mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
3320 lines
168 KiB
JSON
3320 lines
168 KiB
JSON
{
|
|
"$defs": {
|
|
"AllContentEnum": {
|
|
"description": "Enum for Security Content that is used in production.\n\nNOTE: This enum is dynamically populated at runtime.",
|
|
"enum": [
|
|
"0bj3ctivity Stealer",
|
|
"3CX Supply Chain Attack",
|
|
"3CX Supply Chain Attack Network Indicators",
|
|
"3cx_ioc_domains",
|
|
"7zip CommandLine To SMB Share Path",
|
|
"AD LDAP Account Locking",
|
|
"AD LDAP Account Unlocking",
|
|
"AD LDAP Entity Attribute Lookup",
|
|
"AMOS Stealer",
|
|
"APT29 Diplomatic Deceptions with WINELOADER",
|
|
"APT37 Rustonotto and FadeStealer",
|
|
"ASL AWS CloudTrail",
|
|
"ASL AWS Concurrent Sessions From Different Ips",
|
|
"ASL AWS Create Access Key",
|
|
"ASL AWS Create Policy Version to allow all resources",
|
|
"ASL AWS Credential Access GetPasswordData",
|
|
"ASL AWS Credential Access RDS Password reset",
|
|
"ASL AWS Defense Evasion Delete CloudWatch Log Group",
|
|
"ASL AWS Defense Evasion Delete Cloudtrail",
|
|
"ASL AWS Defense Evasion Impair Security Services",
|
|
"ASL AWS Defense Evasion PutBucketLifecycle",
|
|
"ASL AWS Defense Evasion Stop Logging Cloudtrail",
|
|
"ASL AWS Defense Evasion Update Cloudtrail",
|
|
"ASL AWS Detect Users creating keys with encrypt policy without MFA",
|
|
"ASL AWS Disable Bucket Versioning",
|
|
"ASL AWS EC2 Snapshot Shared Externally",
|
|
"ASL AWS ECR Container Upload Outside Business Hours",
|
|
"ASL AWS ECR Container Upload Unknown User",
|
|
"ASL AWS IAM AccessDenied Discovery Events",
|
|
"ASL AWS IAM Assume Role Policy Brute Force",
|
|
"ASL AWS IAM Delete Policy",
|
|
"ASL AWS IAM Failure Group Deletion",
|
|
"ASL AWS IAM Successful Group Deletion",
|
|
"ASL AWS Multi-Factor Authentication Disabled",
|
|
"ASL AWS Network Access Control List Created with All Open Ports",
|
|
"ASL AWS Network Access Control List Deleted",
|
|
"ASL AWS New MFA Method Registered For User",
|
|
"ASL AWS SAML Update identity provider",
|
|
"ASL AWS UpdateLoginProfile",
|
|
"AWS AMI Attribute Modification for Exfiltration",
|
|
"AWS Bedrock Delete GuardRails",
|
|
"AWS Bedrock Delete Knowledge Base",
|
|
"AWS Bedrock Delete Model Invocation Logging Configuration",
|
|
"AWS Bedrock High Number List Foundation Model Failures",
|
|
"AWS Bedrock Invoke Model Access Denied",
|
|
"AWS Bedrock Security",
|
|
"AWS CloudTrail",
|
|
"AWS CloudTrail AssumeRoleWithSAML",
|
|
"AWS CloudTrail ConsoleLogin",
|
|
"AWS CloudTrail CopyObject",
|
|
"AWS CloudTrail CreateAccessKey",
|
|
"AWS CloudTrail CreateKey",
|
|
"AWS CloudTrail CreateLoginProfile",
|
|
"AWS CloudTrail CreateNetworkAclEntry",
|
|
"AWS CloudTrail CreatePolicyVersion",
|
|
"AWS CloudTrail CreateSnapshot",
|
|
"AWS CloudTrail CreateTask",
|
|
"AWS CloudTrail CreateVirtualMFADevice",
|
|
"AWS CloudTrail DeactivateMFADevice",
|
|
"AWS CloudTrail DeleteAccountPasswordPolicy",
|
|
"AWS CloudTrail DeleteAlarms",
|
|
"AWS CloudTrail DeleteDetector",
|
|
"AWS CloudTrail DeleteGroup",
|
|
"AWS CloudTrail DeleteGuardrail",
|
|
"AWS CloudTrail DeleteIPSet",
|
|
"AWS CloudTrail DeleteKnowledgeBase",
|
|
"AWS CloudTrail DeleteLogGroup",
|
|
"AWS CloudTrail DeleteLogStream",
|
|
"AWS CloudTrail DeleteLoggingConfiguration",
|
|
"AWS CloudTrail DeleteModelInvocationLoggingConfiguration",
|
|
"AWS CloudTrail DeleteNetworkAclEntry",
|
|
"AWS CloudTrail DeletePolicy",
|
|
"AWS CloudTrail DeleteRule",
|
|
"AWS CloudTrail DeleteRuleGroup",
|
|
"AWS CloudTrail DeleteSnapshot",
|
|
"AWS CloudTrail DeleteTrail",
|
|
"AWS CloudTrail DeleteVirtualMFADevice",
|
|
"AWS CloudTrail DeleteWebACL",
|
|
"AWS CloudTrail DescribeEventAggregates",
|
|
"AWS CloudTrail DescribeImageScanFindings",
|
|
"AWS CloudTrail DescribeSnapshotAttribute",
|
|
"AWS CloudTrail GetAccountPasswordPolicy",
|
|
"AWS CloudTrail GetObject",
|
|
"AWS CloudTrail GetPasswordData",
|
|
"AWS CloudTrail InvokeModel",
|
|
"AWS CloudTrail JobCreated",
|
|
"AWS CloudTrail ListFoundationModels",
|
|
"AWS CloudTrail ModifyDBInstance",
|
|
"AWS CloudTrail ModifyImageAttribute",
|
|
"AWS CloudTrail ModifySnapshotAttribute",
|
|
"AWS CloudTrail PutBucketAcl",
|
|
"AWS CloudTrail PutBucketLifecycle",
|
|
"AWS CloudTrail PutBucketReplication",
|
|
"AWS CloudTrail PutBucketVersioning",
|
|
"AWS CloudTrail PutImage",
|
|
"AWS CloudTrail PutKeyPolicy",
|
|
"AWS CloudTrail ReplaceNetworkAclEntry",
|
|
"AWS CloudTrail SetDefaultPolicyVersion",
|
|
"AWS CloudTrail StopLogging",
|
|
"AWS CloudTrail UpdateAccountPasswordPolicy",
|
|
"AWS CloudTrail UpdateLoginProfile",
|
|
"AWS CloudTrail UpdateSAMLProvider",
|
|
"AWS CloudTrail UpdateTrail",
|
|
"AWS CloudWatchLogs VPCflow",
|
|
"AWS Cloudfront",
|
|
"AWS Concurrent Sessions From Different Ips",
|
|
"AWS Console Login Failed During MFA Challenge",
|
|
"AWS Create Policy Version to allow all resources",
|
|
"AWS CreateAccessKey",
|
|
"AWS CreateLoginProfile",
|
|
"AWS Credential Access Failed Login",
|
|
"AWS Credential Access GetPasswordData",
|
|
"AWS Credential Access RDS Password reset",
|
|
"AWS Defense Evasion",
|
|
"AWS Defense Evasion Delete CloudWatch Log Group",
|
|
"AWS Defense Evasion Delete Cloudtrail",
|
|
"AWS Defense Evasion Impair Security Services",
|
|
"AWS Defense Evasion PutBucketLifecycle",
|
|
"AWS Defense Evasion Stop Logging Cloudtrail",
|
|
"AWS Defense Evasion Update Cloudtrail",
|
|
"AWS Detect Users creating keys with encrypt policy without MFA",
|
|
"AWS Detect Users with KMS keys performing encryption S3",
|
|
"AWS Disable Bucket Versioning",
|
|
"AWS Disable User Accounts",
|
|
"AWS EC2 Snapshot Shared Externally",
|
|
"AWS ECR Container Scanning Findings High",
|
|
"AWS ECR Container Scanning Findings Low Informational Unknown",
|
|
"AWS ECR Container Scanning Findings Medium",
|
|
"AWS ECR Container Upload Outside Business Hours",
|
|
"AWS ECR Container Upload Unknown User",
|
|
"AWS Excessive Security Scanning",
|
|
"AWS Exfiltration via Anomalous GetObject API Activity",
|
|
"AWS Exfiltration via Batch Service",
|
|
"AWS Exfiltration via Bucket Replication",
|
|
"AWS Exfiltration via DataSync Task",
|
|
"AWS Exfiltration via EC2 Snapshot",
|
|
"AWS Find Inactive Users",
|
|
"AWS High Number Of Failed Authentications For User",
|
|
"AWS High Number Of Failed Authentications From Ip",
|
|
"AWS IAM AccessDenied Discovery Events",
|
|
"AWS IAM Account Locking",
|
|
"AWS IAM Account Unlocking",
|
|
"AWS IAM Assume Role Policy Brute Force",
|
|
"AWS IAM Delete Policy",
|
|
"AWS IAM Failure Group Deletion",
|
|
"AWS IAM Privilege Escalation",
|
|
"AWS IAM Successful Group Deletion",
|
|
"AWS Identity and Access Management Account Takeover",
|
|
"AWS Lambda UpdateFunctionCode",
|
|
"AWS Multi-Factor Authentication Disabled",
|
|
"AWS Multiple Failed MFA Requests For User",
|
|
"AWS Multiple Users Failing To Authenticate From Ip",
|
|
"AWS Network ACL Activity",
|
|
"AWS Network Access Control List Created with All Open Ports",
|
|
"AWS Network Access Control List Deleted",
|
|
"AWS New MFA Method Registered For User",
|
|
"AWS Password Policy Changes",
|
|
"AWS S3 Bucket Security Monitoring",
|
|
"AWS S3 Exfiltration Behavior Identified",
|
|
"AWS SAML Update identity provider",
|
|
"AWS Security Hub",
|
|
"AWS Security Hub Alerts",
|
|
"AWS SetDefaultPolicyVersion",
|
|
"AWS Successful Console Authentication From Multiple IPs",
|
|
"AWS Successful Single-Factor Authentication",
|
|
"AWS Unusual Number of Failed Authentications From Ip",
|
|
"AWS UpdateLoginProfile",
|
|
"AWS User Monitoring",
|
|
"Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring",
|
|
"Access LSASS Memory for Dump Creation",
|
|
"Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint",
|
|
"AcidPour",
|
|
"AcidRain",
|
|
"Active Directory Disable Account Dispatch",
|
|
"Active Directory Discovery",
|
|
"Active Directory Enable Account Dispatch",
|
|
"Active Directory Kerberos Attacks",
|
|
"Active Directory Lateral Movement",
|
|
"Active Directory Lateral Movement Identified",
|
|
"Active Directory Password Spraying",
|
|
"Active Directory Privilege Escalation",
|
|
"Active Directory Privilege Escalation Identified",
|
|
"Active Setup Registry Autostart",
|
|
"ActiveDirectory Reset password",
|
|
"Add DefaultUser And Password In Registry",
|
|
"Add or Set Windows Defender Exclusion",
|
|
"Adobe ColdFusion Access Control Bypass",
|
|
"Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360",
|
|
"Adobe ColdFusion Unauthenticated Arbitrary File Read",
|
|
"AdsiSearcher Account Discovery",
|
|
"Advanced IP or Port Scanner Execution",
|
|
"AgentTesla",
|
|
"Allow File And Printing Sharing In Firewall",
|
|
"Allow Inbound Traffic By Firewall Rule Registry",
|
|
"Allow Inbound Traffic In Firewall Rule",
|
|
"Allow Network Discovery In Firewall",
|
|
"Allow Operation with Consent Admin",
|
|
"Amadey",
|
|
"Amazon EKS Kubernetes Pod scan detection",
|
|
"Amazon EKS Kubernetes cluster scan detection",
|
|
"Anomalous usage of 7zip",
|
|
"Apache Struts Vulnerability",
|
|
"Apache Tomcat Session Deserialization Attacks",
|
|
"AppLocker",
|
|
"ArcaneDoor",
|
|
"Asset Tracking",
|
|
"AsyncRAT",
|
|
"Atlassian Confluence Server and Data Center CVE-2022-26134",
|
|
"Attacker Tools On Endpoint",
|
|
"Attempt To Add Certificate To Untrusted Store",
|
|
"Attribute Lookup Dispatch",
|
|
"Auto Admin Logon Registry Entry",
|
|
"Automated Enrichment",
|
|
"AwfulShred",
|
|
"Axios Supply Chain Post Compromise",
|
|
"Azorult",
|
|
"Azure AD Account Locking",
|
|
"Azure AD Account Unlocking",
|
|
"Azure AD Admin Consent Bypassed by Service Principal",
|
|
"Azure AD Application Administrator Role Assigned",
|
|
"Azure AD Authentication Failed During MFA Challenge",
|
|
"Azure AD AzureHound UserAgent Detected",
|
|
"Azure AD Block User Consent For Risky Apps Disabled",
|
|
"Azure AD Concurrent Sessions From Different Ips",
|
|
"Azure AD Device Code Authentication",
|
|
"Azure AD External Guest User Invited",
|
|
"Azure AD FullAccessAsApp Permission Assigned",
|
|
"Azure AD Global Administrator Role Assigned",
|
|
"Azure AD Graph User Attribute Lookup",
|
|
"Azure AD High Number Of Failed Authentications For User",
|
|
"Azure AD High Number Of Failed Authentications From Ip",
|
|
"Azure AD Multi-Factor Authentication Disabled",
|
|
"Azure AD Multi-Source Failed Authentications Spike",
|
|
"Azure AD Multiple AppIDs and UserAgents Authentication Spike",
|
|
"Azure AD Multiple Denied MFA Requests For User",
|
|
"Azure AD Multiple Failed MFA Requests For User",
|
|
"Azure AD Multiple Service Principals Created by SP",
|
|
"Azure AD Multiple Service Principals Created by User",
|
|
"Azure AD Multiple Users Failing To Authenticate From Ip",
|
|
"Azure AD New Custom Domain Added",
|
|
"Azure AD New Federated Domain Added",
|
|
"Azure AD New MFA Method Registered",
|
|
"Azure AD New MFA Method Registered For User",
|
|
"Azure AD OAuth Application Consent Granted By User",
|
|
"Azure AD PIM Role Assigned",
|
|
"Azure AD PIM Role Assignment Activated",
|
|
"Azure AD Privileged Authentication Administrator Role Assigned",
|
|
"Azure AD Privileged Graph API Permission Assigned",
|
|
"Azure AD Privileged Role Assigned",
|
|
"Azure AD Privileged Role Assigned to Service Principal",
|
|
"Azure AD Service Principal Authentication",
|
|
"Azure AD Service Principal Created",
|
|
"Azure AD Service Principal Enumeration",
|
|
"Azure AD Service Principal New Client Credentials",
|
|
"Azure AD Service Principal Owner Added",
|
|
"Azure AD Service Principal Privilege Escalation",
|
|
"Azure AD Successful Authentication From Different Ips",
|
|
"Azure AD Successful PowerShell Authentication",
|
|
"Azure AD Successful Single-Factor Authentication",
|
|
"Azure AD Tenant Wide Admin Consent Granted",
|
|
"Azure AD Unusual Number of Failed Authentications From Ip",
|
|
"Azure AD User Consent Blocked for Risky Application",
|
|
"Azure AD User Consent Denied for OAuth Application",
|
|
"Azure AD User Enabled And Password Reset",
|
|
"Azure AD User ImmutableId Attribute Updated",
|
|
"Azure Active Directory",
|
|
"Azure Active Directory Account Takeover",
|
|
"Azure Active Directory Add app role assignment to service principal",
|
|
"Azure Active Directory Add member to role",
|
|
"Azure Active Directory Add owner to application",
|
|
"Azure Active Directory Add service principal",
|
|
"Azure Active Directory Add unverified domain",
|
|
"Azure Active Directory Consent to application",
|
|
"Azure Active Directory Disable Strong Authentication",
|
|
"Azure Active Directory Enable account",
|
|
"Azure Active Directory High Risk Sign-in",
|
|
"Azure Active Directory Invite external user",
|
|
"Azure Active Directory MicrosoftGraphActivityLogs",
|
|
"Azure Active Directory NonInteractiveUserSignInLogs",
|
|
"Azure Active Directory Persistence",
|
|
"Azure Active Directory Privilege Escalation",
|
|
"Azure Active Directory Reset password (by admin)",
|
|
"Azure Active Directory Set domain authentication",
|
|
"Azure Active Directory Sign-in activity",
|
|
"Azure Active Directory Update application",
|
|
"Azure Active Directory Update authorization policy",
|
|
"Azure Active Directory Update user",
|
|
"Azure Active Directory User registered security info",
|
|
"Azure Audit Create or Update an Azure Automation Runbook",
|
|
"Azure Audit Create or Update an Azure Automation account",
|
|
"Azure Audit Create or Update an Azure Automation webhook",
|
|
"Azure Automation Account Created",
|
|
"Azure Automation Runbook Created",
|
|
"Azure Monitor Activity",
|
|
"Azure Runbook Webhook Created",
|
|
"BCDEdit Failure Recovery Modification",
|
|
"BITS Job Persistence",
|
|
"BITS Jobs",
|
|
"BITSAdmin Download File",
|
|
"Backdoor Pingpong",
|
|
"Baron Samedit CVE-2021-3156",
|
|
"Baseline Of Kubernetes Container Network IO",
|
|
"Baseline Of Kubernetes Container Network IO Ratio",
|
|
"Baseline Of Kubernetes Process Resource",
|
|
"Baseline Of Kubernetes Process Resource Ratio",
|
|
"Baseline Of Open S3 Bucket Decommissioning",
|
|
"Baseline of Network ACL Activity by ARN",
|
|
"Baseline of S3 Bucket deletion activity by ARN",
|
|
"Baseline of Security Group Activity by ARN",
|
|
"Baseline of blocked outbound traffic from AWS",
|
|
"Batch File Write to System32",
|
|
"Bcdedit Command Back To Normal Mode Boot",
|
|
"BishopFox Sliver Adversary Emulation Framework",
|
|
"Black Basta Ransomware",
|
|
"BlackByte Ransomware",
|
|
"BlackLotus Campaign",
|
|
"BlackMatter Ransomware",
|
|
"BlackSuit Ransomware",
|
|
"BlankGrabber Stealer",
|
|
"Block Indicators",
|
|
"Brand Monitoring",
|
|
"Braodo Stealer",
|
|
"Bro conn",
|
|
"Bro dns",
|
|
"Bro files",
|
|
"Bro http",
|
|
"Bro loaded_scripts",
|
|
"Bro ntp",
|
|
"Bro ocsp",
|
|
"Bro ssl",
|
|
"Bro weird",
|
|
"Bro x509",
|
|
"Browser Hijacking",
|
|
"Brute Ratel C4",
|
|
"CHCP Command Execution",
|
|
"CISA AA22-257A",
|
|
"CISA AA22-264A",
|
|
"CISA AA22-277A",
|
|
"CISA AA22-320A",
|
|
"CISA AA23-347A",
|
|
"CISA AA24-241A",
|
|
"CMD Carry Out String Command Parameter",
|
|
"CMD Echo Pipe - Escalation",
|
|
"CMLUA Or CMSTPLUA UAC Bypass",
|
|
"CSC Net On The Fly Compilation",
|
|
"CVE-2022-40684 Fortinet Appliance Auth bypass",
|
|
"CVE-2023-21716 Word RTF Heap Corruption",
|
|
"CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server",
|
|
"CVE-2023-23397 Outlook Elevation of Privilege",
|
|
"CVE-2023-36884 Office and Windows HTML RCE Vulnerability",
|
|
"Cactus Ransomware",
|
|
"Caddy Wiper",
|
|
"Castle RAT",
|
|
"CertUtil With Decode Argument",
|
|
"Certutil exe certificate extraction",
|
|
"Change To Safe Mode With Network Config",
|
|
"Chaos Ransomware",
|
|
"Check Elevated CMD using whoami",
|
|
"Child Processes of Spoolsv exe",
|
|
"China-Nexus Threat Activity",
|
|
"Circle CI Disable Security Job",
|
|
"Circle CI Disable Security Step",
|
|
"CircleCI",
|
|
"Cisco AI Defense Alerts",
|
|
"Cisco AI Defense Security Alerts by Application Name",
|
|
"Cisco ASA - AAA Policy Tampering",
|
|
"Cisco ASA - Core Syslog Message Volume Drop",
|
|
"Cisco ASA - Device File Copy Activity",
|
|
"Cisco ASA - Device File Copy to Remote Location",
|
|
"Cisco ASA - Logging Disabled via CLI",
|
|
"Cisco ASA - Logging Filters Configuration Tampering",
|
|
"Cisco ASA - Logging Message Suppression",
|
|
"Cisco ASA - New Local User Account Created",
|
|
"Cisco ASA - Packet Capture Activity",
|
|
"Cisco ASA - Reconnaissance Command Activity",
|
|
"Cisco ASA - User Account Deleted From Local Database",
|
|
"Cisco ASA - User Account Lockout Threshold Exceeded",
|
|
"Cisco ASA - User Privilege Level Change",
|
|
"Cisco ASA Logs",
|
|
"Cisco Catalyst SD-WAN Analytics",
|
|
"Cisco Configuration Archive Logging Analysis",
|
|
"Cisco Duo Activity",
|
|
"Cisco Duo Admin Login Unusual Browser",
|
|
"Cisco Duo Admin Login Unusual Country",
|
|
"Cisco Duo Admin Login Unusual Os",
|
|
"Cisco Duo Administrator",
|
|
"Cisco Duo Bulk Policy Deletion",
|
|
"Cisco Duo Bypass Code Generation",
|
|
"Cisco Duo Policy Allow Devices Without Screen Lock",
|
|
"Cisco Duo Policy Allow Network Bypass 2FA",
|
|
"Cisco Duo Policy Allow Old Flash",
|
|
"Cisco Duo Policy Allow Old Java",
|
|
"Cisco Duo Policy Allow Tampered Devices",
|
|
"Cisco Duo Policy Bypass 2FA",
|
|
"Cisco Duo Policy Deny Access",
|
|
"Cisco Duo Policy Skip 2FA for Other Countries",
|
|
"Cisco Duo Set User Status to Bypass 2FA",
|
|
"Cisco Duo Suspicious Activity",
|
|
"Cisco IOS Logs",
|
|
"Cisco IOS Suspicious Privileged Account Creation",
|
|
"Cisco IOS XE Implant Access",
|
|
"Cisco IOS XE Software Web Management User Interface vulnerability",
|
|
"Cisco Isovalent - Access To Cloud Metadata Service",
|
|
"Cisco Isovalent - Cron Job Creation",
|
|
"Cisco Isovalent - Curl Execution With Insecure Flags",
|
|
"Cisco Isovalent - Kprobe Spike",
|
|
"Cisco Isovalent - Late Process Execution",
|
|
"Cisco Isovalent - Non Allowlisted Image Use",
|
|
"Cisco Isovalent - Nsenter Usage in Kubernetes Pod",
|
|
"Cisco Isovalent - Pods Running Offensive Tools",
|
|
"Cisco Isovalent - Potential Escape to Host",
|
|
"Cisco Isovalent - Shell Execution",
|
|
"Cisco Isovalent Process Connect",
|
|
"Cisco Isovalent Process Exec",
|
|
"Cisco Isovalent Process Kprobe",
|
|
"Cisco Isovalent Suspicious Activity",
|
|
"Cisco NVM - Curl Execution With Insecure Flags",
|
|
"Cisco NVM - Installation of Typosquatted Python Package",
|
|
"Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI",
|
|
"Cisco NVM - Non-Network Binary Making Network Connection",
|
|
"Cisco NVM - Outbound Connection to Suspicious Port",
|
|
"Cisco NVM - Rclone Execution With Network Activity",
|
|
"Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download",
|
|
"Cisco NVM - Susp Script From Archive Triggering Network Activity",
|
|
"Cisco NVM - Suspicious Download From File Sharing Website",
|
|
"Cisco NVM - Suspicious File Download via Headless Browser",
|
|
"Cisco NVM - Suspicious Network Connection From Process With No Args",
|
|
"Cisco NVM - Suspicious Network Connection Initiated via MsXsl",
|
|
"Cisco NVM - Suspicious Network Connection to IP Lookup Service API",
|
|
"Cisco NVM - Webserver Download From File Sharing Website",
|
|
"Cisco Network Interface Modifications",
|
|
"Cisco Network Visibility Module Analytics",
|
|
"Cisco Network Visibility Module Flow Data",
|
|
"Cisco Network Visibility Module OSquery",
|
|
"Cisco Privileged Account Creation with HTTP Command Execution",
|
|
"Cisco Privileged Account Creation with Suspicious SSH Activity",
|
|
"Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity",
|
|
"Cisco SD-WAN - Low Frequency Rogue Peer",
|
|
"Cisco SD-WAN - Peering Activity",
|
|
"Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity",
|
|
"Cisco SD-WAN NTCE 1000001",
|
|
"Cisco SD-WAN Service Proxy Access Logs",
|
|
"Cisco SNMP Community String Configuration Changes",
|
|
"Cisco Secure Access Analytics",
|
|
"Cisco Secure Access Firewall",
|
|
"Cisco Secure Firewall - Binary File Type Download",
|
|
"Cisco Secure Firewall - Bits Network Activity",
|
|
"Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint",
|
|
"Cisco Secure Firewall - Blocked Connection",
|
|
"Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt",
|
|
"Cisco Secure Firewall - Communication Over Suspicious Ports",
|
|
"Cisco Secure Firewall - Connection to File Sharing Domain",
|
|
"Cisco Secure Firewall - File Download Over Uncommon Port",
|
|
"Cisco Secure Firewall - High EVE Threat Confidence",
|
|
"Cisco Secure Firewall - High Priority Intrusion Classification",
|
|
"Cisco Secure Firewall - High Volume of Intrusion Events Per Host",
|
|
"Cisco Secure Firewall - Intrusion Events by Threat Activity",
|
|
"Cisco Secure Firewall - Lumma Stealer Activity",
|
|
"Cisco Secure Firewall - Lumma Stealer Download Attempt",
|
|
"Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt",
|
|
"Cisco Secure Firewall - Malware File Downloaded",
|
|
"Cisco Secure Firewall - Oracle E-Business Suite Correlation",
|
|
"Cisco Secure Firewall - Oracle E-Business Suite Exploitation",
|
|
"Cisco Secure Firewall - Possibly Compromised Host",
|
|
"Cisco Secure Firewall - Potential Data Exfiltration",
|
|
"Cisco Secure Firewall - Privileged Command Execution via HTTP",
|
|
"Cisco Secure Firewall - Rare Snort Rule Triggered",
|
|
"Cisco Secure Firewall - React Server Components RCE Attempt",
|
|
"Cisco Secure Firewall - Remote Access Software Usage Traffic",
|
|
"Cisco Secure Firewall - Repeated Blocked Connections",
|
|
"Cisco Secure Firewall - Repeated Malware Downloads",
|
|
"Cisco Secure Firewall - SSH Connection to Non-Standard Port",
|
|
"Cisco Secure Firewall - SSH Connection to sshd_operns",
|
|
"Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts",
|
|
"Cisco Secure Firewall - Static Tundra Smart Install Abuse",
|
|
"Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity",
|
|
"Cisco Secure Firewall - Wget or Curl Download",
|
|
"Cisco Secure Firewall Threat Defense Analytics",
|
|
"Cisco Secure Firewall Threat Defense Connection Event",
|
|
"Cisco Secure Firewall Threat Defense File Event",
|
|
"Cisco Secure Firewall Threat Defense Intrusion Event",
|
|
"Cisco Smart Install Oversized Packet Detection",
|
|
"Cisco Smart Install Port Discovery and Status",
|
|
"Cisco Smart Install Remote Code Execution CVE-2018-0171",
|
|
"Cisco TFTP Server Configuration for Data Exfiltration",
|
|
"Cisco Umbrella DNS Denylisting",
|
|
"CiscoTalosIntelligence Identifier Reputation Analysis",
|
|
"Citrix ADC Exploitation CVE-2023-3519",
|
|
"Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure",
|
|
"Citrix ADC and Gateway Unauthorized Data Disclosure",
|
|
"Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966",
|
|
"Citrix NetScaler ADC and NetScaler Gateway CVE-2025-5777",
|
|
"Citrix Netscaler ADC CVE-2023-3519",
|
|
"Citrix ShareFile Exploitation CVE-2023-24489",
|
|
"Citrix ShareFile RCE CVE-2023-24489",
|
|
"Clear Unallocated Sector Using Cipher App",
|
|
"Cleo File Transfer Software",
|
|
"Clop Common Exec Parameter",
|
|
"Clop Ransomware",
|
|
"Clop Ransomware Known Service Name",
|
|
"Cloud API Calls From Previously Unseen User Roles",
|
|
"Cloud Compute Instance Created By Previously Unseen User",
|
|
"Cloud Compute Instance Created In Previously Unused Region",
|
|
"Cloud Compute Instance Created With Previously Unseen Image",
|
|
"Cloud Compute Instance Created With Previously Unseen Instance Type",
|
|
"Cloud Cryptomining",
|
|
"Cloud Federated Credential Abuse",
|
|
"Cloud Instance Modified By Previously Unseen User",
|
|
"Cloud Provisioning Activity From Previously Unseen City",
|
|
"Cloud Provisioning Activity From Previously Unseen Country",
|
|
"Cloud Provisioning Activity From Previously Unseen IP Address",
|
|
"Cloud Provisioning Activity From Previously Unseen Region",
|
|
"Cloud Security Groups Modifications by User",
|
|
"Cobalt Strike",
|
|
"ColdRoot MacOS RAT",
|
|
"Collection and Staging",
|
|
"Command And Control",
|
|
"Common Ransomware Extensions",
|
|
"Common Ransomware Notes",
|
|
"Compromised Linux Host",
|
|
"Compromised User Account",
|
|
"Compromised Windows Host",
|
|
"Confluence CVE-2023-22515 Trigger Vulnerability",
|
|
"Confluence Data Center and Confluence Server Vulnerabilities",
|
|
"Confluence Data Center and Server Privilege Escalation",
|
|
"Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527",
|
|
"Confluence Unauthenticated Remote Code Execution CVE-2022-26134",
|
|
"ConnectWise ScreenConnect Authentication Bypass",
|
|
"ConnectWise ScreenConnect Path Traversal",
|
|
"ConnectWise ScreenConnect Path Traversal Windows SACL",
|
|
"ConnectWise ScreenConnect Vulnerabilities",
|
|
"Conti Common Exec parameter",
|
|
"Control Loading from World Writable Directory",
|
|
"Count of Unique IPs Connecting to Ports",
|
|
"Count of assets by category",
|
|
"Create Remote Thread In Shell Application",
|
|
"Create Remote Thread into LSASS",
|
|
"Create a list of approved AWS service accounts",
|
|
"Create or delete windows shares using net exe",
|
|
"Creation of Shadow Copy",
|
|
"Creation of Shadow Copy with wmic and powershell",
|
|
"Creation of lsass Dump with Taskmgr",
|
|
"Credential Dumping",
|
|
"Credential Dumping via Copy Command from Shadow Copy",
|
|
"Credential Dumping via Symlink to Shadow Copy",
|
|
"Critical Alerts",
|
|
"CrowdStrike Falcon Stream Alert",
|
|
"CrowdStrike Falcon Stream Alerts",
|
|
"CrowdStrike OAuth API Device Attribute Lookup",
|
|
"CrowdStrike OAuth API Dynamic Analysis",
|
|
"CrowdStrike OAuth API Endpoint Analysis",
|
|
"CrowdStrike OAuth API Executable Denylisting",
|
|
"CrowdStrike OAuth API File Collection",
|
|
"CrowdStrike OAuth API File Eviction",
|
|
"CrowdStrike OAuth API File Restore",
|
|
"CrowdStrike OAuth API Get Device Info",
|
|
"CrowdStrike OAuth API Identifier Activity Analysis",
|
|
"CrowdStrike OAuth API Network Isolation",
|
|
"CrowdStrike OAuth API Network Restore",
|
|
"CrowdStrike OAuth API Process Termination",
|
|
"CrowdStrike ProcessRollup2",
|
|
"Crowdstrike Admin Weak Password Policy",
|
|
"Crowdstrike Admin With Duplicate Password",
|
|
"Crowdstrike High Identity Risk Severity",
|
|
"Crowdstrike Malware Triage",
|
|
"Crowdstrike Medium Identity Risk Severity",
|
|
"Crowdstrike Medium Severity Alert",
|
|
"Crowdstrike Multiple LOW Severity Alerts",
|
|
"Crowdstrike Privilege Escalation For Non-Admin User",
|
|
"Crowdstrike User Weak Password Policy",
|
|
"Crowdstrike User with Duplicate Password",
|
|
"CrushFTP",
|
|
"CrushFTP Authentication Bypass Exploitation",
|
|
"CrushFTP Max Simultaneous Users From IP",
|
|
"CrushFTP Server Side Template Injection",
|
|
"CrushFTP Vulnerabilities",
|
|
"Crypto Stealer",
|
|
"Curl Execution with Percent Encoded URL",
|
|
"Cyclops Blink",
|
|
"DHS Report TA18-074A",
|
|
"DLLHost with no Command Line Arguments with Network",
|
|
"DNS Amplification Attacks",
|
|
"DNS Denylisting Dispatch",
|
|
"DNS Exfiltration Using Nslookup App",
|
|
"DNS Hijacking",
|
|
"DNS Kerberos Coercion",
|
|
"DNS Query Length With High Standard Deviation",
|
|
"DNSTwist Domain Names",
|
|
"DSQuery Domain Discovery",
|
|
"DarkCrystal RAT",
|
|
"DarkGate Malware",
|
|
"DarkSide Ransomware",
|
|
"Data Destruction",
|
|
"Data Exfiltration",
|
|
"Data Protection",
|
|
"Default Baseline",
|
|
"Default EventBasedDetection",
|
|
"Defense Evasion or Unauthorized Access Via SDDL Tampering",
|
|
"Delete Detected Files",
|
|
"Delete ShadowCopy With PowerShell",
|
|
"Deleting Shadow Copies",
|
|
"Deobfuscate-Decode Files or Information",
|
|
"Derusbi",
|
|
"Detect ARP Poisoning",
|
|
"Detect AWS Console Login by New User",
|
|
"Detect AWS Console Login by User from New City",
|
|
"Detect AWS Console Login by User from New Country",
|
|
"Detect AWS Console Login by User from New Region",
|
|
"Detect AzureHound Command-Line Arguments",
|
|
"Detect AzureHound File Modifications",
|
|
"Detect Baron Samedit CVE-2021-3156",
|
|
"Detect Baron Samedit CVE-2021-3156 Segfault",
|
|
"Detect Baron Samedit CVE-2021-3156 via OSQuery",
|
|
"Detect Certify Command Line Arguments",
|
|
"Detect Certify With PowerShell Script Block Logging",
|
|
"Detect Certipy File Modifications",
|
|
"Detect Computer Changed with Anonymous Account",
|
|
"Detect Copy of ShadowCopy with Script Block Logging",
|
|
"Detect Credential Dumping through LSASS access",
|
|
"Detect DNS Query to Decommissioned S3 Bucket",
|
|
"Detect Distributed Password Spray Attempts",
|
|
"Detect Empire with PowerShell Script Block Logging",
|
|
"Detect Excessive Account Lockouts From Endpoint",
|
|
"Detect Excessive User Account Lockouts",
|
|
"Detect Exchange Web Shell",
|
|
"Detect F5 TMUI RCE CVE-2020-5902",
|
|
"Detect GCP Storage access from a new IP",
|
|
"Detect HTML Help Renamed",
|
|
"Detect HTML Help Spawn Child Process",
|
|
"Detect HTML Help URL in Command Line",
|
|
"Detect HTML Help Using InfoTech Storage Handlers",
|
|
"Detect IPv6 Network Infrastructure Threats",
|
|
"Detect Large ICMP Traffic",
|
|
"Detect MSHTA Url in Command Line",
|
|
"Detect Mimikatz With PowerShell Script Block Logging",
|
|
"Detect New Local Admin account",
|
|
"Detect New Login Attempts to Routers",
|
|
"Detect New Open GCP Storage Buckets",
|
|
"Detect New Open S3 Buckets over AWS CLI",
|
|
"Detect New Open S3 buckets",
|
|
"Detect Outbound LDAP Traffic",
|
|
"Detect Outbound SMB Traffic",
|
|
"Detect Outlook exe writing a zip file",
|
|
"Detect Password Spray Attack Behavior From Source",
|
|
"Detect Password Spray Attack Behavior On User",
|
|
"Detect Password Spray Attempts",
|
|
"Detect Path Interception By Creation Of program exe",
|
|
"Detect Port Security Violation",
|
|
"Detect Prohibited Applications Spawning cmd exe",
|
|
"Detect PsExec With accepteula Flag",
|
|
"Detect RClone Command-Line Usage",
|
|
"Detect RTLO In File Name",
|
|
"Detect RTLO In Process",
|
|
"Detect Rare Executables",
|
|
"Detect Regasm Spawning a Process",
|
|
"Detect Regasm with Network Connection",
|
|
"Detect Regasm with no Command Line Arguments",
|
|
"Detect Regsvcs Spawning a Process",
|
|
"Detect Regsvcs with Network Connection",
|
|
"Detect Regsvcs with No Command Line Arguments",
|
|
"Detect Regsvr32 Application Control Bypass",
|
|
"Detect Remote Access Software Usage DNS",
|
|
"Detect Remote Access Software Usage File",
|
|
"Detect Remote Access Software Usage FileInfo",
|
|
"Detect Remote Access Software Usage Process",
|
|
"Detect Remote Access Software Usage Registry",
|
|
"Detect Remote Access Software Usage Traffic",
|
|
"Detect Remote Access Software Usage URL",
|
|
"Detect Renamed 7-Zip",
|
|
"Detect Renamed PSExec",
|
|
"Detect Renamed RClone",
|
|
"Detect Renamed WinRAR",
|
|
"Detect Rogue DHCP Server",
|
|
"Detect Rundll32 Inline HTA Execution",
|
|
"Detect S3 access from a new IP",
|
|
"Detect SNICat SNI Exfiltration",
|
|
"Detect SharpHound Command-Line Arguments",
|
|
"Detect SharpHound File Modifications",
|
|
"Detect SharpHound Usage",
|
|
"Detect Software Download To Network Device",
|
|
"Detect Spike in AWS Security Hub Alerts for EC2 Instance",
|
|
"Detect Spike in AWS Security Hub Alerts for User",
|
|
"Detect Spike in S3 Bucket deletion",
|
|
"Detect Spike in blocked Outbound Traffic from your AWS",
|
|
"Detect Traffic Mirroring",
|
|
"Detect Unauthorized Assets by MAC address",
|
|
"Detect Use of cmd exe to Launch Script Interpreters",
|
|
"Detect WMI Event Subscription Persistence",
|
|
"Detect Web Access to Decommissioned S3 Bucket",
|
|
"Detect Windows DNS SIGRed via Splunk Stream",
|
|
"Detect Windows DNS SIGRed via Zeek",
|
|
"Detect Zerologon Attack",
|
|
"Detect Zerologon via Zeek",
|
|
"Detect attackers scanning for vulnerable JBoss servers",
|
|
"Detect hosts connecting to dynamic domain providers",
|
|
"Detect malicious requests to exploit JBoss servers",
|
|
"Detect mshta inline hta execution",
|
|
"Detect mshta renamed",
|
|
"Detection of tools built by NirSoft",
|
|
"Dev Sec Ops",
|
|
"Disable AMSI Through Registry",
|
|
"Disable Defender AntiVirus Registry",
|
|
"Disable Defender BlockAtFirstSeen Feature",
|
|
"Disable Defender Enhanced Notification",
|
|
"Disable Defender MpEngine Registry",
|
|
"Disable Defender Spynet Reporting",
|
|
"Disable Defender Submit Samples Consent Feature",
|
|
"Disable ETW Through Registry",
|
|
"Disable Logs Using WevtUtil",
|
|
"Disable Registry Tool",
|
|
"Disable Schedule Task",
|
|
"Disable Security Logs Using MiniNt Registry",
|
|
"Disable Show Hidden Files",
|
|
"Disable UAC Remote Restriction",
|
|
"Disable Windows App Hotkeys",
|
|
"Disable Windows Behavior Monitoring",
|
|
"Disable Windows SmartScreen Protection",
|
|
"Disabled Kerberos Pre-Authentication Discovery With Get-ADUser",
|
|
"Disabled Kerberos Pre-Authentication Discovery With PowerView",
|
|
"Disabling CMD Application",
|
|
"Disabling ControlPanel",
|
|
"Disabling Defender Services",
|
|
"Disabling Firewall with Netsh",
|
|
"Disabling FolderOptions Windows Feature",
|
|
"Disabling NoRun Windows App",
|
|
"Disabling Remote User Account Control",
|
|
"Disabling Security Tools",
|
|
"Disabling SystemRestore In Registry",
|
|
"Disabling Task Manager",
|
|
"Disabling Windows Local Security Authority Defences via Registry",
|
|
"Discover DNS records",
|
|
"Disk Wiper",
|
|
"Domain Account Discovery with Dsquery",
|
|
"Domain Account Discovery with Wmic",
|
|
"Domain Controller Discovery with Nltest",
|
|
"Domain Controller Discovery with Wmic",
|
|
"Domain Group Discovery With Dsquery",
|
|
"Domain Group Discovery With Wmic",
|
|
"Domain Group Discovery with Adsisearcher",
|
|
"Domain Trust Discovery",
|
|
"Double Zero Destructor",
|
|
"Download Files Using Telegram",
|
|
"Drop IcedID License dat",
|
|
"Dump LSASS via comsvcs DLL",
|
|
"Dump LSASS via procdump",
|
|
"Dynamic Analysis Dispatch",
|
|
"Dynamic DNS",
|
|
"DynoWiper",
|
|
"ESXi Account Modified",
|
|
"ESXi Audit Tampering",
|
|
"ESXi Bulk VM Termination",
|
|
"ESXi Download Errors",
|
|
"ESXi Encryption Settings Modified",
|
|
"ESXi External Root Login Activity",
|
|
"ESXi Firewall Disabled",
|
|
"ESXi Lockdown Mode Disabled",
|
|
"ESXi Loghost Config Tampering",
|
|
"ESXi Malicious VIB Forced Install",
|
|
"ESXi Post Compromise",
|
|
"ESXi Reverse Shell Patterns",
|
|
"ESXi SSH Brute Force",
|
|
"ESXi SSH Enabled",
|
|
"ESXi Sensitive Files Accessed",
|
|
"ESXi Shared or Stolen Root Account",
|
|
"ESXi Shell Access Enabled",
|
|
"ESXi Syslog Config Change",
|
|
"ESXi System Clock Manipulation",
|
|
"ESXi System Information Discovery",
|
|
"ESXi User Granted Admin Role",
|
|
"ESXi VIB Acceptance Level Tampering",
|
|
"ESXi VM Discovery",
|
|
"ESXi VM Exported via Remote Tool",
|
|
"ETW Registry Disabled",
|
|
"Earth Alux",
|
|
"Elevated Group Discovery With Wmic",
|
|
"Elevated Group Discovery with PowerView",
|
|
"Email Attachments With Lots Of Spaces",
|
|
"Email Notification for Malware",
|
|
"Email files written outside of the Outlook directory",
|
|
"Email servers sending high volume traffic to hosts",
|
|
"Emotet Malware DHS Report TA18-201A",
|
|
"Enable RDP In Other Port Number",
|
|
"Enable WDigest UseLogonCredential Registry",
|
|
"Enumerate Users Local Group Using Telegram",
|
|
"Esentutl SAM Copy",
|
|
"Eventvwr UAC Bypass",
|
|
"Excessive Attempt To Disable Services",
|
|
"Excessive DNS Failures",
|
|
"Excessive File Deletion In WinDefender Folder",
|
|
"Excessive Usage Of Cacls App",
|
|
"Excessive Usage Of SC Service Utility",
|
|
"Excessive Usage Of Taskkill",
|
|
"Excessive Usage of NSLOOKUP App",
|
|
"Excessive distinct processes from Windows Temp",
|
|
"Excessive number of service control start as disabled",
|
|
"Excessive number of taskhost processes",
|
|
"Exchange PowerShell Abuse via SSRF",
|
|
"Exchange PowerShell Module Usage",
|
|
"Executable File Written in Administrative SMB Share",
|
|
"Executables Or Script Creation In Suspicious Path",
|
|
"Executables Or Script Creation In Temp Path",
|
|
"Execute Javascript With Jscript COM CLSID",
|
|
"Execution of File with Multiple Extensions",
|
|
"Exploit Public Facing Application via Apache Commons Text",
|
|
"Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952",
|
|
"F5 Authentication Bypass with TMUI",
|
|
"F5 BIG-IP Vulnerability CVE-2022-1388",
|
|
"F5 BIG-IP iControl REST Vulnerability CVE-2022-1388",
|
|
"F5 TMUI Authentication Bypass",
|
|
"F5 TMUI RCE CVE-2020-5902",
|
|
"FIN7",
|
|
"Fake CAPTCHA Campaigns",
|
|
"File Download or Read to Pipe Execution",
|
|
"File with Samsam Extension",
|
|
"Firewall Allowed Program Enable",
|
|
"First Time Seen Child Process of Zoom",
|
|
"First Time Seen Running Windows Service",
|
|
"Flax Typhoon",
|
|
"FodHelper UAC Bypass",
|
|
"Forest Blizzard",
|
|
"Fortinet Appliance Auth bypass",
|
|
"Fortinet FortiNAC CVE-2022-39952",
|
|
"Fsutil Zeroing File",
|
|
"G Suite Drive",
|
|
"G Suite Gmail",
|
|
"G Suite for GMail Message Identifier Activity Analysis",
|
|
"G Suite for Gmail Message Eviction",
|
|
"G Suite for Gmail Search and Purge",
|
|
"GCP Account Takeover",
|
|
"GCP Authentication Failed During MFA Challenge",
|
|
"GCP Cross Account Activity",
|
|
"GCP Detect gcploit framework",
|
|
"GCP Kubernetes cluster pod scan detection",
|
|
"GCP Multi-Factor Authentication Disabled",
|
|
"GCP Multiple Failed MFA Requests For User",
|
|
"GCP Multiple Users Failing To Authenticate From Ip",
|
|
"GCP Successful Single-Factor Authentication",
|
|
"GCP Unusual Number of Failed Authentications From Ip",
|
|
"GPUpdate with no Command Line Arguments with Network",
|
|
"GSuite Email Suspicious Attachment",
|
|
"Gdrive suspicious file sharing",
|
|
"Geographic Improbable Location",
|
|
"Get ADDefaultDomainPasswordPolicy with Powershell",
|
|
"Get ADDefaultDomainPasswordPolicy with Powershell Script Block",
|
|
"Get ADUser with PowerShell",
|
|
"Get ADUser with PowerShell Script Block",
|
|
"Get ADUserResultantPasswordPolicy with Powershell",
|
|
"Get ADUserResultantPasswordPolicy with Powershell Script Block",
|
|
"Get DomainPolicy with Powershell",
|
|
"Get DomainPolicy with Powershell Script Block",
|
|
"Get DomainUser with PowerShell",
|
|
"Get DomainUser with PowerShell Script Block",
|
|
"Get WMIObject Group Discovery",
|
|
"Get WMIObject Group Discovery with Script Block Logging",
|
|
"Get-DomainTrust with PowerShell",
|
|
"Get-DomainTrust with PowerShell Script Block",
|
|
"Get-ForestTrust with PowerShell",
|
|
"Get-ForestTrust with PowerShell Script Block",
|
|
"GetAdComputer with PowerShell",
|
|
"GetAdComputer with PowerShell Script Block",
|
|
"GetAdGroup with PowerShell",
|
|
"GetAdGroup with PowerShell Script Block",
|
|
"GetCurrent User with PowerShell",
|
|
"GetCurrent User with PowerShell Script Block",
|
|
"GetDomainComputer with PowerShell",
|
|
"GetDomainComputer with PowerShell Script Block",
|
|
"GetDomainController with PowerShell",
|
|
"GetDomainController with PowerShell Script Block",
|
|
"GetDomainGroup with PowerShell",
|
|
"GetDomainGroup with PowerShell Script Block",
|
|
"GetLocalUser with PowerShell",
|
|
"GetLocalUser with PowerShell Script Block",
|
|
"GetNetTcpconnection with PowerShell",
|
|
"GetNetTcpconnection with PowerShell Script Block",
|
|
"GetWmiObject DS User with PowerShell",
|
|
"GetWmiObject DS User with PowerShell Script Block",
|
|
"GetWmiObject Ds Computer with PowerShell",
|
|
"GetWmiObject Ds Computer with PowerShell Script Block",
|
|
"GetWmiObject Ds Group with PowerShell",
|
|
"GetWmiObject Ds Group with PowerShell Script Block",
|
|
"GetWmiObject User Account with PowerShell",
|
|
"GetWmiObject User Account with PowerShell Script Block",
|
|
"Gh0st RAT",
|
|
"GhostRedirector IIS Module and Rungan Backdoor",
|
|
"GitHub Enterprise Audit Logs",
|
|
"GitHub Enterprise Delete Branch Ruleset",
|
|
"GitHub Enterprise Disable 2FA Requirement",
|
|
"GitHub Enterprise Disable Audit Log Event Stream",
|
|
"GitHub Enterprise Disable Classic Branch Protection Rule",
|
|
"GitHub Enterprise Disable Dependabot",
|
|
"GitHub Enterprise Disable IP Allow List",
|
|
"GitHub Enterprise Modify Audit Log Event Stream",
|
|
"GitHub Enterprise Pause Audit Log Event Stream",
|
|
"GitHub Enterprise Register Self Hosted Runner",
|
|
"GitHub Enterprise Remove Organization",
|
|
"GitHub Enterprise Repository Archived",
|
|
"GitHub Enterprise Repository Deleted",
|
|
"GitHub Malicious Activity",
|
|
"GitHub Organizations Audit Logs",
|
|
"GitHub Organizations Delete Branch Ruleset",
|
|
"GitHub Organizations Disable 2FA Requirement",
|
|
"GitHub Organizations Disable Classic Branch Protection Rule",
|
|
"GitHub Organizations Disable Dependabot",
|
|
"GitHub Organizations Repository Archived",
|
|
"GitHub Organizations Repository Deleted",
|
|
"GitHub Webhooks",
|
|
"GitHub Workflow File Creation or Modification",
|
|
"Gomir",
|
|
"Google Workspace",
|
|
"Google Workspace login_failure",
|
|
"Google Workspace login_success",
|
|
"Gozi Malware",
|
|
"Graceful Wipe Out Attack",
|
|
"Gsuite Drive Share In External Email",
|
|
"Gsuite Email Suspicious Subject With Attachment",
|
|
"Gsuite Email With Known Abuse Web Service Link",
|
|
"Gsuite Outbound Email With Attachment To External Domain",
|
|
"Gsuite Suspicious Shared File Name",
|
|
"Gsuite suspicious calendar invite",
|
|
"HAFNIUM Group",
|
|
"HTTP C2 Framework User Agent",
|
|
"HTTP Duplicated Header",
|
|
"HTTP Malware User Agent",
|
|
"HTTP PUA User Agent",
|
|
"HTTP Possible Request Smuggling",
|
|
"HTTP RMM User Agent",
|
|
"HTTP Rapid POST with Mixed Status Codes",
|
|
"HTTP Request Smuggling",
|
|
"HTTP Request to Reserved Name on IIS Server",
|
|
"HTTP Scripting Tool User Agent",
|
|
"Handala Wiper",
|
|
"Headless Browser Mockbin or Mocky Request",
|
|
"Headless Browser Usage",
|
|
"Hellcat Ransomware",
|
|
"Hermetic Wiper",
|
|
"Hidden Cobra Malware",
|
|
"Hide User Account From Sign-In Screen",
|
|
"Hiding Files And Directories With Attrib exe",
|
|
"High Frequency Copy Of Files In Network Share",
|
|
"High Number of Login Failures from a single source",
|
|
"High Process Termination Frequency",
|
|
"High Volume of Bytes Out to Url",
|
|
"Hosts receiving high volume of network traffic from email server",
|
|
"Hunting",
|
|
"Hunting 3CXDesktopApp Software",
|
|
"Hunting for Log4Shell",
|
|
"ICACLS Grant Command",
|
|
"IIS Components",
|
|
"Icacls Deny Command",
|
|
"IcedID",
|
|
"IcedID Exfiltrated Archived File Creation",
|
|
"Identifier Activity Analysis Dispatch",
|
|
"Identifier Reputation Analysis Dispatch",
|
|
"Identify Systems Creating Remote Desktop Traffic",
|
|
"Identify Systems Receiving Remote Desktop Traffic",
|
|
"Identify Systems Using Remote Desktop",
|
|
"Impacket Lateral Movement Commandline Parameters",
|
|
"Impacket Lateral Movement WMIExec Commandline Parameters",
|
|
"Impacket Lateral Movement smbexec CommandLine Parameters",
|
|
"Industroyer2",
|
|
"Information Sabotage",
|
|
"Ingress Tool Transfer",
|
|
"Insider Threat",
|
|
"Interactive Session on Remote Endpoint with PowerShell",
|
|
"Interlock Ransomware",
|
|
"Interlock Rat",
|
|
"Internal Horizontal Port Scan",
|
|
"Internal Horizontal Port Scan NMAP Top 20",
|
|
"Internal Host SSH Investigate",
|
|
"Internal Host SSH Log4j Investigate",
|
|
"Internal Host SSH Log4j Respond",
|
|
"Internal Host Splunk Investigate log4j",
|
|
"Internal Host WinRM Investigate",
|
|
"Internal Host WinRM Log4j Investigate",
|
|
"Internal Host WinRM log4j Respond",
|
|
"Internal Vertical Port Scan",
|
|
"Internal Vulnerability Scan",
|
|
"Ivanti Connect Secure Command Injection Attempts",
|
|
"Ivanti Connect Secure SSRF in SAML Component",
|
|
"Ivanti Connect Secure System Information Access via Auth Bypass",
|
|
"Ivanti Connect Secure VPN Vulnerabilities",
|
|
"Ivanti EPM SQL Injection Remote Code Execution",
|
|
"Ivanti EPM Vulnerabilities",
|
|
"Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078",
|
|
"Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082",
|
|
"Ivanti EPMM Remote Unauthenticated Access",
|
|
"Ivanti Sentry Authentication Bypass",
|
|
"Ivanti Sentry Authentication Bypass CVE-2023-38035",
|
|
"Ivanti VTM Audit",
|
|
"Ivanti VTM New Account Creation",
|
|
"Ivanti Virtual Traffic Manager CVE-2024-7593",
|
|
"JBoss Vulnerability",
|
|
"Java Class File download by Java User Agent",
|
|
"Java Writing JSP File",
|
|
"Jenkins Arbitrary File Read CVE-2024-23897",
|
|
"Jenkins Server Vulnerabilities",
|
|
"JetBrains TeamCity Authentication Bypass CVE-2024-27198",
|
|
"JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198",
|
|
"JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199",
|
|
"JetBrains TeamCity RCE Attempt",
|
|
"JetBrains TeamCity Unauthenticated RCE",
|
|
"JetBrains TeamCity Vulnerabilities",
|
|
"Jira Related Tickets Search",
|
|
"Jscript Execution Using Cscript App",
|
|
"Juniper JunOS Remote Code Execution",
|
|
"Juniper Networks Remote Code Execution Exploit Detection",
|
|
"Kerberoasting spn request with RC4 encryption",
|
|
"Kerberos Coercion with DNS",
|
|
"Kerberos Pre-Authentication Flag Disabled in UserAccountControl",
|
|
"Kerberos Pre-Authentication Flag Disabled with PowerShell",
|
|
"Kerberos Service Ticket Request Using RC4 Encryption",
|
|
"Kerberos TGT Request Using RC4 Encryption",
|
|
"Kerberos User Enumeration",
|
|
"Kubernetes AWS detect suspicious kubectl calls",
|
|
"Kubernetes Abuse of Secret by Unusual Location",
|
|
"Kubernetes Abuse of Secret by Unusual User Agent",
|
|
"Kubernetes Abuse of Secret by Unusual User Group",
|
|
"Kubernetes Abuse of Secret by Unusual User Name",
|
|
"Kubernetes Access Scanning",
|
|
"Kubernetes Anomalous Inbound Network Activity from Process",
|
|
"Kubernetes Anomalous Inbound Outbound Network IO",
|
|
"Kubernetes Anomalous Inbound to Outbound Network IO Ratio",
|
|
"Kubernetes Anomalous Outbound Network Activity from Process",
|
|
"Kubernetes Anomalous Traffic on Network Edge",
|
|
"Kubernetes Audit",
|
|
"Kubernetes Create or Update Privileged Pod",
|
|
"Kubernetes Cron Job Creation",
|
|
"Kubernetes DaemonSet Deployed",
|
|
"Kubernetes Falco",
|
|
"Kubernetes Falco Shell Spawned",
|
|
"Kubernetes Nginx Ingress LFI",
|
|
"Kubernetes Nginx Ingress RFI",
|
|
"Kubernetes Node Port Creation",
|
|
"Kubernetes Pod Created in Default Namespace",
|
|
"Kubernetes Pod With Host Network Attachment",
|
|
"Kubernetes Previously Unseen Container Image Name",
|
|
"Kubernetes Previously Unseen Process",
|
|
"Kubernetes Process Running From New Path",
|
|
"Kubernetes Process with Anomalous Resource Utilisation",
|
|
"Kubernetes Process with Resource Ratio Anomalies",
|
|
"Kubernetes Scanner Image Pulling",
|
|
"Kubernetes Scanning Activity",
|
|
"Kubernetes Scanning by Unauthenticated IP Address",
|
|
"Kubernetes Security",
|
|
"Kubernetes Sensitive Object Access Activity",
|
|
"Kubernetes Shell Running on Worker Node",
|
|
"Kubernetes Shell Running on Worker Node with CPU Activity",
|
|
"Kubernetes Suspicious Image Pulling",
|
|
"Kubernetes Unauthorized Access",
|
|
"Kubernetes newly seen TCP edge",
|
|
"Kubernetes newly seen UDP edge",
|
|
"LAMEHUG",
|
|
"LLM Model File Creation",
|
|
"LOLBAS With Network Traffic",
|
|
"Large Volume of DNS ANY Queries",
|
|
"Linux APT Privilege Escalation",
|
|
"Linux AWK Privilege Escalation",
|
|
"Linux Account Manipulation Of SSH Config and Keys",
|
|
"Linux Add Files In Known Crontab Directories",
|
|
"Linux Add User Account",
|
|
"Linux Adding Crontab Using List Parameter",
|
|
"Linux At Allow Config File Creation",
|
|
"Linux At Application Execution",
|
|
"Linux Auditd AI CLI Permission Override Activated",
|
|
"Linux Auditd Add User",
|
|
"Linux Auditd Add User Account",
|
|
"Linux Auditd Add User Account Type",
|
|
"Linux Auditd At Application Execution",
|
|
"Linux Auditd Auditd Daemon Abort",
|
|
"Linux Auditd Auditd Daemon Shutdown",
|
|
"Linux Auditd Auditd Daemon Start",
|
|
"Linux Auditd Auditd Service Stop",
|
|
"Linux Auditd Base64 Decode Files",
|
|
"Linux Auditd Change File Owner To Root",
|
|
"Linux Auditd Clipboard Data Copy",
|
|
"Linux Auditd Copy Fail Privilege Escalation",
|
|
"Linux Auditd Cwd",
|
|
"Linux Auditd Daemon Abort",
|
|
"Linux Auditd Daemon End",
|
|
"Linux Auditd Daemon Start",
|
|
"Linux Auditd Data Destruction Command",
|
|
"Linux Auditd Data Transfer Size Limits Via Split",
|
|
"Linux Auditd Data Transfer Size Limits Via Split Syscall",
|
|
"Linux Auditd Database File And Directory Discovery",
|
|
"Linux Auditd Dd File Overwrite",
|
|
"Linux Auditd Disable Or Modify System Firewall",
|
|
"Linux Auditd Doas Conf File Creation",
|
|
"Linux Auditd Doas Tool Execution",
|
|
"Linux Auditd Edit Cron Table Parameter",
|
|
"Linux Auditd Execve",
|
|
"Linux Auditd File And Directory Discovery",
|
|
"Linux Auditd File Permission Modification Via Chmod",
|
|
"Linux Auditd File Permissions Modification Via Chattr",
|
|
"Linux Auditd Find Credentials From Password Managers",
|
|
"Linux Auditd Find Credentials From Password Stores",
|
|
"Linux Auditd Find Ssh Private Keys",
|
|
"Linux Auditd Hardware Addition Swapoff",
|
|
"Linux Auditd Hidden Files And Directories Creation",
|
|
"Linux Auditd Insert Kernel Module Using Insmod Utility",
|
|
"Linux Auditd Install Kernel Module Using Modprobe Utility",
|
|
"Linux Auditd Kernel Module Enumeration",
|
|
"Linux Auditd Kernel Module Using Rmmod Utility",
|
|
"Linux Auditd Nopasswd Entry In Sudoers File",
|
|
"Linux Auditd Osquery Service Stop",
|
|
"Linux Auditd Path",
|
|
"Linux Auditd Possible Access Or Modification Of Sshd Config File",
|
|
"Linux Auditd Possible Access To Credential Files",
|
|
"Linux Auditd Possible Access To Sudoers File",
|
|
"Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File",
|
|
"Linux Auditd Preload Hijack Library Calls",
|
|
"Linux Auditd Preload Hijack Via Preload File",
|
|
"Linux Auditd Private Keys and Certificate Enumeration",
|
|
"Linux Auditd Proctitle",
|
|
"Linux Auditd Service Restarted",
|
|
"Linux Auditd Service Started",
|
|
"Linux Auditd Service Stop",
|
|
"Linux Auditd Setuid Using Chmod Utility",
|
|
"Linux Auditd Setuid Using Setcap Utility",
|
|
"Linux Auditd Shred Overwrite Command",
|
|
"Linux Auditd Stop Services",
|
|
"Linux Auditd Sudo Or Su Execution",
|
|
"Linux Auditd Syscall",
|
|
"Linux Auditd Sysmon Service Stop",
|
|
"Linux Auditd System Network Configuration Discovery",
|
|
"Linux Auditd Unix Shell Configuration Modification",
|
|
"Linux Auditd Unload Module Via Modprobe",
|
|
"Linux Auditd Virtual Disk File And Directory Discovery",
|
|
"Linux Auditd Whoami User Discovery",
|
|
"Linux Busybox Privilege Escalation",
|
|
"Linux Change File Owner To Root",
|
|
"Linux Clipboard Data Copy",
|
|
"Linux Common Process For Elevation Control",
|
|
"Linux Composer Privilege Escalation",
|
|
"Linux Cpulimit Privilege Escalation",
|
|
"Linux Csvtool Privilege Escalation",
|
|
"Linux Curl Upload File",
|
|
"Linux DD File Overwrite",
|
|
"Linux Data Destruction Command",
|
|
"Linux Decode Base64 to Shell",
|
|
"Linux Deleting Critical Directory Using RM Command",
|
|
"Linux Deletion Of Cron Jobs",
|
|
"Linux Deletion Of Init Daemon Script",
|
|
"Linux Deletion Of Services",
|
|
"Linux Deletion of SSL Certificate",
|
|
"Linux Disable Services",
|
|
"Linux Doas Conf File Creation",
|
|
"Linux Doas Tool Execution",
|
|
"Linux Docker Root Directory Mount",
|
|
"Linux Docker Shell Execution",
|
|
"Linux Edit Cron Table Parameter",
|
|
"Linux Emacs Privilege Escalation",
|
|
"Linux File Created In Kernel Driver Directory",
|
|
"Linux File Creation In Init Boot Directory",
|
|
"Linux File Creation In Profile Directory",
|
|
"Linux Find Privilege Escalation",
|
|
"Linux GDB Privilege Escalation",
|
|
"Linux GNU Awk Privilege Escalation",
|
|
"Linux Gdrive Binary Activity",
|
|
"Linux Gem Privilege Escalation",
|
|
"Linux Hardware Addition SwapOff",
|
|
"Linux High Frequency Of File Deletion In Boot Folder",
|
|
"Linux High Frequency Of File Deletion In Etc Folder",
|
|
"Linux Impair Defenses Process Kill",
|
|
"Linux Indicator Removal Clear Cache",
|
|
"Linux Indicator Removal Service File Deletion",
|
|
"Linux Ingress Tool Transfer Hunting",
|
|
"Linux Ingress Tool Transfer with Curl",
|
|
"Linux Insert Kernel Module Using Insmod Utility",
|
|
"Linux Install Kernel Module Using Modprobe Utility",
|
|
"Linux Iptables Firewall Modification",
|
|
"Linux Kernel Module Enumeration",
|
|
"Linux Kworker Process In Writable Process Path",
|
|
"Linux Living Off The Land",
|
|
"Linux Magic SysRq Key Abuse",
|
|
"Linux Make Privilege Escalation",
|
|
"Linux Medusa Rootkit",
|
|
"Linux MySQL Privilege Escalation",
|
|
"Linux NOPASSWD Entry In Sudoers File",
|
|
"Linux Ngrok Reverse Proxy Usage",
|
|
"Linux Node Privilege Escalation",
|
|
"Linux Obfuscated Files or Information Base64 Decode",
|
|
"Linux Octave Privilege Escalation",
|
|
"Linux OpenVPN Privilege Escalation",
|
|
"Linux PHP Privilege Escalation",
|
|
"Linux Persistence Techniques",
|
|
"Linux Persistence and Privilege Escalation Risk Behavior",
|
|
"Linux Possible Access Or Modification Of sshd Config File",
|
|
"Linux Possible Access To Credential Files",
|
|
"Linux Possible Access To Sudoers File",
|
|
"Linux Possible Append Command To At Allow Config File",
|
|
"Linux Possible Append Command To Profile Config File",
|
|
"Linux Possible Append Cronjob Entry on Existing Cronjob File",
|
|
"Linux Possible Cronjob Modification With Editor",
|
|
"Linux Possible Ssh Key File Creation",
|
|
"Linux Post-Exploitation",
|
|
"Linux Preload Hijack Library Calls",
|
|
"Linux Privilege Escalation",
|
|
"Linux Proxy Socks Curl",
|
|
"Linux Puppet Privilege Escalation",
|
|
"Linux RPM Privilege Escalation",
|
|
"Linux Rootkit",
|
|
"Linux Ruby Privilege Escalation",
|
|
"Linux SSH Authorized Keys Modification",
|
|
"Linux SSH Remote Services Script Execute",
|
|
"Linux Secure",
|
|
"Linux Service File Created In Systemd Directory",
|
|
"Linux Service Restarted",
|
|
"Linux Service Started Or Enabled",
|
|
"Linux Setuid Using Chmod Utility",
|
|
"Linux Setuid Using Setcap Utility",
|
|
"Linux Shred Overwrite Command",
|
|
"Linux Sqlite3 Privilege Escalation",
|
|
"Linux Stdout Redirection To Dev Null File",
|
|
"Linux Stop Services",
|
|
"Linux Sudo OR Su Execution",
|
|
"Linux Sudoers Tmp File Creation",
|
|
"Linux Suspicious React or Next.js Child Process",
|
|
"Linux System Network Discovery",
|
|
"Linux System Reboot Via System Request Key",
|
|
"Linux Telnet Authentication Bypass",
|
|
"Linux Unix Shell Enable All SysRq Functions",
|
|
"Linux Visudo Utility Execution",
|
|
"Linux c89 Privilege Escalation",
|
|
"Linux c99 Privilege Escalation",
|
|
"Linux pkexec Privilege Escalation",
|
|
"Living Off The Land",
|
|
"Living Off The Land Detection",
|
|
"Loading Of Dynwrapx Module",
|
|
"Local Account Discovery With Wmic",
|
|
"Local LLM Framework DNS Query",
|
|
"Local Privilege Escalation With KrbRelayUp",
|
|
"LockBit Ransomware",
|
|
"Log4Shell CVE-2021-44228",
|
|
"Log4Shell CVE-2021-44228 Exploitation",
|
|
"Log4Shell JNDI Payload Injection Attempt",
|
|
"Log4Shell JNDI Payload Injection with Outbound Connection",
|
|
"Log4j Investigate",
|
|
"Log4j Respond",
|
|
"Logon Script Event Trigger Execution",
|
|
"Lokibot",
|
|
"Lotus Blossom Chrysalis Backdoor",
|
|
"Lumma Stealer",
|
|
"M365 Copilot Agentic Jailbreak Attack",
|
|
"M365 Copilot Application Usage Pattern Anomalies",
|
|
"M365 Copilot Failed Authentication Patterns",
|
|
"M365 Copilot Graph API",
|
|
"M365 Copilot Impersonation Jailbreak Attack",
|
|
"M365 Copilot Information Extraction Jailbreak Attack",
|
|
"M365 Copilot Jailbreak Attempts",
|
|
"M365 Copilot Non Compliant Devices Accessing M365 Copilot",
|
|
"M365 Copilot Session Origin Anomalies",
|
|
"M365 Exported eDiscovery Prompts",
|
|
"MCP Filesystem Server Suspicious Extension Write",
|
|
"MCP Github Suspicious Operation",
|
|
"MCP Postgres Suspicious Query",
|
|
"MCP Prompt Injection",
|
|
"MCP Sensitive System File Search",
|
|
"MCP Server",
|
|
"MOVEit Certificate Store Access Failure",
|
|
"MOVEit Empty Key Fingerprint Authentication Attempt",
|
|
"MOVEit Transfer Authentication Bypass",
|
|
"MOVEit Transfer Critical Vulnerability",
|
|
"MS Defender ATP Alerts",
|
|
"MS Exchange Mailbox Replication service writing Active Server Pages",
|
|
"MS Graph for Office 365 Message Eviction",
|
|
"MS Graph for Office 365 Message Identifier Activity Analysis",
|
|
"MS Graph for Office 365 Message Restore",
|
|
"MS Graph for Office 365 Search and Purge",
|
|
"MS Graph for Office 365 Search and Restore",
|
|
"MS Scripting Process Loading Ldap Module",
|
|
"MS Scripting Process Loading WMI Module",
|
|
"MS365 Defender Incident Alerts",
|
|
"MSBuild Suspicious Spawned By Script Process",
|
|
"MSI Module Loaded by Non-System Binary",
|
|
"MSIX Package Abuse",
|
|
"MacOS - Re-opened Applications",
|
|
"MacOS AMOS Stealer - Virtual Machine Check Activity",
|
|
"MacOS Account Created",
|
|
"MacOS Data Chunking",
|
|
"MacOS Gatekeeper Bypass",
|
|
"MacOS Hidden Files and Directories",
|
|
"MacOS Kextload Usage",
|
|
"MacOS Keychains Dumped",
|
|
"MacOS LOLbin",
|
|
"MacOS List Firewall Rules",
|
|
"MacOS Log Removal",
|
|
"MacOS LoginHook Persistence",
|
|
"MacOS Network Share Discovery",
|
|
"MacOS Persistence Techniques",
|
|
"MacOS Post-Exploitation",
|
|
"MacOS Privilege Escalation",
|
|
"MacOS plutil",
|
|
"Mailsniper Invoke functions",
|
|
"Malicious InProcServer32 Modification",
|
|
"Malicious Inno Setup Loader",
|
|
"Malicious PowerShell",
|
|
"Malicious PowerShell Process - Encoded Command",
|
|
"Malicious PowerShell Process - Execution Policy Bypass",
|
|
"Malicious PowerShell Process With Obfuscation Techniques",
|
|
"Malicious Powershell Executed As A Service",
|
|
"Malware Hunt and Contain",
|
|
"Masquerading - Rename System Utilities",
|
|
"Medusa Ransomware",
|
|
"Medusa Rootkit",
|
|
"Meduza Stealer",
|
|
"MetaSploit",
|
|
"Meterpreter",
|
|
"Microsoft Defender ATP Alerts",
|
|
"Microsoft Defender Incident Alerts",
|
|
"Microsoft Intune Bulk Wipe",
|
|
"Microsoft Intune Device Health Scripts",
|
|
"Microsoft Intune DeviceManagementConfigurationPolicies",
|
|
"Microsoft Intune Manual Device Management",
|
|
"Microsoft Intune Mobile Apps",
|
|
"Microsoft MSHTML Remote Code Execution CVE-2021-40444",
|
|
"Microsoft SharePoint Server Elevation of Privilege",
|
|
"Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357",
|
|
"Microsoft SharePoint Vulnerabilities",
|
|
"Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190",
|
|
"Microsoft WSUS CVE-2025-59287",
|
|
"Mimikatz PassTheTicket CommandLine Parameters",
|
|
"Mmc LOLBAS Execution Process Spawn",
|
|
"Modification Of Wallpaper",
|
|
"Modify ACL permission To Files Or Folder",
|
|
"Monitor Email For Brand Abuse",
|
|
"Monitor Registry Keys for Print Monitors",
|
|
"Monitor Web Traffic For Brand Abuse",
|
|
"Monitor for Updates",
|
|
"MoonPeak",
|
|
"Mshta spawning Rundll32 OR Regsvr32 Process",
|
|
"Msmpeng Application DLL Side Loading",
|
|
"MuddyWater",
|
|
"Multiple Archive Files Http Post Traffic",
|
|
"NET Profiler UAC bypass",
|
|
"NLTest Domain Trust Discovery",
|
|
"NOBELIUM Group",
|
|
"NPM Supply Chain Compromise",
|
|
"NTLM Operational 8004",
|
|
"NTLM Operational 8005",
|
|
"NTLM Operational 8006",
|
|
"NailaoLocker Ransomware",
|
|
"NetSupport RMM Tool Abuse",
|
|
"Netsh Abuse",
|
|
"Network Connection Discovery With Arp",
|
|
"Network Connection Discovery With Netstat",
|
|
"Network Discovery",
|
|
"Network Discovery Using Route Windows App",
|
|
"Network Share Discovery Via Dir Command",
|
|
"Network Traffic to Active Directory Web Services Protocol",
|
|
"Nginx Access",
|
|
"Nginx ConnectWise ScreenConnect Authentication Bypass",
|
|
"Ngrok Reverse Proxy on Network",
|
|
"Nishang PowershellTCPOneLine",
|
|
"NjRAT",
|
|
"No Windows Updates in a time frame",
|
|
"Non Chrome Process Accessing Chrome Default Dir",
|
|
"Non Firefox Process Access Firefox Profile Dir",
|
|
"NotDoor Malware",
|
|
"Notepad with no Command Line Arguments",
|
|
"Ntdsutil Export NTDS",
|
|
"O365",
|
|
"O365 Add App Role Assignment Grant User",
|
|
"O365 Add app role assignment grant to user.",
|
|
"O365 Add app role assignment to service principal.",
|
|
"O365 Add member to role.",
|
|
"O365 Add owner to application.",
|
|
"O365 Add service principal.",
|
|
"O365 Add-MailboxPermission",
|
|
"O365 Added Service Principal",
|
|
"O365 Admin Consent Bypassed by Service Principal",
|
|
"O365 Advanced Audit Disabled",
|
|
"O365 Application Available To Other Tenants",
|
|
"O365 Application Registration Owner Added",
|
|
"O365 ApplicationImpersonation Role Assigned",
|
|
"O365 BEC Email Hiding Rule Created",
|
|
"O365 Block User Consent For Risky Apps Disabled",
|
|
"O365 Bypass MFA via Trusted IP",
|
|
"O365 Change user license.",
|
|
"O365 Compliance Content Search Exported",
|
|
"O365 Compliance Content Search Started",
|
|
"O365 Concurrent Sessions From Different Ips",
|
|
"O365 Consent to application.",
|
|
"O365 Cross-Tenant Access Change",
|
|
"O365 DLP Rule Triggered",
|
|
"O365 Disable MFA",
|
|
"O365 Disable Strong Authentication.",
|
|
"O365 Elevated Mailbox Permission Assigned",
|
|
"O365 Email Access By Security Administrator",
|
|
"O365 Email Hard Delete Excessive Volume",
|
|
"O365 Email New Inbox Rule Created",
|
|
"O365 Email Password and Payroll Compromise Behavior",
|
|
"O365 Email Receive and Hard Delete Takeover Behavior",
|
|
"O365 Email Reported By Admin Found Malicious",
|
|
"O365 Email Reported By User Found Malicious",
|
|
"O365 Email Security Feature Changed",
|
|
"O365 Email Send Attachments Excessive Volume",
|
|
"O365 Email Send and Hard Delete Exfiltration Behavior",
|
|
"O365 Email Send and Hard Delete Suspicious Behavior",
|
|
"O365 Email Suspicious Behavior Alert",
|
|
"O365 Email Suspicious Search Behavior",
|
|
"O365 Email Transport Rule Changed",
|
|
"O365 Excessive Authentication Failures Alert",
|
|
"O365 Excessive SSO logon errors",
|
|
"O365 Exfiltration via File Access",
|
|
"O365 Exfiltration via File Download",
|
|
"O365 Exfiltration via File Sync Download",
|
|
"O365 External Guest User Invited",
|
|
"O365 External Identity Policy Changed",
|
|
"O365 File Permissioned Application Consent Granted by User",
|
|
"O365 FullAccessAsApp Permission Assigned",
|
|
"O365 High Number Of Failed Authentications for User",
|
|
"O365 High Privilege Role Granted",
|
|
"O365 Mail Permissioned Application Consent Granted by User",
|
|
"O365 MailItemsAccessed",
|
|
"O365 Mailbox Email Forwarding Enabled",
|
|
"O365 Mailbox Folder Read Permission Assigned",
|
|
"O365 Mailbox Folder Read Permission Granted",
|
|
"O365 Mailbox Inbox Folder Shared with All Users",
|
|
"O365 Mailbox Read Access Granted to Application",
|
|
"O365 ModifyFolderPermissions",
|
|
"O365 Multi-Source Failed Authentications Spike",
|
|
"O365 Multiple AppIDs and UserAgents Authentication Spike",
|
|
"O365 Multiple Failed MFA Requests For User",
|
|
"O365 Multiple Mailboxes Accessed via API",
|
|
"O365 Multiple OS Vendors Authenticating From User",
|
|
"O365 Multiple Service Principals Created by SP",
|
|
"O365 Multiple Service Principals Created by User",
|
|
"O365 Multiple Users Failing To Authenticate From Ip",
|
|
"O365 New Email Forwarding Rule Created",
|
|
"O365 New Email Forwarding Rule Enabled",
|
|
"O365 New Federated Domain Added",
|
|
"O365 New Forwarding Mailflow Rule Created",
|
|
"O365 New MFA Method Registered",
|
|
"O365 OAuth App Mailbox Access via EWS",
|
|
"O365 OAuth App Mailbox Access via Graph API",
|
|
"O365 PST export alert",
|
|
"O365 Privileged Graph API Permission Assigned",
|
|
"O365 Privileged Role Assigned",
|
|
"O365 Privileged Role Assigned To Service Principal",
|
|
"O365 Safe Links Detection",
|
|
"O365 Security And Compliance Alert Triggered",
|
|
"O365 Service Principal New Client Credentials",
|
|
"O365 Service Principal Privilege Escalation",
|
|
"O365 Set Company Information.",
|
|
"O365 Set-Mailbox",
|
|
"O365 SharePoint Allowed Domains Policy Changed",
|
|
"O365 SharePoint Malware Detection",
|
|
"O365 SharePoint Suspicious Search Behavior",
|
|
"O365 Tenant Wide Admin Consent Granted",
|
|
"O365 Threat Intelligence Suspicious Email Delivered",
|
|
"O365 Threat Intelligence Suspicious File Detected",
|
|
"O365 Update application.",
|
|
"O365 Update authorization policy.",
|
|
"O365 Update user.",
|
|
"O365 User Consent Blocked for Risky Application",
|
|
"O365 User Consent Denied for OAuth Application",
|
|
"O365 UserLoggedIn",
|
|
"O365 UserLoginFailed",
|
|
"O365 ZAP Activity Detection",
|
|
"Office 365 Account Takeover",
|
|
"Office 365 Collection Techniques",
|
|
"Office 365 Persistence Mechanisms",
|
|
"Office 365 Reporting Message Trace",
|
|
"Office 365 Universal Audit Log",
|
|
"Okta",
|
|
"Okta Account Takeover",
|
|
"Okta Authentication Failed During MFA Challenge",
|
|
"Okta IDP Lifecycle Modifications",
|
|
"Okta MFA Exhaustion",
|
|
"Okta MFA Exhaustion Hunt",
|
|
"Okta Mismatch Between Source and Response for Verify Push Request",
|
|
"Okta Multi-Factor Authentication Disabled",
|
|
"Okta Multiple Accounts Locked Out",
|
|
"Okta Multiple Failed MFA Requests For User",
|
|
"Okta Multiple Failed Requests to Access Applications",
|
|
"Okta Multiple Users Failing To Authenticate From Ip",
|
|
"Okta New API Token Created",
|
|
"Okta New Device Enrolled on Account",
|
|
"Okta Non-Standard VPN Usage",
|
|
"Okta Phishing Detection with FastPass Origin Check",
|
|
"Okta Risk Threshold Exceeded",
|
|
"Okta Successful Single Factor Authentication",
|
|
"Okta Suspicious Activity Reported",
|
|
"Okta Suspicious Use of a Session Cookie",
|
|
"Okta ThreatInsight Threat Detected",
|
|
"Okta Unauthorized Access to Application",
|
|
"Okta User Logins from Multiple Cities",
|
|
"Ollama Abnormal Network Connectivity",
|
|
"Ollama Abnormal Service Crash Availability Attack",
|
|
"Ollama Excessive API Requests",
|
|
"Ollama Possible API Endpoint Scan Reconnaissance",
|
|
"Ollama Possible Memory Exhaustion Resource Abuse",
|
|
"Ollama Possible Model Exfiltration Data Leakage",
|
|
"Ollama Possible RCE via Model Loading",
|
|
"Ollama Server",
|
|
"Ollama Suspicious Prompt Injection Jailbreak",
|
|
"OpenSSL CVE-2022-3602",
|
|
"Oracle E-Business Suite Exploitation",
|
|
"Orangeworm Attack Group",
|
|
"Osquery Results",
|
|
"Outbound Network Connection from Java Using Default Ports",
|
|
"Outlook RCE CVE-2024-21378",
|
|
"Overwriting Accessibility Binaries",
|
|
"PHP-CGI RCE Attack on Japanese Organizations",
|
|
"PXA Stealer",
|
|
"Palo Alto Network Threat",
|
|
"Palo Alto Network Traffic",
|
|
"Panorama Outbound Traffic Filtering",
|
|
"PaperCut MF NG Vulnerability",
|
|
"PaperCut NG Remote Web Access Attempt",
|
|
"PaperCut NG Suspicious Behavior Debug Log",
|
|
"PathWiper",
|
|
"Permission Modification using Takeown App",
|
|
"PetitPotam NTLM Relay on Active Directory Certificate Services",
|
|
"PetitPotam Network Share Access Request",
|
|
"PetitPotam Suspicious Kerberos TGT Request",
|
|
"Phemedrone Stealer",
|
|
"PhishTank URL Reputation Analysis",
|
|
"Ping Sleep Batch Command",
|
|
"PingID",
|
|
"PingID Mismatch Auth Source and Verification Response",
|
|
"PingID Multiple Failed MFA Requests For User",
|
|
"PingID New MFA Method After Credential Reset",
|
|
"PingID New MFA Method Registered For User",
|
|
"Plain HTTP POST Exfiltrated Data",
|
|
"PlugX",
|
|
"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
|
|
"Possible Browser Pass View Parameter",
|
|
"Possible Lateral Movement PowerShell Spawn",
|
|
"Potential System Network Configuration Discovery Activity",
|
|
"Potential Telegram API Request Via CommandLine",
|
|
"Potential password in username",
|
|
"PowerShell - Connect To Internet With Hidden Window",
|
|
"PowerShell 4104 Hunting",
|
|
"PowerShell Domain Enumeration",
|
|
"PowerShell Enable PowerShell Remoting",
|
|
"PowerShell Environment Variable Execution",
|
|
"PowerShell Get LocalGroup Discovery",
|
|
"PowerShell Invoke CIMMethod CIMSession",
|
|
"PowerShell Invoke WmiExec Usage",
|
|
"PowerShell Loading DotNET into Memory via Reflection",
|
|
"PowerShell PInvoke Process Injection API Chain",
|
|
"PowerShell Script Block With URL Chain",
|
|
"PowerShell Start or Stop Service",
|
|
"PowerShell Start-BitsTransfer",
|
|
"PowerShell WebRequest Using Memory Stream",
|
|
"Powershell COM Hijacking InprocServer32 Modification",
|
|
"Powershell Creating Thread Mutex",
|
|
"Powershell Disable Security Monitoring",
|
|
"Powershell Enable SMB1Protocol Feature",
|
|
"Powershell Execute COM Object",
|
|
"Powershell Fileless Process Injection via GetProcAddress",
|
|
"Powershell Fileless Script Contains Base64 Encoded Content",
|
|
"Powershell Get LocalGroup Discovery with Script Block Logging",
|
|
"Powershell Installed IIS Modules",
|
|
"Powershell Load Module in Meterpreter",
|
|
"Powershell Processing Stream Of Data",
|
|
"Powershell Remote Services Add TrustedHost",
|
|
"Powershell Remote Thread To Known Windows Process",
|
|
"Powershell Remove Windows Defender Directory",
|
|
"Powershell SIP Inventory",
|
|
"Powershell Script Block Logging 4104",
|
|
"Powershell Using memory As Backing Store",
|
|
"Powershell Windows Defender Exclusion Commands",
|
|
"Prestige Ransomware",
|
|
"Prevent Automatic Repair Mode using Bcdedit",
|
|
"Previously Seen Cloud API Calls Per User Role - Initial",
|
|
"Previously Seen Cloud API Calls Per User Role - Update",
|
|
"Previously Seen Cloud Compute Creations By User - Initial",
|
|
"Previously Seen Cloud Compute Creations By User - Update",
|
|
"Previously Seen Cloud Compute Images - Initial",
|
|
"Previously Seen Cloud Compute Images - Update",
|
|
"Previously Seen Cloud Compute Instance Types - Initial",
|
|
"Previously Seen Cloud Compute Instance Types - Update",
|
|
"Previously Seen Cloud Instance Modifications By User - Initial",
|
|
"Previously Seen Cloud Instance Modifications By User - Update",
|
|
"Previously Seen Cloud Provisioning Activity Sources - Initial",
|
|
"Previously Seen Cloud Provisioning Activity Sources - Update",
|
|
"Previously Seen Cloud Regions - Initial",
|
|
"Previously Seen Cloud Regions - Update",
|
|
"Previously Seen Running Windows Services - Initial",
|
|
"Previously Seen Running Windows Services - Update",
|
|
"Previously Seen Users In CloudTrail - Update",
|
|
"Previously Seen Users in CloudTrail - Initial",
|
|
"Previously Seen Zoom Child Processes - Initial",
|
|
"Previously Seen Zoom Child Processes - Update",
|
|
"Previously seen S3 bucket access by remote IP",
|
|
"Previously seen command line arguments",
|
|
"Print Processor Registry Autostart",
|
|
"Print Spooler Adding A Printer Driver",
|
|
"Print Spooler Failed to Load a Plug-in",
|
|
"PrintNightmare CVE-2021-34527",
|
|
"Process Creating LNK file in Suspicious Location",
|
|
"Process Deleting Its Process File Path",
|
|
"Process Execution via WMI",
|
|
"Process Kill Base On File Path",
|
|
"Process Writing DynamicWrapperX",
|
|
"Processes Tapping Keyboard Events",
|
|
"Processes launching netsh",
|
|
"Prohibited Network Traffic Allowed",
|
|
"Prohibited Traffic Allowed or Protocol Mismatch",
|
|
"PromptFlux",
|
|
"PromptLock",
|
|
"Protocol or Port Mismatch",
|
|
"Protocols passing authentication in cleartext",
|
|
"ProxyNotShell",
|
|
"ProxyShell",
|
|
"ProxyShell ProxyNotShell Behavior Detected",
|
|
"Qakbot",
|
|
"Quasar RAT",
|
|
"QuietVault",
|
|
"RMM Software Tracking",
|
|
"Randomly Generated Scheduled Task Name",
|
|
"Randomly Generated Windows Service Name",
|
|
"Ransomware",
|
|
"Ransomware Cloud",
|
|
"Ransomware Investigate and Contain",
|
|
"Ransomware Notes bulk creation",
|
|
"React2Shell",
|
|
"Recon AVProduct Through Pwh or WMI",
|
|
"Recon Using WMI Class",
|
|
"Recursive Delete of Directory In Batch CMD",
|
|
"RedLine Stealer",
|
|
"Reg exe Manipulating Windows Services Registry Keys",
|
|
"Registry Keys Used For Persistence",
|
|
"Registry Keys Used For Privilege Escalation",
|
|
"Registry Keys for Creating SHIM Databases",
|
|
"Regsvr32 Silent and Install Param Dll Loading",
|
|
"Regsvr32 with Known Silent Switch Cmdline",
|
|
"Related Tickets Search Dispatch",
|
|
"Remcos",
|
|
"Remcos RAT File Creation in Remcos Folder",
|
|
"Remcos client registry install entry",
|
|
"Remote Desktop Network Traffic",
|
|
"Remote Desktop Process Running On System",
|
|
"Remote Employment Fraud",
|
|
"Remote Monitoring and Management Software",
|
|
"Remote Process Instantiation via DCOM and PowerShell",
|
|
"Remote Process Instantiation via DCOM and PowerShell Script Block",
|
|
"Remote Process Instantiation via WMI",
|
|
"Remote Process Instantiation via WMI and PowerShell",
|
|
"Remote Process Instantiation via WMI and PowerShell Script Block",
|
|
"Remote Process Instantiation via WinRM and PowerShell",
|
|
"Remote Process Instantiation via WinRM and PowerShell Script Block",
|
|
"Remote Process Instantiation via WinRM and Winrs",
|
|
"Remote System Discovery with Adsisearcher",
|
|
"Remote System Discovery with Dsquery",
|
|
"Remote System Discovery with Wmic",
|
|
"Remote WMI Command Attempt",
|
|
"Resize ShadowStorage volume",
|
|
"Reverse Network Proxy",
|
|
"Revil Common Exec Parameter",
|
|
"Revil Ransomware",
|
|
"Revil Registry Entry",
|
|
"Rhysida Ransomware",
|
|
"Risk Notable Block Indicators",
|
|
"Risk Notable Enrich",
|
|
"Risk Notable Import Data",
|
|
"Risk Notable Investigate",
|
|
"Risk Notable Merge Events",
|
|
"Risk Notable Mitigate",
|
|
"Risk Notable Preprocess",
|
|
"Risk Notable Protect Assets and Users",
|
|
"Risk Notable Review Indicators",
|
|
"Risk Notable Verdict",
|
|
"Risk Rule for Dev Sec Ops by Repository",
|
|
"Router and Infrastructure Security",
|
|
"Rubeus Command Line Parameters",
|
|
"Rubeus Kerberos Ticket Exports Through Winlogon Access",
|
|
"RunDLL Loading DLL By Ordinal",
|
|
"Runas Execution in CommandLine",
|
|
"Rundll32 Control RunDLL Hunt",
|
|
"Rundll32 Control RunDLL World Writable Directory",
|
|
"Rundll32 Create Remote Thread To A Process",
|
|
"Rundll32 CreateRemoteThread In Browser",
|
|
"Rundll32 DNSQuery",
|
|
"Rundll32 LockWorkStation",
|
|
"Rundll32 Process Creating Exe Dll Files",
|
|
"Rundll32 Shimcache Flush",
|
|
"Rundll32 with no Command Line Arguments with Network",
|
|
"Ryuk Ransomware",
|
|
"Ryuk Test Files Detected",
|
|
"Ryuk Wake on LAN Command",
|
|
"SAM Database File Access Attempt",
|
|
"SAP NetWeaver Exploitation",
|
|
"SAP NetWeaver Visual Composer Exploitation Attempt",
|
|
"SLUI RunAs Elevated",
|
|
"SLUI Spawning a Process",
|
|
"SMB Traffic Spike",
|
|
"SQL Injection",
|
|
"SQL Injection with Long URLs",
|
|
"SQL Server Abuse",
|
|
"SSL Certificates with Punycode",
|
|
"Salt Typhoon",
|
|
"SamSam Ransomware",
|
|
"Samsam Test File Write",
|
|
"Sandworm Tools",
|
|
"Sc exe Manipulating Windows Services",
|
|
"Scattered Lapsus$ Hunters",
|
|
"Scattered Spider",
|
|
"SchCache Change By App Connect And Create ADSI Object",
|
|
"Schedule Task with HTTP Command Arguments",
|
|
"Schedule Task with Rundll32 Command Trigger",
|
|
"Scheduled Task Creation on Remote Endpoint using At",
|
|
"Scheduled Task Deleted Or Created via CMD",
|
|
"Scheduled Task Initiation on Remote Endpoint",
|
|
"Scheduled Tasks",
|
|
"Schtasks Run Task On Demand",
|
|
"Schtasks scheduling job on remote system",
|
|
"Schtasks used for forcing a reboot",
|
|
"Screensaver Event Trigger Execution",
|
|
"Script Execution via WMI",
|
|
"Sdclt UAC Bypass",
|
|
"Sdelete Application Execution",
|
|
"SearchProtocolHost with no Command Line with Network",
|
|
"Seashell Blizzard",
|
|
"Secret Blizzard",
|
|
"SecretDumps Offline NTDS Dumping Tool",
|
|
"Security Solution Tampering",
|
|
"ServiceNow Related Tickets Search",
|
|
"ServicePrincipalNames Discovery with PowerShell",
|
|
"ServicePrincipalNames Discovery with SetSPN",
|
|
"Services Escalate Exe",
|
|
"Services LOLBAS Execution Process Spawn",
|
|
"SesameOp",
|
|
"Set Default PowerShell Execution Policy To Unrestricted or Bypass",
|
|
"Shai-Hulud 2 Exfiltration Artifact Files",
|
|
"Shai-Hulud Workflow File Creation or Modification",
|
|
"Shim Database File Creation",
|
|
"Shim Database Installation With Suspicious Parameters",
|
|
"Short Lived Scheduled Task",
|
|
"Short Lived Windows Accounts",
|
|
"ShrinkLocker",
|
|
"Signed Binary Proxy Execution InstallUtil",
|
|
"SilentCleanup UAC Bypass",
|
|
"Silver Sparrow",
|
|
"Single Letter Process On Endpoint",
|
|
"Snake Keylogger",
|
|
"Snake Malware",
|
|
"SnappyBee",
|
|
"Sneaky Active Directory Persistence Tricks",
|
|
"SolarWinds WHD RCE Post Exploitation",
|
|
"Spearphishing Attachments",
|
|
"Spike in File Writes",
|
|
"Splunk",
|
|
"Splunk AppDynamics Secure Application Alert",
|
|
"Splunk AppDynamics Secure Application Alerts",
|
|
"Splunk Attack Analyzer Dynamic Analysis",
|
|
"Splunk Automated Email Investigation",
|
|
"Splunk Common Information Model (CIM)",
|
|
"Splunk Identifier Activity Analysis",
|
|
"Splunk Message Identifier Activity Analysis",
|
|
"Splunk Notable Related Tickets Search",
|
|
"Splunk Stream HTTP",
|
|
"Splunk Stream IP",
|
|
"Splunk Stream TCP",
|
|
"Spoolsv Spawning Rundll32",
|
|
"Spoolsv Suspicious Loaded Modules",
|
|
"Spoolsv Suspicious Process Access",
|
|
"Spoolsv Writing a DLL",
|
|
"Spoolsv Writing a DLL - Sysmon",
|
|
"Spring4Shell CVE-2022-22965",
|
|
"Spring4Shell Payload URL Request",
|
|
"Sqlite Module In Temp Folder",
|
|
"Start Investigation",
|
|
"Steal or Forge Authentication Certificates Behavior Identified",
|
|
"StealC Stealer",
|
|
"Storm-0501 Ransomware",
|
|
"Storm-2460 CLFS Zero Day Exploitation",
|
|
"Subvert Trust Controls SIP and Trust Provider Hijacking",
|
|
"Sunburst Correlation DLL and Network Event",
|
|
"Supernova Webshell",
|
|
"Suricata",
|
|
"Suspicious AWS Login Activities",
|
|
"Suspicious AWS S3 Activities",
|
|
"Suspicious AWS Traffic",
|
|
"Suspicious Cisco Adaptive Security Appliance Activity",
|
|
"Suspicious Cloud Authentication Activities",
|
|
"Suspicious Cloud Instance Activities",
|
|
"Suspicious Cloud Provisioning Activities",
|
|
"Suspicious Cloud User Activities",
|
|
"Suspicious Command-Line Executions",
|
|
"Suspicious Compiled HTML Activity",
|
|
"Suspicious Computer Account Name Change",
|
|
"Suspicious Copy on System32",
|
|
"Suspicious Curl Network Connection",
|
|
"Suspicious DLLHost no Command Line Arguments",
|
|
"Suspicious DNS Traffic",
|
|
"Suspicious Email Attachment Extensions",
|
|
"Suspicious Emails",
|
|
"Suspicious GCP Storage Activities",
|
|
"Suspicious GPUpdate no Command Line Arguments",
|
|
"Suspicious IcedID Rundll32 Cmdline",
|
|
"Suspicious Image Creation In Appdata Folder",
|
|
"Suspicious Java Classes",
|
|
"Suspicious Kerberos Service Ticket Request",
|
|
"Suspicious Linux Discovery Commands",
|
|
"Suspicious Local LLM Frameworks",
|
|
"Suspicious MCP Activities",
|
|
"Suspicious MSBuild Rename",
|
|
"Suspicious MSBuild Spawn",
|
|
"Suspicious MSHTA Activity",
|
|
"Suspicious Microsoft 365 Copilot Activities",
|
|
"Suspicious Okta Activity",
|
|
"Suspicious Ollama Activities",
|
|
"Suspicious PlistBuddy Usage",
|
|
"Suspicious PlistBuddy Usage via OSquery",
|
|
"Suspicious Process DNS Query Known Abuse Web Services",
|
|
"Suspicious Process Executed From Container File",
|
|
"Suspicious Process With Discord DNS Query",
|
|
"Suspicious Reg exe Process",
|
|
"Suspicious Regsvcs Regasm Activity",
|
|
"Suspicious Regsvr32 Activity",
|
|
"Suspicious Regsvr32 Register Suspicious Path",
|
|
"Suspicious Rundll32 Activity",
|
|
"Suspicious Rundll32 PluginInit",
|
|
"Suspicious Rundll32 StartW",
|
|
"Suspicious Rundll32 dllregisterserver",
|
|
"Suspicious Rundll32 no Command Line Arguments",
|
|
"Suspicious SQLite3 LSQuarantine Behavior",
|
|
"Suspicious Scheduled Task from Public Directory",
|
|
"Suspicious SearchProtocolHost no Command Line Arguments",
|
|
"Suspicious Ticket Granting Ticket Request",
|
|
"Suspicious User Agents",
|
|
"Suspicious WAV file in Appdata Folder",
|
|
"Suspicious WMI Use",
|
|
"Suspicious Windows Registry Activities",
|
|
"Suspicious Zoom Child Processes",
|
|
"Suspicious microsoft workflow compiler rename",
|
|
"Suspicious microsoft workflow compiler usage",
|
|
"Suspicious msbuild path",
|
|
"Suspicious mshta child process",
|
|
"Suspicious mshta spawn",
|
|
"Suspicious wevtutil Usage",
|
|
"Suspicious writes to windows Recycle Bin",
|
|
"Svchost LOLBAS Execution Process Spawn",
|
|
"Swift Slicer",
|
|
"SysAid On-Prem Software CVE-2023-47246 Vulnerability",
|
|
"Sysmon EventID 1",
|
|
"Sysmon EventID 10",
|
|
"Sysmon EventID 11",
|
|
"Sysmon EventID 12",
|
|
"Sysmon EventID 13",
|
|
"Sysmon EventID 14",
|
|
"Sysmon EventID 15",
|
|
"Sysmon EventID 17",
|
|
"Sysmon EventID 18",
|
|
"Sysmon EventID 20",
|
|
"Sysmon EventID 21",
|
|
"Sysmon EventID 22",
|
|
"Sysmon EventID 23",
|
|
"Sysmon EventID 26",
|
|
"Sysmon EventID 29",
|
|
"Sysmon EventID 3",
|
|
"Sysmon EventID 5",
|
|
"Sysmon EventID 6",
|
|
"Sysmon EventID 7",
|
|
"Sysmon EventID 8",
|
|
"Sysmon EventID 9",
|
|
"Sysmon for Linux EventID 1",
|
|
"Sysmon for Linux EventID 11",
|
|
"System Info Gathering Using Dxdiag Application",
|
|
"System Information Discovery Detection",
|
|
"System Processes Run From Unexpected Locations",
|
|
"System User Discovery With Query",
|
|
"System User Discovery With Whoami",
|
|
"SystemBC",
|
|
"TOR Traffic",
|
|
"Telnetd CVE-2026-24061",
|
|
"Termite Ransomware",
|
|
"Text4Shell CVE-2022-42889",
|
|
"Threat Activity by Snort IDs",
|
|
"Threat Intel Investigate",
|
|
"Time Provider Persistence Registry",
|
|
"Tomcat Session Deserialization Attempt",
|
|
"Tomcat Session File Upload Attempt",
|
|
"Trickbot",
|
|
"Trickbot Named Pipe",
|
|
"TruSTAR Enrich Indicators",
|
|
"Trusted Developer Utilities Proxy Execution",
|
|
"Trusted Developer Utilities Proxy Execution MSBuild",
|
|
"Tuoni",
|
|
"UAC Bypass MMC Load Unsigned Dll",
|
|
"UAC Bypass With Colorui COM Object",
|
|
"URL Outbound Traffic Filtering Dispatch",
|
|
"USN Journal Deletion",
|
|
"Uninstall App Using MsiExec",
|
|
"Unknown Process Using The Kerberos Protocol",
|
|
"Unload Sysmon Filter Driver",
|
|
"Unloading AMSI via Reflection",
|
|
"Unusual Number of Computer Service Tickets Requested",
|
|
"Unusual Number of Kerberos Service Tickets Requested",
|
|
"Unusual Number of Remote Endpoint Authentication Events",
|
|
"Unusual Processes",
|
|
"Unusually Long Command Line",
|
|
"Unusually Long Content-Type Length",
|
|
"UrlScan IO Dynamic Analysis",
|
|
"Use of Cleartext Protocols",
|
|
"User Discovery With Env Vars PowerShell",
|
|
"User Discovery With Env Vars PowerShell Script Block",
|
|
"VIP Keylogger",
|
|
"VMWare Aria Operations Exploit Attempt",
|
|
"VMWare ESXi Syslog",
|
|
"VMware Aria Operations vRealize CVE-2023-20887",
|
|
"VMware ESXi AD Integration Authentication Bypass CVE-2024-37085",
|
|
"VMware Server Side Injection and Privilege Escalation",
|
|
"VMware Server Side Template Injection Hunt",
|
|
"VMware Workspace ONE Freemarker Server-side Template Injection",
|
|
"ValleyRAT",
|
|
"VanHelsing Ransomware",
|
|
"Vbscript Execution Using Wscript App",
|
|
"Verclsid CLSID Execution",
|
|
"VirusTotal V3 Dynamic Analysis",
|
|
"VirusTotal v3 Identifier Reputation Analysis",
|
|
"Void Manticore",
|
|
"VoidLink Cloud-Native Linux Malware",
|
|
"Volt Typhoon",
|
|
"WBAdmin Delete System Backups",
|
|
"WMI Permanent Event Subscription",
|
|
"WMI Permanent Event Subscription - Sysmon",
|
|
"WMI Recon Running Process Or Services",
|
|
"WMI Temporary Event Subscription",
|
|
"WMIC XSL Execution via URL",
|
|
"WS FTP Remote Code Execution",
|
|
"WS FTP Server Critical Vulnerabilities",
|
|
"WSReset UAC Bypass",
|
|
"Warzone RAT",
|
|
"Water Gamayun",
|
|
"Wbemprox COM Object Execution",
|
|
"Web JSP Request via URL",
|
|
"Web Remote ShellServlet Access",
|
|
"Web Servers Executing Suspicious Processes",
|
|
"Web Spring Cloud Function FunctionRouter",
|
|
"Web Spring4Shell HTTP Request Class Module",
|
|
"Web or Application Server Spawning a Shell",
|
|
"Wermgr Process Connecting To IP Check Web Services",
|
|
"Wermgr Process Create Executable File",
|
|
"Wermgr Process Spawned CMD Or Powershell Process",
|
|
"WhisperGate",
|
|
"WinDealer RAT",
|
|
"WinEvent Scheduled Task Created Within Public Path",
|
|
"WinEvent Scheduled Task Created to Spawn Shell",
|
|
"WinEvent Windows Task Scheduler Event Action Started",
|
|
"WinRAR Spawning Shell Application",
|
|
"WinRAR Spoofing Attack CVE-2023-38831",
|
|
"WinRM Spawning a Process",
|
|
"Windows .Key File Creation in Root Directory",
|
|
"Windows AD Abnormal Object Access Activity",
|
|
"Windows AD AdminSDHolder ACL Modified",
|
|
"Windows AD Cross Domain SID History Addition",
|
|
"Windows AD DCShadow Privileges ACL Addition",
|
|
"Windows AD DSRM Account Changes",
|
|
"Windows AD DSRM Password Reset",
|
|
"Windows AD Dangerous Deny ACL Modification",
|
|
"Windows AD Dangerous Group ACL Modification",
|
|
"Windows AD Dangerous User ACL Modification",
|
|
"Windows AD Domain Controller Audit Policy Disabled",
|
|
"Windows AD Domain Controller Promotion",
|
|
"Windows AD Domain Replication ACL Addition",
|
|
"Windows AD Domain Root ACL Deletion",
|
|
"Windows AD Domain Root ACL Modification",
|
|
"Windows AD GPO Deleted",
|
|
"Windows AD GPO Disabled",
|
|
"Windows AD GPO New CSE Addition",
|
|
"Windows AD Hidden OU Creation",
|
|
"Windows AD Object Owner Updated",
|
|
"Windows AD Privileged Account SID History Addition",
|
|
"Windows AD Privileged Group Modification",
|
|
"Windows AD Privileged Object Access Activity",
|
|
"Windows AD Replication Request Initiated by User Account",
|
|
"Windows AD Replication Request Initiated from Unsanctioned Location",
|
|
"Windows AD Replication Service Traffic",
|
|
"Windows AD Rogue Domain Controller Network Activity",
|
|
"Windows AD SID History Attribute Modified",
|
|
"Windows AD Same Domain SID History Addition",
|
|
"Windows AD Self DACL Assignment",
|
|
"Windows AD ServicePrincipalName Added To Domain Account",
|
|
"Windows AD Short Lived Domain Account ServicePrincipalName",
|
|
"Windows AD Short Lived Domain Controller SPN Attribute",
|
|
"Windows AD Short Lived Server Object",
|
|
"Windows AD Suspicious Attribute Modification",
|
|
"Windows AD add Self to Group",
|
|
"Windows AI Platform DNS Query",
|
|
"Windows Abused Web Services",
|
|
"Windows Access Token Manipulation SeDebugPrivilege",
|
|
"Windows Access Token Manipulation Winlogon Duplicate Token Handle",
|
|
"Windows Access Token Winlogon Duplicate Handle In Uncommon Path",
|
|
"Windows Account Access Removal via Logoff Exec",
|
|
"Windows Account Discovery With NetUser PreauthNotRequire",
|
|
"Windows Account Discovery for None Disable User Account",
|
|
"Windows Account Discovery for Sam Account Name",
|
|
"Windows Active Directory Admon",
|
|
"Windows AdFind Exe",
|
|
"Windows Admin Permission Discovery",
|
|
"Windows Administrative Shares Accessed On Multiple Hosts",
|
|
"Windows Admon Default Group Policy Object Modified",
|
|
"Windows Admon Group Policy Object Created",
|
|
"Windows Advanced Installer MSIX with AI_STUBS Execution",
|
|
"Windows Alternate DataStream - Base64 Content",
|
|
"Windows Alternate DataStream - Executable Content",
|
|
"Windows Alternate DataStream - Process Execution",
|
|
"Windows Anomalous Registry Value Length in Environment Key",
|
|
"Windows Anonymous Pipe Activity",
|
|
"Windows Apache Benchmark Binary",
|
|
"Windows App Layer Protocol Qakbot NamedPipe",
|
|
"Windows App Layer Protocol Wermgr Connect To NamedPipe",
|
|
"Windows AppCertDLL Modification Via Command Line",
|
|
"Windows AppLocker",
|
|
"Windows AppLocker Block Events",
|
|
"Windows AppLocker Execution from Uncommon Locations",
|
|
"Windows AppLocker Privilege Escalation via Unauthorized Bypass",
|
|
"Windows AppLocker Rare Application Launch Detection",
|
|
"Windows AppX Deployment Full Trust Package Installation",
|
|
"Windows AppX Deployment Package Installation Success",
|
|
"Windows AppX Deployment Unsigned Package Installation",
|
|
"Windows Application Layer Protocol RMS Radmin Tool Namedpipe",
|
|
"Windows Application Whitelisting Bypass Attempt via Rundll32",
|
|
"Windows Archive Collected Data via Powershell",
|
|
"Windows Archive Collected Data via Rar",
|
|
"Windows Archived Collected Data In TEMP Folder",
|
|
"Windows Attack Surface Reduction",
|
|
"Windows Attempt To Stop Security Service",
|
|
"Windows Audit Policy Auditing Option Disabled via Auditpol",
|
|
"Windows Audit Policy Auditing Option Modified - Registry",
|
|
"Windows Audit Policy Cleared via Auditpol",
|
|
"Windows Audit Policy Disabled via Auditpol",
|
|
"Windows Audit Policy Disabled via Legacy Auditpol",
|
|
"Windows Audit Policy Excluded Category via Auditpol",
|
|
"Windows Audit Policy Restored via Auditpol",
|
|
"Windows Audit Policy Security Descriptor Tampering via Auditpol",
|
|
"Windows Audit Policy Tampering",
|
|
"Windows AutoIt3 Execution",
|
|
"Windows Autostart Execution LSASS Driver Registry Modification",
|
|
"Windows Azure PowerShell Module Installation Via PowerShell Script",
|
|
"Windows Azure Storage Utility Execution Via CLI",
|
|
"Windows Binary Execution from an Archive",
|
|
"Windows Binary Proxy Execution Mavinject DLL Injection",
|
|
"Windows BitDefender Submission Wizard DLL Sideloading",
|
|
"Windows BitLocker Suspicious Command Usage",
|
|
"Windows BitLockerToGo Process Execution",
|
|
"Windows BitLockerToGo with Network Activity",
|
|
"Windows Bluetooth Service Installed From Uncommon Location",
|
|
"Windows Boot or Logon Autostart Execution In Startup Folder",
|
|
"Windows BootKits",
|
|
"Windows BootLoader Inventory",
|
|
"Windows Browser Process Launched with Unusual Flags",
|
|
"Windows Bypass UAC via Pkgmgr Tool",
|
|
"Windows CAB File on Disk",
|
|
"Windows COM Hijacking InprocServer32 Modification",
|
|
"Windows Cabinet File Extraction Via Expand",
|
|
"Windows Cached Domain Credentials Reg Query",
|
|
"Windows Certificate Services",
|
|
"Windows Certutil Root Certificate Addition",
|
|
"Windows Change File Association Command To Notepad",
|
|
"Windows Chrome Auto-Update Disabled via Registry",
|
|
"Windows Chrome Enable Extension Loading via Command-Line",
|
|
"Windows Chrome Extension Allowed Registry Modification",
|
|
"Windows Chromium Browser Launched with Small Window Size",
|
|
"Windows Chromium Browser No Security Sandbox Process",
|
|
"Windows Chromium Browser with Custom User Data Directory",
|
|
"Windows Chromium Process Launched with Logging Disabled",
|
|
"Windows Chromium Process Loaded Extension via Command-Line",
|
|
"Windows Chromium Process with Disabled Extensions",
|
|
"Windows Chromium process Launched with Disable Popup Blocking",
|
|
"Windows Cisco Secure Endpoint Related Service Stopped",
|
|
"Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc",
|
|
"Windows Cisco Secure Endpoint Unblock File Via Sfc",
|
|
"Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc",
|
|
"Windows ClipBoard Data via Get-ClipBoard",
|
|
"Windows Cmdline Tool Execution From Non-Shell Process",
|
|
"Windows Cobalt Strike PowerShell Loader",
|
|
"Windows Command Obfuscation with Environment Variable Substrings",
|
|
"Windows Command Shell DCRat ForkBomb Payload",
|
|
"Windows Command and Scripting Interpreter Hunting Path Traversal",
|
|
"Windows Command and Scripting Interpreter Path Traversal Exec",
|
|
"Windows Common Abused Cmd Shell Risk Behavior",
|
|
"Windows Compatibility Telemetry Suspicious Child Process",
|
|
"Windows Compatibility Telemetry Tampering Through Registry",
|
|
"Windows Computer Account Changed to Domain Controller",
|
|
"Windows Computer Account Created by Computer Account",
|
|
"Windows Computer Account Requesting Kerberos Ticket",
|
|
"Windows Computer Account With SPN",
|
|
"Windows ComputerDefaults Spawning a Process",
|
|
"Windows ConHost with Headless Argument",
|
|
"Windows ConsoleHost History File Deletion",
|
|
"Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script",
|
|
"Windows Create Local Account",
|
|
"Windows Create Local Administrator Account Via Net",
|
|
"Windows Credential Access From Browser Password Store",
|
|
"Windows Credential Dumping LSASS Memory Createdump",
|
|
"Windows Credential Target Information Structure in Commandline",
|
|
"Windows Credentials Access via VaultCli Module",
|
|
"Windows Credentials from Password Stores Chrome Copied in TEMP Dir",
|
|
"Windows Credentials from Password Stores Chrome Extension Access",
|
|
"Windows Credentials from Password Stores Chrome LocalState Access",
|
|
"Windows Credentials from Password Stores Chrome Login Data Access",
|
|
"Windows Credentials from Password Stores Creation",
|
|
"Windows Credentials from Password Stores Deletion",
|
|
"Windows Credentials from Password Stores Query",
|
|
"Windows Credentials from Web Browsers Saved in TEMP Folder",
|
|
"Windows Credentials in Registry Reg Query",
|
|
"Windows CrowdStrike Agent Registry Key Removal",
|
|
"Windows Crowdstrike RTR Script Execution",
|
|
"Windows Curl Download to Suspicious Path",
|
|
"Windows Curl Upload to Remote Destination",
|
|
"Windows DISM Install PowerShell Web Access",
|
|
"Windows DISM Remove Defender",
|
|
"Windows DLL Module Loaded in Temp Dir",
|
|
"Windows DLL Search Order Hijacking Hunt with Sysmon",
|
|
"Windows DLL Search Order Hijacking with iscsicpl",
|
|
"Windows DLL Side-Loading In Calc",
|
|
"Windows DLL Side-Loading Process Child Of Calc",
|
|
"Windows DNS Gather Network Info",
|
|
"Windows DNS Query Request To TinyUrl",
|
|
"Windows DNS Query Request by Telegram Bot API",
|
|
"Windows DNS SIGRed CVE-2020-1350",
|
|
"Windows Data Destruction Recursive Exec Files Deletion",
|
|
"Windows Debugger Tool Execution",
|
|
"Windows Defacement Modify Transcodedwallpaper File",
|
|
"Windows Default Cobalt Strike PowerShell Beacon",
|
|
"Windows Default Group Policy Object Modified",
|
|
"Windows Default Group Policy Object Modified with GPME",
|
|
"Windows Default RDP File Creation By Non MSTSC Process",
|
|
"Windows Default Rdp File Deletion",
|
|
"Windows Default Rdp File Unhidden",
|
|
"Windows Defender ASR Audit Events",
|
|
"Windows Defender ASR Block Events",
|
|
"Windows Defender ASR Registry Modification",
|
|
"Windows Defender ASR Rule Disabled",
|
|
"Windows Defender ASR Rules Stacking",
|
|
"Windows Defender ASR or Threat Configuration Tamper",
|
|
"Windows Defender ATP Identifier Activity Analysis",
|
|
"Windows Defender Alerts",
|
|
"Windows Defender Exclusion Registry Entry",
|
|
"Windows Defense Evasion Tactics",
|
|
"Windows Delete or Modify System Firewall",
|
|
"Windows Deleted Registry By A Non Critical Process File Path",
|
|
"Windows Detect Network Scanner Behavior",
|
|
"Windows Developer-Signed MSIX Package Installation",
|
|
"Windows Devtunnels Execution",
|
|
"Windows Devtunnels Image Loaded",
|
|
"Windows Disable Change Password Through Registry",
|
|
"Windows Disable Internet Explorer Addons",
|
|
"Windows Disable Lock Workstation Feature Through Registry",
|
|
"Windows Disable LogOff Button Through Registry",
|
|
"Windows Disable Memory Crash Dump",
|
|
"Windows Disable Notification Center",
|
|
"Windows Disable Shutdown Button Through Registry",
|
|
"Windows Disable Windows Event Logging Disable HTTP Logging",
|
|
"Windows Disable Windows Group Policy Features Through Registry",
|
|
"Windows Disable or Modify Tools Via Taskkill",
|
|
"Windows Disable or Stop Browser Process",
|
|
"Windows DisableAntiSpyware Registry",
|
|
"Windows Discovery Techniques",
|
|
"Windows DiskCryptor Usage",
|
|
"Windows Diskshadow Proxy Execution",
|
|
"Windows DnsAdmins New Member Added",
|
|
"Windows Domain Account Discovery Via Get-NetComputer",
|
|
"Windows Domain Admin Impersonation Indicator",
|
|
"Windows DotNet Binary in Non Standard Path",
|
|
"Windows Downdate Registry Activity",
|
|
"Windows Driver Inventory",
|
|
"Windows Driver Load Non-Standard Path",
|
|
"Windows Drivers",
|
|
"Windows Drivers Loaded by Signature",
|
|
"Windows EDRSilencer Execution",
|
|
"Windows EFI Bootloader File Modification",
|
|
"Windows EFI Volume Mount Attempt Via Mountvol",
|
|
"Windows ESX Admins Group Creation Security Event",
|
|
"Windows ESX Admins Group Creation via Net",
|
|
"Windows ESX Admins Group Creation via PowerShell",
|
|
"Windows Enable PowerShell Web Access",
|
|
"Windows Enable Win32 ScheduledJob via Registry",
|
|
"Windows Entra User Management Via Azure CLI",
|
|
"Windows Error Reporting Service Elevation of Privilege Vulnerability",
|
|
"Windows Event For Service Disabled",
|
|
"Windows Event Log AppXDeployment-Server 400",
|
|
"Windows Event Log AppXDeployment-Server 854",
|
|
"Windows Event Log AppXDeployment-Server 855",
|
|
"Windows Event Log AppXPackaging 171",
|
|
"Windows Event Log Application 15457",
|
|
"Windows Event Log Application 17135",
|
|
"Windows Event Log Application 2282",
|
|
"Windows Event Log Application 3000",
|
|
"Windows Event Log Application 8128",
|
|
"Windows Event Log CAPI2 70",
|
|
"Windows Event Log CAPI2 81",
|
|
"Windows Event Log CertificateServicesClient 1007",
|
|
"Windows Event Log Cleared",
|
|
"Windows Event Log Defender 1121",
|
|
"Windows Event Log Defender 1122",
|
|
"Windows Event Log Defender 1125",
|
|
"Windows Event Log Defender 1126",
|
|
"Windows Event Log Defender 1129",
|
|
"Windows Event Log Defender 1131",
|
|
"Windows Event Log Defender 1132",
|
|
"Windows Event Log Defender 1133",
|
|
"Windows Event Log Defender 1134",
|
|
"Windows Event Log Defender 5007",
|
|
"Windows Event Log Microsoft Windows TerminalServices RDPClient 1024",
|
|
"Windows Event Log Printservice 316",
|
|
"Windows Event Log Printservice 4909",
|
|
"Windows Event Log Printservice 808",
|
|
"Windows Event Log RemoteConnectionManager 1149",
|
|
"Windows Event Log Security 1100",
|
|
"Windows Event Log Security 1102",
|
|
"Windows Event Log Security 4624",
|
|
"Windows Event Log Security 4625",
|
|
"Windows Event Log Security 4627",
|
|
"Windows Event Log Security 4648",
|
|
"Windows Event Log Security 4662",
|
|
"Windows Event Log Security 4663",
|
|
"Windows Event Log Security 4672",
|
|
"Windows Event Log Security 4688",
|
|
"Windows Event Log Security 4698",
|
|
"Windows Event Log Security 4699",
|
|
"Windows Event Log Security 4700",
|
|
"Windows Event Log Security 4702",
|
|
"Windows Event Log Security 4703",
|
|
"Windows Event Log Security 4719",
|
|
"Windows Event Log Security 4720",
|
|
"Windows Event Log Security 4724",
|
|
"Windows Event Log Security 4725",
|
|
"Windows Event Log Security 4726",
|
|
"Windows Event Log Security 4727",
|
|
"Windows Event Log Security 4728",
|
|
"Windows Event Log Security 4730",
|
|
"Windows Event Log Security 4731",
|
|
"Windows Event Log Security 4732",
|
|
"Windows Event Log Security 4737",
|
|
"Windows Event Log Security 4738",
|
|
"Windows Event Log Security 4739",
|
|
"Windows Event Log Security 4741",
|
|
"Windows Event Log Security 4742",
|
|
"Windows Event Log Security 4744",
|
|
"Windows Event Log Security 4749",
|
|
"Windows Event Log Security 4754",
|
|
"Windows Event Log Security 4756",
|
|
"Windows Event Log Security 4759",
|
|
"Windows Event Log Security 4768",
|
|
"Windows Event Log Security 4769",
|
|
"Windows Event Log Security 4771",
|
|
"Windows Event Log Security 4776",
|
|
"Windows Event Log Security 4781",
|
|
"Windows Event Log Security 4783",
|
|
"Windows Event Log Security 4790",
|
|
"Windows Event Log Security 4794",
|
|
"Windows Event Log Security 4798",
|
|
"Windows Event Log Security 4876",
|
|
"Windows Event Log Security 4886",
|
|
"Windows Event Log Security 4887",
|
|
"Windows Event Log Security 4946",
|
|
"Windows Event Log Security 4947",
|
|
"Windows Event Log Security 4948",
|
|
"Windows Event Log Security 5136",
|
|
"Windows Event Log Security 5137",
|
|
"Windows Event Log Security 5140",
|
|
"Windows Event Log Security 5141",
|
|
"Windows Event Log Security 5145",
|
|
"Windows Event Log System 104",
|
|
"Windows Event Log System 4720",
|
|
"Windows Event Log System 4726",
|
|
"Windows Event Log System 4728",
|
|
"Windows Event Log System 7036",
|
|
"Windows Event Log System 7040",
|
|
"Windows Event Log System 7045",
|
|
"Windows Event Log TaskScheduler 200",
|
|
"Windows Event Log TaskScheduler 201",
|
|
"Windows Event Logging Service Has Shutdown",
|
|
"Windows Event Triggered Image File Execution Options Injection",
|
|
"Windows EventLog Recon Activity Using Log Query Utilities",
|
|
"Windows Eventlog Cleared Via Wevtutil",
|
|
"Windows Excel Spawning Microsoft Project Application",
|
|
"Windows Excessive Disabled Services Event",
|
|
"Windows Excessive Service Stop Attempt",
|
|
"Windows Excessive Usage Of Net App",
|
|
"Windows Exchange Autodiscover SSRF Abuse",
|
|
"Windows Executable Masquerading as Benign File Types",
|
|
"Windows Executable in Loaded Modules",
|
|
"Windows Execute Arbitrary Commands with MSDT",
|
|
"Windows Execution of Microsoft MSC File In Suspicious Path",
|
|
"Windows Exfiltration Over C2 Via Invoke RestMethod",
|
|
"Windows Exfiltration Over C2 Via Powershell UploadString",
|
|
"Windows Explorer LNK Exploit Process Launch With Padding",
|
|
"Windows Explorer.exe Spawning PowerShell or Cmd",
|
|
"Windows Export Certificate",
|
|
"Windows File Association Modification via Ftype",
|
|
"Windows File Collection Via Copy Utilities",
|
|
"Windows File Download Via CertUtil",
|
|
"Windows File Download Via PowerShell",
|
|
"Windows File Extension and Association Abuse",
|
|
"Windows File Share Discovery With Powerview",
|
|
"Windows File Transfer Protocol In Non-Common Process Path",
|
|
"Windows File Without Extension In Critical Folder",
|
|
"Windows File and Directory Enable ReadOnly Permissions",
|
|
"Windows File and Directory Permissions Enable Inheritance",
|
|
"Windows File and Directory Permissions Remove Inheritance",
|
|
"Windows Files and Dirs Access Rights Modification Via Icacls",
|
|
"Windows Filtering Platform Policy Added to Block EDR Process",
|
|
"Windows Find Domain Organizational Units with GetDomainOU",
|
|
"Windows Find Interesting ACL with FindInterestingDomainAcl",
|
|
"Windows Findstr GPP Discovery",
|
|
"Windows Firewall Rule Added",
|
|
"Windows Firewall Rule Deletion",
|
|
"Windows Firewall Rule Modification",
|
|
"Windows Forest Discovery with GetForestDomain",
|
|
"Windows Gather Victim Host Information Camera",
|
|
"Windows Gather Victim Identity SAM Info",
|
|
"Windows Gather Victim Network Info Through Ip Check Web Services",
|
|
"Windows Gdrive Binary Activity",
|
|
"Windows Get Local Admin with FindLocalAdminAccess",
|
|
"Windows Get-AdComputer Unconstrained Delegation Discovery",
|
|
"Windows Get-Variable.EXE Execution from WindowsApps Folder",
|
|
"Windows Global Object Access Audit List Cleared Via Auditpol",
|
|
"Windows GrimResource - MMC Process Accessing APDS DLL",
|
|
"Windows Group Discovery Via Net",
|
|
"Windows Group Policy Object Created",
|
|
"Windows Guest Account Enabled Via Net.EXE",
|
|
"Windows HTTP Network Communication From MSIExec",
|
|
"Windows Handle Duplication in Known UAC-Bypass Binaries",
|
|
"Windows Hidden Schedule Task Settings",
|
|
"Windows Hide Notification Features Through Registry",
|
|
"Windows High File Deletion Frequency",
|
|
"Windows Hijack Execution Flow Version Dll Side Load",
|
|
"Windows Hosts File Access",
|
|
"Windows Hunting System Account Targeting Lsass",
|
|
"Windows IIS",
|
|
"Windows IIS 29",
|
|
"Windows IIS Components Add New Module",
|
|
"Windows IIS Components Get-WebGlobalModule Module Query",
|
|
"Windows IIS Components Module Failed to Load",
|
|
"Windows IIS Components New Module Added",
|
|
"Windows IIS Server PSWA Console Access",
|
|
"Windows IOBit Unlocker Extension DLL Registration via Regsvr32",
|
|
"Windows ISO LNK File Creation",
|
|
"Windows Identify PowerShell Web Access IIS Pool",
|
|
"Windows Identify Protocol Handlers",
|
|
"Windows Impair Defense Add Xml Applocker Rules",
|
|
"Windows Impair Defense Change Win Defender Health Check Intervals",
|
|
"Windows Impair Defense Change Win Defender Quick Scan Interval",
|
|
"Windows Impair Defense Change Win Defender Throttle Rate",
|
|
"Windows Impair Defense Change Win Defender Tracing Level",
|
|
"Windows Impair Defense Configure App Install Control",
|
|
"Windows Impair Defense Define Win Defender Threat Action",
|
|
"Windows Impair Defense Delete Win Defender Context Menu",
|
|
"Windows Impair Defense Delete Win Defender Profile Registry",
|
|
"Windows Impair Defense Deny Security Software With Applocker",
|
|
"Windows Impair Defense Disable Controlled Folder Access",
|
|
"Windows Impair Defense Disable Defender Firewall And Network",
|
|
"Windows Impair Defense Disable Defender Protocol Recognition",
|
|
"Windows Impair Defense Disable PUA Protection",
|
|
"Windows Impair Defense Disable Realtime Signature Delivery",
|
|
"Windows Impair Defense Disable Web Evaluation",
|
|
"Windows Impair Defense Disable Win Defender App Guard",
|
|
"Windows Impair Defense Disable Win Defender Compute File Hashes",
|
|
"Windows Impair Defense Disable Win Defender Gen reports",
|
|
"Windows Impair Defense Disable Win Defender Network Protection",
|
|
"Windows Impair Defense Disable Win Defender Report Infection",
|
|
"Windows Impair Defense Disable Win Defender Scan On Update",
|
|
"Windows Impair Defense Disable Win Defender Signature Retirement",
|
|
"Windows Impair Defense Overide Win Defender Phishing Filter",
|
|
"Windows Impair Defense Override SmartScreen Prompt",
|
|
"Windows Impair Defense Set Win Defender Smart Screen Level To Warn",
|
|
"Windows Impair Defenses Disable AV AutoStart via Registry",
|
|
"Windows Impair Defenses Disable Auto Logger Session",
|
|
"Windows Impair Defenses Disable HVCI",
|
|
"Windows Impair Defenses Disable Win Defender Auto Logging",
|
|
"Windows Important Audit Policy Disabled",
|
|
"Windows InProcServer32 New Outlook Form",
|
|
"Windows Increase in Group or Object Modification Activity",
|
|
"Windows Increase in User Modification Activity",
|
|
"Windows Indicator Removal Via Rmdir",
|
|
"Windows Indirect Command Execution Via Series Of Forfiles",
|
|
"Windows Indirect Command Execution Via forfiles",
|
|
"Windows Indirect Command Execution Via pcalua",
|
|
"Windows Information Discovery Fsutil",
|
|
"Windows Ingress Tool Transfer Using Explorer",
|
|
"Windows Input Capture Using Credential UI Dll",
|
|
"Windows InstallUtil Credential Theft",
|
|
"Windows InstallUtil Remote Network Connection",
|
|
"Windows InstallUtil URL in Command Line",
|
|
"Windows InstallUtil Uninstall Option",
|
|
"Windows InstallUtil in Non Standard Path",
|
|
"Windows Kerberos Coercion via DNS",
|
|
"Windows Kerberos Local Successful Logon",
|
|
"Windows Known Abused DLL Created",
|
|
"Windows Known Abused DLL Loaded Suspiciously",
|
|
"Windows Known GraphicalProton Loaded Modules",
|
|
"Windows KrbRelayUp Service Creation",
|
|
"Windows LAPS Password Gathering Via PowerShell Script",
|
|
"Windows LOLBAS Executed As Renamed File",
|
|
"Windows LOLBAS Executed Outside Expected Path",
|
|
"Windows LSA Secrets NoLMhash Registry",
|
|
"Windows Large Number of Computer Service Tickets Requested",
|
|
"Windows Ldifde Directory Object Behavior",
|
|
"Windows Level RMM PowerShell Script Installer",
|
|
"Windows Level RMM Watchdog Task Created",
|
|
"Windows Linked Policies In ADSI Discovery",
|
|
"Windows List ENV Variables Via SET Command From Uncommon Parent",
|
|
"Windows Local Administrator Credential Stuffing",
|
|
"Windows Local LLM Framework Execution",
|
|
"Windows Log Manipulation",
|
|
"Windows MMC Loaded Script Engine DLL",
|
|
"Windows MOF Event Triggered Execution via WMI",
|
|
"Windows MOVEit Transfer Writing ASPX",
|
|
"Windows MSC EvilTwin Directory Path Manipulation",
|
|
"Windows MSExchange Management Mailbox Cmdlet Usage",
|
|
"Windows MSHTA Writing to World Writable Path",
|
|
"Windows MSI Rollback Script Deleted By Non-Msiexec Process",
|
|
"Windows MSIExec DLLRegisterServer",
|
|
"Windows MSIExec Remote Download",
|
|
"Windows MSIExec Spawn Discovery Command",
|
|
"Windows MSIExec Spawn WinDBG",
|
|
"Windows MSIExec Unregister DLLRegisterServer",
|
|
"Windows MSIX Package Interaction",
|
|
"Windows MSTSC RDP Commandline",
|
|
"Windows Mail Protocol In Non-Common Process Path",
|
|
"Windows Mark Of The Web Bypass",
|
|
"Windows Masquerading Explorer As Child Process",
|
|
"Windows Masquerading Msdtc Process",
|
|
"Windows Metasploit Confluence Plugin Execution",
|
|
"Windows Mimikatz Binary Execution",
|
|
"Windows Mimikatz Crypto Export File Extensions",
|
|
"Windows Mock Trusted Directory MSC File Creation",
|
|
"Windows Modify Registry AuthenticationLevelOverride",
|
|
"Windows Modify Registry Auto Minor Updates",
|
|
"Windows Modify Registry Auto Update Notif",
|
|
"Windows Modify Registry Configure BitLocker",
|
|
"Windows Modify Registry Default Icon Setting",
|
|
"Windows Modify Registry Delete Firewall Rules",
|
|
"Windows Modify Registry DisAllow Windows App",
|
|
"Windows Modify Registry Disable RDP",
|
|
"Windows Modify Registry Disable Restricted Admin",
|
|
"Windows Modify Registry Disable Toast Notifications",
|
|
"Windows Modify Registry Disable Win Defender Raw Write Notif",
|
|
"Windows Modify Registry Disable WinDefender Notifications",
|
|
"Windows Modify Registry Disable Windows Security Center Notif",
|
|
"Windows Modify Registry DisableRemoteDesktopAntiAlias",
|
|
"Windows Modify Registry DisableSecuritySettings",
|
|
"Windows Modify Registry Disabling WER Settings",
|
|
"Windows Modify Registry Do Not Connect To Win Update",
|
|
"Windows Modify Registry DontShowUI",
|
|
"Windows Modify Registry EnableLinkedConnections",
|
|
"Windows Modify Registry LongPathsEnabled",
|
|
"Windows Modify Registry MaxConnectionPerServer",
|
|
"Windows Modify Registry No Auto Reboot With Logon User",
|
|
"Windows Modify Registry No Auto Update",
|
|
"Windows Modify Registry NoChangingWallPaper",
|
|
"Windows Modify Registry ProxyEnable",
|
|
"Windows Modify Registry ProxyServer",
|
|
"Windows Modify Registry Qakbot Binary Data Registry",
|
|
"Windows Modify Registry Regedit Silent Reg Import",
|
|
"Windows Modify Registry Risk Behavior",
|
|
"Windows Modify Registry Suppress Win Defender Notif",
|
|
"Windows Modify Registry Tamper Protection",
|
|
"Windows Modify Registry USeWuServer",
|
|
"Windows Modify Registry UpdateServiceUrlAlternate",
|
|
"Windows Modify Registry Utilize ProgIDs",
|
|
"Windows Modify Registry ValleyRAT C2 Config",
|
|
"Windows Modify Registry ValleyRat PWN Reg Entry",
|
|
"Windows Modify Registry With MD5 Reg Key Name",
|
|
"Windows Modify Registry WuServer",
|
|
"Windows Modify Registry on Smart Card Group Policy",
|
|
"Windows Modify Registry to Add or Modify Firewall Rule",
|
|
"Windows Modify Registry wuStatusServer",
|
|
"Windows Modify Show Compress Color And Info Tip Registry",
|
|
"Windows Modify System Firewall with Notable Process Path",
|
|
"Windows MpCmdRun RemoveDefinitions Execution",
|
|
"Windows Mshta Execution In Registry",
|
|
"Windows MsiExec HideWindow Rundll32 Execution",
|
|
"Windows Multi hop Proxy TOR Website Query",
|
|
"Windows Multiple Account Passwords Changed",
|
|
"Windows Multiple Accounts Deleted",
|
|
"Windows Multiple Accounts Disabled",
|
|
"Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos",
|
|
"Windows Multiple Invalid Users Fail To Authenticate Using Kerberos",
|
|
"Windows Multiple Invalid Users Failed To Authenticate Using NTLM",
|
|
"Windows Multiple NTLM Null Domain Authentications",
|
|
"Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials",
|
|
"Windows Multiple Users Failed To Authenticate From Host Using NTLM",
|
|
"Windows Multiple Users Failed To Authenticate From Process",
|
|
"Windows Multiple Users Failed To Authenticate Using Kerberos",
|
|
"Windows Multiple Users Remotely Failed To Authenticate From Host",
|
|
"Windows Mustang Panda USB Tool Execution",
|
|
"Windows Net System Service Discovery",
|
|
"Windows NetSupport RMM DLL Loaded By Uncommon Process",
|
|
"Windows Netspy Network Scanner Execution",
|
|
"Windows Network Connection Discovery Via Net",
|
|
"Windows Network Connection From Program In Suspect Location",
|
|
"Windows Network Share Interaction Via Net",
|
|
"Windows New Custom Security Descriptor Set On EventLog Channel",
|
|
"Windows New Default File Association Value Set",
|
|
"Windows New Deny Permission Set On Service SD Via Sc.EXE",
|
|
"Windows New EventLog ChannelAccess Registry Value Set",
|
|
"Windows New InProcServer32 Added",
|
|
"Windows New Service Security Descriptor Set Via Sc.EXE",
|
|
"Windows Ngrok Reverse Proxy Usage",
|
|
"Windows NirSoft AdvancedRun",
|
|
"Windows NirSoft Tool Bundle File Created",
|
|
"Windows NirSoft Utilities",
|
|
"Windows Njrat Fileless Storage via Registry",
|
|
"Windows Non Discord App Access Discord LevelDB",
|
|
"Windows Non-System Account Targeting Lsass",
|
|
"Windows NorthStar C2 Agent Execution",
|
|
"Windows Obfuscated Files or Information via RAR SFX",
|
|
"Windows Odbcconf Hunting",
|
|
"Windows Odbcconf Load DLL",
|
|
"Windows Odbcconf Load Response File",
|
|
"Windows Office Product Dropped Cab or Inf File",
|
|
"Windows Office Product Dropped Uncommon File",
|
|
"Windows Office Product Loaded MSHTML Module",
|
|
"Windows Office Product Loading Taskschd DLL",
|
|
"Windows Office Product Loading VBE7 DLL",
|
|
"Windows Office Product Spawned Child Process For Download",
|
|
"Windows Office Product Spawned Control",
|
|
"Windows Office Product Spawned MSDT",
|
|
"Windows Office Product Spawned Rundll32 With No DLL",
|
|
"Windows Office Product Spawned Uncommon Process",
|
|
"Windows OneDrive Share Mounted via Net",
|
|
"Windows Outlook Dialogs Disabled from Unusual Process",
|
|
"Windows Outlook LoadMacroProviderOnBoot Persistence",
|
|
"Windows Outlook Macro Created by Suspicious Process",
|
|
"Windows Outlook Macro Security Modified",
|
|
"Windows Outlook WebView Registry Modification",
|
|
"Windows PUA Named Pipe",
|
|
"Windows PaperCut NG Spawn Shell",
|
|
"Windows Parent PID Spoofing with Explorer",
|
|
"Windows Password Managers Discovery",
|
|
"Windows Password Policy Discovery with Net",
|
|
"Windows Persistence Techniques",
|
|
"Windows Phishing Outlook Drop Dll In FORM Dir",
|
|
"Windows Phishing PDF File Executes URL Link",
|
|
"Windows Phishing Recent ISO Exec Registry",
|
|
"Windows Possible Credential Dumping",
|
|
"Windows Post Exploitation Risk Behavior",
|
|
"Windows Post-Exploitation",
|
|
"Windows Potato Privilege Escalation Tool Execution",
|
|
"Windows Potential AppDomainManager Hijack Artifacts Creation",
|
|
"Windows Potential Cloudflared Network Connection",
|
|
"Windows Potential Cloudflared Tunnel Execution",
|
|
"Windows Potential Web Shell Creation For VMware Workspace ONE",
|
|
"Windows PowGoop Beacon Decoding",
|
|
"Windows PowerShell Add Module to Global Assembly Cache",
|
|
"Windows PowerShell Disable HTTP Logging",
|
|
"Windows PowerShell Export Certificate",
|
|
"Windows PowerShell Export PfxCertificate",
|
|
"Windows PowerShell FakeCAPTCHA Clipboard Execution",
|
|
"Windows PowerShell Get CIMInstance Remote Computer",
|
|
"Windows PowerShell IIS Components WebGlobalModule Usage",
|
|
"Windows PowerShell Invoke-RestMethod IP Information Collection",
|
|
"Windows PowerShell Invoke-Sqlcmd Execution",
|
|
"Windows PowerShell MSIX Package Installation",
|
|
"Windows PowerShell Module File Created",
|
|
"Windows PowerShell Process Implementing Manual Base64 Decoder",
|
|
"Windows PowerShell Process With Malicious String",
|
|
"Windows PowerShell ScheduleTask",
|
|
"Windows PowerShell Script Block With Malicious String",
|
|
"Windows PowerShell Script From WindowsApps Directory",
|
|
"Windows PowerShell Script TabExpansion Direct Call",
|
|
"Windows PowerShell WMI Win32 ScheduledJob",
|
|
"Windows PowerSploit GPP Discovery",
|
|
"Windows PowerView AD Access Control List Enumeration",
|
|
"Windows PowerView Constrained Delegation Discovery",
|
|
"Windows PowerView Kerberos Service Ticket Request",
|
|
"Windows PowerView SPN Discovery",
|
|
"Windows PowerView Unconstrained Delegation Discovery",
|
|
"Windows Powershell Cryptography Namespace",
|
|
"Windows Powershell History File Deletion",
|
|
"Windows Powershell Import Applocker Policy",
|
|
"Windows Powershell Logoff User via Quser",
|
|
"Windows Powershell RemoteSigned File",
|
|
"Windows Private Keys Discovery",
|
|
"Windows Privilege Escalation",
|
|
"Windows Privilege Escalation Attempt Via MSI Rollback",
|
|
"Windows Privilege Escalation Suspicious Process Elevation",
|
|
"Windows Privilege Escalation System Process Without System Parent",
|
|
"Windows Privilege Escalation User Process Spawn System Process",
|
|
"Windows Privileged Group Modification",
|
|
"Windows Process Accessing Windows Recall Directory",
|
|
"Windows Process Commandline Discovery",
|
|
"Windows Process Executed From Removable Media",
|
|
"Windows Process Execution From ProgramData",
|
|
"Windows Process Execution From RDP Share",
|
|
"Windows Process Execution in Temp Dir",
|
|
"Windows Process Injection In Non-Service SearchIndexer",
|
|
"Windows Process Injection Of Wermgr to Known Browser",
|
|
"Windows Process Injection Remote Thread",
|
|
"Windows Process Injection Wermgr Child Process",
|
|
"Windows Process Injection With Public Source Path",
|
|
"Windows Process Injection into Commonly Abused Processes",
|
|
"Windows Process Injection into Notepad",
|
|
"Windows Process With NamedPipe CommandLine",
|
|
"Windows Process With NetExec Command Line Parameters",
|
|
"Windows Process Writing File to World Writable Path",
|
|
"Windows Processes Killed By Industroyer2 Malware",
|
|
"Windows Product Key Registry Query",
|
|
"Windows Protocol Tunneling with Plink",
|
|
"Windows Proxy Execution of .NET Utilities via Scripts",
|
|
"Windows Proxy Via Netsh",
|
|
"Windows Proxy Via Registry",
|
|
"Windows PsTools Recon Usage",
|
|
"Windows PuTTY Suite Utility Execution",
|
|
"Windows Query Registry Browser List Application",
|
|
"Windows Query Registry UnInstall Program List",
|
|
"Windows RDP Artifacts and Defense Evasion",
|
|
"Windows RDP Bitmap Cache File Creation",
|
|
"Windows RDP Cache File Deletion",
|
|
"Windows RDP Client Launched with Admin Session",
|
|
"Windows RDP Connection Successful",
|
|
"Windows RDP File Execution",
|
|
"Windows RDP Login Session Was Established",
|
|
"Windows RDP Server Registry Deletion",
|
|
"Windows RDP Server Registry Entry Created",
|
|
"Windows RDPClient Connection Sequence Events",
|
|
"Windows RMM Named Pipe",
|
|
"Windows RMM Tool Execution",
|
|
"Windows Raccine Scheduled Task Deletion",
|
|
"Windows Rapid Authentication On Multiple Hosts",
|
|
"Windows Rasautou DLL Execution",
|
|
"Windows Raw Access To Disk Volume Partition",
|
|
"Windows Raw Access To Master Boot Record Drive",
|
|
"Windows Rdp AutomaticDestinations Deletion",
|
|
"Windows Registry Abuse",
|
|
"Windows Registry BootExecute Modification",
|
|
"Windows Registry Certificate Added",
|
|
"Windows Registry Delete Task SD",
|
|
"Windows Registry Dotnet ETW Disabled Via ENV Variable",
|
|
"Windows Registry Entries Exported Via Reg",
|
|
"Windows Registry Entries Restored Via Reg",
|
|
"Windows Registry Modification for Safe Mode Persistence",
|
|
"Windows Registry Payload Injection",
|
|
"Windows Registry SIP Provider Modification",
|
|
"Windows Regsvr32 Renamed Binary",
|
|
"Windows Remote Access Software BRC4 Loaded Dll",
|
|
"Windows Remote Access Software RMS Registry",
|
|
"Windows Remote Assistance Spawning Process",
|
|
"Windows Remote Create Service",
|
|
"Windows Remote Desktop Network Bruteforce Attempt",
|
|
"Windows Remote Host Computer Management Access",
|
|
"Windows Remote Image Load",
|
|
"Windows Remote Management Execute Shell",
|
|
"Windows Remote Service Rdpwinst Tool Execution",
|
|
"Windows Remote Services Allow Rdp In Firewall",
|
|
"Windows Remote Services Allow Remote Assistance",
|
|
"Windows Remote Services Rdp Enable",
|
|
"Windows Renamed Powershell Execution",
|
|
"Windows Replication Through Removable Media",
|
|
"Windows Root Domain linked policies Discovery",
|
|
"Windows Routing and Remote Access Service Registry Key Change",
|
|
"Windows RunMRU Command Execution",
|
|
"Windows RunMRU Registry Key or Value Deleted",
|
|
"Windows Rundll32 Apply User Settings Changes",
|
|
"Windows Rundll32 Execution With Log.DLL",
|
|
"Windows Rundll32 Load DLL in Temp Dir",
|
|
"Windows Rundll32 WebDAV Request",
|
|
"Windows Rundll32 WebDav With Network Connection",
|
|
"Windows Rundll32 with Non-Standard File Extension",
|
|
"Windows SIP Provider Inventory",
|
|
"Windows SIP WinVerifyTrust Failed Trust Validation",
|
|
"Windows SOAPHound Binary Execution",
|
|
"Windows SQL Server Configuration Option Hunt",
|
|
"Windows SQL Server Critical Procedures Enabled",
|
|
"Windows SQL Server Extended Procedure DLL Loading Hunt",
|
|
"Windows SQL Server Startup Procedure",
|
|
"Windows SQL Server xp_cmdshell Config Change",
|
|
"Windows SQL Spawning CertUtil",
|
|
"Windows SQLCMD Execution",
|
|
"Windows SSH Proxy Command",
|
|
"Windows ScManager Security Descriptor Tampering Via Sc.EXE",
|
|
"Windows Scheduled Task Created Via XML",
|
|
"Windows Scheduled Task Created in a Group Policy Object",
|
|
"Windows Scheduled Task DLL Module Loaded",
|
|
"Windows Scheduled Task Service Spawned Shell",
|
|
"Windows Scheduled Task with Highest Privileges",
|
|
"Windows Scheduled Task with Suspicious Command",
|
|
"Windows Scheduled Task with Suspicious Name",
|
|
"Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr",
|
|
"Windows Schtasks Create Run As System",
|
|
"Windows Screen Capture Via Powershell",
|
|
"Windows Screen Capture in TEMP folder",
|
|
"Windows Security Account Manager Stopped",
|
|
"Windows Security And Backup Services Stop",
|
|
"Windows Security Support Provider Reg Query",
|
|
"Windows Sensitive Group Discovery With Net",
|
|
"Windows Sensitive Registry Hive Dump Via CommandLine",
|
|
"Windows Server Software Component GACUtil Install to GAC",
|
|
"Windows Service Abuse",
|
|
"Windows Service Create Kernel Mode Driver",
|
|
"Windows Service Create RemComSvc",
|
|
"Windows Service Create SliverC2",
|
|
"Windows Service Create with Tscon",
|
|
"Windows Service Created with Suspicious Service Name",
|
|
"Windows Service Created with Suspicious Service Path",
|
|
"Windows Service Creation Using Registry Entry",
|
|
"Windows Service Creation on Remote Endpoint",
|
|
"Windows Service Deletion In Registry",
|
|
"Windows Service Execution RemCom",
|
|
"Windows Service Initiation on Remote Endpoint",
|
|
"Windows Service Stop Attempt",
|
|
"Windows Service Stop By Deletion",
|
|
"Windows Service Stop Win Updates",
|
|
"Windows Set Account Password Policy To Unlimited Via Net",
|
|
"Windows Set Custom DNS ServerLevelPlugin Via Dnscmd",
|
|
"Windows Set Network Profile Category to Private via Registry",
|
|
"Windows SharePoint Spinstall0 GET Request",
|
|
"Windows SharePoint Spinstall0 Webshell File Creation",
|
|
"Windows SharePoint ToolPane Endpoint Exploitation Attempt",
|
|
"Windows Shell Process from CrushFTP",
|
|
"Windows Shell or Script Execution From IIS Directory",
|
|
"Windows Short Lived DNS Record",
|
|
"Windows Snake Malware File Modification Crmlog",
|
|
"Windows Snake Malware Kernel Driver Comadmin",
|
|
"Windows Snake Malware Registry Modification wav OpenWithProgIds",
|
|
"Windows Snake Malware Service Create",
|
|
"Windows SnappyBee Create Test Registry",
|
|
"Windows SoftEther VPN Masquerading as Legitimate Binary",
|
|
"Windows Software Discovery Via PowerShell",
|
|
"Windows Spearphishing Attachment Connect To None MS Office Domain",
|
|
"Windows Spearphishing Attachment Onenote Spawn Mshta",
|
|
"Windows Special Privileged Logon On Multiple Hosts",
|
|
"Windows SpeechRuntime COM Hijacking DLL Load",
|
|
"Windows SpeechRuntime Suspicious Child Process",
|
|
"Windows SqlWriter SQLDumper DLL Sideload",
|
|
"Windows Sqlservr Spawning Shell",
|
|
"Windows Steal Authentication Certificates - ESC1 Abuse",
|
|
"Windows Steal Authentication Certificates - ESC1 Authentication",
|
|
"Windows Steal Authentication Certificates CS Backup",
|
|
"Windows Steal Authentication Certificates CertUtil Backup",
|
|
"Windows Steal Authentication Certificates Certificate Issued",
|
|
"Windows Steal Authentication Certificates Certificate Request",
|
|
"Windows Steal Authentication Certificates CryptoAPI",
|
|
"Windows Steal Authentication Certificates Export Certificate",
|
|
"Windows Steal Authentication Certificates Export PfxCertificate",
|
|
"Windows Steal or Forge Kerberos Tickets Klist",
|
|
"Windows SubInAcl Execution",
|
|
"Windows Suspect Process With Authentication Traffic",
|
|
"Windows Suspicious C2 Named Pipe",
|
|
"Windows Suspicious Child Process Spawned From WebServer",
|
|
"Windows Suspicious Driver Loaded Path",
|
|
"Windows Suspicious File in EFI Volume",
|
|
"Windows Suspicious Named Pipe",
|
|
"Windows Suspicious Process File Path",
|
|
"Windows Suspicious QEMU Execution",
|
|
"Windows Suspicious React or Next.js Child Process",
|
|
"Windows Suspicious VMWare Tools Child Process",
|
|
"Windows Svchost.exe Parent Process Anomaly",
|
|
"Windows SymbolicLink-Testing-Tools Utility Execution",
|
|
"Windows Symlink Evaluation Change via Fsutil",
|
|
"Windows System Binary Proxy Execution Compiled HTML File Decompile",
|
|
"Windows System Binary Proxy Execution MSIExec",
|
|
"Windows System Discovery Using Qwinsta",
|
|
"Windows System Discovery Using ldap Nslookup",
|
|
"Windows System File on Disk",
|
|
"Windows System LogOff Commandline",
|
|
"Windows System Network Config Discovery Display DNS",
|
|
"Windows System Network Connections Discovery Netsh",
|
|
"Windows System Reboot CommandLine",
|
|
"Windows System Remote Discovery With Query",
|
|
"Windows System Script Proxy Execution Syncappvpublishingserver",
|
|
"Windows System Shutdown CommandLine",
|
|
"Windows System Time Discovery W32tm Delay",
|
|
"Windows System User Discovery Via Quser",
|
|
"Windows System User Privilege Discovery",
|
|
"Windows TOR Client Execution",
|
|
"Windows TeamCity Payload Execution from Temp Directory",
|
|
"Windows TeamCity Plugin Installed",
|
|
"Windows Terminating Lsass Process",
|
|
"Windows Theme File Creation in Unusual Location",
|
|
"Windows Time Based Evasion",
|
|
"Windows Time Based Evasion via Choice Exec",
|
|
"Windows TinyCC Shellcode Execution",
|
|
"Windows UAC Bypass Suspicious Child Process",
|
|
"Windows UAC Bypass Suspicious Escalation Behavior",
|
|
"Windows USBSTOR Registry Key Modification",
|
|
"Windows Universal Data Link File Creation",
|
|
"Windows Unsecured Outlook Credentials Access In Registry",
|
|
"Windows Unsigned DLL Side-Loading",
|
|
"Windows Unsigned DLL Side-Loading In Same Process Path",
|
|
"Windows Unsigned MS DLL Side-Loading",
|
|
"Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos",
|
|
"Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos",
|
|
"Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM",
|
|
"Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials",
|
|
"Windows Unusual Count Of Users Failed To Auth Using Kerberos",
|
|
"Windows Unusual Count Of Users Failed To Authenticate From Process",
|
|
"Windows Unusual Count Of Users Failed To Authenticate Using NTLM",
|
|
"Windows Unusual Count Of Users Remotely Failed To Auth From Host",
|
|
"Windows Unusual File Creation in Confluence Directory",
|
|
"Windows Unusual FileZilla XML Config Access",
|
|
"Windows Unusual Intelliform Storage Registry Access",
|
|
"Windows Unusual NTLM Authentication Destinations By Source",
|
|
"Windows Unusual NTLM Authentication Destinations By User",
|
|
"Windows Unusual NTLM Authentication Users By Destination",
|
|
"Windows Unusual NTLM Authentication Users By Source",
|
|
"Windows Unusual Process Load Mozilla NSS-Mozglue Module",
|
|
"Windows Unusual SysWOW64 Process Run System32 Executable",
|
|
"Windows Updates Install Failures",
|
|
"Windows Updates Install Successes",
|
|
"Windows User Deletion Via Net",
|
|
"Windows User Disabled Via Net",
|
|
"Windows User Discovery Via Net",
|
|
"Windows User Execution Malicious URL Shortcut File",
|
|
"Windows Visual Basic Commandline Compiler DNSQuery",
|
|
"Windows Vulnerable 3CX Software",
|
|
"Windows Vulnerable Driver Installed",
|
|
"Windows Vulnerable Driver Loaded",
|
|
"Windows WBAdmin File Recovery From Backup",
|
|
"Windows WMI Impersonate Token",
|
|
"Windows WMI Process And Service List",
|
|
"Windows WMI Process Call Create",
|
|
"Windows WMI Reconnaissance Class Query",
|
|
"Windows WMIC Shadowcopy Delete",
|
|
"Windows WPDBusEnum Registry Key Modification",
|
|
"Windows WSUS Spawning Shell",
|
|
"Windows WinDBG Spawning AutoIt3",
|
|
"Windows WinLogon with Public Network Connection",
|
|
"Windows WinPEAS PowerShell Script Execution",
|
|
"Windows WinRAR Launched Outside Default Installation Directory",
|
|
"Windows Wmic CPU Discovery",
|
|
"Windows Wmic DiskDrive Discovery",
|
|
"Windows Wmic Memory Chip Discovery",
|
|
"Windows Wmic Network Discovery",
|
|
"Windows Wmic Systeminfo Discovery",
|
|
"Windows XLL File Creation Outside of Typical Location",
|
|
"Winhlp32 Spawning a Process",
|
|
"Winter Vivern",
|
|
"Wmic Group Discovery",
|
|
"Wmic NonInteractive App Uninstallation",
|
|
"Wmiprvse LOLBAS Execution Process Spawn",
|
|
"WordPress Bricks Builder plugin RCE",
|
|
"WordPress Vulnerabilities",
|
|
"Wscript Or Cscript Suspicious Child Process",
|
|
"Wsmprovhost LOLBAS Execution Process Spawn",
|
|
"XML Runner Loader",
|
|
"XMRIG Driver Loaded",
|
|
"XMRig",
|
|
"XSL Script Execution With WMIC",
|
|
"XWorm",
|
|
"XorDDos",
|
|
"ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day",
|
|
"ZOVWiper",
|
|
"ZScaler Outbound Traffic Filtering",
|
|
"Zeek Conn",
|
|
"Zeek x509 Certificate with Punycode",
|
|
"Zoom High Video Latency",
|
|
"Zoom Rare Audio Devices",
|
|
"Zoom Rare Input Devices",
|
|
"Zoom Rare Video Devices",
|
|
"Zscaler Adware Activities Threat Blocked",
|
|
"Zscaler Behavior Analysis Threat Blocked",
|
|
"Zscaler Browser Proxy Threats",
|
|
"Zscaler CryptoMiner Downloaded Threat Blocked",
|
|
"Zscaler Employment Search Web Activity",
|
|
"Zscaler Exploit Threat Blocked",
|
|
"Zscaler Legal Liability Threat Blocked",
|
|
"Zscaler Malware Activity Threat Blocked",
|
|
"Zscaler Phishing Activity Threat Blocked",
|
|
"Zscaler Potentially Abused File Download",
|
|
"Zscaler Privacy Risk Destinations Threat Blocked",
|
|
"Zscaler Scam Destinations Threat Blocked",
|
|
"Zscaler Virus Download threat blocked",
|
|
"ace_access_rights_lookup",
|
|
"ace_flag_lookup",
|
|
"ace_type_lookup",
|
|
"admon",
|
|
"advanced_audit_policy_guids",
|
|
"amazon_security_lake",
|
|
"api_call_by_user_baseline",
|
|
"appdynamics_security",
|
|
"applocker",
|
|
"applockereventcodes",
|
|
"asr_rules",
|
|
"attacker_tools",
|
|
"aws_cloudwatchlogs_eks",
|
|
"aws_config",
|
|
"aws_description",
|
|
"aws_ecr_users",
|
|
"aws_ecr_users_asl",
|
|
"aws_s3_accesslogs",
|
|
"aws_securityhub_finding",
|
|
"aws_securityhub_firehose",
|
|
"aws_service_accounts",
|
|
"azure_audit",
|
|
"azure_monitor_aad",
|
|
"azure_monitor_activity",
|
|
"azuread",
|
|
"base64decode",
|
|
"baseline_blocked_outbound_connections",
|
|
"bootloader_inventory",
|
|
"brandMonitoring_lookup",
|
|
"brand_abuse_dns",
|
|
"brand_abuse_email",
|
|
"brand_abuse_web",
|
|
"browser_app_list",
|
|
"browser_process_and_path",
|
|
"builtin_groups_lookup",
|
|
"capi2_operational",
|
|
"certificateservices_lifecycle",
|
|
"char_conversion_matrix",
|
|
"circleci",
|
|
"cisco_ai_defense",
|
|
"cisco_asa",
|
|
"cisco_duo_activity",
|
|
"cisco_duo_administrator",
|
|
"cisco_isovalent",
|
|
"cisco_isovalent_allowed_images",
|
|
"cisco_isovalent_process_connect",
|
|
"cisco_isovalent_process_exec",
|
|
"cisco_network_visibility_module_flowdata",
|
|
"cisco_networks",
|
|
"cisco_sd_wan_service_proxy_access",
|
|
"cisco_sd_wan_syslog",
|
|
"cisco_secure_firewall",
|
|
"cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools",
|
|
"cisco_secure_firewall_filetype_lookup",
|
|
"cisco_secure_firewall_inside_to_outside",
|
|
"cisco_snort_ids_to_threat_mapping",
|
|
"cloud_api_calls_from_previously_unseen_user_roles_activity_window",
|
|
"cloud_instances_enough_data",
|
|
"cloudtrail",
|
|
"cloudwatch_eks",
|
|
"cloudwatch_vpc",
|
|
"cloudwatchlogs_vpcflow",
|
|
"crowdstrike_identities",
|
|
"crowdstrike_stream",
|
|
"crushftp",
|
|
"decommissioned_buckets",
|
|
"discovered_dns_records",
|
|
"domain_admins",
|
|
"domains",
|
|
"driverinventory",
|
|
"dynamic_dns_providers",
|
|
"dynamic_dns_providers_default",
|
|
"dynamic_dns_providers_local",
|
|
"dynamic_dns_web_traffic",
|
|
"ec2_modification_api_calls",
|
|
"esxi_syslog",
|
|
"evilginx_phishlets_0365",
|
|
"evilginx_phishlets_amazon",
|
|
"evilginx_phishlets_aws",
|
|
"evilginx_phishlets_facebook",
|
|
"evilginx_phishlets_github",
|
|
"evilginx_phishlets_google",
|
|
"evilginx_phishlets_outlook",
|
|
"excluded_cloud_binaries",
|
|
"executable_extensions",
|
|
"f5_bigip_rogue",
|
|
"fillnull_config",
|
|
"filter_rare_process_allow_list",
|
|
"github",
|
|
"github_enterprise",
|
|
"github_known_users",
|
|
"github_organizations",
|
|
"google_gcp_pubnet_message",
|
|
"google_gcp_pubsub_message",
|
|
"gsuite_calendar",
|
|
"gsuite_drive",
|
|
"gsuite_gmail",
|
|
"gws_login_mfa_methods",
|
|
"gws_reports_admin",
|
|
"gws_reports_login",
|
|
"hijacklibs",
|
|
"hijacklibs_loaded",
|
|
"iis_get_webglobalmodule",
|
|
"iis_operational_logs",
|
|
"images_to_repository",
|
|
"important_audit_policy_subcategory_guids",
|
|
"is_net_windows_file",
|
|
"is_net_windows_file_macro",
|
|
"is_nirsoft_software",
|
|
"is_nirsoft_software_macro",
|
|
"is_suspicious_file_extension_lookup",
|
|
"is_windows_system_file",
|
|
"is_windows_system_file_macro",
|
|
"ivanti_vtm_audit",
|
|
"k8s_container_network_io_baseline",
|
|
"k8s_container_network_io_ratio_baseline",
|
|
"k8s_process_resource_baseline",
|
|
"k8s_process_resource_ratio_baseline",
|
|
"kube_allowed_images",
|
|
"kube_allowed_locations",
|
|
"kube_allowed_user_agents",
|
|
"kube_allowed_user_groups",
|
|
"kube_allowed_user_names",
|
|
"kube_audit",
|
|
"kube_container_falco",
|
|
"kube_objects_events",
|
|
"kubernetes_azure",
|
|
"kubernetes_container_controller",
|
|
"kubernetes_metrics",
|
|
"legit_domains",
|
|
"linux_auditd",
|
|
"linux_auditd_normalized_execve_process",
|
|
"linux_auditd_normalized_proctitle_process",
|
|
"linux_hosts",
|
|
"linux_offsec_tool_processes",
|
|
"linux_shells",
|
|
"linux_tool_discovery_process",
|
|
"local_file_inclusion_paths",
|
|
"lolbas_file_path",
|
|
"loldrivers",
|
|
"lookup_rare_process_allow_list_default",
|
|
"lookup_rare_process_allow_list_local",
|
|
"lookup_uncommon_processes_default",
|
|
"lookup_uncommon_processes_local",
|
|
"m365_copilot_graph_api",
|
|
"m365_exported_ediscovery_prompt_logs",
|
|
"malicious_powershell_strings",
|
|
"malware_user_agents",
|
|
"mandatory_job_for_workflow",
|
|
"mandatory_step_for_job",
|
|
"mcp_server",
|
|
"moveit_sftp_logs",
|
|
"ms365_defender_incident_alerts",
|
|
"ms_defender",
|
|
"ms_defender_atp_alerts",
|
|
"msad_guid_lookup",
|
|
"msexchange_management",
|
|
"netbackup",
|
|
"network_acl_activity_baseline",
|
|
"network_acl_events",
|
|
"nginx_access_logs",
|
|
"non_public_ip_blocks",
|
|
"normalized_service_binary_field",
|
|
"ntlm_audit",
|
|
"o365_graph",
|
|
"o365_management_activity",
|
|
"o365_messagetrace",
|
|
"o365_suspect_search_terms_regex",
|
|
"okta",
|
|
"oldsummaries_config",
|
|
"ollama_server",
|
|
"osquery_macro",
|
|
"osquery_process",
|
|
"papercutng",
|
|
"pingid",
|
|
"potential_password_in_username_false_positive_reduction",
|
|
"potentially_malicious_code_on_cmdline_tokenize_score",
|
|
"powershell",
|
|
"previously_seen_S3_access_from_remote_ip",
|
|
"previously_seen_api_calls_from_user_roles",
|
|
"previously_seen_aws_cross_account_activity",
|
|
"previously_seen_aws_regions",
|
|
"previously_seen_cloud_api_calls_per_user_role",
|
|
"previously_seen_cloud_api_calls_per_user_role_forget_window",
|
|
"previously_seen_cloud_compute_creations_by_user",
|
|
"previously_seen_cloud_compute_creations_by_user_search_window_begin_offset",
|
|
"previously_seen_cloud_compute_image_search_window_begin_offset",
|
|
"previously_seen_cloud_compute_images",
|
|
"previously_seen_cloud_compute_images_forget_window",
|
|
"previously_seen_cloud_compute_instance_type_forget_window",
|
|
"previously_seen_cloud_compute_instance_types",
|
|
"previously_seen_cloud_compute_instance_types_search_window_begin_offset",
|
|
"previously_seen_cloud_instance_modifications_by_user",
|
|
"previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset",
|
|
"previously_seen_cloud_provisioning_activity_forget_window",
|
|
"previously_seen_cloud_provisioning_activity_sources",
|
|
"previously_seen_cloud_region_forget_window",
|
|
"previously_seen_cloud_regions",
|
|
"previously_seen_cloud_regions_search_window_begin_offset",
|
|
"previously_seen_cmd_line_arguments",
|
|
"previously_seen_ec2_amis_lookup",
|
|
"previously_seen_ec2_instance_types_lookup",
|
|
"previously_seen_ec2_launches_by_user_lookup",
|
|
"previously_seen_ec2_modifications_by_user",
|
|
"previously_seen_gcp_storage_access_from_remote_ip",
|
|
"previously_seen_provisioning_activity_src",
|
|
"previously_seen_running_windows_services",
|
|
"previously_seen_users_console_logins",
|
|
"previously_seen_windows_services_forget_window",
|
|
"previously_seen_windows_services_window",
|
|
"previously_seen_zoom_child_processes_forget_window",
|
|
"previously_seen_zoom_child_processes_window",
|
|
"previously_unseen_cloud_provisioning_activity_window",
|
|
"printservice",
|
|
"privileged_azure_ad_roles",
|
|
"process_auditpol",
|
|
"process_bitsadmin",
|
|
"process_certutil",
|
|
"process_cmd",
|
|
"process_copy",
|
|
"process_csc",
|
|
"process_cscript",
|
|
"process_curl",
|
|
"process_diskshadow",
|
|
"process_dllhost",
|
|
"process_dsquery",
|
|
"process_dxdiag",
|
|
"process_esentutl",
|
|
"process_fodhelper",
|
|
"process_gpupdate",
|
|
"process_hh",
|
|
"process_installutil",
|
|
"process_microsoftworkflowcompiler",
|
|
"process_msbuild",
|
|
"process_mshta",
|
|
"process_msiexec",
|
|
"process_net",
|
|
"process_netsh",
|
|
"process_nltest",
|
|
"process_ntdsutil",
|
|
"process_office_products",
|
|
"process_office_products_parent",
|
|
"process_ping",
|
|
"process_powershell",
|
|
"process_procdump",
|
|
"process_psexec",
|
|
"process_rclone",
|
|
"process_reg",
|
|
"process_regasm",
|
|
"process_regedit",
|
|
"process_regsvcs",
|
|
"process_regsvr32",
|
|
"process_route",
|
|
"process_runas",
|
|
"process_rundll32",
|
|
"process_sc",
|
|
"process_schtasks",
|
|
"process_sdelete",
|
|
"process_setspn",
|
|
"process_sqlcmd",
|
|
"process_verclsid",
|
|
"process_vssadmin",
|
|
"process_wbadmin",
|
|
"process_wermgr",
|
|
"process_wmic",
|
|
"process_wscript",
|
|
"prohibited_apps_launching_cmd",
|
|
"prohibited_apps_launching_cmd_macro",
|
|
"prohibited_processes",
|
|
"prohibited_softwares",
|
|
"pua_named_pipes",
|
|
"pua_user_agents",
|
|
"ransomware_extensions",
|
|
"ransomware_extensions_lookup",
|
|
"ransomware_notes",
|
|
"ransomware_notes_lookup",
|
|
"remote_access_software",
|
|
"remote_access_software_exceptions",
|
|
"remote_access_software_usage_exceptions",
|
|
"remoteconnectionmanager",
|
|
"remove_valid_domains",
|
|
"risk_index",
|
|
"rmm_user_agents",
|
|
"s3_accesslogs",
|
|
"s3_deletion_baseline",
|
|
"sAMAccountName Spoofing and Domain Controller Impersonation",
|
|
"scripting_tools_user_agents",
|
|
"secureapp_es_field_mappings",
|
|
"security_content_ctime",
|
|
"security_content_summariesonly",
|
|
"security_group_activity_baseline",
|
|
"security_group_api_calls",
|
|
"security_services_lookup",
|
|
"sslbl_ssl_certificate_blacklist",
|
|
"stream_dns",
|
|
"stream_http",
|
|
"stream_tcp",
|
|
"subjectinterfacepackage",
|
|
"summariesonly_config",
|
|
"suricata",
|
|
"suspicious_c2_named_pipes",
|
|
"suspicious_c2_user_agents",
|
|
"suspicious_email_attachments",
|
|
"suspicious_named_pipes",
|
|
"suspicious_ports_list",
|
|
"suspicious_rmm_named_pipes",
|
|
"suspicious_writes",
|
|
"suspicious_writes_lookup",
|
|
"sysmon",
|
|
"system_network_configuration_discovery_tools",
|
|
"threat_snort_count",
|
|
"typo_squatted_python_packages",
|
|
"uacbypass_process_name",
|
|
"uncommon_processes",
|
|
"windows_exchange_iis",
|
|
"windows_protocol_handlers",
|
|
"windows_shells",
|
|
"windows_suspicious_services",
|
|
"windows_suspicious_tasks",
|
|
"wineventlog_application",
|
|
"wineventlog_appxdeploymentserver",
|
|
"wineventlog_appxpackaging",
|
|
"wineventlog_rdp",
|
|
"wineventlog_security",
|
|
"wineventlog_system",
|
|
"wineventlog_task_scheduler",
|
|
"wmi",
|
|
"zeek_rpc",
|
|
"zeek_ssl",
|
|
"zeek_x509",
|
|
"zoom_first_time_child_process",
|
|
"zoom_index",
|
|
"zscaler_proxy"
|
|
],
|
|
"title": "AllContentEnum",
|
|
"type": "string"
|
|
},
|
|
"DeprecationInfo": {
|
|
"additionalProperties": false,
|
|
"description": "Information required for the deprecation and removal of a Security Content Object.",
|
|
"properties": {
|
|
"reason": {
|
|
"description": "The reason this content is scheduled for removal",
|
|
"title": "Reason",
|
|
"type": "string"
|
|
},
|
|
"removed_in_version": {
|
|
"description": "The version in which this content will be removed. That means it should be present in older versions, but no longer present starting with this version. If it is still present in this version of the app, a validation error will be generated at build time.",
|
|
"examples": [
|
|
"1.0.0",
|
|
"2.1.3",
|
|
"1.0.0-beta.1"
|
|
],
|
|
"format": "version",
|
|
"title": "Removed In Version",
|
|
"type": "string"
|
|
},
|
|
"replacement_content": {
|
|
"description": "Any appropriate content that may replace this piece of content.",
|
|
"items": {
|
|
"$ref": "#/$defs/AllContentEnum"
|
|
},
|
|
"title": "Replacement Content",
|
|
"type": "array",
|
|
"uniqueItems": true
|
|
}
|
|
},
|
|
"required": [
|
|
"reason",
|
|
"removed_in_version"
|
|
],
|
|
"title": "DeprecationInfo",
|
|
"type": "object"
|
|
}
|
|
},
|
|
"description": "Removed Content is a special type of content that has been deprecated and removed.\n\nIt still requires a number of fields for tracking purposes, but is intentionally more\npermissive about extra fields to support different types of content created against\ndifferent versions of the content specifications.",
|
|
"properties": {
|
|
"name": {
|
|
"description": "Each Security Content Object must have a unique name. Due to issues with how local/default stanzas are merged in the Splunk products, these names MUST NOT change between subsequent releases of content packs.",
|
|
"title": "Name",
|
|
"type": "string"
|
|
},
|
|
"id": {
|
|
"description": "Each Security Content Object must have a unique identifier. This is particularly important when leveraging many of the Content Versioning features built into Enterprise Security 8+. Unique ids may be generated with a python command such as `uuid.uuid4()` or similar.",
|
|
"format": "uuid",
|
|
"title": "Id",
|
|
"type": "string"
|
|
},
|
|
"version": {
|
|
"description": "The version of this object. This number MUST be incremented in the following circumstances:\n1. Any time the object in this file is modified\n2. Any time that the serialization logic for this object changes, changing what is written in its conf file stanza(s)\n3. Any time that an object this object references, for example via enrichment, causes a change in its associated conf file stanzas(s).\nThis final determination is challenging to make manually, so the `contentctl inspect command` will help identify when this a version increment is required.",
|
|
"exclusiveMinimum": 0,
|
|
"title": "Version",
|
|
"type": "integer"
|
|
},
|
|
"creation_date": {
|
|
"description": "The date that this object was created. This should NEVER be updated.",
|
|
"format": "date",
|
|
"title": "Creation Date",
|
|
"type": "string"
|
|
},
|
|
"modification_date": {
|
|
"description": "The date that this object was last modified. This should be updated whenever the object is modified.",
|
|
"format": "date",
|
|
"title": "Modification Date",
|
|
"type": "string"
|
|
},
|
|
"author": {
|
|
"description": "The author of this object. This is a freeform string that can be used to identify the author of the object. It will eventually be replaced by a more detailed Contributors list.",
|
|
"title": "Author",
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"description": "A description of the Security Content Object. This should be a human-readable description of the object, including its purpose.",
|
|
"title": "Description",
|
|
"type": "string"
|
|
},
|
|
"references": {
|
|
"description": "A list of references to external resources that are relevant to this object. This can include links to documentation, blog posts, or other resources that provide additional context or information about the object.",
|
|
"items": {
|
|
"format": "uri",
|
|
"maxLength": 2083,
|
|
"minLength": 1,
|
|
"type": "string"
|
|
},
|
|
"minItems": 0,
|
|
"title": "References",
|
|
"type": "array",
|
|
"uniqueItems": true
|
|
},
|
|
"deprecation_info": {
|
|
"$ref": "#/$defs/DeprecationInfo",
|
|
"description": "Removed content REQUIRES deprecation info."
|
|
},
|
|
"status": {
|
|
"const": "removed",
|
|
"description": "The status of this RemovedContent. It must be 'removed'. Even though a single value is possible for this field, it must always be provided explicitly in the YML.",
|
|
"title": "Status",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"name",
|
|
"id",
|
|
"version",
|
|
"creation_date",
|
|
"modification_date",
|
|
"author",
|
|
"description",
|
|
"deprecation_info",
|
|
"status"
|
|
],
|
|
"title": "RemovedContent",
|
|
"type": "object"
|
|
} |