Coverage › CVE-2024-4577

CVE-2024-4577 Mapped Sigma

PHP-CGI OS Command Injection Vulnerability

Vendor / product: PHP Group — PHP
Description (CISA): PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
Added to KEV: 2024-06-12
Due date: 2024-07-03
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Known
CWE: CWE-78
CISA notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://www.php.net/ChangeLog-8.php#
https://nvd.nist.gov/vuln/detail/CVE-2024-4577
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

12 mapping objects across 12 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1190 Exploit Public-Facing Application	exploitation technique	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live
T1003 OS Credential Dumping	secondary impact	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live
T1003.001 LSASS Memory	secondary impact	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live
T1033 System Owner/User Discovery	secondary impact	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live
T1041 Exfiltration Over C2 Channel	secondary impact	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live
T1053 Scheduled Task/Job	secondary impact	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live
T1059 Command and Scripting Interpreter	primary impact	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live
T1068 Exploitation for Privilege Escalation	secondary impact	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live
T1071.001 Web Protocols	secondary impact	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live
T1112 Modify Registry	secondary impact	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live
T1543 Create or Modify System Process	secondary impact	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live
T1570 Lateral Tool Transfer	secondary impact	CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials. ref 1 · ref 2 · ref 3 · ref 4	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1003 OS Credential Dumping secondary impact

DET0234 Credential Dumping via Sensitive Memory and Registry Access Correlation
AN0648 Windows
Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.

WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access
WinEventLog:Security EventCode=4662 → DC0071 Active Directory Object Access

Tunable: AccessMask TimeWindow ParentProcessFilter

AN0649 Linux
Processes opening /proc//mem or /proc//maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.

auditd:SYSCALL open → DC0055 File Access
auditd:SYSCALL ptrace → DC0035 Process Access
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: TargetProcessName ToolProcessName

AN0650 macOS
Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.

macos:unifiedlog Code Execution & Entitlement Access → DC0034 Process Metadata
macos:keychain Access to Keychain DB or system.keychain → DC0055 File Access
macos:osquery Invocation of osascript or dylib injection → DC0032 Process Creation

Tunable: KeychainAccessPath SignedBinaryStatus

Sigma rules tagged `attack.t1003` (37)

Potential Credential Dumping Attempt Using New NetworkProvider - REG mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-08-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0442defa-b4a2-41c9-ae2c-ea7042fc4701

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Techniques: T1003

Potential Invoke-Mimikatz PowerShell Script hightest

Author: Tim Rauch, Elastic (idea) · 2022-09-28 · logsource: product=windows category=ps_script · 189e3b02-82b2-4b90-9662-411eb64486d4

Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.

Techniques: T1003

WCE wceaux.dll Access criticaltest

Author: Thomas Patzke · 2017-06-14 (modified 2025-01-30) · logsource: product=windows service=security · 1de68c67-af5c-4097-9c85-fe5578e09e67

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

Techniques: T1003

Hacktool Execution - Imphash criticaltest

Author: Florian Roth (Nextron Systems) · 2022-03-04 (modified 2024-11-23) · logsource: product=windows category=process_creation · 24e3e58a-646b-4b50-adef-02ef935b9fc8

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Techniques: T1588.002 T1003

Suspicious SYSTEM User Process Creation hightest

Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) · 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Techniques: T1134 T1003 T1027

Microsoft IIS Service Account Password Dumped hightest

Author: Tim Rauch, Janantha Marasinghe, Elastic (original idea) · 2022-11-08 (modified 2023-01-22) · logsource: product=windows category=process_creation · 2d3cdeec-c0db-45b4-aa86-082f7eb75701

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Techniques: T1003

HackTool - Rubeus Execution - ScriptBlock hightest

Author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems) · 2023-04-27 · logsource: product=windows category=ps_script · 3245cd30-e015-40ff-a31d-5cadd5f377ec

Detects the execution of the hacktool Rubeus using specific command line flags

Techniques: T1003 T1558.003 T1550.003

Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 mediumexperimental

Author: Milad Cheraghi · 2026-04-28 · logsource: product=linux category=process_creation · 33b3cfb1-574e-44b9-b527-fbf9303b9d7b

Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2. Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges. These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets. CVE-2025-5054: Information leak via core dumps from SUID binaries using apport. CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.

Techniques: T1548 T1003

CVE tags: CVE-2025-5054CVE-2025-4598

Loaded Module Enumeration Via Tasklist.EXE mediumtest

Author: Swachchhanda Shrawan Poudel · 2024-02-12 (modified 2024-03-13) · logsource: product=windows category=process_creation · 34275eb8-fa19-436b-b959-3d9ecd53fa1f

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

Techniques: T1003

Hacktool Execution - PE Metadata hightest

Author: Florian Roth (Nextron Systems) · 2022-04-27 (modified 2024-01-15) · logsource: product=windows category=process_creation · 37c1333a-a0db-48be-b64b-7393b2386e3b

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Techniques: T1588.002 T1003

OpenCanary - MSSQL Login Attempt Via SQLAuth hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.

Techniques: T1003 T1213

Credential Manager Access By Uncommon Applications mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-11 (modified 2026-07-28) · logsource: product=windows category=file_access · 407aecb1-e762-4acf-8c7b-d087bcff3bb6

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Techniques: T1003

Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-27 (modified 2026-01-09) · logsource: product=windows category=image_load · 416bc4a2-7217-4519-8dc7-c3271817f1d5

Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.

Techniques: T1003 T1685

Linux Keylogging with Pam.d hightest

Author: Pawel Mazur · 2021-05-24 (modified 2022-12-18) · logsource: product=linux service=auditd · 49aae26c-450e-448b-911d-b3c13d178dfc

Detect attempt to enable auditing of TTY input

Techniques: T1003 T1056.001

OpenCanary - REDIS Action Command Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 547dfc53-ebf6-4afe-8d2e-793d9574975d

Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.

Techniques: T1003 T1213

All 37 rules on the technique page →

T1003.001 LSASS Memory secondary impact

DET0363 Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence
AN1030 Windows
A non-privileged or abnormal process attempts to open a handle with full access (0x1F0FFF) to lsass.exe and subsequently invokes memory dump, file creation, or registry modification indicative of credential scraping. This behavior chain reflects staged credential theft activity.

WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Security EventCode=4673 → DC0013 User Account Metadata
WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

Tunable: AccessMask TimeWindow ParentProcessName DumpFilePath CommandLinePattern

Sigma rules tagged `attack.t1003.001` (79)

APT31 Judgement Panda Activity criticaltest

Author: Florian Roth (Nextron Systems) · 2019-02-21 (modified 2023-03-10) · logsource: product=windows category=process_creation · 03e2746e-2b31-42f1-ab7a-eb39365b2422

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

Techniques: T1003.001 T1560.001

HackTool - Impacket File Indicators highexperimental

Author: The DFIR Report, IrishDeath · 2025-05-19 · logsource: product=windows category=file_event · 03f4ca17-de95-428d-a75a-4ee78b047256

Detects file creation events with filename patterns used by Impacket.

Techniques: T1003.001

Mimikatz Use hightest

Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) · 2017-01-10 (modified 2022-01-05) · logsource: product=windows · 06d71506-7beb-4f22-8888-e2e5e2ca7fd8

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Techniques: T1003.002 T1003.004 T1003.001 T1003.006

Time Travel Debugging Utility Usage hightest

Author: Ensar Şamil, @sblmsrsn, @oscd_initiative · 2020-10-06 (modified 2022-10-09) · logsource: product=windows category=process_creation · 0b4ae027-2a2d-4b93-8c7e-962caaba5b2a

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

Techniques: T1218 T1003.001

Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process mediumtest

Author: Perez Diego (@darkquassar), oscd.community, Ecco · 2019-10-27 (modified 2024-03-01) · logsource: product=windows category=image_load · 0e277796-5f23-4e49-a490-483131d4f6e1

Detects the load of dbghelp/dbgcore DLL by a potentially uncommon or potentially suspicious process. The Dbghelp and Dbgcore DLLs export functions that allow for the dump of process memory. Tools like ProcessHacker, Task Manager and some attacker tradecraft use the MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine. Keep in mind that many legitimate Windows processes and services might load the aforementioned DLLs for debugging or other related purposes. Investigate the CommandLine and the Image location of the process loading the DLL.

Techniques: T1003.001

Potential Credential Dumping Attempt Via PowerShell mediumtest

Author: oscd.community, Natalia Shornikova · 2020-10-06 (modified 2023-11-28) · logsource: product=windows category=process_access · 0f920ebe-7aea-4c54-b202-9aa0c609cfe5

Detects a PowerShell process requesting access to "lsass.exe", which can be indicative of potential credential dumping attempts

Techniques: T1003.001

Potential Windows Defender AV Bypass Via Dump64.EXE Rename hightest

Author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-11-26 (modified 2024-06-21) · logsource: product=windows category=process_creation · 129966c9-de17-4334-a123-8b58172e664d

Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.

Techniques: T1003.001

Renamed CreateDump Utility Execution hightest

Author: Florian Roth (Nextron Systems) · 2022-09-20 (modified 2023-02-14) · logsource: product=windows category=process_creation · 1a1ed54a-2ba4-4221-94d5-01dee560d71e

Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory

Techniques: T1036 T1003.001

PPL Tampering Via WerFaultSecure highexperimental

Author: Jason (https://github.com/0xbcf) · 2025-09-23 (modified 2025-11-23) · logsource: product=windows category=process_creation · 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2

Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.

Techniques: T1685 T1003.001

Dumping Process via Sqldumper.exe mediumtest

Author: Kirill Kiryanov, oscd.community · 2020-10-08 (modified 2021-11-27) · logsource: product=windows category=process_creation · 23ceaf5c-b6f1-4a32-8559-f2ff734be516

Detects process dump via legitimate sqldumper.exe binary

Techniques: T1003.001

HackTool - Dumpert Process Dumper Execution criticaltest

Author: Florian Roth (Nextron Systems) · 2020-02-04 (modified 2025-01-22) · logsource: product=windows category=process_creation · 2704ab9e-afe2-4854-a3b1-0c0706d03578

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

Techniques: T1003.001

Procdump Execution mediumtest

Author: Florian Roth (Nextron Systems) · 2021-08-16 (modified 2026-06-29) · logsource: product=windows category=process_creation · 2e65275c-8288-4ab4-aeb7-6274f58b6b20

Detects usage of the SysInternals Procdump utility

Techniques: T1036 T1003.001

Transferring Files with Credential Data via Network Shares - Zeek mediumtest

Author: @neu5ron, Teymur Kheirkhabarov, oscd.community · 2020-04-02 (modified 2021-11-27) · logsource: product=zeek service=smb_files · 2e69f167-47b5-4ae7-a390-47764529eff5

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Techniques: T1003.002 T1003.001 T1003.003

Potential Adplus.EXE Abuse hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-09 (modified 2023-06-23) · logsource: product=windows category=process_creation · 2f869d59-7f6a-4931-992c-cce556ff2d53

Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

Techniques: T1003.001

Lsass Full Dump Request Via DumpType Registry Settings hightest

Author: @pbssubhash · 2022-12-08 (modified 2023-08-17) · logsource: product=windows category=registry_set · 33efc23c-6ea2-4503-8cfe-bdf82ce8f719

Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.

Techniques: T1003.001

All 79 rules on the technique page →

T1033 System Owner/User Discovery secondary impact

DET0093 Behavioral Detection of User Discovery via Local and Remote Enumeration
AN0254 Windows
Adversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell).

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

Tunable: ParentProcessContext TimeWindow UserContext

AN0255 Linux
Adversary runs commands like whoami, id, w, or cat /etc/passwd from non-interactive or scripting contexts to enumerate system user details.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: CommandLineRegex ShellContext AccessFrequency

AN0256 macOS
Adversary uses dscl, who, or environment variables like $USER to identify accounts or sessions via Terminal or malicious LaunchAgents.

macos:unifiedlog subsystem:com.apple.Terminal → DC0064 Command Execution
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation

Tunable: LaunchAgentPersistence CommandExecutionPath UsernameEnumerationPattern

AN0257 Network Devices
Adversary executes CLI commands like show users, show ssh, or attempts to dump AAA user lists from routers or switches.

networkdevice:syslog aaa privilege_exec → DC0021 OS API Execution
networkdevice:syslog eventlog → DC0064 Command Execution

Tunable: CLICommandBaseline DeviceRoleSensitivity CommandFrequencyThreshold

Sigma rules tagged `attack.t1033` (30)

User Discovery And Export Via Get-ADUser Cmdlet mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-09-09 (modified 2022-11-17) · logsource: product=windows category=process_creation · 1114e048-b69c-4f41-bc20-657245ae6e3f

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

Techniques: T1033

ESXi Network Configuration Discovery Via ESXCLI mediumtest

Author: Cedric Maurugeon · 2023-09-04 · logsource: product=linux category=process_creation · 33e814e0-1f00-4e43-9c34-31fb7ae2b174

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

Techniques: T1033 T1007 T1059.012

Suspicious PowerShell Get Current User lowtest

Author: frack113 · 2022-04-04 · logsource: product=windows category=ps_script · 4096a49c-7de4-4da0-a230-c66ccd56ea5a

Detects the use of PowerShell to identify the current logged user.

Techniques: T1033

Computer Discovery And Export Via Get-ADComputer Cmdlet mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-11-10 (modified 2022-11-17) · logsource: product=windows category=process_creation · 435e10e4-992a-4281-96f3-38b11106adde

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Techniques: T1033

Webshell Hacking Activity Patterns hightest

Author: Florian Roth (Nextron Systems) · 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Techniques: T1505.003 T1018 T1033 T1087

Local Accounts Discovery lowtest

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community · 2019-10-21 (modified 2025-10-20) · logsource: product=windows category=process_creation · 502b42de-4306-40b4-9596-6f590c81f073

Local accounts, System Owner/User discovery using operating systems utilities

Techniques: T1033 T1087.001

Possible DCSync Attack hightest

Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · 56fda488-113e-4ce9-8076-afc2457922c3

Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.

Techniques: T1033

ESXi VM List Discovery Via ESXCLI mediumtest

Author: Cedric Maurugeon · 2023-09-04 · logsource: product=linux category=process_creation · 5f1573a7-363b-4114-9208-ad7a61de46eb

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

Techniques: T1033 T1007 T1059.012

SharpHound Recon Sessions hightest

Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · 6d580420-ff3f-4e0e-b6b0-41b90c787e28

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Techniques: T1033

Whoami.EXE Execution From Privileged Process hightest

Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov · 2022-01-28 (modified 2023-12-04) · logsource: product=windows category=process_creation · 79ce34ca-af29-4d0e-b832-fc1b377020db

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

Techniques: T1033

Whoami.EXE Execution Anomaly mediumtest

Author: Florian Roth (Nextron Systems) · 2021-08-12 (modified 2025-03-06) · logsource: product=windows category=process_creation · 8de1cbe8-d6f5-496d-8237-5f44a721c7a0

Detects the execution of whoami.exe with suspicious parent processes.

Techniques: T1033

Get-ADUser Enumeration Using UserAccountControl Flags mediumtest

Author: frack113 · 2022-03-17 · logsource: product=windows category=ps_script · 96c982fe-3d08-4df4-bed2-eb14e02f21c8

Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.

Techniques: T1033

Cisco Discovery lowtest

Author: Austin Clark · 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b

Find information about network devices that is not stored in config files

Techniques: T1083 T1201 T1057 T1018 T1082 T1016 T1049 T1033 T1124

Security Privileges Enumeration Via Whoami.EXE hightest

Author: Florian Roth (Nextron Systems) · 2021-05-05 (modified 2023-02-28) · logsource: product=windows category=process_creation · 97a80ec7-0e2f-4d05-9ef4-65760e634f6b

Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

Techniques: T1033

System Owner or User Discovery - Linux lowtest

Author: Timur Zinniatullin, oscd.community · 2019-10-21 (modified 2025-06-04) · logsource: product=linux service=auditd · 9a0d8ca0-2385-4020-b6c6-cb6153ca56f3

Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Techniques: T1033

All 30 rules on the technique page →

T1041 Exfiltration Over C2 Channel secondary impact

DET0348 Detection Strategy for Exfiltration Over C2 Channel
AN0988 Windows
Identifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
NSM:Flow Flow/PCAP analysis for outbound payloads → DC0085 Network Traffic Content
WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

Tunable: DataVolumeThreshold KnownBenignProcesses

AN0989 Linux
Monitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:SYSCALL connect → DC0082 Network Connection Creation
NSM:Flow conn.log + files.log + ssl.log → DC0085 Network Traffic Content
NSM:Flow session stats with bytes_out > bytes_in → DC0078 Network Traffic Flow

Tunable: OutboundEntropyScore ConnectionDuration

AN0990 macOS
Detects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.

macos:unifiedlog eventMessage = 'open', 'sendto', 'connect' → DC0085 Network Traffic Content
macos:osquery socket_events → DC0078 Network Traffic Flow
macos:osquery process_events → DC0032 Process Creation

Tunable: ParentProcessAncestry ProtocolList

AN0991 ESXi
Detects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.

esxi:vpxa connection attempts and data transmission logs → DC0078 Network Traffic Flow
esxi:vmkernel network stack module logs → DC0085 Network Traffic Content
esxi:syslog guest OS outbound transfer logs → DC0055 File Access

Tunable: GuestOSAllowList TransferSizeThresholdMB ProtocolAllowList

Sigma rules tagged `attack.t1041` (5)

Network Communication Initiated To Portmap.IO Domain mediumtest

Author: Florian Roth (Nextron Systems) · 2024-05-31 · logsource: product=windows category=network_connection · 07837ab9-60e1-481f-a74d-c31fb496a94c

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

Techniques: T1041 T1090.002

Equation Group C2 Communication hightest

Author: Florian Roth (Nextron Systems) · 2017-04-15 (modified 2021-11-27) · logsource: category=firewall · 881834a4-6659-4773-821e-1c151789d873

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

Techniques: T1041

OpenCanary - TFTP Request hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · b4e6b016-a2ac-4759-ad85-8000b300d61e

Detects instances where a TFTP service on an OpenCanary node has had a request.

Techniques: T1041

Tunneling Tool Execution mediumtest

Author: Daniil Yugoslavskiy, oscd.community · 2019-10-24 (modified 2024-01-18) · logsource: product=windows category=process_creation · c75309a3-59f8-4a8d-9c2c-4c927ad50555

Detects the execution of well known tools that can be abused for data exfiltration and tunneling.

Techniques: T1041 T1572 T1071.001

Shai-Hulud NPM Package Malicious Exfiltration via Curl highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983

Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.

Techniques: T1041 T1005

T1053 Scheduled Task/Job secondary impact

DET0094 Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse
AN0258 Windows
Detects creation or modification of scheduled tasks using schtasks.exe, at.exe, or COM objects followed by execution of outlier processes tied to the scheduled job.

WinEventLog:Security EventCode=4698 → DC0001 Scheduled Job Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=2 → DC0061 File Modification

Tunable: TaskAuthor CommandLineRegex ExecutionWindow

AN0259 Linux
Detects creation or modification of cron jobs via crontab, /etc/cron.* directories, or systemd timer units with execution by unusual users or non-standard intervals.

auditd:SYSCALL write, rename → DC0061 File Modification
auditd:SYSCALL execve → DC0032 Process Creation
linux:osquery crontab, systemd_timers → DC0001 Scheduled Job Creation

Tunable: CronSchedulePattern ServiceUser BinaryEntropy

AN0260 macOS
Detects creation or alteration of LaunchAgents or LaunchDaemons with corresponding plist modification followed by execution of associated binaries.

macos:unifiedlog process launch → DC0032 Process Creation
fs:fsusage disk activity on /Library/LaunchAgents or LaunchDaemons → DC0039 File Creation
macos:osquery launchd_jobs → DC0001 Scheduled Job Creation

Tunable: PlistLabel LaunchPath JobRunInterval

AN0261 Containers
Detects unusual use of cron or sleep loops inside containers executing unfamiliar scripts or binaries repeatedly.

auditd:SYSCALL execve → DC0032 Process Creation
containerd:runtime file change monitoring within /etc/cron.*, /tmp, or mounted volumes → DC0061 File Modification

Tunable: ContainerLabel ScriptFrequency ImageSource

AN0262 ESXi
Detects modification of ESXi cron jobs, local.sh scripts, or scheduled API calls to persist custom binaries or shell scripts.

esxi:vmkernel Startup script and task execution logs → DC0001 Scheduled Job Creation
esxi:hostd shell access or job registration → DC0064 Command Execution
esxi:cron manual edits to /etc/rc.local.d/local.sh or cron.d → DC0061 File Modification

Tunable: StartupScriptName ExecutionContext PersistenceInterval

Sigma rules tagged `attack.t1053` (12)

HackTool - CrackMapExec Execution Patterns highstable

Author: Thomas Patzke · 2020-05-22 (modified 2023-11-06) · logsource: product=windows category=process_creation · 058f4380-962d-40a5-afce-50207d36d7e2

Detects various execution patterns of the CrackMapExec pentesting framework

Techniques: T1047 T1053 T1059.003 T1059.001

Remote Schedule Task Lateral Movement via ATSvc hightest

Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · 0fcd1c79-4eeb-4746-aba9-1b458f7a79cb

Detects remote RPC calls to create or execute a scheduled task via ATSvc

Techniques: T1053 T1053.002

HackTool - SharPersist Execution hightest

Author: Florian Roth (Nextron Systems) · 2022-09-15 (modified 2023-02-04) · logsource: product=windows category=process_creation · 26488ad0-f9fd-4536-876f-52fea846a2e4

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

Techniques: T1053

HackTool - CrackMapExec Execution hightest

Author: Florian Roth (Nextron Systems) · 2022-02-25 (modified 2023-03-08) · logsource: product=windows category=process_creation · 42a993dd-bb3e-48c8-b372-4d6684c4106c

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Techniques: T1047 T1053 T1059.003 T1059.001 T1110 T1201

Scheduled TaskCache Change by Uncommon Program hightest

Author: Syed Hasan (@syedhasan009) · 2021-06-18 (modified 2025-10-22) · logsource: product=windows category=registry_set · 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d

Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious

Techniques: T1053 T1053.005

Cisco Modify Configuration mediumtest

Author: Austin Clark · 2019-08-12 (modified 2025-04-28) · logsource: product=cisco service=aaa · 671ffc77-50a7-464f-9e3d-9ea2b493b26b

Modifications to a config that will serve an adversary's impacts or persistence

Techniques: T1490 T1505 T1565.002 T1053

Suspicious Scheduled Task Write to System32 Tasks hightest

Author: Florian Roth (Nextron Systems) · 2021-11-16 (modified 2022-01-12) · logsource: product=windows category=file_event · 80e1f67a-4596-4351-98f5-a9c3efabac95

Detects the creation of tasks from processes executed from suspicious locations

Techniques: T1053

Remote Schedule Task Lateral Movement via ITaskSchedulerService hightest

Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d

Detects remote RPC calls to create or execute a scheduled task

Techniques: T1053 T1053.002

Remote Schedule Task Lateral Movement via SASec hightest

Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · aff229ab-f8cd-447b-b215-084d11e79eb0

Detects remote RPC calls to create or execute a scheduled task via SASec

Techniques: T1053 T1053.002

HAFNIUM Exchange Exploitation Activity criticaltest

Author: Florian Roth (Nextron Systems) · 2021-03-09 (modified 2023-03-09) · logsource: product=windows category=process_creation · bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

Techniques: T1546 T1053

Defrag Deactivation - Security mediumtest

Author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1) · 2019-03-04 (modified 2022-11-27) · logsource: product=windows service=security · c5a178bf-9cfb-4340-b584-e4df39b6a3e7

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Techniques: T1053

Potential ACTINIUM Persistence Activity hightest

Author: Andreas Hunkeler (@Karneades) · 2022-02-07 (modified 2023-03-18) · logsource: product=windows category=process_creation · e1118a8f-82f5-44b3-bb6b-8a284e5df602

Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

Techniques: T1053 T1053.005

T1059 Command and Scripting Interpreter primary impact

DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 Windows
Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: CommandLinePattern ParentProcessName TimeWindow

AN1429 Linux
Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: InterpreterName UserContext ExecutionChainLength

AN1430 macOS
Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

Tunable: LaunchAgentName ScriptName TerminalAppUsage

AN1431 ESXi
Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

esxi:vobd shell session start → DC0064 Command Execution

Tunable: ShellEnabledFlag SSHContext

AN1432 Network Devices
Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

networkdevice:cli shell command → DC0064 Command Execution
networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

Tunable: UserRole DeviceType

Sigma rules tagged `attack.t1059` (95)

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Techniques: T1189 T1203 T1059

Add New Download Source To Winget mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842

Detects usage of winget to add new additional download sources

Techniques: T1059

Potential Arbitrary Command Execution Via FTP.EXE mediumtest

Author: Victor Sergeev, oscd.community · 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Techniques: T1059 T1202

Use of Pcalua For Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Techniques: T1059

Shai-Hulud Malware Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

Techniques: T1059

Script Interpreter Execution From Suspicious Folder hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba

Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.

Techniques: T1059

DNS Request From Windows Script Host lowtest

Author: Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c

Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.

Techniques: T1059

Windows Shell/Scripting Application File Write to Suspicious Folder hightest

Author: Florian Roth (Nextron Systems) · 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43

Detects Windows shells and scripting applications that write files to suspicious folders

Techniques: T1059

Elevated System Shell Spawned From Uncommon Parent Location mediumtest

Author: frack113, Tim Shelton (update fp) · 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Techniques: T1059

DarkGate - Autoit3.EXE File Creation By Uncommon Process mediumtest

Author: Micah Babinski · 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Techniques: T1105 T1059

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) mediumtest

Author: Andreas Braathen (mnemonic.io) · 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Techniques: T1059 T1190

CVE tags: CVE-2023-22518

Ruby Inline Command Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Techniques: T1059

Payload Decoded and Decrypted via Built-in Utilities mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Techniques: T1059 T1204 T1140

Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Techniques: T1059

Renamed PingCastle Binary Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Techniques: T1059 T1202

All 95 rules on the technique page →

T1068 Exploitation for Privilege Escalation secondary impact

DET0514 Detection Strategy for Exploitation for Privilege Escalation
AN1419 Windows
Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

Tunable: DriverNamePattern TimeWindow ParentProcessPath

AN1420 Linux
Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:SYSCALL ACCESS → DC0035 Process Access
auditd:SYSCALL dmesg → DC0016 Module Load

Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold

AN1421 macOS
Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

macos:unifiedlog process:exec and kext load events → DC0032 Process Creation
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

Tunable: EntitlementList TimeWindow

AN1422 Containers
Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

auditd:SYSCALL capset or setns → DC0067 Logon Session Creation
containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged `attack.t1068` (31)

Exploiting CVE-2019-1388 criticalstable

Author: Florian Roth (Nextron Systems) · 2019-11-20 (modified 2024-12-01) · logsource: product=windows category=process_creation · 02e0b2ea-a597-428e-b04a-af6a1a403e5c

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Techniques: T1068

CVE tags: CVE-2019-1388

Malicious Driver Load hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-08-18 (modified 2023-12-02) · logsource: product=windows category=driver_load · 05296024-fe8a-4baf-8f3d-9a5f5624ceb2

Detects loading of known malicious drivers via their hash.

Techniques: T1543.003 T1068

Possible Coin Miner CPU Priority Param criticaltest

Author: Florian Roth (Nextron Systems) · 2021-10-09 (modified 2022-12-25) · logsource: product=linux service=auditd · 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed

Detects command line parameter very often used with coin miners

Techniques: T1068

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation highexperimental

Author: Swachchhanda Shrawn Poudel (Nextron Systems) · 2025-10-02 (modified 2026-03-31) · logsource: product=linux category=file_event · 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d

Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.

Techniques: T1068

CVE tags: CVE-2025-32463

Potential CVE-2024-35250 Exploitation Activity mediumexperimental

Author: @eyezuhk Isaac Fernandes · 2025-02-19 · logsource: product=windows category=image_load · 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1

Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.

Techniques: T1068

CVE tags: CVE-2024-35250

Buffer Overflow Attempts hightest

Author: Florian Roth (Nextron Systems) · 2017-03-01 (modified 2025-03-17) · logsource: product=linux · 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781

Detects buffer overflow attempts in Unix system log files

Techniques: T1068

Exploiting SetupComplete.cmd CVE-2019-1378 hightest

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Techniques: T1068 T1059.003 T1574

CVE tags: CVE-2019-1378

OMIGOD SCX RunAsProvider ExecuteShellCommand hightest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Techniques: T1068 T1190 T1203

HKTL - SharpSuccessor Privilege Escalation Tool Execution highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-06 · logsource: product=windows category=process_creation · 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments. Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.

Techniques: T1068

Malicious Driver Load By Name mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-03 (modified 2023-12-02) · logsource: product=windows category=driver_load · 39b64854-5497-4b57-a448-40977b8c9679

Detects loading of known malicious drivers via the file name of the drivers.

Techniques: T1543.003 T1068

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event criticaltest

Author: Florian Roth (Nextron Systems) · 2021-11-22 (modified 2022-12-25) · logsource: product=windows category=file_event · 3be82d5d-09fe-4d6a-a275-0d40d234d324

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Techniques: T1068

Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator highexperimental

Author: Gene Kazimiarovich · 2026-04-30 · logsource: product=linux service=auditd · 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94

Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall. AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431 to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD splice path that corrupts the page cache of SUID binaries. Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN daemons using non-default kernel offload configurations.

Techniques: T1068

CVE tags: CVE-2026-31431

Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator highexperimental

Author: Gene Kazimiarovich · 2026-05-09 · logsource: product=linux category=process_creation · 474b415a-d917-4f3b-8c62-9e1a0d5f7b48

Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher (e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation, where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path, corrupting the page cache of SUID binaries for local privilege escalation. On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod) with 'modprobe' appearing in the command line.

Techniques: T1068 T1547.006

CVE tags: CVE-2026-31431

Audit CVE Event criticaltest

Author: Florian Roth (Nextron Systems), Zach Mathis · 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Techniques: T1203 T1068 T1211 T1212 T1210 T1499.004

All 31 rules on the technique page →

T1071.001 Web Protocols secondary impact

DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
AN0075 Windows
Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.

NSM:Flow http.log, ssl.log → DC0085 Network Traffic Content
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: ProcessNameExclusions UserAgentAnomalies OutboundByteRatioThreshold

AN0076 Linux
Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.

NSM:Flow http.log, conn.log → DC0085 Network Traffic Content
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: CommandLinePatternMatch BeaconIntervalWindow

AN0077 macOS
Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).

macos:osquery socket_events → DC0078 Network Traffic Flow
macos:unifiedlog log stream --predicate → DC0064 Command Execution

Tunable: SuspiciousParentProcess URIEntropyThreshold

AN0078 ESXi
Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.

NSM:Flow SPAN or port-mirrored HTTP/S → DC0085 Network Traffic Content
esxi:shell /root/.ash_history or /etc/init.d/* → DC0032 Process Creation

Tunable: ShellScriptMatch ExternalConnectionFilter

AN0079 Network Devices
Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.

NSM:Flow http.log, ssl.log, websocket.log → DC0085 Network Traffic Content

Tunable: HeaderEncodingPattern TLSFingerprintMismatch

Sigma rules tagged `attack.t1071.001` (42)

DNS Query To Devtunnels Domain mediumtest

Author: citron_ninja · 2023-10-25 (modified 2023-11-20) · logsource: product=windows category=dns_query · 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1071.001 T1572

HTTP Request With Empty User Agent mediumtest

Author: Florian Roth (Nextron Systems) · 2017-07-08 (modified 2021-11-27) · logsource: category=proxy · 21e44d78-95e7-421b-a464-ffd8395659c4

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Techniques: T1071.001

PwnDrp Access criticaltest

Author: Florian Roth (Nextron Systems) · 2020-04-15 (modified 2021-11-27) · logsource: category=proxy · 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Techniques: T1071.001 T1102.001 T1102.003

Renamed Visual Studio Code Tunnel Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-09-28 (modified 2025-10-29) · logsource: product=windows category=process_creation · 2cf29f11-e356-4f61-98c0-1bdb9393d6da

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Techniques: T1071.001 T1219

HackTool - BabyShark Agent Default URL Pattern criticaltest

Author: Florian Roth (Nextron Systems) · 2021-06-09 (modified 2024-02-15) · logsource: category=proxy · 304810ed-8853-437f-9e36-c4975c3dfd7e

Detects Baby Shark C2 Framework default communication patterns

Techniques: T1071.001

Visual Studio Code Tunnel Service Installation mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-10-25 · logsource: product=windows category=process_creation · 30bf1789-379d-4fdc-900f-55cd0a90a801

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Techniques: T1071.001

Curl.EXE Execution With Custom UserAgent mediumtest

Author: frack113 · 2022-01-23 (modified 2023-02-21) · logsource: product=windows category=process_creation · 3286d37a-00fd-41c2-a624-a672dcd34e60

Detects execution of curl.exe with custom useragent options

Techniques: T1071.001

Outbound Network Connection Initiated By Microsoft Dialer hightest

Author: CertainlyP · 2024-04-26 · logsource: product=windows category=network_connection · 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

Techniques: T1071.001

Wannacry Killswitch Domain hightest

Author: Mike Wade · 2020-09-16 (modified 2022-03-24) · logsource: category=dns · 3eaf6218-3bed-4d8a-8707-274096f12a18

Detects wannacry killswitch domain dns queries

Techniques: T1071.001

Raw Paste Service Access hightest

Author: Florian Roth (Nextron Systems) · 2019-12-05 (modified 2023-01-19) · logsource: category=proxy · 5468045b-4fcc-4d1a-973c-c9c9578edacb

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Techniques: T1071.001 T1102.001 T1102.003

APT40 Dropbox Tool User Agent hightest

Author: Thomas Patzke · 2019-11-12 (modified 2023-05-18) · logsource: category=proxy · 5ba715b6-71b7-44fd-8245-f66893e81b3d

Detects suspicious user agent string of APT40 Dropbox tool

Techniques: T1071.001 T1567.002

Malware User Agent hightest

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2017-07-08 (modified 2024-04-14) · logsource: category=proxy · 5c84856b-55a5-45f1-826f-13f37250cf4e

Detects suspicious user agent strings used by malware in proxy logs

Techniques: T1071.001

APT User Agent hightest

Author: Florian Roth (Nextron Systems), Markus Neis · 2019-11-12 (modified 2024-02-15) · logsource: category=proxy · 6ec820f2-e963-4801-9127-d8b2dce4d31b

Detects suspicious user agent strings used in APT malware in proxy logs

Techniques: T1071.001

Suspicious User Agent hightest

Author: Florian Roth (Nextron Systems) · 2017-07-08 (modified 2022-10-31) · logsource: category=proxy · 7195a772-4b3f-43a4-a210-6a003d65caa1

Detects suspicious malformed user agent strings in proxy logs

Techniques: T1071.001

Axios NPM Compromise Malicious C2 Domain DNS Query highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: category=dns · 73e5d24f-493f-4092-bd2f-c72cabda40ee

Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.

Techniques: T1071.001 T1568

All 42 rules on the technique page →

T1112 Modify Registry secondary impact

DET0280 Behavior-Based Registry Modification Detection on Windows
AN0781 Windows
Behavior chain involving abnormal registry modifications via CLI, PowerShell, WMI, or direct API calls, especially targeting persistence, privilege escalation, or defense evasion keys, potentially followed by service restart or process execution. Such as editing Notify/Userinit/Startup keys, or disabling SafeDllSearchMode.

WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: RegistryKeyPathPatterns ParentProcessAllowList TimeWindow SignatureCheck

Sigma rules tagged `attack.t1112` (96)

DNS-over-HTTPS Enabled by Registry mediumtest

Author: Austin Songer · 2021-07-22 (modified 2023-08-17) · logsource: product=windows category=registry_set · 04b45a8a-d11d-49e4-9acc-4a1b524407a5

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

Techniques: T1140 T1112

Terminal Server Client Connection History Cleared - Registry hightest

Author: Christian Burkard (Nextron Systems) · 2021-10-19 (modified 2023-02-08) · logsource: product=windows category=registry_delete · 07bdd2f5-9c58-4f38-aec8-e101bb79ef8d

Detects the deletion of registry keys containing the MSTSC connection history

Techniques: T1070 T1112

Imports Registry Key From an ADS hightest

Author: Oddvar Moe, Sander Wiebing, oscd.community · 2020-10-12 (modified 2024-03-13) · logsource: product=windows category=process_creation · 0b80ade5-6997-4b1d-99a1-71701778ea61

Detects the import of a alternate datastream to the registry with regedit.exe.

Techniques: T1112

Activate Suppression of Windows Security Center Notifications mediumtest

Author: frack113 · 2022-08-19 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0c93308a-3f1b-40a9-b649-57ea1a1c1d63

Detect set Notification_Suppress to 1 to disable the Windows security center notification

Techniques: T1112

Potential Tampering With RDP Related Registry Keys Via Reg.EXE hightest

Author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport · 2022-02-12 (modified 2025-11-22) · logsource: product=windows category=process_creation · 0d5675be-bc88-4172-86d3-1e96a4476536

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Techniques: T1021.001 T1112

Potential Raspberry Robin Registry Set Internet Settings ZoneMap lowtest

Author: Swachchhanda Shrawan Poudel · 2024-07-31 · logsource: product=windows category=registry_set · 16a4c7b3-4681-49d0-8d58-3e9b796dcb43

Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.

Techniques: T1112

Sysmon Channel Reference Deletion hightest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-07-14 (modified 2025-10-22) · logsource: product=windows service=security · 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc

Potential threat actor tampering with Sysmon manifest and eventually disabling it

Techniques: T1112

Run Once Task Execution as Configured in Registry lowtest

Author: Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated) · 2020-10-18 (modified 2022-12-13) · logsource: product=windows category=process_creation · 198effb6-6c98-4d0c-9ea3-451fa143c45c

This rule detects the execution of Run Once task as configured in the registry

Techniques: T1112

Wdigest CredGuard Registry Modification hightest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2019-08-25 (modified 2021-11-27) · logsource: product=windows category=registry_event · 1a2d6c47-75b0-45bd-b133-2c0be75349fd

Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials.

Techniques: T1112

Security Event Logging Disabled via MiniNt Registry Key - Process highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-04-09 · logsource: product=windows category=process_creation · 1a4bd6af-99ac-4466-b5b2-7b72b4a05462

Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.

Techniques: T1685.001 T1112

Trust Access Disable For VBApplications hightest

Author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems) · 2020-05-22 (modified 2023-08-17) · logsource: product=windows category=registry_set · 1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf

Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.

Techniques: T1112

Registry Explorer Policy Modification mediumtest

Author: frack113 · 2022-03-18 (modified 2023-08-17) · logsource: product=windows category=registry_set · 1c3121ed-041b-4d97-a075-07f54f20fb4a

Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)

Techniques: T1112

Potential Qakbot Registry Activity hightest

Author: Hieu Tran · 2023-03-13 · logsource: product=windows category=registry_event · 1c8e96cd-2bed-487d-9de0-b46c90cade56

Detects a registry key used by IceID in a campaign that distributes malicious OneNote files

Techniques: T1112

Potential NetWire RAT Activity - Registry hightest

Author: Christopher Peacock · 2021-10-07 (modified 2025-11-03) · logsource: product=windows category=registry_add · 1d218616-71b0-4c40-855b-9dbe75510f7f

Detects registry keys related to NetWire RAT

Techniques: T1112

Potential Ursnif Malware Activity - Registry hightest

Author: megan201296 · 2019-02-13 (modified 2025-10-22) · logsource: product=windows category=registry_add · 21f17060-b282-4249-ade0-589ea3591558

Detects registry keys related to Ursnif malware.

Techniques: T1112

All 96 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 Windows
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList

AN0220 Linux
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content
auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

Tunable: WebProcList ChildToolList BurstThreshold TimeWindow

AN0221 macOS
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content
macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation
NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

Tunable: ServiceList TimeWindow

AN0222 Containers
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content
docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation
NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

Tunable: IngressNamespaces MetadataEndpoints TimeWindow

AN0223 IaaS
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content
AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

Tunable: LBProjects ErrorBurst

AN0224 ESXi
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content
NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

Tunable: MgmtCIDR TimeWindow

AN0225 Network Devices
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content
NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged `attack.t1190` (149)

Potential CVE-2023-25717 Exploitation Attempt hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Techniques: T1190

CVE tags: CVE-2023-25717

Potential CVE-2021-27905 Exploitation Attempt mediumtest

Author: @gott_cyber · 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Techniques: T1190

CVE tags: CVE-2021-27905

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 criticaltest

Author: Florian Roth (Nextron Systems) · 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Techniques: T1190

CVE tags: CVE-2020-8193CVE-2020-8195

Ruby on Rails Framework Exceptions mediumstable

Author: Thomas Patzke · 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Techniques: T1190

Potential CVE-2023-23752 Exploitation Attempt hightest

Author: Bhabesh Raj · 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Techniques: T1190

CVE tags: CVE-2023-23752

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Terminal Service Process Spawn hightest

Author: Florian Roth (Nextron Systems) · 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Techniques: T1190 T1210

RDS Database Security Group Modification mediumtest

Author: jamesc-grafana · 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015

Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.

Techniques: T1190

Cisco ASA Exploitation Activity - Proxy highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Techniques: T1190

CVE tags: CVE-2025-20333CVE-2025-20362

TerraMaster TOS CVE-2020-28188 hightest

Author: Bhabesh Raj · 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Techniques: T1190

CVE tags: CVE-2020-28188

Potential Server Side Template Injection In Velocity hightest

Author: Moti Harmats · 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Techniques: T1190

CVE-2021-21972 VSphere Exploitation hightest

Author: Bhabesh Raj · 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Techniques: T1190

CVE tags: CVE-2021-21972

Potential OWASSRF Exploitation Attempt - Webserver hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Techniques: T1190

Suspicious User-Agents Related To Recon Tools mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton · 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a

Detects known suspicious (default) user-agents related to scanning/recon tools

Techniques: T1190

Python SQL Exceptions mediumstable

Author: Thomas Patzke · 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9

Generic rule for SQL exceptions in Python according to PEP 249

Techniques: T1190

All 149 rules on the technique page →

T1543 Create or Modify System Process secondary impact

DET0571 Detection of System Process Creation or Modification Across Platforms
AN1575 Windows
Detects command-line or API-based creation/modification of Windows Services via sc.exe, powershell.exe, services.exe, or ChangeServiceConfig. Looks for creation/modification of autostart services via registry changes, file drops to System32\services, and anomalous parent-child process trees.

WinEventLog:Security EventCode=4697 → DC0060 Service Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

Tunable: ServiceNamePattern ParentProcessFilter RegistryPathList

AN1576 Linux
Detects creation or modification of systemd service units, addition of cron jobs that invoke binaries on boot, or suspicious writes to /etc/init.d/. Monitors chmod +x and systemctl execution paths, especially from non-root parent processes.

auditd:SYSCALL write or rename to /etc/systemd/system or /etc/init.d → DC0061 File Modification
auditd:SYSCALL execution of systemctl or service with enable/start/modify → DC0064 Command Execution

Tunable: ServicePathRegex UserContextList CommandNameList

AN1577 macOS
Detects creation or modification of LaunchDaemon or LaunchAgent plist files under /Library/LaunchDaemons/, ~/Library/LaunchAgents/, or similar. Monitors execution of launchctl, property list edits, and file permission changes.

macos:unifiedlog launchctl load/unload or plist file modification → DC0064 Command Execution
fs:fsusage file write to launchd plist paths → DC0061 File Modification

Tunable: PlistPathList PlistKeyMonitor UnsignedBinaryAlert

AN1578 Containers
Detects creation of new container system processes via docker run --restart, kubectl exec to init containers, or modification of container init specs. Flags container images that override entrypoints to embed persistence behaviors.

docker:events docker run with restart=always or modifying init → DC0072 Container Creation
auditd:SYSCALL modification of entrypoint scripts or init containers → DC0061 File Modification

Tunable: EntrypointOverridePattern RestartPolicyMatch KubeInitModPath

Sigma rules tagged `attack.t1543` (9)

PUA - System Informer Driver Load mediumtest

Author: Florian Roth (Nextron Systems) · 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=driver_load · 10cb6535-b31d-4512-9962-513dcbc42cc1

Detects driver load of the System Informer tool

Techniques: T1543

PUA - System Informer Execution mediumtest

Author: Florian Roth (Nextron Systems) · 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 5722dff1-4bdd-4949-86ab-fbaf707e767a

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Techniques: T1082 T1564 T1543

PUA - Process Hacker Driver Load hightest

Author: Florian Roth (Nextron Systems) · 2022-11-16 (modified 2024-11-23) · logsource: product=windows category=driver_load · 67add051-9ee7-4ad3-93ba-42935615ae8d

Detects driver load of the Process Hacker tool

Techniques: T1543

CVE tags: CVE-2021-21551

Service Installed By Unusual Client - System hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-15 (modified 2023-01-04) · logsource: product=windows service=system · 71c276aa-49cd-43d2-b920-2dcd3e6962d5

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Techniques: T1543

PUA - Process Hacker Execution mediumtest

Author: Florian Roth (Nextron Systems) · 2022-10-10 (modified 2024-11-23) · logsource: product=windows category=process_creation · 811e0002-b13b-4a15-9d00-a613fce66e42

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

Techniques: T1622 T1564 T1543

CodeIntegrity - Blocked Driver Load With Revoked Certificate hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-06 · logsource: product=windows service=codeintegrity-operational · 9b72b82d-f1c5-4632-b589-187159bc6ec1

Detects blocked load attempts of revoked drivers

Techniques: T1543

Service Installed By Unusual Client - Security hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-15 (modified 2023-01-04) · logsource: product=windows service=security · c4e92a97-a9ff-4392-9d2d-7a4c642768ca

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Techniques: T1543

CodeIntegrity - Blocked Image/Driver Load For Policy Violation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-11-10 (modified 2023-06-07) · logsource: product=windows service=codeintegrity-operational · e4be5675-4a53-426a-8c81-a8bb2387e947

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Techniques: T1543

KrbRelayUp Service Installation hightest

Author: Sittikorn S, Tim Shelton · 2022-05-11 (modified 2022-10-05) · logsource: product=windows service=system · e97d9903-53b2-41fc-8cb9-889ed4093e80

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Techniques: T1543

T1570 Lateral Tool Transfer secondary impact

DET0183 Detection Strategy for Lateral Tool Transfer across OS platforms
AN0516 Windows
Correlate suspicious file transfers over SMB or Admin$ shares with process creation events (e.g., cmd.exe, powershell.exe, certutil.exe) that do not align with normal administrative behavior. Detect remote file writes followed by execution of transferred binaries.

WinEventLog:Security EventCode=5140 → DC0102 Network Share Access
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: TimeWindow UserContext FilePathWhitelist

AN0517 Linux
Monitor scp, rsync, curl, sftp, or ftp processes initiating transfers to internal systems combined with file creation events in unusual directories. Correlate transfer activity with subsequent execution of those binaries.

auditd:SYSCALL execve: Invocation of scp, rsync, curl, or sftp → DC0064 Command Execution
auditd:FILE create: New file created in system binaries or temp directories → DC0039 File Creation

Tunable: AllowedTools DestinationDirectories

AN0518 macOS
Detect anomalous use of scp, rsync, curl, or third-party sync apps transferring executables into user directories. Correlate new file creation with immediate execution events.

macos:unifiedlog Execution of scp, rsync, curl with remote destination → DC0032 Process Creation
macos:unifiedlog File created in ~/Library/LaunchAgents or executable directories → DC0039 File Creation

Tunable: SyncApplications EntropyThreshold

AN0519 ESXi
Identify lateral transfer via datastore file uploads or internal scp/ssh sessions that result in new VMX/VMDK or script files. Correlate transfer with VM execution or datastore modification.

esxi:vmkernel Upload of file to datastore → DC0059 File Metadata
esxi:hostd scp/ssh used to move file across hosts → DC0064 Command Execution

Tunable: DatastoreWhitelist TransferProtocol

Sigma rules tagged `attack.t1570` (6)

SMB over QUIC Via Net.EXE mediumtest

Author: frack113 · 2023-07-21 · logsource: product=windows category=process_creation · 2238d337-42fb-4971-9a68-63570f2aede4

Detects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enterprise environments.

Techniques: T1570

PSEXEC Remote Execution File Artefact hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-21 (modified 2023-02-23) · logsource: product=windows category=file_event · 304afd73-55a5-4bb9-8c21-0b1fc84ea9e4

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Techniques: T1136.002 T1543.003 T1570

Rundll32 Execution Without Parameters hightest

Author: Bartlomiej Czyz, Relativity · 2021-01-31 (modified 2023-02-28) · logsource: product=windows category=process_creation · 5bb68627-3198-40ca-b458-49f973db8752

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

Techniques: T1021.002 T1570 T1569.002

SMB over QUIC Via PowerShell Script mediumtest

Author: frack113 · 2023-07-21 · logsource: product=windows category=ps_script · 6df07c3b-8456-4f8b-87bb-fe31ec964cae

Detects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enterprise environments

Techniques: T1570

Metasploit Or Impacket Service Installation Via SMB PsExec hightest

Author: Bartlomiej Czyz, Relativity · 2021-01-21 (modified 2022-10-05) · logsource: product=windows service=security · 6fb63b40-e02a-403e-9ffd-3bcc1d749442

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Techniques: T1021.002 T1570 T1569.002

Potentially Suspicious File Creation by OpenEDR's ITSMService mediumexperimental

Author: @kostastsale · 2026-02-19 · logsource: product=windows category=file_event · 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d

Detects the creation of potentially suspicious files by OpenEDR's ITSMService process. The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features. While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.

Techniques: T1105 T1570 T1219

CVE-2024-4577 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1003 OS Credential Dumping secondary impact

Sigma rules tagged attack.t1003 (37)

T1003.001 LSASS Memory secondary impact

Sigma rules tagged attack.t1003.001 (79)

T1033 System Owner/User Discovery secondary impact

Sigma rules tagged attack.t1033 (30)

T1041 Exfiltration Over C2 Channel secondary impact

Sigma rules tagged attack.t1041 (5)

T1053 Scheduled Task/Job secondary impact

Sigma rules tagged attack.t1053 (12)

T1059 Command and Scripting Interpreter primary impact

Sigma rules tagged attack.t1059 (95)

T1068 Exploitation for Privilege Escalation secondary impact

Sigma rules tagged attack.t1068 (31)

T1071.001 Web Protocols secondary impact

Sigma rules tagged attack.t1071.001 (42)

T1112 Modify Registry secondary impact

Sigma rules tagged attack.t1112 (96)

T1190 Exploit Public-Facing Application exploitation technique

Sigma rules tagged attack.t1190 (149)

T1543 Create or Modify System Process secondary impact

Sigma rules tagged attack.t1543 (9)

T1570 Lateral Tool Transfer secondary impact

Sigma rules tagged attack.t1570 (6)

Sigma rules tagged `attack.t1003` (37)

Sigma rules tagged `attack.t1003.001` (79)

Sigma rules tagged `attack.t1033` (30)

Sigma rules tagged `attack.t1041` (5)

Sigma rules tagged `attack.t1053` (12)

Sigma rules tagged `attack.t1059` (95)

Sigma rules tagged `attack.t1068` (31)

Sigma rules tagged `attack.t1071.001` (42)

Sigma rules tagged `attack.t1112` (96)

Sigma rules tagged `attack.t1190` (149)

Sigma rules tagged `attack.t1543` (9)

Sigma rules tagged `attack.t1570` (6)