admin/Karma-X-Inc-protections-artifacts
1
0
Fork 0
mirror of https://github.com/Karma-X-Inc/protections-artifacts synced 2026-06-08 11:28:09 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
Karma-X-Inc-protections-art…/behavior/rules
T
History
protectionsmachine 6fa996b70e Updating artifacts
2024-02-08 17:30:26 +00:00
..
collection_getasynckeystate_api_call_from_suspicious_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
collection_keystroke_input_capture_via_directinput.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
collection_keystrokes_input_capture_from_unsigned_dll.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
collection_potential_data_collection_in_temporary_directory_by_hidden_executable.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
collection_suspicious_directshow_devices_enumeration.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
command_and_control_connection_to_webservice_by_an_unsigned_binary.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
command_and_control_curl_execution_via_apple_installer_package.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
command_and_control_curl_execution_via_application_shell_script.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
command_and_control_curl_execution_via_automator_application.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_curl_execution_via_commandline_shell_script.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
command_and_control_curl_file_download_via_osascript.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_curl_from_volume_mount.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_dns_query_to_suspicious_top_level_domain.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_download_activity_via_a_headless_browser.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_executable_file_access_or_modification_via_osascript.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_execution_from_suspicious_stack_trailing_bytes.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
command_and_control_execution_of_a_file_written_by_a_signed_binary_proxy.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_hidden_file_network_connection_and_executable_download.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_ingress_tool_transfer_via_curl.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_ingress_tool_transfer_via_inet_cache.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_ingress_tool_transfer_via_powershell.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_library_load_of_a_file_written_by_a_signed_binary_proxy.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_macos_suspicious_archive_file_download_via_curl.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_netwire_rat_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_network_activity_detected_via_cat.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_osascript_download_cradle_spawned.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_osascript_payload_drop_and_execute.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_payload_downloaded_by_process_running_in_suspicious_directory.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
command_and_control_potential_execution_via_sliver_framework.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_potential_multi_architecture_file_downloads.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_potential_payload_download_via_applescript_applet.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_potential_plugx_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_potential_protocol_tunneling_via_legit_utilities.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_potential_vsingle_malware_infection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_potential_wizardupdate_malware_infection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_potential_xcsset_malware_infection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_remcos_rat_registry_or_file_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_service_communication_via_mail_protocol.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_shlayer_malware_infection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_suspicious_command_and_control_via_internet_explorer.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_suspicious_communication_via_mail_protocol.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
command_and_control_suspicious_curl_from_macos_application.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_suspicious_curl_to_google_app_script_endpoint.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_suspicious_dns_query_from_mounted_virtual_disk.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
command_and_control_suspicious_dns_query_to_free_ssl_certificate_domains.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_suspicious_executable_download_via_ruby.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
command_and_control_suspicious_executable_file_creation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_suspicious_hidden_executable_and_immediate_network_connection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_suspicious_netsupport_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_suspicious_url_as_argument_to_self_signed_binary.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
command_and_control_suspicious_vscode_extension_child_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
command_and_control_url_as_argument_to_python_script_and_immediate_network_connection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_access_to_browser_credentials_from_suspicious_memory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_access_to_windows_passwords_vault_via_powershell.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_autologons_access_attempt_via_registry.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_browser_debugging_from_unusual_parent.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_cloud_credential_files_accessed_by_osascript.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
credential_access_credential_access_via_known_utilities.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_dumping_account_hashes_via_built_in_commands.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_failed_access_attempt_to_web_browser_files.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_failed_attempts_to_access_sensitive_files.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_kerberos_config_file_accessed_by_osascript.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_kerberos_config_file_accessed_by_untrusted_or_unsigned_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_keychain_credential_files_collected_via_archive_utility.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_keychain_dump_via_native_security_tool.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_linux_init_(pid_1)_secret_dump_via_gdb.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_lsa_dump_via_silentprocessexit.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_lsa_dump_via_windows_error_reporting.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_lsass_access_attempt_from_an_unsigned_executable.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_lsass_access_attempt_from_unbacked_memory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_lsass_memory_dump_via_minidumpwritedump.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_potential_access_to_kerberos_cached_credentials.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_potential_credential_access_via_mimikatz.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_potential_credential_access_via_rubeus.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_potential_credential_access_via_windows_credential_history.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_potential_credentials_phishing_via_osascript.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_potential_discovery_of_dpapi_master_keys.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_potential_discovery_of_windows_credential_manager_store.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_potential_linux_credential_dumping_via_proc_filesystem.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_potential_linux_credential_dumping_via_unshadow.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_security_account_manager_(sam)_file_access.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
credential_access_security_account_manager_(sam)_registry_access.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
credential_access_sensitive_file_access_cloud_credentials.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_sensitive_file_access_remote_desktop_connection_manager.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_sensitive_file_access_ssh_saved_keys.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_sensitive_file_access_system_admin_utilities.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_sensitive_file_access_unattended_panther.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_slack_workspace_files_accessed_by_osascript.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_slack_workspace_files_accessed_by_unsigned_or_untrusted_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_ssh_keys_accessed_by_osascript.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_suspicious_access_to_active_directory_database_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_suspicious_access_to_lsa_secrets_registry.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
credential_access_suspicious_access_to_web_browser_credential_stores.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_suspicious_access_to_windows_vault_files.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_suspicious_credential_files_creation_via_kerberos.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_suspicious_registry_hive_dump.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_suspicious_vault_client_image_load.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_suspicious_vault_files_access_via_rpc.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_system_bootkey_registry_access.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_systemkey_access_via_command_line.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
credential_access_telegram_data_accessed_by_osascript.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_telegram_data_accessed_by_unsigned_or_untrusted_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_unusual_kerberos_client_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_unusual_ldap_client_process.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
credential_access_user_keychain_db_access_by_osascript.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_user_keychain_db_access_by_self_signed_binary.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_web_browser_credential_access_via_unsigned_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_web_browser_credential_access_via_unusual_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_web_browser_credential_data_accessed_by_osascript.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_web_browser_credential_data_accessed_by_unsigned_or_untrusted_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
credential_access_web_browsers_password_access_via_command_line.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_allowprotectedrenames_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_amsi_bypass_via_com_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_amsi_bypass_via_unbacked_memmory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_amsi_or_wldp_bypass_via_memory_patching.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_attempt_to_disable_driver_via_hvcidisallowedimages.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_attempt_to_disable_linux_security_and_logging_controls.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_attempt_to_disable_windows_defender_services.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_attempt_to_disable_windows_driver_blocklist_via_registry.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_binary_executed_from_shared_memory_directory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_binary_masquerading_via_untrusted_path.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_binary_proxy_execution_via_appvlp.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_binary_proxy_execution_via_pester.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_binary_proxy_execution_via_rundll32.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_binary_proxy_execution_via_runexehelper.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_binary_proxy_execution_via_ttdinject.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_call_stack_spoofing_via_synthetic_frames.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_common_language_runtime_loaded_via_an_unsigned_module.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_control_panel_process_with_unusual_arguments.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_crashdump_disabled_via_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_decoded_or_decrypted_payload_written_to_suspicious_directory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_defense_evasion_via_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_delayed_common_language_runtime_load.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_direct_syscall_via_assembly_bytes.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_disabling_hypervisor_protected_code_integrity_via_registry.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_dll_control_panel_items_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_dll_dropped_by_msiexec_followed_by_sideload.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_dll_execution_via_visual_studio_live_share.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_dll_injection_via_mavinject_utility.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_dll_side_loading_of_a_file_dropped_by_microsoft_office.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_dll_side_loading_via_a_copied_microsoft_executable.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_dylib_injection_via_process_environment_variables.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_dylib_load_via_ssh_keygen.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_dylib_load_with_suspicious_code_signature.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_dylib_loaded_by_process_in_suspicious_location.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_elastic_endpoint_security_kernel_extension_unload.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_evasion_via_device_credential_deployment.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_evasion_via_event_tracing_for_windows_patching.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_evasion_via_file_name_masquerading.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_evasion_via_ldrpkernel32_overwrite.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_executable_heap_allocation_by_unsigned_module.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_execution_from_suspicious_directory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_execution_of_a_binary_dropped_via_microsoft_bsdtar_archive_tool.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_execution_of_a_dnguard_protected_program.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_execution_of_a_file_dropped_by_openssl.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_execution_of_a_file_dropped_from_kernel_mode.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_execution_of_an_unsigned_or_untrusted_binary_via_ruby.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_execution_of_hidden_file_from_the_shared_directory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_execution_of_in_memory_file_via_interactive_session.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_execution_of_non_executable_file_via_shell.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_execution_via_internet_explorer_exporter.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_execution_via_program_compatibility_assistant.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_execution_via_renamed_signed_binary_proxy.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_file_made_executable_via_package_install_script.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_firewall_policy_changed_by_a_suspicious_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_global_dynamic_linker_file_copied.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_image_hollow_from_unusual_stack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_in_memory_jxa_execution_via_scriptingadditions.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_indirect_command_execution_via_console_window_host.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_indirect_command_execution_via_forfiles.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_ingress_dll_transfer_followed_by_dll_sideloading.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_internet_activity_from_suspicious_unbacked_memory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_library_loaded_via_a_callback_function.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_mach_o_file_with_unusual_extension.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
defense_evasion_macos_hidden_file_mounted.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_managed_.net_code_execution_via_powershell.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_managed_.net_code_execution_via_windows_script_interpreter.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_memory_protection_modification_of_an_unsigned_dll.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_microsoft_common_language_runtime_loaded_from_suspicious_memory.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_modification_of_global_dynamic_linker_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_modification_of_safari_settings_via_defaults_command.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_module_stomping_from_a_copied_library.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_msbuild_with_unusual_arguments.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_network_activity_from_a_reflected_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_network_activity_from_a_stomped_module.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_network_activity_from_in_memory_file.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
defense_evasion_network_connection_via_process_with_unusual_arguments.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_network_library_load_via_ldrloaddll.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_network_module_loaded_from_suspicious_unbacked_memory.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_ntdll_loaded_from_an_unusual_path.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_operating_system_security_updates_disabled.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_oversized_dll_creation_followed_by_sideload.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_parallel_ntdll_loaded_from_unbacked_memory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_parent_process_pid_spoofing.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_payload_decoded_and_decrypted_via_built_in_utilities.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_autoconfigurl_settings_hijack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_beacon_masking_from_a_stomped_module.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_binary_masquerading_via_invalid_code_signature.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
defense_evasion_potential_defense_evasion_via_filter_manager_control_program.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_dll_hijack_via_directory_spoofing.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_dll_hijacking_via_environment_paths.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_dll_search_order_hijacking_of_an_existing_program.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_dll_sideload_via_a_microsoft_signed_binary.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_dll_sideload_via_a_renamed_signed_binary.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_endpoint_security_evasion_via_firewallrules.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_evasion_via_asp.net_compiler.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_evasion_via_dotnet_framework_installation_utility.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_potential_evasion_via_inline_execute_assembly.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_potential_evasion_via_intel_gfxdownloadwrapper.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_evasion_via_invalid_code_signature.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_evasion_via_oversized_image_load.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_potential_evasion_via_sleep_obfuscation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_evasion_via_stack_rumbling.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_evasion_with_hardware_breakpoints.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_executable_stored_in_the_registry.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_image_load_with_a_spoofed_creation_time.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_potential_initial_access_via_dll_search_order_hijacking.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_injection_via_an_exception_handler.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_injection_via_asynchronous_procedure_call.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_injection_via_dotnet_debugging.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_injection_via_module_stomping.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_injection_via_nsis_installer.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_injection_via_the_console_window_class.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_injection_via_windows_thread_pools.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_potential_library_load_via_rop_gadgets.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_potential_masquerading_as_svchost.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_masquerading_as_system_binary.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_masquerading_as_windows_error_manager.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_ntdll_memory_unhooking.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_operation_via_direct_syscall.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_potential_parent_process_pid_spoofing_via_malseclogon.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_privacy_control_bypass_via_localhost_secure_copy.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_process_creation_via_direct_syscall.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_process_creation_via_shellcode.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_remote_code_injection.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_potential_self_deletion_of_a_running_executable.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_potential_thread_call_stack_spoofing.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_potential_unbacked_memory_content_masking.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_privilege_escalation_via_microsoft_exchange_dll_hijacking.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_process_creation_from_a_stomped_module.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_process_creation_from_backed_rwx_memory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_process_creation_from_modified_ntdll.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_process_creation_from_unbacked_memory_via_unsigned_parent.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_process_creation_via_rop_gadgets.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_process_creation_with_unusual_mitigation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_process_executable_image_tampering_attempt.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_process_execution_with_unusual_file_extension.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_process_from_archive_or_removable_media_via_unbacked_code.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_process_stared_via_remote_thread.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_protected_process_light_bypass_via_dll_tampering.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_quarantine_attrib_removal_via_textedit.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_quarantine_attrib_removed_by_unsigned_or_unstrusted_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_quarantine_attribute_deleted_via_untrusted_binary.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_reading_or_modifying_downloaded_files_database_via_sqlite_utility.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_reflective_binary_load.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_reflective_dylib_load.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_regsvr32_scriptlet_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_regsvr32_with_unusual_arguments.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_remote_file_execution_via_msiexec.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_remote_memory_write_to_a_non_child_process.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_remote_msi_package_installation_via_msiexec.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_remote_process_injection_via_mapping.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_remote_process_manipulation_by_suspicious_process.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_remote_thread_context_manipulation.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_renamed_autoit_scripts_interpreter.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_renamed_third_party_administrator_tools.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_renamed_windows_automaton_script_interpreter.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_rundll32_or_regsvr32_executing_an_oversized_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_rundll32_or_regsvr32_loaded_a_dll_from_unbacked_memory.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_rundll32_regsvr32_loads_a_dll_downloaded_via_bits.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_rundll32_with_unusual_arguments.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_script_execution_via_macos_application_bundle.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_script_execution_via_microsoft_html_application.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_script_execution_via_msxsl.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_scriptlet_execution_via_cmstp.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_scriptlet_execution_via_rundll32.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_scriptlet_proxy_execution_via_pubprn.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_self_injection_via_appdomain_manager_assembly.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
defense_evasion_shadow_copy_service_disabled_via_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_shellcode_execution_from_low_reputation_module.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_activity_from_a_control_panel_applet.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_api_call_from_a_script_interpreter.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_api_call_from_an_unsigned_dll.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_appdomain_manager_configuration_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_bitsadmin_activity.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_call_stack_trailing_bytes.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_control_panel_dll_loaded_by_explorer.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_dllregisterserver_execution_via_msiexec.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_dmg_file_creation_in_tmp_directory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_dylib_load_from_volume_mount_path.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_executable_heap_allocation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_executable_memory_permission_modification.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_suspicious_execution_from_a_mounted_device.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_execution_via_dcom.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_execution_via_dotnet_remoting.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_file_overwrite_and_modification_via_echo.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_suspicious_image_load_by_system_protected_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_image_load_from_smb_shares.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_image_load_via_ldrloaddll.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_imageload_from_an_iso_mounted_device.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_imageload_via_odbc_driver_configuration_program.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_imageload_via_windows_certoc.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_imageload_via_windows_update_auto_update_client.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_kernel32_memory_protection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_macos_application_hidden_executable_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_memory_protection_fluctuation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_memory_write_to_a_remote_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_msiexec_child_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_ntdll_image_load.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_suspicious_ntdll_memory_write.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_null_terminated_call_stack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_openssl_execution_via_macos_application.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_parent_child_relationship.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_powershell_console_history_deletion.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_suspicious_process_creation_via_reflection.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_suspicious_process_with_a_spoofed_parent.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
defense_evasion_suspicious_remote_memory_allocation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_remote_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_shell_extension_handler_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_stop_of_tccd_via_launchctl.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_task_for_pid_system_call.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_unload_of_elastic_agent_via_launchctl.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
defense_evasion_suspicious_unsigned_dll_loaded_by_a_trusted_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_windows_api_call_from_virtual_disk_or_usb.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_suspicious_windows_api_call_via_direct_syscall.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_suspicious_windows_api_call_via_rop_gadgets.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_windows_api_proxy_call.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_windows_defender_exclusions_added_via_powershell.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_suspicious_windows_defender_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_windows_explorer_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_windows_lua_script_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_suspicious_wmic_xsl_script_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_system_binary_proxy_execution_via_scriptrunner.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_tampering_of_bash_command_line_history.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_unsigned_dll_from_suspicious_directory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_unsigned_dll_loaded_by_an_elastic_signed_binary.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_unsigned_dll_loaded_by_rundll32_via_com.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_unsigned_or_untrusted_process_execution_and_immediate_self_deletion.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
defense_evasion_untrusted_dll_loaded_by_a_persistent_program.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_unusual_dll_extension_loaded_by_rundll32_or_regsvr32.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_unusual_network_connection_via_rundll32.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_unusual_process_running_as_antimalware_protected.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_unusual_registry_modification_via_wmi.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_unusual_windows_system_service_disabled.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_user_account_control_disabled_via_registry.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_virtualalloc_api_call_from_an_unsigned_dll.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_virtualprotect_api_call_from_an_unsigned_dll.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_virtualprotect_call_via_nttestalert.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_virtualprotect_via_indirect_random_syscall.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_virtualprotect_via_rop_gadgets.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_waasmedicsvc_com_type_lib_hijack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_windows_api_via_a_callback_function.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_windows_console_execution_from_unbacked_memory.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
defense_evasion_windows_defender_exclusions_by_extension.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_windows_defender_exclusions_by_path.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_windows_error_manager_reporting_masquerading.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_windows_firewall_exception_list_modified_via_untrusted_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
defense_evasion_windows_system_module_remote_hooking.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
discovery_external_ip_address_discovery_via_a_trusted_program.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
discovery_external_ip_address_discovery_via_untrusted_program.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
discovery_potential_hawkeyes_stealer_infection.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
discovery_potential_virtual_machine_fingerprinting_via_grep.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
discovery_potential_virtual_machine_fingerprinting_via_vmdetect.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
discovery_security_software_discovery_via_grep.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
discovery_suspicious_sip_check_by_macos_application.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_abnormal_auval_child_process_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_attempt_to_mount_a_remote_webdav_share.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_background_process_execution_via_shell.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_code_editor_untrusted_or_unsigned_child_process_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_command_and_scripting_interpreter_from_suspicious_parent.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_command_shell_activity_started_via_rundll32.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_curl_download_and_execution_of_javascript_payload.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_dll_loaded_from_webdav_share.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_dynwrapx_image_load_via_windows_scripts.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_eggshell_backdoor_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_embedded_executable_via_windows_shortcut_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_empire_stager_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_executable_file_extracted_to_temporary_directory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_from_a_password_protected_self_extracting_archive.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_from_unusual_directory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_from_zip_file_via_explorer.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_of_a_file_written_by_windows_script_host.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_of_a_windows_script_downloaded_via_a_lolbin.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_of_a_windows_script_file_written_by_a_suspicious_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_of_a_windows_script_with_unusual_file_extension.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_of_javascript_payload_via_osascript.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_of_javascript_payload_via_python.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_of_self_signed_binary_from_volume_mount.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_via_electron_child_process_node.js_module.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_via_outlook_application_com_object.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_via_suspicious_javascript_updates.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_via_syncappvpublishingserver.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_via_wmi_activescript_event_consumer.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_via_wmi_commandline_event_consumer.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_execution_via_wmi_followed_by_network_connection.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
execution_file_cloned_by_unsigned_or_untrusted_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_hidden_folder_or_file_access_in_tmp_via_python.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_initial_access_discovery_via_applet_executable.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_initial_access_via_audio_unit_plug_in.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_initial_access_via_macos_installer_package.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
execution_initial_access_via_osa_shell_script_piped_to_python_interpreter.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
execution_linux_reverse_shell_via_child.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_linux_reverse_shell_via_netcat.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_linux_reverse_shell_via_suspicious_utility.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_linux_reverse_shell.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_malicious_reputation_of_executable_download.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_nohup_execution_followed_by_outbound_network_connection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_oversized_windows_script_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_possible_java_reverse_shell.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_potential_command_and_control_via_windows_scripts.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_potential_execution_via_zipexec.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_potential_linux_hack_tool_launched.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_potential_python_reverse_shell.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_potential_reverse_shell_activity_via_terminal.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_potential_reverse_shell_via_java.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_powershell_engine_loaded_via_injection.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
execution_powershell_execution_via_runscripthelper.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_powershell_outbound_network_connection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_privilege_escalation_enumeration_via_linpeas.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_shell_execution_via_windows_shortcut_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_shell_script_execution_from_abnormal_volume_mount_path.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_apple_script_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_audio_unit_plug_in_file_access.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_automator_application_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_automator_workflows_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_cmd_execution_via_wmi.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_codesign_execution_via_osacompile.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_electron_command_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_execution_from_a_windows_script.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_execution_from_mssql_service.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_execution_via_sql_powershell.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_execution_via_windows_management_instrumentation.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
execution_suspicious_image_load_via_windows_scripts.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_installer_remote_plugin_service_child_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_interactive_shell_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_java_execution_via_a_windows_script.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_javascript_execution_via_node.js.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_mining_process_events.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_network_connection_via_installer_package.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_powershell_child_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_powershell_downloads.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_powershell_execution_via_windows_scripts.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_powershell_execution.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
execution_suspicious_python_package_child_process_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_python_script_interpreter.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_script_compilation_via_osacompile.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_script_execution_via_vbsedit_launcher.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_script_or_process_execution_from_mounted_device.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_terminal_child_process_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_windows_command_shell_execution.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
execution_suspicious_windows_component_object_model_via_dllhost.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_windows_script_file_name.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
execution_suspicious_windows_script_interpreter_child_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_windows_script_process_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_windows_shortcut_file_creation_or_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_suspicious_wmi_library_load.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
execution_suspicious_xpc_service_child_process.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
execution_tclsh_execution_followed_by_immediate_network_connection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_unsigned_or_untrusted_application_launch_via_xpc.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_unusual_powershell_engine_imageload.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_user_discovery_command_execution_from_volume_mount.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_user_tcc_db_access_by_unsigned_or_untrusted_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_windows_script_execution_from_archive_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
execution_windows_shortcut_file_embedded_object_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
exfiltration_potential_data_exfiltration_via_curl.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
impact_bcdedit_safe_mode_command_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_darkradiation_ransomware_infection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_inhibit_system_recovery_followed_by_a_suspicious_file_rename.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_inhibit_system_recovery_via_microsoft_office_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_inhibit_system_recovery_via_obfuscated_commands.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_inhibit_system_recovery_via_renamed_utilities.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_inhibit_system_recovery_via_signed_binary_proxy.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_inhibit_system_recovery_via_stopping_backup_services.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_inhibit_system_recovery_via_untrusted_parent_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_inhibit_system_recovery_via_windows_command_shell.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_potential_data_wiping_attack_behavior.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_potential_ransomware_note_file.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
impact_suspicious_file_rename_by_an_unusual_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_suspicious_file_rename_from_unbacked_memory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_suspicious_recursive_file_deletion_via_built_in_utilities.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
impact_vss_service_disabled_followed_by_a_suspicious_file_rename.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_dll_loaded_from_a_macro_enabled_document.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_execution_from_a_downloaded_iso_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_execution_from_a_macro_enabled_office_document.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
initial_access_execution_of_commonly_abused_utilities_via_explorer_trampoline.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_execution_of_file_written_or_modified_by_microsoft_equation_editor.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_execution_of_file_written_or_modified_by_microsoft_office.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_execution_via_a_suspicious_wmi_client.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_execution_via_microsoft_excel_xll_add_in.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_file_execution_via_microsoft_html_help.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_initial_access_or_execution_via_microsoft_office_application.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_microsoft_equation_editor_child_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_microsoft_office_fetching_remote_content.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_microsoft_office_file_execution_via_script_interpreter.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_microsoft_office_file_execution_via_wmi.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_microsoft_office_loaded_a_dropped_executable_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_microsoft_office_process_setting_persistence_via_startup.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_potential_browser_exploit_via_fake_rpc_messages.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_potential_decoy_document_via_user_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_potential_execution_via_winrar_exploitation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_potential_initial_access_via_rogue_rdp_server.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_potential_winrar_cve_2023_38831_exploitation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_powershell_obfuscation_spawned_via_microsoft_office.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_process_creation_via_microsoft_office_add_ins.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_registry_modification_via_microsoft_office.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_remote_code_execution_via_confluence_ognl_injection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_rundll32_regsvr32_loads_dropped_executable.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_script_file_written_by_microsoft_office_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_shortcut_file_modification_via_macro_enabled_document.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_signed_binary_execution_via_microsoft_office.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_execution_from_a_pdf_documents.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_execution_via_a_mounted_image_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_execution_via_compiled_html_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_execution_via_macos_script_editor.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_execution_via_microsoft_officecmd_url_handler.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_execution_via_shellbrowserwindow_shellwindow_com.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_file_delivery_via_html_smuggling.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_file_dropped_by_a_macro_enabled_document.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_microsoft_iis_worker_descendant.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_microsoft_office_child_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_microsoft_office_embedded_object.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_microsoft_onenote_child_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_ms_office_execution_via_dcom.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_network_connection_from_microsoft_equation_editor.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_suspicious_registry_modification_via_wmi.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_untrusted_document_opened_via_microsoft_office.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_untrusted_file_execution_via_microsoft_office.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_windows_command_shell_spawned_via_microsoft_office.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
initial_access_wmi_image_load_via_microsoft_office.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
lateral_movement_execution_of_a_file_dropped_from_smb.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
lateral_movement_lateral_execution_via_dcom_office_application.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
lateral_movement_potential_kerberos_attack_via_bifrost.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
lateral_movement_potential_lateral_movement_via_smbexec.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
lateral_movement_potential_ssh_it_ssh_worm_downloaded.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
lateral_movement_suspicious_nullsessionpipe_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
lateral_movement_suspicious_process_execution_via_network_logon.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
lateral_movement_unexpected_smb_connection_from_user_mode_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
lateral_movement_unsigned_file_execution_via_network_logon.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
lateral_movement_unusual_remote_desktop_client_process.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
persistence_at_job_creation_or_modification_by_an_unusual_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_browser_native_messaging_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_chromium_extension_loaded_from_unusual_parent.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_component_object_model_registry_modification_by_a_low_reputation_process.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
persistence_cron_tab_creation_or_modification_by_an_unusual_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_dual_persistence_via_startup_and_scheduled_task.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_initial_access_staging_via_installer_package.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_linux_backdoor_network_access_via_unusual_process.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
persistence_manual_loading_of_a_suspicious_chromium_extension.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_microsoft_office_addin_creation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_microsoft_office_addin_loaded.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_network_connection_via_startup_item.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_new_system_kext_file_and_immediate_load_via_kextload.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_office_application_startup_via_template_file_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_persistence_via_a_hidden_plist_filename.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_persistence_via_a_masqueraded_plist_filename.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_persistence_via_a_process_from_a_removable_or_mounted_iso_device.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_persistence_via_autodialdll_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_persistence_via_bits_setnotifycmdline_method.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_persistence_via_extensible_firmware_modification.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
persistence_persistence_via_suspicious_launch_agent_or_launch_daemon.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
persistence_potential_execution_via_shortcut_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_potential_persistence_via_emond.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_registry_or_file_modification_from_suspicious_memory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_registry_persistence_via_microsoft_office_descendant_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_registry_run_key_modified_by_unusual_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_registry_run_key_prefixed_with_asterisk.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_scheduled_task_by_a_low_reputation_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_scheduled_task_creation_by_an_unusual_process.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
persistence_scheduled_task_creation_from_suspicious_parent.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_scheduled_task_creation_via_unsigned_parent.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
persistence_scheduled_task_from_a_browser_or_compression_utility_descendant.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_scheduled_task_from_a_removable_or_mounted_iso_device.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_screensaver_plist_file_modified_by_unexpected_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_script_file_written_to_startup_folder.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_script_interpreter_process_writing_to_commonly_abused_persistence_locations.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_self_service_persistence_by_an_unsigned_process.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
persistence_startup_persistence_by_a_low_reputation_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_startup_persistence_from_a_browser_or_compression_utility_descendant.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_startup_persistence_from_backed_rwx_memory.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_startup_persistence_via_microsoft_office_descendant_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_startup_persistence_via_unusual_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_startup_persistence_via_windows_script_interpreter.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_api_from_an_unsigned_service_dll.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_apple_mail_rule_plist_creation_or_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_browser_files_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_execution_via_microsoft_exchange_transport_agent.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_file_creation_via_pkg_install_script.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_image_file_execution_options_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_process_spawned_from_motd_detected.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_property_list_file_creation_or_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_scheduled_task_creation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_scheduled_task_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_service_imagepath_value.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_shortcut_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_startupitem_plist_creation_or_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_string_value_written_to_registry_run_key.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_svchost_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_windows_authentication_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_windows_schedule_child_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_suspicious_windows_service_dll_creation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_uncommon_persistence_via_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_unexpected_child_process_of_macos_screensaver_engine.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_unsigned_or_untrusted_process_execution_via_installer.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_untrusted_or_unsigned_binary_executed_via_launch_service.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_untrusted_process_writing_to_commonly_abused_persistence_locations.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_unusual_file_written_or_modified_in_startup_folder.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
persistence_unusual_startup_shell_folder_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_access_token_manipulation_via_child_process.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_cve_2023_0386_exploitation_attempt.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_driver_dropped_by_untrusted_executable.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
privilege_escalation_elevated_apple_script_execution_via_unsigned_parent.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_elevation_via_common_log_file_system_exploitation.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
privilege_escalation_kernel_driver_registered_via_ntloaddriver.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_code_injection_via_remote_thread.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_common_log_file_system_vulnerability_exploitation.toml
Updating artifacts
2024-01-24 18:27:07 +00:00
privilege_escalation_potential_execution_via_token_theft.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
privilege_escalation_potential_privilege_escalation_via_dll_redirection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_privilege_escalation_via_file_redirection.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_privilege_escalation_via_localpotato_exploit.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_privilege_escalation_via_logonui.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
privilege_escalation_potential_privilege_escalation_via_missing_dll.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_privilege_escalation_via_rogue_winrm.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_privilege_escalation_via_root_crontab_file_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_privilege_escalation_via_tcc_bypass_with_fake_tcc.db.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_privilege_escalation_via_token_impersonation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_sip_bypass_via_the_shoveservice.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_sudo_privilege_escalation_via_cve_2019_14287.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_potential_uac_bypass_via_ielevatedfactoryserver.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_privilege_escalation_via_extended_startupinfo.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_privilege_escalation_via_named_pipe_impersonation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_privilege_escalation_via_ntlmrelay2self.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_privilege_escalation_via_pkexec_exploitation.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_privilege_escalation_via_polkit_system_service.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_privilege_escalation_via_seimpersonateprivilege.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_privilege_escalation_via_windir_or_systemroot_environment_variable.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_privilege_escalation_via_windows_installer_hijack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_sudo_heap_based_buffer_overflow_attempt.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_suspicious_execution_via_windows_services.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
privilege_escalation_suspicious_impersonation_as_trusted_installer.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
privilege_escalation_suspicious_kernel_mode_address_manipulation.toml
Updating artifacts
2024-02-08 17:30:26 +00:00
privilege_escalation_suspicious_ntoskrnl_image_load.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_suspicious_privilegedhelpertool_activity.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_suspicious_registry_symbolic_link.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_suspicious_windows_service_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_attempt_via_cdssync_scheduled_task_hijack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_attempt_via_consent_dll_search_order_hijacking.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_attempt_via_dccw_dll_search_order_hijacking.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_attempt_via_dismcore_dll_side_loading.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_attempt_via_dll_side_loading_from_windows_media_player_folder.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_attempt_via_elevated_com_internet_explorer_add_on_installer.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_attempt_via_mmc_dll_search_order_hijacking.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_attempt_via_silentcleanup_task_dll_search_order_hijacking.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_attempt_via_windows_directory_masquerading.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_attempt_via_wow64_logger_dll_side_loading.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_attempt_with_ieditionupgrademanager_elevated_com_interface.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_computerdefaults_execution_hijack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_control_panel_execution_hijack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_delegateexecute_registry_modification.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_event_viewer.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_fodhelper_execution_hijack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_hijacking_winmgmt_mmc.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_icmluautil_elevated_com_interface.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_malicious_mmc_snap_in_execution.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_sdclt.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_unsafe_deserialization_in_event_viewer.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_windows_activation_execution_hijack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_windows_firewall_snap_in_hijack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_uac_bypass_via_wsreset_execution_hijack.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_unusual_child_process_integrity_level.toml
Updating artifacts
2024-01-08 20:04:33 +00:00
privilege_escalation_unusual_privilege_escalation_to_system.toml
Updating artifacts
2024-01-08 20:04:33 +00:00