Every published rule

Suspicious Process Execution by Microsoft OneNote on Windows Child Programs

Alerts when onenote.exe spawns suspicious script or system execution child processes on Windows, consistent with malicious OneNote payload behavior.

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

Alerts on Windows process launches of Seatbelt.exe with discovery group arguments and outputfile usage.

PowerShell Set-Acl targeting Windows folder paths on Windows

Flags PowerShell Set-Acl commands that modify ACLs for Windows folder paths, often using FullControl/Allow.

PowerShell Set-Acl Script Execution Changes File or Folder Permissions on Windows

Flags PowerShell commands using Set-Acl (-AclObject and -Path) to alter Windows file or folder permissions.

PowerShell Set-Service SecurityDescriptorSddl DACL Modification for Windows Services

Detects PowerShell Set-Service commands with SecurityDescriptorSddl SDDL patterns that modify Windows service DACLs.

Windows PowerShell Set-Service SDDL Usage to Hide Services

Flags pwsh Set-Service commands that set a SecurityDescriptorSddl to hide a Windows service from other tools.

PowerShell Set-Service SecurityDescriptor (DCLCWPDTSD) to Hide Services

Flags PowerShell Set-Service calls that set a SecurityDescriptor SDDL (DCLCWPDTSD) to hide services from other utilities.

Windows Security Event 5136: msDS-KeyCredentialLink Shadow Credential Added to AD Object

Alerts on AD attribute changes adding to msDS-KeyCredentialLink via Windows Security EventID 5136, consistent with shadow credential additions.

macOS Process Execution Traces Indicating WizardUpdate Downloader/C2 Staging

Flags macOS process creations showing curl+eval execution and intermediate agent indicators associated with WizardUpdate activity.

Windows process execution: wermgr.exe running outside standard system directories

Alerts when wermgr.exe is launched from a non-standard directory on Windows.

Windows Process Creation: Suspicious Child Process Spawned by Wermgr.EXE

Alerts on suspicious children spawned by wermgr.exe using common execution utilities, with a rundll32 WerConCpl exclusion.

Windows Kerberos Replay Attack Likely Activity on Domain Controllers (Event ID 4649)

Alerts on Windows Security Event 4649 indicating a Kerberos replay error (KRB_AP_ERR_REPEAT).

Windows: ssh.exe RDP tunneling to :3389 via SSH

Alerts on Windows process executions of ssh.exe that reference RDP port :3389 for SSH tunneling.

Windows Process Execution of PCHunter (PCHunter64.exe or PCHunter32.exe)

Flags Windows execution of PCHunter64/32.exe using image path plus PE metadata and known hashes.

Windows MSSQL: Extended Stored Procedure execution with provider name MSSQLSERVER and message containing 'maggie'

Flags MSSQLSERVER extended stored procedure events where the message contains 'maggie', indicating potential backdoor usage.

Windows: NPS (npc.exe) Port Forwarding Proxy Execution via Command-Line Parameters

Flags Windows executions of npc.exe with NPS server, vkey/password, or config=npc command-line parameters.

Windows Execution of IOX (iex/port forwarding) Tunnel/Proxy Tool via Process Creation

Alerts on Windows process creation for iox.exe with tunneling/proxy forwarding command-line parameters.

Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters

Detects command-line execution patterns for SharpWSUS or WSUSpendu on Windows.

Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)

Alerts when TabTip.exe is started via CLSID/DCOM activation in Windows DistributedCOM EventID 10001.

Windows Process Creation: GMER Rootkit Tool Execution (gmer.exe)

Flags execution of gmer.exe on Windows when matched by known process hashes.