Coverage › CVE-2023-27532

CVE-2023-27532 Mapped Sigma

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

Vendor / product: Veeam — Backup & Replication
Description (CISA): Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.
Added to KEV: 2023-08-22
Due date: 2023-09-12
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Known
CWE: CWE-306
CISA notes: https://www.veeam.com/kb4424
https://nvd.nist.gov/vuln/detail/CVE-2023-27532
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

6 mapping objects across 6 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1133 External Remote Services	exploitation technique	CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ref 1 · ref 2 · ref 3	live
T1059.003 Windows Command Shell	primary impact	CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ref 1 · ref 2 · ref 3	live
T1087 Account Discovery	secondary impact	CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ref 1 · ref 2 · ref 3	live
T1087.001 Local Account	secondary impact	CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ref 1 · ref 2 · ref 3	live
T1486 Data Encrypted for Impact	secondary impact	CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ref 1 · ref 2 · ref 3	live
T1555 Credentials from Password Stores	secondary impact	CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ref 1 · ref 2 · ref 3	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059.003 Windows Command Shell primary impact

DET0202 Behavioral Detection of Windows Command Shell Execution
AN0578 Windows
Detects interactive or scripted abuse of cmd.exe, batch files, or shell invocation chains. Focuses on parent-child relationships (e.g., cmd.exe launched from unusual parents), anomalous command-line parameters, and chaining with discovery, credential access, or lateral movement behaviors.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
EDR:scriptblock Process Tree + Script Block Logging → DC0029 Script Execution

Tunable: ParentProcessName TimeWindow CommandLinePattern ScriptStoragePath UserContext

Sigma rules tagged `attack.t1059.003` (46)

Headless Process Launched Via Conhost.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2024-07-23 · logsource: product=windows category=process_creation · 00ca75ab-d5ce-43be-b86c-55ff39c6abfc

Detects the launch of a child process via "conhost.exe" with the "--headless" flag. The "--headless" flag hides the windows from the user upon execution.

Techniques: T1059.001 T1059.003

Suspicious HWP Sub Processes hightest

Author: Florian Roth (Nextron Systems) · 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Techniques: T1566.001 T1203 T1059.003

Powershell Executed From Headless ConHost Process mediumtest

Author: Matt Anderson (Huntress) · 2024-07-23 · logsource: product=windows category=process_creation · 056c7317-9a09-4bd4-9067-d051312752ea

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

Techniques: T1059.001 T1059.003 T1564.003

HackTool - CrackMapExec Execution Patterns highstable

Author: Thomas Patzke · 2020-05-22 (modified 2023-11-06) · logsource: product=windows category=process_creation · 058f4380-962d-40a5-afce-50207d36d7e2

Detects various execution patterns of the CrackMapExec pentesting framework

Techniques: T1047 T1053 T1059.003 T1059.001

Remote Access Tool - ScreenConnect Command Execution lowtest

Author: Ali Alwashali · 2023-10-10 · logsource: product=windows service=application · 076ebe48-cc05-4d8f-9d41-89245cd93a14

Detects command execution via ScreenConnect RMM

Techniques: T1059.003

Potential CommandLine Path Traversal Via Cmd.EXE hightest

Author: xknow @xknow_infosec, Tim Shelton · 2020-06-11 (modified 2023-03-06) · logsource: product=windows category=process_creation · 087790e3-3287-436c-bccf-cbd0184a7db1

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

Techniques: T1059.003

HackTool - Jlaive In-Memory Assembly Execution mediumtest

Author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk) · 2022-05-24 (modified 2023-02-22) · logsource: product=windows category=process_creation · 0a99eb3e-1617-41bd-b095-13dc767f3def

Detects the use of Jlaive to execute assemblies in a copied PowerShell

Techniques: T1059.003

Remote Access Tool - ScreenConnect Temporary File lowtest

Author: Ali Alwashali · 2023-10-10 · logsource: product=windows category=file_event · 0afecb6e-6223-4a82-99fb-bf5b981e92a5

Detects the creation of files in a specific location by ScreenConnect RMM. ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.

Techniques: T1059.003

Rorschach Ransomware Execution Activity criticaltest

Author: X__Junior (Nextron Systems) · 2023-04-04 (modified 2023-04-22) · logsource: product=windows category=process_creation · 0e9e6c63-1350-48c4-9fa1-7ccb235edc68

Detects Rorschach ransomware execution activity

Techniques: T1059.003 T1059.001

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

AWS EC2 Startup Shell Script Change hightest

Author: faloker · 2020-02-12 (modified 2022-06-07) · logsource: product=aws service=cloudtrail · 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Techniques: T1059.001 T1059.003 T1059.004

Command Line Execution with Suspicious URL and AppData Strings mediumtest

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · 2019-01-16 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1ac8666b-046f-4201-8aba-1951aaec03a3

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Techniques: T1059.003 T1059.001 T1105

Exploiting SetupComplete.cmd CVE-2019-1378 hightest

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Techniques: T1068 T1059.003 T1574

CVE tags: CVE-2019-1378

Read Contents From Stdin Via Cmd.EXE mediumtest

Author: frack113, Nasreddine Bencherchali (Nextron Systems) · 2023-03-07 · logsource: product=windows category=process_creation · 241e802a-b65e-484f-88cd-c2dc10f9206d

Detect the use of "<" to read and potentially execute a file via cmd.exe

Techniques: T1059.003

Suspicious Usage of For Loop with Recursive Directory Search in CMD mediumexperimental

Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2025-11-12 · logsource: product=windows category=process_creation · 2782fbd8-b662-4eb5-9962-5bfbfb671e7b

Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing. This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection. This behavior has been observed in various malicious lnk files.

Techniques: T1059.003 T1027.010

All 46 rules on the technique page →

T1087 Account Discovery secondary impact

DET0587 Enumeration of User or Account Information Across Platforms
AN1612 Windows
Detection of processes performing local or domain account enumeration by invoking account directory queries or security APIs followed by structured output of account lists. The defender observes command execution or API invocation patterns that retrieve account information and produce enumeration artifacts shortly afterward.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Security EventCode=4798, 4799 → DC0099 Group Enumeration

Tunable: CommandLinePattern TimeWindow UserContext

AN1613 Linux
Enumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.

auditd:SYSCALL PATH → DC0055 File Access
linux:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: AccessedFile ParentProcessName

AN1614 macOS
Detection of account enumeration through directory service queries or system utilities accessing account metadata stores, followed by structured enumeration output.

macos:unifiedlog process event → DC0032 Process Creation
macos:unifiedlog DirectoryService queries retrieving account information → DC0013 User Account Metadata

Tunable: CommandLine ExecutionContext

AN1615 IaaS
Detection of enumeration of identity entities through cloud provider APIs where principals retrieve account metadata such as IAM users or roles in rapid succession.

AWS:CloudTrail DescribeUsers / ListUsers / GetUser → DC0083 Cloud Service Enumeration

Tunable: API_Method CallerType

AN1616 Identity Provider
Detection of identity directory enumeration through API calls or administrative queries retrieving multiple account objects within a short interval.

azure:signinlogs Graph API Query → DC0083 Cloud Service Enumeration
saas:okta User Enumeration Events → DC0013 User Account Metadata

Tunable: QueryType AppContext

AN1617 ESXi
Detection of enumeration activity when system processes query ESXi host account configuration or management APIs to retrieve user account listings.

esxi:vpxd vCenter Management → DC0064 Command Execution

Tunable: CommandPattern PrivilegedSession

AN1618 SaaS
Account enumeration via bulk access to user directory features or hidden APIs.

gcp:audit Directory API Access → DC0013 User Account Metadata

Tunable: EndpointURL UserAgent

AN1619 Office Suite
Account discovery via VBA macros, COM objects, or embedded scripting.

m365:unified Scripted Activity → DC0029 Script Execution

Tunable: MacroName ExecutionScope

Sigma rules tagged `attack.t1087` (16)

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Hacktool Ruler hightest

Author: Florian Roth (Nextron Systems) · 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae

This events that are generated when using the hacktool Ruler by Sensepost

Techniques: T1087 T1114 T1059 T1550.002

PUA - Seatbelt Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-18 (modified 2023-02-04) · logsource: product=windows category=process_creation · 38646daa-e78f-4ace-9de0-55547b2d30da

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Techniques: T1526 T1087 T1083

Webshell Hacking Activity Patterns hightest

Author: Florian Roth (Nextron Systems) · 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Techniques: T1505.003 T1018 T1033 T1087

SharpHound Recon Account Discovery hightest

Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · 65f77b1e-8e79-45bf-bb67-5988a8ce45a5

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Techniques: T1087

Potential Pikabot Discovery Activity hightest

Author: Andreas Braathen (mnemonic.io) · 2023-10-27 (modified 2024-01-26) · logsource: product=windows category=process_creation · 698d4431-514f-4c82-af4d-cf573872a9f5

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

Techniques: T1016 T1049 T1087

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer · 2017-03-05 (modified 2025-12-10) · logsource: product=windows category=ps_script · 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

HackTool - winPEAS Execution hightest

Author: Georg Lauenstein (sure[secure]) · 2022-09-19 (modified 2023-03-23) · logsource: product=windows category=process_creation · 98b53e78-ebaf-46f8-be06-421aafd176d9

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Techniques: T1082 T1087 T1046

Suspicious Use of PsLogList mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2021-12-18 (modified 2026-06-29) · logsource: product=windows category=process_creation · aae1243f-d8af-40d8-ab20-33fc6d0c55bc

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Techniques: T1087 T1087.001 T1087.002

Uncommon Connection to Active Directory Web Services mediumtest

Author: @kostastsale · 2024-01-26 · logsource: product=windows category=network_connection · b3ad3c0f-c949-47a1-a30e-b0491ccae876

Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.

Techniques: T1087

Potentially Suspicious EventLog Recon Activity Using Log Query Utilities mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2022-09-09 (modified 2025-12-02) · logsource: product=windows category=process_creation · beaa66d6-aa1b-4e3c-80f5-e0145369bfaf

Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.

Techniques: T1552 T1087

Webshell Detection With Command Line Keywords hightest

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson · 2017-01-01 (modified 2026-07-14) · logsource: product=windows category=process_creation · bed2a484-9348-4143-8a8a-b801c979301c

Detects certain command line parameters often used during reconnaissance activity via web shells

Techniques: T1505.003 T1018 T1033 T1087

Network Reconnaissance Activity hightest

Author: Florian Roth (Nextron Systems) · 2022-02-07 · logsource: product=windows category=process_creation · e6313acd-208c-44fc-a0ff-db85d572e90e

Detects a set of suspicious network related commands often used in recon stages

Techniques: T1087 T1082

HackTool - SOAPHound Execution hightest

Author: @kostastsale · 2024-01-26 · logsource: product=windows category=process_creation · e92a4287-e072-4a40-9739-370c106bb750

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

Techniques: T1087

All 16 rules on the technique page →

T1087.001 Local Account secondary impact

DET0303 Local Account Enumeration Across Host Platforms
AN0846 Windows
Adversary enumeration of local user accounts using Net.exe, WMI, or PowerShell.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: CommandLinePattern UserContext TimeWindow

AN0847 Linux
Enumeration of local users or groups via file access (/etc/passwd) or commands like id, groups.

auditd:PATH PATH → DC0055 File Access
linux:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: AccessedFile ExecutionScope

AN0848 macOS
Enumeration of macOS local users using dscl, id, dscacheutil, or /etc/passwd access.

macos:unifiedlog None → DC0032 Process Creation

Tunable: CommandLine InteractiveSession

AN0849 ESXi
Enumeration of local ESXi accounts using esxcli or vSphere API from unauthorized sessions.

vpxd.log vCenter Management → DC0013 User Account Metadata
esxi:shell Shell Execution → DC0032 Process Creation

Tunable: CommandPattern SessionType

Sigma rules tagged `attack.t1087.001` (13)

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

BloodHound Collection Files hightest

Author: C.J. May · 2022-08-09 (modified 2026-02-19) · logsource: product=windows category=file_event · 02773bed-83bf-469f-b7ff-e676e7d78bab

Detects default file names outputted by the BloodHound collection tool SharpHound

Techniques: T1087.001 T1087.002 T1482 T1069.001 T1069.002 T1059.001

Net.EXE Execution lowtest

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · 2019-01-16 (modified 2022-07-11) · logsource: product=windows category=process_creation · 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac

Detects execution of "Net.EXE".

Techniques: T1007 T1049 T1018 T1135 T1201 T1069.001 T1069.002 T1087.001 T1087.002 T1021.002

Local Accounts Discovery lowtest

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community · 2019-10-21 (modified 2025-10-20) · logsource: product=windows category=process_creation · 502b42de-4306-40b4-9596-6f590c81f073

Local accounts, System Owner/User discovery using operating systems utilities

Techniques: T1033 T1087.001

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Suspicious Use of PsLogList mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2021-12-18 (modified 2026-06-29) · logsource: product=windows category=process_creation · aae1243f-d8af-40d8-ab20-33fc6d0c55bc

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Techniques: T1087 T1087.001 T1087.002

Local System Accounts Discovery - Linux lowtest

Author: Alejandro Ortuno, oscd.community, CheraghiMilad · 2020-10-08 (modified 2024-12-10) · logsource: product=linux category=process_creation · b45e3d6f-42c6-47d8-a478-df6bd6cf534c

Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Techniques: T1087.001

Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-10 · logsource: product=windows category=process_creation · c8a180d6-47a3-4345-a609-53f9c3d834fc

Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet

Techniques: T1087.001

Cisco Collect Data lowtest

Author: Austin Clark · 2019-08-11 (modified 2023-01-04) · logsource: product=cisco service=aaa · cd072b25-a418-4f98-8ebc-5093fb38fe1a

Collect pertinent data from the configuration files

Techniques: T1087.001 T1552.001 T1005

Suspicious Group And Account Reconnaissance Activity Using Net.EXE mediumtest

Author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems) · 2019-01-16 (modified 2023-03-02) · logsource: product=windows category=process_creation · d95de845-b83c-4a9a-8a6a-4fc802ebf6c0

Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)

Techniques: T1087.001 T1087.002

Local System Accounts Discovery - MacOs lowtest

Author: Alejandro Ortuno, oscd.community · 2020-10-08 (modified 2026-07-07) · logsource: product=macos category=process_creation · ddf36b67-e872-4507-ab2e-46bda21b842c

Detects enumeration of local system accounts on MacOS systems. This can be used by attackers to identify accounts for lateral movement or privilege escalation.

Techniques: T1087.001

HackTool - Bloodhound/Sharphound Execution hightest

Author: Florian Roth (Nextron Systems) · 2019-12-20 (modified 2023-02-04) · logsource: product=windows category=process_creation · f376c8a7-a2d0-4ddc-aa0c-16c17236d962

Detects command line parameters used by Bloodhound and Sharphound hack tools

Techniques: T1087.001 T1087.002 T1482 T1069.001 T1069.002 T1059.001

T1133 External Remote Services exploitation technique

DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
AN1004 Windows
Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.

WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication
WinEventLog:Application VPN, Citrix, or remote access gateway logs showing external IP addresses → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: BusinessHours KnownRemoteIPs FailedLogonThreshold GeoIPWhitelist TimeWindow

AN1005 Linux
Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).

auditd:SYSCALL ssh logins or execve of remote commands → DC0088 Logon Session Metadata
NSM:Connections Failed password or accepted password for SSH users → DC0038 Application Log Content
NSM:Flow connection: Inbound connections to SSH or VPN ports → DC0082 Network Connection Creation

Tunable: KnownSSHClients FailedLogonThreshold TimeWindow

AN1006 macOS
Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.

macos:unifiedlog Remote login (ssh) or screen sharing authentication attempts → DC0088 Logon Session Metadata
macos:unifiedlog Inbound connections to VNC/SSH ports → DC0082 Network Connection Creation
PF:Logs External traffic to remote access services → DC0078 Network Traffic Flow

Tunable: KnownVNCServers TimeWindow

AN1007 Containers
Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.

ApplicationLog:API Docker/Kubernetes API access from external sources → DC0038 Application Log Content
kubernetes:audit Unauthorized container creation or kubelet exec logs → DC0088 Logon Session Metadata
NSM:Flow External access to container ports (2375, 6443) → DC0082 Network Connection Creation

Tunable: AllowedCIDRs TimeWindow

Sigma rules tagged `attack.t1133` (20)

Remote Access Tool - Team Viewer Session Started On Linux Host lowtest

Author: Josh Nickels, Qi Nan · 2024-03-11 · logsource: product=linux category=process_creation · 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Techniques: T1133

External Remote RDP Logon from Public IP mediumtest

Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) · 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Techniques: T1133 T1078 T1110

FortiGate - New VPN SSL Web Portal Added mediumexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2025-11-01 · logsource: product=fortigate service=event · 2bfb6216-0c31-4d20-8501-2629b29a3fa2

Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.

Techniques: T1133

OpenCanary - Telnet Login Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Techniques: T1133 T1078

OpenCanary - RDP New Connection Attempt highexperimental

Author: Marco Pedrinazzi (@pedrinazziM) · 2026-01-06 · logsource: product=opencanary category=application · 598290cf-5932-45cd-9123-be1e05ab4f2e

Detects instances where an RDP service on an OpenCanary node has had a connection attempt.

Techniques: T1133 T1021.001

Potential Exploitation of GoAnywhere MFT Vulnerability highexperimental

Author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-10-07 · logsource: product=windows category=process_creation · 6c76b3d0-afe4-4870-9443-ffe6773c5fef

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

Techniques: T1190 T1059.001 T1133

CVE tags: CVE-2025-10035

Remote Access Tool - ScreenConnect Installation Execution mediumtest

Author: Florian Roth (Nextron Systems) · 2021-02-11 (modified 2024-02-26) · logsource: product=windows category=process_creation · 75bfe6e6-cd8e-429e-91d3-03921e1d7962

Detects ScreenConnect program starts that establish a remote access to a system.

Techniques: T1133

External Remote SMB Logon from Public IP hightest

Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) · 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 78d5cab4-557e-454f-9fb9-a222bd0d5edc

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Techniques: T1133 T1078 T1110

FortiGate - VPN SSL Settings Modified mediumexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2025-11-01 · logsource: product=fortigate service=event · 8b5dacf2-aeb7-459d-b133-678eb696d410

Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.

Techniques: T1133

Unusual File Deletion by Dns.exe hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-27 (modified 2023-02-15) · logsource: product=windows category=file_delete · 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0

Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Unusual File Modification by dns.exe hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-27 · logsource: product=windows category=file_change · 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3

Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Unusual Child Process of dns.exe hightest

Author: Tim Rauch, Elastic (idea) · 2022-09-27 (modified 2023-02-05) · logsource: product=windows category=process_creation · a4e3d776-f12e-42c2-8510-9e6ed1f43ec3

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Remote Access Tool - Team Viewer Session Started On Windows Host lowtest

Author: Josh Nickels, Qi Nan · 2024-03-11 · logsource: product=windows category=process_creation · ab70c354-d9ac-4e11-bbb6-ec8e3b153357

Techniques: T1133

Running Chrome VPN Extensions via the Registry 2 VPN Extension hightest

Author: frack113 · 2021-12-28 (modified 2023-08-17) · logsource: product=windows category=registry_set · b64a026b-8deb-4c1d-92fd-98893209dff1

Running Chrome VPN Extensions via the Registry install 2 vpn extension

Techniques: T1133

OpenCanary - SSH New Connection Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

Techniques: T1133 T1021 T1078

All 20 rules on the technique page →

T1486 Data Encrypted for Impact secondary impact

DET0215 Detection of Multi-Platform File Encryption for Impact
AN0602 Windows
High-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=2 → DC0061 File Modification

Tunable: FileExtension TargetFolder TimeWindow CommandLine

AN0603 Linux
Encryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.

auditd:SYSCALL openat, write, rename, unlink → DC0061 File Modification
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: FilenamePattern SyscallBurstRate DirectoryTargeted

AN0604 macOS
Userland or kernel-level ransomware encrypting user files (Documents, Desktop) using srm, gpg, or compiled payloads. Often correlated with ransom note creation in multiple directories.

macos:unifiedlog file encrypted|new file with .encrypted extension|disk write burst → DC0061 File Modification
macos:unifiedlog exec srm|exec openssl|exec gpg → DC0032 Process Creation

Tunable: ExtensionPattern VolumeTargeted

AN0605 ESXi
Ransomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run through dcui, SSH, or vSphere.

esxi:vmkernel rename .vmdk to .*.locked|datastore write spike → DC0061 File Modification
esxi:shell openssl|tar|dd → DC0064 Command Execution

Tunable: FileType UserContext

AN0606 IaaS
Encryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.

AWS:CloudTrail PutObject (with SSE-C), UploadPart (SSE-C) → DC0023 Cloud Storage Modification

Tunable: SSEHeader AffectedBucket UserAgent

Sigma rules tagged `attack.t1486` (16)

Suspicious Reg Add BitLocker hightest

Author: frack113 · 2021-11-15 (modified 2022-09-09) · logsource: product=windows category=process_creation · 0e0255bf-2548-47b8-9582-c0955c9283f5

Detects suspicious addition to BitLocker related registry keys via the reg.exe utility

Techniques: T1486

AWS KMS Imported Key Material Usage highexperimental

Author: toopricey · 2025-10-18 · logsource: product=aws service=cloudtrail · 1279262f-1464-422f-ac0d-5b545320c526

Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.

Techniques: T1486 T1608.003

AWS EC2 Disable EBS Encryption mediumstable

Author: Sittikorn S · 2021-06-29 (modified 2021-08-20) · logsource: product=aws service=cloudtrail · 16124c2d-e40b-4fcc-8f2c-5ab7870a2223

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

Techniques: T1486 T1565

FunkLocker Ransomware File Creation highexperimental

Author: Saiprashanth Pulisetti ( @Prashanthblogs) · 2025-08-08 · logsource: product=windows category=file_event · 2c76a22b-702d-48fd-8fa9-e41e2fe203b3

Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.

Techniques: T1486

Load Of RstrtMgr.DLL By An Uncommon Process lowtest

Author: Luc Génaux · 2023-11-28 (modified 2026-07-28) · logsource: product=windows category=image_load · 3669afd2-9891-4534-a626-e5cf03810a61

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Techniques: T1486 T1685

WannaCry Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro · 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079

Detects WannaCry ransomware activity

Techniques: T1210 T1083 T1222.001 T1486 T1490

Antivirus - Ransomware Signature criticaltest

Author: Florian Roth (Nextron Systems), Arnim Rupp · 2022-05-12 (modified 2026-06-15) · logsource: category=antivirus · 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f

Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1486

Potential Conti Ransomware Activity criticaltest

Author: frack113 · 2021-10-12 (modified 2023-02-13) · logsource: product=windows category=process_creation · 689308fc-cfba-4f72-9897-796c1dc61487

Detects a specific command used by the Conti ransomware group

Techniques: T1486

LockerGoga Ransomware Activity criticalstable

Author: Vasiliy Burov, oscd.community · 2020-10-18 (modified 2023-02-03) · logsource: product=windows category=process_creation · 74db3488-fd28-480a-95aa-b7af626de068

Detects LockerGoga ransomware activity via specific command line.

Techniques: T1486

Portable Gpg.EXE Execution mediumtest

Author: frack113, Nasreddine Bencherchali (Nextron Systems) · 2023-08-06 (modified 2023-11-10) · logsource: product=windows category=process_creation · 77df53a5-1d78-4f32-bc5a-0e7465bd8f41

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Techniques: T1486

Load Of RstrtMgr.DLL By A Suspicious Process hightest

Author: Luc Génaux · 2023-11-28 · logsource: product=windows category=image_load · b48492dc-c5ef-4572-8dff-32bc241c15c8

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Techniques: T1486 T1685

Microsoft 365 - Potential Ransomware Activity mediumtest

Author: austinsonger · 2021-08-19 (modified 2022-10-09) · logsource: product=m365 service=threat_management · bd132164-884a-48f1-aa2d-c6d646b04c69

Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

Techniques: T1486

Suspicious Creation TXT File in User Desktop mediumtest

Author: frack113 · 2021-12-26 (modified 2026-01-09) · logsource: product=windows category=file_event · caf02a0a-1e1c-4552-9b48-5e070bd88d11

Detects creation of .txt files in user desktop folders via cmd.exe. This behavior may indicate ransomware deploying ransom notes, but can also occur during legitimate administrative tasks. Analysts should investigate for suspicious filenames (e.g., "RANSOM", "DECRYPT", "READ_ME"), bulk file creation patterns, or concurrent encryption activity to determine if this is part of a ransomware attack.

Techniques: T1486

Suspicious Appended Extension mediumtest

Author: frack113 · 2022-07-16 (modified 2023-11-11) · logsource: product=windows category=file_rename · e3f673b3-65d1-4d80-9146-466f8b63fa99

Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.

Techniques: T1486

Renamed Gpg.EXE Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2023-08-09 · logsource: product=windows category=process_creation · ec0722a3-eb5c-4a56-8ab2-bf6f20708592

Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.

Techniques: T1486

All 16 rules on the technique page →

T1555 Credentials from Password Stores secondary impact

DET0430 Detect Credentials Access from Password Stores
AN1198 Windows
Monitors suspicious access to password stores such as LSASS, DPAPI, Windows Credential Manager, or browser credential databases. Detects anomalous process-to-process access (e.g., Mimikatz accessing LSASS) and correlation of credential store file reads with execution of non-standard processes.

WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: TargetProcesses KeywordPatterns

AN1199 Linux
Detects access to known password store files (e.g., /etc/shadow, GNOME Keyring, KWallet, browser credential databases). Monitors anomalous process read attempts and suspicious API calls that attempt to extract stored credentials.

auditd:SYSCALL open/read → DC0055 File Access
auditd:EXECVE execve → DC0032 Process Creation

Tunable: MonitoredFiles SuspiciousCommands

AN1200 macOS
Monitors Keychain database access and suspicious invocations of security and osascript utilities. Correlates process execution with attempts to dump or unlock Keychain data.

macos:unifiedlog access to keychain database → DC0055 File Access
macos:unifiedlog execution of security or osascript → DC0032 Process Creation

Tunable: AllowedApplications AlertThreshold

AN1201 IaaS
Detects attempts to access or enumerate cloud password/secrets storage services such as AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Monitors API calls for abnormal enumeration or bulk retrieval of secrets.

AWS:CloudTrail GetSecretValue → DC0083 Cloud Service Enumeration
AWS:CloudTrail Decrypt → DC0021 OS API Execution

Tunable: UserContext AccessThreshold

Sigma rules tagged `attack.t1555` (8)

Suspicious Serv-U Process Pattern hightest

Author: Florian Roth (Nextron Systems) · 2021-07-14 (modified 2022-07-14) · logsource: product=windows category=process_creation · 58f4ea09-0fc2-4520-ba18-b85c540b0eaf

Detects a suspicious process pattern which could be a sign of an exploited Serv-U service

Techniques: T1555

CVE tags: CVE-2021-35211

Enumerate Credentials from Windows Credential Manager With PowerShell mediumtest

Author: frack113 · 2021-12-20 (modified 2022-12-25) · logsource: product=windows category=ps_script · 603c6630-5225-49c1-8047-26c964553e0e

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Techniques: T1555

HackTool - SecurityXploded Execution criticalstable

Author: Florian Roth (Nextron Systems) · 2018-12-19 (modified 2023-02-04) · logsource: product=windows category=process_creation · 7679d464-4f74-45e2-9e01-ac66c5eb041a

Detects the execution of SecurityXploded Tools

Techniques: T1555

DPAPI Backup Keys And Certificate Export Activity IOC hightest

Author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems) · 2024-06-26 · logsource: product=windows category=file_event · 7892ec59-c5bb-496d-8968-e5d210ca3ac4

Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.

Techniques: T1555 T1552.004

HackTool - WinPwn Execution - ScriptBlock hightest

Author: Swachchhanda Shrawan Poudel · 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Techniques: T1046 T1082 T1106 T1518 T1548.002 T1552.001 T1555 T1555.003

Dump Credentials from Windows Credential Manager With PowerShell mediumtest

Author: frack113 · 2021-12-20 (modified 2022-12-25) · logsource: product=windows category=ps_script · 99c49d9c-34ea-45f7-84a7-4751ae6b2cbc

Techniques: T1555

PUA - AWS TruffleHog Execution mediumexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-10-21 · logsource: product=aws service=cloudtrail · a840e606-7c8c-4684-9bc1-eb6b6155127f

Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.

Techniques: T1555 T1003

HackTool - WinPwn Execution hightest

Author: Swachchhanda Shrawan Poudel · 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Techniques: T1046 T1082 T1106 T1518 T1548.002 T1552.001 T1555 T1555.003

CVE-2023-27532 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059.003 Windows Command Shell primary impact

Sigma rules tagged attack.t1059.003 (46)

T1087 Account Discovery secondary impact

Sigma rules tagged attack.t1087 (16)

T1087.001 Local Account secondary impact

Sigma rules tagged attack.t1087.001 (13)

T1133 External Remote Services exploitation technique

Sigma rules tagged attack.t1133 (20)

T1486 Data Encrypted for Impact secondary impact

Sigma rules tagged attack.t1486 (16)

T1555 Credentials from Password Stores secondary impact

Sigma rules tagged attack.t1555 (8)

Sigma rules tagged `attack.t1059.003` (46)

Sigma rules tagged `attack.t1087` (16)

Sigma rules tagged `attack.t1087.001` (13)

Sigma rules tagged `attack.t1133` (20)

Sigma rules tagged `attack.t1486` (16)

Sigma rules tagged `attack.t1555` (8)