CmdID / Rules
Sigma rules
The 1614 Sigma process creation rules CmdID checks every command line against, from SigmaHQ, each by its named authors under the Detection Rule License 1.1. Each page has what the rule looks for, its techniques and the everyday command lines that trip it. To see which rules a command line trips, paste it into CmdID.
Windows
APT27 - Emissary Panda Activitycritical · T1574.001APT29 2018 Phishing Campaign CommandLine Indicatorscritical · T1218.011APT31 Judgement Panda Activitycritical · T1003.001 · T1560.001COLDSTEEL RAT Cleanup Command ExecutioncriticalCOLDSTEEL RAT Service Persistence ExecutioncriticalDarkSide Ransomware Patterncritical · T1204DNS RCE CVE-2020-1350critical · T1190 · T1569.002DumpStack.log Defender EvasioncriticalElise Backdoor Activitycritical · T1059.003Equation Group DLL_U Export Function Loadcritical · T1218.011EvilNum APT Golden Chickens Deployment Via OCX Filescritical · T1218.011Exploit for CVE-2015-1641critical · T1036.005Exploit for CVE-2017-8759critical · T1203 · T1204.002 · T1566.001Exploiting CVE-2019-1388critical · T1068Greenbug Espionage Group Indicatorscritical · T1036.005 · T1059.001 · T1105Griffon Malware Attack PatterncriticalHackTool - DInjector PowerShell Cradle Executioncritical · T1055HackTool - Dumpert Process Dumper Executioncritical · T1003.001HackTool - Empire PowerShell UAC Bypasscritical · T1548.002HackTool - F-Secure C3 Load by Rundll32critical · T1218.011HackTool - Inveigh Executioncritical · T1003.001HackTool - PurpleSharp Executioncritical · T1587HackTool - Rubeus Executioncritical · T1003 · T1550.003 · T1558.003HackTool - SafetyKatz Executioncritical · T1003.001HackTool - SecurityXploded Executioncritical · T1555HackTool - SharpUp PrivEsc Tool Executioncritical · T1569.002 · T1574.005 · T1615HackTool - Sliver C2 Implant Activity Patterncritical · T1059HackTool - SysmonEOP Executioncritical · T1068HackTool - Windows Credential Editor (WCE) Executioncritical · T1003.001HAFNIUM Exchange Exploitation Activitycritical · T1053 · T1546Lazarus Group Activitycritical · T1059LockerGoga Ransomware Activitycritical · T1486Mint Sandstorm - AsperaFaspex Suspicious Process ExecutioncriticalMint Sandstorm - ManageEngine Suspicious Process ExecutioncriticalNotPetya Ransomware Activitycritical · T1003.001 · T1218.011 · T1685.005OilRig APT Activitycritical · T1053.005 · T1071.004 · T1112 · T1543.003Persistence Via Sticky Key Backdoorcritical · T1546.008Potential Conti Ransomware Activitycritical · T1486Potential Credential Dumping Via LSASS Process Clonecritical · T1003 · T1003.001Potential CVE-2021-41379 Exploitation Attemptcritical · T1068Potential Dridex Activitycritical · T1033 · T1055 · T1135Potential Dtrack RAT Activitycritical · T1490Potential Emotet Rundll32 Executioncritical · T1218.011Potential Maze Ransomware Activitycritical · T1047 · T1204.002 · T1490Potential QBot Activitycritical · T1059.005Potential Russian APT Credential Theft Activitycritical · T1003.003 · T1552.001Potential SMB Relay Attack Tool Executioncritical · T1557.001Potential SystemNightmare Exploitation Attemptcritical · T1068Qakbot Rundll32 Exports ExecutioncriticalQakbot Rundll32 Fake DLL Extension ExecutioncriticalRenamed Whoami Executioncritical · T1033REvil Kaseya Incident Malware Patternscritical · T1059Rorschach Ransomware Execution Activitycritical · T1059.001 · T1059.003Serv-U Exploitation CVE-2021-35211 by DEV-0322critical · T1136.001Sticky Key Like Backdoor Executioncritical · T1546.008Suspicious Child Process Of Veeam DabatasecriticalSuspicious PowerShell Mailbox Export to SharecriticalTrustedPath UAC Bypass Patterncritical · T1548.002Turla Group Commands May 2020critical · T1027 · T1053.005 · T1059.001Turla Group Lateral Movementcritical · T1021.002 · T1059 · T1083 · T1135UNC2452 PowerShell Patterncritical · T1047 · T1059.001WannaCry Ransomware Activitycritical · T1083 · T1210 · T1222.001 · T1486 · T1490Winnti Malware HK University Campaigncritical · T1574.001Winnti Pipemon Characteristicscritical · T1574.001WMI Backdoor Exchange Transport Agentcritical · T1546.003ZxShell Malwarecritical · T1059.003 · T1218.011AADInternals PowerShell Cmdlets Execution - ProccessCreationhighAbuse of Service Permissions to Hide Services Via Set-Servicehigh · T1574.011Abused Debug Privilege by Arbitrary Parent Processeshigh · T1548Add Insecure Download Source To Wingethigh · T1059Add SafeBoot Keys Via Reg Utilityhigh · T1685Adwind RAT / JRAThigh · T1059.005 · T1059.007All Backups Deleted Via Wbadmin.EXEhigh · T1490Allow Service Access Using Security Descriptor Tampering Via Sc.EXEhigh · T1543.003Arbitrary File Download Via IMEWDBLD.EXEhigh · T1218Attempts of Kerberos Coercion Via DNS SPN Spoofinghigh · T1187 · T1557.001Audit Policy Tampering Via Auditpolhigh · T1685.001Audit Policy Tampering Via NT Resource Kit Auditpolhigh · T1685.001Axios NPM Compromise Indicators - Windowshigh · T1059.003 · T1059.005 · T1105 · T1195.002Bad Opsec Defaults Sacrificial Processes With Improper Argumentshigh · T1218.011Base64 Encoded PowerShell Command Detectedhigh · T1027 · T1059.001 · T1140Base64 MZ Header In CommandLinehighBlue Mockingbirdhigh · T1047 · T1112Boot Configuration Tampering Via Bcdedit.EXEhigh · T1490Bypass UAC via CMSTPhigh · T1218.003 · T1548.002Bypass UAC via WSReset.exehigh · T1548.002Cab File Extraction Via Wusa.EXE From Potentially Suspicious PathshighChange Default File Association To Executable Via Assochigh · T1546.001Chopper Webshell Process Patternhigh · T1018 · T1033 · T1087 · T1505.003ChromeLoader Malware Executionhigh · T1053.005 · T1059.001 · T1176Chromium Browser Headless Execution To Mockbin Like SitehighCmd.EXE Missing Space Characters Execution Anomalyhigh · T1059.001CobaltStrike Load by Rundll32high · T1218.011Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)high · T1190Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)high · T1505.003Conhost.exe CommandLine Path Traversalhigh · T1059.003Conti NTDS Exfiltration Commandhigh · T1560Conti Volume Shadow Listinghigh · T1587.001Control Panel Itemshigh · T1218.002 · T1546Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXEhighCopy From VolumeShadowCopy Via Cmd.EXEhigh · T1490Copying Sensitive Files with Credential Datahigh · T1003.002 · T1003.003CreateDump Process Dumphigh · T1003.001 · T1036Csc.EXE Execution Form Potentially Suspicious Parenthigh · T1027.004 · T1059.005 · T1059.007 · T1218.005Cscript/Wscript Uncommon Script Extension Executionhigh · T1059.005 · T1059.007Curl Download And Execute Combinationhigh · T1105 · T1218Curl File Upload To File Sharing Websiteshigh · T1567.002CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Processhigh · T1203CVE-2024-50623 Exploitation Attempt - Cleohigh · T1190DarkGate - Autoit3.EXE Execution Parametershigh · T1059DarkGate - User Created Via Net.EXEhigh · T1136.001Delete All Scheduled Taskshigh · T1489Delete Important Scheduled Taskhigh · T1489Deletion of Volume Shadow Copies via WMI with PowerShellhigh · T1490Deny Service Access Using Security Descriptor Tampering Via Sc.EXEhigh · T1543.003Devcon Execution Disabling VMware VMCI Devicehigh · T1543.003 · T1685Devtoolslauncher.exe Executes Specified Binaryhigh · T1218Diamond Sleet APT Process Activity IndicatorshighDisable Important Scheduled Taskhigh · T1489Disable Windows Defender AV Security Monitoringhigh · T1685Disable Windows IIS HTTP Logginghigh · T1685.001Disabled IE Security Featureshigh · T1685Disabled Volume Snapshotshigh · T1685Disabling Windows Defender WMI Autologger Session via Reg.exehigh · T1685DLL Sideloading by VMware Xfer Utilityhigh · T1574.001Dllhost.EXE Execution Anomalyhigh · T1055DNS Exfiltration and Tunneling Tools Executionhigh · T1048.001 · T1071.004 · T1132.001DSInternals Suspicious PowerShell Cmdletshigh · T1059.001Dumping of Sensitive Hives Via Reg.EXEhigh · T1003.002 · T1003.004 · T1003.005Email Exifiltration Via PowershellhighEmotet Loader Execution Via .LNK Filehigh · T1059.006Enable LM Hash Storage - ProcCreationhigh · T1112ETW Logging Tamper In .NET Processes Via CommandLinehigh · T1685ETW Trace Evasion Activityhigh · T1070 · T1685Exchange PowerShell Snap-Ins Usagehigh · T1059.001 · T1114Execute Pcwrun.EXE To Leverage Follinahigh · T1218Execution Of Non-Existing Filehigh · T1055Execution of Powershell Script in Public Folderhigh · T1059.001Execution via stordiag.exehigh · T1218Execution via WorkFolders.exehigh · T1218Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Processhigh · T1190 · T1203Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoChigh · T1210Exploited CVE-2020-10189 Zoho ManageEnginehigh · T1059.001 · T1059.003 · T1190Exploiting SetupComplete.cmd CVE-2019-1378high · T1059.003 · T1068 · T1574Explorer NOUACCHECK Flaghigh · T1548.002Exports Critical Registry Keys To a Filehigh · T1012FakeUpdates/SocGholish Activityhigh · T1059.001File Decoded From Base64/Hex Via Certutil.EXEhigh · T1027File Download And Execution Via IEExec.EXEhigh · T1105File Download From IP Based URL Via CertOC.EXEhigh · T1105File Download Using Notepad++ GUP Utilityhigh · T1105File Download Via Bitsadmin To A Suspicious Target Folderhigh · T1036.003 · T1105 · T1197File Download Via Windows Defender MpCmpRun.EXEhigh · T1105 · T1218File Download with Headless Browserhigh · T1105 · T1564.003File Encryption/Decryption Via Gpg4win From Suspicious LocationshighFile Explorer Folder Opened Using Explorer Folder Shortcut Via Shellhigh · T1135File In Suspicious Location Encoded To Base64 Via Certutil.EXEhigh · T1027File With Suspicious Extension Downloaded Via Bitsadminhigh · T1036.003 · T1105 · T1197Findstr GPP Passwordshigh · T1552.006Finger.EXE Executionhigh · T1105Fireball Archer Installhigh · T1218.011Forest Blizzard APT - Process Creation ActivityhighForfiles.EXE Child Process Masqueradinghigh · T1036Formbook Process Creationhigh · T1587.001Fsutil Suspicious Invocationhigh · T1070 · T1485Grixba Malware Reconnaissance Activityhigh · T1046 · T1595.001HackTool - ADCSPwn Executionhigh · T1557.001HackTool - Bloodhound/Sharphound Executionhigh · T1059.001 · T1069.001 · T1069.002 · T1087.001 · T1087.002 · T1482HackTool - Certify Executionhigh · T1649HackTool - Certipy Executionhigh · T1649HackTool - CoercedPotato Executionhigh · T1055HackTool - Covenant PowerShell Launcherhigh · T1059.001 · T1564.003HackTool - CrackMapExec Executionhigh · T1047 · T1053 · T1059.001 · T1059.003 · T1110 · T1201HackTool - CrackMapExec Execution Patternshigh · T1047 · T1053 · T1059.001 · T1059.003HackTool - CrackMapExec PowerShell Obfuscationhigh · T1027.005 · T1059.001HackTool - CrackMapExec Process Patternshigh · T1003.001HackTool - CreateMiniDump Executionhigh · T1003.001HackTool - Default PowerSploit/Empire Scheduled Task Creationhigh · T1053.005 · T1059.001HackTool - Defendnot Executionhigh · T1685HackTool - Doppelanger LSASS Dumper Executionhigh · T1003.001Hacktool - EDR-Freeze Executionhigh · T1685HackTool - EDRSilencer Executionhigh · T1685HackTool - Empire PowerShell Launch Parametershigh · T1059.001HackTool - GMER Rootkit Detector and Remover ExecutionhighHackTool - GoldenDMSA Executionhigh · T1098 · T1110.001 · T1558.003HackTool - HandleKatz LSASS Dumper Executionhigh · T1003.001HackTool - Hashcat Password Cracker Executionhigh · T1110.002HackTool - HollowReaper Executionhigh · T1055.012HackTool - Htran/NATBypass Executionhigh · T1090HackTool - Hydra Password Bruteforce Executionhigh · T1110 · T1110.001HackTool - Impacket Tools Executionhigh · T1557.001HackTool - Koadic Executionhigh · T1059.003 · T1059.005 · T1059.007HackTool - KrbRelay Executionhigh · T1558.003HackTool - KrbRelayUp Executionhigh · T1550.003 · T1558.003HackTool - LocalPotato ExecutionhighHackTool - Mimikatz Executionhigh · T1003.001 · T1003.002 · T1003.004 · T1003.005 · T1003.006HackTool - NetExec Executionhigh · T1018 · T1021HackTool - PCHunter Executionhigh · T1007 · T1012 · T1057 · T1082 · T1083HackTool - Potential Impacket Lateral Movement Activityhigh · T1021.003 · T1047HackTool - PowerTool Executionhigh · T1685HackTool - PPID Spoofing SelectMyParent Tool Executionhigh · T1134.004HackTool - Pypykatz Credentials Dumping Activityhigh · T1003.002HackTool - Quarks PwDump Executionhigh · T1003.002HackTool - RedMimicry Winnti Playbook Executionhigh · T1059.003 · T1106 · T1218.011HackTool - RemoteKrbRelay Executionhigh · T1558.003HackTool - SharpChisel Executionhigh · T1090.001HackTool - SharpDPAPI Executionhigh · T1134.001 · T1134.003HackTool - SharPersist Executionhigh · T1053HackTool - SharpEvtMute Executionhigh · T1685.001HackTool - SharpImpersonation Executionhigh · T1134.001 · T1134.003HackTool - SharpLdapWhoami Executionhigh · T1033HackTool - SharpMove Tool Executionhigh · T1021.002HackTool - SharpView Executionhigh · T1033 · T1049 · T1069.002 · T1135 · T1482HackTool - SharpWSUS/WSUSpendu Executionhigh · T1210HackTool - SILENTTRINITY Stager Executionhigh · T1071HackTool - SOAPHound Executionhigh · T1087HackTool - Stracciatella Executionhigh · T1059 · T1685HackTool - TruffleSnout Executionhigh · T1482HackTool - UACMe Akagi Executionhigh · T1548.002HackTool - winPEAS Executionhigh · T1046 · T1082 · T1087HackTool - WinPwn Executionhigh · T1046 · T1082 · T1106 · T1518 · T1548.002 · T1552.001 · T1555 · T1555.003HackTool - Wmiexec Default Powershell CommandhighHackTool - WSASS Executionhigh · T1003.001HackTool - XORDump Executionhigh · T1003.001 · T1036Hacktool Execution - PE Metadatahigh · T1003 · T1588.002Hermetic Wiper TG Process Patternshigh · T1021.001HKTL - SharpSuccessor Privilege Escalation Tool Executionhigh · T1068HTML Help HH.EXE Suspicious Child Processhigh · T1047 · T1059.001 · T1059.003 · T1059.005 · T1059.007 · T1218 · T1218.001 · T1218.010 · T1218.011 · T1566 · T1566.001Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLinehigh · T1685IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32high · T1218.011IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLIhighImagingDevices Unusual Parent/Child ProcesseshighImports Registry Key From an ADShigh · T1112Injected Browser Process Spawning Rundll32 - GuLoader Activityhigh · T1055Installation of WSL Kali-Linuxhigh · T1059Interactive AT Jobhigh · T1053.002Invoke-Obfuscation CLIP+ Launcherhigh · T1027 · T1059.001Invoke-Obfuscation Obfuscated IEX Invocationhigh · T1027 · T1059.001Invoke-Obfuscation STDIN+ Launcherhigh · T1027 · T1059.001Invoke-Obfuscation VAR+ Launcherhigh · T1027 · T1059.001Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATIONhigh · T1027 · T1059.001Invoke-Obfuscation Via Stdinhigh · T1027 · T1059.001Invoke-Obfuscation Via Use Cliphigh · T1027 · T1059.001Invoke-Obfuscation Via Use MSHTAhigh · T1027 · T1059.001Kalambur Backdoor Curl TOR SOCKS Proxy Executionhigh · T1059.001 · T1071.001 · T1090 · T1573Kapeka Backdoor Execution Via RunDLL32.EXEhigh · T1218.011Kapeka Backdoor Persistence Activityhigh · T1053.005Kavremover Dropped Binary LOLBIN Usagehigh · T1127Kernel Memory Dump Via LiveKDhighLace Tempest Cobalt Strike DownloadhighLace Tempest Malware Loader ExecutionhighLazarus System Binary Masqueradinghigh · T1036.005LOL-Binary Copied From System Directoryhigh · T1036.003LSASS Dump Keyword In CommandLinehigh · T1003.001LSASS Process Reconnaissance Via Findstr.EXEhigh · T1552.006Lummac Stealer Activity - Execution Of More.com And Vbc.exehigh · T1055Lynx Ransomware Execution Patternhigh · T1486Malicious Base64 Encoded PowerShell Keywords in Command Lineshigh · T1059.001Malicious PowerShell Commandlets - ProcessCreationhigh · T1059.001 · T1069 · T1069.001 · T1069.002 · T1087 · T1087.001 · T1087.002 · T1482ManageEngine Endpoint Central Dctask64.EXE Potential Abusehigh · T1055.001Mavinject Inject DLL Into Running Processhigh · T1055.001 · T1218.013MERCURY APT Activityhigh · T1059.001Microsoft IIS Connection Strings Decryptionhigh · T1003Microsoft IIS Service Account Password Dumpedhigh · T1003Mint Sandstorm - Log4J Wstomcat Process ExecutionhighMMC Executing Files with Reversed Extensions Using RTLO Abusehigh · T1036.002 · T1204.002 · T1218.014MMC Spawning Windows Shellhigh · T1021.003MMC20 Lateral Movementhigh · T1021.003MpiExec Lolbinhigh · T1218MSDT Execution Via Answer Filehigh · T1218MSHTA Execution with Suspicious File Extensionshigh · T1059.007 · T1140 · T1218.005Mshtml.DLL RunHTMLApplication Suspicious UsagehighMstsc.EXE Execution From Uncommon ParenthighMustang Panda Dropperhigh · T1587.001Net WebClient Casing Anomalieshigh · T1059.001Network Reconnaissance Activityhigh · T1082 · T1087New DNS ServerLevelPluginDll Installed Via Dnscmd.EXEhigh · T1112 · T1574.001New User Created Via Net.EXE With Never Expire Optionhigh · T1136.001NewActiveScriptEventConsumer Creation Attempt via Wmic.EXEhigh · T1546.003Non-privileged Usage of Reg or Powershellhigh · T1112NtdllPipe Like Activity ExecutionhighNTLM Hash Leak Via Curl NTLM Authenticationhigh · T1187Obfuscated PowerShell MSI Install via WindowsInstaller COMhigh · T1027.010 · T1059.001 · T1218.007Obfuscated PowerShell OneLiner Executionhigh · T1059.001 · T1685Odbcconf.EXE Suspicious DLL Locationhigh · T1218.008OneNote.EXE Execution of Malicious Embedded Scriptshigh · T1218.001OpenWith.exe Executes Specified Binaryhigh · T1218Operation Wocao Activityhigh · T1012 · T1027 · T1036.004 · T1053.005 · T1059.001Operator Bloopers Cobalt Strike Commandshigh · T1059.003Operator Bloopers Cobalt Strike Moduleshigh · T1059.003Outlook EnableUnsafeClientMailRules Setting Enabledhigh · T1059 · T1202PaperCut MF/NG Exploitation Related IndicatorshighPaperCut MF/NG Potential ExploitationhighPeach Sandstorm APT Process Activity IndicatorshighPhishing Pattern ISO in Archivehigh · T1566Pikabot Fake DLL Extension Execution Via Rundll32.EXEhighPing Hex IPhigh · T1027 · T1140Pingback Backdoor Activityhigh · T1574.001Possible Privilege Escalation via Weak Service Permissionshigh · T1574.011Potential ACTINIUM Persistence Activityhigh · T1053 · T1053.005Potential Adplus.EXE Abusehigh · T1003.001Potential AMSI Bypass Via .NET Reflectionhigh · T1685Potential APT FIN7 Reconnaissance/POWERTRASH Related ActivityhighPotential APT Mustang Panda Activity Against Australian GovhighPotential APT10 Cloud Hopper Activityhigh · T1059.005Potential Arbitrary Code Execution Via Node.EXEhigh · T1127Potential Arbitrary Command Execution Using Msdt.EXEhigh · T1202Potential Arbitrary File Download Using Office Applicationhigh · T1202Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempthigh · T1059 · T1190Potential Baby Shark Malware Activityhigh · T1012 · T1059.001 · T1059.003 · T1218.005Potential BearLPE Exploitationhigh · T1053.005Potential BlackByte Ransomware Activityhigh · T1059.001 · T1140 · T1485 · T1498Potential CobaltStrike Process Patternshigh · T1059Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Imagehigh · T1027Potential CommandLine Path Traversal Via Cmd.EXEhigh · T1059.003Potential Compromised 3CXDesktopApp Executionhigh · T1218Potential Compromised 3CXDesktopApp Update Activityhigh · T1218Potential Conti Ransomware Database Dumping Activity Via SQLCmdhigh · T1005Potential Credential Dumping Attempt Using New NetworkProvider - CLIhigh · T1003Potential Credential Dumping Via WERhigh · T1003.001Potential Crypto Mining Activityhigh · T1496Potential CVE-2021-26857 Exploitation Attempthigh · T1203Potential CVE-2021-40444 Exploitation Attempthigh · T1059Potential CVE-2021-44228 Exploitation Attempt - VMware Horizonhigh · T1190Potential CVE-2022-29072 Exploitation AttempthighPotential CVE-2023-21554 QueueJumper ExploitationhighPotential CVE-2023-36874 Exploitation - Fake Wermgr ExecutionhighPotential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URIhigh · T1187Potential Data Exfiltration Activity Via CommandLine Toolshigh · T1059.001Potential Data Stealing Via Chromium Headless Debugginghigh · T1185 · T1564.003Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1highPotential Defense Evasion Activity Via Emoji Usage In CommandLine - 2highPotential Defense Evasion Activity Via Emoji Usage In CommandLine - 3highPotential Defense Evasion Activity Via Emoji Usage In CommandLine - 4highPotential Defense Evasion Via Rename Of Highly Relevant Binarieshigh · T1036.003Potential Defense Evasion Via Right-to-Left Overridehigh · T1036.002Potential Devil Bait Malware Reconnaissancehigh · T1218Potential Emotet Activityhigh · T1027 · T1059.001Potential EmpireMonkey Activityhigh · T1218.010Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApphigh · T1021.003Potential Exploitation Attempt From Office ApplicationhighPotential Exploitation Attempt Of Undocumented WindowsServer RCEhigh · T1190Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)high · T1059.001 · T1059.003 · T1068 · T1190Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins GrouphighPotential Exploitation of GoAnywhere MFT Vulnerabilityhigh · T1059.001 · T1133 · T1190Potential Exploitation of RCE Vulnerability CVE-2025-33053high · T1105 · T1218Potential File Overwrite Via Sysinternals SDeletehigh · T1485Potential Goofy Guineapig Backdoor ActivityhighPotential Goofy Guineapig GoolgeUpdate Process AnomalyhighPotential Ke3chang/TidePool Malware Activityhigh · T1685Potential LethalHTA Technique Executionhigh · T1218.005Potential LSASS Process Dump Via Procdumphigh · T1003.001 · T1036Potential Manage-bde.wsf Abuse To Proxy Executionhigh · T1216Potential Meterpreter/CobaltStrike Activityhigh · T1134.001 · T1134.002Potential Mpclient.DLL Sideloading Via Defender Binarieshigh · T1574.001Potential MsiExec Masqueradinghigh · T1036.005Potential MSTSC Shadowing Activityhigh · T1563.002Potential MuddyWater APT ActivityhighPotential Notepad++ CVE-2025-49144 Exploitationhigh · T1574.008Potential NTLM Coercion Via Certutil.EXEhigh · T1218Potential Persistence Via Logon Scripts - CommandLinehigh · T1037.001Potential Persistence Via Powershell Search Order Hijacking - Taskhigh · T1053.005 · T1059.001Potential Pikabot Discovery Activityhigh · T1016 · T1049 · T1087Potential Pikabot Hollowing Activityhigh · T1055.012Potential PlugX Activityhigh · T1574.001Potential PowerShell Command Line Obfuscationhigh · T1027 · T1059.001Potential PowerShell Execution Policy Tampering - ProcCreationhighPotential PowerShell Execution Via DLLhigh · T1218.011Potential PowerShell Obfuscation Via Reversed Commandshigh · T1027 · T1059.001Potential PowerShell Obfuscation Via WCHAR/CHARhigh · T1027 · T1059.001Potential Powershell ReverseShell Connectionhigh · T1059.001Potential Privilege Escalation To LOCAL SYSTEMhigh · T1587.001Potential Privilege Escalation Using Symlink Between Osk and Cmdhigh · T1546.008Potential Privilege Escalation via Service Permissions Weaknesshigh · T1574.011Potential Process Injection Via Msra.EXEhigh · T1055Potential Provisioning Registry Key Abuse For Binary Proxy Executionhigh · T1218Potential PsExec Remote Executionhigh · T1587.001Potential Qakbot Rundll32 ExecutionhighPotential Raspberry Robin CPL Execution Activityhigh · T1218.011Potential Raspberry Robin Dot Ending FilehighPotential RDP Tunneling Via Plinkhigh · T1572Potential RDP Tunneling Via SSHhigh · T1572Potential Recon Activity Using DriverQuery.EXEhighPotential Reconnaissance For Cached Credentials Via Cmdkey.EXEhigh · T1003.005Potential Remote SquiblyTwo Technique Executionhigh · T1047 · T1059.005 · T1059.007 · T1220Potential Renamed Rundll32 ExecutionhighPotential Rundll32 Execution With DLL Stored In ADShigh · T1564.004Potential Ryuk Ransomware Activityhigh · T1547.001Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicatorshigh · T1190Potential Signing Bypass Via Windows Developer FeatureshighPotential SNAKE Malware Installation Binary IndicatorhighPotential SNAKE Malware Installation CLI Arguments IndicatorhighPotential SNAKE Malware Persistence Service ExecutionhighPotential Snatch Ransomware Activityhigh · T1204Potential SSH Tunnel Persistence Install Using A Scheduled Taskhigh · T1053.005Potential Suspicious Child Process Of 3CXDesktopApphigh · T1218Potential SysInternals ProcDump Evasionhigh · T1003.001 · T1036Potential Tampering With RDP Related Registry Keys Via Reg.EXEhigh · T1021.001 · T1112Potential Tampering With Security Products Via WMIChigh · T1685Potential WinAPI Calls Via CommandLinehigh · T1106Potential Windows Defender AV Bypass Via Dump64.EXE Renamehigh · T1003.001Potential Windows Defender Tampering Via Wmic.EXEhigh · T1047 · T1685Potentially Suspicious ASP.NET Compilation Via AspNetCompilerhigh · T1127Potentially Suspicious Call To Win32_NTEventlogFile ClasshighPotentially Suspicious Child Process Of Regsvr32high · T1218.010Potentially Suspicious Child Processes Spawned by ConHosthigh · T1202 · T1218Potentially Suspicious DLL Registered Via Odbcconf.EXEhigh · T1218.008Potentially Suspicious Event Viewer Child Processhigh · T1548.002Potentially Suspicious Execution From Parent Process In Public Folderhigh · T1059 · T1564Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXEhighPotentially Suspicious GoogleUpdate Child ProcesshighPotentially Suspicious Mofcomp Executionhigh · T1218Potentially Suspicious Office Document Executed From Trusted Locationhigh · T1202Potentially Suspicious Regsvr32 HTTP IP Patternhigh · T1218.010PowerShell Base64 Encoded FromBase64String Cmdlethigh · T1059.001 · T1140PowerShell Base64 Encoded IEX Cmdlethigh · T1059.001PowerShell Base64 Encoded Invoke Keywordhigh · T1027 · T1059.001Powershell Base64 Encoded MpPreference Cmdlethigh · T1685PowerShell Base64 Encoded Reflective Assembly Loadhigh · T1027 · T1059.001 · T1620PowerShell Base64 Encoded WMI Classeshigh · T1027 · T1059.001Powershell Defender Disable Scan Featurehigh · T1685PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'high · T1685PowerShell Download and Execution Cradleshigh · T1059PowerShell Dynamic Module Invocation Via ExportedCommands Array Indexhigh · T1027.010 · T1059.001PowerShell Execution With Potential Decryption CapabilitieshighPowerShell Get-Process LSASShigh · T1552.004PowerShell SAM Copyhigh · T1003.002PowerShell Script Change Permission Via Set-AclhighPowerShell Set-Acl On Windows FolderhighPowershell Token Obfuscation - Process Creationhigh · T1027.009PowerShell Web Access Feature Enabled Via DISMhigh · T1548.002PPL Tampering Via WerFaultSecurehigh · T1003.001 · T1685PrintBrm ZIP Creation of Extractionhigh · T1105 · T1564.004Privilege Escalation via Named Pipe Impersonationhigh · T1021Process Access via TrolleyExpress Exclusionhigh · T1003.001 · T1218.011Process Execution From A Potentially Suspicious Folderhigh · T1036Process Memory Dump Via Comsvcs.DLLhigh · T1003.001 · T1036Process Memory Dump via RdrLeakDiag.EXEhigh · T1003.001Proxy Execution Via Wuauclt.EXEhigh · T1218Ps.exe Renamed SysInternals Toolhigh · T1036.003PsExec/PAExec Escalation to LOCAL SYSTEMhigh · T1587.001PUA - 3Proxy Executionhigh · T1572PUA - AdFind Suspicious Executionhigh · T1018 · T1069.002 · T1087.002 · T1482PUA - AdvancedRun Suspicious Executionhigh · T1134.002PUA - Chisel Tunneling Tool Executionhigh · T1090.001PUA - CleanWipe Executionhigh · T1685PUA - Crassus Executionhigh · T1590.001PUA - CsExec Executionhigh · T1569.002 · T1587.001PUA - DefenderCheck Executionhigh · T1027.005PUA - DIT Snapshot Viewerhigh · T1003.003PUA - Fast Reverse Proxy (FRP) Executionhigh · T1090PUA - Kernel Driver Utility (KDU) Executionhigh · T1543.003PUA - Memory Dump Mount Via MemProcFShigh · T1003 · T1003.001 · T1003.002 · T1003.004PUA - Netcat Suspicious Executionhigh · T1095PUA - Ngrok Executionhigh · T1572PUA - Nimgrab Executionhigh · T1105PUA - NirCmd Execution As LOCAL SYSTEMhigh · T1569.002PUA - NPS Tunneling Tool Executionhigh · T1090PUA - NSudo Executionhigh · T1569.002PUA - PingCastle Execution From Potentially Suspicious Parenthigh · T1595PUA - Rclone Executionhigh · T1567.002PUA - Restic Backup Tool Executionhigh · T1048 · T1567.002PUA - RunXCmd Executionhigh · T1569.002PUA - Seatbelt Executionhigh · T1083 · T1087 · T1526PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXEhigh · T1087.002PUA - Wsudo Suspicious Executionhigh · T1059PUA- IOX Tunneling Tool Executionhigh · T1090Python Function Execution Security Warning Disabled In Excelhigh · T1685Python One-Liners with Base64 Decodinghigh · T1027.010 · T1059.006Python Spawning Pretty TTY on Windowshigh · T1059Qakbot Regsvr32 Calc PatternhighQakbot Uninstaller ExecutionhighRaccine Uninstallhigh · T1685Rar Usage with Password and Compression Levelhigh · T1560.001Raspberry Robin Initial Execution From External Drivehigh · T1059.001Raspberry Robin Subsequent Execution of Commandshigh · T1059.001RDP Connection Allowed Via Netsh.EXEhigh · T1686.003RDP Port Forwarding Rule Added Via Netsh.EXEhigh · T1090RedSun - Conhost.exe Spawned by TieringEngineService.exehigh · T1036.005 · T1134.002Reg Add Suspicious Pathshigh · T1112 · T1685Regedit as Trusted Installerhigh · T1548Registry Export of Third-Party Credentialshigh · T1552.002Regsvr32 DLL Execution With Suspicious File Extensionhigh · T1218.010Regsvr32 Execution From Highly Suspicious Locationhigh · T1218.010Remote Access Tool - Anydesk Execution From Suspicious Folderhigh · T1219.002Remote Access Tool - AnyDesk Silent Installationhigh · T1219.002Remote Access Tool - Renamed MeshAgent Execution - Windowshigh · T1036.003 · T1219.002Remote Access Tool - ScreenConnect Server Web Shell Executionhigh · T1190Remote CHM File Download/Execution Via HH.EXEhigh · T1218.001Remote XSL Execution Via Msxsl.EXEhigh · T1220RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesseshigh · T1218Remotely Hosted HTA File Executed Via Mshta.EXEhigh · T1218.005Renamed AdFind Executionhigh · T1018 · T1069.002 · T1087.002 · T1482Renamed AutoIt Executionhigh · T1027Renamed BrowserCore.EXE Executionhigh · T1036.003 · T1528Renamed Cloudflared.EXE Executionhigh · T1090.001Renamed CreateDump Utility Executionhigh · T1003.001 · T1036Renamed Gpg.EXE Executionhigh · T1486Renamed Jusched.EXE Executionhigh · T1036.003Renamed Mavinject.EXE Executionhigh · T1055.001 · T1218.013Renamed MegaSync Executionhigh · T1218Renamed Msdt.EXE Executionhigh · T1036.003Renamed NetSupport RAT ExecutionhighRenamed NirCmd.EXE Executionhigh · T1059 · T1202Renamed Office Binary Executionhigh · T1036.003Renamed PAExec Executionhigh · T1202Renamed PingCastle Binary Executionhigh · T1059 · T1202Renamed Plink Executionhigh · T1036Renamed ProcDump Executionhigh · T1036.003Renamed PsExec Service ExecutionhighRenamed Schtasks Executionhigh · T1036.003 · T1053.005Renamed SysInternals DebugView Executionhigh · T1588.002Renamed Sysinternals Sdelete Executionhigh · T1485Renamed Visual Studio Code Tunnel Executionhigh · T1071.001 · T1219Renamed Vmnat.exe Executionhigh · T1574.001Renamed ZOHO Dctask64 Executionhigh · T1036 · T1055.001 · T1202 · T1218RestrictedAdminMode Registry Value Tampering - ProcCreationhigh · T1112Root Certificate Installed From Susp Locationshigh · T1553.004Run PowerShell Script from ADShigh · T1564.004Run PowerShell Script from Redirected Input Streamhigh · T1059Rundll32 Execution Without CommandLine Parametershigh · T1202Rundll32 Execution Without Parametershigh · T1021.002 · T1569.002 · T1570Rundll32 Registered COM Objectshigh · T1546.015RunDLL32 Spawning Explorerhigh · T1218.011Rundll32 UNC Path Executionhigh · T1021.002 · T1218.011RunMRU Registry Key Deletionhigh · T1070.003SafeBoot Registry Key Deleted Via Reg.EXEhigh · T1685Scheduled Task Creation Masquerading as System Processeshigh · T1036.004 · T1036.005 · T1053.005Scheduled Task Executing Encoded Payload from Registryhigh · T1053.005 · T1059.001Schtasks Creation Or Modification With SYSTEM Privilegeshigh · T1053.005Schtasks From Suspicious Foldershigh · T1053.005Script Event Consumer Spawning Processhigh · T1047Script Interpreter Execution From Suspicious Folderhigh · T1059Script Interpreter Spawning Credential Scanner - Windowshigh · T1005 · T1059.007 · T1552Sdiagnhost Calling Suspicious Child Processhigh · T1036 · T1218Security Event Logging Disabled via MiniNt Registry Key - Processhigh · T1112 · T1685.001Security Privileges Enumeration Via Whoami.EXEhigh · T1033Security Service Disabled Via Reg.EXEhigh · T1685Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Locationhigh · T1218Sensitive File Access Via Volume Shadow Copy Backuphigh · T1490Sensitive File Dump Via Print.EXEhigh · T1003.002 · T1003.003 · T1218Sensitive File Dump Via Wbadmin.EXEhigh · T1003.003Sensitive File Recovery From Backup Via Wbadmin.EXEhigh · T1003.003Serpent Backdoor Payload Execution Via Scheduled Taskhigh · T1053.005 · T1059.006Service DACL Abuse To Hide Services Via Sc.EXEhigh · T1574.011Service Registry Key Deleted Via Reg.EXEhigh · T1685Set Suspicious Files as System Files Using Attrib.EXEhigh · T1564.001Shadow Copies Deletion Using Operating Systems Utilitieshigh · T1070 · T1490Shai-Hulud 2.0 Malicious NPM Package Installationhigh · T1195.002Shai-Hulud Malicious Bun Executionhigh · T1195.002 · T1203Shai-Hulud Malware Indicators - Windowshigh · T1059Shell32 DLL Execution in Suspicious Directoryhigh · T1218.011ShimCache Flushhigh · T1112Small Sieve Malware CommandLine Indicatorhigh · T1574.001Sofacy Trojan Loader Activityhigh · T1059.003 · T1218.011SOURGUM Actor Behaviourshigh · T1546 · T1546.015SQLite Chromium Profile Data DB Accesshigh · T1005 · T1539 · T1555.003SQLite Firefox Profile Data DB Accesshigh · T1005 · T1539Suspect Svchost Activityhigh · T1055Suspicious Active Directory Database Snapshot Via ADExplorerhigh · T1069.002 · T1087.002 · T1482Suspicious AddinUtil.EXE CommandLine Executionhigh · T1218Suspicious Advpack Call Via Rundll32.EXEhighSuspicious AgentExecutor PowerShell Executionhigh · T1218Suspicious ArcSOC.exe Child Processhigh · T1059 · T1203Suspicious Autorun Registry Modified via WMIhigh · T1047 · T1547.001Suspicious Binary In User Directory Spawned From Office Applicationhigh · T1204.002Suspicious BitLocker Access Agent Update Utility Executionhigh · T1021.003 · T1218Suspicious Calculator Usagehigh · T1036Suspicious CertReq Command to Downloadhigh · T1105Suspicious Child Process Created as Systemhigh · T1134.002Suspicious Child Process of AspNetCompilerhigh · T1127Suspicious Child Process Of BgInfo.EXEhigh · T1059.005 · T1202 · T1218Suspicious Child Process Of Manage Engine ServiceDeskhigh · T1102Suspicious Child Process of Notepad++ Updater - GUP.Exehigh · T1195.002 · T1557Suspicious Child Process of SolarWinds WebHelpDeskhigh · T1190Suspicious Child Process Of SQL Serverhigh · T1190 · T1505.003Suspicious Child Process Of Wermgr.EXEhigh · T1036 · T1055Suspicious Chromium Browser Instance Executed With Custom Extensionhigh · T1176.001Suspicious ClickFix/FileFix Execution Patternhigh · T1204.001 · T1204.004Suspicious Command Patterns In Scheduled Task Creationhigh · T1053.005Suspicious Control Panel DLL Loadhigh · T1218.011Suspicious Curl.EXE Downloadhigh · T1105Suspicious CustomShellHost Executionhigh · T1216Suspicious Debugger Registration Cmdlinehigh · T1546.008Suspicious Desktopimgdownldr Commandhigh · T1105Suspicious DLL Loaded via CertOC.EXEhigh · T1218Suspicious Double Extension File Executionhigh · T1566.001Suspicious Download From Direct IP Via Bitsadminhigh · T1036.003 · T1197Suspicious Download From File-Sharing Website Via Bitsadminhigh · T1036.003 · T1105 · T1197Suspicious Download from Office Domainhigh · T1105 · T1608Suspicious Driver/DLL Installation Via Odbcconf.EXEhigh · T1218.008Suspicious DumpMinitool Executionhigh · T1003.001 · T1036Suspicious Encoded And Obfuscated Reflection Assembly Load Function Callhigh · T1027 · T1059.001Suspicious Encoded PowerShell Command Linehigh · T1059.001Suspicious Eventlog Clearing or Configuration Change Activityhigh · T1685.001 · T1685.005Suspicious Execution From Outlook Temporary Folderhigh · T1566.001Suspicious Execution Location Of Wermgr.EXEhighSuspicious Explorer Process with Whitespace Padding - ClickFix/FileFixhigh · T1027.010 · T1204.004Suspicious File Download From File Sharing Domain Via Curl.EXEhighSuspicious File Download From File Sharing Domain Via Wget.EXEhighSuspicious File Download From IP Via Curl.EXEhighSuspicious File Download From IP Via Wget.EXEhighSuspicious File Download From IP Via Wget.EXE - PathshighSuspicious File Downloaded From Direct IP Via Certutil.EXEhigh · T1027 · T1105Suspicious File Downloaded From File-Sharing Website Via Certutil.EXEhigh · T1027 · T1105Suspicious File Encoded To Base64 Via Certutil.EXEhigh · T1027Suspicious File Execution From Internet Hosted WebDav Sharehigh · T1059.001Suspicious FileFix Execution Patternhigh · T1204.004Suspicious Greedy Compression Using Rar.EXEhigh · T1059Suspicious GrpConv Executionhigh · T1547Suspicious GUP Usagehigh · T1574.001Suspicious HH.EXE Executionhigh · T1047 · T1059.001 · T1059.003 · T1059.005 · T1059.007 · T1218 · T1218.001 · T1218.010 · T1218.011 · T1566 · T1566.001Suspicious HWP Sub Processeshigh · T1059.003 · T1203 · T1566.001Suspicious IIS Module Registrationhigh · T1505.004Suspicious Invoke-WebRequest Executionhigh · T1105Suspicious JavaScript Execution Via Mshta.EXEhigh · T1218.005Suspicious Kerberos Ticket Request via CLIhigh · T1558.003Suspicious Kernel Dump Using Dtracehigh · T1082Suspicious Key Manager Accesshigh · T1555.004Suspicious LNK Command-Line Padding with Whitespace Charactershigh · T1204.002Suspicious Manipulation Of Default Accounts Via Net.EXEhigh · T1560.001Suspicious Microsoft Office Child Processhigh · T1047 · T1204.002 · T1218.010Suspicious Microsoft OneNote Child Processhigh · T1566 · T1566.001Suspicious Modification Of Scheduled Taskshigh · T1053.005Suspicious MSDT Parent Processhigh · T1036 · T1218Suspicious MSHTA Child Processhigh · T1218.005Suspicious Mshta.EXE Execution Patternshigh · T1106Suspicious Mstsc.EXE Execution With Local RDP Filehigh · T1219.002Suspicious New Service Creationhigh · T1543.003Suspicious NTLM Authentication on the Printer Spooler Servicehigh · T1212Suspicious Obfuscated PowerShell CodehighSuspicious Outlook Child Processhigh · T1204.002Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Scripthigh · T1059Suspicious Ping/Del Command Combinationhigh · T1070.004Suspicious Plink Port Forwardinghigh · T1021.001 · T1572Suspicious PowerShell Download and Execute Patternhigh · T1059.001Suspicious PowerShell Encoded Command Patternshigh · T1059.001Suspicious PowerShell IEX Execution Patternshigh · T1059.001Suspicious PowerShell Parameter Substringhigh · T1059.001Suspicious PowerShell Parent Processhigh · T1059.001Suspicious PrinterPorts Creation (CVE-2020-1048)high · T1059.001Suspicious Process By Web Server Processhigh · T1190 · T1505.003Suspicious Process Created Via Wmic.EXEhigh · T1047Suspicious Process Execution From Fake Recycle.Bin FolderhighSuspicious Process Masquerading As SvcHost.EXEhigh · T1036.005Suspicious Process Parentshigh · T1036Suspicious Process Patterns NTDS.DIT Exfilhigh · T1003.003Suspicious Process Spawned by CentreStack Portal AppPoolhigh · T1059.003 · T1505.003Suspicious Processes Spawned by Java.EXEhighSuspicious Processes Spawned by WinRMhigh · T1190Suspicious Program Location Whitelisted In Firewall Via Netsh.EXEhigh · T1686.003Suspicious Program Nameshigh · T1059Suspicious Provlaunch.EXE Child Processhigh · T1218Suspicious RazerInstaller Explorer Subprocesshigh · T1553Suspicious RDP Redirect Using TSCONhigh · T1021.001 · T1563.002Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBShigh · T1059.005 · T1615Suspicious Redirection to Local Admin Sharehigh · T1048Suspicious Reg Add BitLockerhigh · T1486Suspicious Registry Modification From ADS Via Regini.EXEhigh · T1112Suspicious Regsvr32 Execution From Remote Sharehigh · T1218.010Suspicious Remote Child Process From Outlookhigh · T1059 · T1202Suspicious Response File Execution Via Odbcconf.EXEhigh · T1218.008Suspicious Rundll32 Activity Invoking Sys Filehigh · T1218.011Suspicious Rundll32 Execution With Image Extensionhigh · T1218.011Suspicious Rundll32 Invoking Inline VBScripthigh · T1055Suspicious Scheduled Task Creation Involving Temp Folderhigh · T1053.005Suspicious Schtasks Execution AppData Folderhigh · T1053.005 · T1059.001Suspicious Schtasks Schedule Typeshigh · T1053.005Suspicious Serv-U Process Patternhigh · T1555Suspicious Service Binary Directoryhigh · T1202Suspicious Service DACL Modification Via Set-Service Cmdlethigh · T1543.003Suspicious Service Path Modificationhigh · T1543.003Suspicious ShellExec_RunDLL Call Via Ordinalhigh · T1218.011Suspicious Shells Spawn by Java Utility KeytoolhighSuspicious Splwow64 Without Paramshigh · T1202Suspicious Spool Service Child Processhigh · T1068 · T1203Suspicious Sysmon as Execution Parenthigh · T1068Suspicious SYSTEM User Process Creationhigh · T1003 · T1027 · T1134Suspicious TSCON Start as SYSTEMhigh · T1219.002Suspicious UltraVNC Executionhigh · T1021.005Suspicious Uninstall of Windows Defender Feature via PowerShellhigh · T1685Suspicious Usage Of ShellExec_RunDLLhighSuspicious Use of CSharp Interactive Consolehigh · T1127Suspicious VBScript UN2452 Patternhigh · T1547.001Suspicious Velociraptor Child Processhigh · T1219Suspicious WebDav Client Execution Via Rundll32.EXEhigh · T1048.003Suspicious Windows Defender Registry Key Tampering Via Reg.EXEhigh · T1685Suspicious Windows Service Tamperinghigh · T1489 · T1685Suspicious Windows Trace ETW Session Tamper Via Logman.EXEhigh · T1685 · T1685.005Suspicious Windows Update Agent Empty Cmdlinehigh · T1036Suspicious WMIC Execution Via Office Processhigh · T1047 · T1204.002 · T1218.010Suspicious WmiPrvSE Child Processhigh · T1047 · T1204.002 · T1218.010Suspicious WSL Binary Hijack via Proxy Executionhigh · T1036.005 · T1218Suspicious WSL Binary Masqueradinghigh · T1036.005 · T1218Suspicious WSL InstallLocation Registry Key Modification Via CommandLinehigh · T1112 · T1218Sysinternals PsSuspend Suspicious Executionhigh · T1685Sysmon Discovery Via Default Driver Altitude Using Findstr.EXEhigh · T1518.001Sysmon Driver Unloaded Via Fltmc.EXEhigh · T1070 · T1685 · T1685.001System File Execution Location Anomalyhigh · T1036System Restore Registry Modification via CommandLinehigh · T1490TAIDOOR RAT DLL Loadhigh · T1055.001Tamper Windows Defender Remove-MpPreferencehigh · T1685TanStack Supply-Chain Attack Execution Indicators - Windowshigh · T1059.007 · T1204.002Taskkill Symantec Endpoint Protectionhigh · T1685Taskmgr as LOCAL_SYSTEMhigh · T1036Tasks Folder Evasionhigh · T1574.001Terminal Service Process Spawnhigh · T1190 · T1210Tor Client/Browser Executionhigh · T1090.003Trickbot Malware Activityhigh · T1559TropicTrooper Campaign November 2018high · T1059.001UAC Bypass Tools Using ComputerDefaultshigh · T1548.002UAC Bypass Using ChangePK and SLUIhigh · T1548.002UAC Bypass Using Consent and Comctl32 - Processhigh · T1548.002UAC Bypass Using Disk Cleanuphigh · T1548.002UAC Bypass Using Event Viewer RecentViewshighUAC Bypass Using IEInstal - Processhigh · T1548.002UAC Bypass Using MSConfig Token Modification - Processhigh · T1548.002UAC Bypass Using NTFS Reparse Point - Processhigh · T1548.002UAC Bypass Using PkgMgr and DISMhigh · T1548.002UAC Bypass Using Windows Media Player - Processhigh · T1548.002UAC Bypass via ICMLuaUtilhigh · T1548.002UAC Bypass WSResethigh · T1548.002UEFI Persistence Via Wpbbin - ProcessCreationhigh · T1542.001UNC2452 Process Creation Patternshigh · T1059.001Uncommon Child Process Of Setres.EXEhigh · T1202 · T1218Uncommon FileSystem Load Attempt By Format.comhighUncommon One Time Only Scheduled Task At 00:00high · T1053.005Uncommon Svchost Command Line Parameterhigh · T1036.005 · T1055 · T1055.012Uncommon Userinit Child Processhigh · T1037.001Uninstall Crowdstrike Falcon Sensorhigh · T1685Uninstall Sysinternals Sysmonhigh · T1685Unusual Child Process of dns.exehigh · T1133Ursnif Redirection Of Discovery Commandshigh · T1059Use of W32tm as Timerhigh · T1124User Added To Highly Privileged Grouphigh · T1098User Added to Remote Desktop Users Grouphigh · T1021.001 · T1133 · T1136.001User Shell Folders Registry Modification via CommandLinehigh · T1112 · T1547.001Using SettingSyncHost.exe as LOLBinhigh · T1574.008VeeamBackup Database Credentials Dump Via Sqlcmd.EXEhigh · T1005Visual Basic Command Line Compiler Usagehigh · T1027.004VMToolsd Suspicious Child Processhigh · T1059VolumeShadowCopy Symlink Creation Via Mklinkhigh · T1003.002 · T1003.003Vulnerable Driver Blocklist Registry Tampering Via CommandLinehigh · T1685Wab Execution From Non Default LocationhighWab/Wabmig Unusual Parent Or Child ProcesseshighWebshell Detection With Command Line Keywordshigh · T1018 · T1033 · T1087 · T1505.003Webshell Hacking Activity Patternshigh · T1018 · T1033 · T1087 · T1505.003Webshell Tool Reconnaissance Activityhigh · T1505.003WhoAmI as Parameterhigh · T1033Whoami.EXE Execution From Privileged Processhigh · T1033Windows AMSI Related Registry Tampering Via CommandLinehigh · T1685Windows Credential Guard Registry Tampering Via CommandLinehigh · T1685Windows Defender Context Menu Removedhigh · T1685Windows Defender Definition Files Removedhigh · T1685Windows Defender Disabled Via SystemSettingsAdminFlows.EXEhigh · T1685Windows EventLog Autologger Session Registry Modification Via CommandLinehigh · T1685.001Windows Internet Hosted WebDav Share Mount Via Net.EXEhigh · T1021.002Windows Shell/Scripting Processes Spawning Suspicious Programshigh · T1059.001 · T1059.005 · T1218Windows Suspicious Child Process from Node.js - React2Shellhigh · T1059 · T1190Winrs Local Command Executionhigh · T1021.006 · T1218WSL Kali-Linux Usagehigh · T1202Wusa.EXE Executed By Parent Process Located In Suspicious LocationhighXwizard.EXE Execution From Non-Default Locationhigh · T1574.0017Zip Compressing Dump Filesmedium · T1560.001Abusing Print Executablemedium · T1218Active Directory Database Snapshot Via ADExplorermedium · T1069.002 · T1087.002 · T1482Active Directory Structure Export Via Csvde.EXEmedium · T1087.002Active Directory Structure Export Via Ldifde.EXEmediumAdd New Download Source To Wingetmedium · T1059Add Potential Suspicious New Download Source To Wingetmedium · T1059Add Windows Capability Via PowerShell CmdletmediumAddinUtil.EXE Execution From Uncommon Directorymedium · T1218AgentExecutor PowerShell Executionmedium · T1218Always Install Elevated MSI Spawned Cmd And Powershellmedium · T1548.002Always Install Elevated Windows Installermedium · T1548.002Application Removed Via Wmic.EXEmedium · T1047Application Termination Attempt via Wmic.EXEmedium · T1047Arbitrary Binary Execution Using GUP UtilitymediumArbitrary Command Execution Using WSLmedium · T1202 · T1218Arbitrary DLL or Csproj Code Execution Via Dotnet.EXEmedium · T1218Arbitrary File Download Via ConfigSecurityPolicy.EXEmedium · T1567Arbitrary File Download Via GfxDownloadWrapper.EXEmedium · T1105Arbitrary File Download Via MSEDGE_PROXY.EXEmedium · T1218Arbitrary File Download Via MSOHTMED.EXEmedium · T1218Arbitrary File Download Via MSPUB.EXEmedium · T1218Arbitrary File Download Via PresentationHost.EXEmedium · T1218Arbitrary File Download Via Squirrel.EXEmedium · T1218Arbitrary MSI Download Via Devinit.EXEmedium · T1218Arbitrary Shell Command Execution Via Settingcontent-Msmedium · T1204 · T1566.001AspNetCompiler Executionmedium · T1127Assembly Loading Via CL_LoadAssembly.ps1medium · T1216Audio Capture via PowerShellmedium · T1123Audio Capture via SoundRecordermedium · T1123Automated Collection Command Promptmedium · T1119 · T1552.001AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xslmedium · T1216Binary Proxy Execution Via Dotnet-Trace.EXEmedium · T1218Browser Started with Remote Debuggingmedium · T1185C# IL Code Compilation Via Ilasm.EXEmedium · T1127Cab File Extraction Via Wusa.EXEmediumCapture Credentials with Rpcping.exemedium · T1003Certificate Exported Via Certutil.EXEmedium · T1027Certificate Exported Via PowerShellmedium · T1059.001 · T1552.004Change PowerShell Policies to an Insecure Levelmedium · T1059.001Changing Existing Service ImagePath Value Via Reg.EXEmedium · T1574.011Chromium Browser Instance Executed With Custom Extensionmedium · T1176.001ClickOnce Deployment Execution - Dfsvc.EXE Child ProcessmediumCloudflared Portable Executionmedium · T1090.001Cloudflared Quick Tunnel Executionmedium · T1090.001Cloudflared Tunnel Connections Cleanupmedium · T1090 · T1102 · T1572Cloudflared Tunnel Executionmedium · T1090 · T1102 · T1572Cmd Launched with Hidden Start Flags to Suspicious Targetsmedium · T1564.003Code Execution via Pcwutl.dllmedium · T1218.011CodePage Modification Via MODE.COM To Russian Languagemedium · T1036COM Object Execution via Xwizard.EXEmedium · T1218Command Line Execution with Suspicious URL and AppData Stringsmedium · T1059.001 · T1059.003 · T1105Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)medium · T1078.001Compress Data and Lock With Password for Exfiltration With 7-ZIPmedium · T1560.001Compress Data and Lock With Password for Exfiltration With WINZIPmedium · T1560.001Computer Discovery And Export Via Get-ADComputer Cmdletmedium · T1033Computer Password Change Via Ksetup.EXEmediumComputer System Reconnaissance Via Wmic.EXEmedium · T1047Conhost Spawned By Uncommon Parent Processmedium · T1059Console CodePage Lookup Via CHCPmedium · T1614.001ConvertTo-SecureString Cmdlet Usage Via CommandLinemedium · T1027 · T1059.001Copy From Or To Admin Share Or Sysvol Foldermedium · T1021.002 · T1039 · T1048Cscript/Wscript Potentially Suspicious Child ProcessmediumCurl Web Request With Potential Custom User-AgentmediumCurl.EXE Execution With Custom UserAgentmedium · T1071.001CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)medium · T1059 · T1190Data Export From MSSQL Table Via BCP.EXEmedium · T1048Defrag Deactivationmedium · T1053.005Deleted Data Overwritten Via Cipher.EXEmedium · T1485Detected Windows Software Discoverymedium · T1518Detection of PowerShell Execution via Sqlps.exemedium · T1059.001 · T1127DeviceCredentialDeployment Executionmedium · T1218Direct Autorun Keys Modificationmedium · T1547.001Diskshadow Child Process Spawnedmedium · T1218Diskshadow Script Mode - Execution From Potential Suspicious Locationmedium · T1218Diskshadow Script Mode - Uncommon Script Extension Executionmedium · T1218Diskshadow Script Mode Executionmedium · T1218Dism Remove Online Packagemedium · T1685DLL Call by Ordinal Via Rundll32.EXEmedium · T1218.011DLL Execution via Rasautou.exemedium · T1218DLL Execution Via Register-cimprovider.exemedium · T1574DLL Loaded via CertOC.EXEmedium · T1218DllUnregisterServer Function Call Via Msiexec.EXEmedium · T1218.007Domain Trust Discovery Via Dsquerymedium · T1482Driver/DLL Installation Via Odbcconf.EXEmedium · T1218.008DriverQuery.EXE ExecutionmediumDropping Of Password Filter DLLmedium · T1556.002Dumping Process via Sqldumper.exemedium · T1003.001DumpMinitool Executionmedium · T1003.001 · T1036Dynamic .NET Compilation Via Csc.EXEmedium · T1027.004Dynamic .NET Compilation Via Csc.EXE - Huntingmedium · T1027.004Elevated System Shell Spawnedmedium · T1059Elevated System Shell Spawned From Uncommon Parent Locationmedium · T1059Enumerate All Information With Whoami.EXEmedium · T1033Enumeration for 3rd Party Creds From CLImedium · T1552.002Enumeration for Credentials in Registrymedium · T1552.002Esentutl Gather Credentialsmedium · T1003 · T1003.003Esentutl Steals Browser Informationmedium · T1005EventLog Query Requests By Builtin Utilitiesmedium · T1552Execute Code with Pester.batmedium · T1059.001 · T1216Execute Files with Msdeploy.exemedium · T1218Execute From Alternate Data Streamsmedium · T1564.004Execution From Webserver Root Foldermedium · T1505.003Execution of Suspicious File Type ExtensionmediumExploit for CVE-2017-0261medium · T1203 · T1204.002 · T1566.001Explorer Process Tree Breakmedium · T1036File Decryption Using Gpg4winmediumFile Download From Browser Process Via Inline URLmedium · T1105File Download From IP URL Via Curl.EXEmediumFile Download Using ProtocolHandler.exemedium · T1218File Download Via Bitsadminmedium · T1036.003 · T1105 · T1197File Download via CertOC.EXEmedium · T1105File Download Via Curl.EXEmedium · T1105File Download Via InstallUtil.EXEmedium · T1218File Encoded To Base64 Via Certutil.EXEmedium · T1027File Encryption Using Gpg4winmediumFile or Folder Permissions Modificationsmedium · T1222.001File Recovery From Backup Via Wbadmin.EXEmedium · T1490Filter Driver Unloaded Via Fltmc.EXEmedium · T1070 · T1685 · T1685.001Findstr Launching .lnk Filemedium · T1027.003 · T1036 · T1202Firewall Disabled via Netsh.EXEmedium · T1686.003Firewall Rule Deleted Via Netsh.EXEmedium · T1686.003Firewall Rule Update Via Netsh.EXEmediumFolder Compress To Potentially Suspicious Output Via Compress-Archive Cmdletmedium · T1074.001Forfiles Command Executionmedium · T1059FTP Connection Open Attempt Via Winscp CLImedium · T1048Github Self-Hosted Runner Executionmedium · T1071 · T1102.002Gpresult Display Group Policy Informationmedium · T1615Gpscript Executionmedium · T1218Greedy File Deletion Using Delmedium · T1070.004Group Membership Reconnaissance Via Whoami.EXEmedium · T1033Gzip Archive Decode Via PowerShellmedium · T1132.001HackTool - Impersonate Executionmedium · T1134.001 · T1134.003HackTool - Jlaive In-Memory Assembly Executionmedium · T1059.003HackTool - LaZagne ExecutionmediumHackTool - SharpLDAPmonitor ExecutionmediumHackTool - WinRM Access Via Evil-WinRMmedium · T1021.006Hardware Model Reconnaissance Via Wmic.EXEmedium · T1047Harvesting Of Wifi Credentials Via Netsh.EXEmedium · T1040Hidden Powershell in Link File Patternmedium · T1059.001Hiding Files with Attrib.exemedium · T1564.001Hiding User Account Via SpecialAccounts Registry Key - CommandLinemedium · T1564.002Ie4uinit Lolbin Use From Invalid Pathmedium · T1218IIS Native-Code Module Command Line Installationmedium · T1505.003IIS WebServer Log Deletion via CommandLine Utilitiesmedium · T1070Import LDAP Data Interchange Format File Via Ldifde.EXEmedium · T1105 · T1218Import PowerShell Modules From Suspicious Directories - ProcCreationmedium · T1059.001Imports Registry Key From a Filemedium · T1112Indirect Command Execution From Script File Via Bash.EXEmedium · T1202Indirect Command Execution via SFTP ProxyCommandmedium · T1202Indirect Inline Command Execution Via Bash.EXEmedium · T1202InfDefaultInstall.exe .inf Executionmedium · T1218Insecure Proxy/DOH Transfer Via Curl.EXEmediumInsecure Transfer Via Curl.EXEmediumInstall New Package Via Winget Local Manifestmedium · T1059Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)medium · T1003.003Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespacemedium · T1027.010 · T1059.001Invoke-Obfuscation COMPRESS OBFUSCATIONmedium · T1027 · T1059.001Java Running with Remote Debuggingmedium · T1203Launch-VsDevShell.PS1 Proxy Executionmedium · T1216.001Loaded Module Enumeration Via Tasklist.EXEmedium · T1003Local File Read Using Curl.EXEmediumLogged-On User Password Change Via Ksetup.EXEmediumLOLBAS Data Exfiltration by DataSvcUtil.exemedium · T1567LOLBIN Execution From Abnormal DrivemediumLolbin Unregmp2.exe Use As Proxymedium · T1218LSA PPL Protection Setting Modification via CommandLinemedium · T1689Malicious PE Execution by Microsoft Visual Studio Debuggermedium · T1218Manual Execution of Script Inside of a Compressed Filemedium · T1059Microsoft Workflow Compiler Executionmedium · T1127 · T1218Modify Group Policy Settingsmedium · T1484.001Monitoring For Persistence Via BITSmedium · T1197MSExchange Transport Agent Installationmedium · T1505.002Msiexec Quiet Installationmedium · T1218.007MsiExec Web Installmedium · T1105 · T1218.007Msxsl.EXE Executionmedium · T1220Netsh Allow Group Policy on Microsoft Defender Firewallmedium · T1686.003New Agent Skills Installation Attempt Via Node.EXEmedium · T1059.007New Capture Session Launched Via DXCap.EXEmedium · T1218New DLL Registered Via Odbcconf.EXEmedium · T1218.008New DMSA Service Account Created in Specific OUsmedium · T1078.002 · T1098New Firewall Rule Added Via Netsh.EXEmedium · T1686.003New Generic Credentials Added Via Cmdkey.EXEmedium · T1003.005New Kernel Driver Via SC.EXEmedium · T1543.003New Network Trace Capture Started Via Netsh.EXEmedium · T1040New Port Forwarding Rule Added Via Netsh.EXEmedium · T1090New Remote Desktop Connection Initiated Via Mstsc.EXEmedium · T1021.001New Root Certificate Installed Via CertMgr.EXEmedium · T1553.004New Root Certificate Installed Via Certutil.EXEmedium · T1553.004New Self Extracting Package Created Via IExpress.EXEmedium · T1218New User Account Creation Attempt Via ADSI in CommandLinemedium · T1136.001 · T1136.002New User Created Via Net.EXEmedium · T1136.001New Virtual Smart Card Created Via TpmVscMgr.EXEmediumNode Process Executionsmedium · T1059.007 · T1127Nslookup PowerShell Download Cradle - ProcessCreationmedium · T1071.004Obfuscated IP Download ActivitymediumObfuscated IP Via CLImediumOpenEDR Spawning Command Shellmedium · T1021.004 · T1059.003 · T1219Password Provided In Command Line Of Net.EXEmedium · T1021.002 · T1078Password Set to Never Expire via WMImedium · T1047 · T1098PDQ Deploy Remote Adminstartion Tool Executionmedium · T1072Perl Inline Command Executionmedium · T1059Permission Check Via Accesschk.EXEmedium · T1069.001Permission Misconfiguration Reconnaissance Via Findstr.EXEmedium · T1552.006Persistence Via TypedPaths - CommandLinemediumPhp Inline Command Executionmedium · T1059PktMon.EXE Executionmedium · T1040Port Forwarding Activity Via SSH.EXEmedium · T1021.001 · T1021.004 · T1572Portable Gpg.EXE Executionmedium · T1486Potential Active Directory Enumeration Using AD Module - ProcCreationmediumPotential Amazon SSM Agent Hijackingmedium · T1219.002Potential AMSI Bypass Using NULL Bitsmedium · T1685Potential Application Whitelisting Bypass via Dnx.EXEmedium · T1027.004 · T1218Potential APT FIN7 Exploitation Activitymedium · T1059.001 · T1059.003Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32medium · T1218.010Potential Arbitrary Command Execution Via FTP.EXEmedium · T1059 · T1202Potential Arbitrary DLL Load Using Winwordmedium · T1202Potential Arbitrary File Download Via Cmdl32.EXEmedium · T1202 · T1218Potential Binary Impersonating Sysinternals Toolsmedium · T1036.005 · T1202 · T1218Potential Binary Proxy Execution Via Cdb.EXEmedium · T1106 · T1127 · T1218Potential Binary Proxy Execution Via VSDiagnostics.EXEmedium · T1218Potential Browser Data Stealingmedium · T1555.003Potential COM Objects Download Cradles Usage - Process Creationmedium · T1105Potential Command Line Path Traversal Evasion Attemptmedium · T1036Potential Commandline Obfuscation Using Escape Charactersmedium · T1140Potential CommandLine Obfuscation Using Unicode Charactersmedium · T1027Potential Configuration And Service Reconnaissance Via Reg.EXEmedium · T1007 · T1012Potential Cookies Session HijackingmediumPotential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Executionmedium · T1059.006 · T1190Potential Data Exfiltration Via Curl.EXEmedium · T1105 · T1567Potential Defense Evasion Via Binary Renamemedium · T1036.003Potential Discovery Activity Via Dnscmd.EXEmediumPotential DLL File Download Via PowerShell Invoke-WebRequestmedium · T1059.001 · T1105Potential DLL Injection Or Execution Using Tracker.exemedium · T1055.001Potential DLL Injection Via AccCheckConsolemediumPotential DLL Sideloading Activity Via ExtExport.EXEmedium · T1218Potential DLL Sideloading Via DeviceEnroller.EXEmedium · T1574.001Potential Dosfuscation Activitymedium · T1059Potential Download/Upload Activity Using Type Commandmedium · T1105Potential Dropper Script Execution Via WScript/CScript/MSHTAmedium · T1059.005 · T1059.007Potential Fake Instance Of Hxtsr.EXE Executedmedium · T1036Potential File Download Via MS-AppInstaller Protocol Handlermedium · T1218Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLImedium · T1564.004Potential Homoglyph Attack Using Lookalike Charactersmedium · T1036 · T1036.003Potential KamiKakaBot Activity - Lure Document Executionmedium · T1059Potential KamiKakaBot Activity - Shutdown Schedule Task CreationmediumPotential Lateral Movement via Windows Remote Shellmedium · T1021.006Potential Memory Dumping Activity Via LiveKDmediumPotential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXEmedium · T1059Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Executionmedium · T1218Potential Network Sniffing Activity Using Network Toolsmedium · T1040Potential Obfuscated Ordinal Call Via Rundll32medium · T1027.010Potential Password Reconnaissance Via Findstr.EXEmedium · T1552.001Potential Password Spraying Attempt Using Dsacls.EXEmedium · T1218Potential Persistence Attempt Via Existing Service Tamperingmedium · T1543.003 · T1574.011Potential Persistence Attempt Via Run Keys Using Reg.EXEmedium · T1547.001Potential Persistence Via Microsoft Compatibility Appraisermedium · T1053.005Potential Persistence Via Netsh Helper DLLmedium · T1546.007Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Scriptmedium · T1059Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXEmedium · T1059.003 · T1105 · T1218Potential PowerShell Console History Access Attempt via History Filemedium · T1552.001Potential PowerShell Downgrade Attackmedium · T1059.001Potential Process Execution Proxy Via CL_Invocation.ps1medium · T1216Potential Process Reconnaissance via Wmic.EXEmedium · T1047 · T1057Potential Product Class Reconnaissance Via Wmic.EXEmedium · T1047 · T1082Potential Product Reconnaissance Via Wmic.EXEmedium · T1047Potential Provlaunch.EXE Binary Proxy Execution Abusemedium · T1218Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXEmedium · T1070 · T1542.003Potential RDP Session Hijacking ActivitymediumPotential Recon Activity Via Nltest.EXEmedium · T1016 · T1482Potential Reconnaissance Activity Via GatherNetworkInfo.VBSmedium · T1059.005 · T1615Potential ReflectDebugger Content Execution Via WerFault.EXEmedium · T1036Potential Register_App.Vbs LOLScript Abusemedium · T1218Potential Regsvr32 Commandline Flag Anomalymedium · T1218.010Potential Remote Desktop Tunnelingmedium · T1021Potential Script Proxy Execution Via CL_Mutexverifiers.ps1medium · T1216Potential ShellDispatch.DLL Functionality AbusemediumPotential Shim Database Persistence via Sdbinst.EXEmedium · T1546.011Potential SPN Enumeration Via Setspn.EXEmedium · T1558.003Potential Suspicious Activity Using SeCEditmedium · T1082 · T1505.005 · T1546.007 · T1546.008 · T1547.001 · T1547.002 · T1547.010 · T1547.014 · T1556.002 · T1557 · T1564.002 · T1574.007 · T1685 · T1685.001Potential Suspicious Browser Launch From Document Reader Processmedium · T1204.002Potential Suspicious Registry File Imported Via Reg.EXEmedium · T1112Potential Suspicious Windows Feature Enabled - ProcCreationmediumPotential UAC Bypass Via Sdclt.EXEmedium · T1548.002Potential Unquoted Service Path Reconnaissance Via Wmic.EXEmedium · T1047Potential WMI Lateral Movement WmiPrvSE Spawned PowerShellmedium · T1047 · T1059.001Potentially Over Permissive Permissions Granted Using Dsacls.EXEmedium · T1218Potentially Suspicious Cabinet File Expansionmedium · T1218Potentially Suspicious Child Process Of ClickOnce ApplicationmediumPotentially Suspicious Child Process Of DiskShadow.EXEmedium · T1218Potentially Suspicious Child Process of KeyScrambler.exemedium · T1203 · T1574.001Potentially Suspicious Child Process Of VsCodemedium · T1202 · T1218Potentially Suspicious Child Process Of WinRAR.EXEmedium · T1203Potentially Suspicious CMD Shell Output Redirectmedium · T1218Potentially Suspicious Command Targeting Teams Sensitive Filesmedium · T1528Potentially Suspicious Compression Tool Parametersmedium · T1560.001Potentially Suspicious Desktop Background Change Using Reg.EXEmedium · T1112 · T1491.001Potentially Suspicious Electron Application CommandLinemediumPotentially Suspicious EventLog Recon Activity Using Log Query Utilitiesmedium · T1087 · T1552Potentially Suspicious Execution Of PDQDeployRunnermediumPotentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Locationmedium · T1218.009Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extensionmedium · T1218.009Potentially Suspicious Inline JavaScript Execution via NodeJS Binarymedium · T1059.007Potentially Suspicious JWT Token Search Via CLImedium · T1528 · T1552.001Potentially Suspicious NTFS Symlink Behavior Modificationmedium · T1059 · T1222.001Potentially Suspicious Ping/Copy Command Combinationmedium · T1070.004Potentially Suspicious PowerShell Child Processesmedium · T1059.001Potentially Suspicious Powershell Script Execution From Temp Foldermedium · T1059.001Potentially Suspicious Regsvr32 HTTP/FTP Patternmedium · T1218.010Potentially Suspicious Rundll32 Activitymedium · T1218.011Potentially Suspicious Rundll32.EXE Execution of UDL Filemedium · T1071 · T1218.011Potentially Suspicious Usage Of Qemumedium · T1090 · T1572Potentially Suspicious WebDAV LNK Executionmedium · T1059.001 · T1204Potentially Suspicious Windows App ActivitymediumPowershell Defender Exclusionmedium · T1685PowerShell Download Patternmedium · T1059.001Powershell Executed From Headless ConHost Processmedium · T1059.001 · T1059.003 · T1564.003PowerShell Get-Clipboard Cmdlet Via CLImedium · T1115Powershell Inline Execution From A Filemedium · T1059.001PowerShell MSI Install via WindowsInstaller COM From Remote Locationmedium · T1059.001 · T1105 · T1218PowerShell Script Run in AppDatamedium · T1059.001Private Keys Reconnaissance Via CommandLine Toolsmedium · T1552.004Procdump Executionmedium · T1003.001 · T1036Process Creation Attempt via Wmic.EXEmedium · T1047Process Creation Using Sysnative Foldermedium · T1055Process Launched Without Image NamemediumProcess Memory Dump Via Dotnet-Dumpmedium · T1218Process Proxy Execution Via Squirrel.EXEmedium · T1218Program Executed Using Proxy/Local Command Via SSH.EXEmedium · T1218Proxy Execution via Vshadowmedium · T1202Psexec Executionmedium · T1021 · T1569PsExec Service ExecutionmediumPUA - AdFind.EXE Executionmedium · T1087.002PUA - Advanced IP Scanner Executionmedium · T1046 · T1135PUA - Advanced Port Scanner Executionmedium · T1046 · T1135PUA - AdvancedRun Executionmedium · T1059.003 · T1134.002 · T1564.003PUA - Mouse Lock Executionmedium · T1056.002PUA - NimScan Executionmedium · T1046PUA - NirCmd Executionmedium · T1569.002PUA - Nmap/Zenmap Executionmedium · T1046PUA - PingCastle Executionmedium · T1595PUA - Potential PE Metadata Tamper Using Rceditmedium · T1027 · T1027.005 · T1036 · T1036.003PUA - Process Hacker Executionmedium · T1543 · T1564 · T1622PUA - Radmin Viewer Utility Executionmedium · T1072PUA - SoftPerfect Netscan Executionmedium · T1046PUA - System Informer Executionmedium · T1082 · T1543 · T1564PUA - TruffleHog Executionmedium · T1083 · T1552.001PUA - WebBrowserPassView Executionmedium · T1555.003Pubprn.vbs Proxy Executionmedium · T1216.001Python Inline Command Executionmedium · T1059Query Usage To Exfil DatamediumRDP Enable or Disable via Win32_TerminalServiceSetting WMI Classmedium · T1021.001 · T1047Read Contents From Stdin Via Cmd.EXEmedium · T1059.003Rebuild Performance Counter Values Via Lodctr.EXEmediumRecon Command Output Piped To Findstr.EXEmedium · T1057Recon Information for Export with Command Promptmedium · T1119REGISTER_APP.VBS Proxy Executionmedium · T1218Registry Enumeration via WMI Stdregprovmedium · T1012 · T1047Registry Manipulation via WMI Stdregprovmedium · T1047 · T1112Registry Modification Attempt Via VBScriptmedium · T1059.005 · T1112Registry Modification of MS-settings Protocol Handlermedium · T1112 · T1546.001 · T1548.002Registry Tampering Of Internal Tools Settingsmedium · T1112Regsvr32 DLL Execution With Uncommon Extensionmedium · T1574Regsvr32 Execution From Potential Suspicious Locationmedium · T1218.010Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitlymedium · T1218Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessionsmedium · T1219.002Remote Access Tool - Ammy Admin Agent ExecutionmediumRemote Access Tool - AnyDesk Executionmedium · T1219.002Remote Access Tool - AnyDesk Execution With Known Revoked Signing CertificatemediumRemote Access Tool - AnyDesk Piped Password Via CLImedium · T1219.002Remote Access Tool - Cmd.EXE Execution via AnyViewermediumRemote Access Tool - GoToAssist Executionmedium · T1219.002Remote Access Tool - LogMeIn Executionmedium · T1219.002Remote Access Tool - MeshAgent Command Execution via MeshCentralmedium · T1219.002Remote Access Tool - NetSupport Executionmedium · T1219.002Remote Access Tool - NetSupport Execution From Unusual LocationmediumRemote Access Tool - Potential MeshAgent Execution - Windowsmedium · T1219.002Remote Access Tool - RURAT Execution From Unusual LocationmediumRemote Access Tool - ScreenConnect Executionmedium · T1219.002Remote Access Tool - ScreenConnect Installation Executionmedium · T1133Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Executionmedium · T1219.002Remote Access Tool - Simple Help Executionmedium · T1219.002Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Servermedium · T1105 · T1219Remote Access Tool - UltraViewer Executionmedium · T1219.002Remote Code Execute via Winrm.vbsmedium · T1216Remote File Download Via Desktopimgdownldr Utilitymedium · T1105Remote File Download Via Findstr.EXEmedium · T1105 · T1218 · T1552.001 · T1564.004Remote PowerShell Session Host Process (WinRM)medium · T1021.006 · T1059.001Renamed AutoHotkey.EXE ExecutionmediumRenamed BOINC Client Executionmedium · T1553Renamed CURL.EXE Executionmedium · T1059 · T1202Renamed FTP.EXE Executionmedium · T1059 · T1202Renamed Microsoft Teams ExecutionmediumRenamed Remote Utilities RAT (RURAT) ExecutionmediumReplace.exe Usagemedium · T1105Response File Execution Via Odbcconf.EXEmedium · T1218.008Rhadamanthys Stealer Module Launch Via Rundll32.EXEmedium · T1218.011Ruby Inline Command Executionmedium · T1059Rundll32 Execution With Uncommon DLL Extensionmedium · T1218.011Rundll32 InstallScreenSaver Executionmedium · T1218.011Rundll32 Spawned Via Explorer.EXEmediumRundll32.EXE Calling DllRegisterServer Export Function Explicitlymedium · T1218Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXEmedium · T1053.005Scheduled Task Creation From Potential Suspicious Parent Locationmedium · T1053.005Scheduled Task Creation with Curl and PowerShell Execution Combomedium · T1053.005 · T1105 · T1218Scheduled Task Executing Payload from Registrymedium · T1053.005 · T1059.001Screen Capture Activity Via Psr.EXEmedium · T1113Scripting/CommandLine Process Spawned Regsvr32medium · T1218.010Security Tools Keyword Lookup Via Findstr.EXEmedium · T1518.001Service Reconnaissance Via Wmic.EXEmedium · T1047Service Security Descriptor Tampering Via Sc.EXEmedium · T1574.011Service Started/Stopped Via Wmic.EXEmedium · T1047Service Startup Type Change Via Wmic.EXEmedium · T1047 · T1685Service StartupType Change Via PowerShell Set-Servicemedium · T1685Service StartupType Change Via Sc.EXEmedium · T1685Setup16.EXE Execution With Custom .Lst Filemedium · T1574.005Shadow Copies Creation Using Operating Systems Utilitiesmedium · T1003 · T1003.002 · T1003.003Shell Process Spawned by Java.EXEmediumSMB over QUIC Via Net.EXEmedium · T1570SQL Client Tools PowerShell Session Detectionmedium · T1059.001 · T1127Start of NT Virtual DOS MachinemediumSuspicious Cabinet File Execution Via Msdt.EXEmedium · T1202Suspicious Child Process of SAP NetWeavermedium · T1059.003 · T1190Suspicious CodePage Switch Via CHCPmedium · T1036Suspicious Copy From or To System Directorymedium · T1036.003Suspicious Cross-User Process Spawnmedium · T1055 · T1134Suspicious CrushFTP Child Processmedium · T1059.001 · T1059.003 · T1190Suspicious Csi.exe Usagemedium · T1072 · T1218Suspicious Diantz Alternate Data Stream Executionmedium · T1564.004Suspicious Diantz Download and Compress Into a CAB Filemedium · T1105Suspicious Download Via Certutil.EXEmedium · T1027 · T1105Suspicious Driver Install by pnputil.exemedium · T1547Suspicious Electron Application Child ProcessesmediumSuspicious Execution of InstallUtil Without LogmediumSuspicious Execution of Powershell with Base64medium · T1059.001Suspicious Execution of Shutdownmedium · T1529Suspicious Execution of Shutdown to Log Outmedium · T1529Suspicious Extrac32 Alternate Data Stream Executionmedium · T1564.004Suspicious Extrac32 Executionmedium · T1105Suspicious File Characteristics Due to Missing Fieldsmedium · T1059.006Suspicious FromBase64String Usage On Gzip Archive - Process Creationmedium · T1132.001Suspicious Git Clonemedium · T1593.003Suspicious Group And Account Reconnaissance Activity Using Net.EXEmedium · T1087.001 · T1087.002Suspicious IIS URL GlobalRules Rewrite Via AppCmdmediumSuspicious Invoke-WebRequest Execution With DirectIPmedium · T1105Suspicious Msbuild Execution By Uncommon Parent ProcessmediumSuspicious MsiExec Embedding Parentmedium · T1218.007Suspicious Msiexec Execute Arbitrary DLLmedium · T1218.007Suspicious Msiexec Quiet Install From Remote Locationmedium · T1218.007Suspicious New Instance Of An Office COM ObjectmediumSuspicious Powercfg Execution To Change Lock Screen TimeoutmediumSuspicious PowerShell Invocation From Script Enginesmedium · T1059.001Suspicious PowerShell Invocations - Specific - ProcessCreationmediumSuspicious Process Start Locationsmedium · T1036Suspicious RASdial Activitymedium · T1059Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdletmedium · T1087.001Suspicious Recursive Takeownmedium · T1222.001Suspicious RunAs-Like Flag CombinationmediumSuspicious Rundll32 Setupapi.dll Activitymedium · T1218.011Suspicious Runscripthelper.exemedium · T1059 · T1202Suspicious Scan Loop Networkmedium · T1018 · T1059Suspicious Scheduled Task Creation via Masqueraded XML Filemedium · T1036.005 · T1053.005Suspicious Scheduled Task Name As GUIDmedium · T1053.005Suspicious Schtasks Schedule Type With High Privilegesmedium · T1053.005Suspicious ScreenSave Change by Reg.exemedium · T1546.002Suspicious SYSVOL Domain Group Policy Accessmedium · T1552.006Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)medium · T1003.003Suspicious Usage of For Loop with Recursive Directory Search in CMDmedium · T1027.010 · T1059.003Suspicious Use of PsLogListmedium · T1087 · T1087.001 · T1087.002Suspicious Userinit Child Processmedium · T1055Suspicious VBoxDrvInst.exe Parametersmedium · T1112Suspicious Vsls-Agent Command With AgentExtensionPath Loadmedium · T1218Suspicious Windows Defender Folder Exclusion Added Via Reg.EXEmedium · T1685Suspicious WindowsTerminal Child ProcessesmediumSuspicious Workstation Locking via Rundll32mediumSuspicious X509Enrollment - Process Creationmedium · T1553.004Suspicious XOR Encoded PowerShell Commandmedium · T1027 · T1059.001 · T1140Suspicious ZipExec Executionmedium · T1202 · T1218SyncAppvPublishingServer Execute Arbitrary PowerShell Codemedium · T1218SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Codemedium · T1216 · T1218Sysinternals PsService Executionmedium · T1543.003Sysinternals PsSuspend Executionmedium · T1543.003Sysmon Configuration Updatemedium · T1685Sysprep on AppData Foldermedium · T1059System Disk And Volume Reconnaissance Via Wmic.EXEmedium · T1047 · T1082System Language Discovery via Reg.Exemedium · T1614.001Tap Installer Executionmedium · T1048Tunneling Tool Executionmedium · T1041 · T1071.001 · T1572UAC Bypass via Windows Firewall Snap-In Hijackmedium · T1548Uncommon Assistive Technology Applications Execution Via AtBroker.EXEmedium · T1218Uncommon AddinUtil.EXE CommandLine Executionmedium · T1218Uncommon Child Process Of AddinUtil.EXEmedium · T1218Uncommon Child Process Of Appvlp.EXEmedium · T1218Uncommon Child Process Of Conhost.EXEmedium · T1202Uncommon Child Process Spawned From XBootMgrSleep.EXEmedium · T1202Uncommon Child Processes Of SndVol.exemediumUncommon Extension Shim Database Installation Via Sdbinst.EXEmedium · T1546.011Uncommon Link.EXE Parent Processmedium · T1218Uncommon Sigverif.EXE Child Processmedium · T1216Uncommon Svchost Parent Processmedium · T1036.005Uncommon System Information Discovery Via Wmic.EXEmedium · T1082Unsigned AppX Installation Attempt Using Add-AppxPackagemediumUnusual Parent Process For Cmd.EXEmedium · T1059Usage Of Web Request Commands And Cmdletsmedium · T1059.001Use Icacls to Hide File to Everyonemedium · T1564.001Use NTFS Short Name in Command Linemedium · T1564.004Use NTFS Short Name in Imagemedium · T1564.004Use of FSharp Interpretersmedium · T1059Use of OpenConsolemedium · T1059Use of Pcalua For Executionmedium · T1059Use of Remote.exemedium · T1127Use of Scriptrunner.exemedium · T1218Use Of The SFTP.EXE Binary As A LOLBINmedium · T1218Use of TTDInject.exemedium · T1127Use of UltraVNC Remote Access Softwaremedium · T1219.002Use of VisualUiaVerifyNative.exemedium · T1218Use of VSIISExeLauncher.exemedium · T1127Use of Wfc.exemedium · T1127Use Short Name Path in Command Linemedium · T1564.004Use Short Name Path in Imagemedium · T1564.004User Added to Local Administrators Groupmedium · T1098User Discovery And Export Via Get-ADUser Cmdletmedium · T1033UtilityFunctions.ps1 Proxy Dllmedium · T1216Veeam Backup Database Suspicious Querymedium · T1005Verclsid.exe Runs COM Objectmedium · T1218Visual Studio Code Tunnel Executionmedium · T1071.001 · T1219Visual Studio Code Tunnel Service Installationmedium · T1071.001Visual Studio Code Tunnel Shell Executionmedium · T1071.001Visual Studio NodejsTools PressAnyKey Renamed Executionmedium · T1218Weak or Abused Passwords In CLImediumWebDav Client Execution Via Rundll32.EXEmedium · T1048.003Whoami.EXE Execution Anomalymedium · T1033Whoami.EXE Execution With Output Optionmedium · T1033Windows Admin Share Mount Via Net.EXEmedium · T1021.002Windows Backup Deleted Via Wbadmin.EXEmedium · T1490Windows Binary Executed From WSLmedium · T1202Windows Credential Manager Access via VaultCmdmedium · T1555.004Windows Default Domain GPO Modification via GPMEmedium · T1484.001Windows Firewall Disabled via PowerShellmedium · T1685Windows Hotfix Updates Reconnaissance Via Wmic.EXEmedium · T1047Windows Kernel Debugger ExecutionmediumWindows Recall Feature Enabled Via Reg.EXEmedium · T1113Windows Recovery Environment Disabled Via Reagentcmedium · T1490Winrar Compressing Dump Filesmedium · T1560.001WinRAR Execution in Non-Standard Foldermedium · T1560.001Winscp Execution From Non Standard Foldermedium · T1048Wlrmdr.EXE Uncommon Argument Or Child Processmedium · T1218WMI Persistence - Script Event Consumermedium · T1546.003WMIC Remote Command Executionmedium · T1047WmiPrvSE Spawned A Processmedium · T1047Write Protect For Storage Disabledmedium · T1685Writing Of Malicious Files To The Fonts Foldermedium · T1059 · T1211Wscript Shell Run In CommandLinemedium · T1059WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscriptmedium · T1059.005 · T1059.007WSL Child Process Anomalymedium · T1202 · T1218XBAP Execution From Uncommon Locations Via PresentationHost.EXEmedium · T1218XSL Script Execution Via WMIC.EXEmedium · T1047 · T1059.005 · T1059.007 · T1220BitLockerTogo.EXE Executionlow · T1218Browser Execution In Headless Modelow · T1105 · T1564.003Change Default File Association Via Assoclow · T1546.001CMD Shell Output Redirectlow · T1082CodePage Modification Via MODE.COMlow · T1036Compressed File Creation Via Tar.EXElow · T1560 · T1560.001Compressed File Extraction Via Tar.EXElow · T1560 · T1560.001Curl.EXE Executionlow · T1105Data Copied To Clipboard Via Clip.EXElow · T1115Directory Removal Via Rmdirlow · T1070.004DirLister Executionlow · T1083Discovery of a System Timelow · T1124Exports Registry Key To a Filelow · T1012File And SubFolder Enumeration Via Dir Commandlow · T1217File Deletion Via Dellow · T1070.004Files Added To An Archive Using Rar.EXElow · T1560.001Firewall Configuration Discovery Via Netsh.EXElow · T1016Fsutil Drive Enumerationlow · T1120HH.EXE Executionlow · T1218.001HTML File Opened From Download Folderlow · T1566.001 · T1598.002Import New Module Via PowerShell CommandLinelowInsensitive Subfolder Search Via Findstr.EXElow · T1105 · T1218 · T1552.001 · T1564.004Interesting Service Enumeration Via Sc.EXElow · T1003JScript Compiler Executionlow · T1127Local Accounts Discoverylow · T1033 · T1087.001Local Groups Reconnaissance Via Wmic.EXElow · T1069.001Malicious Windows Script Components File Execution by TAEF Detectionlow · T1218Mstsc.EXE Execution With Local RDP Filelow · T1219.002Net.EXE Executionlow · T1007 · T1018 · T1021.002 · T1049 · T1069.001 · T1069.002 · T1087.001 · T1087.002 · T1135 · T1201New Process Created Via Taskmgr.EXElow · T1036New Service Creation Using PowerShelllow · T1543.003New Service Creation Using Sc.EXElow · T1543.003New Windows Firewall Rule Added Via New-NetFirewallRule Cmdletlow · T1686.003Nltest.EXE Executionlow · T1016 · T1018 · T1482NodeJS Execution of JavaScript Filelow · T1059.007Non Interactive PowerShell Process Spawnedlow · T1059.001Notepad Password Files Discoverylow · T1083Password Protected Compressed File Extraction Via 7Ziplow · T1560.001Potential Encoded PowerShell Patterns In CommandLinelow · T1027 · T1059.001Potential Executable Run Itself As Sacrificial Processlow · T1055Potential Execution of Sysinternals Toolslow · T1588.002Potential File Override/Append Via SET CommandlowPotential Proxy Execution Via Explorer.EXE From Shell Processlow · T1218Potential Suspicious Execution From GUID Like Folder Nameslow · T1027PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicylow · T1518.001Process Execution From WebDAV Sharelow · T1105Process Terminated Via Taskkilllow · T1489PUA - Adidnsdump Executionlow · T1018QuickAssist Executionlow · T1219.002RegAsm.EXE Execution Without CommandLine Flags or Fileslow · T1218.009Registry Modification Via Regini.EXElow · T1112Remote Access Tool - ScreenConnect Remote Command Executionlow · T1059.003Remote Access Tool - Team Viewer Session Started On Windows Hostlow · T1133Run Once Task Execution as Configured in Registrylow · T1112SC.EXE Query Executionlow · T1007Scheduled Task Creation Via Schtasks.EXElow · T1053.005Set Files as System Files Using Attrib.EXElow · T1564.001Share And Session Enumeration Using Net.EXElow · T1018Start Windows Service Via Net.EXElow · T1569.002Stop Windows Service Via Net.EXElow · T1489Stop Windows Service Via PowerShell Stop-Servicelow · T1489Stop Windows Service Via Sc.EXElow · T1489Suspicious Execution of Hostnamelow · T1082Suspicious Execution of Systeminfolow · T1082Suspicious Network Commandlow · T1016Suspicious Query of MachineGUIDlow · T1082Suspicious Where Executionlow · T1217System Information Discovery via Registry Querieslow · T1082System Information Discovery Via Wmic.EXElow · T1082System Network Connections Discovery Via Net.EXElow · T1049Unmount Share Via Net.EXElow · T1070.005Unusually Long PowerShell CommandLinelow · T1059.001Virtualbox Driver Installation or Starting of VMslow · T1564 · T1564.006Windows MSIX Package Support Framework AI_STUBS Executionlow · T1204.002 · T1218 · T1553.005Windows Processes Suspicious Parent Directorylow · T1036.003 · T1036.005Windows Share Mount Via Net.EXElow · T1021.002Potential BOINC Software Execution (UC-Berkeley Signature)informational · T1553Suspicious High IntegrityLevel Conhost Legacy Optioninformational · T1202Suspicious Tasklist Discovery Commandinformational · T1057Linux
UNC4841 - Potential SEASPY ExecutioncriticalApache Spark Shell Command Injection - ProcessCreationhigh · T1190Atlassian Confluence CVE-2022-26134high · T1059 · T1190Audit Rules Deleted Via Auditctlhigh · T1685.004Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicatorhigh · T1068 · T1547.006Axios NPM Compromise Indicators - Linuxhigh · T1059.004 · T1059.006 · T1105 · T1195.002Capsh Shell Invocation - Linuxhigh · T1059Copy Passwd Or Shadow From TMP Pathhigh · T1552.001CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)high · T1059 · T1190ESXi Admin Permission Assigned To Account Via ESXCLIhigh · T1059.012 · T1098History File Deletionhigh · T1565.001Inline Python Execution - Spawn Shell Via OS System Libraryhigh · T1059Kaspersky Endpoint Security Stopped Via CommandLine - Linuxhigh · T1685Linux Crypto Mining Indicatorshigh · T1496Linux HackTool Executionhigh · T1587Linux Recon Indicatorshigh · T1552.001 · T1592.004Linux Suspicious Child Process from Node.js - React2Shellhigh · T1059 · T1190Linux Webshell Indicatorshigh · T1505.003LiteLLM / TeamPCP Supply Chain Attack Indicatorshigh · T1195.002 · T1543.002 · T1560.001Mask System Power Settings Via Systemctlhigh · T1653OMIGOD SCX RunAsProvider ExecuteScripthigh · T1068 · T1190 · T1203OMIGOD SCX RunAsProvider ExecuteShellCommandhigh · T1068 · T1190 · T1203Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child ProcesshighPotential GobRAT File Discovery Via Grephigh · T1082Potential Netcat Reverse Shell Executionhigh · T1059Potential Perl Reverse Shell ExecutionhighPotential PHP Reverse ShellhighProcess Execution From Shared Memory Directoryhigh · T1027.011Python One-Liners with Base64 Decoding - Linuxhigh · T1027.010 · T1059.006Python Reverse Shell Execution Via PTY And Socket ModuleshighScript Interpreter Spawning Credential Scanner - Linuxhigh · T1005 · T1059.004 · T1552Shai-Hulud 2.0 Malicious NPM Package Installation - Linuxhigh · T1195.002Shai-Hulud Malicious Bun Execution - Linuxhigh · T1195.002 · T1203Shai-Hulud Malware Indicators - Linuxhigh · T1059Shai-Hulud NPM Package Malicious Exfiltration via Curlhigh · T1005 · T1041Shell Execution GCC - Linuxhigh · T1083Shell Execution Of Process Located In Tmp DirectoryhighShell Execution via Find - Linuxhigh · T1083Shell Execution via Flock - Linuxhigh · T1083Shell Execution via Git - Linuxhigh · T1059Shell Execution via Nice - Linuxhigh · T1083Shell Execution via Rsync - Linuxhigh · T1059Shell Invocation via Env Command - Linuxhigh · T1059.004Shell Invocation Via Ssh - Linuxhigh · T1059Sudo Privilege Escalation CVE-2019-14287high · T1068 · T1548.003Suspicious Download and Execute Pattern via Curl/Wgethigh · T1059.004 · T1203Suspicious Invocation of Shell via AWK - Linuxhigh · T1059Suspicious Invocation of Shell via Rsynchigh · T1059 · T1203Suspicious Java Children Processeshigh · T1059Suspicious Nohup ExecutionhighSyslog Clearing or Removal Via System Utilitieshigh · T1685.006TanStack Supply-Chain Attack Execution Indicators - Linuxhigh · T1059.006 · T1059.007 · T1204.002Triple Cross eBPF Rootkit Execve HijackhighTriple Cross eBPF Rootkit Install Commandshigh · T1014UNC4841 - Download Compressed Files From Temp.sh Using Wgethigh · T1140UNC4841 - Download Tar File From Untrusted Direct IP Via Wgethigh · T1140UNC4841 - SSL Certificate Exfiltration Via Opensslhigh · T1140Vim GTFOBin Abuse - Linuxhigh · T1059 · T1083Access of Sudoers File Contentmedium · T1592.004BPFtrace Unsafe Option Usagemedium · T1059.004Chmod Targeting Sensitive Directoriesmedium · T1222.002Disable Or Stop Servicesmedium · T1489 · T1685Disabling Security Toolsmedium · T1686Download File To Potentially Suspicious Directory Via Wgetmedium · T1105Enable BPF Kprobes TracingmediumESXi Account Creation Via ESXCLImedium · T1059.012 · T1136ESXi Network Configuration Discovery Via ESXCLImedium · T1007 · T1033 · T1059.012ESXi Storage Information Discovery Via ESXCLImedium · T1007 · T1033 · T1059.012ESXi Syslog Configuration Change Via ESXCLImedium · T1059.012 · T1685 · T1690ESXi System Information Discovery Via ESXCLImedium · T1007 · T1033 · T1059.012ESXi VM Kill Via ESXCLImedium · T1059.012 · T1529ESXi VM List Discovery Via ESXCLImedium · T1007 · T1033 · T1059.012ESXi VSAN Information Discovery Via ESXCLImedium · T1007 · T1033 · T1059.012Execution Of Script Located In Potentially Suspicious DirectorymediumFlush Iptables Ufw Chainmedium · T1686Group Has Been Deleted Via Groupdelmedium · T1531Interactive Bash Suspicious Childrenmedium · T1036 · T1059.004Linux Base64 Encoded Pipe to Shellmedium · T1140Linux Base64 Encoded Shebang In CLImedium · T1140Linux Logs Clearing Attemptsmedium · T1685.006Linux Shell Pipe to Shellmedium · T1140Mount Execution With Hidepid Parametermedium · T1564Nohup Executionmedium · T1059.004Pnscan Binary Data Transmission Activitymedium · T1046Potential Discovery Activity Using Find - Linuxmedium · T1083Potential Exploitation of CVE-2025-5054 or CVE-2025-4598medium · T1003 · T1548Potential Linux Amazon SSM Agent Hijackingmedium · T1219.002Potential Linux Process Code Injection Via DD Utilitymedium · T1055.009Potential Ruby Reverse ShellmediumPotential Suspicious Change To Sensitive/Critical Filesmedium · T1565.001Potential Xterm Reverse Shellmedium · T1059Potentially Suspicious Execution From Tmp Foldermedium · T1036Potentially Suspicious Named Pipe Created Via MkfifomediumPrint History File Contentsmedium · T1592.004PUA - TruffleHog Execution - Linuxmedium · T1083 · T1552.001Python Spawning Pretty TTY Via PTY Modulemedium · T1059Python WebServer Execution - Linuxmedium · T1048.003Remove Immutable File Attributemedium · T1222.002Remove Scheduled Cron Task/JobmediumScheduled Cron Task/Job - Linuxmedium · T1053.003Shell Invocation via Apt - Linuxmedium · T1083Shell Spawned by Celery Worker Processmedium · T1059.004Suspicious Child Process of SAP NetWeaver - Linuxmedium · T1059.003 · T1190Suspicious Curl Change User Agents - Linuxmedium · T1071.001Suspicious Curl File Upload - Linuxmedium · T1105 · T1567Suspicious Git Clone - Linuxmedium · T1593.003Suspicious Package Installed - Linuxmedium · T1553.004Terminate Linux Process Via Killmedium · T1685Touch Suspicious Service Filemedium · T1070.006UFW Disable Attemptmedium · T1686User Added To Root/Sudoers Group Using UsermodmediumUser Has Been Deleted Via Userdelmedium · T1531Bash Interactive ShelllowCapabilities Discovery - Linuxlow · T1083Clipboard Collection with Xclip Toollow · T1115Connection Proxylow · T1090Container Residence Discovery Via Proc Virtual FSlow · T1082Crontab Enumerationlow · T1007Curl Usage on Linuxlow · T1105DD File Overwritelow · T1485Decode Base64 Encoded Textlow · T1027Docker Container Discovery Via Dockerenv Listinglow · T1082Install Root Certificatelow · T1553.004Linux Doas Tool Executionlow · T1548Linux Network Service Scanning Tools Executionlow · T1046Linux Package Uninstalllow · T1070Linux Remote System Discoverylow · T1018Linux Setgid Capability Set on a Binary via Setcap Utilitylow · T1548 · T1554Linux Setuid Capability Set on a Binary via Setcap Utilitylow · T1548 · T1554Linux Sudo Chroot Executionlow · T1068Local Groups Discovery Attempt - Linuxlow · T1069.001Local System Accounts Discovery Attempt - Linuxlow · T1087.001Named Pipe Created Via MkfifolowOS Architecture Discovery Via Greplow · T1082Potential Container Discovery Via Inodes Listinglow · T1082Process Discoverylow · T1057Remote Access Tool - Team Viewer Session Started On Linux Hostlow · T1133Scheduled Task/Job Atlow · T1053.002Security Software Discovery - Linuxlow · T1518.001Setuid and Setgidlow · T1548.001System Network Connections Discovery - Linuxlow · T1049File and Directory Discovery - Linuxinformational · T1083File Deletioninformational · T1070.004System Information Discoveryinformational · T1082System Network Discovery - Linuxinformational · T1016macOS
Atomic MacOS Stealer - FileGrabber Activityhigh · T1059.002Axios NPM Compromise Indicators - macOShigh · T1059.002 · T1059.004 · T1105 · T1195.002Binary Padding - MacOShigh · T1027.001Credentials In Fileshigh · T1552.001JXA In-memory Execution Via OSAScripthigh · T1059.002 · T1059.007OSACompile Run-Only Executionhigh · T1059.002Potential Base64 Decoded From Imageshigh · T1140Potential Persistence Via PlistBuddyhigh · T1543.001 · T1543.004Potential WizardUpdate Malware InfectionhighRemote Access Tool - Renamed MeshAgent Execution - MacOShigh · T1036.003 · T1219.002Suspicious Microsoft Office Child Process - MacOShigh · T1059.002 · T1137.002 · T1204.002Clipboard Access Via OSAScriptmedium · T1059.002 · T1115Clipboard Data Collection Via Pbpastemedium · T1115Credentials from Password Stores - Keychainmedium · T1555.001Disable Security Toolsmedium · T1685Disk Image Creation Via Hdiutil - MacOSmediumDisk Image Mounting Via Hdiutil - MacOSmedium · T1560.001 · T1566.001File Download Via Nscurl - MacOSmedium · T1105File Time Attribute Changemedium · T1070.006Hidden Flag Set On File/Directory Via Chflags - MacOSmedium · T1105 · T1218 · T1552.001 · T1564.004Hidden User Creationmedium · T1564.002Indicator Removal on Host - Clear Mac System Logsmedium · T1685.006JAMF MDM Potential Suspicious Child ProcessmediumLaunch Agent/Daemon Execution Via Launchctlmedium · T1543.001 · T1543.004 · T1569.001MacOS Scripting Interpreter AppleScriptmedium · T1059.002New File Exclusion Added To Time Machine Via Tmutil - MacOSmedium · T1490Osacompile Execution By Potentially Suspicious Applet/Osascriptmedium · T1059.002Payload Decoded and Decrypted via Built-in Utilitiesmedium · T1059 · T1140 · T1204Potential Discovery Activity Using Find - MacOSmedium · T1083Potential In-Memory Download And Compile Of Payloadsmedium · T1059.007 · T1105Potential XCSSET Malware InfectionmediumRemote Access Tool - Potential MeshAgent Execution - MacOSmedium · T1219.002Root Account Enable Via Dsenablerootmedium · T1078 · T1078.001 · T1078.003Scheduled Cron Task/Job - MacOsmedium · T1053.003Security Software Discovery - MacOsmedium · T1518.001Suspicious Browser Child Process - MacOSmedium · T1059 · T1189 · T1203Suspicious Execution via macOS Script Editormedium · T1059 · T1059.002 · T1204 · T1204.001 · T1553 · T1566 · T1566.002Suspicious History File Operationsmedium · T1552.003Suspicious Installer Package Child Processmedium · T1059 · T1059.007 · T1071 · T1071.001Suspicious MacOS Firmware ActivitymediumSystem Information Discovery Using Ioregmedium · T1082System Information Discovery Using sw_versmedium · T1082System Information Discovery Using System_Profilermedium · T1082 · T1497.001System Information Discovery Via Sysctl - MacOSmedium · T1082 · T1497.001System Integrity Protection (SIP) Disabledmedium · T1518.001Time Machine Backup Deletion Attempt Via Tmutil - MacOSmedium · T1490Time Machine Backup Disabled Via Tmutil - MacOSmedium · T1490User Added To Admin Group Via Dsclmedium · T1078.003User Added To Admin Group Via DseditGroupmedium · T1078.003User Added To Admin Group Via Sysadminctlmedium · T1078.003Creation Of A Local User Accountlow · T1136.001Decode Base64 Encoded Text -MacOslow · T1027Gatekeeper Bypass via Xattrlow · T1553.001Guest Account Enabled Via Sysadminctllow · T1078 · T1078.001GUI Input Capture - macOSlow · T1056.002JAMF MDM ExecutionlowLocal System Accounts Discovery - MacOslow · T1087.001MacOS Network Service Scanninglow · T1046Remote Access Tool - Team Viewer Session Started On MacOS Hostlow · T1133Screen Capture - macOSlow · T1113Space After Filename - macOSlow · T1036.006Split A File Into Pieceslow · T1030System Integrity Protection (SIP) Enumerationlow · T1518.001File and Directory Discovery - MacOSinformational · T1083Local Groups Discovery - MacOsinformational · T1069.001Macos Remote System Discoveryinformational · T1018Network Sniffing - MacOsinformational · T1040System Network Connections Discovery - MacOsinformational · T1049System Network Discovery - macOSinformational · T1016System Shutdown/Reboot - MacOsinformational · T1529