Coverage › CVE-2023-38035

CVE-2023-38035 Mapped Sigma

Ivanti Sentry Authentication Bypass Vulnerability

Vendor / product: Ivanti — Sentry
Description (CISA): Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Added to KEV: 2023-08-22
Due date: 2023-09-12
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Known
CWE: CWE-863
CISA notes: https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US
https://nvd.nist.gov/vuln/detail/CVE-2023-38035
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

9 mapping objects across 9 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1190 Exploit Public-Facing Application	exploitation technique	This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. ref 1 · ref 2 · ref 3 · ref 4	live
T1018 Remote System Discovery	secondary impact	This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. ref 1 · ref 2 · ref 3 · ref 4	live
T1046 Network Service Discovery	secondary impact	This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. ref 1 · ref 2 · ref 3 · ref 4	live
T1059 Command and Scripting Interpreter	primary impact	This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. ref 1 · ref 2 · ref 3 · ref 4	live
T1071.001 Web Protocols	secondary impact	This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. ref 1 · ref 2 · ref 3 · ref 4	live
T1105 Ingress Tool Transfer	secondary impact	This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. ref 1 · ref 2 · ref 3 · ref 4	live
T1496 Resource Hijacking	secondary impact	This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. ref 1 · ref 2 · ref 3 · ref 4	live
T1557.001 Name Resolution Poisoning and SMB Relay	secondary impact	This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. ref 1 · ref 2 · ref 3 · ref 4	live renamed from “LLMNR/NBT-NS Poisoning and SMB Relay”
T1571 Non-Standard Port	secondary impact	This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. This vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using "sudo." Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. ref 1 · ref 2 · ref 3 · ref 4	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1018 Remote System Discovery secondary impact

DET0574 Detection Strategy for Remote System Enumeration Behavior
AN1583 Windows
Execution of network enumeration utilities (e.g., net.exe, ping.exe, tracert.exe) in short succession, often chained with lateral movement tools or system enumeration commands.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TimeWindow CommandLinePattern ParentProcess

AN1584 Linux
Use of bash scripts or interactive shells to issue sequential ping, arp, or traceroute commands to map remote hosts.

auditd:EXECVE execve → DC0032 Process Creation
linux:syslog network → DC0082 Network Connection Creation

Tunable: TargetIPRange ShellContext

AN1585 macOS
Execution of built-in or AppleScript-based system enumeration via arp, netstat, ping, and discovery of /etc/hosts contents.

macos:unifiedlog process → DC0032 Process Creation
macos:osquery file_events → DC0055 File Access

Tunable: ExecutionUser CommandSignature

AN1586 ESXi
ESXi shell or SSH access issuing esxcli network diag ping or viewing routing tables to identify connected hosts.

esxi:hostd None → DC0064 Command Execution

Tunable: ESXCommandPattern RemoteUserShell

AN1587 Network Devices
Execution of discovery commands like show cdp neighbors, show arp, and other interface-level introspection on Cisco or Juniper devices.

networkdevice:syslog syslog facility LOCAL7 or trap messages → DC0064 Command Execution

Tunable: CommandList PrivLevel

Sigma rules tagged `attack.t1018` (17)

Macos Remote System Discovery informationaltest

Author: Alejandro Ortuno, oscd.community · 2020-10-22 (modified 2021-11-27) · logsource: product=macos category=process_creation · 10227522-8429-47e6-a301-f2b2d014e7ad

Detects the enumeration of other remote systems.

Techniques: T1018

Linux Remote System Discovery lowtest

Author: Alejandro Ortuno, oscd.community · 2020-10-22 (modified 2021-11-27) · logsource: product=linux category=process_creation · 11063ec2-de63-4153-935e-b1a8b9e616f1

Detects the enumeration of other remote systems.

Techniques: T1018

Net.EXE Execution lowtest

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · 2019-01-16 (modified 2022-07-11) · logsource: product=windows category=process_creation · 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac

Detects execution of "Net.EXE".

Techniques: T1007 T1049 T1018 T1135 T1201 T1069.001 T1069.002 T1087.001 T1087.002 T1021.002

DirectorySearcher Powershell Exploitation mediumtest

Author: frack113 · 2022-02-12 · logsource: product=windows category=ps_script · 1f6399cf-2c80-4924-ace1-6fcff3393480

Enumerates Active Directory to determine computers that are joined to the domain

Techniques: T1018

PUA - Adidnsdump Execution lowtest

Author: frack113 · 2022-01-01 (modified 2023-02-21) · logsource: product=windows category=process_creation · 26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160

This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed, Usee to Query/modify DNS records for Active Directory integrated DNS via LDAP

Techniques: T1018

Active Directory Computers Enumeration With Get-AdComputer lowtest

Author: frack113 · 2022-03-17 (modified 2023-07-08) · logsource: product=windows category=ps_script · 36bed6b2-e9a0-4fff-beeb-413a92b86138

Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

Techniques: T1018 T1087.002

Webshell Hacking Activity Patterns hightest

Author: Florian Roth (Nextron Systems) · 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Techniques: T1505.003 T1018 T1033 T1087

Share And Session Enumeration Using Net.EXE lowstable

Author: Endgame, JHasenbusch (ported for oscd.community) · 2018-10-30 (modified 2023-02-21) · logsource: product=windows category=process_creation · 62510e69-616b-4078-b371-847da438cc03

Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.

Techniques: T1018

HackTool - NetExec Execution highexperimental

Author: Chirag Damani · 2026-03-29 · logsource: product=windows category=process_creation · 7638e5fe-600c-4289-a968-f49dd537ec7d

Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.

Techniques: T1018 T1021

Nltest.EXE Execution lowtest

Author: Arun Chauhan · 2023-02-03 · logsource: product=windows category=process_creation · 903076ff-f442-475a-b667-4f246bcc203b

Detects nltest commands that can be used for information discovery

Techniques: T1016 T1018 T1482

Cisco Discovery lowtest

Author: Austin Clark · 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b

Find information about network devices that is not stored in config files

Techniques: T1083 T1201 T1057 T1018 T1082 T1016 T1049 T1033 T1124

PUA - AdFind Suspicious Execution hightest

Author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community · 2021-02-02 (modified 2025-10-24) · logsource: product=windows category=process_creation · 9a132afa-654e-11eb-ae93-0242ac130002

Detects AdFind execution with common flags seen used during attacks

Techniques: T1018 T1087.002 T1482 T1069.002

Webshell Detection With Command Line Keywords hightest

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson · 2017-01-01 (modified 2026-07-14) · logsource: product=windows category=process_creation · bed2a484-9348-4143-8a8a-b801c979301c

Detects certain command line parameters often used during reconnaissance activity via web shells

Techniques: T1505.003 T1018 T1033 T1087

Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock mediumexperimental

Author: frack113 · 2025-03-05 · logsource: product=windows category=ps_script · cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5

Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.

Techniques: T1018 T1558 T1589.002

Renamed AdFind Execution hightest

Author: Florian Roth (Nextron Systems) · 2022-08-21 (modified 2025-02-26) · logsource: product=windows category=process_creation · df55196f-f105-44d3-a675-e9dfb6cc2f2b

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Techniques: T1018 T1087.002 T1482 T1069.002

All 17 rules on the technique page →

T1046 Network Service Discovery secondary impact

DET0376 Behavioral Detection Strategy for Network Service Discovery Across Platforms
AN1057 Windows
Detects processes performing network enumeration (e.g., port scans, service probing) by correlating process creation, socket connections, and sequential destination IP probing within a time window.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: ScanRateThreshold KnownScannerExeList TimeWindow

AN1058 Linux
Detects use of network scanning utilities or scripts performing rapid connections to multiple services or hosts using auditd and netflow/pcap telemetry.

auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow Outbound TCP SYN or UDP to multiple ports/hosts → DC0078 Network Traffic Flow

Tunable: PortScanThreshold ToolPatternRegex ExpectedScanSources

AN1059 macOS
Detects Bonjour-based mDNS enumeration or use of system tools (e.g., dns-sd, nmap) to find active services via multicast probing or targeted scans.

macos:unifiedlog dns-sd, mDNSResponder, socket activity → DC0085 Network Traffic Content
macos:osquery process_events → DC0032 Process Creation

Tunable: MDNSServiceQueryPatterns UserContext ScanToolList

AN1060 Containers
Detects lateral discovery or container breakout attempts using netcat, curl, or custom binaries probing other services within the same namespace or VPC subnet.

ebpf:syscalls socket connect → DC0082 Network Connection Creation
ebpf:syscalls execve → DC0032 Process Creation
containerd:runtime container-level outbound traffic events → DC0078 Network Traffic Flow

Tunable: ExecutablePath TimeWindow NetworkDestinationCount

Sigma rules tagged `attack.t1046` (20)

Linux Network Service Scanning - Auditd lowtest

Author: Alejandro Ortuno, oscd.community · 2020-10-21 (modified 2023-09-26) · logsource: product=linux service=auditd · 3761e026-f259-44e6-8826-719ed8079408

Detects enumeration of local or remote network services.

Techniques: T1046

Linux Network Service Scanning Tools Execution lowtest

Author: Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]) · 2020-10-21 (modified 2024-09-19) · logsource: product=linux category=process_creation · 3e102cd9-a70d-4a7a-9508-403963092f31

Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.

Techniques: T1046

PUA - NimScan Execution mediumtest

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-02-05 · logsource: product=windows category=process_creation · 4fd6b1c7-19b8-4488-97f6-00f0924991a3

Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment. This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.

Techniques: T1046

PUA - Advanced Port Scanner Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2021-12-18 (modified 2023-02-07) · logsource: product=windows category=process_creation · 54773c5f-f1cc-4703-9126-2f797d96a69d

Detects the use of Advanced Port Scanner.

Techniques: T1046 T1135

OpenCanary - NMAP NULL Scan highexperimental

Author: Marco Pedrinazzi (@pedrinazziM) · 2026-01-06 · logsource: product=opencanary category=application · 68b8547b-107f-43f3-97fb-900a7d63c190

Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan

Techniques: T1046

MacOS Network Service Scanning lowtest

Author: Alejandro Ortuno, oscd.community · 2020-10-21 (modified 2021-11-27) · logsource: product=macos category=process_creation · 84bae5d4-b518-4ae0-b331-6d4afd34d00f

Detects enumeration of local or remote network services.

Techniques: T1046

HackTool - WinPwn Execution - ScriptBlock hightest

Author: Swachchhanda Shrawan Poudel · 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Techniques: T1046 T1082 T1106 T1518 T1548.002 T1552.001 T1555 T1555.003

OpenCanary - Host Port Scan (SYN Scan) highexperimental

Author: Marco Pedrinazzi (@pedrinazziM) · 2026-01-06 · logsource: product=opencanary category=application · 974be8d2-283e-4033-ab08-7505b84204d0

Detects instances where an OpenCanary node has been targeted by a SYN port scan.

Techniques: T1046

Pnscan Binary Data Transmission Activity mediumtest

Author: David Burkett (@signalblur) · 2024-04-16 · logsource: product=linux category=process_creation · 97de11cd-4b67-4abf-9a8b-1020e670aa9e

Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT

Techniques: T1046

HackTool - winPEAS Execution hightest

Author: Georg Lauenstein (sure[secure]) · 2022-09-19 (modified 2023-03-23) · logsource: product=windows category=process_creation · 98b53e78-ebaf-46f8-be06-421aafd176d9

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Techniques: T1082 T1087 T1046

Grixba Malware Reconnaissance Activity highexperimental

Author: yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-26 · logsource: product=windows category=process_creation · af688c76-4ce4-4309-bfdd-e896f01acf27

Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations. This tool is used by the Play ransomware group for network enumeration, data gathering, and event log clearing.

Techniques: T1595.001 T1046

Python Initiated Connection mediumtest

Author: frack113 · 2021-12-10 (modified 2025-03-05) · logsource: product=windows category=network_connection · bef0bc5a-b9ae-425d-85c6-7b2d705980c6

Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.

Techniques: T1046

PUA - Advanced IP Scanner Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy · 2020-05-12 (modified 2023-02-07) · logsource: product=windows category=process_creation · bef37fa2-f205-4a7b-b484-0759bfd5f86f

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Techniques: T1046 T1135

PUA - SoftPerfect Netscan Execution mediumtest

Author: @d4ns4n_ (Wuerth-Phoenix) · 2024-04-25 · logsource: product=windows category=process_creation · ca387a8e-1c84-4da3-9993-028b45342d30

Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.

Techniques: T1046

HackTool - WinPwn Execution hightest

Author: Swachchhanda Shrawan Poudel · 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Techniques: T1046 T1082 T1106 T1518 T1548.002 T1552.001 T1555 T1555.003

All 20 rules on the technique page →

T1059 Command and Scripting Interpreter primary impact

DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 Windows
Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: CommandLinePattern ParentProcessName TimeWindow

AN1429 Linux
Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: InterpreterName UserContext ExecutionChainLength

AN1430 macOS
Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

Tunable: LaunchAgentName ScriptName TerminalAppUsage

AN1431 ESXi
Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

esxi:vobd shell session start → DC0064 Command Execution

Tunable: ShellEnabledFlag SSHContext

AN1432 Network Devices
Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

networkdevice:cli shell command → DC0064 Command Execution
networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

Tunable: UserRole DeviceType

Sigma rules tagged `attack.t1059` (95)

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Techniques: T1189 T1203 T1059

Add New Download Source To Winget mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842

Detects usage of winget to add new additional download sources

Techniques: T1059

Potential Arbitrary Command Execution Via FTP.EXE mediumtest

Author: Victor Sergeev, oscd.community · 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Techniques: T1059 T1202

Use of Pcalua For Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Techniques: T1059

Shai-Hulud Malware Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

Techniques: T1059

Script Interpreter Execution From Suspicious Folder hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba

Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.

Techniques: T1059

DNS Request From Windows Script Host lowtest

Author: Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c

Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.

Techniques: T1059

Windows Shell/Scripting Application File Write to Suspicious Folder hightest

Author: Florian Roth (Nextron Systems) · 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43

Detects Windows shells and scripting applications that write files to suspicious folders

Techniques: T1059

Elevated System Shell Spawned From Uncommon Parent Location mediumtest

Author: frack113, Tim Shelton (update fp) · 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Techniques: T1059

DarkGate - Autoit3.EXE File Creation By Uncommon Process mediumtest

Author: Micah Babinski · 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Techniques: T1105 T1059

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) mediumtest

Author: Andreas Braathen (mnemonic.io) · 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Techniques: T1059 T1190

CVE tags: CVE-2023-22518

Ruby Inline Command Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Techniques: T1059

Payload Decoded and Decrypted via Built-in Utilities mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Techniques: T1059 T1204 T1140

Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Techniques: T1059

Renamed PingCastle Binary Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Techniques: T1059 T1202

All 95 rules on the technique page →

T1071.001 Web Protocols secondary impact

DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
AN0075 Windows
Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.

NSM:Flow http.log, ssl.log → DC0085 Network Traffic Content
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: ProcessNameExclusions UserAgentAnomalies OutboundByteRatioThreshold

AN0076 Linux
Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.

NSM:Flow http.log, conn.log → DC0085 Network Traffic Content
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: CommandLinePatternMatch BeaconIntervalWindow

AN0077 macOS
Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).

macos:osquery socket_events → DC0078 Network Traffic Flow
macos:unifiedlog log stream --predicate → DC0064 Command Execution

Tunable: SuspiciousParentProcess URIEntropyThreshold

AN0078 ESXi
Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.

NSM:Flow SPAN or port-mirrored HTTP/S → DC0085 Network Traffic Content
esxi:shell /root/.ash_history or /etc/init.d/* → DC0032 Process Creation

Tunable: ShellScriptMatch ExternalConnectionFilter

AN0079 Network Devices
Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.

NSM:Flow http.log, ssl.log, websocket.log → DC0085 Network Traffic Content

Tunable: HeaderEncodingPattern TLSFingerprintMismatch

Sigma rules tagged `attack.t1071.001` (42)

DNS Query To Devtunnels Domain mediumtest

Author: citron_ninja · 2023-10-25 (modified 2023-11-20) · logsource: product=windows category=dns_query · 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1071.001 T1572

HTTP Request With Empty User Agent mediumtest

Author: Florian Roth (Nextron Systems) · 2017-07-08 (modified 2021-11-27) · logsource: category=proxy · 21e44d78-95e7-421b-a464-ffd8395659c4

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Techniques: T1071.001

PwnDrp Access criticaltest

Author: Florian Roth (Nextron Systems) · 2020-04-15 (modified 2021-11-27) · logsource: category=proxy · 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Techniques: T1071.001 T1102.001 T1102.003

Renamed Visual Studio Code Tunnel Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-09-28 (modified 2025-10-29) · logsource: product=windows category=process_creation · 2cf29f11-e356-4f61-98c0-1bdb9393d6da

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Techniques: T1071.001 T1219

HackTool - BabyShark Agent Default URL Pattern criticaltest

Author: Florian Roth (Nextron Systems) · 2021-06-09 (modified 2024-02-15) · logsource: category=proxy · 304810ed-8853-437f-9e36-c4975c3dfd7e

Detects Baby Shark C2 Framework default communication patterns

Techniques: T1071.001

Visual Studio Code Tunnel Service Installation mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-10-25 · logsource: product=windows category=process_creation · 30bf1789-379d-4fdc-900f-55cd0a90a801

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Techniques: T1071.001

Curl.EXE Execution With Custom UserAgent mediumtest

Author: frack113 · 2022-01-23 (modified 2023-02-21) · logsource: product=windows category=process_creation · 3286d37a-00fd-41c2-a624-a672dcd34e60

Detects execution of curl.exe with custom useragent options

Techniques: T1071.001

Outbound Network Connection Initiated By Microsoft Dialer hightest

Author: CertainlyP · 2024-04-26 · logsource: product=windows category=network_connection · 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

Techniques: T1071.001

Wannacry Killswitch Domain hightest

Author: Mike Wade · 2020-09-16 (modified 2022-03-24) · logsource: category=dns · 3eaf6218-3bed-4d8a-8707-274096f12a18

Detects wannacry killswitch domain dns queries

Techniques: T1071.001

Raw Paste Service Access hightest

Author: Florian Roth (Nextron Systems) · 2019-12-05 (modified 2023-01-19) · logsource: category=proxy · 5468045b-4fcc-4d1a-973c-c9c9578edacb

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Techniques: T1071.001 T1102.001 T1102.003

APT40 Dropbox Tool User Agent hightest

Author: Thomas Patzke · 2019-11-12 (modified 2023-05-18) · logsource: category=proxy · 5ba715b6-71b7-44fd-8245-f66893e81b3d

Detects suspicious user agent string of APT40 Dropbox tool

Techniques: T1071.001 T1567.002

Malware User Agent hightest

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2017-07-08 (modified 2024-04-14) · logsource: category=proxy · 5c84856b-55a5-45f1-826f-13f37250cf4e

Detects suspicious user agent strings used by malware in proxy logs

Techniques: T1071.001

APT User Agent hightest

Author: Florian Roth (Nextron Systems), Markus Neis · 2019-11-12 (modified 2024-02-15) · logsource: category=proxy · 6ec820f2-e963-4801-9127-d8b2dce4d31b

Detects suspicious user agent strings used in APT malware in proxy logs

Techniques: T1071.001

Suspicious User Agent hightest

Author: Florian Roth (Nextron Systems) · 2017-07-08 (modified 2022-10-31) · logsource: category=proxy · 7195a772-4b3f-43a4-a210-6a003d65caa1

Detects suspicious malformed user agent strings in proxy logs

Techniques: T1071.001

Axios NPM Compromise Malicious C2 Domain DNS Query highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: category=dns · 73e5d24f-493f-4092-bd2f-c72cabda40ee

Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.

Techniques: T1071.001 T1568

All 42 rules on the technique page →

T1105 Ingress Tool Transfer secondary impact

DET0060 Detect Ingress Tool Transfers via Behavioral Chain
AN0165 Windows
Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: ParentProcessName DestinationIPCategory FilePathRegex

AN0166 Linux
Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

auditd:SYSCALL connect, execve, write → DC0064 Command Execution
auditd:SYSCALL file creation/modification → DC0039 File Creation
iptables:LOG TCP connections → DC0078 Network Traffic Flow

Tunable: ToolName DownloadExtension

AN0167 macOS
Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation
macos:unifiedlog file write/create → DC0039 File Creation
macos:unifiedlog connection open → DC0082 Network Connection Creation

Tunable: DirectoryTargeted ProcessPath

AN0168 ESXi
Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

esxi:hostd command execution → DC0064 Command Execution
esxi:vmkernel file write → DC0039 File Creation

Tunable: ToolName DatastorePath

AN0169 Network Devices
Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

NSM:Flow connection metadata → DC0078 Network Traffic Flow
snmp:syslog firmware write/log event → DC0039 File Creation

Tunable: PayloadVolumeThreshold ProtocolUsed

Sigma rules tagged `attack.t1105` (87)

Suspicious Curl File Upload - Linux mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582

Detects a suspicious curl process start the adds a file to a web request

Techniques: T1567 T1105

Potential Data Exfiltration Via Curl.EXE mediumtest

Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update) · 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

Techniques: T1567 T1105

Suspicious Download from Office Domain hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Techniques: T1105 T1608

Potential COM Objects Download Cradles Usage - Process Creation mediumtest

Author: frack113 · 2022-12-25 · logsource: product=windows category=process_creation · 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Techniques: T1105

Insensitive Subfolder Search Via Findstr.EXE lowtest

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Techniques: T1218 T1564.004 T1552.001 T1105

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

Techniques: T1218 T1105

CVE tags: CVE-2025-33053

Local Network Connection Initiated By Script Interpreter mediumtest

Author: frack113 · 2022-08-28 (modified 2024-05-31) · logsource: product=windows category=network_connection · 08249dc0-a28d-4555-8ba5-9255a198e08c

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Techniques: T1105

Axios NPM Compromise Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Techniques: T1195.002 T1059.006 T1059.004 T1105

Uncommon Network Connection Initiated By Certutil.EXE hightest

Author: frack113, Florian Roth (Nextron Systems) · 2022-09-02 (modified 2024-05-31) · logsource: product=windows category=network_connection · 0dba975d-a193-4ed1-a067-424df57570d1

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

Techniques: T1105

File Download with Headless Browser hightest

Author: Sreeman, Florian Roth (Nextron Systems) · 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Techniques: T1105 T1564.003

Potential DLL File Download Via PowerShell Invoke-WebRequest mediumtest

Author: Florian Roth (Nextron Systems), Hieu Tran · 2023-03-13 (modified 2025-07-18) · logsource: product=windows category=process_creation · 0f0450f3-8b47-441e-a31b-15a91dc243e2

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

Techniques: T1059.001 T1105

Potential In-Memory Download And Compile Of Payloads mediumtest

Author: Sohan G (D4rkCiph3r), Red Canary (idea) · 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Techniques: T1059.007 T1105

Suspicious File Downloaded From Direct IP Via Certutil.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Techniques: T1027 T1105

Suspicious Diantz Download and Compress Into a CAB File mediumtest

Author: frack113 · 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · 185d7418-f250-42d0-b72e-0c8b70661e93

Download and compress a remote file and store it in a cab file on local machine.

Techniques: T1105

Download from Suspicious Dyndns Hosts mediumtest

Author: Florian Roth (Nextron Systems) · 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Techniques: T1105 T1568

All 87 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 Windows
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList

AN0220 Linux
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content
auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

Tunable: WebProcList ChildToolList BurstThreshold TimeWindow

AN0221 macOS
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content
macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation
NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

Tunable: ServiceList TimeWindow

AN0222 Containers
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content
docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation
NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

Tunable: IngressNamespaces MetadataEndpoints TimeWindow

AN0223 IaaS
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content
AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

Tunable: LBProjects ErrorBurst

AN0224 ESXi
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content
NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

Tunable: MgmtCIDR TimeWindow

AN0225 Network Devices
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content
NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged `attack.t1190` (149)

Potential CVE-2023-25717 Exploitation Attempt hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Techniques: T1190

CVE tags: CVE-2023-25717

Potential CVE-2021-27905 Exploitation Attempt mediumtest

Author: @gott_cyber · 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Techniques: T1190

CVE tags: CVE-2021-27905

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 criticaltest

Author: Florian Roth (Nextron Systems) · 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Techniques: T1190

CVE tags: CVE-2020-8193CVE-2020-8195

Ruby on Rails Framework Exceptions mediumstable

Author: Thomas Patzke · 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Techniques: T1190

Potential CVE-2023-23752 Exploitation Attempt hightest

Author: Bhabesh Raj · 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Techniques: T1190

CVE tags: CVE-2023-23752

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Terminal Service Process Spawn hightest

Author: Florian Roth (Nextron Systems) · 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Techniques: T1190 T1210

RDS Database Security Group Modification mediumtest

Author: jamesc-grafana · 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015

Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.

Techniques: T1190

Cisco ASA Exploitation Activity - Proxy highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Techniques: T1190

CVE tags: CVE-2025-20333CVE-2025-20362

TerraMaster TOS CVE-2020-28188 hightest

Author: Bhabesh Raj · 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Techniques: T1190

CVE tags: CVE-2020-28188

Potential Server Side Template Injection In Velocity hightest

Author: Moti Harmats · 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Techniques: T1190

CVE-2021-21972 VSphere Exploitation hightest

Author: Bhabesh Raj · 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Techniques: T1190

CVE tags: CVE-2021-21972

Potential OWASSRF Exploitation Attempt - Webserver hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Techniques: T1190

Suspicious User-Agents Related To Recon Tools mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton · 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a

Detects known suspicious (default) user-agents related to scanning/recon tools

Techniques: T1190

Python SQL Exceptions mediumstable

Author: Thomas Patzke · 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9

Generic rule for SQL exceptions in Python according to PEP 249

Techniques: T1190

All 149 rules on the technique page →

T1496 Resource Hijacking secondary impact

DET0267 Resource Hijacking Detection Strategy
AN0741 Windows
Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
Windows:perfmon High sustained CPU usage by a single process → DC0018 Host Status
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TimeWindow DestinationIPList ExecutableNamePatterns

AN0742 Linux
Abnormal CPU/memory usage by unauthorized processes with outbound connections to known mining pools or using cron jobs/scripts to maintain persistence.

auditd:SYSCALL execve → DC0032 Process Creation
linux:procfs Sustained high /proc/[pid]/stat usage → DC0018 Host Status
NSM:Flow Outbound traffic to mining pools or proxies → DC0078 Network Traffic Flow

Tunable: ProcessPath CPUThreshold KnownMiningDomains

AN0743 macOS
Background launch agents/daemons with high CPU use and network access to external mining services.

macos:unifiedlog launchctl activity and process creation → DC0032 Process Creation
macos:unifiedlog Persistent outbound traffic to mining domains → DC0085 Network Traffic Content

Tunable: launchdLabel TrafficVolumeThreshold

AN0744 IaaS
Sudden spikes in cloud VM CPU usage with outbound traffic to mining pools and unauthorized instance creation.

AWS:CloudTrail RunInstances → DC0080 Instance Start
AWS:CloudWatch Sustained EC2 CPU usage above normal baseline → DC0018 Host Status
AWS:VPCFlowLogs Outbound flow logs to known mining pools → DC0078 Network Traffic Flow

Tunable: CPUUtilizationThreshold UnusualRegionList

AN0745 Containers
High CPU usage by unauthorized containers running mining binaries or public proxy tools.

containerd:events New container with suspicious image name or high resource usage → DC0032 Process Creation
prometheus:metrics Container CPU/Memory usage exceeding threshold → DC0018 Host Status
container:cni Outbound network traffic to mining proxies → DC0078 Network Traffic Flow

Tunable: ImageName CPUQuotaThreshold

AN0746 SaaS
Abuse of cloud messaging platforms to send mass spam or consume quota-based resources.

m365:unified SendMessage → DC0069 Cloud Service Modification
saas:application High-volume API calls or traffic via messaging or webhook service → DC0038 Application Log Content

Tunable: MessageRateThreshold APIKeyList

Sigma rules tagged `attack.t1496` (13)

Azure Kubernetes Network Policy Change mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 08d6ac24-c927-4469-b3b7-2e422d6e3c43

Identifies when a Azure Kubernetes network policy is modified or deleted.

Techniques: T1485 T1496 T1489

Azure Kubernetes Service Account Modified or Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2

Identifies when a service account is modified or deleted.

Techniques: T1531 T1485 T1496 T1489

Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 25cb259b-bbdc-4b87-98b7-90d7c72f8743

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Techniques: T1485 T1496 T1489

Potential Crypto Mining Activity highstable

Author: Florian Roth (Nextron Systems) · 2021-10-26 (modified 2023-02-13) · logsource: product=windows category=process_creation · 66c3b204-9f88-4d0a-a7f7-8a57d521ca55

Detects command line parameters or strings often used by crypto miners

Techniques: T1496

Azure Kubernetes Secret or Config Object Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 7ee0b4aa-d8d4-4088-b661-20efdf41a04c

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Techniques: T1485 T1496 T1489

Azure Kubernetes Sensitive Role Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 818fee0c-e0ec-4e45-824e-83e4817b0887

Identifies when ClusterRoles/Roles are being modified or deleted.

Techniques: T1485 T1496 T1489

Linux Crypto Mining Indicators hightest

Author: Florian Roth (Nextron Systems) · 2021-10-26 (modified 2022-12-25) · logsource: product=linux category=process_creation · 9069ea3c-b213-4c52-be13-86506a227ab1

Detects command line parameters or strings often used by crypto miners

Techniques: T1496

Azure Container Registry Created or Deleted lowtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 93e0ef48-37c8-49ed-a02c-038aab23628e

Detects when a Container Registry is created or deleted.

Techniques: T1485 T1496 T1489

Azure Kubernetes Cluster Created or Deleted lowtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 9541f321-7cba-4b43-80fc-fbd1fb922808

Detects when a Azure Kubernetes Cluster is created or deleted.

Techniques: T1485 T1496 T1489

Linux Crypto Mining Pool Connections highstable

Author: Florian Roth (Nextron Systems) · 2021-10-26 · logsource: product=linux category=network_connection · a46c93b7-55ed-4d27-a41b-c259456c4746

Detects process connections to a Monero crypto mining pool

Techniques: T1496

Monero Crypto Coin Mining Pool Lookup highstable

Author: Florian Roth (Nextron Systems) · 2021-10-24 · logsource: category=dns · b593fd50-7335-4682-a36c-4edcb68e4641

Detects suspicious DNS queries to Monero mining pools

Techniques: T1496 T1567

Author: Saw Winn Naung, Azure-Sentinel, @neu5ron · 2021-08-19 (modified 2022-07-07) · logsource: product=zeek service=dns · bf74135c-18e8-4a72-a926-0e4f47888c19

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Techniques: T1569.002 T1496

Network Communication With Crypto Mining Pool highstable

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-10-26 (modified 2026-07-24) · logsource: product=windows category=network_connection · fa5b1358-b040-4403-9868-15f7d9ab6329

Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.

Techniques: T1496

T1557.001 Name Resolution Poisoning and SMB Relay secondary impact

DET0462 Detect LLMNR/NBT-NS Poisoning and SMB Relay on Windows
AN1274 Windows
Detects anomalous network traffic on UDP 5355 (LLMNR) and UDP 137 (NBT-NS) combined with unauthorized SMB relay attempts, registry modifications re-enabling multicast name resolution, or suspicious service creation indicative of adversary-in-the-middle credential interception.

WinEventLog:Security EventCode=4697 → DC0060 Service Creation
WinEventLog:Security Registry key modification HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast → DC0063 Windows Registry Key Modification
NSM:Flow Unusual responses to LLMNR (UDP 5355) or NBT-NS (UDP 137) queries from unauthorized hosts → DC0085 Network Traffic Content
NSM:Flow Abnormal SMB authentication attempts correlated with poisoned LLMNR/NBT-NS sessions → DC0078 Network Traffic Flow

Tunable: TrustedResponderList TimeWindow SMBServiceBaseline

Sigma rules tagged `attack.t1557.001` (10)

Attempts of Kerberos Coercion Via DNS SPN Spoofing highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-20 · logsource: product=windows category=process_creation · 0ed99dda-6a35-11ef-8c99-0242ac120002

Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the `nslookup` command.

Techniques: T1557.001 T1187

RottenPotato Like Attack Pattern hightest

Author: @SBousseaden, Florian Roth · 2019-11-15 (modified 2022-12-22) · logsource: product=windows service=security · 16f5d8ca-44bd-47c8-acbe-6fc95a16c12f

Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

Techniques: T1557.001

Potential PetitPotam Attack Via EFS RPC Calls mediumtest

Author: @neu5ron, @Antonlovesdnb, Mike Remen · 2021-08-17 (modified 2022-11-28) · logsource: product=zeek service=dce_rpc · 4096842a-8f9f-4d36-92b4-d0b2a62f9b2a

Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'

Techniques: T1557.001 T1187

HackTool - Impacket Tools Execution hightest

Author: Florian Roth (Nextron Systems) · 2021-07-24 (modified 2023-02-07) · logsource: product=windows category=process_creation · 4627c6ae-6899-46e2-aa0c-6ebcb1becd19

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

Techniques: T1557.001

Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-20 · logsource: product=zeek service=dns · 5588576c-5898-4fac-bcdd-7475a60e8f43

Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

Techniques: T1557.001 T1187

Potential SMB Relay Attack Tool Execution criticaltest

Author: Florian Roth (Nextron Systems) · 2021-07-24 (modified 2023-02-14) · logsource: product=windows category=process_creation · 5589ab4f-a767-433c-961d-c91f3f704db1

Detects different hacktools used for relay attacks on Windows for privilege escalation

Techniques: T1557.001

WinDivert Driver Load hightest

Author: Florian Roth (Nextron Systems) · 2021-07-30 (modified 2024-11-23) · logsource: product=windows category=driver_load · 679085d5-f427-4484-9f58-1dc30a7c426d

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

Techniques: T1599.001 T1557.001

Local Privilege Escalation Indicator TabTip hightest

Author: Florian Roth (Nextron Systems) · 2022-10-07 (modified 2023-04-14) · logsource: product=windows service=system · bc2e25ed-b92b-4daa-b074-b502bdd1982b

Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode

Techniques: T1557.001

HackTool - ADCSPwn Execution hightest

Author: Florian Roth (Nextron Systems) · 2021-07-31 (modified 2023-02-04) · logsource: product=windows category=process_creation · cd8c163e-a19b-402e-bdd5-419ff5859f12

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

Techniques: T1557.001

Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-20 · logsource: product=windows category=dns_query · e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c

Techniques: T1557.001 T1187

T1571 Non-Standard Port secondary impact

DET0227 Detection Strategy for Non-Standard Ports
AN0633 Windows
Processes initiating outbound connections on uncommon ports or using protocols inconsistent with the assigned port. Correlating process creation with subsequent network connections reveals anomalies such as svchost.exe or Office applications using high, atypical ports.

WinEventLog:Security EventCode=5156, 5157 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: PortThresholds ProcessAllowList TimeWindow

AN0634 Linux
Unusual daemons or user processes binding/listening on ports outside of standard ranges, or initiating client connections using mismatched protocol/port pairings.

auditd:SYSCALL socket/connect syscalls → DC0078 Network Traffic Flow
linux:syslog processes binding to non-standard ports or sshd configured on unexpected port → DC0038 Application Log Content
linux:osquery process listening or connecting on non-standard ports → DC0032 Process Creation

Tunable: AllowedServices PayloadEntropyThreshold

AN0635 macOS
Applications making outbound connections on non-standard ports or launchd services bound to ports inconsistent with system baselines.

macos:unifiedlog outbound TCP/UDP traffic over unexpected port → DC0078 Network Traffic Flow
macos:unifiedlog launchd services binding to non-standard ports → DC0032 Process Creation

Tunable: BaselinePortProfiles

AN0636 ESXi
VM services or management daemons communicating on ports not defined by VMware defaults, such as vpxa or hostd processes initiating traffic over high-numbered or unexpected ports.

esxi:vpxd ESXi service connections on unexpected ports → DC0078 Network Traffic Flow
esxcli:network listening sockets bound to non-standard ports → DC0085 Network Traffic Content

Tunable: ESXiAllowedPorts

Sigma rules tagged `attack.t1571` (5)

Potentially Suspicious Malware Callback Communication hightest

Author: Florian Roth (Nextron Systems) · 2017-03-19 (modified 2024-03-12) · logsource: product=windows category=network_connection · 4b89abaa-99fe-4232-afdd-8f9aa4d20382

Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases

Techniques: T1571

Communication To Uncommon Destination Ports mediumtest

Author: Florian Roth (Nextron Systems) · 2017-03-19 (modified 2024-03-12) · logsource: product=windows category=network_connection · 6d8c3d20-a5e1-494f-8412-4571d716cf5c

Detects programs that connect to uncommon destination ports

Techniques: T1571

Testing Usage of Uncommonly Used Port mediumtest

Author: frack113 · 2022-01-23 · logsource: product=windows category=ps_script · adf876b3-f1f8-4aa9-a4e4-a64106feec06

Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.

Techniques: T1571

Potentially Suspicious Malware Callback Communication - Linux hightest

Author: hasselj · 2024-05-10 · logsource: product=linux category=network_connection · dbfc7c98-04ab-4ab7-aa94-c74d22aa7376

Detects programs that connect to known malware callback ports based on threat intelligence reports.

Techniques: T1571

Suspicious DNS Z Flag Bit Set mediumtest

Author: @neu5ron, SOC Prime Team, Corelight · 2021-05-04 (modified 2022-11-29) · logsource: product=zeek service=dns · ede05abc-2c9e-4624-9944-9ff17fdc0bf5

The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare. Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward. Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering. This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'

Techniques: T1095 T1571

CVE-2023-38035 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1018 Remote System Discovery secondary impact

Sigma rules tagged attack.t1018 (17)

T1046 Network Service Discovery secondary impact

Sigma rules tagged attack.t1046 (20)

T1059 Command and Scripting Interpreter primary impact

Sigma rules tagged attack.t1059 (95)

T1071.001 Web Protocols secondary impact

Sigma rules tagged attack.t1071.001 (42)

T1105 Ingress Tool Transfer secondary impact

Sigma rules tagged attack.t1105 (87)

T1190 Exploit Public-Facing Application exploitation technique

Sigma rules tagged attack.t1190 (149)

T1496 Resource Hijacking secondary impact

Sigma rules tagged attack.t1496 (13)

T1557.001 Name Resolution Poisoning and SMB Relay secondary impact

Sigma rules tagged attack.t1557.001 (10)

T1571 Non-Standard Port secondary impact

Sigma rules tagged attack.t1571 (5)

Sigma rules tagged `attack.t1018` (17)

Sigma rules tagged `attack.t1046` (20)

Sigma rules tagged `attack.t1059` (95)

Sigma rules tagged `attack.t1071.001` (42)

Sigma rules tagged `attack.t1105` (87)

Sigma rules tagged `attack.t1190` (149)

Sigma rules tagged `attack.t1496` (13)

Sigma rules tagged `attack.t1557.001` (10)

Sigma rules tagged `attack.t1571` (5)