| Dangerous emails with links clicked |
Collection |
📦 Egress Defend |
| Dangerous emails with links clicked |
Collection |
📦 KnowBe4 Defend |
| DarkSide |
Ransomware |
🔗 GitHub Only |
| Data copied to other location than C drive |
- |
🔗 GitHub Only |
| Dataverse - Activity after failed logons |
InitialAccess |
📦 Microsoft Business Applications |
| Dataverse - Activity after Microsoft Entra alerts |
InitialAccess |
📦 Microsoft Business Applications |
| Dataverse - Cross-environment data export activity |
Exfiltration, Collection |
📦 Microsoft Business Applications |
| Dataverse - Dataverse export copied to USB devices |
Exfiltration |
📦 Microsoft Business Applications |
| Dataverse - Generic client app used to access production environments |
Execution |
📦 Microsoft Business Applications |
| Dataverse - Identity management activity outside of privileged directory role membership |
PrivilegeEscalation |
📦 Microsoft Business Applications |
| Dataverse - Identity management changes without MFA |
InitialAccess |
📦 Microsoft Business Applications |
| Decoy User Account Authentication Attempt |
LateralMovement |
📦 Windows Security Events |
| Defender for Endpoint Telemetry |
- |
🔗 GitHub Only |
| Deimos Component Execution |
Execution, Collection, Exfiltration, Impact |
📦 Microsoft Defender XDR |
| deimos-component-execution |
Execution, Collection, Exfiltration, Impact, Malware, component |
🔗 GitHub Only |
| deleting-data-w-cipher-tool |
Defense evasion |
🔗 GitHub Only |
| Deletion of data on multiple drives using cipher exe |
Impact |
📦 Microsoft Defender XDR |
| Deletion of data on multiple drives using cipher exe |
Ransomware |
🔗 GitHub Only |
| dell-driver-vulnerability-2021 |
Privilege escalation |
🔗 GitHub Only |
| Detect Azure RemoteIP |
- |
🔗 GitHub Only |
| Detect beacon like pattern based on repetitive time intervals in Wire Data Traffic |
CommandAndControl |
📄 Standalone Content |
| Detect Certutil (LOLBins and LOLScripts) Usage |
CommandAndControl |
📦 Endpoint Threat Protection Essentials |
| Detect CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities |
Execution |
📦 Microsoft Defender XDR |
| Detect CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities |
Execution |
🔗 GitHub Only |
| Detect Disabled Account Sign-in Attempts by Account Name |
InitialAccess |
📦 Cloud Identity Threat Protection Essentials |
| Detect Disabled Account Sign-in Attempts by IP Address |
InitialAccess |
📦 Cloud Identity Threat Protection Essentials |
| Detect DNS obfuscation using @ symbol |
- |
🔗 GitHub Only |
| Detect Encoded Powershell |
Execution |
🔗 GitHub Only |
| Detect Enumeration Activity Using Unique Identifiers and Session Aggregation |
Reconnaissance, Collection |
🔗 GitHub Only |
| Detect File Creation in Startup Folder |
Persistence, PrivilegeEscalation, DefenseEvasion |
📦 Malware Protection Essentials |
| Detect Files with Ramsomware Extensions |
Execution, Impact |
📦 Malware Protection Essentials |
| Detect IPAddress in the requested URL (ASIM Web Session) |
Exfiltration, CommandAndControl |
📦 Web Session Essentials |
| Detect Kali Linux UserAgent (ASIM Web Session) |
Execution |
📦 Web Session Essentials |
| Detect MaiSniper |
InitialAccess, CredentialAccess, Collection, Exfiltration |
📦 Microsoft Defender XDR |
| Detect Malicious use of MSIExec |
Execution, PrivilegeEscalation, CredentialAccess |
📦 Microsoft Defender XDR |
| Detect Malicious use of Msiexec Mimikatz |
Execution, CredentialAccess, PrivilegeEscalation |
📦 Microsoft Defender XDR |
| Detect Modification to System Files or Directories by User Accounts |
DefenseEvasion, Persistence, PrivilegeEscalation |
📦 Malware Protection Essentials |
| Detect New Scheduled Task Creation that Run Executables From Non-Standard Location |
Execution, PrivilegeEscalation, Persistence |
📦 Malware Protection Essentials |
| Detect New Scheduled Task Entry Creations |
Execution, PrivilegeEscalation, Persistence |
📦 Malware Protection Essentials |
| Detect Outbound LDAP Traffic(ASIM Network Session schema) |
InitialAccess, Execution |
📦 Network Session Essentials |
| Detect port misuse by anomaly (ASIM Network Session schema) |
CommandAndControl, InitialAccess, Execution |
📦 Network Session Essentials |
| Detect port misuse by static threshold (ASIM Network Session schema) |
CommandAndControl, InitialAccess, Execution |
📦 Network Session Essentials |
| Detect Potential kerberoast Activities |
LateralMovement |
📦 Microsoft Defender XDR |
| Detect potential kerberoast activities |
Lateral movement |
🔗 GitHub Only |
| Detect PowerShell v2 Downgrade |
Execution |
🔗 GitHub Only |
| Detect Suspicious Commands Initiated by Webserver Processes |
Execution, DefenseEvasion, Discovery |
📦 Microsoft Defender XDR |
| Detect Suspicious Mshta Usage |
Execution |
📦 Microsoft Defender XDR |
| Detect threat information in web requests (ASIM Web Session) |
InitialAccess |
📦 Web Session Essentials |
| detect-anomalous-process-trees |
Initial access, Execution, Persistence, Discovery, Lateral movement |
🔗 GitHub Only |
| detect-archive-exfiltration-to-competitor |
Exfiltration |
🔗 GitHub Only |
| detect-bluekeep-exploitation-attempts |
Initial access, Lateral movement |
🔗 GitHub Only |
| detect-bluekeep-related-mining |
Execution |
🔗 GitHub Only |
| detect-cve-2019-0863-AngryPolarBearBug2-exploit |
Privilege escalation |
🔗 GitHub Only |
| detect-cve-2019-0973-installerbypass-exploit |
Privilege escalation |
🔗 GitHub Only |
| detect-cve-2019-1053-sandboxescape-exploit |
Privilege escalation |
🔗 GitHub Only |
| detect-cve-2019-1069-bearlpe-exploit |
Privilege escalation |
🔗 GitHub Only |
| detect-cve-2019-1129-byebear-exploit |
Privilege escalation |
🔗 GitHub Only |
| detect-cyzfc-activity |
Execution |
🔗 GitHub Only |
| detect-cyzfc-activity (1) |
Execution |
🔗 GitHub Only |
| detect-cyzfc-activity (2) |
Execution |
🔗 GitHub Only |
| detect-cyzfc-activity (3) |
Execution |
🔗 GitHub Only |
| detect-cyzfc-activity (4) |
Execution |
🔗 GitHub Only |
| detect-doublepulsar-execution |
Execution |
🔗 GitHub Only |
| detect-exfiltration-after-termination |
Exfiltration |
🔗 GitHub Only |
| detect-exploitation-of-cve-2018-8653 |
Initial access, Execution |
🔗 GitHub Only |
| detect-impacket-atexec |
Execution |
🔗 GitHub Only |
| detect-impacket-dcomexec |
Execution |
🔗 GitHub Only |
| detect-impacket-psexec-module |
Execution |
🔗 GitHub Only |
| detect-impacket-wmiexec |
Execution |
🔗 GitHub Only |
| detect-impacket-wmiexec |
Execution |
🔗 GitHub Only |
| detect-impacket-wmiexec |
Execution |
🔗 GitHub Only |
| detect-impacket-wmipersist |
Persistence |
🔗 GitHub Only |
| detect-jscript-file-creation |
Execution, Defense evasion |
🔗 GitHub Only |
| detect-mailsniper |
Initial access, Credential Access, Collection, Exfiltration |
🔗 GitHub Only |
| detect-malicious-rar-extraction |
Initial access, Execution, Persistence, Command and control |
🔗 GitHub Only |
| detect-malicious-use-of-msiexec |
Execution, Privilege escalation, Credential Access |
🔗 GitHub Only |
| detect-malicious-use-of-msiexec-mimikatz |
Execution, Privilege escalation, Credential Access |
🔗 GitHub Only |
| detect-malicious-use-of-msiexec-powershell |
Execution, Privilege escalation, Credential Access |
🔗 GitHub Only |
| detect-nbtscan-activity |
Discovery |
🔗 GitHub Only |
| Detect-Not-Active-AD-User-Accounts |
- |
🔗 GitHub Only |
| detect-office-applications-spawning-msdt-CVE-2022-30190 |
Defense Evasion |
🔗 GitHub Only |
| detect-office-products-spawning-wmic |
Execution |
🔗 GitHub Only |
| detect-prifou-pua |
Persistence, Malware, component |
🔗 GitHub Only |
| detect-steganography-exfiltration |
Exfiltration |
🔗 GitHub Only |
| detect-suspicious-commands-initiated-by-web-server-processes |
Execution, Defense evasion, Discovery |
🔗 GitHub Only |
| detect-suspicious-mshta-usage |
Execution, Execution |
🔗 GitHub Only |
| detect-suspicious-rdp-connections |
Initial access, Discovery, Lateral movement |
🔗 GitHub Only |
| detect-uac-elevation |
Execution |
🔗 GitHub Only |
| detect-web-server-exploit-doublepulsar |
Execution |
🔗 GitHub Only |
| Detecting Suspicious PowerShell Command Executions |
Execution |
📦 Cyware |
| Detecting Suspicious PowerShell Command Executions |
CommandAndControl |
📦 Cyware |
| Detections by detection methods |
InitialAccess |
📦 Microsoft Defender XDR |
| Detections by detection methods |
InitialAccess |
🔗 GitHub Only |
| Detects several users with the same MAC address (ASIM Network Session schema) |
InitialAccess |
📦 Network Session Essentials |
| DetectTorRelayConnectivity |
Discovery, Command and control |
🔗 GitHub Only |
| DetectTorrentUse |
- |
🔗 GitHub Only |
| Determine Successfully Delivered Phishing Emails by top IP Addresses |
InitialAccess |
📦 Microsoft Defender XDR |
| Determine Successfully Delivered Phishing Emails to Inbox/Junk folder. |
InitialAccess |
📦 Microsoft Defender XDR |
| Determine users with cluster admin role |
Persistence |
📦 Azure kubernetes Service |
| Dev-0056 Command Line Activity November 2021 |
CommandAndControl |
📦 Legacy IOC based Threat Protection |
| Dev-0056 Command Line Activity November 2021 (ASIM Version) |
CommandAndControl |
🔗 GitHub Only |
| Dev-0322 Command Line Activity November 2021 |
Persistence, LateralMovement, CommandAndControl |
📦 Legacy IOC based Threat Protection |
| Dev-0322 Command Line Activity November 2021 (ASIM Version) |
Persistence, LateralMovement, CommandAndControl |
📦 Legacy IOC based Threat Protection |
| Dev-0322 File Drop Activity November 2021 |
Persistence, CommandAndControl |
📦 Legacy IOC based Threat Protection |
| Dev-0322 File Drop Activity November 2021 (ASIM Version) |
Persistence, CommandAndControl |
📦 Legacy IOC based Threat Protection |
| Device Count by DNS Suffix |
- |
🔗 GitHub Only |
| Device Logons from Unknown IPs |
- |
🔗 GitHub Only |
| Device network events w low count FQDN |
- |
🔗 GitHub Only |
| Device uptime calculation |
Initial access, Persistence, Command and control |
🔗 GitHub Only |
| Devices By Specific DeviceType and DeviceSubtype |
- |
🔗 GitHub Only |
| Devices In Subnet - IPAddressV4 |
- |
🔗 GitHub Only |
| Devices In Subnet - IPAddressV6 |
- |
🔗 GitHub Only |
| Devices with Log4j vulnerability alerts and additional other alert related context |
InitialAccess, Execution |
📦 Microsoft Defender XDR |
| Devices with Log4j vulnerability alerts and additional other alert related context |
Vulnerability |
🔗 GitHub Only |
| devices_with_vuln_and_users_received_payload |
- |
🔗 GitHub Only |
| devices_with_vuln_and_users_received_payload (1) |
- |
🔗 GitHub Only |
| Digital Guardian - Files sent by users |
Exfiltration |
📦 Digital Guardian Data Loss Prevention |
| Digital Guardian - Incident domains |
Exfiltration |
📦 Digital Guardian Data Loss Prevention |
| Digital Guardian - Insecure file transfer sources |
Exfiltration |
📦 Digital Guardian Data Loss Prevention |
| Digital Guardian - Inspected files |
Exfiltration |
📦 Digital Guardian Data Loss Prevention |
| Digital Guardian - New incidents |
Exfiltration |
📦 Digital Guardian Data Loss Prevention |
| Digital Guardian - Rare destination ports |
Exfiltration |
📦 Digital Guardian Data Loss Prevention |
| Digital Guardian - Rare network protocols |
Exfiltration |
📦 Digital Guardian Data Loss Prevention |
| Digital Guardian - Rare Urls |
Exfiltration |
📦 Digital Guardian Data Loss Prevention |
| Digital Guardian - Urls used |
Exfiltration |
📦 Digital Guardian Data Loss Prevention |
| Digital Guardian - Users' incidents |
Exfiltration |
📦 Digital Guardian Data Loss Prevention |
| Disable Controlled Folders |
Ransomware |
🔗 GitHub Only |
| Disabled accounts using Squid proxy |
CredentialAccess |
📄 Standalone Content |
| Disabling Services via Registry |
DefenseEvasion |
📦 Microsoft Defender XDR |
| Disabling Services via Registry |
Defense Evasion |
🔗 GitHub Only |
| Discord download invoked from cmd line |
Execution, CommandAndControl, Exfiltration |
📦 Windows Security Events |
| Discord download invoked from cmd line (ASIM Version) |
Execution, CommandAndControl, Exfiltration |
📄 Standalone Content |
| Discover hosts doing possible network scans |
- |
🔗 GitHub Only |
| Discovering potentially tampered devices [Nobelium] |
Defense evasion |
🔗 GitHub Only |
| Discovery for highly-privileged accounts |
Discovery, Ransomware |
🔗 GitHub Only |
| Display Name - Spoof and Impersonation |
InitialAccess |
📦 Microsoft Defender XDR |
| Display Name - Spoof and Impersonation |
InitialAccess |
🔗 GitHub Only |
| Distribution from remote location |
Ransomware |
🔗 GitHub Only |
| DKIM Failure Trend |
InitialAccess |
📦 Microsoft Defender XDR |
| DKIM Failure Trend |
InitialAccess |
🔗 GitHub Only |
| DLLHost.exe file creation via PowerShell |
Execution |
🔗 GitHub Only |
| DLLHost.exe WMIC domain discovery |
Reconnaissance |
📦 Microsoft Defender XDR |
| DLLHost.exe WMIC domain discovery |
Reconnaissance |
🔗 GitHub Only |
| DMARC Failure Trend |
InitialAccess |
📦 Microsoft Defender XDR |
| DMARC Failure Trend |
InitialAccess |
🔗 GitHub Only |
| DNS - domain anomalous lookup increase |
CommandAndControl, Exfiltration |
📦 Windows Server DNS |
| DNS Domains linked to WannaCry ransomware campaign |
Impact |
📦 Windows Server DNS |
| DNS Full Name anomalous lookup increase |
CommandAndControl, Exfiltration |
📦 Windows Server DNS |
| DNS lookups for commonly abused TLDs |
CommandAndControl, Exfiltration |
📦 Windows Server DNS |
| DNSPattern [Nobelium] |
Command and control |
🔗 GitHub Only |
| Doc attachment with link to download |
- |
🔗 GitHub Only |
| DofoilNameCoinServerTraffic |
- |
🔗 GitHub Only |
| Domain controller installation media creation |
CredentialAccess |
📦 Windows Security Events |
| doppelpaymer |
Discovery, Lateral movement |
🔗 GitHub Only |
| Doppelpaymer Stop Services |
Execution, DefenseEvasion |
📦 Microsoft Defender XDR |
| doppelpaymer-procdump |
Credential Access |
🔗 GitHub Only |
| doppelpaymer-psexec |
Lateral movement |
🔗 GitHub Only |
| doppelpaymer-stop-services |
Execution, Defense evasion |
🔗 GitHub Only |
| Dopplepaymer In-Memory Malware Implant |
- |
🔗 GitHub Only |
| DopplePaymer Procdump |
CredentialAccess |
📦 Microsoft Defender XDR |
| Dormant account activity from uncommon country |
- |
📦 UEBA Essentials |
| Dormant Local Admin Logon |
PrivilegeEscalation |
📦 UEBA Essentials |
| Dormant Service Principal Update Creds and Logs In |
Persistence |
🔗 GitHub Only |
| Dormant User Update MFA and Logs In |
Persistence |
🔗 GitHub Only |
| Dormant User Update MFA and Logs In - UEBA |
Persistence |
🔗 GitHub Only |
| Download of New File Using Curl |
CommandAndControl |
📦 Endpoint Threat Protection Essentials |
| Download of New File Using Curl |
CommandAndControl |
🔗 GitHub Only |
| Dragon Fly |
- |
🔗 GitHub Only |
| Dropbox downloads linked from other site |
- |
🔗 GitHub Only |
| Dropping Payload via certutil |
InitialAccess, DefenseEvasion |
📦 Microsoft Defender XDR |
| Dropping payload via certutil |
Initial access, Defense evasion |
🔗 GitHub Only |