windows_rare_user_runas_event
endpoint_suspicious_login_activity
endpoint_rare_user_type10_remote_login

event.code: (4624 OR 4625 OR 4648 OR 4672 OR 4720 OR 4724 OR 4776 OR 4778 OR 4779 OR 4798 OR 4799)

winlog.event_id: 4624 AND winlog.logon.type: 3 AND user.name: ("Administrator" OR "Guest" OR "DefaultAccount" OR "krbtgt") AND NOT source.ip: ("10.0.0.0/8" OR "192.168.0.0/16")

xfreerdp
See also: T1078.003 (Local Accounts), T1078.004 (Cloud Accounts)

"net user" AND "add"   -- followed by:
"net localgroup" AND "admin"

event.code: 4720 OR process.command_line: ("new-localuser" OR ("net user" AND "\/add"))

Get-LocalUser

VPN:  port == [443, 1194, 51820, 500, 4500, 1701] || protocol == [openvpn, ipsec, l2tp, sstp, pptp, ssl, tls]
SSH:  port == 22 || protocols == ssh
RDP:  port == 3389 || protocol == rdp
WinRM: port == 5985

event.category: "authentication" AND event.outcome: "success" AND destination.port: (3389 OR 22) AND NOT source.ip: ("10.0.0.0/8" OR "192.168.0.0/16" OR "172.16.0.0/12")

event.code: (2 OR 23 OR 26) AND (process.name: *dns* OR process.executable: "\\dns*")

process.name: wsmprovhosts.exe AND NOT related.user: (<legit MP accounts>)
*winrm* AND NOT process.name: wsmprovhost.exe

process.parent.name: ("w3wp.exe" OR "httpd.exe" OR "nginx.exe" OR "php.exe" OR "php-cgi.exe" OR "tomcat.exe") AND process.name: ("cmd.exe" OR "cscript.exe" OR "powershell.exe" OR "pwsh.exe" OR "powershell_ise.exe" OR "wmic.exe" OR "wscript.exe")

url.original: (*..%2f* OR *%2e%2e%2f* OR *etc/passwd* OR *UNION+SELECT*) OR http.response.status_code: 500

event.code: (4624 OR 4634 OR 4647 OR 4778)
-- AND look for: net conns from mstsc.exe, rdpclip.exe, logon type 10

event.type: "creation" AND process.name: ("UMWorkerProcess.exe" OR "umservice.exe") AND file.extension: ("php" OR "jsp" OR "js" OR "aspx" OR "asmx" OR "asax" OR "cfm" OR "shtml")

event.category: (network or network_traffic) AND network.transport: tcp AND (destination.port: 3389 OR event.dataset: zeek.rdp) AND NOT source.ip: (10.0.0.0/8 OR 172.16.0.0/12 OR 192.168.0.0/16) AND destination.ip: (10.0.0.0/8 OR 172.16.0.0/12 OR 192.168.0.0/16)

event.code: 1 AND process.parent.executable: (*\\wsmprovhost.exe) AND process.executable: (*\\cmd.exe OR *\\sh.exe OR *\\bash.exe OR *\\powershell.exe OR *\\pwsh.exe OR *\\wsl.exe OR *\\schtasks.exe OR *\\certutil.exe OR *\\whoami.exe OR *\\bitsadmin.exe)

protocols == http AND http.uri == [*vpn*, *smb.conf*, *.xml*, *.pl*]
url.path: (*vpns* OR *smb.conf* OR *vpn* OR *.xml* OR *.pl*)

event.code: 6416   -- New external device recognized
event.code: 6421   -- Request to enable a device
event.code: 6422   -- Device enabled
event.code: 6423   -- Device installation forbidden by policy

arp -a
nmap -sn <network range>
-- Compare against authorized device list from mission partner

event.action: "Process Create (rule: ProcessCreate)" AND process.parent.name: outlook.exe AND process.name: (Microsoft.Workflow.Compiler.exe OR arp.exe OR atbroker.exe OR bitsadmin.exe OR certutil.exe OR cmd.exe OR cscript.exe OR mshta.exe OR net.exe OR net1.exe OR netsh.exe OR nltest.exe OR ping.exe OR powershell.exe OR pwsh.exe OR reg.exe OR regsvr32.exe OR sc.exe OR schtasks.exe OR systeminfo.exe OR tasklist.exe OR whoami.exe OR wmic.exe OR wscript.exe)

process.parent.name: ("WINWORD.EXE" OR "EXCEL.EXE" OR "POWERPNT.EXE" OR "OUTLOOK.EXE" OR "AcroRd32.exe" OR "FoxitReader.exe") AND process.name: ("cmd.exe" OR "powershell.exe" OR "wscript.exe" OR "cscript.exe" OR "mshta.exe" OR "rundll32.exe")

event.category: process AND event.type: start AND process.parent.name: "outlook.exe"

event.type != "deletion" AND file.extension: "exe" AND process.name: ("AcroRd32.exe" OR "rdrcef.exe" OR "FoxitPhantomPDF.exe" OR "FoxitReader.exe") AND NOT file.name: ("FoxitPhantomPDF.exe" OR "FoxitReader.exe" OR "AcroRd32.exe" OR "rdrcef.exe")

ip.src == <NOT MP IPs> AND ip.dst == <MP IPs> AND (protocols == smtp OR port == 25)
email.fn == EXISTS!

email.fn == EXISTS!

event.code: 4663 AND file.extension: "url" AND NOT process.name: "explorer.exe"

process.parent.name: (WINWORD.EXE OR EXCEL.EXE OR POWERPNT.EXE OR mspub.exe OR fltldr.exe OR visio.exe) AND file.extension: (exe OR pif OR scr OR iso OR rar OR 7z OR img OR vhd OR js OR vbs OR wsh OR hta OR cpl OR jse OR vbe OR cmd OR dll)

powershell AND "Invoke-WebRequest" AND "-OutFile"

event.action in ("creation", "rename") AND file.extension: ("htm", "html") AND file.path: ("?:\\Users\\*\\Downloads\\*" OR "?:\\Users\\*\\Content.Outlook\\*" OR "?:\\Users\\*\\AppData\\Local\\Temp\\*") AND ((file.Ext.entropy >= 5 AND file.size >= 150000) OR file.size >= 1000000)

event.type: "start" AND process.parent.name: ("cscript.exe", "wscript.exe") AND process.name: "powershell.exe"

".chm"
process.name: "hh.exe" AND NOT destination.ip: (<MP IPs>) AND NOT dns.question.name: "localhost"

event.action in ("creation", "rename") AND file.extension: ("htm", "html") AND file.path: ("?:\\Users\\*\\Downloads\\*" OR "?:\\Users\\*\\Content.Outlook\\*" OR "?:\\Users\\*\\AppData\\Local\\Temp\\*") AND ((file.Ext.entropy >= 5 AND file.size >= 150000) OR file.size >= 1000000)

process.name: (iexplore.exe OR msedge.exe OR chrome.exe OR firefox.exe) AND process.command_line: *http* AND process.parent.name: OUTLOOK.EXE

event.action: "start" AND process.name: (chrome.exe OR msedge.exe OR brave.exe OR firefox.exe OR iexplore.exe) AND process.args: ("?:\\Users\\*\\Downloads\\*.htm*" OR "?:\\Users\\*\\Content.Outlook\\*.htm*" OR "?:\\Users\\*\\AppData\\Local\\Temp\\*.htm*")

event.code: 4663 AND "removable storage"
event.code: 4688 AND NOT new.process.name: <normal drive>:*

event.dataset: "network_traffic" AND dns.question.name: (*suspicious-cdn* OR *malvertising* OR *adserver*) AND NOT dns.question.name: (*google* OR *akamai*)

http.response.body contains "<iframe src=" AND (http.response.body contains "hidden" OR http.response.body contains "width=0" OR http.response.body contains "display:none")

process.parent.name: ("chrome.exe" OR "msedge.exe" OR "firefox.exe" OR "iexplore.exe") AND process.name: ("cmd.exe" OR "powershell.exe" OR "wscript.exe" OR "cscript.exe" OR "certutil.exe" OR "mshta.exe")

winlog.event_id: 3 AND process.name: ("chrome.exe" OR "msedge.exe") AND NOT destination.port: (80 OR 443 OR 8080)

http.response.code == 302 AND http.location contains "http://" AND http.location matches "[a-zA-Z0-9]{15,}\.(info|xyz|top)"

process.parent.name: ("SolarWinds.BusinessLayerHost.exe" OR "kaseya.exe" OR "TaniumClient.exe") AND process.name: ("cmd.exe" OR "powershell.exe" OR "whoami.exe")

event.dataset: "dns" AND dns.question.name: * AND source.ip: "10.0.x.x" /* IP of Trusted Management Server */

source.ip: "198.51.100.0/24" /* Example MSP IP Range */ AND event.category: "authentication" AND event.outcome: "success" AND (user.name: "*admin*" OR user.name: "*svc*")

ip.src == [Trusted_Partner_IP] AND tcp.len > 10000000  /* flows larger than 10MB */

winlog.channel: "Microsoft-Windows-WLAN-AutoConfig/Operational" AND winlog.event_id: 8002

wlan.fc.type_subtype == 0x0c OR wlan.fc.type_subtype == 0x0a

mstsc.exe

process.name: powershell.exe AND process.command_line: (*Start-Process* OR *Invoke-Command* OR *IEX*)

event.code: (4104 OR 4103)

process.name: ("powershell.exe" OR "pwsh.exe") AND process.command_line: (*-enc* OR *-EncodedCommand* OR *-w hidden* OR *DownloadString* OR *-ExecutionPolicy Bypass*)

event.code: (10 OR 4688) AND process.name: powershell.exe AND NOT process.parent.name: explorer.exe

winlog.task: "Execute a Remote Command"
"Enable-PSRemoting"
winrm AND "Invoke-Command*"
process.name: (powershell.exe OR pwsh.exe OR powershell_ise.exe) AND winlog.event_data.Payload: *

(event.type: "process_start" AND process.name: "powershell.exe") OR (event.type: "process_start" AND process.name: "pwsh.exe") OR (event.type: "process_start" AND process.name: "powershell_ise.exe")

powershell AND iex

process.name: cmd.exe

event.code: 1 AND process.command_line: (*cmd.exe\ \/Q\ \/c\ *\ 1\ \\\\*\\*\\*\ 2\&1 OR *cmd.exe\ \/C\ *\ \ \\\\*\\*\\*\ 2\&1)

event.code: 1 AND process.command_line: *curl*

process.name: (cscript.exe OR wscript.exe)
process.parent.name: (winword.exe OR powerpnt.exe OR excel.exe OR onenote.exe)
event.type: creation AND event.category: file AND file.name: *vbscript.dll*

(event.type: "process_start" AND process.name: "python.exe") OR (event.type: "process_start" AND process.name: "python3.exe")

event.type: "start" AND process.command_line: * AND process.name: ("arp.exe" OR "dsquery.exe" OR "gpresult.exe" OR "hostname.exe" OR "ipconfig.exe" OR "nbtstat.exe" OR "net.exe" OR "netsh.exe" OR "netstat.exe" OR "nltest.exe" OR "ping.exe" OR "quser.exe" OR "qwinsta.exe" OR "reg.exe" OR "sc.exe" OR "systeminfo.exe" OR "tasklist.exe" OR "whoami.exe") AND process.parent.name: "wmiprvse.exe"

event.type: "start" AND process.parent.name: "WmiPrvSE.exe" AND process.name: "cmd.exe"

process.name: ("wmic.exe" OR "powershell.exe" OR "wbemtool.exe" OR "wmiprvse.exe" OR "wmiadp.exe" OR "scrcons.exe")
process.command_line: (wmic OR get-wmi* OR get-cim*)

event.code: (4688 OR 4656 OR 4103 OR 800)
-- WMI specific:
event.code: (5861 OR 5857 OR 5858)
  5861: WMI query execution failures
  5857: File failed policy enforcement check
  5858: Changes to WMI filters

event.code: (4698 OR 4699 OR 4700 OR 4701 OR 4702 OR 106 OR 140 OR 141)
  4698: Task created  |  4699: Task deleted  |  4700: Task enabled
  4701: Task disabled  |  4702: Task updated

process.name: schtasks.exe AND process.args: /create
process.name: ("schtasks.exe" OR "at.exe" OR "Taskeng.exe")

event.code: 4698 AND NOT (Reboot OR Defrag) AND process.name: (powershell.exe OR cmd.exe)

(process.name: "schtasks.exe" AND process.command_line: "* /create *" AND process.command_line: ("*AppData*" OR "*Temp*" OR "*ProgramData*")) OR winlog.event_id: 4698

(event.type: "process_start" AND process.name: "TaskScheduler.exe") AND (process.command_line: "* /Create *" OR process.command_line: "* /Change *" OR process.command_line: "* /Delete *")

winlog.event_id: 10 AND winlog.event_data.TargetImage: ("*lsass.exe" OR "*explorer.exe") AND winlog.event_data.GrantedAccess: ("0x1FFFFF" OR "0x1438")

(event.code: 4688 OR event.code: 4689) AND process.name: ("*\\rundll32.exe" OR "*\\regsvr32.exe" OR "*\\mshta.exe" OR "*\\cscript.exe" OR "*\\wscript.exe" OR "*\\powershell.exe" OR "*\\cmd.exe")

process.name: "hh.exe" AND NOT destination.ip: (<MP IPs>) AND NOT dns.question.name: "localhost"
event.type: "start" AND process.parent.name: "hh.exe" AND process.name: ("mshta.exe" OR "cmd.exe" OR "powershell.exe" OR "cscript.exe" OR "wscript.exe")

rule.name: "Downloads" AND process.name: <browser exe> AND file.name: *

event.type: "change" AND registry.path: ("HKU\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM" OR "HKU\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\VbaWarnings") AND registry.data.strings: "0x00000001" AND process.name: ("cscript.exe" OR "wscript.exe" OR "mshta.exe" OR "winword.exe" OR "excel.exe")

(process.command_line: (*cmd.exe* AND *calc.exe*)) OR (process.command_line: (*winword.exe* AND *-nop* AND *download*)) OR (process.name: powershell.exe AND process.parent.name: winword.exe)

(process.name: "sc.exe" AND process.command_line: "* create *" AND process.command_line: "* binPath= *") OR (winlog.event_id: 7045 AND NOT winlog.event_data.ServiceFileName: "*Program Files*")

(event.type: "process_start" AND process.parent.name: "services.exe") OR (event.type: "process_start" AND process.parent.name: "svchost.exe")

tcp.port == 445 AND dcerpc.endpoint == "svcctl"

process.name: schtasks.exe
-- Check: parent process, working dir, output redirection, user context, agent.hostname

event.type: "process_start" AND process.name: "TaskScheduler.exe" AND process.command_line: (* /Create * OR * /Change * OR * /Delete *)

rule.name: "Downloads" AND process.name: (chrome.exe OR firefox.exe OR msedge.exe OR iexplore.exe) AND file.name: *

event.dataset: ("aws.cloudtrail" OR "azure.activitylogs") AND event.action: ("RunCommand" OR "SendCommand" OR "runCommand")

process.parent.name: ("amazon-ssm-agent.exe" OR "WaAppAgent.exe") AND process.name: ("cmd.exe" OR "powershell.exe")

kubernetes.audit.verb: "create" AND kubernetes.audit.objectRef.subresource: ("exec" OR "attach")

tcp.port == 6443 AND NOT ip.src == 10.0.0.0/8

kubernetes.audit.verb: "create" AND kubernetes.audit.objectRef.resource: "pods" AND NOT container.image.name: (*my-private-registry.com*)

http.request.uri contains "/v2/" AND http.request.uri contains "/manifests/" AND dns.qry.name contains "docker.io"

event.dataset: "vmware.esxi" AND (process.name: "esxcli" OR message: "Accepted password for root from")

ip.dst == [ESXi_Host_IP] AND (tcp.port == 22 OR tcp.port == 443)

process.parent.name: ("AcroRd32.exe" OR "Acrobat.exe" OR "FoxitReader.exe" OR "WINWORD.EXE") AND process.name: ("cmd.exe" OR "powershell.exe" OR "certutil.exe" OR "rundll32.exe")

http.response.headers.content_type == "application/pdf" AND http.response.body contains "/JS" AND http.response.body contains "/JavaScript"

winlog.event_id: 4104 AND powershell.file.script_block_text: ("*System.Windows.Forms.SendKeys*" OR "*SendWait*")

event.action: "file_modified" AND file.path: ("*.github/workflows*" OR "*Jenkinsfile*" OR "*.gitlab-ci.yml")

ip.src == [Build_Runner_IP] AND NOT tls.handshake.extensions_server_name matches "(github|gitlab|docker|aws)"

event.dataset: "aws.cloudtrail" AND event.action: ("CreateFunction" OR "UpdateFunctionCode" OR "Invoke") AND event.provider: "lambda.amazonaws.com"

process.name: ("rundll32.exe" OR "regsvr32.exe") AND process.command_line: ("*AppData*" OR "*Temp*" OR "*ProgramData*")

process.parent.name: ("CcmExec.exe" OR "IntuneManagementExtension.exe") AND process.name: ("powershell.exe" OR "cmd.exe" OR "wscript.exe")

ip.src == [SCCM_Server_IP] AND tcp.len > 5000000

event.code: 4688 AND process.command_line: "regadd\EnvironmentUserInitMprLogonScript"

event.code: (4657 OR 4656) AND registry.path: "*/\Environment/\UserInitMprLogonScript"
process.name: reg.exe AND process.command_line: *UserInitMprLogonScript*
event.code: (12 OR 13 OR 14) AND *UserInitMprLogonScript*

event.code: (4698 OR 4700 OR 4701 OR 4702 OR 4699)
  4698: Task created | 4700: Enabled | 4701: Disabled | 4702: Modified | 4699: Deleted

process.name: schtasks* AND process.command_line: *create*
process.name: ("schtasks.exe" OR "at.exe" OR "Taskeng.exe" OR "cron" OR "crontab")

process.name: schtasks.exe

event.action: "logged-in" AND event.outcome: "success" AND source.ip != null AND NOT source.ip: (172.0.0.1 OR "::1") AND (winlog.event_data.TargetUserName: (*Admin* OR *super* OR *SVC* OR *DC0* OR *service* OR *DMZ* OR *ADM*))

event.code: (4738 OR 4728)
  4738: User account changed | 4728: Member added to security-enabled global group

/etc/ssh/sshd_config
~/.ssh/authorized_keys

event.code: 4720

process.name: net.exe AND process.args: user AND process.args: /add
adduser OR useradd   -- Linux

process.name: bitsadmin.exe
process.name: bitsadmin.exe AND process.command_line: (*transfer* AND *Download*)
bitsadmin AND (Transfer OR Create OR AddFile OR SetNotifyFlags OR SetNotifyCmdLine OR SetMinRetryDelay OR SetCustomHeaders OR Resume)

powershell AND Start-BitsTransfer
process.name: bitsadmin.exe OR ((process.name: powershell.exe OR pwsh.exe) AND process.command_line: (*payload* OR *autoruns*))

event.code: (59 OR 60 OR 61)
  59: BITS job created | 60: BITS job updated | 61: BITS job deleted

event.type: "start" AND process.parent.name: ("w3wp.exe" OR "httpd.exe" OR "nginx.exe" OR "php.exe" OR "php-cgi.exe" OR "tomcat.exe") AND process.name: ("cmd.exe" OR "cscript.exe" OR "powershell.exe" OR "pwsh.exe" OR "wmic.exe" OR "wscript.exe")

process.name: ("arp.exe" OR "at.exe" OR "certutil.exe" OR "cmd.exe" OR "cscript.exe" OR "dsquery.exe" OR "find.exe" OR "findstr.exe" OR "hostname.exe" OR "ipconfig.exe" OR "net.exe" OR "net1.exe" OR "netsh.exe" OR "netstat.exe" OR "nltest.exe" OR "nslookup.exe" OR "ping.exe" OR "powershell.exe" OR "reg.exe" OR "rundll32.exe" OR "sc.exe" OR "schtasks.exe" OR "systeminfo.exe" OR "tasklist.exe" OR "whoami.exe" OR "wmic.exe" OR "wscript.exe") AND process.parent.name: ("w3wp.exe" OR "httpd.exe" OR "nginx.exe" OR "php.exe" OR "tomcat.exe")

(registry.path: "HK*}\\InprocServer32\" AND registry.data.strings: ("scrobj.dll" OR "C:\\*\\scrobj.dll")) OR (registry.path: ("HKEY_USERS\\*Classes\\*\\InprocXServer32\" OR "HKEY_USERS\\*Classes\\*\\LocalServer32\" OR "HKEY_USERS\\*Classes\\*\\DelegateExecute\") AND user.domain != "NT AUTHORITY")

event.type: ("start" OR "process_started") AND process.name: "wmic.exe" AND process.args: "create" AND process.args: ("ActiveScriptEventConsumer" OR "CommandLineEventConsumer")

event.code: (4657 OR 4670)
"HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

"HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages"
"HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages"
event.code: (4657 OR 4688) AND process.command_line: (*reg.exe* AND *Lsa*)

storesyncsvc.dll

(event.category: "library" OR (event.category: "process" AND event.action: "Image loaded*")) AND dll.name: ("wlbsctrl.dll" OR "wbemcomn.dll" OR "WptsExtensions.dll" OR "wow64log.dll" OR "WindowsCoreDeviceInfo.dll" OR "Ualapi.dll" OR "wlanhlp.dll" OR "phoneinfo.dll" OR "EdgeGdi.dll" OR "cdpsgshims.dll") AND (dll.code_signature.trusted: false OR dll.code_signature.exists: false)

Image: (*\\winword.exe OR *\\excel.exe OR *\\powerpnt.exe OR *\\cmd.exe OR *\\certutil.exe OR *\\mshta.exe OR *\\curl.exe OR *\\powershell.exe OR *\\pwsh.exe) AND TargetFilename: *.dll AND TargetFilename: (*\\Users\\* AND *\\AppData\\*)

event.code: (4657 OR 4656) AND registry.path: *UserInitMprLogonScript*

process.name: reg.exe AND process.command_line: *UserInitMprLogonScript*
event.code: (12 OR 13 OR 14) AND winlog.event_data.TargetObject: *UserInitMprLogonScript*

process.name: schtasks.exe
event.code: 4698
-- 4698: Scheduled task created — check task XML for Run As user and action

event.dataset: "azure.auditlogs" AND event.action: ("Consent to application" OR "Add app role assignment to service principal" OR "Add service principal")

event.module: "file_integrity" AND event.action: ("attributes_modified" OR "created" OR "updated") AND file.path: ("/usr/sbin/sshd" OR "/bin/login" OR "/lib/security/pam_unix.so")

event.category: "file" AND event.action: "file_lock" AND process.name: ("powershell.exe" OR "cmd.exe" OR "*.tmp.exe")

process.name: ("ngrok.exe" OR "AnyDesk.exe" OR "TeamViewer_Service.exe" OR "screenconnect.exe" OR "meshagent.exe")

tls.handshake.extensions_server_name contains "ngrok.io" OR dns.qry.name contains "anydesk.com"

event.dataset: "aws.cloudtrail" AND event.action: ("ModifyImageAttribute" OR "RegisterImage" OR "CreateImage") AND NOT user.name: "*automation-role*"

winlog.event_id: (10 OR 8) AND winlog.event_data.TargetImage: "*\\lsass.exe" AND NOT process.executable: ("*\\System32\\svchost.exe" OR "*\\Antivirus.exe")

event.module: "file_integrity" AND event.action: ("updated" OR "created") AND file.path: "/etc/pam.d/*"

process.name: ("reg.exe" OR "powershell.exe") AND process.command_line: ("* add *" OR "*Set-ItemProperty*") AND process.command_line: ("*CurrentVersion\\Run*" OR "*Windows Defender*")

winlog.event_id: 11 AND file.path: ("*\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*" OR "*\\AppData\\Roaming\\Microsoft\\AddIns\\*") AND file.extension: ("dotm" OR "wll" OR "xll" OR "xla")

winlog.event_id: (12 OR 13) AND registry.path: "*\\Software\\Microsoft\\Office\\*\\Outlook\\Profiles\\*\\Rule*"

process.name: "powercfg.exe" AND process.command_line: ("* /change *" OR "* -x *") AND process.command_line: ("*standby-timeout-ac 0*" OR "*hibernate-timeout-ac 0*")

process.name: "mountvol.exe" AND process.command_line: "* /S"

process.name: "bcdedit.exe" AND process.command_line: ("*set loadoptions DDISABLE_INTEGRITY_CHECKS*" OR "*set testsigning on*")

process.name: ("chrome.exe" OR "msedge.exe") AND process.command_line: "*--load-extension=*"

winlog.event_id: 11 AND file.path: "*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*" AND file.name: "manifest.json"

process.name: ("tcpdump" OR "bpftool") AND NOT user.name: "root"

(tcp.flags.syn == 1 AND tcp.flags.ack == 0) AND tcp.dstport > 10000

winlog.event_id: (4722 OR 4738) AND (winlog.event_data.UserAccountControl: "*Password Never Expires*" OR winlog.event_id: 4722)

event.dataset: "aws.cloudtrail" AND event.action: "CreateAccessKey"

event.type: ("access" OR "creation" OR "installation") AND file.extension: ("exe" OR "dll") AND event.code: ("7" OR "3" OR "560")
  Code 7: Process Creation | Code 3: File Creation | Code 560: Object Access

registry.path: ("HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls" OR "HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls") AND NOT process.executable: ("C:\\Windows\\System32\\msiexec.exe" OR "C:\\Windows\\SysWOW64\\msiexec.exe")
registry.path: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs
RegCreateKeyEx OR RegSetValueEx

event.code: 4688

event.code: (4656 OR 4663)   -- File creation / object access
event.code: 4657 AND registry.path: "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk"

process.name: eventvwr.exe AND registry.key: HKCU\Software\Classes\mscfile\shell\open\command
process.name: sdclt.exe AND registry.key: HKCU\Software\Microsoft\Windows\CurrentVersion\AppPaths\control.exe

event.code: 1 AND process.name: (cmd.exe OR powershell.exe OR pwsh.exe) AND process.parent.name: (*Installer* AND *msi* AND *tmp)

event.code: (4657 OR 4656) AND registry.path: "*/\Environment/\UserInitMprLogonScript"
process.name: reg.exe AND process.command_line: *UserInitMprLogonScript*

event.code: (4738 OR 4728)
  4738: User account changed | 4728: Member added to security-enabled global group

process.name: schtasks.exe AND process.command_line: */create*
event.code: 4698
-- Verify: is the task configured to run as NT AUTHORITY\SYSTEM or other elevated account?

event.type: "process_start" AND process.name: "TaskScheduler.exe" AND process.command_line: (* /Create * OR * /Change * OR * /Delete *)

(event.category: "library" OR (event.category: "process" AND event.action: "Image loaded*")) AND
(dll.name: ("wlbsctrl.dll" OR "wbemcomn.dll" OR "WptsExtensions.dll" OR "wow64log.dll" OR
            "WindowsCoreDeviceInfo.dll" OR "Ualapi.dll" OR "wlanhlp.dll" OR "phoneinfo.dll" OR
            "EdgeGdi.dll" OR "cdpsgshims.dll" OR "diagtrack_win.dll") AND
 (dll.code_signature.trusted: false OR dll.code_signature.exists: false))

winlog.event_id: 4624 AND winlog.logon.type: 9 AND event.outcome: "success"

process.name: ("sc.exe" OR "powershell.exe") AND process.command_line: "* config *" AND process.command_line: "* binPath= *"

winlog.event_id: 5145 AND winlog.event_data.ShareName: "*\\SYSVOL*" AND winlog.event_data.RelativeTargetName: "*\\Policies\\*\\GPT.ini" AND winlog.event_data.AccessMask: "0x2"

event.dataset: "azure.auditlogs" AND event.action: ("Update policy" OR "Delete policy") AND event.category: "Policy"

process.name: ("chroot" OR "nsenter") AND process.command_line: ("*/host*" OR "*-t 1 -m -u -n -i*")

process.parent.name: "spoolsv.exe" AND process.name: ("cmd.exe" OR "powershell.exe" OR "rundll32.exe" OR "whoami.exe")

winlog.event_id: 6 AND file.path: ("*\\Temp\\*.sys" OR "*\\AppData\\*.sys" OR "*\\Users\\Public\\*.sys")

process.name: "runas.exe" AND process.command_line: "* /user:*" AND (process.command_line: "*admin*" OR process.command_line: "*root*")

process.name: (powershell.exe OR cmd.exe) AND process.command_line: *base64*
process.name: powershell.exe AND process.command_line: (*-ec* OR *-e* OR *-en*)
process.name: cmd.exe AND process.command_line: (*\^* OR *\=* OR *\%* OR *\!* OR *\[* OR *\(* OR *\;*)

process.name: (upx.exe OR mpress.exe OR exepacker.exe OR morphine.exe)

((ParentCommandLine: (*.exe OR *.exe")) AND Image: *\\cmd.exe AND CommandLine: \/c\ echo\ "*) AND NOT ((ParentImage: (*\:\\Windows\\System32\\* OR *\:\\Windows\\SysWOW64\\*)) AND ParentImage: *\\forfiles.exe AND Image: *\\cmd.exe)

event.action: "start" AND process.name: (powershell.exe OR pwsh.exe OR powershell_ise.exe) AND (process.args: "*Clear-History*" OR (process.args: ("*Remove-Item*" OR *rm) AND process.args: ("*ConsoleHost_history.txt*" OR "*(Get-PSReadlineOption).HistorySavePath*")))

event.type: ("start" OR "process_started") AND ((process.name: "logman.exe") AND process.args: "EventLog-*" AND process.args: ("stop" OR "delete")) OR (process.name: ("powershell.exe") AND process.args: "Set-Service" AND process.args: "EventLog" AND process.args: "Disabled") OR (process.name: "auditpol.exe" AND process.args: "/success:disable")

event.code: 1102 OR event.action: "Log clear"
"wevutil cl"
process.name: wevtutil.exe AND process.args: (cl OR clear-log OR set-log OR sl OR lfn)
event.category: process AND event.type: (start OR process_started) AND process.name: wevtutil.exe AND process.args: cl

process.name: (sdelete64.exe OR sdelete.exe)
process.name: (del.exe OR rmdir.exe)
process.name: powershell.exe AND process.command_line: *Remove-Item*

process.name: "reg.exe" AND process.args: ("add" OR "set" OR "delete") AND (process.args: "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*" OR process.args: "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce*")

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools

process.name: certutil.exe AND process.command_line: (*decode* OR *urlcache* OR *encode* OR *encodehex* OR *decodehex* OR *exportPFX*)
host.os.type: "windows" AND event.type: "start" AND process.name: "certutil.exe"

event.id: 1 AND command.line: "*Invoke-ReflectivePEInjection*"

process.name: (zip* OR rar* OR 7zip* OR winzip* OR winrar* OR ziparchiver* OR peazip*)

event.type: "start" AND process.name: "mshta.exe" AND network.direction: "incoming" AND network.transport: "tcp" AND source.port > 49151 AND destination.port > 49151 AND NOT source.address: ("127.0.0.1" OR "::1")

process.name: hh.exe AND process.command_line: *.chm*

process.name: rundll32.exe AND process.command_line: *Start*
process.name: rundll32.exe AND process.command_line: *javascript*
process.name: rundll32.exe   -- broad, may have many hits; triage by parent/user

event.type: "change" AND registry.path: "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\EnableScriptBlockLogging" AND registry.data.strings: ("0", "0x00000000")

event.code: 4688 AND process.name: sc.exe AND process.args: (config OR stop OR query)
event.code: 7036 AND (("Windows Defender" OR "Windows Firewall") AND "stopped")

"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" AND "DisableAntiSpy"
powershell AND Set-ItemProperty AND "Windows Defender" AND DisableAntiSpyware
"MpCmdRun" AND "RevertPlatform"

"Set-MpPreference -DisableScriptScanning"   -- Windows
"setenforce 0"                               -- Linux (disables SELinux)

event.type: "creation" AND file.path: "C:\\*:*" AND NOT file.path: "C:\\*:zone.identifier*" AND file.extension: ("pdf" OR "dll" OR "png" OR "exe" OR "dat" OR "com" OR "bat" OR "cmd" OR "sys" OR "vbs" OR "ps1" OR "hta" OR "txt" OR "js" OR "docx" OR "doc" OR "xlsx" OR "xls")

process.name: reg.exe AND process.command_line: (*ShowSuperHidden* OR *Hidden*)
registry.path: (*Hidden* OR *hidden*)

- Review firewall rules for unauthorized changes
- Check router settings for newly added/modified routes
- Look for traffic between networks that shouldn't communicate
- Monitor unusually high traffic volumes on specific ports
- View traffic flowing in/out from boundary devices
- Monitor for unauthorized communication between enclaves

event.code: 10 AND winlog.event_data.GrantedAccess: ("0x1fffff" OR "0x1f1fff" OR "0x143a" OR "0x40" OR "0x1000")
event.code: 10 AND target.process.name: (lsass.exe OR svchost.exe OR explorer.exe)

process.parent.name: (svchost.exe OR services.exe) AND process.name: (cmd.exe OR powershell.exe OR wscript.exe OR cscript.exe)

process.name: bitsadmin.exe AND process.command_line: (*transfer* AND *Download*)
process.name: bitsadmin.exe AND process.command_line: *transfer*
bitsadmin AND (Transfer OR Create OR AddFile OR SetNotifyFlags OR SetNotifyCmdLine OR SetMinRetryDelay OR SetCustomHeaders OR Resume)

process.name: powershell.exe AND process.command_line: *Start-BitsTransfer*

event.code: (59 OR 60 OR 61)
-- 59: BITS job created  60: BITS job updated  61: BITS job deleted

event.code: 1102 OR event.action: "Log clear"

process.name: wevtutil.exe AND process.command_line: (*clear-log* OR * cl * OR *set-log* OR * sl * OR *lfn*)
process.command_line: *wevutil cl*
-- Common: wevutil cl system  wevutil cl application  wevutil cl security

process.name: (powershell.exe OR pwsh.exe) AND process.command_line: (*Clear-EventLog* OR *Clear-WinEvent*)
process.name: wmic.exe AND process.command_line: *ClearEventLog*

process.name: (sdelete.exe OR sdelete64.exe)

process.name: (del.exe OR rmdir.exe)
process.name: powershell.exe AND process.command_line: *Remove-Item*

process.name: hh.exe AND process.command_line: *.chm*

process.name: rundll32.exe AND process.command_line: *Start*

process.name: rundll32.exe AND process.command_line: *javascript*

process.name: rundll32.exe
-- Tune: exclude known-good paths (e.g., C:\Windows\System32\shell32.dll)

process.command_line: *Set-MpPreference* AND process.command_line: *Disable*
process.name: powershell.exe AND process.command_line: *Set-ItemProperty* AND process.command_line: *DisableAntiSpyware*

event.code: 4688 AND process.name: sc.exe AND process.args: (config OR stop OR query)

event.code: 7036 AND winlog.event_data.param1: ("Windows Defender*" OR "Windows Firewall*") AND winlog.event_data.param2: "stopped"

registry.path: ("HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender*" OR "HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers*")
registry.path: *DisableAntiSpy*

process.name: MpCmdRun.exe AND process.command_line: *RevertPlatform*

process.name: reg.exe AND process.command_line: (*ShowSuperHidden* OR *Hidden*)

registry.path: (*Hidden* OR *SuperHidden*)

(event.category: "library" OR (event.category: "process" AND event.action: "Image loaded*")) AND
(dll.name: ("wlbsctrl.dll" OR "wbemcomn.dll" OR "WptsExtensions.dll" OR "wow64log.dll" OR
            "WindowsCoreDeviceInfo.dll" OR "Ualapi.dll" OR "wlanhlp.dll" OR "phoneinfo.dll" OR
            "EdgeGdi.dll" OR "cdpsgshims.dll" OR "diagtrack_win.dll") AND
 (dll.code_signature.trusted: false OR dll.code_signature.exists: false))

process.parent.name: ("fodhelper.exe" OR "computerdefaults.exe" OR "sdclt.exe" OR "slui.exe") AND process.name: ("cmd.exe" OR "powershell.exe" OR "rundll32.exe")

winlog.event_id: 4624 AND winlog.logon.type: 9 AND event.outcome: "success"

process.name: ("docker" OR "buildah" OR "podman") AND process.command_line: "* build *" AND NOT host.hostname: "*build-runner*"

winlog.event_id: 10 AND winlog.event_data.TargetImage: ("*\\wireshark.exe" OR "*\\sysmon.exe" OR "*\\x64dbg.exe")

process.name: "ping.exe" AND process.command_line: ("*-n 60*" OR "*-n 100*") AND process.command_line: ("*127.0.0.1*" OR "*localhost*")

process.name: "docker" AND process.command_line: "* run *" AND process.command_line: ("*--privileged*" OR "*--net=host*" OR "*-v /:*")

process.name: "vssadmin.exe" AND process.command_line: ("* create shadow *" OR "*ntds.dit*")

winlog.event_id: 9 AND winlog.event_data.Device: "\\Device\\HarddiskVolume*"

winlog.event_id: 5136 AND winlog.event_data.ObjectClass: "groupPolicyContainer" AND winlog.event_data.AttributeLDAPDisplayName: "gPCMachineExtensionNames"

event.dataset: "o365.message_trace" AND source.domain: "yourcompany.com" AND (email.auth.spf.status: "fail" OR email.auth.dmarc.status: "fail")

process.name: ("whoami.exe" OR "nltest.exe" OR "ipconfig.exe") AND process.parent.name: ("WINWORD.EXE" OR "EXCEL.EXE" OR "AcroRd32.exe")

process.parent.name: ("MsMpEng.exe" OR "csfalcon.exe" OR "TaniumClient.exe" OR "cb.exe") AND process.name: ("cmd.exe" OR "powershell.exe" OR "whoami.exe")

process.name: ("icacls.exe" OR "takeown.exe") AND process.command_line: ("*/grant Everyone:F*" OR "*/f *")

process.name: ("chmod" OR "chown") AND process.command_line: ("* /etc/shadow*" OR "* /etc/passwd*")

winlog.event_id: 4648 AND process.name: "runas.exe" AND winlog.event_data.TargetUserName: ("Administrator" OR "*admin*")

process.name: ("pcalua.exe" OR "forfiles.exe" OR "syncappvpublishingserver.exe") AND process.command_line: ("*-a*" OR "*/c*" OR "*cmd.exe*")

winlog.event_id: (12 OR 13) AND registry.path: "*\\System\\CurrentControlSet\\Control\\Lsa\\Authentication Packages*"

event.dataset: "aws.cloudtrail" AND event.action: ("DeleteFlowLogs" OR "StopLogging" OR "DeleteTrail")

event.dataset: "azure.activitylogs" AND event.action: "Microsoft.Network/networkSecurityGroups/securityRules/write"

(event.dataset: "aws.cloudtrail" AND event.action: "RemoveAccountFromOrganization") OR (event.dataset: "azure.activitylogs" AND event.action: "Microsoft.Management/managementGroups/subscriptions/delete")

event.dataset: ("cisco.ios" OR "fortinet.firewall") AND message: ("*copy tftp flash*" OR "*execute restore image*") AND NOT source.ip: "10.0.x.x"

process.name: ("defaults" OR "plutil") AND process.command_line: ("* write * LSUIElement *" OR "* write * LSEnvironment *")

process.name: ("afuwin64.exe" OR "fptw64.exe" OR "fwupdlocal.exe")

winlog.event_id: 4104 AND powershell.file.script_block_text: ("*[System.Reflection.Assembly]::Load*" OR "*[Reflection.Assembly]::Load*")

winlog.event_id: 4662 AND winlog.event_data.Properties: ("*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*" OR "*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*") AND NOT user.name: "*$"

dcerpc.opnum == 3 AND NOT ip.src == 10.0.0.0/24

winlog.event_id: 6 AND file.path: ("*\\Temp\\*.sys" OR "*\\AppData\\*.sys" OR "*\\Users\\Public\\*.sys")

process.name: ("powershell.exe" OR "cmd.exe") AND process.command_line: ("*Add-MpPreference -ExclusionPath*" OR "*Add-MpPreference -ExclusionProcess*" OR "*Add-MpPreference -ExclusionExtension*")

process.name: "certutil.exe" AND process.command_line: ("*-addstore*" OR "*-importpfx*") AND process.command_line: ("*Root*" OR "*TrustedPublisher*")

process.name: ("wscript.exe" OR "cscript.exe") AND process.command_line: "*pubprn.vbs 127.0.0.1 script:http*"

winlog.event_id: 3 AND process.name: ("WINWORD.EXE" OR "EXCEL.EXE") AND network.direction: "outbound" AND destination.port: (80 OR 443 OR 445) AND NOT destination.ip: ("10.0.0.0/8" OR "192.168.0.0/16")

http.request.uri matches "\.dotm$" OR http.response.headers.content_type contains "application/vnd.ms-word.template.macroEnabled"

process.name: ("tcpdump" OR "bpftool" OR "snort") AND NOT user.name: "root"

process.name: ("MSBuild.exe" OR "csc.exe" OR "jsc.exe") AND process.command_line: ("*\\AppData\\*" OR "*\\Temp\\*" OR "*\\Users\\Public\\*")

event.dataset: "aws.cloudtrail" AND event.action: ("RunInstances" OR "CreateVpc") AND NOT aws.region: ("us-east-1" OR "us-east-2" OR "us-west-1" OR "us-west-2")

winlog.event_id: 4624 AND winlog.logon.type: 9 AND winlog.event_data.LogonProcessName: "seclogo"

process.command_line: "*sekurlsa::pth*" OR process.command_line: "*kerberos::ptt*"

winlog.event_id: 4624 AND winlog.logon.type: (2 OR 10) AND user.name: ("svc_*" OR "*_svc")

process.name: "wmic.exe" AND process.command_line: ("*computersystem get*" OR "*bios get*" OR "*memorychip*")

winlog.event_id: (12 OR 13) AND registry.path: "*\\System\\CurrentControlSet\\Control\\Lsa\\LmCompatibilityLevel"

process.name: "wmic.exe" AND process.command_line: ("*/format:http://*" OR "*/format:https://*")

file_name: "lsass*.dmp" AND NOT process_name: "werfault.exe"
process.name: prodump.exe AND process.command_line: *lsass.exe*

process.name: mimikatz.exe AND process.command_line: *sekurlsa* AND process.command_line: (*minidump* OR *logonPasswords*)
process.name: rundll32.exe AND process.command_line: *comsvcs.dll*
process.name: rundll32.exe AND process.command_line: *Minidump*

process.name: lsass.exe AND process.parent.name: (explorer.exe OR cmd.exe OR lsass.exe)
process.parent.name: lsass.exe AND process.name: (cmd.exe OR powershell.exe OR regsvr32.exe OR mstsc.exe OR dllhost.exe)

event.type: ("creation" OR "change") AND registry.path: "HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential" AND registry.data.strings: "1"

process.command_line: *NTDS.dit*
process.name: (ntdsutil.exe OR secretsdump.py OR vssadmin.exe OR wmic.exe)
event.code: 4688 AND process.name: ("mimikatz.exe" OR "procdump.exe" OR "ntdsutil.exe" OR "powershell.exe") AND process.command_line: (*Invoke* AND (*Mimikatz* OR *CachedCredentials* OR *LSADump* OR *SAMDump*))

event.code: 4663 AND process.name: ("mimikatz.exe" OR "procdump.exe" OR "reg.exe" OR "powershell.exe" OR "wmic.exe" OR "schtasks.exe" OR "cmd.exe") AND process.args: "\SAM"

event.code: 4688 AND process.name: procdump.exe AND process.command_line: (*-ma* AND *lsass*)

event.code: 4663 AND process.args: (*\config\SAM* OR *\ntds.dit* OR *\policy\secrets* OR *\cache*)

event.code: (4625 OR 4776 OR 5379 OR 530 OR 533 OR 7038)
  4625: Failed logon | 4776: Local auth attempt | 5379: Credential manager read
  530: Logon outside allowed hours | 533: User not authorized on this machine

hashcat.exe OR hydra OR crackmapexec OR poshC2 OR medusa OR ncrack OR patator OR john OR w3af
nmap AND brute

event.code: (4625 OR 5379)
kerbrute.exe
sshpass

event.code: (4768 OR 4769 OR 4771 OR 675)

event.type: ("start" OR "process_started") AND process.name: "rundll32.exe" AND process.args: ("?:\\Windows\\System32\\davclnt.dll,DavSetCookie" OR "?:\\Windows\\SysWOW64\\davclnt.dll,DavSetCookie") AND process.args: ("http*/print/pipe/*" OR "http*/pipe/spoolss" OR "http*/pipe/srvsvc")

process.name: (cmd.exe OR powershell.exe) AND event.code: (1 OR 5 OR 7 OR 11) AND event.action: (Read OR Write) AND file.path: (*.txt OR *.xml OR *.json OR *.csv)

event.code: 4104 AND powershell.file.script_block_text: (*password* OR *credential* OR *secret* OR *token* OR *passwd* OR *passphrase*)

"findstr /si password"
"findstr /si pass"

process.name: ("keepass.exe" OR "lastpass.exe") AND (file.path: /%appdata%\.*\.kdbx/ OR file.path: /%systemroot%\system32\credmgr.exe/)

process.name: ("chrome.exe" OR "firefox.exe" OR "msedge.exe" OR "iexplore.exe" OR "brave.exe") AND file.path: ("*.sqlite" OR "*.logins.json" OR "*.key3.db" OR "*.signons.sqlite" OR "*.signons3.txt")

Windows: LSASS process access, SAM registry, NTDS.dit file access
Linux: /etc/passwd, /etc/shadow
Use event.code: 4663 with ObjectName containing SAM or NTDS.dit

process.command_line: *NTDS.dit*
process.name: (ntdsutil.exe OR vssadmin.exe OR wmic.exe)

event.code: 4688 AND process.name: ("mimikatz.exe" OR "procdump.exe" OR "ntdsutil.exe" OR "powershell.exe") AND process.command_line: (*Invoke-Mimikatz* OR *LSADump* OR *SAMDump*)

event.code: 4662 AND winlog.event_data.AccessMask: "0x100" AND winlog.event_data.Properties: (
  "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2" OR
  "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" OR
  "9923a32a-3607-11d2-b9be-0000f87a36b2" OR
  "89e95b76-444d-4c62-991a-0facbeda640c"
)

event.code: 4688 AND process.name: procdump.exe AND process.command_line: (*-ma* AND *lsass*)

event.code: 4663 AND process.name: ("mimikatz.exe" OR "procdump.exe" OR "reg.exe" OR "powershell.exe" OR "wmic.exe") AND process.args: ("\SAM" OR "ntds.dit")

event.code: (4625 OR 5379)
-- High volume of 4625 across many different user accounts = credential stuffing
-- 5379: Credential Manager credentials read

process.name: kerbrute.exe

process.name: sshpass

winlog.event_id: 3 AND network.direction: "inbound" AND destination.port: (137 OR 5355 OR 53) AND NOT process.name: ("svchost.exe" OR "System")

udp.port == 5355 OR udp.port == 137

winlog.event_id: 3 AND destination.port: (445 OR 139) AND NOT destination.ip: ("10.0.0.0/8" OR "192.168.0.0/16" OR "172.16.0.0/12")

smb.cmd == 0x73 AND ip.dst != 10.0.0.0/8

winlog.event_id: 4662 AND winlog.event_data.ObjectName: "*ADFS\\Policy Store*" AND winlog.event_data.AccessMask: "0x100"

winlog.event_id: 10 AND winlog.event_data.CallTrace: ("*GetAsyncKeyState*" OR "*SetWindowsHookEx*") AND NOT process.executable: "*\\Antivirus.exe"

winlog.event_id: 7 AND process.name: "lsass.exe" AND NOT file.path: "*\\Windows\\System32\\*" AND file.extension: "dll"

event.dataset: "azure.auditlogs" AND event.action: "User logged in" AND event.outcome: "success"

event.dataset: ("okta.system" OR "azure.auditlogs") AND event.action: ("user.mfa.attempt_bypass" OR "Authentication failed") AND event.reason: "*denied*" | stats count by user.name | where count > 5

process.name: ("tcpdump" OR "tshark" OR "wireshark.exe" OR "pktmon.exe") AND NOT user.name: ("root" OR "SYSTEM")

http.authbasic OR ftp.request.command == "USER" OR ftp.request.command == "PASS"

network.direction: "outbound" AND destination.ip: "169.254.169.254" AND process.name: ("curl" OR "wget" OR "powershell.exe" OR "cmd.exe")

http.request.uri contains "/latest/meta-data/iam/security-credentials/"

process.name: ("powershell.exe" OR "cmd.exe" OR "python.exe") AND process.command_line: ("*\\AppData\\Local\\Google\\Chrome\\User Data\\*\\Network\\Cookies*")

winlog.event_id: 4887 AND winlog.event_data.Requester: "*\\*" AND winlog.event_data.CertificateTemplate: "*WebServer*"

process.name: "Rubeus.exe" AND process.command_line: ("*asktgt*" AND "*/certificate:*")

winlog.event_id: 4769 AND winlog.event_data.TicketEncryptionType: "0x17" AND winlog.event_data.ServiceName: ("*sql*" OR "*svc*" OR "*admin*") | stats count by user.name | where count > 15

kerberos.msg_type == 14 AND kerberos.ENCTYPE == 23

event.code: 4688 AND ("sc query" OR (tasklist AND svc) OR (systemctl AND type AND service) OR (net AND start))
"sc query" | tasklist /svc | systemctl --type=service | net start

event.type: start AND (((process.name: "net.exe") AND process.args: ("start", "use") AND process.args_count == 2) OR ((process.name: "sc.exe") AND process.args: ("query", "q*")) OR ((process.name: "tasklist.exe") AND process.args: "/svc"))

powershell AND Get-Service

event.category: process AND event.type: (start OR process_started) AND process.name: (ipconfig.exe)
event.type: ("start" OR "process_started") AND ((process.name: "nbtstat.exe" AND process.args: ("-n", "-s")) OR (process.name: "arp.exe" AND process.args: "-a"))
process.name: netsh.exe

qwinsta
"System.DirectoryServices.DirectoryEntry" AND LDAP
"show cdp neighbors" | "show arp"

process.name: (ping.exe OR tracert.exe)
event.code: 4663

powershell AND Find-DomainLocalGroupMember

event.category: process AND event.type: (start OR process_started) AND process.name: (whoami.exe OR HOSTNAME.EXE OR who OR whoami)
"net use" OR "quser" OR "query user"
wmic AND useraccount | quser | qwinsta

powershell AND ("Get-LocalUser" OR "Get-WmiObject Win32" OR "Get-ComputerInfo" OR "Get-Acl" OR "Get-ADUser")
event.code: 4688 AND process.name: at.exe

process.name: (nmap.exe OR nc.exe OR ping.exe OR tcping.exe OR tracert.exe OR pathping.exe OR osql.exe)
nmap

tags == network-service-discovery AND ip.src != <MP IPs>

event.action: "network-flow"   -- look for one source connecting to 20+ destination ports

process.name: tasklist.exe
qwinsta
hostname OR ipconfig OR net OR quser OR qwinsta OR systeminfo OR tasklist OR dsquery OR whoami

event.type: ("start" OR "process_started") AND process.name: ("net.exe" OR "net1.exe") AND process.args: ("group" OR "user" OR "localgroup") AND process.args: ("admin" OR "Domain Admins" OR "Remote Desktop Users" OR "Enterprise Admins") AND NOT process.args: "/add"

net localgroup
"net group /domain"
groups | ldapsearch   -- Linux

event.category: process AND event.type: (start OR process_started) AND process.name: (systeminfo.exe OR netcfg.exe)
event.type: start AND (process.name: cmd.exe AND process.args: (ver* OR systeminfo.exe OR hostname.exe)) OR (process.name: wmic.exe AND process.args: (os AND get))

process.name: cmd.exe AND process.command_line: *tree* AND process.args: "\/F"
process.name: tree.com
dir OR ls OR find
event.type: "start" AND process.name: "cmd.exe" AND process.args: "/c" AND process.args: ("set" OR "dir")

powershell.exe AND get-childitem AND recursive

net.exe OR net1.exe
process.command_line: (*net.exe* OR *net1.exe*)

powershell AND (Get-LocalUser OR Get-WmiObject OR Get-NetUser)
winlog.event_id: (4103 OR 4104) AND (*Get-WmiObject* OR *Get-LocalUser* OR *Get-NetUser*)
winlog.event_id: (4103 OR 4104) AND (*Get-DomainUser* OR *Get-ADUser* OR *Get-ADGroupMember*)

"net user"             -- all local accounts
"net user /domain"     -- domain accounts (requires domain creds)
"net user Administrator"
"net account" | "net localgroup"

process.name: ("net.exe" OR "net1.exe")
process.name: powershell.exe AND process.command_line: *Get-User*

powershell AND Get-DomainUser
powershell AND (Get-ADUser OR Get-ADGroupMember)
"net user /domain" OR "net group /domain"
event.code: (4798 OR 4799)

event.code: (4798 OR 4799)
  4798: User's local group membership enumerated
  4799: Security enabled local group membership enumerated

net view OR "net share"
"get-smbshare"
process.command_line: (*smbclient* AND *\-L*)
Image: (*\\net.exe OR *\\net1.exe) AND CommandLine: *view*

netstat OR qwinsta
"net use"       -- manage network connections / list mapped drives
"net session"   -- active sessions on computer
"netstat -a"    -- active TCP connections
"arp" OR "arp -a"   -- IP to MAC mappings
"netsh interface ip show address"   -- display IP of connected interface

event.type: ("start" OR "process_start") AND process.name: "reg.exe" AND process.args: "query"
event.code: 4657   -- registry value modified

event.code: 4103 AND process.command_line: (*New-PSDrive* AND *Registry*) OR process.command_line: (*HKEY_CLASSES_ROOT* OR *HKCR*)

"nltest /domain_trusts"

AdFind.exe continues to be seen across majority of breaches.
Monitor LDAP and MSRPC traffic for anomalous patterns not matching expected protocol flows.

netsh AND advfirewall
(wmic.exe OR powershell.exe) AND SecurityCenter
sc AND query AND windefend
tasklist
findstr AND (virus OR cb OR defender OR cylance OR mc)

process.name: reg.exe AND process.args: (*query* AND *HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\*)
process.name: reg.exe AND process.command_line: *Software*

event.type: (start OR process_started) AND process.name: wmic.exe AND process.args: "/namespace:\\\\root\\SecurityCenter2" AND process.args: "Get"

-- Windows:
"net accounts" AND "domain" AND "Get-ADDefaultDomainPasswordPolicy"
-- Linux:
"chage -l"
"cat" AND "/etc/pam.d/common-password"
-- macOS:
"pwpolicy getaccountpolices"
-- Network devices:
"show aaa" OR "show aaa common-criteria policy all"

winlog.api: wineventlog AND NOT event.code: (7024 OR 7036 OR 7034 OR 9009) AND (winlog.event_data.param1: *Get-ADD* OR winlog.event_data.param2: *Get-ADD*)

event.type: ("start" OR "process_started") AND process.name: "fsutil.exe" AND process.args: "fsinfo" AND process.args: "drives"

process.name: net* AND process.command_line: *time*
event.type: start AND ((process.name: net* AND process.command_line: *time* AND NOT process.args: /set) OR (process.name: w32t* AND process.command_line: *tz*)) AND NOT user.id: ("S-1-5-18" OR "S-1-5-19" OR "S-1-5-20")
event.type: start AND (process.name: tzutil.exe AND process.args: "/g")

Image: (*awk OR *\/cat OR *grep OR *\/head OR *\/less OR *\/more OR *\/nl OR *\/tail) AND (CommandLine: *\/proc\/2\/* OR (CommandLine: *\/proc\/* AND (CommandLine: (*\/cgroup OR *\/sched))))

docker ps
docker inspect
kubectl get pods
kubectl get nodes

wevtutil AND <log name>   -- Application, Security, System
process.name: CollectGuestLogs.exe
powershell AND Get-EventLog AND <log name>
powershell AND Get-WinEvent AND LogName
"event viewer" OR eventvwr
%SystemDrive%\\inetpub\\logs\\LogFiles   -- IIS log access

var AND log AND ls
var AND log AND (tail OR head OR more OR cat)

process.name: ("net.exe" OR "net1.exe") AND process.command_line: (*user* OR *localgroup* OR *group*)
-- Check: parent process, working dir, RPC exclusions (ruby), user context

process.name: powershell.exe AND process.command_line: *Get-LocalUser*

process.name: ("net.exe" OR "net1.exe") AND process.command_line: (*/domain*)
process.command_line: (*net user /domain* OR *net group /domain*)

process.name: powershell.exe AND process.command_line: (*Get-DomainUser* OR *Get-ADUser* OR *Get-ADGroupMember*)

event.code: (4798 OR 4799)
-- 4798: User's local group membership enumerated
-- 4799: Security-enabled local group membership enumerated

process.name: "tasklist.exe" AND process.command_line: "* /v *"

process.name: ("cmd.exe" OR "powershell.exe" OR "findstr.exe") AND process.command_line: ("*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Bookmarks*" OR "*\\AppData\\*\\History*")

event.dataset: "aws.cloudtrail" AND event.action: "DescribeInstances" | stats count by user.name | where count > 50

event.dataset: "aws.cloudtrail" AND event.action: "ConsoleLogin" AND event.outcome: "success" AND NOT source.ip: ("[Corporate_IP_Ranges]")

event.dataset: "azure.activitylogs" AND event.action: "Microsoft.Resources/subscriptions/providers/read"

event.dataset: "aws.cloudtrail" AND event.provider: "s3.amazonaws.com" AND event.action: ("ListBuckets" OR "ListObjects")

process.name: ("tasklist.exe" OR "wmic.exe") AND process.command_line: ("*wireshark*" OR "*sysmon*" OR "*procmon*")

process.name: ("driverquery.exe" OR "powershell.exe") AND process.command_line: ("*driverquery*" OR "*Get-WmiObject Win32_PnPSignedDriver*")

process.name: ("gpresult.exe" OR "powershell.exe") AND process.command_line: ("* /z*" OR "* /v*" OR "*Get-DomainGPO*" OR "*Get-GPO*")

process.name: ("diskpart.exe" OR "wmic.exe" OR "powershell.exe") AND process.command_line: ("*list volume*" OR "*logicaldisk get*" OR "*Get-Volume*")

process.name: ("lsblk" OR "fdisk" OR "df") AND process.command_line: ("*-l*" OR "*-h*")

process.name: ("tcpdump" OR "tshark" OR "ngrep") AND process.command_line: ("*-i eth0*" OR "*-i any*") AND NOT user.name: "root"

process.name: ("curl.exe" OR "wget.exe" OR "powershell.exe") AND process.command_line: ("*ifconfig.me*" OR "*icanhazip.com*" OR "*ipinfo.io*")

host == "ifconfig.me" || host == "icanhazip.com" || host == "ipinfo.io"

process.name: ("wmic.exe" OR "powershell.exe") AND process.command_line: ("*computersystem get manufacturer*" OR "*Get-WmiObject Win32_ComputerSystem*")

process.name: ("wmic.exe" OR "powershell.exe") AND process.command_line: ("*memorychip*" OR "*cpu get*")

event.type: "start" AND process.args: "*:3389" AND process.args: ("-L" OR "-P" OR "-R" OR "-pw" OR "-ssh")
process.args: ("-L" OR "-P" OR "-R" OR "-pw" OR "-ssh") AND process.args: *3389*

event.type: ("start" OR "process_started") AND process.name: "mshta.exe" AND process.args: "-Embedding"

PuTTY port forwarding: -R * -pw
Secure copy (scp): -pw * * @
Mimikatz: sekurlsa::
RAR encryption: -hp
Look for IP patterns: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}

event.action: creation AND process.name: mstsc.exe
event.action: "Network connection detected" AND destination.port: 3389 AND NOT process.executable: ("C:\\Windows\\System32\\mstsc.exe" OR "C:\\Windows\\System32\\svchost.exe")
"reg add" OR "GE_DWORD" OR ("RDP-TCP" AND "PortNumber")   -- RDP port change

winlog.channel: Security AND event.code: 4825   -- Failed RDP auth by authenticated user
winlog.channel: Security AND event.code: 4624 AND winlog.event_data.LogonType: 10 AND source.ip: ("::1" OR "127.0.0.1")   -- Local loopback RDP (RDP hijacking precursor)

(process.name: mstsc.exe OR process.pid: 4) AND file.path: *Microsoft*Startup*

port == 22 || protocols == ssh
putty.exe OR plink.exe OR pscp.exe

wsmprovhost.exe
process.name: wmiprvse.exe
winrm

protocols == http AND port == 5985
destination.port: 5985 AND (network.protocol: http OR log.file.path: *http.log)

protocols == rdp  || port == 3389
protocols == telnet || port == 23
protocols == ssh || port == 22
protocols == vnc || port == 5900
protocols == [openvpn, wireguard, ike2, ipsec, pptp, sstp] || port == [500, 4500, 443, 1194, 51820, 1723]

event.code: (1149 OR 21 OR 25 OR 1024)
  1149: RDP auth succeeded | 21: Session logon | 25: Session reconnect | 1024: RDP client connection

port.dst == [25, 143, 993, 110, 995]
email.fn == EXISTS!

powershell AND "Invoke-WebRequest" AND "-OutFile"
event.code: 4663 AND file.extension: "url" AND NOT process.name: "explorer.exe"

event.action: "Process Create (rule: ProcessCreate)" AND process.parent.name: outlook.exe AND process.name: (arp.exe OR bitsadmin.exe OR certutil.exe OR cmd.exe OR cscript.exe OR mshta.exe OR net.exe OR nltest.exe OR ping.exe OR powershell.exe OR reg.exe OR regsvr32.exe OR sc.exe OR schtasks.exe OR tasklist.exe OR whoami.exe OR wmic.exe OR wscript.exe)

protocols == smb AND ip == [<IPs of interest>]

event.code: (5157 OR 5159 OR 5155 OR 5031)
  5157: WFP blocked connection | 5159: WFP blocked bind to port
  5155: WFP blocked app from listening | 5031: Windows Firewall blocked incoming connection

event.code: (5140 OR 5142 OR 5144 OR 5145)
  5140: Network share accessed | 5142: Share added | 5144: Share deleted | 5145: Share access check

event.code: 4663 AND "removable storage"

process.name: "tscon.exe" AND process.command_line: ("* /dest:*" OR "* /v *") AND NOT user.name: "SYSTEM"

Session hijacking occurs inside host OS memory and Terminal Services. Network traffic continues to look like a normal encrypted RDP stream. Rely entirely on endpoint/process logs.

process.parent.name: ("CcmExec.exe" OR "IntuneManagementExtension.exe" OR "PDQDeploy.exe") AND process.name: ("powershell.exe" OR "cmd.exe") AND process.command_line: ("*DownloadString*" OR "*vssadmin*" OR "*Net.WebClient*")

winlog.event_id: 5145 AND winlog.event_data.RelativeTargetName: ("*.lnk" OR "*.vbs" OR "*.wsf" OR "*.scr") AND winlog.event_data.AccessMask: "0x2"

protocols == smb && smb2.filename == r".*\.(lnk|vbs|scr)$"

winlog.event_id: 4624 AND winlog.logon.type: 9 AND winlog.event_data.LogonProcessName: "seclogo"

Over the network, a PtH attack looks exactly like a legitimate NTLM authentication sequence. Network tools cannot distinguish a stolen hash from a legitimately hashed password. Rely on endpoint logging.

protocols == smb AND ip == [<IPs of interest>]

event.code: (5157 OR 5159 OR 5155 OR 5031)

"SELECT" AND "FROM" AND "WHERE"
process.name: (SQLCMD.EXE OR sqlcmd.exe)

event.type: start AND ("systeminfo" OR "ipconfig" OR "hostname" OR "net user" OR "net localgroup" OR "net group" OR "net share" OR "net view" OR "netstat" OR "*tasklist*" OR "dir*" OR "ls*")

event.code: 4663 AND event.action: "Removable Storage"
event.code: 4663 AND NOT winlog.event_data_ObjectName: "C:\\*" AND winlog.event_data.ObjectType: File

process.name: powershell.exe AND process.command_line: (*Get-Volume* AND *Removable*)

destination.port: 445
destination.port: 445 AND NOT source.ip: <int IPs>

http.uri == [*.exe, *.dll, *.zip, *.7z, *.php, *.aspx] AND http.uri != [*google*, *windowsupdate*]
http.uri: (*.exe OR *.dll OR *.zip OR *.7z OR *.rar OR *.raw OR *.iso OR *.php OR *.aspx) AND NOT http.uri: (*google* OR *windowsupdate*)

file.path: ("*C:\\Windows\\Temp*" OR "*$Recycle.Bin*")
file.path: (*Temp* OR *temp* OR *Recycle*)

event.code: 10 AND TargetImage: (*.edb OR *.eml OR *.emlx OR *.mbox OR *.msg OR *.ost OR *.pst OR *.vcf)

process.command_line: (*ost* OR *pst*)

process.name: (powershell.exe OR pwsh.exe OR powershell_ise.exe) AND process.args: New-MailboxExportRequest*

protocols == smtp || port.dst == [110, 146, 465, 587, 993, 995]

protocols == smtp AND email.has-header.value == Forward AND email.md5 == EXISTS!

event.code: 4104
-- look for: Get-Inbox

event.category: process AND powershell.file.script_block_text: (CopyFromScreen AND ("System.Drawing.Bitmap" OR "Drawing.Bitmap"))

process.name: clip.exe
process.command_line: *Get-Clipboard*

event.code: (11 OR 1) AND <compressed file extension>
event.code: 11 AND *.(zip OR rar OR 7z) AND (C:\\Windows\\temp\\* OR %APPDATA%\\temp* OR appdata\\local\\temp)
event.code: 4688 AND parent.process.name: (cscript.exe OR wscript.exe)
event.code: 4663 AND (C:\\Windows\\temp\\* OR %APPDATA%\\temp* OR appdata\\local\\temp)

smb.fn == *.<compression ext>
ftp.fn == *.<compression ext>
email.fn == *.<compression ext>

process.name: Soundrecorder.exe
process.name: powershell.exe AND process.command_line: *WindowsAudioDevice-Powershell-Cmdlet*

event.category: process AND powershell.file.script_block_text: ("Get-MicrophoneAudio" OR "WindowsAudioDevice-Powershell-Cmdlet" OR (waveInGetNumDevs AND mciSendStringA)) AND NOT user.id: "S-1-5-18"

process.name: (*audio* OR *sound* OR *microphone*) AND NOT process.parent.name: (explorer.exe OR *system*)
file.type: dll AND (avrt OR winmm OR msacm32)
Audacity OR "screen capture" OR Ardour OR Ocenaudio

alert smb any any -> any any (msg:"SMB File Exfiltration Detected"; flow:established; file_data; fileext:"pdf,docx,xlsx,pptx"; filemagic:"%PDF-,%DOC-,%SLX-,%PPT-"; content:"NT Trans Request"; depth:15; sid:1000001; rev:1;)

event.code: (13 OR 14)    -- document checked out/in
event.code: (47 OR 48 OR 49 OR 50)   -- document/list viewed
event.code: (15 OR 19 OR 39)    -- object deleted/restored
event.code: (11 OR 12 OR 20 OR 25 OR 26 OR 27 OR 28 OR 29)   -- user/permission edits

event.type: ("start" OR "process_started") AND ((process.name: "rar.exe" OR process.pe.original_file_name: "Command line RAR") AND process.args: "a" AND process.args: ("-hp*" OR "-p*" OR "-dw" OR "-tb" OR "-ta" OR "/hp*" OR "/p*")) OR (process.pe.original_file_name: ("7z.exe" OR "7za.exe") AND process.args: "a" AND process.args: ("-p*" OR "-sdel"))

event.category: process_creation AND process.name: (7z.exe OR 7za.exe OR winzip.exe OR winzip64.exe OR rar.exe OR winrar.exe)
process.name: powershell.exe AND process.command_line: *Compress-Archive*
process.name: 7z*.exe AND process.command_line: *-p *   -- password-protected archive

file.name: (*.zip OR *.7z OR *.rar OR *.gzip OR *.tar) AND event.type: creation
(event.type: "file_created" OR event.type: "file_modified") AND file.extension: ("zip" OR "rar" OR "7z")

process.command_line: (*.ost* OR *.pst*)

process.name: (powershell.exe OR pwsh.exe OR powershell_ise.exe) AND process.args: *New-MailboxExportRequest*

-- Document checked out/in:
event.code: (13 OR 14)
-- Document/list viewed:
event.code: (47 OR 48 OR 49 OR 50)
-- Objects deleted/restored:
event.code: (15 OR 19 OR 39)
-- User and permission changes:
event.code: (11 OR 12 OR 20 OR 25 OR 26 OR 27 OR 28 OR 29 OR 30 OR 31 OR 32 OR 33 OR 34 OR 35 OR 36 OR 37 OR 38)

event.category: process_creation AND process.name: (7z.exe OR 7za.exe OR winzip.exe OR winzip64.exe OR rar.exe OR winrar.exe)
process.name: 7z*.exe AND process.command_line: *-p *
process.name: winzip*.exe AND process.command_line: *-s *
process.name: rar.exe AND process.command_line: *-hp*

process.name: powershell.exe AND process.command_line: *Compress-Archive*

file.name: (*.zip OR *.gzip OR *.tar OR *.7z OR *.rar) AND event.type: creation

event.type: ("start" OR "process_started") AND (
  (process.name: "rar.exe" AND process.args: "a" AND process.args: ("-hp*" OR "-p*" OR "-dw" OR "-tb" OR "-ta")) OR
  (process.pe.original_file_name: ("7z.exe" OR "7za.exe") AND process.args: "a" AND process.args: ("-p*" OR "-sdel"))
)

file.name: (*.zip OR *.7z OR *.rar OR *.gzip) AND event.type: creation

process.name: ("arpspoof" OR "ettercap" OR "bettercap" OR "mitmproxy") AND NOT user.name: "root"

protocols == arp && arp.opcode == 2

process.name: ("chrome.exe" OR "msedge.exe") AND process.command_line: "*--remote-debugging-port=*"

event.dataset: "aws.cloudtrail" AND event.provider: "s3.amazonaws.com" AND event.action: "GetObject" | stats count by user.name | where count > 1000

event.dataset: ("github.audit" OR "gitlab.audit") AND event.action: ("git.clone" OR "repository.download") | stats count by user.name | where count > 10

ip.src == [Git_Server_IP] && bytes > 10000000

winlog.event_id: 11 AND file.path: ("*\\Temp\\*.log" OR "*\\AppData\\Local\\Temp\\*.txt") AND process.executable: ("*\\Temp\\*.exe" OR "*\\AppData\\Local\\Temp\\*.exe")

winlog.event_id: (12 OR 13) AND registry.path: "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\webcam\\*"

process.name: ("ffmpeg" OR "vlc" OR "mpv") AND process.command_line: "*/dev/video*" AND NOT user.name: "root"

http.request.method: POST

process.name: (powershell.exe OR cmd.exe) AND process.command_line: *base64*
process.name: powershell.exe AND process.command_line: (*-e* OR *-enc*)

http.method == [GET,POST] && http.statuscode == 200 && entropy.http==[6,7,8] && ip.dst != [<private IPs>]
http.method == [GET,POST] && http.statuscode == 200 && http.content-type == application/x-www-form-urlencoded

protocols == http && http.uri == EXISTS! && http.host == EXISTS! && http.method == [GET,POST] && http.statuscode == 200 && entropy.http == [6,7,8]

-- Focus on specific suspicious hosts rather than bulk scanning
-- Use CyberChef to identify encoded content in libfile-parsed file transfers
-- Correlate with known C2 domain/IP IOCs to corroborate findings

process.command_line: (*-SSL* OR *-Si* OR *-Sp* OR *-Up* OR *-Pi* OR *-Pp* OR *-HTTP*)
-- -SSL: TLS tunneling  -Si: C2 IP  -Sp: C2 port  -Up: C2 UDP port
-- -Pi: proxy IP  -Pp: proxy port  -HTTP: HTTP persistent connection

-- Look for client sending significantly more data than it receives (upload-heavy)
-- Processes with unexpected external network connections
-- Packet contents not matching expected protocol behavior for the port used

protocols == irc || port == [194,6667]

protocols == telnet || port == 23

protocols == stratum || port == 10001

protocols == rdp || port == 7519

process.name: powershell.exe AND process.command_line: *Invoke-WebRequest* AND process.command_line: (*HttpBrowser* OR *Wget* OR *Opera*)

process.name: curl.exe AND process.command_line: *-s* AND process.command_line: *-A* AND process.command_line: (*HttpBrowser* OR *Wget* OR *Opera*)

event.category:(network or network_traffic) AND (
  tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83 OR
  tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C OR
  tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C
)

http.method==POST && host.http==EXISTS!
tls.ja3 ==EXISTS!

protocols == ftp || protocols == ftps || protocols == tftp
port == [20,21,990,989,69]

protocols == smb || port == [445,137,138,139]

protocols == smtp || protocols == smtps || protocols == pop3 || protocols == imap
port == [143,993,110,995,25,465]

event.category:(network OR network_traffic) AND network.protocol:http AND network.transport:tcp AND url.full:/http:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/cd/ AND destination.port:(53 OR 80 OR 8080 OR 443)

email.fn == EXISTS!

event.category:process AND event.type:start AND process.name:nslookup.exe AND process.args:(-querytype=* OR -qt=* OR -q=* OR -type=*)

-- Create Kibana vertical bar graph:
--   Filter: event.module:"zeek" AND fileset.name:"dns"
--   Y-axis: Unique Count of dns.question.name
--   X-axis: Term aggregation on source.ip
-- Hosts with far more unique DNS queries than peers are suspicious
-- High NXDOMAIN rate = possible DGA malware C2 beaconing

protocols == socks
port == 5090

process.name: (amule.exe OR ares.exe OR azureus.exe OR bearshare.exe OR bitcomet.exe OR bitlord.exe OR bittorrent.exe OR deluge.exe OR frostwire.exe OR limewire.exe OR mlnet.exe OR overnet.exe OR popcorn-time.exe OR pplive.exe OR qtorrent.exe OR tribler.exe OR tvants.exe OR utorrent.exe OR vuze.exe OR zultrax.exe) OR process.name: *torrent*

process.name: tor.exe

-- Request list of authorized VPN servers from network team
-- Analyze VPN and ICMP traffic for anomalies
-- Obtain Tor exit/guard node IP lists from threat intel feeds

event.code: (6416 OR 4663)
-- 6416: New external device recognized  4663: Object access performed

event.code: 4688 AND NOT winlog.event_data.NewProcessName: ("C:\\*" OR "D:\\*")

ip.protocol == icmp && icmp.type == [0,8]
-- Add bytes filter for packets >200 bytes
-- icmp.request.code  icmp.response.code

network.transport: icmp AND zeek.connection.icmp.type: (0 OR 8)

network.protocol: dns AND NOT user.id: ("S-1-5-18" OR "S-1-5-19" OR "S-1-5-20") AND dns.question.name: (
  "raw.githubusercontent.*" OR "*.pastebin.*" OR "*drive.google.*" OR
  "*api.dropboxapi.*" OR "*dropboxusercontent.*" OR "*onedrive.*" OR
  "*slack-files.com" OR "*ghostbin.*" OR "*ngrok.*" OR "*portmap.*" OR
  "*serveo.net" OR "*localtunnel.me" OR "*pagekite.me" OR "*localxpose.io" OR
  "*notabug.org" OR "rawcdn.githack.*" OR "paste.nrecom.net" OR
  "zerobin.net" OR "controlc.com" OR "requestbin.net"
) AND NOT process.executable: (
  "?:\\Program Files\\*.exe" OR "?:\\Program Files (x86)\\*.exe" OR
  "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe" OR
  "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe"
)

process.name: powershell.exe AND process.command_line: (*downloadstring* OR *downloaddata* OR *downloadfile* OR *iex* OR *.invoke* OR *invoke-expression* OR *Invoke-WebRequest*)

process.name: certutil.exe AND process.command_line: (*urlcache* AND *split*)

process.name: bitsadmin.exe AND process.command_line: (*download* OR *transfer*)

event.type: "start" AND (process.name: "CertReq.exe" OR process.pe.original_file_name: "CertReq.exe") AND process.args: "-Post"

event.type: "start" AND (process.name: "desktopimgdownldr.exe" OR process.pe.original_file_name: "desktopimgdownldr.exe") AND process.args: "/lockscreenurl:http*"

event.category:network AND event.type:connection AND process.name:cmd.exe AND NOT destination.ip:(10.0.0.0/8 OR 172.16.0.0/12 OR 192.168.0.0/16)

event.code: (3 OR 11) AND process.executable: (*bitsadmin.exe OR *rsync.exe OR *scp.exe OR *sftp.exe OR *certutil.exe OR *nc.exe OR *MpCmdRun.exe)

process.name: certutil.exe AND process.command_line: (*-encode* OR *-decode*)

process.command_line: *base64*
process.command_line: *bxor*
process.name: (winzip.exe OR winrar.exe OR 7z.exe OR peazip.exe)

process.name: powershell.exe AND process.command_line: (*-band* OR *-bor* OR *-bxor* OR *-bnot* OR *-shl* OR *-shr*)

event.category:(network OR network_traffic) AND type:(tls OR http) AND network.transport:tcp AND destination.domain: /[a-z]{3}\.stage\.[0-9]{8}\..*/

-- CDN domains may trigger DGA detections due to similar naming patterns
-- Check for recently registered domains (WHOIS age < 30 days)
-- Look for high NXDOMAIN rates from single hosts
-- Use entropy/frequency analysis on dns.question.name in Kibana

process.name: ssh AND event.action: (connection_attempted OR connection_accepted) AND NOT destination.port: 22

event.action: exec AND process.name: ssh

registry.path: ("HKLM\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*" OR "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*")

event.code: 1 AND process.command_line: (*screenshot* OR *Sys_info* OR *Get-Network* OR *Scan_all*)

tls.cipher == EXISTS! && ip.dst != [<private IPs>]

tls.cipher: * AND NOT destination.ip: (10.0.0.0/8 OR 172.16.0.0/12 OR 192.168.0.0/16)

alert tcp any any -> any any (msg:"Asymmetric Cryptography Traffic Detected (SSL/TLS)";flow:established,from_server;content:"|01|";depth:1;offset:9;sid:1000005;rev:1;)

alert tls any any -> any any (msg:"Self-Signed Certificate Detected";tls.cert_subject;content:"issuer";content:"OU";within:30;sid:1000006;rev:1;)

subject_key_identifier: null AND extensions.authority_key_identifier: null

network.direction: "outbound" AND http.response.status_code: 200 AND http.response.bytes < 500 | stats count by url.original | where count > 1000

event.dataset: "proxy" AND tls.client.server_name: ("*google.com*" OR "*cloudfront.net*") AND NOT http.request.headers.host: ("*google.com*" OR "*cloudfront.net*")

Without SSL decryption the HTTP Host header is invisible. Hunt for endpoints sending large sustained data transfers to CDN IP ranges that don't match normal baseline web browsing.

winlog.event_id: 8 AND process.parent.name: ("powershell.exe" OR "cmd.exe" OR "wscript.exe")
-- Correlate injection timestamp with preceding outbound connections (Event ID 3)

process.name: ("AnyDesk.exe" OR "TeamViewer_Service.exe" OR "screenconnect.exe" OR "AteraAgent.exe" OR "meshagent.exe")

dns.host == r".*(anydesk|teamviewer|screenconnect|logmein|atera)\.com"

event.action: "deny" AND network.transport: "tcp" | stats dc(destination.port) as ports_hit by source.ip | where ports_hit > 3

http.request.body.content: *download* AND http.request.body.content: (*.zip OR *.rar OR *.7z OR *.gz OR *.tar OR *.bz2 OR *.xz OR *.lzma OR *.lz4 OR *.zst)

http.request.method: POST AND url.original: (*.zip OR *.rar OR *.7z OR *.gz OR *.tar OR *.bz2 OR *.xz OR *.lzma OR *.lz4 OR *.zst)

event.category:(network OR network_traffic) AND network.transport:tcp AND (destination.port:26 OR (event.dataset:zeek.smtp AND destination.port:26))

protocols == [ftp,smtp,https,dns,smb]

network.transport:tcp AND destination.port:(139 OR 445) AND NOT destination.ip:(10.0.0.0/8 OR 172.16.0.0/12 OR 192.168.0.0/16)

protocols == ftp
-- Search session content for "STOR" command (file upload)

protocols == http && http.method == POST

-- Create Kibana visualization:
--   Filter: event.module:"zeek" AND fileset.name:"dns"
--   Y-axis: Unique Count of dns.question.name
--   X-axis: Term aggregation on source.ip
-- Hosts with abnormally high unique DNS query counts may be exfiltrating via DNS

event.code: 6416

event.code: 4688 AND winlog.event_data.CommandLine: *
-- Inspect drive letter in CommandLine: E:, F:, G: etc. may indicate removable drive

event.code: (2003 OR 2100 OR 2102)
-- 2003: USB device connection initiated
-- 2100: Intermediate USB disconnection tracked
-- 2102: Final USB disconnection

process.name: ("rclone.exe" OR "pscp.exe" OR "filezilla.exe" OR "winscp.exe") AND process.command_line: ("*sync*" OR "*copy*") AND process.command_line: ("*ftp:*" OR "*sftp:*" OR "*scp:*")

protocols == ftp && ftp.request.command == "STOR"

process.name: ("7z.exe" OR "rar.exe" OR "tar") AND process.command_line: ("*-v*" OR "*split*") AND process.command_line: ("*m *" OR "*k *")

network.direction: "outbound" AND network.bytes >= 9500000 AND network.bytes <= 10500000 | stats count by destination.ip | where count > 20

winlog.channel: "Microsoft-Windows-WLAN-AutoConfig/Operational" AND winlog.event_id: 8001 AND NOT winlog.event_data.SSID: "Corporate_WiFi"

Data exfiltrated over cellular or a different Wi-Fi network bypasses the corporate firewall and IDS entirely. You will have zero network visibility. Rely on endpoint USB/adapter logs and WLAN event logs.

event.dataset: "network_traffic" AND destination.domain: ("*dropbox.com*" OR "*drive.google.com*" OR "*mega.nz*" OR "*pastebin.com*") AND network.direction: "outbound"

http.method == "POST" && (host == "api.dropboxapi.com" || host == "www.googleapis.com" || host == "gofile.io")

network.direction: "outbound" AND source.bytes > 100000000 AND (hour_of_day > 20 OR hour_of_day < 5)

process.parent.name: "svchost.exe" AND process.name: ("curl.exe" OR "powershell.exe" OR "rclone.exe") AND process.command_line: ("*POST*" OR "*upload*")

event.dataset: "aws.cloudtrail" AND event.action: ("ModifySnapshotAttribute" OR "ModifyImageAttribute") AND requestParameters.createVolumePermission.add.items.userId: *

Cloud-to-cloud exfiltration (e.g., AWS snapshot copy, S3 bucket sync to another account) happens on the provider's dark fiber. You will have zero network visibility. Rely entirely on CloudTrail / Azure Audit logs.

protocols == tcp && tcpflags.syn == 1 && tcpflags.ack == 0
-- Each SYN should have different source IP with identical window size (spoofed sources)

protocols == icmp

protocols == udp && port == [7,19]

event.code: (1074 OR 6006)
-- 1074: System shutdown/restart initiated by a process
-- 6006: Event Log Service stopped (clean shutdown)

event.code: (41 OR 1076 OR 6005 OR 6008 OR 6013)
-- 41: Unexpected reboot (kernel power)
-- 1076: User-specified reason for last unexpected shutdown
-- 6005: Event Log Service started (system startup)
-- 6008: Unexpected/dirty shutdown recorded
-- 6013: System uptime

process.name: shutdown.exe

winlog.event_id: (4724 OR 4726) AND winlog.event_data.TargetUserName: ("*admin*" OR "Administrator") AND NOT user.name: "SYSTEM"

process.name: ("sdelete.exe" OR "cipher.exe" OR "fsutil.exe") AND process.command_line: ("*-z*" OR "*/w:*" OR "*usn deletejournal*")

event.category: "file" AND event.action: "deletion" AND file.path: ("*\\Documents\\*" OR "*\\Desktop\\*") | stats count by process.name | where count > 1000

winlog.event_id: 5145 AND winlog.event_data.AccessMask: "0x120116" | stats count by source.ip | where count > 5000

event.category: "file" AND event.action: "creation" AND file.name: ("*decrypt*" OR "*RECOVER*" OR "*ransom*" OR "*README*") | stats count by process.name | where count > 10

event.dataset: "sql.audit" AND event.action: ("UPDATE" OR "INSERT" OR "DELETE") AND NOT user.name: ("app_service_account") | stats count by user.name | where count > 500

winlog.event_id: 2 AND file.path: ("*\\Finance\\*" OR "*\\HR\\*" OR "*\\Legal\\*") AND NOT process.name: ("WINWORD.EXE" OR "EXCEL.EXE")

event.category: "file" AND event.action: ("modification" OR "creation") AND file.path: ("*\\inetpub\\wwwroot\\*" OR "*\\var\\www\\html\\*") AND NOT process.name: ("w3wp.exe" OR "httpd" OR "nginx")

event.category: "file" AND event.action: "creation" AND file.path: ("*\\wwwroot\\*" OR "*\\public_html\\*") AND file.extension: ("php" OR "asp" OR "aspx" OR "jsp" OR "html")

winlog.event_id: 9 AND winlog.event_data.Device: "\\Device\\HarddiskVolume*" AND process.executable: ("*\\Temp\\*" OR "*\\AppData\\*")

process.name: "dd" AND process.command_line: ("*if=/dev/zero*" OR "*if=/dev/urandom*") AND process.command_line: "*of=/dev/sd*"

process.name: ("bash" OR "sh") AND process.command_line: ":(){ :|:& };:"

event.category: "process" AND event.type: "start" | stats count by process.parent.name | where count > 1000

event.dataset: "o365.audit" AND event.action: ("New-InboxRule" OR "Set-InboxRule") AND winlog.event_data.Parameters: ("*ForwardTo*" OR "*RedirectTo*") AND winlog.event_data.Parameters: ("*@gmail.com*" OR "*@protonmail*")

process.name: ("bitcoin-qt.exe" OR "electrum.exe" OR "exodus.exe") OR destination.domain: ("*binance.com*" OR "*coinbase.com*" OR "*kraken.com*")

process.name: ("fwupdate.exe" OR "flashrom" OR "chipsec_main.py") AND NOT process.code_signature.trusted: true

winlog.event_id: 13 AND registry.path: "*\\HARDWARE\\UEFI\\*" AND NOT process.name: ("MoSetup.exe" OR "setupact.exe")

process.name: ("vssadmin.exe" OR "bcdedit.exe" OR "wbadmin.exe" OR "wmic.exe") AND process.command_line: ("*delete shadows*" OR "*recoveryenabled No*" OR "*delete catalog*" OR "*shadowcopy delete*")

process.name: ("xmrig" OR "minerd" OR "cgminer" OR "xmr-stak") OR process.command_line: ("*--donate-level*" OR "*-o stratum+tcp://*" OR "*pool.minexmr.com*")

protocols == tcp && tcp.payload contains "mining.subscribe"

process.name: ("net.exe" OR "sc.exe" OR "taskkill.exe") AND process.command_line: ("* stop msexchange*" OR "* stop mssql*" OR "* stop veeam*" OR "* /im sqlservr.exe*")