Coverage › CVE-2025-24993
CVE-2025-24993 Mapped Sigma
Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability
- Vendor / product
- Microsoft — Windows
- Description (CISA)
- Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.
- Added to KEV
- 2025-03-11
- Due date
- 2025-04-01
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Unknown
- CWE
- CWE-122
- CISA notes
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24993
https://nvd.nist.gov/vuln/detail/CVE-2025-24993 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
5 mapping objects across 5 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1068 Exploitation for Privilege Escalation | exploitation technique | This heap-based buffer overflow vulnerability in Windows NTFS allows an attacker to elevate to SYSTEM-level privileges. This vulnerability can be exploited via malicious virtual hard disk (VHD) files that can be mounted by a system user, leading to code execution. ref 1 |
live |
| T1203 Exploitation for Client Execution | exploitation technique | This heap-based buffer overflow vulnerability in Windows NTFS allows an attacker to elevate to SYSTEM-level privileges. This vulnerability can be exploited via malicious virtual hard disk (VHD) files that can be mounted by a system user, leading to code execution. ref 1 |
live |
| T1204 User Execution | exploitation technique | This heap-based buffer overflow vulnerability in Windows NTFS allows an attacker to elevate to SYSTEM-level privileges. This vulnerability can be exploited via malicious virtual hard disk (VHD) files that can be mounted by a system user, leading to code execution. ref 1 |
live |
| T1055 Process Injection | primary impact | This heap-based buffer overflow vulnerability in Windows NTFS allows an attacker to elevate to SYSTEM-level privileges. This vulnerability can be exploited via malicious virtual hard disk (VHD) files that can be mounted by a system user, leading to code execution. ref 1 |
live |
| T1565 Data Manipulation | secondary impact | This heap-based buffer overflow vulnerability in Windows NTFS allows an attacker to elevate to SYSTEM-level privileges. This vulnerability can be exploited via malicious virtual hard disk (VHD) files that can be mounted by a system user, leading to code execution. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1055 Process Injection primary impact
- DET0508 Behavioral Detection of Process Injection Across Platforms
AN1399 WindowsDetects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.Tunable:
AccessMaskTimeWindowInjectedProcessListAN1400 LinuxDetects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.Tunable:TargetPIDThresholdTimeWindowAN1401 macOSDetects memory-based injection by monitoringtask_for_pid,mach_vm_write, and dylib injection patterns throughDYLD_INSERT_LIBRARIESor manual memory mapping.macos:unifiedlogsubsystem=com.apple.security, library=libsystem_kernel.dylib→ DC0035 Process Accessmacos:endpointsecurityES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP→ DC0034 Process MetadataTunable:TargetProcessSignatureMachSyscallContext
Sigma rules tagged attack.t1055 (37)
Author: Perez Diego (@darkquassar), oscd.community
· 2019-10-27 (modified 2025-12-08) · logsource: product=windows category=create_remote_thread · 02d1d718-dd13-41af-989d-ea85c7fab93f
Detects uncommon processes creating remote threads.
Author: Florian Roth (Nextron Systems)
· 2021-07-30 (modified 2026-06-18) · logsource: product=windows category=pipe_created · 0e7163d4-9e19-4fa7-9be6-000c61aad77a
Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles
Author: frack113
· 2022-12-31 · logsource: product=windows category=image_load · 0fa66f66-e3f6-4a9c-93f8-4f2610b00171
Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.
Author: David Ledbetter (shellcode), Florian Roth (Nextron Systems)
· 2018-11-17 (modified 2024-01-25) · logsource: product=windows category=ps_script · 16b37b70-6fcf-4814-a092-c36bd3aafcbd
Detects Base64 encoded Shellcode
Author: David Burkett, @signalblur
· 2019-12-28 (modified 2022-06-27) · logsource: product=windows category=process_creation · 16c37b52-b141-42a5-a3ea-bbe098444397
It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2024-12-19 · logsource: product=windows category=process_creation · 19b3806e-46f2-4b4c-9337-e3d8653245ea
Detects the execution of more.com and vbc.exe in the process tree.
This behavior was observed by a set of samples related to Lummac Stealer.
The Lummac payload is injected into the vbc.exe process.
Author: Florian Roth (Nextron Systems)
· 2021-03-05 (modified 2022-10-09) · logsource: product=windows category=process_creation · 1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd
Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452
Author: Bhabesh Raj
· 2022-03-11 (modified 2024-07-02) · logsource: product=windows category=process_access · 250ae82f-736e-4844-a68b-0b5e8cc887da
Detects potential shellcode injection as seen used by tools such as Metasploit's migrate and Empire's psinject.
Author: Florian Roth (Nextron Systems)
· 2021-09-07 (modified 2022-10-09) · logsource: product=windows category=image_load · 33a2d1dd-f3b0-40bd-8baf-7974468927cc
Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances
Author: Florian Roth (Nextron Systems)
· 2022-10-14 (modified 2024-08-29) · logsource: product=windows category=process_creation · 396f6630-f3ac-44e3-bfc8-1b161bc00c4e
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
Author: Max Altgelt (Nextron Systems)
· 2022-08-23 (modified 2025-10-08) · logsource: product=windows category=process_creation · 3c1b5fb0-c72f-45ba-abd1-4d4c353144ab
Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
Author: elhoim
· 2022-04-28 (modified 2022-06-02) · logsource: product=windows category=file_event · 409f8a98-4496-4aaa-818a-c931c0a8b832
This rule detects suspicious files created by Microsoft Sync Center (mobsync)
Author: omkar72, oscd.community
· 2020-10-14 (modified 2023-02-23) · logsource: product=windows category=image_load · 4508a70e-97ef-4300-b62b-ff27992990ea
Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.
Author: Florian Roth (Nextron Systems)
· 2023-10-11 · logsource: product=windows category=pipe_created · 4d0083b3-580b-40da-9bba-626c19fe4033
Detects the pattern of a pipe name as used by the hack tool CoercedPotato
Author: Florian Roth (Nextron Systems)
· 2021-08-23 (modified 2023-12-21) · logsource: product=windows category=pipe_created · 637f689e-b4a5-4a86-be0e-0100a0a33ba2
Detects the pattern of a pipe name as used by the hack tool EfsPotato
All 37 rules on the technique page →
T1068 Exploitation for Privilege Escalation exploitation technique
- DET0514 Detection Strategy for Exploitation for Privilege Escalation
AN1419 WindowsDetects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.Tunable:
DriverNamePatternTimeWindowParentProcessPathAN1420 LinuxDetects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.Tunable:SetUIDBinaryListTimeWindowEffectiveUIDThresholdAN1421 macOSDetects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.Tunable:EntitlementListTimeWindowAN1422 ContainersDetects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.Tunable:NamespaceEscapePatternTimeWindow
Sigma rules tagged attack.t1068 (31)
Author: Florian Roth (Nextron Systems)
· 2019-11-20 (modified 2024-12-01) · logsource: product=windows category=process_creation · 02e0b2ea-a597-428e-b04a-af6a1a403e5c
Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-18 (modified 2023-12-02) · logsource: product=windows category=driver_load · 05296024-fe8a-4baf-8f3d-9a5f5624ceb2
Detects loading of known malicious drivers via their hash.
Author: Florian Roth (Nextron Systems)
· 2021-10-09 (modified 2022-12-25) · logsource: product=linux service=auditd · 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed
Detects command line parameter very often used with coin miners
Author: Nisarg Suthar
· 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72
Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
Author: Swachchhanda Shrawn Poudel (Nextron Systems)
· 2025-10-02 (modified 2026-03-31) · logsource: product=linux category=file_event · 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463.
This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations.
When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment,
potentially leading to arbitrary code execution and privilege escalation.
Author: @eyezuhk Isaac Fernandes
· 2025-02-19 · logsource: product=windows category=image_load · 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1
Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.
Author: Florian Roth (Nextron Systems)
· 2017-03-01 (modified 2025-03-17) · logsource: product=linux · 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
Detects buffer overflow attempts in Unix system log files
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-06 · logsource: product=windows category=process_creation · 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments.
Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-03 (modified 2023-12-02) · logsource: product=windows category=driver_load · 39b64854-5497-4b57-a448-40977b8c9679
Detects loading of known malicious drivers via the file name of the drivers.
Author: Florian Roth (Nextron Systems)
· 2021-11-22 (modified 2022-12-25) · logsource: product=windows category=file_event · 3be82d5d-09fe-4d6a-a275-0d40d234d324
Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file
Author: Gene Kazimiarovich
· 2026-04-30 · logsource: product=linux service=auditd · 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94
Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall.
AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431
to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD
splice path that corrupts the page cache of SUID binaries.
Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN
daemons using non-default kernel offload configurations.
Author: Gene Kazimiarovich
· 2026-05-09 · logsource: product=linux category=process_creation · 474b415a-d917-4f3b-8c62-9e1a0d5f7b48
Detects kernel auto-loading of the authencesn crypto module via modprobe
This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher
(e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the
crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation,
where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path,
corrupting the page cache of SUID binaries for local privilege escalation.
On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod)
with 'modprobe' appearing in the command line.
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
All 31 rules on the technique page →
T1203 Exploitation for Client Execution exploitation technique
- DET0287 Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)
AN0797 WindowsCause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.Tunable:
TimeWindowHighRiskChildrenUserPathsAllowedPluginsEgressAllowlistAN0798 LinuxCause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.Tunable:TimeWindowUserPathsHighRiskChildrenPackageUpdatersAN0799 macOSCause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.Tunable:TimeWindowHighRiskChildrenUserPathsQuarantineBypass
Sigma rules tagged attack.t1203 (35)
Author: Florian Roth (Nextron Systems)
· 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19
Detects download of certain file types from hosts in suspicious TLDs
Author: Florian Roth (Nextron Systems)
· 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Arnim Rupp (Nextron Systems)
· 2026-06-15 · logsource: category=antivirus · 101a1877-2cf4-474d-abfd-7f6ac4788d1a
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-31 · logsource: product=windows category=process_creation · 146aace8-9bd6-42ba-be7a-0070d8027b76
Detects potentially suspicious child processes of WinRAR.exe.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 238527ad-3c2c-4e4f-a1f6-92fd63adb864
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: Florian Roth
· 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Sittikorn S, frack113
· 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-12 (modified 2024-03-12) · logsource: product=windows category=network_connection · 3c21219b-49b5-4268-bce6-c914ed50f09c
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-20 · logsource: category=webserver · 41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe
Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0.
CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass,
which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through
template injection. This sequence enables unauthenticated remote code execution, significantly increasing
the impact of exploitation.
Author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-31 · logsource: product=windows category=process_creation · 43259cc4-1b80-4931-bd98-baea01afc196
Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe.
This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-12 (modified 2024-01-31) · logsource: product=windows category=network_connection · 4c5fba4a-9ef6-4f16-823d-606246054741
Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack.
The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
All 35 rules on the technique page →
T1204 User Execution exploitation technique
- DET0478 User Execution – multi-surface behavior chain (documents/links → helper/unpacker → LOLBIN/child → egress)
AN1314 WindowsCause→effect chain: (1) User-facing app (Office/PDF/archiver/browser) records an open/click or abnormal event, then (2) a downloaded file is created in a user-writable path and/or decompressed, (3) the parent user app spawns a living-off-the-land binary (e.g., powershell/cmd/mshta/rundll32/msiexec/wscript/expand/zip) or installer, and (4) immediate outbound HTTP(S)/DNS/SMB from the same lineage.Tunable:
TimeWindowHighRiskParentsHighRiskChildrenUserPathsEgressAllowListAN1315 LinuxCause→effect chain: (1) User app/browser/archiver logs an open/click or abnormal exit, (2) new executable/script/archive extracted into $HOME/Downloads, /tmp, or ~/.cache, (3) parent app spawns shell/interpreter (bash/sh/python/node/curl/wget) or desktop file, and (4) new outbound connection(s) from the child lineage.linux:syslogopened document|clicked link|segfault|abnormal termination|sandbox→ DC0038 Application Log ContentTunable:TimeWindowUserPathsHighRiskChildrenPkgUpdatersAN1316 macOSCause→effect chain: (1) unified logs show application open/click or crash for Safari/Chrome/Office/Preview/archiver, (2) file write/extraction into ~/Downloads, /private/var/folders/* or ~/Library, (3) parent app spawns osascript/bash/zsh/curl/python or opens a quarantined app with Gatekeeper prompts, (4) network egress from child.macos:unifiedlogopened document|clicked link|EXC_BAD_ACCESS|abort|LSQuarantine→ DC0038 Application Log ContentTunable:TimeWindowHighRiskChildrenQuarantineSignalsAN1317 ContainersCause→effect chain in CI/dev desktops: (1) user triggers container run/pull after opening a doc/link/script, (2) newly created image/container uses unexpected external registry or entrypoint, (3) container starts and immediately egresses to suspicious destinations.docker:eventscreated,started: new container from untrusted registry or unexpected entrypoint→ DC0072 Container CreationTunable:TrustedRegistriesAllowedEntrypointsTimeWindowAN1318 IaaSCause→effect chain in cloud consoles: (1) user clicks link then invokes instance/image creation via API, (2) instance/image originates from external AMI or unknown image, (3) instance immediately egresses or retrieves payloads.Tunable:ApprovedImagesUserContextTimeWindow
Sigma rules tagged attack.t1204 (10)
Author: Micah Babinski
· 2023-08-21 · logsource: product=windows category=process_creation · 1412aa78-a24c-4abd-83df-767dfb2c5bbe
Detects possible execution via LNK file accessed on a WebDAV server.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Sreeman
· 2020-03-13 (modified 2022-04-14) · logsource: product=windows category=process_creation · 24de4f3b-804c-4165-b442-5a06a2302c7e
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
Author: Florian Roth (Nextron Systems)
· 2020-08-26 (modified 2025-10-19) · logsource: product=windows category=process_creation · 5325945e-f1f0-406e-97b8-65104d393fff
Detects specific process characteristics of Snatch ransomware word document droppers
Author: Josh Nickels, Michael Taggart
· 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Florian Roth (Nextron Systems)
· 2021-05-14 · logsource: product=windows category=process_creation · 965fff6c-1d7e-4e25-91fd-cdccd75f7d2c
Detects DarkSide Ransomware and helpers
Author: The DFIR Report
· 2025-01-23 · logsource: product=windows category=file_event · b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e
Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.
Author: Markus Neis, @markus_neis, Florian Roth
· 2021-07-04 (modified 2023-06-12) · logsource: product=windows category=registry_event · ba6b9e43-1d45-4d3c-a504-1043a64c8469
Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2021-08-16 (modified 2026-06-15) · logsource: category=antivirus · fa0c05b6-8ad3-468d-8231-c1cbccb64fba
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
T1565 Data Manipulation secondary impact
- DET0059 Detection Strategy for Data Manipulation
AN0162 WindowsCorrelate unauthorized or anomalous file modifications, deletions, or metadata changes with suspicious process execution or API calls. Detect abnormal changes to structured data (e.g., database files, logs, financial records) outside expected business process activity.Tunable:
MonitoredFilePathsTimeWindowAuthorizedProcessesAN0163 LinuxDetect unauthorized manipulation of log files, database entries, or system configuration files through auditd and syslog. Correlate shell commands that alter HISTFILE or data-related processes with abnormal file access patterns.auditd:SYSCALLopen, unlink, rename: Suspicious file access, deletion, or modification of sensitive paths→ DC0061 File Modificationlinux:syslogUnexpected SQL or application log entries showing tampered or malformed data→ DC0085 Network Traffic ContentTunable:WatchedDirectoriesCommandExclusionsAN0164 macOSDetect manipulation of system or application files in/Library,/System, or user data directories using FSEvents and Unified Logs. Identify anomalous process execution modifying plist files, structured data, or logs outside expected update cycles.macos:unifiedlogAnomalous plist modifications or sensitive file overwrites by non-standard processes→ DC0061 File Modificationmacos:osqueryopen, execve: Unexpected processes accessing or modifying critical files→ DC0021 OS API ExecutionTunable:AllowedPlistEditorsFileIntegrityBaseline
Sigma rules tagged attack.t1565 (3)
Author: Sittikorn S
· 2021-06-29 (modified 2021-08-20) · logsource: product=aws service=cloudtrail · 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Author: Austin Songer @austinsonger
· 2021-08-15 (modified 2022-10-09) · logsource: product=gcp service=gcp.audit · 234f9f48-904b-4736-a34c-55d23919e4b7
Identifies when sensitive information is re-identified in google Cloud.
Author: Borna Talebi
· 2021-09-14 (modified 2022-10-09) · logsource: product=windows category=ps_script · 4368354e-1797-463c-bc39-a309effbe8d7
Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace.
This will bypass the default DNS server and uses a specified server for answering the query.