: September 15, 2025
View details
Repeated object audit policy changes
Critical
TA0005, T1562.002
Windows
Last updated: September 15, 2025
View details
Failed file access attempts
Critical
TA0009, TA0005, T1005
Windows
Last updated: September 15, 2025
View details
Repeated registry entry failures
Critical
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Multiple system audit policy changes
Critical
TA0005, T1562.002
Windows
Last updated: September 15, 2025
View details
Excessive application crashes
Critical
TA0040, T1499
Windows
Last updated: September 15, 2025
View details
Windows backup repeated failures
Critical
TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Notable account lockouts
Critical
TA0006, T1110.003
Windows
Last updated: September 15, 2025
View details
WinRAR Zero-Day vulnerability exploitation
Critical
TA0002, T1203
Windows
Last updated: September 15, 2025
View details
Windows Search RCE Exploitation
Critical
TA0002, T1203
Windows
Last updated: September 15, 2025
View details
QueueJumper Vulnerability Exploitation
Critical
TA0002, T1203
Windows
Last updated: September 15, 2025
View details
Microsoft Outlook Vulnerability Exploitation
Critical
TA0002, T1203
Windows
Last updated: September 15, 2025
View details
Built-in guest account privilege escalation
Critical
TA0004, T1078.001
Windows
Last updated: September 15, 2025
View details
Suspicious Failed Password Change Activity in Windows
Critical
TA0005, TA0004, T1556.001
Windows
Last updated: September 15, 2025
View details
Excessive Software Installation Attempts on Windows
Attention
TA0003, TA0004, TA0002, T1547
Windows
Last updated: September 15, 2025
View details
Excessive Software Update Attempts on Windows
Attention
TA0005, TA0002, TA0003, TA0004, T1078
Windows
Last updated: September 15, 2025
View details
Suspicious Windows Registry Access
Attention
TA0005, TA0004, TA0003, TA0002, T1112
Windows
Last updated: September 15, 2025
View details
Unauthorized Group Policy Object Deletion Detected
Attention
TA0004, TA0005, TA0006, TA0003, TA0001, T1098
Windows
Last updated: September 15, 2025
View details
Unauthorized Group Deletion Detected
Attention
TA0003, TA0004, TA0005, TA0006, TA0001, T1098
Windows
Last updated: September 15, 2025
View details
Excessive Windows File Modification
Critical
TA0040, T1485
Windows
Last updated: September 15, 2025
View details
Suspicious Scheduled Tasks created during non-working hours on Windows.
Critical
TA0003, TA0002, T1053.005
Windows
Last updated: September 15, 2025
View details
Suspicious Bulk File Modifications or Deletions on Windows
Critical
TA0040, TA0002, TA0009, TA0006, T1485
Windows
Last updated: September 15, 2025
View details
Suspicious successful password change activity in Windows.
Critical
TA0005, TA0004, T1556.001
Windows
Last updated: September 15, 2025
View details
Suspicious successful password change activity on a workstation.
Attention
TA0006, TA0005, TA0003, TA0004, TA0001, T1556.001
Windows
Last updated: September 15, 2025
View details
Suspicious failed password change activity on a workstation.
Attention
TA0006, TA0005, TA0003, TA0004, TA0001, T1556.001
Windows
Last updated: September 15, 2025
View details
Failed DNS Zone Transfer
Trouble
TA0043, T1590.002
Active Directory
Last updated: September 15, 2025
View details
DNS Server Error Failed Loading the ServerLevelPluginDLL
Trouble
TA0005, T1574.001
Active Directory
Last updated: September 15, 2025
View details
Ntdsutil Abuse
Trouble
TA0006, T1003.003
Active Directory
Last updated: September 15, 2025
View
details
Dump Ntds.dit To Suspicious Location
Trouble
TA0002
Active Directory
Last updated: September 15, 2025
View details
Powerview Add-DomainObjectAcl DCSync AD Extend Right
Trouble
TA0003, T1098
Active Directory
Last updated: September 15, 2025
View details
AD Privileged Users or Groups Reconnaissance
Trouble
TA0007, T1087.002
Active Directory
Last updated: September 15, 2025
View details
Add or Remove Computer from DC
Attention
TA0005, T1207
Active Directory
Last updated: September 15, 2025
View details
Access To ADMIN$ Network Share
Attention
TA0008, T1021.002
Active Directory
Last updated: September 15, 2025
View details
AD Object WriteDAC Access
Critical
TA0005, T1222.001
Active Directory
Last updated: September 15, 2025
View details
Active Directory Replication from Non Machine Account
Critical
TA0006, T1003.006
Active Directory
Last updated: September 15, 2025
View details
Enabled User Right in AD to Control User Objects
Trouble
TA0003, T1098
Active Directory
Last updated: September 15, 2025
View details
Active Directory User Backdoors
Trouble
TA0003, T1098
Active Directory
Last updated: September 15, 2025
View details
Mimikatz DC Sync
Trouble
TA0006, T1003.006
Active Directory
Last updated: September 15, 2025
View
details
DPAPI Domain Backup Key Extraction
Trouble
TA0006, T1003.004
Active Directory
Last updated: September 15, 2025
View details
Hidden Local User Creation
Trouble
TA0003, T1136.001
Active Directory
Last updated: September 15, 2025
View details
Kerberoasting Activity - Initial Query
Trouble
TA0006, T1558.003
Active Directory
Last updated: September 15, 2025
View details
Credential Dumping Tools Service Execution - Security
Trouble
TA0006, TA0002, T1003.001
Active Directory
Last updated: September 15, 2025
View details
A Member Was Added to a Security-Enabled Global Group
Attention
TA0003, T1098
Active Directory
Last updated: September 15, 2025
View details
A Member Was Removed From a Security-Enabled Global Group
Attention
TA0003, T1098
Active Directory
Last updated: September 15, 2025
View details
New or Renamed User Account with '$' Character
Trouble
TA0005, T1036
Active Directory
Last updated: September 15, 2025
View details
Password Policy Enumerated
Trouble
TA0007, T1201
Active Directory
Last updated: September 15, 2025
View details
Pass the Hash Activity 2
Trouble
TA0008, T1550.002
Active Directory
Last updated: September 15, 2025
View details
Possible DC Shadow Attack
Trouble
TA0006, TA0005, T1207
Active Directory
Last updated: September 15, 2025
View details
A Security-Enabled Global Group Was Deleted
Attention
TA0003, T1098
Active Directory
Last updated: September 15, 2025
View details
A New Trust Was Created To A Domain
Trouble
TA0003, T1098
Active Directory
Last updated: September 15, 2025
View details
Potential Compromise of DSRM Account
Trouble
TA0003, T1098
Active Directory
Last updated: September 15, 2025
View
details
Group Policy Abuse for Privilege Addition
Trouble
TA0004, T1484.001
Active Directory
Last updated: September 15, 2025
View details
Potential Discovery Activity Via Dnscmd.EXE
Trouble
TA0007, TA0002
Active Directory
Last updated: September 15, 2025
View details
ADSI-Cache File Creation By Uncommon Tool
Trouble
TA0011, T1001.003
Active Directory
Last updated: September 15, 2025
View details
NTDS.DIT Created
Attention
TA0006, T1003.003
Active Directory
Last updated: September 15, 2025
View
details
NTDS.DIT Creation By Uncommon Process
Trouble
TA0006, T1003.002
Active Directory
Last updated: September 15, 2025
View details
NTDS Exfiltration Filename Patterns
Trouble
TA0006, T1003.003
Active Directory
Last updated: September 15, 2025
View details
DPAPI Backup Keys And Certificate Export Activity IOC
Trouble
TA0006, T1555
Active Directory
Last updated: September 15, 2025
View details
Potential Azure Browser SSO Abuse
Attention
TA0005, TA0004, T1574.001
Active Directory
Last updated: September 15, 2025
View details
Active Directory Parsing DLL Loaded Via Office Application
Trouble
TA0002, T1204.002
Active Directory
Last updated: September 15, 2025
View details
Active Directory Kerberos DLL Loaded Via Office Application
Trouble
TA0002, T1204.002
Active Directory
Last updated: September 15, 2025
View details
Uncommon Connection to Active Directory Web Services
Trouble
TA0007, T1087
Active Directory
Last updated: September 15, 2025
View details
AADInternals PowerShell Cmdlets Execution - PsScript
Trouble
TA0002, TA0043, TA0007, TA0006, TA0040
Active Directory
Last updated: September 15, 2025
View details
Potential Active Directory Enumeration Using AD Module - PsScript
Trouble
TA0043, TA0007, TA0040
Active Directory
Last updated: September 15, 2025
View details
PowerShell ADRecon Execution
Trouble
TA0007, TA0002, T1059.001
Active Directory
Last updated: September 15, 2025
View details
Get-ADUser Enumeration Using UserAccountControl Flags
Trouble
TA0007, T1033
Active Directory
Last updated: September 15, 2025
View details
Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell
Trouble
TA0007, T1033
Active Directory
Last updated: September 15, 2025
View details
Create Volume Shadow Copy with Powershell
Trouble
TA0006, T1003.003
Active Directory
Last updated: September 15, 2025
View details
DirectorySearcher Powershell Exploitation
Trouble
TA0007, T1018
Active Directory
Last updated: September 15, 2025
View details
Manipulation of User Computer or Group Security Principals Across AD
Trouble
TA0003, T1136.002
Active Directory
Last updated: September 15, 2025
View details
DSInternals Suspicious PowerShell Cmdlets - ScriptBlock
Trouble
TA0002, T1059.001
Active Directory
Last updated: September 15, 2025
View details
Active Directory Computers Enumeration With Get-AdComputer
Attention
TA0007, T1018
Active Directory
Last updated: September 15, 2025
View details
Active Directory Group Enumeration With Get-AdGroup
Attention
TA0007, T1069.002
Active Directory
Last updated: September 15, 2025
View details
Suspicious Get-ADReplAccount
Trouble
TA0006, T1003.006
Active Directory
Last updated: September 15, 2025
View details
HackTool - WinPwn Execution - ScriptBlock
Trouble
TA0006, TA0005, TA0007, TA0002, TA0004, T1552.001
Active Directory
Last updated: September 15, 2025
View details
Modify Group Policy Settings - ScriptBlockLogging
Trouble
TA0005, TA0004, T1484.001
Active Directory
Last updated: September 15, 2025
View details
Request A Single Ticket via PowerShell
Trouble
TA0006, T1558.003
Active Directory
Last updated: September 15, 2025
View details
AD Groups Or Users Enumeration Using PowerShell - ScriptBlock
Attention
TA0007, T1069.001
Active Directory
Last updated: September 15, 2025
View details
Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy
Attention
TA0007, T1201
Active Directory
Last updated: September 15, 2025
View details
Suspicious GPO Discovery With Get-GPO
Attention
TA0007, T1615
Active Directory
Last updated: September 15, 2025
View details
Suspicious Connection to Remote Account
Attention
TA0006, T1110.001
Active Directory
Last updated: September 15, 2025
View details
Remove Account From Domain Admin Group
Trouble
TA0040, T1531
Active Directory
Last updated: September 15, 2025
View details
User Discovery And Export Via Get-ADUser Cmdlet - PowerShell
Trouble
TA0007, T1033
Active Directory
Last updated: September 15, 2025
View details
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
Trouble
TA0005, T1574.001
Active Directory
Last updated: September 15, 2025
View details
Potentially Over Permissive Permissions Granted Using Dsacls.EXE
Trouble
TA0005, T1218
Active Directory
Last updated: September 15, 2025
View details
Potential Password Spraying Attempt Using Dsacls.EXE
Trouble
TA0005, T1218
Active Directory
Last updated: September 15, 2025
View details
Domain Trust Discovery Via Dsquery
Trouble
TA0007, T1482
Active Directory
Last updated: September 15, 2025
View details
Esentutl Gather Credentials
Trouble
TA0006, T1003
Active Directory
Last updated: September 15, 2025
View details
HackTool - ADCSPwn Execution
Trouble
TA0006, T1557.001
Active Directory
Last updated: September 15, 2025
View details
Terminal Service Process Spawn
Trouble
TA0001, TA0008, T1190
Windows
Last updated: September 15, 2025
View details
Uncommon Svchost Parent Process
Trouble
TA0005, T1036.005
Windows
Last updated: September 15, 2025
View details
Permission Check Via Accesschk.EXE
Trouble
TA0007, T1069.001
Windows
Last updated: September 15, 2025
View details
Potential Execution of Sysinternals Tools
Attention
TA0042, T1588.002
Windows
Last updated: September 15, 2025
View details
Potential Memory Dumping Activity Via LiveKD
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Procdump Execution
Trouble
TA0005, TA0006, T1036
Windows
Last updated: September 15, 2025
View
details
Potential SysInternals ProcDump Evasion
Trouble
TA0005, TA0006, T1036
Windows
Last updated: September 15, 2025
View details
Potential LSASS Process Dump Via Procdump
Trouble
TA0005, TA0006, T1036
Windows
Last updated: September 15, 2025
View details
Psexec Execution
Trouble
TA0002, TA0008, T1569
Windows
Last updated: September 15, 2025
View
details
PsExec/PAExec Escalation to LOCAL SYSTEM
Trouble
TA0042, T1587.001
Windows
Last updated: September 15, 2025
View details
Potential PsExec Remote Execution
Trouble
TA0042, T1587.001
Windows
Last updated: September 15, 2025
View details
Suspicious Use of PsLogList
Trouble
TA0007, T1087
Windows
Last updated: September 15, 2025
View details
Sysinternals PsService Execution
Trouble
TA0007, TA0003, T1543.003
Windows
Last updated: September 15, 2025
View details
Sysinternals PsSuspend Execution
Trouble
TA0007, TA0003, T1543.003
Windows
Last updated: September 15, 2025
View details
Sysinternals PsSuspend Suspicious Execution
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Potential File Overwrite Via Sysinternals SDelete
Trouble
TA0040, T1485
Windows
Last updated: September 15, 2025
View details
Potential Privilege Escalation To LOCAL SYSTEM
Trouble
TA0042, T1587.001
Windows
Last updated: September 15, 2025
View details
Sysmon Configuration Update
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Uninstall Sysinternals Sysmon
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Sysprep on AppData Folder
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious Execution of Systeminfo
Attention
TA0007, T1082
Windows
Last updated: September 15, 2025
View details
Potential Signing Bypass Via Windows Developer Features
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Suspicious Recursive Takeown
Trouble
TA0005, T1222.001
Windows
Last updated: September 15, 2025
View details
Compressed File Creation Via Tar.EXE
Attention
TA0009, TA0010, T1560
Windows
Last updated: September 15, 2025
View details
Compressed File Extraction Via Tar.EXE
Attention
TA0009, TA0010, T1560
Windows
Last updated: September 15, 2025
View details
Taskkill Symantec Endpoint Protection
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Loaded Module Enumeration Via Tasklist.EXE
Trouble
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
New Process Created Via Taskmgr.EXE
Attention
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Command Targeting Teams Sensitive Files
Trouble
TA0006, T1528
Windows
Last updated: September 15, 2025
View details
New Virtual Smart Card Created Via TpmVscMgr.EXE
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Suspicious RDP Redirect Using TSCON
Trouble
TA0008, T1563.002
Windows
Last updated: September 15, 2025
View details
Bypass UAC via Fodhelper.exe
Trouble
TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
UAC Bypass via Windows Firewall Snap-In Hijack
Trouble
TA0004, T1548
Windows
Last updated: September 15, 2025
View details
UAC Bypass via ICMLuaUtil
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
Bypass UAC via WSReset.exe
Trouble
TA0004, TA0005, T1548.002
Windows
Last updated: September 15, 2025
View details
Use of UltraVNC Remote Access Software
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Suspicious UltraVNC Execution
Trouble
TA0008, T1021.005
Windows
Last updated: September 15, 2025
View details
Uninstall Crowdstrike Falcon Sensor
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Uncommon Userinit Child Process
Trouble
TA0003, T1037.001
Windows
Last updated: September 15, 2025
View details
Windows Credential Manager Access via VaultCmd
Trouble
TA0006, T1555.004
Windows
Last updated: September 15, 2025
View details
Verclsid.exe Runs COM Object
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Detect Virtualbox Driver Installation OR Starting Of VMs
Attention
TA0005, TA0005, T1564
Windows
Last updated: September 15, 2025
View details
Suspicious VBoxDrvInst.exe Parameters
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
Trouble
TA0002, TA0003, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
Trouble
TA0002, TA0003, T1059
Windows
Last updated: September 15, 2025
View details
VMToolsd Suspicious Child Process
Trouble
TA0002, TA0003, T1059
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Child Process Of VsCode
Trouble
TA0002, TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Visual Studio Code Tunnel Execution
Trouble
TA0011, T1071.001
Windows
Last updated: September 15, 2025
View details
Visual Studio Code Tunnel Shell Execution
Trouble
TA0011, T1071.001
Windows
Last updated: September 15, 2025
View details
Renamed Visual Studio Code Tunnel Execution
Trouble
TA0011, T1071.001
Windows
Last updated: September 15, 2025
View details
Visual Studio Code Tunnel Service Installation
Trouble
TA0011, T1071.001
Windows
Last updated: September 15, 2025
View details
Potential Binary Proxy Execution Via VSDiagnostics.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious Vsls-Agent Command With AgentExtensionPath Load
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Wab Execution From Non Default Location
Trouble
TA0005, TA0002
Windows
Last updated: September 15, 2025
View details
Wab/Wabmig Unusual Parent Or Child Processes
Trouble
TA0005, TA0002
Windows
Last updated: September 15, 2025
View details
All Backups Deleted Via Wbadmin.EXE
Trouble
TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Windows Backup Deleted Via Wbadmin.EXE
Trouble
TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Sensitive File Dump Via Wbadmin.EXE
Trouble
TA0006, T1003.003
Windows
Last updated: September 15, 2025
View details
File Recovery From Backup Via Wbadmin.EXE
Trouble
TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Sensitive File Recovery From Backup Via Wbadmin.EXE
Trouble
TA0006, T1003.003
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious WebDAV LNK Execution
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Webshell Hacking Activity Patterns
Trouble
TA0003, TA0007, T1505.003
Windows
Last updated: September 15, 2025
View details
Webshell Detection With Command Line Keywords
Trouble
TA0003, TA0007, T1505.003
Windows
Last updated: September 15, 2025
View details
Suspicious Process By Web Server Process
Trouble
TA0003, TA0001, T1505.003
Windows
Last updated: September 15, 2025
View details
Webshell Tool Reconnaissance Activity
Trouble
TA0003, T1505.003
Windows
Last updated: September 15, 2025
View details
Potential ReflectDebugger Content Execution Via WerFault.EXE
Trouble
TA0002, TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Suspicious Child Process Of Wermgr.EXE
Trouble
TA0005, TA0004, T1055
Windows
Last updated: September 15, 2025
View details
Suspicious Execution Location Of Wermgr.EXE
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Suspicious Where Execution
Attention
TA0007, T1217
Windows
Last updated: September 15, 2025
View details
Suspicious WindowsTerminal Child Processes
Trouble
TA0002, TA0003
Windows
Last updated: September 15, 2025
View details
Add New Download Source To Winget
Trouble
TA0005, TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Add Insecure Download Source To Winget
Trouble
TA0005, TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Install New Package Via Winget Local Manifest
Trouble
TA0005, TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Winrar Compressing Dump Files
Trouble
TA0009, T1560.001
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Child Process Of WinRAR.EXE
Trouble
TA0002, T1203
Windows
Last updated: September 15, 2025
View details
Winrar Execution in Non-Standard Folder
Trouble
TA0009, T1560.001
Windows
Last updated: September 15, 2025
View details
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl
Trouble
TA0005, T1216
Windows
Last updated: September 15, 2025
View details
Remote Code Execute via Winrm.vbs
Trouble
TA0005, T1216
Windows
Last updated: September 15, 2025
View details
Remote PowerShell Session Host Process (WinRM)
Trouble
TA0002, TA0008, T1059.001
Windows
Last updated: September 15, 2025
View details
Suspicious Processes Spawned by WinRM
Trouble
TA0001, TA0003, TA0004, T1190
Windows
Last updated: September 15, 2025
View details
Wlrmdr.EXE Uncommon Argument Or Child Process
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
New ActiveScriptEventConsumer Created Via Wmic.EXE
Trouble
TA0003, T1546.003
Windows
Last updated: September 15, 2025
View details
Potential Windows Defender Tampering Via Wmic.EXE
Trouble
TA0005, TA0002, T1562
Windows
Last updated: September 15, 2025
View details
New Process Created Via Wmic.EXE
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Computer System Reconnaissance Via Wmic.EXE
Trouble
TA0007, TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Hardware Model Reconnaissance Via Wmic.EXE
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Local Groups Reconnaissance Via Wmic.EXE
Attention
TA0007, T1069.001
Windows
Last updated: September 15, 2025
View details
Windows Hotfix Updates Reconnaissance Via Wmic.EXE
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Process Reconnaissance Via Wmic.EXE
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Potential Product Reconnaissance Via Wmic.EXE
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Potential Product Class Reconnaissance Via Wmic.EXE
Trouble
TA0002, TA0007, T1047
Windows
Last updated: September 15, 2025
View details
Service Reconnaissance Via Wmic.EXE
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Uncommon System Information Discovery Via Wmic.EXE
Trouble
TA0007, T1082
Windows
Last updated: September 15, 2025
View details
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
System Disk And Volume Reconnaissance Via Wmic.EXE
Trouble
TA0002, TA0007, T1047
Windows
Last updated: September 15, 2025
View details
WMIC Remote Command Execution
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Lace Tempest PowerShell Evidence Eraser
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Lace Tempest PowerShell Launcher
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Access to Browser Login Data
Trouble
TA0006, T1555.003
Windows
Last updated: September 15, 2025
View details
Powershell Add Name Resolution Policy Table Rule
Trouble
TA0040, T1565
Windows
Last updated: September 15, 2025
View details
Add Windows Capability Via PowerShell Script
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
AMSI Bypass Pattern Assembly GetType
Trouble
TA0005, TA0002, T1562.001
Windows
Last updated: September 15, 2025
View details
Silence.EDA Detection
Critical
TA0002, TA0011, TA0040, T1059.001
Windows
Last updated: September 15, 2025
View details
Potential Data Exfiltration Via Audio File
Trouble
TA0010
Windows
Last updated: September 15, 2025
View details
Automated Collection Command PowerShell
Trouble
TA0009, T1119
Windows
Last updated: September 15, 2025
View details
Windows Screen Capture with CopyFromScreen
Trouble
TA0009, T1113
Windows
Last updated: September 15, 2025
View details
Clearing Windows Console History
Trouble
TA0005, T1070
Windows
Last updated: September 15, 2025
View details
Clear PowerShell History - PowerShell
Trouble
TA0005, T1070.003
Windows
Last updated: September 15, 2025
View details
Powershell Create Scheduled Task
Trouble
TA0003, T1053.005
Windows
Last updated: September 15, 2025
View details
Registry-Free Process Scope COR_PROFILER
Trouble
TA0003, T1574.012
Windows
Last updated: September 15, 2025
View details
Powershell Detect Virtualization Environment
Trouble
TA0005, T1497.001
Windows
Last updated: September 15, 2025
View details
Disable Powershell Command History
Trouble
TA0005, T1070.003
Windows
Last updated: September 15, 2025
View details
Disable-WindowsOptionalFeature Command PowerShell
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Potential In-Memory Execution Using Reflection.Assembly
Trouble
TA0005, T1620
Windows
Last updated: September 15, 2025
View details
Potential COM Objects Download Cradles Usage - PS Script
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Dump Credentials from Windows Credential Manager With PowerShell
Trouble
TA0006, T1555
Windows
Last updated: September 15, 2025
View details
Potential Suspicious Windows Feature Enabled
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Enumerate Credentials from Windows Credential Manager With PowerShell
Trouble
TA0006, T1555
Windows
Last updated: September 15, 2025
View details
Disable of ETW Trace - Powershell
Trouble
TA0005, T1070
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell Mailbox SMTP Forward Rule
Trouble
TA0010
Windows
Last updated: September 15, 2025
View details
Certificate Exported Via PowerShell - ScriptBlock
Trouble
TA0006, T1552.004
Windows
Last updated: September 15, 2025
View details
Suspicious FromBase64String Usage On Gzip Archive - Ps Script
Trouble
TA0011, T1132.001
Windows
Last updated: September 15, 2025
View details
Service Registry Permissions Weakness Check
Trouble
TA0003, T1574.011
Windows
Last updated: September 15, 2025
View details
Automated Collection Bookmarks Using Get-ChildItem PowerShell
Attention
TA0007, T1217
Windows
Last updated: September 15, 2025
View details
HackTool - Rubeus Execution - ScriptBlock
Trouble
TA0006, TA0008, T1003
Windows
Last updated: September 15, 2025
View details
PowerShell ICMP Exfiltration
Trouble
TA0010, T1048.003
Windows
Last updated: September 15, 2025
View details
Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript
Trouble
TA0003, TA0005
Windows
Last updated: September 15, 2025
View details
Execute Invoke-command on Remote Host
Trouble
TA0008, T1021.006
Windows
Last updated: September 15, 2025
View details
Powershell DNSExfiltration
Trouble
TA0010, T1048
Windows
Last updated: September 15, 2025
View details
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
Trouble
TA0005, TA0002, T1027
Windows
Last updated: September 15, 2025
View details
Invoke-Obfuscation Via Use MSHTA - PowerShell
Trouble
TA0005, TA0002, T1027
Windows
Last updated: September 15, 2025
View details
Invoke-Obfuscation Via Use Rundll32 - PowerShell
Trouble
TA0005, TA0002, T1027
Windows
Last updated: September 15, 2025
View details
Powershell Keylogging
Trouble
TA0009, T1056.001
Windows
Last updated: September 15, 2025
View details
Powershell LocalAccount Manipulation
Trouble
TA0003, T1098
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell Mailbox Export to Share - PS
Critical
TA0010
Windows
Last updated: September 15, 2025
View details
Malicious PowerShell Keywords
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Live Memory Dump Using Powershell
Trouble
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Powershell MsXml COM Object
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Malicious Nishang PowerShell Commandlets
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
NTFS Alternate Data Stream
Trouble
TA0005, TA0002, T1564.004
Windows
Last updated: September 15, 2025
View details
Code Executed Via Office Add-in XLL File
Trouble
TA0003, T1137.006
Windows
Last updated: September 15, 2025
View details
Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock
Trouble
TA0006, TA0007, T1040
Windows
Last updated: September 15, 2025
View details
Potential Invoke-Mimikatz PowerShell Script
Trouble
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
PowerShell Web Access Installation - PsScript
Trouble
TA0003, TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
PowerShell Credential Prompt
Trouble
TA0006, TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
PSAsyncShell - Asynchronous TCP Reverse Shell
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
PowerShell Remote Session Creation
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
PowerShell Script With File Hostname Resolving Capabilities
Trouble
TA0010, T1020
Windows
Last updated: September 15, 2025
View details
Root Certificate Installed - PowerShell
Trouble
TA0005, T1553.004
Windows
Last updated: September 15, 2025
View details
Suspicious Invoke-Item From Mount-DiskImage
Trouble
TA0005, T1553.005
Windows
Last updated: September 15, 2025
View details
PowerShell Script With File Upload Capabilities
Attention
TA0010, T1020
Windows
Last updated: September 15, 2025
View details
Powershell Sensitive File Discovery
Trouble
TA0007, T1083
Windows
Last updated: September 15, 2025
View details
PowerShell Script Change Permission Via Set-Acl - PsScript
Attention
TA0005, T1222
Windows
Last updated: September 15, 2025
View details
PowerShell ShellCode
Trouble
TA0005, TA0004, TA0002, T1055
Windows
Last updated: September 15, 2025
View details
Malicious ShellIntel PowerShell Commandlets
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Detected Windows Software Discovery - PowerShell
Trouble
TA0007, T1518
Windows
Last updated: September 15, 2025
View details
Powershell Store File In Alternate Data Stream
Trouble
TA0005, T1564.004
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Security Descriptors - ScriptBlock
Trouble
TA0003, TA0005, TA0004
Windows
Last updated: September 15, 2025
View details
Potential PowerShell Obfuscation Using Character Join
Attention
TA0005, TA0002, T1027
Windows
Last updated: September 15, 2025
View details
Suspicious Eventlog Clear
Trouble
TA0005, T1070.001
Windows
Last updated: September 15, 2025
View details
Powershell Directory Enumeration
Trouble
TA0007, T1083
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell Download - Powershell Script
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Powershell Execute Batch Script
Trouble
TA0002, T1059.003
Windows
Last updated: September 15, 2025
View details
Extracting Information with PowerShell
Trouble
TA0006, T1552.001
Windows
Last updated: September 15, 2025
View details
Troubleshooting Pack Cmdlet Execution
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
PowerShell Get-Process LSASS in ScriptBlock
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Suspicious GetTypeFromCLSID ShellExecute
Trouble
TA0004, TA0003, T1546.015
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell Get Current User
Attention
TA0007, T1033
Windows
Last updated: September 15, 2025
View details
Suspicious Process Discovery With Get-Process
Attention
TA0007, T1057
Windows
Last updated: September 15, 2025
View details
Suspicious Hyper-V Cmdlets
Trouble
TA0005, T1564.006
Windows
Last updated: September 15, 2025
View details
Change User Agents with WebRequest
Trouble
TA0011, T1071.001
Windows
Last updated: September 15, 2025
View details
Suspicious IO.FileStream
Trouble
TA0005, T1070.003
Windows
Last updated: September 15, 2025
View details
Potential Keylogger Activity
Trouble
TA0009, TA0006, T1056.001
Windows
Last updated: September 15, 2025
View details
Potential Suspicious PowerShell Keywords
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Suspicious Get Local Groups Information - PowerShell
Attention
TA0007, T1069.001
Windows
Last updated: September 15, 2025
View details
Powershell Local Email Collection
Trouble
TA0009, T1114.001
Windows
Last updated: September 15, 2025
View details
PowerShell Deleted Mounted Share
Trouble
TA0005, T1070.005
Windows
Last updated: September 15, 2025
View details
Suspicious Mount-DiskImage
Attention
TA0005, T1553.005
Windows
Last updated: September 15, 2025
View details
Suspicious New-PSDrive to Admin Share
Trouble
TA0008, T1021.002
Windows
Last updated: September 15, 2025
View details
Suspicious TCP Tunnel Via PowerShell Script
Trouble
TA0011, T1090
Windows
Last updated: September 15, 2025
View details
Recon Information for Export with PowerShell
Trouble
TA0009, T1119
Windows
Last updated: September 15, 2025
View details
Suspicious Service DACL Modification Via Set-Service Cmdlet - PS
Trouble
TA0003, TA0005, TA0004, T1574.011
Windows
Last updated: September 15, 2025
View details
Potential PowerShell Obfuscation Using Alias Cmdlets
Attention
TA0005, TA0002, T1027
Windows
Last updated: September 15, 2025
View details
Suspicious Get Information for SMB Share
Attention
TA0007, T1069.001
Windows
Last updated: September 15, 2025
View details
Suspicious SSL Connection
Attention
TA0011, T1573
Windows
Last updated: September 15, 2025
View details
Suspicious Start-Process PassThru
Trouble
TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
Suspicious Unblock-File
Trouble
TA0005, T1553.005
Windows
Last updated: September 15, 2025
View details
Replace Desktop Wallpaper by Powershell
Attention
TA0040, T1491.001
Windows
Last updated: September 15, 2025
View details
Powershell Suspicious Win32_PnPEntity
Attention
TA0007, T1120
Windows
Last updated: September 15, 2025
View details
Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script
Trouble
TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell WindowStyle Option
Trouble
TA0005, T1564.003
Windows
Last updated: September 15, 2025
View details
PowerShell Write-EventLog Usage
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Tamper Windows Defender - ScriptBlockLogging
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
HackTool - Certify Execution
Trouble
TA0007, TA0006, T1649
Active Directory
Last updated: September 15, 2025
View details
HackTool - Certipy Execution
Trouble
TA0007, TA0006, T1649
Active Directory
Last updated: September 15, 2025
View details
HackTool - SharpLdapWhoami Execution
Trouble
TA0007, T1033
Active Directory
Last updated: September 15, 2025
View details
HackTool - SharpView Execution
Trouble
TA0007, T1049
Active Directory
Last updated: September 15, 2025
View details
HackTool - SharpLDAPmonitor Execution
Trouble
TA0007
Active Directory
Last updated: September 15, 2025
View details
HackTool - SOAPHound Execution
Trouble
TA0007, T1087
Active Directory
Last updated: September 15, 2025
View details
HackTool - TruffleSnout Execution
Trouble
TA0007, T1482
Active Directory
Last updated: September 15, 2025
View details
HackTool - WinPwn Execution
Trouble
TA0006, TA0005, TA0007, TA0002, TA0004, T1552.001
Active Directory
Last updated: September 15, 2025
View details
Active Directory Structure Export Via Ldifde.EXE
Trouble
TA0010
Active Directory
Last updated: September 15, 2025
View details
Import LDAP Data Interchange Format File Via Ldifde.EXE
Trouble
TA0011, TA0005, T1105
Active Directory
Last updated: September 15, 2025
View details
Potential Credential Dumping Via LSASS Process Clone
Critical
TA0006, T1003
Active Directory
Last updated: September 15, 2025
View details
Suspicious Group And Account Reconnaissance Activity Using Net.EXE
Trouble
TA0007, T1087.001
Active Directory
Last updated: September 15, 2025
View details
Nltest.EXE Execution
Attention
TA0007, T1016
Active Directory
Last updated: September 15, 2025
View details
Potential Recon Activity Via Nltest.EXE
Trouble
TA0007, T1016
Active Directory
Last updated: September 15, 2025
View details
Network Reconnaissance Activity
Trouble
TA0007, T1087
Active Directory
Last updated: September 15, 2025
View details
Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)
Trouble
TA0006, T1003.003
Active Directory
Last updated: September 15, 2025
View details
Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
Trouble
TA0006, T1003.003
Active Directory
Last updated: September 15, 2025
View details
AADInternals PowerShell Cmdlets Execution - ProccessCreation
Trouble
TA0002, TA0043, TA0007, TA0006, TA0040
Active Directory
Last updated: September 15, 2025
View details
Potential Active Directory Enumeration Using AD Module - ProcCreation
Trouble
TA0043, TA0007, TA0040
Active Directory
Last updated: September 15, 2025
View details
Computer Discovery And Export Via Get-ADComputer Cmdlet
Trouble
TA0007, T1033
Active Directory
Last updated: September 15, 2025
View details
DSInternals Suspicious PowerShell Cmdlets
Trouble
TA0002, T1059.001
Active Directory
Last updated: September 15, 2025
View details
User Discovery And Export Via Get-ADUser Cmdlet
Trouble
TA0007, T1033
Active Directory
Last updated: September 15, 2025
View details
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE
Trouble
TA0007, T1087.002
Active Directory
Last updated: September 15, 2025
View details
PUA - AdFind Suspicious Execution
Trouble
TA0007, T1018
Active Directory
Last updated: September 15, 2025
View details
PUA - DIT Snapshot Viewer
Trouble
TA0006, T1003.003
Active Directory
Last updated: September 15, 2025
View details
PUA - PingCastle Execution From Potentially Suspicious Parent
Trouble
TA0043, T1595
Active Directory
Last updated: September 15, 2025
View details
PUA - Adidnsdump Execution
Attention
TA0007, T1018
Active Directory
Last updated: September 15, 2025
View details
Modify Group Policy Settings
Trouble
TA0005, TA0004, T1484.001
Active Directory
Last updated: September 15, 2025
View details
Enable LM Hash Storage - ProcCreation
Trouble
TA0005, T1112
Active Directory
Last updated: September 15, 2025
View details
Renamed AdFind Execution
Trouble
TA0007, T1018
Active Directory
Last updated: September 15, 2025
View details
Suspicious Process Patterns NTDS.DIT Exfil
Trouble
TA0006, T1003.003
Active Directory
Last updated: September 15, 2025
View details
Suspicious SYSVOL Domain Group Policy Access
Trouble
TA0006, T1552.006
Active Directory
Last updated: September 15, 2025
View details
Active Directory Database Snapshot Via ADExplorer
Trouble
TA0007, T1087.002
Active Directory
Last updated: September 15, 2025
View details
Suspicious Active Directory Database Snapshot Via ADExplorer
Trouble
TA0007, T1087.002
Active Directory
Last updated: September 15, 2025
View details
Directory Service Restore Mode(DSRM) Registry Value Tampering
Trouble
TA0003, T1556
Active Directory
Last updated: September 15, 2025
View details
Enable LM Hash Storage
Trouble
TA0005, T1112
Active Directory
Last updated: September 15, 2025
View details
DNS Server Discovery Via LDAP Query
Attention
TA0007, T1482
Active Directory
Last updated: September 15, 2025
View details
ADFS Database Named Pipe Connection By Uncommon Tool
Trouble
TA0009, T1005
Active Directory
Last updated: September 15, 2025
View details
Standard User In High Privileged Group
Trouble
TA0006, TA0004
Active Directory
Last updated: September 15, 2025
View details
ADCS Certificate Template Configuration Vulnerability
Attention
TA0004, TA0006
Active Directory
Last updated: September 15, 2025
View details
ADCS Certificate Template Configuration Vulnerability with Risky EKU
Trouble
TA0004, TA0006
Active Directory
Last updated: September 15, 2025
View details
Persistence and Execution at Scale via GPO Scheduled Task
Trouble
TA0003, TA0008, T1053.005
Active Directory
Last updated: September 15, 2025
View details
Possible Impacket SecretDump Remote Activity
Trouble
TA0006, T1003.002
Active Directory
Last updated: September 15, 2025
View details
Startup/Logon Script Added to Group Policy Object
Trouble
TA0004, T1484.001
Active Directory
Last updated: September 15, 2025
View details
Computer Password Change Via Ksetup.EXE
Trouble
TA0002
Active Directory
Last updated: September 15, 2025
View details
Logged-On User Password Change Via Ksetup.EXE
Trouble
TA0002
Active Directory
Last updated: September 15, 2025
View details
Anomalous Windows GPO Modification Outside Usual Working Hours
Critical
TA0005, TA0004, T1484
Active Directory
Last updated: September 15, 2025
View details
Suspicious Password Change on Directory Service Restore Mode (DSRM) Account
Trouble
TA0003, T1098
Active Directory
Last updated: September 15, 2025
View details
AWS EC2 Deprecated AMI Discovery
Attention
TA0007, T1580
AWS
Last updated: September 15, 2025
View details
AWS EC2 Encryption Disabled
Trouble
TA0040, T1565.001
AWS
Last updated: September 15, 2025
View details
AWS EC2 Full Network Packet Capture Detected
Trouble
TA0010, TA0009, T1020
AWS
Last updated: September 15, 2025
View details
AWS EC2 Instance Connect SSH Public Key Uploaded
Trouble
TA0008, TA0004, T1021.004
AWS
Last updated: September 15, 2025
View details
AWS EC2 Network Access Control List Created
Attention
TA0003, T1133
AWS
Last updated: September 15, 2025
View details
AWS EC2 Network Access Control List Deleted
Trouble
TA0005, T1562.001
AWS
Last updated: September 15, 2025
View details
AWS EC2 Security Group Configuration Changed
Attention
TA0005, T1562.007
AWS
Last updated: September 15, 2025
View details
AWS EC2 User Data Retrieval for EC2 Instance
Trouble
TA0007, TA0006, T1580
AWS
Last updated: September 15, 2025
View details
AWS EC2 VM Export Failure
Attention
TA0009, TA0010, T1005
AWS
Last updated: September 15, 2025
View details
AWS EFS File System or Mount Deleted
Trouble
TA0040, T1485
AWS
Last updated: September 15, 2025
View details
AWS EventBridge Rule Disabled or Deleted
Attention
TA0040, T1489
AWS
Last updated: September 15, 2025
View details
AWS GuardDuty Detector Deleted
Critical
TA0005, T1562.001
AWS
Last updated: September 15, 2025
View details
AWS IAM Roles Anywhere Profile Created
Attention
TA0003, T1098.003
AWS
Last updated: September 15, 2025
View details
AWS IAM Roles Anywhere Trust Anchor Created with External CA
Trouble
TA0003, T1098.003
AWS
Last updated: September 15, 2025
View details
AWS IAM User Addition to Group
Attention
TA0003, T1098
AWS
Last updated: September 15, 2025
View details
AWS KMS Customer Managed Key Disabled or Scheduled for Deletion
Trouble
TA0040, T1485
AWS
Last updated: September 15, 2025
View details
AWS Lambda Function Created or Updated
Attention
TA0002, T1648
AWS
Last updated: September 15, 2025
View details
AWS Lambda Layer Added to Existing Function
Attention
TA0002, T1648
AWS
Last updated: September 15, 2025
View details
AWS RDS DB Instance or Cluster Restored
Trouble
TA0005, T1578.004
AWS
Last updated: September 15, 2025
View details
AWS RDS DB Instance or Cluster Deletion Protection Disabled
Trouble
TA0040, T1485
AWS
Last updated: September 15, 2025
View details
AWS RDS DB Instance or Cluster Password Modified
Trouble
TA0003, T1098.001
AWS
Last updated: September 15, 2025
View details
AWS RDS DB Snapshot Created
Attention
TA0005, T1578.001
AWS
Last updated: September 15, 2025
View details
AWS RDS DB Snapshot Shared with Another Account
Trouble
TA0010, T1537
AWS
Last updated: September 15, 2025
View details
AWS RDS Instance/Cluster Stoppage
Trouble
TA0040, T1489
AWS
Last updated: September 15, 2025
View details
AWS RDS Security Group Creation
Attention
TA0003, T1136.003
AWS
Last updated: September 15, 2025
View details
AWS RDS Security Group Deletion
Attention
TA0040, T1531
AWS
Last updated: September 15, 2025
View details
AWS S3 Bucket Configuration Deletion
Attention
TA0005, T1070
AWS
Last updated: September 15, 2025
View details
AWS S3 Bucket Expiration Lifecycle Configuration Added
Attention
TA0005, T1070
AWS
Last updated: September 15, 2025
View details
AWS S3 Bucket Server Access Logging Disabled
Trouble
TA0005, T1562.008
AWS
Last updated: September 15, 2025
View details
AWS S3 Object Versioning Suspended
Trouble
TA0040, T1490
AWS
Last updated: September 15, 2025
View details
AWS STS Role Assumption by Service
Attention
TA0004, TA0008, T1548
AWS
Last updated: September 15, 2025
View details
AWS Systems Manager SecureString Parameter Request with Decryption Flag
Trouble
TA0006, T1555.006
AWS
Last updated: September 15, 2025
View details
AWS VPC Flow Logs Deletion
Critical
TA0005, T1562.001
AWS
Last updated: September 15, 2025
View details
AWS WAF Access Control List Deletion
Trouble
TA0005, T1562.001
AWS
Last updated: September 15, 2025
View details
AWS WAF Rule or Rule Group Deletion
Trouble
TA0005, T1562.001
AWS
Last updated: September 15, 2025
View details
AWS CloudTrail Critical Change
Trouble
TA0005, T1562.008
AWS
Last updated: September 15, 2025
View details
LoadBalancer Security Group Modification
Trouble
TA0001, T1190
AWS
Last updated: September 15, 2025
View details
AWS Config Disabling Channel/Recorder
Trouble
TA0005, T1562.008
AWS
Last updated: September 15, 2025
View details
SES Identity Has Been Deleted
Trouble
TA0005, T1070
AWS
Last updated: September 15, 2025
View details
AWS SAML Provider Deletion Activity
Trouble
TA0004, TA0040, T1078.004
AWS
Last updated: September 15, 2025
View details
AWS Key Pair Import Activity
Trouble
TA0001, TA0003, TA0004, T1078
AWS
Last updated: September 15, 2025
View details
AWS GuardDuty Critical Change
Trouble
TA0005, T1562.001
AWS
Last updated: September 15, 2025
View details
New AWS Lambda Function URL Configuration Created
Trouble
TA0001, TA0004
AWS
Last updated: September 15, 2025
View details
AWS Glue Development Endpoint Activity
Attention
TA0004
AWS
Last updated: September 15, 2025
View details
AWS S3 Data Management Tampering
Attention
TA0010, T1537
AWS
Last updated: September 15, 2025
View details
AWS Suspicious SAML Activity
Trouble
TA0001, TA0008, TA0004, T1078
AWS
Last updated: September 15, 2025
View details
AdministratorAccess Policy Attached to User
Trouble
TA0004, TA0003, T1098.003
AWS
Last updated: September 15, 2025
View details
AdministratorAccess Policy Attached to Group
Trouble
TA0004, TA0003, T1098.003
AWS
Last updated: September 15, 2025
View details
AdministratorAccess Policy Attached to Role
Trouble
TA0004, TA0003, T1098.003
AWS
Last updated: September 15, 2025
View details
CloudWatch Alarm Deletion
Trouble
TA0005, T1562.001
AWS
Last updated: September 15, 2025
View details
CloudWatch LogGroup Deletion
Trouble
TA0040, TA0005, T1485
AWS
Last updated: September 15, 2025
View details
CloudWatch Log Stream Deletion
Trouble
TA0040, TA0005, T1485
AWS
Last updated: September 15, 2025
View details
RDS Instance or Cluster Delete
Trouble
TA0040, T1485
AWS
Last updated: September 15, 2025
View details
Publicly Exposed AWS RDS Database
Trouble
TA0003, T1556.009
AWS
Last updated: September 15, 2025
View details
AWS Config Resources Deletion
Attention
TA0005, T1562.001
AWS
Last updated: September 15, 2025
View details
Login to Disabled Account
Trouble
TA0001, T1078.004
Microsoft 365
Last updated: September 15, 2025
View details
PowerShell Sign-In Detected
Attention
TA0001, T1078.004
Microsoft 365
Last updated: September 15, 2025
View details
High Risk Sign-In Detected
Trouble
TA0042, T1586.003
Microsoft 365
Last updated: September 15, 2025
View details
MFA Challenge Failed During Authentication
Trouble
TA0001, TA0042, TA0006, T1078.004
Microsoft 365
Last updated: September 15, 2025
View details
External User Invited
Attention
TA0003, T1136.003
Microsoft 365
Last updated: September 15, 2025
View details
User ImmutableId Attribute Updated
Critical
TA0003, T1098
Microsoft 365
Last updated: September 15, 2025
View details
Authentication Method Changed for an User
Trouble
TA0003, T1098
Microsoft 365
Last updated: September 15, 2025
View details
Password Reset on Sensitive Account
Trouble
TA0040, T1531
Microsoft 365
Last updated: September 15, 2025
View details
MFA Disabled for an Account
Trouble
TA0006, T1556.006
Microsoft 365
Last updated: September 15, 2025
View details
Temporary Access Pass Added To An Account
Critical
TA0001, T1078.004
Microsoft 365
Last updated: September 15, 2025
View details
Entra ID privileged role assigned
Trouble
TA0003, T1098.003
Microsoft 365
Last updated: September 15, 2025
View details
Privileged Identity Management Alerts Disabled
Trouble
TA0005, T1562
Microsoft 365
Last updated: September 15, 2025
View details
PIM Role Configuration Changed
Attention
TA0001, T1078.004
Microsoft 365
Last updated: September 15, 2025
View details
User Added To Group With CA Policy Modification Access
Trouble
TA0005, TA0003, T1548
Microsoft 365
Last updated: September 15, 2025
View details
Added Credentials to Existing Application
Trouble
TA0003, T1098.001
Microsoft 365
Last updated: September 15, 2025
View details
Application ID URI Modified
Critical
TA0001, T1078.004
Microsoft 365
Last updated: September 15, 2025
View details
Consent Granted to Application
Attention
TA0006, T1528
Microsoft 365
Last updated: September 15, 2025
View details
Application Owner Added
Attention
TA0003, T1098
Microsoft 365
Last updated: September 15, 2025
View details
Conditional Access Policy Modified
Attention
TA0004, TA0006, T1548
Microsoft 365
Last updated: September 15, 2025
View details
Elevated Mailbox Permission Assigned
Trouble
TA0003, T1098.002
Microsoft 365
Last updated: September 15, 2025
View details
Anti-Phishing Policy Removed
Trouble
TA0001, T1566
Microsoft 365
Last updated: September 15, 2025
View details
Anti-Phishing Rule Disabled
Trouble
TA0001, T1566
Microsoft 365
Last updated: September 15, 2025
View details
Safe Attachments Rule Disabled
Trouble
TA0005, T1562
Microsoft 365
Last updated: September 15, 2025
View details
Safe Links Rule Disabled
Trouble
TA0001, T1566
Microsoft 365
Last updated: September 15, 2025
View details
Malware Filter Policy Deleted
Trouble
TA0005, T1562
Microsoft 365
Last updated: September 15, 2025
View details
Malware Filter Rule Disabled
Trouble
TA0005, T1562
Microsoft 365
Last updated: September 15, 2025
View details
Mailbox Mail Forwarding Enabled
Trouble
TA0009, T1114.003
Microsoft 365
Last updated: September 15, 2025
View details
Mail Flow Rule for Forwarding Created
Trouble
TA0009, T1114.003
Microsoft 365
Last updated: September 15, 2025
View details
Office Executable File Uploaded
Trouble
TA0008, TA0011, T1570
Microsoft 365
Last updated: September 15, 2025
View details
Anonymous Sharing Link Created
Attention
TA0009, T1213.002
Microsoft 365
Last updated: September 15, 2025
View details
Sign-in Brute Force against M365 Accounts
Critical
TA0006, T1110
Microsoft 365
Last updated: September 15, 2025
View details
Multiple Denied MFA Requests
Critical
TA0006, T1621
Microsoft 365
Last updated: September 15, 2025
View details
M365 Short Lived Accounts
Critical
TA0001, T1078.004
Microsoft 365
Last updated: September 15, 2025
View details
Entra ID User Enabled and Password Reset
Critical
TA0003, T1098
Microsoft 365
Last updated: September 15, 2025
View details
Multiple Admin Membership Removals
Trouble
TA0040, T1531
Microsoft 365
Last updated: September 15, 2025
View details
Global Administrator Role Addition to PIM User
Trouble
TA0003, T1098
Microsoft 365
Last updated: September 15, 2025
View details
Multiple Service Principals Created by User
Trouble
TA0003, T1136.003
Microsoft 365
Last updated: September 15, 2025
View details
Risky Sign-in with Device Registration
Trouble
TA0001, T1078.004
Microsoft 365
Last updated: September 15, 2025
View details
New Federated Domain Added
Trouble
TA0005, TA0004, T1484.002
Microsoft 365
Last updated: September 15, 2025
View details
M365 DLP Compliance Policy Removed
Trouble
TA0005, T1562
Microsoft 365
Last updated: September 15, 2025
View details
Multiple Teams Deleted by a Single User
Trouble
TA0040, T1485
Microsoft 365
Last updated: September 15, 2025
View details
External user added in teams
Attention
TA0003, T1136
Microsoft 365
Last updated: September 15, 2025
View details
Office365 Sharepoint File transfer above threshold
Trouble
TA0010, T1567
Microsoft 365
Last updated: September 15, 2025
View details
Files uploaded to Teams
Attention
TA0001, T1199
Microsoft 365
Last updated: September 15, 2025
View details
Anomalous M365 Account Extended Period Without Password Reset
Critical
TA0006, T1110
Microsoft 365
Last updated: September 15, 2025
View details
Unusually Bulk Emails Sent to a Single Recipient
Attention
TA0040, T1667
Microsoft 365
Last updated: September 15, 2025
View details
Unusually High Number of M365 Login Failures
Attention
TA0006, T1110
Microsoft 365
Last updated: September 15, 2025
View details
Malicious M365 Account Deletion by Unusual Users
Attention
TA0040, TA0040, T1485
Microsoft 365
Last updated: September 15, 2025
View details
Malicious M365 CA Policy Changes After Business Hours
Attention
TA0005, TA0004, T1484
Microsoft 365
Last updated: September 15, 2025
View details
Excessive M365 File Deletion at an Unusual Time
Attention
TA0040, T1485
Microsoft 365
Last updated: September 15, 2025
View details
Abnormally Excessive M365 Accounts Lockouts
Attention
TA0040, T1531
Microsoft 365
Last updated: September 15, 2025
View details
MSSQL Suspicious Successful Password Change Activity
Attention
TA0001, TA0003, TA0004, TA0005, TA0006, T1078
SQL Server
Last updated: September 15, 2025
View details
MSSQL Suspicious Failed Password Change Activity
Attention
TA0001, TA0003, TA0004, TA0005, TA0006, T1078
SQL Server
Last updated: September 15, 2025
View details
Account Added to Sysadmin Role in MSSQL
Trouble
TA0003
SQL Server
Last updated: September 15, 2025
View details
MSSQL Destructive Query
Trouble
TA0010, TA0040, T1485
SQL Server
Last updated: September 15, 2025
View details
MSSQL Disable Audit Settings
Trouble
TA0005
SQL Server
Last updated: September 15, 2025
View details
MSSQL XPCmdshell Suspicious Execution
Trouble
TA0002
SQL Server
Last updated: September 15, 2025
View details
MSSQL XPCmdshell Option Change
Trouble
TA0002
SQL Server
Last updated: September 15, 2025
View details
DLL Loaded for Extended Procedures
Trouble
TA0008
SQL Server
Last updated: September 15, 2025
View details
MSSQL Server Dedicated Admin Connection (DAC) mode activated
Trouble
TA0003, T1505
SQL Server
Last updated: September 15, 2025
View details
MSSQL Server - Connection attempt using a disabled account
Trouble
TA0005, TA0003, TA0004, TA0001, T1078
SQL Server
Last updated: September 15, 2025
View details
SQL Server Lateral Movement with CLR Activation
Trouble
TA0003, T1505
SQL Server
Last updated: September 15, 2025
View details
Dark Web Breach Data
Critical
Advanced Threat Analytics
Last updated: September 15, 2025
View details
Supply Chain Breach
Critical
Advanced Threat Analytics
Last updated: September 15, 2025
View
details
H3c Successive different Location Logons
Critical
Network
Last updated: September 15, 2025
View details
Check Point Privileged Command Execution Anomaly
Critical
TA0002, T1059
Network
Last updated: September 15, 2025
View details
Netscreen Policy deleted during non-working hours
Attention
TA0005, T1562
Network
Last updated: September 15, 2025
View details
Netscreen Policy Added during non-working hours
Attention
TA0005, T1562
Network
Last updated: September 15, 2025
View details
WatchGuard Policy Deleted during non-working hours
Attention
TA0005, T1562
Network
Last updated: September 15, 2025
View details
WatchGuard Policy Added during non-working hours
Attention
TA0005, T1562
Network
Last updated: September 15, 2025
View details
TCP Port Scan
Trouble
TA0043, TA0007, T1595.001
Network
Last updated: September 15, 2025
View details
UDP Port Scan
Trouble
TA0043, TA0007, T1595.001
Network
Last updated: September 15, 2025
View details
TCP Null Flag Attack
Trouble
TA0043, T1595.002
Network
Last updated: September 15, 2025
View details
Cross Site Scripting Detection
Trouble
TA0002, T1059.007
Network
Last updated: September 15, 2025
View details
Brute Force Login Violation.
Trouble
TA0006, T1110
Network
Last updated: September 15, 2025
View details
Botnet Detection
Trouble
TA0011, TA0010, T1095
Network
Last updated: September 15, 2025
View details
Port Scan Detected
Trouble
TA0043, TA0007, T1595.001
Network
Last updated: September 15, 2025
View details
Virus detected
Trouble
TA0002, TA0003, TA0005, TA0011, TA0006, TA0007, T1204.002
Network
Last updated: September 15, 2025
View details
Malformed IP Packet
Trouble
TA0040, TA0005, T1498.001
Network
Last updated: September 15, 2025
View details
Fragmented ICMP Traffic
Trouble
TA0040, T1498.001
Network
Last updated: September 15, 2025
View details
Possible Directory Traversal Attempt
Trouble
TA0009, T1213
Network
Last updated: September 15, 2025
View details
SMTP on Port 26/TCP
Trouble
TA0010, TA0011, T1048
Network
Last updated: September 15, 2025
View details
Interface flapping
Trouble
TA0008, TA0001, T1021
Network
Last updated: September 15, 2025
View details
Accepted Default Telnet Port Connection
Trouble
TA0008, TA0001, T1021
Network
Last updated: September 15, 2025
View details
Abnormal Network Device Reboots
Trouble
TA0040, T1529
Network
Last updated: September 15, 2025
View details
Potential external host enumeration via system ports
Attention
TA0007, T1018
Network
Last updated: September 15, 2025
View details
Abnormal number of connections on SMB or NetBIOS ports
Trouble
TA0007, T1046
Network
Last updated: September 15, 2025
View details
Potential external port scan via system ports
Attention
TA0007, T1046
Network
Last updated: September 15, 2025
View details
Connections from a single IP to an abnormal number of external hosts on uncommon ports
Attention
TA0011, T1095
Network
Last updated: September 15, 2025
View details
Excessive Inbound or Outbound Connections from same Source
Trouble
TA0011, TA0008, TA0010, TA0007, T1105
Network
Last updated: September 15, 2025
View details
Abnormal number of Connections on Telnet ports
Trouble
TA0008, T1021
Network
Last updated: September 15, 2025
View details
TCP FIN Only Flags
Trouble
TA0043, TA0007, T1595
Cisco
Last updated: September 15, 2025
View details
FTP Improper Address Specified
Trouble
TA0001, TA0040, T1190
Cisco
Last updated: September 15, 2025
View details
FTP Improper Port Specified
Trouble
TA0001, T1190
Cisco
Last updated: September 15, 2025
View details
Proxied RPC Request
Trouble
TA0011, TA0008, T1090
Cisco
Last updated: September 15, 2025
View details
Statd Buffer Overflow
Trouble
TA0001, TA0002, T1190
Cisco
Last updated: September 15, 2025
View details
Defense Evasion vulnerability by modifying shun list
Trouble
TA0040, T1565
Cisco
Last updated: September 15, 2025
View details
Adversary-in-the-Middle attack
Trouble
TA0006, TA0040, T1557
Cisco
Last updated: September 15, 2025
View details
Cisco FTD Intrusion Event Detected
Trouble
TA0001, TA0002, T1190
Cisco
Last updated: September 15, 2025
View details
Cisco FTD File Malware Event Detected
Trouble
TA0002, TA0005, T1204
Cisco
Last updated: September 15, 2025
View details
Cisco Critical Configurations Modified
Trouble
TA0040, TA0005, T1565
Cisco
Last updated: September 15, 2025
View details
Cisco File Deletion
Trouble
TA0005, TA0040, T1070.004
Cisco
Last updated: September 15, 2025
View details
Cisco Show Commands Input
Trouble
TA0006, T1552.003
Cisco
Last updated: September 15, 2025
View details
Cisco Successive different Location Logons
Critical
TA0005, T1078.004
Cisco
Last updated: September 15, 2025
View details
PaloAlto Other IP Flood
Trouble
TA0040, T1498
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto SCTP INIT Flood
Trouble
TA0040, T1498
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto Packet Buffer Protection Packet Drop
Trouble
TA0040, T1499
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto Flood Detection
Trouble
TA0040, T1498
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto Host Sweep
Trouble
TA0043, TA0007, T1595.001
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto Scan Detection
Trouble
TA0043, TA0007, T1595
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto FileType Detection
Trouble
TA0009, TA0005, T1119
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto IPv6 Address Violation Detected
Trouble
TA0007, T1046
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto TCP split handshake
Trouble
TA0005, T1205
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto TCP SYN packet with payload
Trouble
TA0005, TA0011, TA0002, T1036.005
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto TCP SYN-ACK packet with payload
Trouble
TA0005, TA0011, TA0002, T1036.005
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto TCP Fast Open Abuse
Trouble
TA0005, TA0040, T1562
PaloAlto
Last updated: September 15, 2025
View details
ICMP packets with error message
Trouble
TA0043, TA0007, T1595.001
PaloAlto
Last updated: September 15, 2025
View details
First packets for a TCP session that are not SYN packets
Trouble
TA0005, TA0043, T1205
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto Spyware Phone Home detected
Trouble
TA0011, T1071.001
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto Spyware Download detection
Trouble
TA0011, TA0002, T1105
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto URL Filtering Detection
Trouble
TA0011, T1071.001
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto Vulnerability Exploit Detection
Trouble
TA0002, T1203
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto Wildfire signature detected
Trouble
TA0005, TA0002, T1027
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto DNS Botnet Detection
Trouble
TA0011, TA0010, T1071.004
PaloAlto
Last updated: September 15, 2025
View details
PaloAlto Data Filtering Detection
Trouble
TA0009, TA0006, T1119
PaloAlto
Last updated: September 15, 2025
View details
Fortinet policy deleted during non-working hours
Attention
TA0005, T1562
Fortinet
Last updated: September 15, 2025
View details
Fortinet policy added during non-working hours
Attention
TA0005, T1562
Fortinet
Last updated: September 15, 2025
View details
Fortinet Privileged Command Execution Failure Anomaly
Critical
TA0002, T1059
Fortinet
Last updated: September 15, 2025
View details
TCP/UDP Signature Detection
Trouble
TA0007, TA0011, TA0002, TA0040, T1046
Fortinet
Last updated: September 15, 2025
View details
ICMP Signature Detection
Trouble
TA0007, TA0040, TA0011, T1046
Fortinet
Last updated: September 15, 2025
View details
Other IPS Signature Detection
Trouble
TA0007, TA0040, TA0011, TA0001, T1046
Fortinet
Last updated: September 15, 2025
View details
Malicious URL Detection
Trouble
TA0011, TA0002, T1071.001
Fortinet
Last updated: September 15, 2025
View details
TCP Source Session Flood
Trouble
TA0040, T1498
Fortinet
Last updated: September 15, 2025
View details
TCP Destination Session Flood
Trouble
TA0040, T1498
Fortinet
Last updated: September 15, 2025
View details
UDP Source Session Flood
Trouble
TA0040, T1498
Fortinet
Last updated: September 15, 2025
View details
UDP Destination Session Flood
Trouble
TA0040, T1498
Fortinet
Last updated: September 15, 2025
View details
ICMP Source Session Flood
Trouble
TA0040, T1498
Fortinet
Last updated: September 15, 2025
View details
ICMP Destination Session Flood
Trouble
TA0040, T1498
Fortinet
Last updated: September 15, 2025
View details
IP Source Session Flood
Trouble
TA0040, T1498
Fortinet
Last updated: September 15, 2025
View details
IP Destination Session Flood
Trouble
TA0040, T1498
Fortinet
Last updated: September 15, 2025
View details
SCTP Source Session Flood
Trouble
TA0040, T1498
Fortinet
Last updated: September 15, 2025
View details
SCTP Destination Session Flood
Trouble
TA0040, T1498
Fortinet
Last updated: September 15, 2025
View details
Traffic Blocked as ICAP Server Found Infection
Trouble
TA0002, T1203
Fortinet
Last updated: September 15, 2025
View details
Suspicious Content Encoding.
Trouble
TA0005, TA0009, T1140
Fortinet
Last updated: September 15, 2025
View details
Command Blocked
Trouble
TA0002, TA0005, T1059
Fortinet
Last updated: September 15, 2025
View details
HTTP Access Limit Violation
Trouble
TA0009, TA0001, T1114
Fortinet
Last updated: September 15, 2025
View details
Generic Attacks Detection
Trouble
TA0001, T1190
Fortinet
Last updated: September 15, 2025
View details
Trojon Detection
Trouble
TA0002, TA0011, TA0005, T1204
Fortinet
Last updated: September 15, 2025
View details
Known Exploits Detection
Trouble
TA0002, T1203
Fortinet
Last updated: September 15, 2025
View details
FTP Command Restriction
Trouble
TA0011, TA0010, T1071.002
Fortinet
Last updated: September 15, 2025
View details
SQL Injection Detection
Trouble
TA0001, TA0009, T1190
Fortinet
Last updated: September 15, 2025
View details
FTP File Security Violation
Trouble
TA0010, T1048
Fortinet
Last updated: September 15, 2025
View details
Credential Stuffing Defense Violation
Trouble
TA0006, T1110.004
Fortinet
Last updated: September 15, 2025
View details
New Connection From A Quarantined IP address
Trouble
TA0011, T1071
Fortinet
Last updated: September 15, 2025
View details
Firewall Violation Detection.
Trouble
TA0005, TA0002, T1027
Fortinet
Last updated: September 15, 2025
View details
Fortinet Successive different Location Logons
Critical
TA0005, T1078.004
Fortinet
Last updated: September 15, 2025
View details
Fortinet Appliance Auth bypass
Critical
TA0001, TA0003, T1190
Fortinet
Last updated: September 15, 2025
View details
ICMP IP Sweep Scan
Trouble
TA0043, TA0007, T1595.001
Juniper
Last updated: September 15, 2025
View details
TCP SYN-ACK-ACK Proxy
Trouble
TA0011, T1090.003
Juniper
Last updated: September 15, 2025
View details
TCP SYN fragmentation attack
Trouble
TA0040, T1498
Juniper
Last updated: September 15, 2025
View details
TCP FIN without ACK Detection
Trouble
TA0043, TA0007, T1595.002
Juniper
Last updated: September 15, 2025
View details
Unknown IP Protocol Detection
Trouble
TA0005, TA0043, T1562
Juniper
Last updated: September 15, 2025
View details
IP Stream Option Detection
Trouble
TA0005, TA0007, T1562
Juniper
Last updated: September 15, 2025
View details
IP Record Route Option Detection
Trouble
TA0007, T1046
Juniper
Last updated: September 15, 2025
View details
IP Timestamp Option Detection
Trouble
TA0007, T1046
Juniper
Last updated: September 15, 2025
View details
IP Security Option Detection
Trouble
TA0005, T1562
Juniper
Last updated: September 15, 2025
View details
Suspicious DHCP Assignment Detected
Trouble
TA0007, TA0006, T1046
Barracuda
Last updated: September 15, 2025
View details
Detects DNS Sinkhole address accessed
Trouble
TA0011, T1071.004
Barracuda
Last updated: September 15, 2025
View details
Detects Virus-Infected File Blocked by Firewall
Trouble
TA0005, TA0002, T1027
Barracuda
Last updated: September 15, 2025
View details
Detects User added to ATP quarantine
Trouble
TA0005, T1562
Barracuda
Last updated: September 15, 2025
View details
Detects ATP and malicious activities
Trouble
TA0005, TA0011, T1027
Barracuda
Last updated: September 15, 2025
View details
Detects Primary ATP server unreachable
Trouble
TA0040, T1499
Barracuda
Last updated: September 15, 2025
View details
Detects Both ATP servers unreachable
Trouble
TA0040, T1499
Barracuda
Last updated: September 15, 2025
View details
Detects Oversized SYN Packet
Trouble
TA0005, TA0011, TA0002, T1036.005
Barracuda
Last updated: September 15, 2025
View details
Detects Potential SYN Flood with Spoofed IPs
Trouble
TA0040, TA0043, T1498
Barracuda
Last updated: September 15, 2025
View details
Duplicate IP Detected
Trouble
TA0006, TA0005, TA0007, T1557
Barracuda
Last updated: September 15, 2025
View details
Barracuda IPS Log Detection
Trouble
TA0009, TA0007, T1119
Barracuda
Last updated: September 15, 2025
View details
Detects Log Data Deleted
Trouble
TA0005, TA0040, T1070.001
Barracuda
Last updated: September 15, 2025
View details
Suspicious ARP activity detected - ARP spoofing
Trouble
TA0006, TA0007, T1557.001
Barracuda
Last updated: September 15, 2025
View details
Sonicwall policy deleted during non-working hours
Attention
TA0005, T1562
SonicWall
Last updated: September 15, 2025
View details
Sonicwall policy added during non-working hours
Attention
TA0005, T1562
SonicWall
Last updated: September 15, 2025
View details
Unauthorized Sophos Firewall Rule Deletion Detected
Critical
TA0004, TA0005, TA0008, T1134
SonicWall
Last updated: September 15, 2025
View details
Invalid SYN Cookie Detected
Trouble
TA0040, T1498
SonicWall
Last updated: September 15, 2025
View details
Probable TCP Fin Scan Detected
Trouble
TA0043, TA0007, T1595.001
SonicWall
Last updated: September 15, 2025
View details
Probable TCP Xmas Scan Detected
Trouble
TA0043, TA0007, T1595.001
SonicWall
Last updated: September 15, 2025
View details
Probable TCP Null Scan Detected
Trouble
TA0043, TA0007, T1595.001
SonicWall
Last updated: September 15, 2025
View details
Possible UDPv6 Flood Attack Detected
Trouble
TA0040, T1498
SonicWall
Last updated: September 15, 2025
View details
Large UDP Fragmented Datagram
Trouble
TA0040, T1498.001
SonicWall
Last updated: September 15, 2025
View details
Possible ARP Attack Detected
Trouble
TA0006, T1557
SonicWall
Last updated: September 15, 2025
View details
Invalid IPv6 Packet Length
Trouble
TA0043, TA0005, TA0040, T1595.002
SonicWall
Last updated: September 15, 2025
View details
Possible SHLO replay attack
Trouble
TA0006, TA0005, T1557
SonicWall
Last updated: September 15, 2025
View details
DHCP IP Spoof detected
Trouble
TA0006, T1557
SonicWall
Last updated: September 15, 2025
View details
DNS Rebind Attack Detected
Trouble
TA0011, T1071.004
SonicWall
Last updated: September 15, 2025
View details
DNS Rebind Attack Blocked
Trouble
TA0011, T1071.004
SonicWall
Last updated: September 15, 2025
View details
Illegal Destination
Trouble
TA0011, TA0010, TA0008, T1071
SonicWall
Last updated: September 15, 2025
View details
Incomplete IGMP Fragment
Trouble
TA0040, T1498.001
SonicWall
Last updated: September 15, 2025
View details
User Login Lockout
Trouble
TA0006, TA0040, T1110
SonicWall
Last updated: September 15, 2025
View details
User Login Disable
Trouble
TA0006, TA0040, T1110
SonicWall
Last updated: September 15, 2025
View details
Forbidden Email Attachment Disabled
Trouble
TA0001, TA0002, T1566.001
SonicWall
Last updated: September 15, 2025
View details
Forbidden Email Attachment Deleted
Trouble
TA0001, TA0002, T1566.001
SonicWall
Last updated: September 15, 2025
View details
Email Fragment Dropped
Trouble
TA0005, TA0001, TA0011, T1027
SonicWall
Last updated: September 15, 2025
View details
FTP Passive Attack
Trouble
TA0011, TA0010, T1071.002
SonicWall
Last updated: September 15, 2025
View details
FTP Port Bounce Attack
Trouble
TA0011, TA0010, T1071.002
SonicWall
Last updated: September 15, 2025
View details
FTP Passive Bounce Attack
Trouble
TA0011, TA0010, T1071.002
SonicWall
Last updated: September 15, 2025
View details
FTP Data Port Attack
Trouble
TA0011, T1071.002
SonicWall
Last updated: September 15, 2025
View details
Sonicwall IDP Detection Alert
Trouble
TA0002, TA0005, T1203
SonicWall
Last updated: September 15, 2025
View details
Sonicwall IDP Prevention Alert
Trouble
TA0002, TA0005, T1203
SonicWall
Last updated: September 15, 2025
View details
SonicWall IPS Detection Alert
Trouble
TA0002, TA0005, T1203
SonicWall
Last updated: September 15, 2025
View details
SonicWall IPS Prevention Alert
Trouble
TA0002, TA0005, T1203
SonicWall
Last updated: September 15, 2025
View details
Sonicwall Anti-Spyware Prevention Alert
Trouble
TA0009, TA0011, TA0005, T1056.001
SonicWall
Last updated: September 15, 2025
View details
Sonicwall Anti-Spyware Detection Alert
Trouble
TA0009, TA0011, TA0005, T1056.001
SonicWall
Last updated: September 15, 2025
View details
Gateway Anti-virus Alert
Trouble
TA0002, TA0003, TA0005, T1204.002
SonicWall
Last updated: September 15, 2025
View details
Sonicwall Successive different Location Logons
Critical
TA0005, T1078.004
SonicWall
Last updated: September 15, 2025
View details
Suspicious Sophos Rule Addition
Attention
TA0005, TA0008, TA0004, T1562.004
Sophos
Last updated: September 15, 2025
View details
Unusual Denied Traffic Activity on Sophos
Attention
TA0007, TA0005, TA0010, T1040
Sophos
Last updated: September 15, 2025
View details
Unexpected Removal of Sophos Firewall Rule
Attention
TA0005, TA0008, TA0004, T1562.004
Sophos
Last updated: September 15, 2025
View details
Unexpected Modification of Sophos Firewall Rule
Attention
TA0005, TA0008, TA0004, T1562.004
Sophos
Last updated: September 15, 2025
View details
Firewall IPS Anomaly Detected
Trouble
TA0005, TA0007, T1027
Sophos
Last updated: September 15, 2025
View details
Firewall IPS Anomaly Blocked
Trouble
TA0005, TA0040, T1027
Sophos
Last updated: September 15, 2025
View details
Firewall IPS Signature Detected
Trouble
TA0002, TA0011, T1059
Sophos
Last updated: September 15, 2025
View details
Firewall IPS Signature Blocked
Trouble
TA0002, TA0011, T1059
Sophos
Last updated: September 15, 2025
View details
Firewall Threat Detected
Trouble
TA0011, TA0002, T1071
Sophos
Last updated: September 15, 2025
View details
Firewall IPS Threat Detected
Trouble
TA0005, TA0002, T1027
Sophos
Last updated: September 15, 2025
View details
Web Threat Detected
Trouble
TA0011, TA0002, T1071.001
Sophos
Last updated: September 15, 2025
View details
Firewall Threat Blocked
Trouble
TA0011, TA0002, T1071
Sophos
Last updated: September 15, 2025
View details
Firewall IPS Threat Blocked
Trouble
TA0005, TA0002, T1027
Sophos
Last updated: September 15, 2025
View details
Web Threat Blocked
Trouble
TA0011, TA0002, T1071.001
Sophos
Last updated: September 15, 2025
View details
ICMP Error Message Allowed
Trouble
TA0043, TA0007, TA0011, T1595.001
Sophos
Last updated: September 15, 2025
View details
ICMP Error Message Blocked
Trouble
TA0005, TA0040, T1562.004
Sophos
Last updated: September 15, 2025
View details
High machine temperature alerts
Critical
TA0040, T1496
ME Applications
Last updated: September 15, 2025
View details
High CPU usage for a long time
Critical
TA0040, T1499
ME Applications
Last updated: September 15, 2025
View details
Insider threat detection
Critical
TA0002, TA0005, T1203
ME Applications
Last updated: September 15, 2025
View details
Role Flooding Attack
Critical
TA0006, T1110
ME Applications
Last updated: September 15, 2025
View details
Insecure forwarding server
Critical
TA0010, T1048.003
ME Applications
Last updated: September 15, 2025
View details
Unusual Mailbox Access
Critical
TA0003, T1671
ME Applications
Last updated: September 15, 2025
View details
Suspicious software installation
Critical
TA0003, TA0004, T1546.016
Miscellaneous
Last updated: September 15, 2025
View details
Suspicious SQL backup activity
Critical
TA0009, T1005
Miscellaneous
Last updated: September 15, 2025
View details
Security Interruption-Inventory Management
Critical
TA0005, T1562
Miscellaneous
Last updated: September 15, 2025
View details
Security Evasion-Inventory Management
Critical
TA0005, T1202
Miscellaneous
Last updated: September 15, 2025
View
details
Excessive logon failures
Critical
TA0005, T1078.004
Miscellaneous
Last updated: September 15, 2025
View details
Excessive VPN Logon Failure
Critical
TA0006, T1110
Miscellaneous
Last updated: September 15, 2025
View details
Excessive password change failure
Critical
TA0006, T1110.001
Miscellaneous
Last updated: September 15, 2025
View details
PowerShell Script Run in AppData
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
PowerShell DownloadFile
Trouble
TA0002, TA0011, T1059.001
Windows
Last updated: September 15, 2025
View details
Suspicious X509Enrollment - Process Creation
Trouble
TA0005, T1553.004
Windows
Last updated: September 15, 2025
View details
Arbitrary File Download Via PresentationHost.EXE
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
XBAP Execution From Uncommon Locations Via PresentationHost.EXE
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution
Trouble
TA0002, TA0005, T1218
Windows
Last updated: September 15, 2025
View details
File Download Using ProtocolHandler.exe
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential Provlaunch.EXE Binary Proxy Execution Abuse
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious Provlaunch.EXE Child Process
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Screen Capture Activity Via Psr.EXE
Trouble
TA0009, T1113
Windows
Last updated: September 15, 2025
View details
PUA - AdvancedRun Execution
Trouble
TA0002, TA0005, TA0004, T1059.003
Windows
Last updated: September 15, 2025
View details
PUA - AdvancedRun Suspicious Execution
Trouble
TA0005, TA0004, T1134.002
Windows
Last updated: September 15, 2025
View details
PUA - Advanced IP Scanner Execution
Trouble
TA0007, T1046
Windows
Last updated: September 15, 2025
View details
PUA - Advanced Port Scanner Execution
Trouble
TA0007, T1046
Windows
Last updated: September 15, 2025
View details
PUA - Chisel Tunneling Tool Execution
Trouble
TA0011, T1090.001
Windows
Last updated: September 15, 2025
View details
PUA - CleanWipe Execution
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
PUA - Crassus Execution
Trouble
TA0007, TA0043, T1590.001
Windows
Last updated: September 15, 2025
View details
PUA - CsExec Execution
Trouble
TA0042, TA0002, T1587.001
Windows
Last updated: September 15, 2025
View details
PUA - DefenderCheck Execution
Trouble
TA0005, T1027.005
Windows
Last updated: September 15, 2025
View details
PUA - Fast Reverse Proxy (FRP) Execution
Trouble
TA0011, T1090
Windows
Last updated: September 15, 2025
View details
PUA- IOX Tunneling Tool Execution
Trouble
TA0011, T1090
Windows
Last updated: September 15, 2025
View details
PUA - Mouse Lock Execution
Trouble
TA0006, TA0009, T1056.002
Windows
Last updated: September 15, 2025
View details
PUA - Netcat Suspicious Execution
Trouble
TA0011, T1095
Windows
Last updated: September 15, 2025
View details
PUA - SoftPerfect Netscan Execution
Trouble
TA0007, T1046
Windows
Last updated: September 15, 2025
View details
PUA - NirCmd Execution
Trouble
TA0002, T1569.002
Windows
Last updated: September 15, 2025
View details
PUA - NirCmd Execution As LOCAL SYSTEM
Trouble
TA0002, T1569.002
Windows
Last updated: September 15, 2025
View details
PUA - Nmap/Zenmap Execution
Trouble
TA0007, T1046
Windows
Last updated: September 15, 2025
View details
PUA - NPS Tunneling Tool Execution
Trouble
TA0011, T1090
Windows
Last updated: September 15, 2025
View details
PUA - NSudo Execution
Trouble
TA0002, T1569.002
Windows
Last updated: September 15, 2025
View
details
PUA - Process Hacker Execution
Trouble
TA0005, TA0007, TA0003, TA0004, T1622
Windows
Last updated: September 15, 2025
View details
PUA - Radmin Viewer Utility Execution
Trouble
TA0002, TA0008, T1072
Windows
Last updated: September 15, 2025
View details
PUA - Potential PE Metadata Tamper Using Rcedit
Trouble
TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
PUA - Rclone Execution
Trouble
TA0010, T1567.002
Windows
Last updated: September 15, 2025
View details
PUA - RunXCmd Execution
Trouble
TA0002, T1569.002
Windows
Last updated: September 15, 2025
View details
PUA - Seatbelt Execution
Trouble
TA0007, T1526
Windows
Last updated: September 15, 2025
View details
PUA - System Informer Execution
Trouble
TA0003, TA0004, TA0007, TA0005, T1543
Windows
Last updated: September 15, 2025
View details
PUA - WebBrowserPassView Execution
Trouble
TA0006, T1555.003
Windows
Last updated: September 15, 2025
View details
PUA - Wsudo Suspicious Execution
Trouble
TA0002, TA0004, T1059
Windows
Last updated: September 15, 2025
View details
Python Inline Command Execution
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Python Spawning Pretty TTY on Windows
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Usage Of Qemu
Trouble
TA0011, T1090
Windows
Last updated: September 15, 2025
View details
QuickAssist Execution
Attention
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Rar Usage with Password and Compression Level
Trouble
TA0009, T1560.001
Windows
Last updated: September 15, 2025
View details
Files Added To An Archive Using Rar.EXE
Attention
TA0009, T1560.001
Windows
Last updated: September 15, 2025
View details
Suspicious RASdial Activity
Trouble
TA0005, TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Process Memory Dump via RdrLeakDiag.EXE
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
Trouble
TA0005, T1218.009
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Trouble
TA0005, T1218.009
Windows
Last updated: September 15, 2025
View details
Exports Critical Registry Keys To a File
Trouble
TA0010, TA0007, T1012
Windows
Last updated: September 15, 2025
View details
Exports Registry Key To a File
Attention
TA0010, TA0007, T1012
Windows
Last updated: September 15, 2025
View details
Regedit as Trusted Installer
Trouble
TA0004, T1548
Windows
Last updated: September 15, 2025
View details
DLL Execution Via Register-cimprovider.exe
Trouble
TA0005, T1574
Windows
Last updated: September 15, 2025
View details
Enumeration for 3rd Party Creds From CLI
Trouble
TA0006, T1552.002
Windows
Last updated: September 15, 2025
View details
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI
Trouble
TA0002, TA0005
Windows
Last updated: September 15, 2025
View details
Suspicious Debugger Registration Cmdline
Trouble
TA0003, TA0004, T1546.008
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Logon Scripts - CommandLine
Trouble
TA0003, T1037.001
Windows
Last updated: September 15, 2025
View details
Potential Credential Dumping Attempt Using New NetworkProvider - CLI
Trouble
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Python Function Execution Security Warning Disabled In Excel
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Potential Provisioning Registry Key Abuse For Binary Proxy Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential PowerShell Execution Policy Tampering - ProcCreation
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Hiding User Account Via SpecialAccounts Registry Key - CommandLine
Trouble
TA0005, T1564.002
Windows
Last updated: September 15, 2025
View details
Persistence Via TypedPaths - CommandLine
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential Regsvr32 Commandline Flag Anomaly
Trouble
TA0005, T1218.010
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Regsvr32 HTTP IP Pattern
Trouble
TA0005, T1218.010
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Regsvr32 HTTP/FTP Pattern
Trouble
TA0005, T1218.010
Windows
Last updated: September 15, 2025
View details
Suspicious Regsvr32 Execution From Remote Share
Trouble
TA0005, T1218.010
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Child Process Of Regsvr32
Trouble
TA0005, T1218.010
Windows
Last updated: September 15, 2025
View details
Regsvr32 Execution From Potential Suspicious Location
Trouble
TA0005, T1218.010
Windows
Last updated: September 15, 2025
View details
Regsvr32 DLL Execution With Suspicious File Extension
Trouble
TA0005, T1218.010
Windows
Last updated: September 15, 2025
View details
Scripting/CommandLine Process Spawned Regsvr32
Trouble
TA0005, T1218.010
Windows
Last updated: September 15, 2025
View details
Regsvr32 DLL Execution With Uncommon Extension
Trouble
TA0005, TA0002, T1574
Windows
Last updated: September 15, 2025
View details
Potential Persistence Attempt Via Run Keys Using Reg.EXE
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Add SafeBoot Keys Via Reg Utility
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Suspicious Reg Add BitLocker
Trouble
TA0040, T1486
Windows
Last updated: September 15, 2025
View details
Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
SafeBoot Registry Key Deleted Via Reg.EXE
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Service Registry Key Deleted Via Reg.EXE
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Desktop Background Change Using Reg.EXE
Trouble
TA0005, TA0040, T1112
Windows
Last updated: September 15, 2025
View details
Direct Autorun Keys Modification
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Security Service Disabled Via Reg.EXE
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Windows Recall Feature Enabled Via Reg.EXE
Trouble
TA0009, T1113
Windows
Last updated: September 15, 2025
View details
Enumeration for Credentials in Registry
Trouble
TA0006, T1552.002
Windows
Last updated: September 15, 2025
View details
Potential Suspicious Registry File Imported Via Reg.EXE
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
RestrictedAdminMode Registry Value Tampering - ProcCreation
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
LSA PPL Protection Disabled Via Reg.EXE
Trouble
TA0005, T1562.010
Windows
Last updated: September 15, 2025
View details
Suspicious Query of MachineGUID
Attention
TA0007, T1082
Windows
Last updated: September 15, 2025
View details
Suspicious Reg Add Open Command
Trouble
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Potential Configuration And Service Reconnaissance Via Reg.EXE
Trouble
TA0007, T1012
Windows
Last updated: September 15, 2025
View details
Potential Tampering With RDP Related Registry Keys Via Reg.EXE
Trouble
TA0005, TA0008, T1112
Windows
Last updated: September 15, 2025
View details
Suspicious ScreenSave Change by Reg.exe
Trouble
TA0004, T1546.002
Windows
Last updated: September 15, 2025
View details
Changing Existing Service ImagePath Value Via Reg.EXE
Trouble
TA0003, T1574.011
Windows
Last updated: September 15, 2025
View details
Detected Windows Software Discovery
Trouble
TA0007, T1518
Windows
Last updated: September 15, 2025
View details
Reg Add Suspicious Paths
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Disabled Volume Snapshots
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Suspicious Windows Defender Registry Key Tampering Via Reg.EXE
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Write Protect For Storage Disabled
Trouble
TA0005, T1562
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - AnyDesk Execution
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Testing Usage of Uncommonly Used Port
Trouble
TA0011, T1571
Windows
Last updated: September 15, 2025
View details
Powershell Timestomp
Trouble
TA0005, T1070.006
Windows
Last updated: September 15, 2025
View details
Abuse of Service Permissions to Hide Services Via Set-Service - PS
Trouble
TA0003, TA0005, TA0004, T1574.011
Windows
Last updated: September 15, 2025
View details
Veeam Backup Servers Credential Dumping Script Execution
Trouble
TA0006
Windows
Last updated: September 15, 2025
View details
Usage Of Web Request Commands And Cmdlets - ScriptBlock
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
PowerShell WMI Win32_Product Install MSI
Trouble
TA0005, T1218.007
Windows
Last updated: September 15, 2025
View details
Windows Firewall Profile Disabled
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Potential WinAPI Calls Via PowerShell Scripts
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Windows Defender Exclusions Added - PowerShell
Trouble
TA0005, TA0002, T1562
Windows
Last updated: September 15, 2025
View details
Powershell WMI Persistence
Trouble
TA0004, T1546.003
Windows
Last updated: September 15, 2025
View details
WMIC Unquoted Services Path Lookup - PowerShell
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Suspicious X509Enrollment - Ps Script
Trouble
TA0005, T1553.004
Windows
Last updated: September 15, 2025
View details
Powershell XML Execute Command
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Compress-Archive Cmdlet Execution
Attention
TA0010, TA0009, T1560
Windows
Last updated: September 15, 2025
View details
Windows Mail App Mailbox Access Via PowerShell Script
Trouble
TA0005, T1070.008
Windows
Last updated: September 15, 2025
View details
SMB over QUIC Via PowerShell Script
Trouble
TA0008, T1570
Windows
Last updated: September 15, 2025
View details
Use Of Remove-Item to Delete File - ScriptBlock
Attention
TA0005, T1070.004
Windows
Last updated: September 15, 2025
View details
WinAPI Library Calls Via PowerShell Scripts
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
WinAPI Function Calls Via PowerShell Scripts
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Diamond Sleet APT Process Activity Indicators
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Mint Sandstorm - Log4J Wstomcat Process Execution
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Potential APT Mustang Panda Activity Against Australian Gov
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)
Trouble
TA0002, TA0001, T1059
Windows
Last updated: September 15, 2025
View details
Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Potential Suspicious Child Process Of 3CXDesktopApp
Trouble
TA0011, TA0002, TA0005, T1218
Windows
Last updated: September 15, 2025
View details
COLDSTEEL RAT Cleanup Command Execution
Critical
TA0003, TA0005
Windows
Last updated: September 15, 2025
View details
COLDSTEEL RAT Service Persistence Execution
Critical
TA0003, TA0005
Windows
Last updated: September 15, 2025
View details
DarkGate - Autoit3.EXE Execution Parameters
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
DarkGate - User Created Via Net.EXE
Trouble
TA0003, T1136.001
Windows
Last updated: September 15, 2025
View details
Griffon Malware Attack Pattern
Critical
TA0002
Windows
Last updated: September 15, 2025
View details
Injected Browser Process Spawning Rundll32 - GuLoader Activity
Trouble
TA0005, T1055
Windows
Last updated: September 15, 2025
View details
IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Potential Pikabot Hollowing Activity
Trouble
TA0005, T1055.012
Windows
Last updated: September 15, 2025
View details
Qakbot Regsvr32 Calc Pattern
Trouble
TA0005, TA0002
Windows
Last updated: September 15, 2025
View details
Potential Qakbot Rundll32 Execution
Trouble
TA0005, TA0002
Windows
Last updated: September 15, 2025
View details
Qakbot Rundll32 Exports Execution
Critical
TA0005, TA0002
Windows
Last updated: September 15, 2025
View details
Qakbot Rundll32 Fake DLL Extension Execution
Critical
TA0005, TA0002
Windows
Last updated: September 15, 2025
View details
Rhadamanthys Stealer Module Launch Via Rundll32.EXE
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Rorschach Ransomware Execution Activity
Critical
TA0002, TA0005, T1059.003
Windows
Last updated: September 15, 2025
View details
Potential SNAKE Malware Installation Binary Indicator
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
PaperCut MF/NG Exploitation Related Indicators
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
PaperCut MF/NG Potential Exploitation
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Potential APT FIN7 Exploitation Activity
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Forest Blizzard APT - Process Creation Activity
Trouble
TA0005, TA0002
Windows
Last updated: September 15, 2025
View details
Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
CVE-2024-50623 Exploitation Attempt - Cleo
Trouble
TA0002, TA0001, T1190
Windows
Last updated: September 15, 2025
View details
Potential KamiKakaBot Activity - Lure Document Execution
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Kapeka Backdoor Persistence Activity
Trouble
TA0003, T1053.005
Windows
Last updated: September 15, 2025
View details
Kapeka Backdoor Execution Via RunDLL32.EXE
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Lummac Stealer Activity - Execution Of More.com And Vbc.exe
Trouble
TA0005, T1055
Windows
Last updated: September 15, 2025
View details
Potential Raspberry Robin CPL Execution Activity
Trouble
TA0005, TA0002, T1218.011
Windows
Last updated: September 15, 2025
View details
7Zip Compressing Dump Files
Trouble
TA0009, T1560.001
Windows
Last updated: September 15, 2025
View details
Compress Data and Lock With Password for Exfiltration With 7-ZIP
Trouble
TA0009, T1560.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Injection Via AccCheckConsole
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Suspicious AddinUtil.EXE CommandLine Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Uncommon Child Process Of AddinUtil.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Uncommon AddinUtil.EXE CommandLine Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
AddinUtil.EXE Execution From Uncommon Directory
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential Adplus.EXE Abuse
Trouble
TA0005, TA0002, TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
AgentExecutor PowerShell Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious AgentExecutor PowerShell Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Uncommon Child Process Of Appvlp.EXE
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
AspNetCompiler Execution
Trouble
TA0005, T1127
Windows
Last updated: September 15, 2025
View details
Suspicious Child Process of AspNetCompiler
Trouble
TA0005, T1127
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
Trouble
TA0005, T1127
Windows
Last updated: September 15, 2025
View details
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Set Suspicious Files as System Files Using Attrib.EXE
Trouble
TA0005, T1564.001
Windows
Last updated: September 15, 2025
View details
Indirect Inline Command Execution Via Bash.EXE
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Indirect Command Execution From Script File Via Bash.EXE
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Boot Configuration Tampering Via Bcdedit.EXE
Trouble
TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE
Trouble
TA0005, TA0003, T1070
Windows
Last updated: September 15, 2025
View details
Data Export From MSSQL Table Via BCP.EXE
Trouble
TA0002, TA0010, T1048
Windows
Last updated: September 15, 2025
View details
Suspicious Child Process Of BgInfo.EXE
Trouble
TA0002, TA0005, T1059.005
Windows
Last updated: September 15, 2025
View details
Uncommon Child Process Of BgInfo.EXE
Trouble
TA0002, TA0005, T1059.005
Windows
Last updated: September 15, 2025
View details
BitLockerTogo.EXE Execution
Attention
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
File Download Via Bitsadmin
Trouble
TA0005, TA0003, T1197
Windows
Last updated: September 15, 2025
View details
Suspicious Download From Direct IP Via Bitsadmin
Trouble
TA0005, TA0003, T1197
Windows
Last updated: September 15, 2025
View details
Suspicious Download From File-Sharing Website Via Bitsadmin
Trouble
TA0005, TA0003, T1197
Windows
Last updated: September 15, 2025
View details
File With Suspicious Extension Downloaded Via Bitsadmin
Trouble
TA0005, TA0003, T1197
Windows
Last updated: September 15, 2025
View details
File Download Via Bitsadmin To A Suspicious Target Folder
Trouble
TA0005, TA0003, T1197
Windows
Last updated: September 15, 2025
View details
File Download Via Bitsadmin To An Uncommon Target Folder
Trouble
TA0005, TA0003, T1197
Windows
Last updated: September 15, 2025
View details
Monitoring For Persistence Via BITS
Trouble
TA0005, T1197
Windows
Last updated: September 15, 2025
View details
Potential Data Stealing Via Chromium Headless Debugging
Trouble
TA0006, TA0009, TA0005, T1185
Windows
Last updated: September 15, 2025
View details
Browser Execution In Headless Mode
Trouble
TA0011, TA0005, T1105
Windows
Last updated: September 15, 2025
View details
File Download with Headless Browser
Trouble
TA0011, TA0005, T1105
Windows
Last updated: September 15, 2025
View details
Chromium Browser Instance Executed With Custom Extension
Trouble
TA0003, T1176.001
Windows
Last updated: September 15, 2025
View details
Chromium Browser Headless Execution To Mockbin Like Site
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Suspicious Chromium Browser Instance Executed With Custom Extension
Trouble
TA0003, T1176.001
Windows
Last updated: September 15, 2025
View details
File Download From Browser Process Via Inline URL
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Browser Started with Remote Debugging
Trouble
TA0006, TA0009, T1185
Windows
Last updated: September 15, 2025
View details
Tor Client/Browser Execution
Trouble
TA0011, T1090.003
Windows
Last updated: September 15, 2025
View details
Suspicious Calculator Usage
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Potential Binary Proxy Execution Via Cdb.EXE
Trouble
TA0002, TA0005, T1106
Windows
Last updated: September 15, 2025
View details
New Root Certificate Installed Via CertMgr.EXE
Trouble
TA0005, T1553.004
Windows
Last updated: September 15, 2025
View details
File Download via CertOC.EXE
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
DLL Loaded via CertOC.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential Arbitrary Command Execution Via FTP.EXE
Trouble
TA0002, TA0005, T1059
Windows
Last updated: September 15, 2025
View details
Arbitrary File Download Via GfxDownloadWrapper.EXE
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Suspicious Git Clone
Trouble
TA0043, T1593.003
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious GoogleUpdate Child Process
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Portable Gpg.EXE Execution
Trouble
TA0040, T1486
Windows
Last updated: September 15, 2025
View details
File Encryption/Decryption Via Gpg4win From Suspicious Locations
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Gpresult Display Group Policy Information
Trouble
TA0007, T1615
Windows
Last updated: September 15, 2025
View details
Arbitrary Binary Execution Using GUP Utility
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
File Download Using Notepad++ GUP Utility
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Suspicious GUP Usage
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Remote CHM File Download/Execution Via HH.EXE
Trouble
TA0005, T1218.001
Windows
Last updated: September 15, 2025
View details
HTML Help HH.EXE Suspicious Child Process
Trouble
TA0005, TA0002, TA0001, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious HH.EXE Execution
Trouble
TA0005, TA0002, TA0001, T1218
Windows
Last updated: September 15, 2025
View details
HackTool - F-Secure C3 Load by Rundll32
Critical
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Operator Bloopers Cobalt Strike Modules
Trouble
TA0002, T1059.003
Windows
Last updated: September 15, 2025
View details
CobaltStrike Load by Rundll32
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
HackTool - Covenant PowerShell Launcher
Trouble
TA0002, TA0005, T1059.001
Windows
Last updated: September 15, 2025
View details
HackTool - DInjector PowerShell Cradle Execution
Critical
TA0005, T1055
Windows
Last updated: September 15, 2025
View details
HackTool - EDRSilencer Execution
Trouble
TA0005, T1562
Windows
Last updated: September 15, 2025
View details
HackTool - Empire PowerShell Launch Parameters
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
HackTool - Empire PowerShell UAC Bypass
Critical
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
HackTool - WinRM Access Via Evil-WinRM
Trouble
TA0008, T1021.006
Windows
Last updated: September 15, 2025
View details
Hacktool Execution - PE Metadata
Trouble
TA0006, TA0042, T1003
Windows
Last updated: September 15, 2025
View details
HackTool - GMER Rootkit Detector and Remover Execution
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
HackTool - HandleKatz LSASS Dumper Execution
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
HackTool - Hashcat Password Cracker Execution
Trouble
TA0006, T1110.002
Windows
Last updated: September 15, 2025
View details
HackTool - Htran/NATBypass Execution
Trouble
TA0011, T1090
Windows
Last updated: September 15, 2025
View details
HackTool - Hydra Password Bruteforce Execution
Trouble
TA0006, T1110
Windows
Last updated: September 15, 2025
View details
HackTool - Impacket Tools Execution
Trouble
TA0002, TA0006, T1557.001
Windows
Last updated: September 15, 2025
View details
HackTool - Impersonate Execution
Trouble
TA0004, TA0005, T1134.001
Windows
Last updated: September 15, 2025
View details
HackTool - Inveigh Execution
Critical
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Invoke-Obfuscation COMPRESS OBFUSCATION
Trouble
TA0005, TA0002, T1027
Windows
Last updated: September 15, 2025
View details
HackTool - Jlaive In-Memory Assembly Execution
Trouble
TA0002, T1059.003
Windows
Last updated: September 15, 2025
View details
HackTool - Koadic Execution
Trouble
TA0002, T1059.003
Windows
Last updated: September 15, 2025
View details
HackTool - KrbRelay Execution
Trouble
TA0006, T1558.003
Windows
Last updated: September 15, 2025
View details
HackTool - KrbRelayUp Execution
Trouble
TA0006, TA0008, T1558.003
Windows
Last updated: September 15, 2025
View details
HackTool - LocalPotato Execution
Trouble
TA0005, TA0004
Windows
Last updated: September 15, 2025
View details
Potential Meterpreter/CobaltStrike Activity
Trouble
TA0004, T1134.001
Windows
Last updated: September 15, 2025
View details
HackTool - Mimikatz Execution
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
HackTool - PCHunter Execution
Trouble
TA0002, TA0007, T1082
Windows
Last updated: September 15, 2025
View details
HackTool - Default PowerSploit/Empire Scheduled Task Creation
Trouble
TA0002, TA0003, TA0004, T1053.005
Windows
Last updated: September 15, 2025
View details
HackTool - PowerTool Execution
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
HackTool - PurpleSharp Execution
Critical
TA0042, T1587
Windows
Last updated: September 15, 2025
View details
HackTool - Pypykatz Credentials Dumping Activity
Trouble
TA0006, T1003.002
Windows
Last updated: September 15, 2025
View details
HackTool - RedMimicry Winnti Playbook Execution
Trouble
TA0002, TA0005, T1106
Windows
Last updated: September 15, 2025
View details
Potential SMB Relay Attack Tool Execution
Critical
TA0002, TA0006, T1557.001
Windows
Last updated: September 15, 2025
View details
HackTool - SafetyKatz Execution
Critical
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
HackTool - SecurityXploded Execution
Critical
TA0006, T1555
Windows
Last updated: September 15, 2025
View details
HackTool - SharPersist Execution
Trouble
TA0003, T1053
Windows
Last updated: September 15, 2025
View details
HackTool - SharpEvtMute Execution
Trouble
TA0005, T1562.002
Windows
Last updated: September 15, 2025
View details
HackTool - SharpMove Tool Execution
Trouble
TA0008, T1021.002
Windows
Last updated: September 15, 2025
View details
HackTool - SharpUp PrivEsc Tool Execution
Critical
TA0004, TA0007, TA0002, T1574.005
Windows
Last updated: September 15, 2025
View details
HackTool - SharpWSUS/WSUSpendu Execution
Trouble
TA0002, TA0008, T1210
Windows
Last updated: September 15, 2025
View details
HackTool - SharpChisel Execution
Trouble
TA0011, T1090.001
Windows
Last updated: September 15, 2025
View details
HackTool - SharpDPAPI Execution
Trouble
TA0004, TA0005, T1134.001
Windows
Last updated: September 15, 2025
View details
HackTool - SharpImpersonation Execution
Trouble
TA0004, TA0005, T1134.001
Windows
Last updated: September 15, 2025
View details
HackTool - SILENTTRINITY Stager Execution
Trouble
TA0011, T1071
Windows
Last updated: September 15, 2025
View details
HackTool - Sliver C2 Implant Activity Pattern
Critical
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
HackTool - SysmonEOP Execution
Critical
TA0004, T1068
Windows
Last updated: September 15, 2025
View details
HackTool - UACMe Akagi Execution
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
HackTool - Windows Credential Editor (WCE) Execution
Critical
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
HackTool - winPEAS Execution
Trouble
TA0004, TA0007, T1082
Windows
Last updated: September 15, 2025
View details
HackTool - Wmiexec Default Powershell Command
Trouble
TA0005, TA0008
Windows
Last updated: September 15, 2025
View details
HackTool - XORDump Execution
Trouble
TA0005, TA0006, T1036
Windows
Last updated: September 15, 2025
View details
Suspicious ZipExec Execution
Trouble
TA0002, TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious Execution of Hostname
Attention
TA0007, T1082
Windows
Last updated: September 15, 2025
View details
Suspicious HWP Sub Processes
Trouble
TA0001, TA0002, T1566.001
Windows
Last updated: September 15, 2025
View details
Potential Fake Instance Of Hxtsr.EXE Executed
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Use Icacls to Hide File to Everyone
Trouble
TA0005, T1564.001
Windows
Last updated: September 15, 2025
View details
File Download And Execution Via IEExec.EXE
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Disable Windows IIS HTTP Logging
Trouble
TA0005, T1562.002
Windows
Last updated: September 15, 2025
View details
Microsoft IIS Service Account Password Dumped
Trouble
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
IIS Native-Code Module Command Line Installation
Trouble
TA0003, T1505.003
Windows
Last updated: September 15, 2025
View details
Suspicious IIS URL GlobalRules Rewrite Via AppCmd
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Microsoft IIS Connection Strings Decryption
Trouble
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Suspicious IIS Module Registration
Trouble
TA0003, T1505.004
Windows
Last updated: September 15, 2025
View details
C\\# IL Code Compilation Via Ilasm.EXE
Trouble
TA0005, T1127
Windows
Last updated: September 15, 2025
View details
ImagingDevices Unusual Parent/Child Processes
Trouble
TA0005, TA0002
Windows
Last updated: September 15, 2025
View details
Arbitrary File Download Via IMEWDBLD.EXE
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
InfDefaultInstall.exe .inf Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
File Download Via InstallUtil.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious Execution of InstallUtil Without Log
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Suspicious Shells Spawn by Java Utility Keytool
Trouble
TA0001, TA0003, TA0004
Windows
Last updated: September 15, 2025
View details
Suspicious Child Process Of Manage Engine ServiceDesk
Trouble
TA0011, T1102
Windows
Last updated: September 15, 2025
View details
Java Running with Remote Debugging
Trouble
TA0002, T1203
Windows
Last updated: September 15, 2025
View details
Suspicious Processes Spawned by Java.EXE
Trouble
TA0001, TA0003, TA0004
Windows
Last updated: September 15, 2025
View details
Shell Process Spawned by Java.EXE
Trouble
TA0001, TA0003, TA0004
Windows
Last updated: September 15, 2025
View details
Suspicious SysAidServer Child
Trouble
TA0008, T1210
Windows
Last updated: September 15, 2025
View details
JScript Compiler Execution
Attention
TA0005, T1127
Windows
Last updated: September 15, 2025
View details
Kavremover Dropped Binary LOLBIN Usage
Trouble
TA0005, T1127
Windows
Last updated: September 15, 2025
View details
Windows Kernel Debugger Execution
Trouble
TA0005, TA0004
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Child Process of KeyScrambler.exe
Trouble
TA0002, TA0005, TA0004, T1203
Windows
Last updated: September 15, 2025
View details
Uncommon Link.EXE Parent Process
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Rebuild Performance Counter Values Via Lodctr.EXE
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Suspicious Windows Trace ETW Session Tamper Via Logman.EXE
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Narrator's Feedback-Hub Persistence
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Office Application Startup - Office Test
Trouble
TA0003, T1137.002
Windows
Last updated: September 15, 2025
View details
Windows Registry Trust Record Modification
Trouble
TA0001, T1566.001
Windows
Last updated: September 15, 2025
View details
New PortProxy Registry Entry Added
Trouble
TA0008, TA0005, TA0011, T1090
Windows
Last updated: September 15, 2025
View details
WINEKEY Registry Modification
Trouble
TA0003, T1547
Windows
Last updated: September 15, 2025
View details
Shell Open Registry Keys Manipulation
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
Potential Credential Dumping Via LSASS SilentProcessExit Technique
Critical
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Security Support Provider (SSP) Added to LSA Configuration
Trouble
TA0003, T1547.005
Windows
Last updated: September 15, 2025
View details
Sticky Key Like Backdoor Usage - Registry
Critical
TA0004, TA0003, T1546.008
Windows
Last updated: September 15, 2025
View details
DLL Load via LSASS
Trouble
TA0002, TA0003, T1547.008
Windows
Last updated: September 15, 2025
View
details
Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Registry Persistence via Service in Safe Mode
Trouble
TA0005, T1564.001
Windows
Last updated: September 15, 2025
View details
Add Debugger Entry To AeDebug For Persistence
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Allow RDP Remote Assistance Feature
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Potential AMSI COM Server Hijacking
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Classes Autorun Keys Modification
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Internet Explorer Autorun Keys Modification
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Session Manager Autorun Keys Modification
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
System Scripts Autorun Keys Modification
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
WinSock2 Autorun Keys Modification
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Wow6432Node Classes Autorun Keys Modification
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
New BgInfo.EXE Custom DB Path Registry Configuration
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
New BgInfo.EXE Custom VBScript Registry Configuration
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
New BgInfo.EXE Custom WMI Query Registry Configuration
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Bypass UAC Using DelegateExecute
Trouble
TA0004, TA0005, T1548.002
Windows
Last updated: September 15, 2025
View details
Bypass UAC Using Event Viewer
Trouble
TA0003, T1547.010
Windows
Last updated: September 15, 2025
View details
Bypass UAC Using SilentCleanup Task
Trouble
TA0004, TA0005, T1548.002
Windows
Last updated: September 15, 2025
View details
Default RDP Port Changed to Non Standard Port
Trouble
TA0003, T1547.010
Windows
Last updated: September 15, 2025
View details
Sysmon Driver Altitude Change
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Change Winevt Channel Access Permission Via Registry
Trouble
TA0005, T1562.002
Windows
Last updated: September 15, 2025
View details
Potential CobaltStrike Service Installations - Registry
Trouble
TA0002, TA0004, TA0008, T1569.002
Windows
Last updated: September 15, 2025
View details
CrashControl CrashDump Disabled
Trouble
TA0005, T1564
Windows
Last updated: September 15, 2025
View details
Service Binary in Suspicious Folder
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Custom File Open Handler Executes PowerShell
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Potential Registry Persistence Attempt Via DbgManagedDebugger
Trouble
TA0003, T1574
Windows
Last updated: September 15, 2025
View details
Windows Defender Exclusions Added - Registry
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Desktop Background Change Via Registry
Trouble
TA0005, TA0040, T1112
Windows
Last updated: September 15, 2025
View details
Antivirus Filter Driver Disallowed On Dev Drive - Registry
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Hypervisor Enforced Code Integrity Disabled
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Hypervisor Enforced Paging Translation Disabled
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
DHCP Callout DLL Installation
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Disabled Windows Defender Eventlog
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Disable PUA Protection on Windows Defender
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Disable Tamper Protection on Windows Defender
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Disable Administrative Share Creation at Startup
Trouble
TA0005, T1070.005
Windows
Last updated: September 15, 2025
View details
Potential AutoLogger Sessions Tampering
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Disable Microsoft Defender Firewall via Registry
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Disable Internal Tools or Feature in Registry
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Disable Macro Runtime Scan Scope
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Disable Privacy Settings Experience in Registry
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Disable Windows Security Center Notifications
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Registry Disable System Restore
Trouble
TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Windows Defender Service Disabled - Registry
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Disable Windows Firewall by Registry
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Add DisallowRun Execution to Registry
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Persistence Via Disk Cleanup Handler - Autorun
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
DNS-over-HTTPS Enabled by Registry
Trouble
TA0005, T1140
Windows
Last updated: September 15, 2025
View details
New DNS ServerLevelPluginDll Installed
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
ETW Logging Disabled In .NET Processes - Sysmon Registry
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Periodic Backup For System Registry Hives Enabled
Trouble
TA0009, T1113
Windows
Last updated: September 15, 2025
View details
Windows Recall Feature Enabled - Registry
Trouble
TA0009, T1113
Windows
Last updated: September 15, 2025
View details
Enabling COR Profiler Environment Variables
Trouble
TA0003, TA0004, TA0005, T1574.012
Windows
Last updated: September 15, 2025
View details
Scripted Diagnostics Turn Off Check Enabled - Registry
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Potential EventLog File Location Tampering
Trouble
TA0005, T1562.002
Windows
Last updated: September 15, 2025
View details
Suspicious Application Allowed Through Exploit Guard
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
New File Association Using Exefile
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Add Debugger Entry To Hangs Key For Persistence
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Registry Modification to Hidden File Extension
Trouble
TA0003, T1137
Windows
Last updated: September 15, 2025
View details
Displaying Hidden Files Feature Disabled
Trouble
TA0005, T1564.001
Windows
Last updated: September 15, 2025
View details
Registry Hide Function from User
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Hide Schedule Task Via Index Value Tamper
Trouble
TA0005, T1562
Windows
Last updated: September 15, 2025
View details
Driver Added To Disallowed Images In HVCI - Registry
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Uncommon Extension In Keyboard Layout IME File Registry Value
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Suspicious Path In Keyboard Layout IME File Registry Value
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
New Root or CA or AuthRoot Certificate to Store
Trouble
TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Internet Explorer DisableFirstRunCustomize Enabled
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Potential Ransomware Activity Using LegalNotice Message
Trouble
TA0040, T1491.001
Windows
Last updated: September 15, 2025
View details
Lolbas OneDriveStandaloneUpdater.exe Proxy Download
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Lsass Full Dump Request Via DumpType Registry Settings
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
RestrictedAdminMode Registry Value Tampering
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Blue Mockingbird - Registry
Trouble
TA0002, TA0003, T1047
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Netsh Helper DLL - Registry
Trouble
TA0003, T1546.007
Windows
Last updated: September 15, 2025
View details
New Netsh Helper DLL Registered From A Suspicious Location
Trouble
TA0003, T1546.007
Windows
Last updated: September 15, 2025
View details
NET NGenAssemblyUsageLog Registry Key Tamper
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
New Application in AppCompat
Attention
TA0002, T1204.002
Windows
Last updated: September 15, 2025
View details
Potential Credential Dumping Attempt Using New NetworkProvider - REG
Trouble
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious ODBC Driver Registered
Trouble
TA0006, TA0003, T1003
Windows
Last updated: September 15, 2025
View details
Trust Access Disable For VBApplications
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Microsoft Office Protected View Disabled
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Python Function Execution Security Warning Disabled In Excel - Registry
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Enable Microsoft Dynamic Data Exchange
Trouble
TA0002, T1559.002
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
Trouble
TA0003, TA0011, T1137
Windows
Last updated: September 15, 2025
View details
Outlook Macro Execution Without Warning Setting Enabled
Trouble
TA0003, TA0011, T1137
Windows
Last updated: September 15, 2025
View details
Outlook EnableUnsafeClientMailRules Setting Enabled - Registry
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Outlook Security Settings Updated - Registry
Trouble
TA0003, T1137
Windows
Last updated: September 15, 2025
View details
Uncommon Microsoft Office Trusted Location Added
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Anomalous user account change
Critical
TA0003, TA0004, T1098
Miscellaneous
Last updated: September 15, 2025
View
details
Multiple tables dropped
Critical
TA0040, T1485
Miscellaneous
Last updated: September 15, 2025
View details
Repeated SQL injection attempts in DB
Critical
TA0001, T1190
Miscellaneous
Last updated: September 15, 2025
View details
Malicious URL requests
Critical
TA0011, T1071.001
Miscellaneous
Last updated: September 15, 2025
View details
Repeated SQL injection attempts
Critical
TA0001, T1190
Miscellaneous
Last updated: September 15, 2025
View details
Repeated failed SUDO commands
Critical
TA0004, T1548.003
Miscellaneous
Last updated: September 15, 2025
View details
Syslog service restarts
Critical
TA0005, T1562.002
Miscellaneous
Last updated: September 15, 2025
View details
Connected App Integration Activity during non-working hours in Salesforce
Attention
TA0003, T1671
Miscellaneous
Last updated: September 15, 2025
View details
Suspicious Bulk Data Transfer Activity in Salesforce
Attention
TA0010, T1567
Miscellaneous
Last updated: September 15, 2025
View details
Salesforce User Management Settings Modification
Attention
TA0003, TA0004, TA0005, T1136
Miscellaneous
Last updated: September 15, 2025
View details
Unix Privileged Command Execution Anomaly
Attention
TA0002, T1059
Miscellaneous
Last updated: September 15, 2025
View details
Unix Privileged Command Execution Failure Anomaly
Attention
TA0002, T1059
Miscellaneous
Last updated: September 15, 2025
View details
Anomalous Unix Password Change Activity
Critical
TA0006, T1110
Miscellaneous
Last updated: September 15, 2025
View details
Meraki Successive different Location Logons
Critical
TA0005, T1078.004
Miscellaneous
Last updated: September 15, 2025
View details
Huawei Successive different Location Logons
Critical
TA0005, T1078.004
Miscellaneous
Last updated: September 15, 2025
View details
IIS FTP server Privileged Command Execution Anomaly
Attention
TA0011, TA0002, T1071.002
Miscellaneous
Last updated: September 15, 2025
View details
Suspicious Password Change Activity on IIS FTP Server
Attention
TA0006, TA0005, TA0003, TA0004, TA0001, T1556.001
Miscellaneous
Last updated: September 15, 2025
View details
Office Macros Warning Disabled
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
MaxMpxCt Registry Value Changed
Attention
TA0005, T1070.005
Windows
Last updated: September 15, 2025
View details
Potential Persistence Using DebugPath
Trouble
TA0003, T1546.015
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via AppCompat RegisterAppRestart Layer
Trouble
TA0003, T1546.011
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via App Paths Default Property
Trouble
TA0003, T1546.012
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via AutodialDLL
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via CHM Helper DLL
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential PSFactoryBuffer COM Hijacking
Trouble
TA0003, T1546.015
Windows
Last updated: September 15, 2025
View details
COM Object Hijacking Via Modification Of Default System CLSID Default Value
Trouble
TA0003, T1546.015
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Event Viewer Events.asp
Trouble
TA0003, TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via GlobalFlags
Trouble
TA0004, TA0003, TA0005, T1546.012
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via LSA Extensions
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Mpnotify
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via MyComputer Registry Keys
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via DLLPathOverride
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Visual Studio Tools for Office
Trouble
TA0003, T1137.006
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Outlook Home Page
Trouble
TA0003, T1112
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Outlook Today Page
Trouble
TA0003, T1112
Windows
Last updated: September 15, 2025
View details
Potential WerFault ReflectDebugger Registry Value Abuse
Trouble
TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Scrobj.dll COM Hijacking
Trouble
TA0003, T1546.015
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Shim Database Modification
Trouble
TA0003, T1546.011
Windows
Last updated: September 15, 2025
View details
Suspicious Shim Database Patching Activity
Trouble
TA0003, T1546.011
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Shim Database In Uncommon Location
Trouble
TA0003, T1546.011
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via TypedPaths
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Excel Add-in - Registry
Trouble
TA0003, T1137.006
Windows
Last updated: September 15, 2025
View details
Potential Attachment Manager Settings Associations Tamper
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
PowerShell as a Service in Registry
Trouble
TA0002, T1569.002
Windows
Last updated: September 15, 2025
View details
PowerShell Script Execution Policy Enabled
Attention
TA0002
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell In Registry Run Keys
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
PowerShell Logging Disabled Via Registry Key Tampering
Trouble
TA0005, T1564.001
Windows
Last updated: September 15, 2025
View details
Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
ETW Logging Disabled For rpcrt4.dll
Attention
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Command Executed Via Run Dialog Box - Registry
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Potential SentinelOne Shell Context Menu Scan Command Tampering
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
ServiceDll Hijack
Trouble
TA0003, TA0004, T1543.003
Windows
Last updated: September 15, 2025
View
details
ETW Logging Disabled For SCM
Attention
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Registry Explorer Policy Modification
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Persistence Via New SIP Provider
Trouble
TA0003, TA0005, T1553.003
Windows
Last updated: September 15, 2025
View details
Tamper With Sophos AV Registry Keys
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Hiding User Account Via SpecialAccounts Registry Key
Trouble
TA0005, T1564.002
Windows
Last updated: September 15, 2025
View details
Activate Suppression of Windows Security Center Notifications
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Suspicious Environment Variable Has Been Registered
Trouble
TA0005, TA0003
Windows
Last updated: September 15, 2025
View details
Suspicious Keyboard Layout Load
Trouble
TA0042, T1588.002
Windows
Last updated: September 15, 2025
View details
Potential PendingFileRenameOperations Tampering
Trouble
TA0005, T1036.003
Windows
Last updated: September 15, 2025
View details
Suspicious Printer Driver Empty Manufacturer
Trouble
TA0004, T1574
Windows
Last updated: September 15, 2025
View details
Registry Persistence via Explorer Run Key
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
New RUN Key Pointing to Suspicious Folder
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Modify User Shell Folders Startup Value
Trouble
TA0003, TA0004, T1547.001
Windows
Last updated: September 15, 2025
View details
Potential Registry Persistence Attempt Via Windows Telemetry
Trouble
TA0003, T1053.005
Windows
Last updated: September 15, 2025
View details
RDP Sensitive Settings Changed to Zero
Trouble
TA0005, TA0003, T1112
Windows
Last updated: September 15, 2025
View details
New TimeProviders Registered With Uncommon DLL Name
Trouble
TA0003, TA0004, T1547.003
Windows
Last updated: September 15, 2025
View details
Old TLS1.0/TLS1.1 Protocol Version Enabled
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
COM Hijacking via TreatAs
Trouble
TA0003, T1546.015
Windows
Last updated: September 15, 2025
View details
Potential Signing Bypass Via Windows Developer Features - Registry
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
UAC Bypass via Event Viewer
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
UAC Bypass Abusing Winsat Path Parsing - Registry
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
UAC Bypass Using Windows Media Player - Registry
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
UAC Disabled
Trouble
TA0004, TA0005, T1548.002
Windows
Last updated: September 15, 2025
View
details
UAC Notification Disabled
Trouble
TA0004, TA0005, T1548.002
Windows
Last updated: September 15, 2025
View details
UAC Secure Desktop Prompt Disabled
Trouble
TA0004, TA0005, T1548.002
Windows
Last updated: September 15, 2025
View details
VBScript Payload Stored in Registry
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Execution DLL of Choice Using WAB.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Wdigest Enable UseLogonCredential
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Disable Windows Defender Functionalities Via Registry Keys
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Enable Local Manifest Installation With Winget
Trouble
TA0005, TA0003
Windows
Last updated: September 15, 2025
View details
Winlogon AllowMultipleTSSessions Enable
Trouble
TA0003, TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Winlogon Notify Key Logon Persistence
Trouble
TA0003, T1547.004
Windows
Last updated: September 15, 2025
View details
Scheduled Task Created - Registry
Attention
TA0002, TA0003, TA0004, T1053.005
Windows
Last updated: September 15, 2025
View details
Microsoft Office Trusted Location Updated
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Command Executed Via Run Dialog Box - Registry
Attention
TA0002
Windows
Last updated: September 15, 2025
View details
Shell Context Menu Command Tampering
Attention
TA0003
Windows
Last updated: September 15, 2025
View details
Remote Thread Created In KeePass.EXE
Trouble
TA0006, T1555.005
Windows
Last updated: September 15, 2025
View details
Remote Thread Creation In Mstsc.Exe From Suspicious Location
Trouble
TA0006
Windows
Last updated: September 15, 2025
View details
Potential Credential Dumping Attempt Via PowerShell Remote Thread
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Remote Thread Creation Via PowerShell In Uncommon Target
Trouble
TA0005, TA0002, T1218.011
Windows
Last updated: September 15, 2025
View details
Rare Remote Thread Creation By Uncommon Source Image
Trouble
TA0004, TA0005, T1055
Windows
Last updated: September 15, 2025
View details
Remote Thread Created In Shell Application
Trouble
TA0005, T1055
Windows
Last updated: September 15, 2025
View details
Remote Thread Creation In Uncommon Target Image
Trouble
TA0005, TA0004, T1055.003
Windows
Last updated: September 15, 2025
View details
Remote Thread Creation Ttdinject.exe Proxy
Trouble
TA0005, T1127
Windows
Last updated: September 15, 2025
View details
DNS Query for Anonfiles.com Domain - Sysmon
Trouble
TA0010, T1567.002
Windows
Last updated: September 15, 2025
View details
AppX Package Installation Attempts Via AppInstaller.EXE
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Cloudflared Tunnels Related DNS Requests
Trouble
TA0011, T1071.001
Windows
Last updated: September 15, 2025
View details
DNS Query To Devtunnels Domain
Trouble
TA0011, T1071.001
Windows
Last updated: September 15, 2025
View details
DNS HybridConnectionManager Service Bus
Trouble
TA0003, T1554
Windows
Last updated: September 15, 2025
View details
Suspicious Cobalt Strike DNS Beaconing - Sysmon
Critical
TA0011, T1071.004
Windows
Last updated: September 15, 2025
View details
DNS Query To MEGA Hosting Website
Trouble
TA0010, T1567.002
Windows
Last updated: September 15, 2025
View details
DNS Query Request To OneLaunch Update Service
Attention
TA0009, T1056
Windows
Last updated: September 15, 2025
View details
DNS Query Request By QuickAssist.EXE
Attention
TA0011, TA0001, TA0008, T1071.001
Windows
Last updated: September 15, 2025
View details
DNS Query Request By Regsvr32.EXE
Trouble
TA0002, TA0005, T1559.001
Windows
Last updated: September 15, 2025
View details
Suspicious DNS Query for IP Lookup Service APIs
Trouble
TA0043, T1590
Windows
Last updated: September 15, 2025
View details
TeamViewer Domain Query By Non-TeamViewer Application
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
DNS Query Tor .Onion Address - Sysmon
Trouble
TA0011, T1090.003
Windows
Last updated: September 15, 2025
View details
DNS Query To Ufile.io
Attention
TA0010, T1567.002
Windows
Last updated: September 15, 2025
View details
DNS Query To Visual Studio Code Tunnels Domain
Trouble
TA0011, T1071.001
Windows
Last updated: September 15, 2025
View details
CobaltStrike Named Pipe
Critical
TA0005, TA0004, T1055
Windows
Last updated: September 15, 2025
View details
CobaltStrike Named Pipe Patterns
Trouble
TA0005, TA0004, T1055
Windows
Last updated: September 15, 2025
View details
HackTool - CoercedPotato Named Pipe Creation
Trouble
TA0005, TA0004, T1055
Windows
Last updated: September 15, 2025
View details
HackTool - DiagTrackEoP Default Named Pipe
Critical
TA0004
Windows
Last updated: September 15, 2025
View details
HackTool - EfsPotato Named Pipe Creation
Trouble
TA0005, TA0004, T1055
Windows
Last updated: September 15, 2025
View details
HackTool - Credential Dumping Tools Named Pipe Created
Critical
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Service Started/Stopped Via Wmic.EXE
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Potential SquiblyTwo Technique Execution
Trouble
TA0005, TA0002, T1220
Windows
Last updated: September 15, 2025
View details
Suspicious WMIC Execution Via Office Process
Trouble
TA0002, TA0005, T1204.002
Windows
Last updated: September 15, 2025
View details
Suspicious Process Created Via Wmic.EXE
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Application Terminated Via Wmic.EXE
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Application Removed Via Wmic.EXE
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Potential Tampering With Security Products Via WMIC
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
XSL Script Execution Via WMIC.EXE
Trouble
TA0005, T1220
Windows
Last updated: September 15, 2025
View details
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
Trouble
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Suspicious WmiPrvSE Child Process
Trouble
TA0002, TA0005, T1047
Windows
Last updated: September 15, 2025
View details
WMI Backdoor Exchange Transport Agent
Critical
TA0003, T1546.003
Windows
Last updated: September 15, 2025
View details
UEFI Persistence Via Wpbbin - ProcessCreation
Trouble
TA0003, TA0005, T1542.001
Windows
Last updated: September 15, 2025
View details
Potential Dropper Script Execution Via WScript/CScript
Trouble
TA0002, T1059.005
Windows
Last updated: September 15, 2025
View details
Cscript/Wscript Potentially Suspicious Child Process
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Cscript/Wscript Uncommon Script Extension Execution
Trouble
TA0002, T1059.005
Windows
Last updated: September 15, 2025
View details
WSL Child Process Anomaly
Trouble
TA0002, TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Proxy Execution Via Wuauclt.EXE
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious Windows Update Agent Empty Cmdline
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Wusa.EXE Executed By Parent Process Located In Suspicious Location
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Xwizard.EXE Execution From Non-Default Location
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Password Protected Compressed File Extraction Via 7Zip
Attention
TA0009, T1560.001
Windows
Last updated: September 15, 2025
View details
Set Files as System Files Using Attrib.EXE
Attention
TA0005, T1564.001
Windows
Last updated: September 15, 2025
View details
Potential BOINC Software Execution (UC-Berkeley Signature)
Attention
TA0002, TA0005, T1553
Windows
Last updated: September 15, 2025
View details
CMD Shell Output Redirect
Attention
TA0007, T1082
Windows
Last updated: September 15, 2025
View details
Potential File Override/Append Via SET Command
Attention
TA0002, TA0005
Windows
Last updated: September 15, 2025
View details
Headless Process Launched Via Conhost.EXE
Trouble
TA0005, TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Dynamic .NET Compilation Via Csc.EXE - Hunting
Trouble
TA0005, T1027.004
Windows
Last updated: September 15, 2025
View details
File Download Via Curl.EXE
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Curl.EXE Execution With Custom UserAgent
Trouble
TA0011, T1071.001
Windows
Last updated: September 15, 2025
View details
Diskshadow Child Process Spawned
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Diskshadow Script Mode Execution
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Potential Proxy Execution Via Explorer.EXE From Shell Process
Attention
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Activity Via ExtExport.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential Password Reconnaissance Via Findstr.EXE
Trouble
TA0006, T1552.001
Windows
Last updated: September 15, 2025
View details
New Self Extracting Package Created Via IExpress.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Microsoft Workflow Compiler Execution
Trouble
TA0005, TA0002, T1127
Windows
Last updated: September 15, 2025
View details
Net.EXE Execution
Attention
TA0007, TA0008, T1007
Windows
Last updated: September 15, 2025
View
details
SMB over QUIC Via Net.EXE
Trouble
TA0008, T1570
Windows
Last updated: September 15, 2025
View details
Suspicious New Instance Of An Office COM Object
Trouble
TA0002, TA0005
Windows
Last updated: September 15, 2025
View details
Invocation Of Crypto-Classes From The Cryptography PowerShell Namespace
Trouble
TA0002, TA0005, T1059.001
Windows
Last updated: September 15, 2025
View details
Import New Module Via PowerShell CommandLine
Attention
TA0002
Windows
Last updated: September 15, 2025
View details
New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet
Attention
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious PowerShell Child Processes
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - Cmd.EXE Execution via AnyViewer
Trouble
TA0002, TA0003
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - ScreenConnect Remote Command Execution - Hunting
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
DLL Call by Ordinal Via Rundll32.EXE
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Rundll32.EXE Calling DllRegisterServer Export Function Explicitly
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Scheduled Task Creation From Potential Suspicious Parent Location
Trouble
TA0002, T1053.005
Windows
Last updated: September 15, 2025
View details
SC.EXE Query Execution
Attention
TA0007, T1007
Windows
Last updated: September 15, 2025
View details
Potential CommandLine Obfuscation Using Unicode Characters
Trouble
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
EventLog Query Requests By Builtin Utilities
Trouble
TA0006, T1552
Windows
Last updated: September 15, 2025
View details
Potential Suspicious Execution From GUID Like Folder Names
Attention
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
Execution From Webserver Root Folder
Trouble
TA0003, T1505.003
Windows
Last updated: September 15, 2025
View details
Tunneling Tool Execution
Trouble
TA0010, TA0011, T1041
Windows
Last updated: September 15, 2025
View details
File or Folder Permissions Modifications
Trouble
TA0005, T1222.001
Windows
Last updated: September 15, 2025
View details
Process Terminated Via Taskkill
Attention
TA0040, T1489
Windows
Last updated: September 15, 2025
View details
Suspicious Tasklist Discovery Command
Attention
TA0007, T1057
Windows
Last updated: September 15, 2025
View details
System Information Discovery Via Wmic.EXE
Attention
TA0007, T1082
Windows
Last updated: September 15, 2025
View details
WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Trouble
TA0002, T1059.005
Windows
Last updated: September 15, 2025
View details
Arbitrary Command Execution Using WSL
Trouble
TA0002, TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Cab File Extraction Via Wusa.EXE
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
LSASS Memory Access by Tool With Dump Keyword In Name
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Remote LSASS Process Access Through Windows Remote Management
Trouble
TA0006, TA0002, TA0008, T1003.001
Windows
Last updated: September 15, 2025
View details
Suspicious LSASS Access Via MalSecLogon
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Credential Dumping Attempt Via WerFault
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Uncommon Process Access Rights For Target Image
Attention
TA0005, TA0004, T1055.011
Windows
Last updated: September 15, 2025
View details
Potential Credential Dumping Attempt Via PowerShell
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Diamond Sleet APT Scheduled Task Creation - Registry
Trouble
TA0005, T1562
Windows
Last updated: September 15, 2025
View details
SNAKE Malware Covert Store Registry Key
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Outlook Task/Note Reminder Received
Attention
TA0003, T1137
Windows
Last updated: September 15, 2025
View details
Potential COLDSTEEL RAT Windows User Creation
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential Encrypted Registry Blob Related To SNAKE Malware
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Forest Blizzard APT - Custom Protocol Handler Creation
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Forest Blizzard APT - Custom Protocol Handler DLL Registry Set
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Potential KamiKakaBot Activity - Winlogon Shell Persistence
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Kapeka Backdoor Configuration Persistence
Trouble
TA0003, TA0005, T1553.003
Windows
Last updated: September 15, 2025
View details
Potential NetWire RAT Activity - Registry
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Potential COM Object Hijacking Via TreatAs Subkey - Registry
Trouble
TA0003, T1546.015
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Disk Cleanup Handler - Registry
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Logon Scripts - Registry
Trouble
TA0003, TA0008, T1037.001
Windows
Last updated: September 15, 2025
View details
PUA - Sysinternal Tool Execution - Registry
Attention
TA0042, T1588.002
Windows
Last updated: September 15, 2025
View details
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted
Trouble
TA0009, T1113
Windows
Last updated: September 15, 2025
View details
Folder Removed From Exploit Guard ProtectedFolders List - Registry
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Terminal Server Client Connection History Cleared - Registry
Trouble
TA0005, T1070
Windows
Last updated: September 15, 2025
View details
Removal Of AMSI Provider Registry Keys
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Removal Of Index Value to Hide Schedule Task - Registry
Trouble
TA0005, T1562
Windows
Last updated: September 15, 2025
View details
Removal Of SD Value to Hide Schedule Task - Registry
Trouble
TA0005, T1562
Windows
Last updated: September 15, 2025
View details
UAC Bypass Via Wsreset
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
CMSTP Execution Registry Event
Trouble
TA0005, TA0002, T1218.003
Windows
Last updated: September 15, 2025
View details
Wdigest CredGuard Registry Modification
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Windows Credential Editor Registry
Critical
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
HybridConnectionManager Service Installation - Registry
Trouble
TA0042, T1608
Windows
Last updated: September 15, 2025
View details
Potential Qakbot Registry Activity
Trouble
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Registry Entries For Azorult Malware
Critical
TA0003, TA0002, T1112
Windows
Last updated: September 15, 2025
View details
Path To Screensaver Binary Modified
Trouble
TA0003, TA0004, T1546.002
Windows
Last updated: September 15, 2025
View details
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
Trouble
TA0008, TA0004, TA0003, T1546.003
Windows
Last updated: September 15, 2025
View details
Potential 7za.DLL Sideloading
Attention
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Abusable DLL Potential Sideloading From Suspicious Location
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Potential Antivirus Software DLL Sideloading
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential appverifUI.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Aruba Network Service Potential DLL Sideloading
Trouble
TA0004, TA0003, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential AVKkid.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential CCleanerDU.DLL Sideloading
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential CCleanerReactivator.DLL Sideloading
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Chrome Frame Helper DLL Sideloading
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Via ClassicExplorer32.dll
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Via comctl32.dll
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Using Coregen.exe
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
System Control Panel Item Loaded From Uncommon Location
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Of DBGCORE.DLL
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Of DBGHELP.DLL
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Of DbgModel.DLL
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential EACore.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Edputil.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Goopdate.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Iviewers.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Via JsSchHlp
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Libvlc.DLL Sideloading
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Mfdetours.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Unsigned Mfdetours.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Of MpSvc.DLL
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Of MsCorSvc.DLL
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Of Non-Existent DLLs From System Folders
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Microsoft Office DLL Sideload
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Python DLL SideLoading
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Rcdll.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential RoboForm.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential ShellDispatch.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
DLL Sideloading Of ShellChromeAPI.DLL
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential SmadHook.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential SolidPDFCreator.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Third Party Software DLL Sideloading
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Fax Service DLL Search Order Hijack
Trouble
TA0003, TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Vivaldi_elf.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
VMGuestLib DLL Sideload
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
VMMap Unsigned Dbghelp.DLL Potential Sideloading
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Via VMware Xfer
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Waveedit.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Wazuh Security Platform DLL Sideloading
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential Mpclient.DLL Sideloading
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential WWlib.DLL Sideloading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Windows Spooler Service Suspicious Binary Load
Attention
TA0003, TA0005, TA0004, T1574
Windows
Last updated: September 15, 2025
View details
Unsigned Module Loaded by ClickOnce Application
Trouble
TA0003, T1574.001
Windows
Last updated: September 15, 2025
View details
DLL Load By System Process From Suspicious Locations
Trouble
TA0005, T1070
Windows
Last updated: September 15, 2025
View details
Python Image Load By Non-Python Process
Trouble
TA0005, T1027.002
Windows
Last updated: September 15, 2025
View details
DotNet CLR DLL Loaded By Scripting Applications
Trouble
TA0002, TA0004, T1055
Windows
Last updated: September 15, 2025
View details
Unsigned DLL Loaded by Windows Utility
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Suspicious Unsigned Thor Scanner Execution
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
UAC Bypass With Fake DLL
Trouble
TA0003, TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
WMIC Loading Scripting Libraries
Trouble
TA0005, T1220
Windows
Last updated: September 15, 2025
View details
Wmiprvse Wbemcomn DLL Hijack
Trouble
TA0002, TA0008, T1047
Windows
Last updated: September 15, 2025
View details
Suspicious WSMAN Provider Image Loads
Trouble
TA0002, TA0008, T1059.001
Windows
Last updated: September 15, 2025
View details
Amsi.DLL Load By Uncommon Process
Attention
TA0005, TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
System Drawing DLL Load
Attention
TA0009, T1113
Windows
Last updated: September 15, 2025
View details
Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location
Attention
TA0003, TA0002, T1053.005
Windows
Last updated: September 15, 2025
View details
Microsoft Excel Add-In Loaded
Attention
TA0002, T1204.002
Windows
Last updated: September 15, 2025
View details
Microsoft Word Add-In Loaded
Attention
TA0002, T1204.002
Windows
Last updated: September 15, 2025
View details
WMI Module Loaded By Uncommon Process
Attention
TA0002, T1047
Windows
Last updated: September 15, 2025
View details
Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon
Trouble
TA0011
Windows
Last updated: September 15, 2025
View details
Network Connection Initiated By AddinUtil.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Uncommon Network Connection Initiated By Certutil.EXE
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Network Connection Initiated To BTunnels Domains
Trouble
TA0010, TA0011, T1567
Windows
Last updated: September 15, 2025
View details
Network Connection Initiated To Cloudflared Tunnels Domains
Trouble
TA0010, TA0011, T1567
Windows
Last updated: September 15, 2025
View details
Network Connection Initiated To DevTunnels Domain
Trouble
TA0010, TA0011, T1567.001
Windows
Last updated: September 15, 2025
View details
Suspicious Dropbox API Usage
Trouble
TA0011, TA0010, T1105
Windows
Last updated: September 15, 2025
View details
Suspicious Network Connection to IP Lookup Service APIs
Trouble
TA0007, T1016
Windows
Last updated: September 15, 2025
View details
Communication To LocaltoNet Tunneling Service Initiated
Trouble
TA0011, T1572
Windows
Last updated: September 15, 2025
View details
Network Connection Initiated To Mega.nz
Attention
TA0010, T1567.002
Windows
Last updated: September 15, 2025
View details
Process Initiated Network Connection To Ngrok Domain
Trouble
TA0010, T1567.001
Windows
Last updated: September 15, 2025
View details
Communication To Ngrok Tunneling Service Initiated
Trouble
TA0010, TA0011, T1567
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Network Connection To Notion API
Attention
TA0011, T1102
Windows
Last updated: September 15, 2025
View details
Network Communication Initiated To Portmap.IO Domain
Trouble
TA0011, TA0010, T1090.002
Windows
Last updated: September 15, 2025
View details
Suspicious Non-Browser Network Communication With Telegram API
Trouble
TA0011, TA0010, T1102
Windows
Last updated: September 15, 2025
View details
Network Connection Initiated To Visual Studio Code Tunnels Domain
Trouble
TA0010, TA0011, T1567
Windows
Last updated: September 15, 2025
View details
Network Connection Initiated By Eqnedt32.EXE
Trouble
TA0002, T1203
Windows
Last updated: September 15, 2025
View details
Network Connection Initiated By IMEWDBLD.EXE
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Network Connection Initiated Via Notepad.EXE
Trouble
TA0011, TA0002, TA0005, T1055
Windows
Last updated: September 15, 2025
View details
Office Application Initiated Network Connection Over Uncommon Ports
Trouble
TA0005, TA0011
Windows
Last updated: September 15, 2025
View details
Python Initiated Connection
Trouble
TA0007, T1046
Windows
Last updated: September 15, 2025
View details
Outbound RDP Connections Over Non-Standard Tools
Trouble
TA0008, T1021.001
Windows
Last updated: September 15, 2025
View details
Network Connection Initiated By Regsvr32.EXE
Trouble
TA0002, TA0005, T1559.001
Windows
Last updated: September 15, 2025
View details
Silenttrinity Stager Msbuild Activity
Trouble
TA0002, TA0005, T1127.001
Windows
Last updated: September 15, 2025
View details
Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Uncommon Outbound Kerberos Connection
Trouble
TA0006, TA0008, T1558
Windows
Last updated: September 15, 2025
View details
Suspicious Outbound SMTP Connections
Trouble
TA0010, T1048.003
Windows
Last updated: September 15, 2025
View details
Suspicious Wordpad Outbound Connections
Trouble
TA0005, TA0011
Windows
Last updated: September 15, 2025
View details
HH.EXE Initiated HTTP Network Connection
Trouble
TA0005, T1218.001
Windows
Last updated: September 15, 2025
View details
Msiexec.EXE Initiated Network Connection Over HTTP
Attention
TA0005, T1218.007
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Azure Front Door Connection
Trouble
TA0011, T1102.002
Windows
Last updated: September 15, 2025
View details
Potential APT FIN7 POWERHOLD Execution
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Potential POWERTRASH Script Execution
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
PowerShell Module File Created
Attention
TA0003
Windows
Last updated: September 15, 2025
View details
PowerShell Module File Created By Non-PowerShell Process
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential Startup Shortcut Persistence Via PowerShell.EXE
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
PSScriptPolicyTest Creation By Uncommon Process
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Rclone Config File Creation
Trouble
TA0010, T1567.002
Windows
Last updated: September 15, 2025
View details
.RDP File Created By Uncommon Application
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Potential Winnti Dropper Activity
Trouble
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
PDF File Created By RegEdit.EXE
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
RemCom Service File Creation
Trouble
TA0002, T1569.002
Windows
Last updated: September 15, 2025
View details
ScreenConnect Temporary Installation Artefact
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Remote Access Tool - ScreenConnect Temporary File
Attention
TA0002, T1059.003
Windows
Last updated: September 15, 2025
View details
Potential RipZip Attack on Startup Folder
Trouble
TA0003, T1547
Windows
Last updated: September 15, 2025
View details
Potential SAM Database Dump
Trouble
TA0006, T1003.002
Windows
Last updated: September 15, 2025
View details
Self Extraction Directive File Created In Potentially Suspicious Location
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Windows Shell/Scripting Application File Write to Suspicious Folder
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Startup Folder File Write
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Created Files by Microsoft Sync Center
Trouble
TA0002, TA0005, T1055
Windows
Last updated: September 15, 2025
View details
Suspicious Files in Default GPO Folder
Trouble
TA0005, T1036.005
Windows
Last updated: September 15, 2025
View details
Suspicious Desktopimgdownldr Target File
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Suspicious desktop.ini Action
Trouble
TA0003, T1547.009
Windows
Last updated: September 15, 2025
View details
Suspicious Creation TXT File in User Desktop
Trouble
TA0040, T1486
Windows
Last updated: September 15, 2025
View details
Suspicious Double Extension Files
Trouble
TA0005, T1036.007
Windows
Last updated: September 15, 2025
View details
Suspicious MSExchangeMailboxReplication ASPX Write
Trouble
TA0001, TA0003, T1190
Windows
Last updated: September 15, 2025
View details
Suspicious Executable File Creation
Trouble
TA0005, T1564
Windows
Last updated: September 15, 2025
View details
Suspicious Get-Variable.exe Creation
Trouble
TA0003, TA0005, T1546
Windows
Last updated: September 15, 2025
View details
Legitimate Application Dropped Archive
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Legitimate Application Dropped Executable
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Legitimate Application Dropped Script
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious PFX File Creation
Trouble
TA0006, T1552.004
Windows
Last updated: September 15, 2025
View details
PowerShell Profile Modification
Trouble
TA0003, TA0004, T1546.013
Windows
Last updated: September 15, 2025
View details
Suspicious PROCEXP152.sys File Created In TMP
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Suspicious File Creation Activity From Fake Recycle.Bin Folder
Trouble
TA0003, TA0005
Windows
Last updated: September 15, 2025
View details
Potential File Extension Spoofing Using Right-to-Left Override
Trouble
TA0002, TA0005, T1036.002
Windows
Last updated: September 15, 2025
View details
Drop Binaries Into Spool Drivers Color Folder
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Suspicious Startup Folder Persistence
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Suspicious Interactive PowerShell as SYSTEM
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Suspicious Scheduled Task Write to System32 Tasks
Trouble
TA0003, TA0002, T1053
Windows
Last updated: September 15, 2025
View details
TeamViewer Remote Session
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
VsCode Powershell Profile Modification
Trouble
TA0003, TA0004, T1546.013
Windows
Last updated: September 15, 2025
View details
Windows Terminal Profile Settings Modification By Uncommon Process
Trouble
TA0003, T1547.015
Windows
Last updated: September 15, 2025
View details
LiveKD Kernel Memory Dump File Created
Trouble
TA0005, TA0004
Windows
Last updated: September 15, 2025
View details
Process Explorer Driver Creation By Non-Sysinternals Binary
Trouble
TA0003, TA0004, T1068
Windows
Last updated: September 15, 2025
View details
Process Monitor Driver Creation By Non-Sysinternals Binary
Trouble
TA0003, TA0004, T1068
Windows
Last updated: September 15, 2025
View details
PsExec Service File Creation
Attention
TA0002, T1569.002
Windows
Last updated: September 15, 2025
View details
PSEXEC Remote Execution File Artefact
Trouble
TA0008, TA0004, TA0002, TA0003, T1570
Windows
Last updated: September 15, 2025
View details
Potential Privilege Escalation Attempt Via .Exe.Local Technique
Trouble
TA0005, TA0003, TA0004
Windows
Last updated: September 15, 2025
View details
Hijack Legit RDP Session to Move Laterally
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
UAC Bypass Using Consent and Comctl32 - File
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
UAC Bypass Using .NET Code Profiler on MMC
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
UAC Bypass Using IDiagnostic Profile - File
Trouble
TA0002, TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
UAC Bypass Using MSConfig Token Modification - File
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
UAC Bypass Using NTFS Reparse Point - File
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
UAC Bypass Abusing Winsat Path Parsing - File
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
UAC Bypass Using Windows Media Player - File
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
VHD Image Download Via Browser
Trouble
TA0042, T1587.001
Windows
Last updated: September 15, 2025
View details
Visual Studio Code Tunnel Remote File Creation
Trouble
TA0011
Windows
Last updated: September 15, 2025
View details
Renamed VsCode Code Tunnel Execution - File Indicator
Trouble
TA0011
Windows
Last updated: September 15, 2025
View details
Creation of WerFault.exe/Wer.dll in Unusual Folder
Trouble
TA0003, TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File
Trouble
TA0005, T1216
Windows
Last updated: September 15, 2025
View details
UEFI Persistence Via Wpbbin - FileCreation
Trouble
TA0003, TA0005, T1542.001
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Self Extraction Directive File Created
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Access To Chromium Browsers Sensitive Files By Uncommon Applications
Attention
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Access To Browser Credential Files By Uncommon Applications
Attention
TA0006, T1003
Windows
Last updated: September 15, 2025
View details
Access To Windows Outlook Mail Files By Uncommon Applications
Attention
TA0005, T1070.008
Windows
Last updated: September 15, 2025
View details
Access To .Reg/.Hive Files By Uncommon Applications
Attention
TA0005, T1112
Windows
Last updated: September 15, 2025
View details
Unattend.XML File Access Attempt
Attention
TA0006, T1552.001
Windows
Last updated: September 15, 2025
View details
Scheduled Task Created - FileCreation
Attention
TA0002, TA0003, TA0004, T1053.005
Windows
Last updated: September 15, 2025
View details
VsCode Code Tunnel Execution File Indicator
Trouble
TA0011
Windows
Last updated: September 15, 2025
View details
WebDAV Temporary Local File Creation
Trouble
TA0001, TA0042, T1566
Windows
Last updated: September 15, 2025
View details
DLL Names Used By SVR For GraphicalProton Backdoor
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Diamond Sleet APT DLL Sideloading Indicators
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Lazarus APT DLL Sideloading Activity
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
Potential COLDSTEEL Persistence Service DLL Load
Trouble
TA0003, TA0005
Windows
Last updated: September 15, 2025
View details
Potential Raspberry Robin Aclui Dll SideLoading
Trouble
TA0005, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
DLL Loaded From Suspicious Location Via Cmspt.EXE
Trouble
TA0005, T1218.003
Windows
Last updated: September 15, 2025
View details
Amsi.DLL Loaded Via LOLBIN Process
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
CredUI.DLL Loaded By Uncommon Process
Trouble
TA0006, TA0009, T1056.002
Windows
Last updated: September 15, 2025
View details
Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
PCRE.NET Package Image Load
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Load Of RstrtMgr.DLL By A Suspicious Process
Trouble
TA0040, TA0005, T1486
Windows
Last updated: September 15, 2025
View details
Load Of RstrtMgr.DLL By An Uncommon Process
Attention
TA0040, TA0005, T1486
Windows
Last updated: September 15, 2025
View details
Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
PowerShell Core DLL Loaded By Non PowerShell Process
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Time Travel Debugging Utility Usage - Image
Trouble
TA0005, TA0006, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious Volume Shadow Copy Vssapi.dll Load
Trouble
TA0005, TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Suspicious Volume Shadow Copy Vsstrace.dll Load
Trouble
TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Suspicious Volume Shadow Copy VSS_PS.dll Load
Trouble
TA0005, TA0040, T1490
Windows
Last updated: September 15, 2025
View details
HackTool - SILENTTRINITY Stager DLL Load
Trouble
TA0011, T1071
Windows
Last updated: September 15, 2025
View details
Potential DCOM InternetExplorer.Application DLL Hijack - Image Load
Critical
TA0008, T1021.002
Windows
Last updated: September 15, 2025
View details
Unsigned Image Loaded Into LSASS Process
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
DotNET Assembly DLL Loaded Via Office Application
Trouble
TA0002, T1204.002
Windows
Last updated: September 15, 2025
View details
CLR DLL Loaded Via Office Applications
Trouble
TA0002, T1204.002
Windows
Last updated: September 15, 2025
View details
GAC DLL Loaded Via Office Applications
Trouble
TA0002, T1204.002
Windows
Last updated: September 15, 2025
View details
Microsoft Excel Add-In Loaded From Uncommon Location
Trouble
TA0002, T1204.002
Windows
Last updated: September 15, 2025
View details
Microsoft VBA For Outlook Addin Loaded Via Outlook
Trouble
TA0002, T1204.002
Windows
Last updated: September 15, 2025
View details
PowerShell Core DLL Loaded Via Office Application
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
VBA DLL Loaded Via Office Application
Trouble
TA0002, T1204.002
Windows
Last updated: September 15, 2025
View details
Suspicious CustomShellHost Execution
Trouble
TA0005, T1216
Windows
Last updated: September 15, 2025
View details
LOLBAS Data Exfiltration by DataSvcUtil.exe
Trouble
TA0010, T1567
Windows
Last updated: September 15, 2025
View details
DeviceCredentialDeployment Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Devtoolslauncher.exe Executes Specified Binary
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious Diantz Download and Compress Into a CAB File
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Suspicious Extrac32 Execution
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
Trouble
TA0007, TA0002, T1615
Windows
Last updated: September 15, 2025
View details
Ie4uinit Lolbin Use From Invalid Path
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Launch-VsDevShell.PS1 Proxy Execution
Trouble
TA0005, T1216.001
Windows
Last updated: September 15, 2025
View details
Potential Manage-bde.wsf Abuse To Proxy Execution
Trouble
TA0005, T1216
Windows
Last updated: September 15, 2025
View details
Mavinject Inject DLL Into Running Process
Trouble
TA0005, TA0004, T1055.001
Windows
Last updated: September 15, 2025
View details
Execute Files with Msdeploy.exe
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Execute MSDT Via Answer File
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
OpenWith.exe Executes Specified Binary
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Use of Pcalua For Execution
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Indirect Command Execution By Program Compatibility Wizard
Attention
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Execute Pcwrun.EXE To Leverage Follina
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Code Execution via Pcwutl.dll
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Execute Code with Pester.bat
Trouble
TA0002, TA0005, T1059.001
Windows
Last updated: September 15, 2025
View details
PrintBrm ZIP Creation of Extraction
Trouble
TA0011, TA0005, T1105
Windows
Last updated: September 15, 2025
View details
Pubprn.vbs Proxy Execution
Trouble
TA0005, T1216.001
Windows
Last updated: September 15, 2025
View details
DLL Execution via Rasautou.exe
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
REGISTER_APP.VBS Proxy Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Lolbin Runexehelper Use As Proxy
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious Runscripthelper.exe
Trouble
TA0002, TA0005, T1059
Windows
Last updated: September 15, 2025
View details
Use of Scriptrunner.exe
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Using SettingSyncHost.exe as LOLBin
Trouble
TA0002, TA0005, T1574.008
Windows
Last updated: September 15, 2025
View details
Use Of The SFTP.EXE Binary As A LOLBIN
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious Certreq Command to Download
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Suspicious Driver Install by pnputil.exe
Trouble
TA0003, T1547
Windows
Last updated: September 15, 2025
View details
Suspicious GrpConv Execution
Trouble
TA0003, T1547
Windows
Last updated: September 15, 2025
View details
Dumping Process via Sqldumper.exe
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
SyncAppvPublishingServer Execute Arbitrary PowerShell Code
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential DLL Injection Or Execution Using Tracker.exe
Trouble
TA0005, T1055.001
Windows
Last updated: September 15, 2025
View details
Time Travel Debugging Utility Usage
Trouble
TA0005, TA0006, T1218
Windows
Last updated: September 15, 2025
View details
Lolbin Unregmp2.exe Use As Proxy
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
UtilityFunctions.ps1 Proxy Dll
Trouble
TA0005, T1216
Windows
Last updated: September 15, 2025
View details
Use of VisualUiaVerifyNative.exe
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Visual Basic Command Line Compiler Usage
Trouble
TA0005, T1027.004
Windows
Last updated: September 15, 2025
View details
Use of VSIISExeLauncher.exe
Trouble
TA0005, T1127
Windows
Last updated: September 15, 2025
View details
Potential Register_App.Vbs LOLScript Abuse
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential Mftrace.EXE Abuse
Trouble
TA0005, T1127
Windows
Last updated: September 15, 2025
View details
MMC20 Lateral Movement
Trouble
TA0002, TA0008, T1021.003
Windows
Last updated: September 15, 2025
View details
MMC Spawning Windows Shell
Trouble
TA0008, T1021.003
Windows
Last updated: September 15, 2025
View details
CodePage Modification Via MODE.COM To Russian Language
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Potential Suspicious Mofcomp Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential Mpclient.DLL Sideloading Via Defender Binaries
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
File Download Via Windows Defender MpCmpRun.EXE
Trouble
TA0005, TA0011, T1218
Windows
Last updated: September 15, 2025
View details
Windows Defender Definition Files Removed
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Suspicious Msbuild Execution By Uncommon Parent Process
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Potential Arbitrary Command Execution Using Msdt.EXE
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Suspicious Cabinet File Execution Via Msdt.EXE
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Suspicious MSDT Parent Process
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
Arbitrary File Download Via MSEDGE_PROXY.EXE
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Remotely Hosted HTA File Executed Via Mshta.EXE
Trouble
TA0005, TA0002, T1218.005
Windows
Last updated: September 15, 2025
View details
Wscript Shell Run In CommandLine
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious JavaScript Execution Via Mshta.EXE
Trouble
TA0005, T1218.005
Windows
Last updated: September 15, 2025
View details
Potential LethalHTA Technique Execution
Trouble
TA0005, T1218.005
Windows
Last updated: September 15, 2025
View details
Suspicious MSHTA Child Process
Trouble
TA0005, T1218.005
Windows
Last updated: September 15, 2025
View details
MSHTA Suspicious Execution 01
Trouble
TA0002, TA0005, TA0005, T1059.007
Windows
Last updated: September 15, 2025
View details
Suspicious Mshta.EXE Execution Patterns
Trouble
TA0002, T1106
Windows
Last updated: September 15, 2025
View details
DllUnregisterServer Function Call Via Msiexec.EXE
Trouble
TA0005, T1218.007
Windows
Last updated: September 15, 2025
View details
Suspicious MsiExec Embedding Parent
Trouble
TA0005, T1218.007
Windows
Last updated: September 15, 2025
View details
Suspicious Msiexec Execute Arbitrary DLL
Trouble
TA0005, T1218.007
Windows
Last updated: September 15, 2025
View details
Msiexec Quiet Installation
Trouble
TA0005, T1218.007
Windows
Last updated: September 15, 2025
View details
Suspicious Msiexec Quiet Install From Remote Location
Trouble
TA0005, T1218.007
Windows
Last updated: September 15, 2025
View details
Potential MsiExec Masquerading
Trouble
TA0005, T1036.005
Windows
Last updated: September 15, 2025
View details
MsiExec Web Install
Trouble
TA0005, TA0011, T1218.007
Windows
Last updated: September 15, 2025
View
details
Arbitrary File Download Via MSOHTMED.EXE
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Arbitrary File Download Via MSPUB.EXE
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Potential Process Injection Via Msra.EXE
Trouble
TA0005, T1055
Windows
Last updated: September 15, 2025
View details
Detection of PowerShell Execution via Sqlps.exe
Trouble
TA0002, TA0005, T1059.001
Windows
Last updated: September 15, 2025
View details
SQL Client Tools PowerShell Session Detection
Trouble
TA0002, TA0005, T1059.001
Windows
Last updated: September 15, 2025
View details
Suspicious Child Process Of SQL Server
Trouble
TA0001, TA0003, TA0004, T1190
Windows
Last updated: September 15, 2025
View details
Suspicious Child Process Of Veeam Dabatase
Critical
TA0001, TA0003, TA0004
Windows
Last updated: September 15, 2025
View details
Potential MSTSC Shadowing Activity
Trouble
TA0008, T1563.002
Windows
Last updated: September 15, 2025
View details
New Remote Desktop Connection Initiated Via Mstsc.EXE
Trouble
TA0008, T1021.001
Windows
Last updated: September 15, 2025
View details
Mstsc.EXE Execution With Local RDP File
Attention
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Suspicious Mstsc.EXE Execution With Local RDP File
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Mstsc.EXE Execution From Uncommon Parent
Trouble
TA0008
Windows
Last updated: September 15, 2025
View details
Remote XSL Execution Via Msxsl.EXE
Trouble
TA0005, T1220
Windows
Last updated: September 15, 2025
View details
New Firewall Rule Added Via Netsh.EXE
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
RDP Connection Allowed Via Netsh.EXE
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Firewall Rule Deleted Via Netsh.EXE
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Firewall Disabled via Netsh.EXE
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Netsh Allow Group Policy on Microsoft Defender Firewall
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Firewall Configuration Discovery Via Netsh.EXE
Attention
TA0007, T1016
Windows
Last updated: September 15, 2025
View details
Firewall Rule Update Via Netsh.EXE
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Netsh Helper DLL
Trouble
TA0004, TA0003, T1546.007
Windows
Last updated: September 15, 2025
View details
New Network Trace Capture Started Via Netsh.EXE
Trouble
TA0007, TA0006, T1040
Windows
Last updated: September 15, 2025
View details
New Port Forwarding Rule Added Via Netsh.EXE
Trouble
TA0008, TA0005, TA0011, T1090
Windows
Last updated: September 15, 2025
View details
RDP Port Forwarding Rule Added Via Netsh.EXE
Trouble
TA0008, TA0005, TA0011, T1090
Windows
Last updated: September 15, 2025
View details
Harvesting Of Wifi Credentials Via Netsh.EXE
Trouble
TA0007, TA0006, T1040
Windows
Last updated: September 15, 2025
View details
Start Windows Service Via Net.EXE
Attention
TA0002, T1569.002
Windows
Last updated: September 15, 2025
View details
Stop Windows Service Via Net.EXE
Attention
TA0040, T1489
Windows
Last updated: September 15, 2025
View details
Windows Internet Hosted WebDav Share Mount Via Net.EXE
Trouble
TA0008, T1021.002
Windows
Last updated: September 15, 2025
View details
Windows Share Mount Via Net.EXE
Attention
TA0008, T1021.002
Windows
Last updated: September 15, 2025
View details
System Network Connections Discovery Via Net.EXE
Attention
TA0007, T1049
Windows
Last updated: September 15, 2025
View details
Share And Session Enumeration Using Net.EXE
Attention
TA0007, T1018
Windows
Last updated: September 15, 2025
View details
Potential Arbitrary Code Execution Via Node.EXE
Trouble
TA0005, T1127
Windows
Last updated: September 15, 2025
View details
Node Process Executions
Trouble
TA0005, TA0002, T1127
Windows
Last updated: September 15, 2025
View details
Nslookup PowerShell Download Cradle - ProcessCreation
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Driver/DLL Installation Via Odbcconf.EXE
Trouble
TA0005, T1218.008
Windows
Last updated: September 15, 2025
View details
Suspicious Driver/DLL Installation Via Odbcconf.EXE
Trouble
TA0005, T1218.008
Windows
Last updated: September 15, 2025
View details
Odbcconf.EXE Suspicious DLL Location
Trouble
TA0005, T1218.008
Windows
Last updated: September 15, 2025
View details
New DLL Registered Via Odbcconf.EXE
Trouble
TA0005, T1218.008
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious DLL Registered Via Odbcconf.EXE
Trouble
TA0005, T1218.008
Windows
Last updated: September 15, 2025
View details
Response File Execution Via Odbcconf.EXE
Trouble
TA0005, T1218.008
Windows
Last updated: September 15, 2025
View details
Suspicious Response File Execution Via Odbcconf.EXE
Trouble
TA0005, T1218.008
Windows
Last updated: September 15, 2025
View details
Uncommon Child Process Spawned By Odbcconf.EXE
Trouble
TA0005, T1218.008
Windows
Last updated: September 15, 2025
View details
Potential Arbitrary File Download Using Office Application
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp
Trouble
TA0008, T1021.003
Windows
Last updated: September 15, 2025
View details
OneNote.EXE Execution of Malicious Embedded Scripts
Trouble
TA0005, T1218.001
Windows
Last updated: September 15, 2025
View details
Suspicious Microsoft OneNote Child Process
Trouble
TA0001, T1566
Windows
Last updated: September 15, 2025
View details
Suspicious Execution From Outlook Temporary Folder
Trouble
TA0001, T1566.001
Windows
Last updated: September 15, 2025
View details
Suspicious Outlook Child Process
Trouble
TA0002, T1204.002
Windows
Last updated: September 15, 2025
View details
Suspicious Microsoft Office Child Process
Trouble
TA0005, TA0002, T1218.010
Windows
Last updated: September 15, 2025
View details
Potential Arbitrary DLL Load Using Winword
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
PDQ Deploy Remote Adminstartion Tool Execution
Trouble
TA0002, TA0008, T1072
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Execution Of PDQDeployRunner
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Perl Inline Command Execution
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Php Inline Command Execution
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious Plink Port Forwarding
Trouble
TA0011, TA0008, T1572
Windows
Last updated: September 15, 2025
View details
Potential RDP Tunneling Via Plink
Trouble
TA0011, T1572
Windows
Last updated: September 15, 2025
View details
Suspicious Powercfg Execution To Change Lock Screen Timeout
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Add Windows Capability Via PowerShell Cmdlet
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Potential AMSI Bypass Via .NET Reflection
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Audio Capture via PowerShell
Trouble
TA0009, T1123
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell Encoded Command Patterns
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Suspicious Obfuscated PowerShell Code
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
PowerShell Base64 Encoded FromBase64String Cmdlet
Trouble
TA0005, TA0002, T1140
Windows
Last updated: September 15, 2025
View details
Malicious Base64 Encoded PowerShell Keywords in Command Lines
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
PowerShell Base64 Encoded IEX Cmdlet
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
PowerShell Base64 Encoded Invoke Keyword
Trouble
TA0002, TA0005, T1059.001
Windows
Last updated: September 15, 2025
View details
Powershell Base64 Encoded MpPreference Cmdlet
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
PowerShell Base64 Encoded Reflective Assembly Load
Trouble
TA0002, TA0005, T1059.001
Windows
Last updated: September 15, 2025
View details
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
Trouble
TA0002, TA0005, T1059.001
Windows
Last updated: September 15, 2025
View details
PowerShell Base64 Encoded WMI Classes
Trouble
TA0002, TA0005, T1059.001
Windows
Last updated: September 15, 2025
View details
Potential Process Execution Proxy Via CL_Invocation.ps1
Trouble
TA0005, T1216
Windows
Last updated: September 15, 2025
View details
Assembly Loading Via CL_LoadAssembly.ps1
Trouble
TA0005, T1216
Windows
Last updated: September 15, 2025
View details
Potential Script Proxy Execution Via CL_Mutexverifiers.ps1
Trouble
TA0005, T1216
Windows
Last updated: September 15, 2025
View details
ConvertTo-SecureString Cmdlet Usage Via CommandLine
Trouble
TA0005, TA0002, T1027
Windows
Last updated: September 15, 2025
View details
Potential PowerShell Obfuscation Via Reversed Commands
Trouble
TA0005, TA0002, T1027
Windows
Last updated: September 15, 2025
View details
New Service Creation Using PowerShell
Attention
TA0003, TA0004, T1543.003
Windows
Last updated: September 15, 2025
View details
Gzip Archive Decode Via PowerShell
Trouble
TA0011, T1132.001
Windows
Last updated: September 15, 2025
View details
Powershell Defender Disable Scan Feature
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Powershell Defender Exclusion
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Disable Windows Defender AV Security Monitoring
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Windows Firewall Disabled via PowerShell
Trouble
TA0005, T1562
Windows
Last updated: September 15, 2025
View details
Disabled IE Security Features
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Potential PowerShell Downgrade Attack
Trouble
TA0005, TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Potential COM Objects Download Cradles Usage - Process Creation
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Potential DLL File Download Via PowerShell Invoke-WebRequest
Trouble
TA0011, TA0002, T1105
Windows
Last updated: September 15, 2025
View details
PowerShell Download and Execution Cradles
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
PowerShell Download Pattern
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Email Exifiltration Via Powershell
Trouble
TA0010
Windows
Last updated: September 15, 2025
View details
Potential Suspicious Windows Feature Enabled - ProcCreation
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Suspicious Execution of Powershell with Base64
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Powershell Inline Execution From A File
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Certificate Exported Via PowerShell
Trouble
TA0006, TA0002, T1552.004
Windows
Last updated: September 15, 2025
View details
Base64 Encoded PowerShell Command Detected
Trouble
TA0005, TA0002, T1027
Windows
Last updated: September 15, 2025
View details
Suspicious FromBase64String Usage On Gzip Archive - Process Creation
Trouble
TA0011, T1132.001
Windows
Last updated: September 15, 2025
View details
PowerShell Get-Clipboard Cmdlet Via CLI
Trouble
TA0009, T1115
Windows
Last updated: September 15, 2025
View details
Abuse of Service Permissions to Hide Services Via Set-Service
Trouble
TA0003, TA0005, TA0004, T1574.011
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell IEX Execution Patterns
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Root Certificate Installed From Susp Locations
Trouble
TA0005, T1553.004
Windows
Last updated: September 15, 2025
View details
Unsigned AppX Installation Attempt Using Add-AppxPackage
Trouble
TA0003, TA0005
Windows
Last updated: September 15, 2025
View details
Suspicious Invoke-WebRequest Execution With DirectIP
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Suspicious Invoke-WebRequest Execution
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell Mailbox Export to Share
Critical
TA0010
Windows
Last updated: September 15, 2025
View details
MSExchange Transport Agent Installation
Trouble
TA0003, T1505.002
Windows
Last updated: September 15, 2025
View details
Non Interactive PowerShell Process Spawned
Attention
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Potential PowerShell Obfuscation Via WCHAR
Trouble
TA0002, TA0005, T1059.001
Windows
Last updated: September 15, 2025
View details
Execution of Powershell Script in Public Folder
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Tamper Windows Defender Remove-MpPreference
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Potential Powershell ReverseShell Connection
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Run PowerShell Script from ADS
Trouble
TA0005, T1564.004
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell Invocation From Script Engines
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Suspicious Service DACL Modification Via Set-Service Cmdlet
Trouble
TA0003, T1543.003
Windows
Last updated: September 15, 2025
View details
PowerShell Script Change Permission Via Set-Acl
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Change PowerShell Policies to an Insecure Level
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Service StartupType Change Via PowerShell Set-Service
Trouble
TA0002, TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Deletion of Volume Shadow Copies via WMI with PowerShell
Trouble
TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Exchange PowerShell Snap-Ins Usage
Trouble
TA0002, TA0009, T1059.001
Windows
Last updated: September 15, 2025
View details
Stop Windows Service Via PowerShell Stop-Service
Attention
TA0040, T1489
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell Download and Execute Pattern
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Suspicious PowerShell Parent Process
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Suspicious Service Installed
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
Coronavirus ransomware detections
Critical
TA0040, TA0040, T1486
Windows
Last updated: September 15, 2025
View details
Mailto ransomware detections
Critical
TA0040, TA0040, T1486
Windows
Last updated: September 15, 2025
View details
Ragnar Locker ransomware detections
Critical
TA0040, TA0040, T1486
Windows
Last updated: September 15, 2025
View details
Possible ransomware activities
Critical
TA0040, TA0040, T1486
Windows
Last updated: September 15, 2025
View details
Uncommon New Firewall Rule Added In Windows Firewall Exception List
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
A Rule Has Been Deleted From The Windows Firewall Exception List
Trouble
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Windows Defender Firewall Has Been Reset To Its Default Configuration
Attention
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Windows Firewall Settings Have Been Changed
Attention
TA0005, T1562.004
Windows
Last updated: September 15, 2025
View details
Security Eventlog Cleared
Trouble
TA0005, T1070.001
Windows
Last updated: September 15, 2025
View details
Processes Accessing the Microphone and Webcam
Trouble
TA0009, T1123
Windows
Last updated: September 15, 2025
View details
Outgoing Logon with New Credentials
Attention
TA0005, TA0008, T1550
Windows
Last updated: September 15, 2025
View details
COLDSTEEL Persistence Service Creation
Trouble
TA0005, TA0003
Windows
Last updated: September 15, 2025
View details
SNAKE Malware Service Persistence
Critical
TA0003
Windows
Last updated: September 15, 2025
View details
NTLMv1 Logon Between Client and Server
Trouble
TA0005, TA0008, T1550.002
Windows
Last updated: September 15, 2025
View details
Important Windows Eventlog Cleared
Trouble
TA0005, T1070.001
Windows
Last updated: September 15, 2025
View details
Critical Hive In Suspicious Location Access Bits Cleared
Trouble
TA0006, T1003.002
Windows
Last updated: September 15, 2025
View details
Diamond Sleet APT File Creation Indicators
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Potential APT FIN7 Related PowerShell Script Created
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Onyx Sleet APT File Creation Indicators
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader
Trouble
TA0003, T1505.001
Windows
Last updated: September 15, 2025
View details
Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity
Trouble
TA0001, T1190
Windows
Last updated: September 15, 2025
View details
Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Potential CVE-2023-36884 Exploitation Dropped File
Trouble
TA0003, TA0005
Windows
Last updated: September 15, 2025
View details
CVE-2023-40477 Potential Exploitation - .REV File Creation
Attention
TA0002
Windows
Last updated: September 15, 2025
View details
Potential COLDSTEEL RAT File Indicators
Trouble
TA0003, TA0005
Windows
Last updated: September 15, 2025
View details
Potential COLDSTEEL Persistence Service DLL Creation
Trouble
TA0003, TA0005
Windows
Last updated: September 15, 2025
View details
DarkGate - Autoit3.EXE File Creation By Uncommon Process
Trouble
TA0011, TA0002, T1105
Windows
Last updated: September 15, 2025
View details
SNAKE Malware Kernel Driver File Indicator
Critical
TA0002
Windows
Last updated: September 15, 2025
View details
SNAKE Malware Installer Name Indicators
Attention
TA0002
Windows
Last updated: September 15, 2025
View details
Forest Blizzard APT - File Creation Activity
Trouble
TA0005, T1562.002
Windows
Last updated: September 15, 2025
View details
ScreenConnect - SlashAndGrab Exploitation Indicators
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
ScreenConnect User Database Modification
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
File Creation Related To RAT Clients
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
EventLog EVTX File Deleted
Trouble
TA0005, T1070
Windows
Last updated: September 15, 2025
View details
IIS WebServer Access Logs Deleted
Trouble
TA0005, T1070
Windows
Last updated: September 15, 2025
View details
PowerShell Console History Logs Deleted
Trouble
TA0005, T1070
Windows
Last updated: September 15, 2025
View details
TeamViewer Log File Deleted
Attention
TA0005, T1070.004
Windows
Last updated: September 15, 2025
View details
Tomcat WebServer Logs Deleted
Trouble
TA0005, T1070
Windows
Last updated: September 15, 2025
View details
File Deleted Via Sysinternals SDelete
Trouble
TA0005, T1070.004
Windows
Last updated: September 15, 2025
View details
Unusual File Deletion by Dns.exe
Trouble
TA0001, T1133
Windows
Last updated: September 15, 2025
View details
Advanced IP Scanner - File Event
Trouble
TA0007, T1046
Windows
Last updated: September 15, 2025
View details
Anydesk Temporary Artefact
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Suspicious Binary Writes Via AnyDesk
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Assembly DLL Creation Via AspNetCompiler
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
EVTX Created In Uncommon Location
Trouble
TA0005, T1562.002
Windows
Last updated: September 15, 2025
View details
Creation Of Non-Existent System DLL
Trouble
TA0005, TA0003, TA0004, T1574.001
Windows
Last updated: September 15, 2025
View details
New Custom Shim Database Created
Trouble
TA0003, T1547.009
Windows
Last updated: September 15, 2025
View details
Suspicious Screensaver Binary File Creation
Trouble
TA0003, T1546.002
Windows
Last updated: September 15, 2025
View details
Files With System DLL Name In Unsuspected Locations
Trouble
TA0005, T1036.005
Windows
Last updated: September 15, 2025
View details
Creation Exe for Service with Unquoted Path
Trouble
TA0003, T1547.009
Windows
Last updated: September 15, 2025
View details
WScript or CScript Dropper - File
Trouble
TA0002, T1059.005
Windows
Last updated: September 15, 2025
View details
CSExec Service File Creation
Trouble
TA0002, T1569.002
Windows
Last updated: September 15, 2025
View details
Dynamic CSharp Compile Artefact
Attention
TA0005, T1027.004
Windows
Last updated: September 15, 2025
View details
DLL Search Order Hijackig Via Additional Space in Path
Trouble
TA0003, TA0004, TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious DMP/HDMP File Creation
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Potential Persistence Attempt Via ErrorHandler.Cmd
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
GoToAssist Temporary Installation Artefact
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
HackTool - Dumpert Process Dumper Default File
Critical
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
HackTool - Typical HiveNightmare SAM File Export
Trouble
TA0006, T1552.001
Windows
Last updated: September 15, 2025
View details
HackTool - Inveigh Execution Artefacts
Critical
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
HackTool - Mimikatz Kirbi File Creation
Critical
TA0006, T1558
Windows
Last updated: September 15, 2025
View details
HackTool - NPPSpy Hacktool Usage
Trouble
TA0006
Windows
Last updated: September 15, 2025
View details
HackTool - Powerup Write Hijack DLL
Trouble
TA0003, TA0004, TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
HackTool - QuarksPwDump Dump File
Critical
TA0006, T1003.002
Windows
Last updated: September 15, 2025
View details
HackTool - SafetyKatz Dump Indicator
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Potential Initial Access via DLL Search Order Hijacking
Trouble
TA0001, TA0005, T1566
Windows
Last updated: September 15, 2025
View details
Installation of TeamViewer Desktop
Trouble
TA0011, T1219.002
Windows
Last updated: September 15, 2025
View details
Malicious DLL File Dropped in the Teams or OneDrive Folder
Trouble
TA0003, TA0004, TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
ISO File Created Within Temp Folders
Trouble
TA0001, T1566.001
Windows
Last updated: September 15, 2025
View details
ISO or Image Mount Indicator in Recent Files
Trouble
TA0001, T1566.001
Windows
Last updated: September 15, 2025
View details
GatherNetworkInfo.VBS Reconnaissance Script Output
Trouble
TA0007
Windows
Last updated: September 15, 2025
View details
LSASS Process Memory Dump Files
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
LSASS Process Dump Artefact In CrashDumps Folder
Trouble
TA0006, T1003.001
Windows
Last updated: September 15, 2025
View details
Adwind RAT / JRAT File Artifact
Trouble
TA0002, T1059.005
Windows
Last updated: September 15, 2025
View details
File Creation In Suspicious Directory By Msdt.EXE
Trouble
TA0003, T1547.001
Windows
Last updated: September 15, 2025
View details
Uncommon File Creation By Mysql Daemon Process
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Suspicious DotNET CLR Usage Log Artifact
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Suspicious File Creation In Uncommon AppData Folder
Trouble
TA0005, TA0002
Windows
Last updated: September 15, 2025
View details
SCR File Write Event
Trouble
TA0005, T1218.011
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Notepad++ Plugins
Trouble
TA0003
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Microsoft Office Add-In
Trouble
TA0003, T1137.006
Windows
Last updated: September 15, 2025
View details
Office Macro File Creation
Attention
TA0001, T1566.001
Windows
Last updated: September 15, 2025
View details
Office Macro File Download
Trouble
TA0001, T1566.001
Windows
Last updated: September 15, 2025
View details
Office Macro File Creation From Suspicious Process
Trouble
TA0001, T1566.001
Windows
Last updated: September 15, 2025
View details
OneNote Attachment File Dropped In Suspicious Location
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Suspicious File Created Via OneNote Application
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
New Outlook Macro Created
Trouble
TA0003, TA0011, T1137
Windows
Last updated: September 15, 2025
View details
Potential Persistence Via Outlook Form
Trouble
TA0003, T1137.003
Windows
Last updated: September 15, 2025
View details
Suspicious Outlook Macro Created
Trouble
TA0003, TA0011, T1137
Windows
Last updated: September 15, 2025
View details
Publisher Attachment File Dropped In Suspicious Location
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
PCRE.NET Package Temp Files
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious File Created In PerfLogs
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Suspicious DLL Loaded via CertOC.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
New Root Certificate Installed Via Certutil.EXE
Trouble
TA0005, T1553.004
Windows
Last updated: September 15, 2025
View details
File Decoded From Base64/Hex Via Certutil.EXE
Trouble
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
Suspicious Download Via Certutil.EXE
Trouble
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
Suspicious File Downloaded From Direct IP Via Certutil.EXE
Trouble
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
Trouble
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
File Encoded To Base64 Via Certutil.EXE
Trouble
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
Suspicious File Encoded To Base64 Via Certutil.EXE
Trouble
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
File In Suspicious Location Encoded To Base64 Via Certutil.EXE
Trouble
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
Certificate Exported Via Certutil.EXE
Trouble
TA0005, T1027
Windows
Last updated: September 15, 2025
View details
Potential NTLM Coercion Via Certutil.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Deleted Data Overwritten Via Cipher.EXE
Trouble
TA0040, T1485
Windows
Last updated: September 15, 2025
View details
Process Access via TrolleyExpress Exclusion
Trouble
TA0005, TA0006, T1218.011
Windows
Last updated: September 15, 2025
View details
Data Copied To Clipboard Via Clip.EXE
Attention
TA0009, T1115
Windows
Last updated: September 15, 2025
View details
Cloudflared Portable Execution
Trouble
TA0011, T1090.001
Windows
Last updated: September 15, 2025
View details
Cloudflared Quick Tunnel Execution
Trouble
TA0011, T1090.001
Windows
Last updated: September 15, 2025
View details
Cloudflared Tunnel Connections Cleanup
Trouble
TA0011, T1102
Windows
Last updated: September 15, 2025
View details
Cloudflared Tunnel Execution
Trouble
TA0011, T1102
Windows
Last updated: September 15, 2025
View details
New Generic Credentials Added Via Cmdkey.EXE
Trouble
TA0006, T1003.005
Windows
Last updated: September 15, 2025
View details
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
Trouble
TA0006, T1003.005
Windows
Last updated: September 15, 2025
View details
Potential Arbitrary File Download Via Cmdl32.EXE
Trouble
TA0002, TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Change Default File Association Via Assoc
Attention
TA0003, T1546.001
Windows
Last updated: September 15, 2025
View details
Change Default File Association To Executable Via Assoc
Trouble
TA0003, T1546.001
Windows
Last updated: September 15, 2025
View details
Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE
Trouble
TA0006
Windows
Last updated: September 15, 2025
View details
Curl Download And Execute Combination
Trouble
TA0005, TA0011, T1218
Windows
Last updated: September 15, 2025
View details
File Deletion Via Del
Attention
TA0005, T1070.004
Windows
Last updated: September 15, 2025
View details
Greedy File Deletion Using Del
Trouble
TA0005, T1070.004
Windows
Last updated: September 15, 2025
View details
File And SubFolder Enumeration Via Dir Command
Attention
TA0007, T1217
Windows
Last updated: September 15, 2025
View details
Command Line Execution with Suspicious URL and AppData Strings
Trouble
TA0002, TA0011, T1059.003
Windows
Last updated: September 15, 2025
View details
Potential Privilege Escalation Using Symlink Between Osk and Cmd
Trouble
TA0004, TA0003, T1546.008
Windows
Last updated: September 15, 2025
View details
VolumeShadowCopy Symlink Creation Via Mklink
Trouble
TA0006, T1003.002
Windows
Last updated: September 15, 2025
View details
Suspicious File Execution From Internet Hosted WebDav Share
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
Cmd.EXE Missing Space Characters Execution Anomaly
Trouble
TA0002, T1059.001
Windows
Last updated: September 15, 2025
View details
NtdllPipe Like Activity Execution
Trouble
TA0005
Windows
Last updated: September 15, 2025
View details
Potential CommandLine Path Traversal Via Cmd.EXE
Trouble
TA0002, T1059.003
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Ping/Copy Command Combination
Trouble
TA0005, T1070.004
Windows
Last updated: September 15, 2025
View details
Suspicious Ping/Del Command Combination
Trouble
TA0005, T1070.004
Windows
Last updated: September 15, 2025
View details
Directory Removal Via Rmdir
Attention
TA0005, T1070.004
Windows
Last updated: September 15, 2025
View details
Copy From VolumeShadowCopy Via Cmd.EXE
Trouble
TA0040, T1490
Windows
Last updated: September 15, 2025
View details
Persistence Via Sticky Key Backdoor
Critical
TA0004, T1546.008
Windows
Last updated: September 15, 2025
View details
Sticky Key Like Backdoor Execution
Critical
TA0004, TA0003, T1546.008
Windows
Last updated: September 15, 2025
View details
Unusual Parent Process For Cmd.EXE
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
CMSTP Execution Process Creation
Trouble
TA0005, TA0002, T1218.003
Windows
Last updated: September 15, 2025
View details
Arbitrary File Download Via ConfigSecurityPolicy.EXE
Trouble
TA0010, T1567
Windows
Last updated: September 15, 2025
View details
Powershell Executed From Headless ConHost Process
Trouble
TA0005, TA0002, T1564.003
Windows
Last updated: September 15, 2025
View details
Conhost.exe CommandLine Path Traversal
Trouble
TA0002, T1059.003
Windows
Last updated: September 15, 2025
View details
Uncommon Child Process Of Conhost.EXE
Trouble
TA0005, T1202
Windows
Last updated: September 15, 2025
View details
Conhost Spawned By Uncommon Parent Process
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Control Panel Items
Trouble
TA0002, TA0005, TA0003, T1218.002
Windows
Last updated: September 15, 2025
View
details
CreateDump Process Dump
Trouble
TA0005, TA0006, T1036
Windows
Last updated: September 15, 2025
View details
Suspicious Csi.exe Usage
Trouble
TA0002, TA0005, T1072
Windows
Last updated: September 15, 2025
View details
Suspicious Use of CSharp Interactive Console
Trouble
TA0002, TA0005, T1127
Windows
Last updated: September 15, 2025
View details
Active Directory Structure Export Via Csvde.EXE
Trouble
TA0010, TA0007, T1087.002
Windows
Last updated: September 15, 2025
View details
Insecure Proxy/DOH Transfer Via Curl.EXE
Trouble
TA0002
Windows
Last updated: September 15, 2025
View details
Suspicious Curl.EXE Download
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
ManageEngine Endpoint Central Dctask64.EXE Potential Abuse
Trouble
TA0005, T1055.001
Windows
Last updated: September 15, 2025
View details
Uncommon Child Process Of Defaultpack.EXE
Trouble
TA0005, TA0002, T1218
Windows
Last updated: September 15, 2025
View details
Remote File Download Via Desktopimgdownldr Utility
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Suspicious Desktopimgdownldr Command
Trouble
TA0011, T1105
Windows
Last updated: September 15, 2025
View details
Potential DLL Sideloading Via DeviceEnroller.EXE
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Child Process Of ClickOnce Application
Trouble
TA0002, TA0005
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Child Process Of DiskShadow.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Diskshadow Script Mode - Uncommon Script Extension Execution
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Diskshadow Script Mode - Execution From Potential Suspicious Location
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
PowerShell Web Access Feature Enabled Via DISM
Trouble
TA0003, TA0004, TA0005, T1548.002
Windows
Last updated: September 15, 2025
View details
Dism Remove Online Package
Trouble
TA0005, T1562.001
Windows
Last updated: September 15, 2025
View details
DLL Sideloading by VMware Xfer Utility
Trouble
TA0005, T1574.001
Windows
Last updated: September 15, 2025
View details
DNS Exfiltration and Tunneling Tools Execution
Trouble
TA0010, TA0011, T1048.001
Windows
Last updated: September 15, 2025
View details
Unusual Child Process of dns.exe
Trouble
TA0001, T1133
Windows
Last updated: September 15, 2025
View details
Potential Application Whitelisting Bypass via Dnx.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Process Memory Dump Via Dotnet-Dump
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Binary Proxy Execution Via Dotnet-Trace.EXE
Trouble
TA0002, TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Potential Recon Activity Using DriverQuery.EXE
Trouble
TA0007
Windows
Last updated: September 15, 2025
View details
Suspicious Kernel Dump Using Dtrace
Trouble
TA0007, T1082
Windows
Last updated: September 15, 2025
View details
DumpMinitool Execution
Trouble
TA0005, TA0006, T1036
Windows
Last updated: September 15, 2025
View details
Suspicious DumpMinitool Execution
Trouble
TA0005, TA0006, T1036
Windows
Last updated: September 15, 2025
View details
New Capture Session Launched Via DXCap.EXE
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Copying Sensitive Files with Credential Data
Trouble
TA0006, T1003.002
Windows
Last updated: September 15, 2025
View details
Esentutl Steals Browser Information
Trouble
TA0009, T1005
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Event Viewer Child Process
Trouble
TA0005, TA0004, T1548.002
Windows
Last updated: September 15, 2025
View details
Potentially Suspicious Cabinet File Expansion
Trouble
TA0005, T1218
Windows
Last updated: September 15, 2025
View details
Explorer Process Tree Break
Trouble
TA0005, T1036
Windows
Last updated: September 15, 2025
View details
File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell
Trouble
TA0007, T1135
Windows
Last updated: September 15, 2025
View details
Remote File Download Via Findstr.EXE
Trouble
TA0005, TA0006, TA0011, T1218
Windows
Last updated: September 15, 2025
View details
LSASS Process Reconnaissance Via Findstr.EXE
Trouble
TA0006, T1552.006
Windows
Last updated: September 15, 2025
View details
Recon Command Output Piped To Findstr.EXE
Trouble
TA0007, T1057
Windows
Last updated: September 15, 2025
View details
Security Tools Keyword Lookup Via Findstr.EXE
Trouble
TA0007, T1518.001
Windows
Last updated: September 15, 2025
View details
Insensitive Subfolder Search Via Findstr.EXE
Attention
TA0005, TA0006, TA0011, T1218
Windows
Last updated: September 15, 2025
View details
Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE
Trouble
TA0007, T1518.001
Windows
Last updated: September 15, 2025
View details
Filter Driver Unloaded Via Fltmc.EXE
Trouble
TA0005, T1070
Windows
Last updated: September 15, 2025
View details
Sysmon Driver Unloaded Via Fltmc.EXE
Trouble
TA0005, T1070
Windows
Last updated: September 15, 2025
View details
Forfiles Command Execution
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Use of FSharp Interpreters
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Fsutil Drive Enumeration
Attention
TA0007, T1120
Windows
Last updated: September 15, 2025
View details
Fsutil Behavior Set SymlinkEvaluation
Trouble
TA0002, T1059
Windows
Last updated: September 15, 2025
View details
Fsutil Suspicious Invocation
Trouble
TA0005, TA0040, T1070
Windows
Last updated: September 15, 2025
View details
