Every published rule

Windows Registry Event Log Tampering by Disabling WINEVT Channel Enabled Key

Flags registry changes that set WINEVT channel Enabled to 0x00000000 to disable Windows event logging.

Windows UAC Bypass via IDiagnosticProfileUAC Triggered from DllHost.exe

Flags elevated process creation where DllHost.exe launches using the specific IDiagnosticProfileUAC /Processid value.

Windows: DllHost.exe creates a System32 DLL for UAC bypass via IDiagnosticProfileUAC

Alerts when dllhost.exe creates a System32 .dll consistent with IDiagnosticProfileUAC UAC bypass behavior.

Windows: Suspicious LSASS handle access via svchost.exe call trace to seclogon.dll

Flags svchost.exe attempting LSASS access (granted access 0x14c0) with seclogon.dll in the call trace.

Windows: assoc.exe Changes File Extension Handler to exefile

Alerts on cmd.exe running assoc to set file extension handlers to exefile, indicating possible persistence via file associations.

Windows Process Creation: bitsadmin Downloads Files to Suspicious Directories

Flags bitsadmin.exe file downloads that target suspicious folders using /transfer, /create, and /addfile command-line parameters.

Windows Process Creation: BITSAdmin Downloading File with Suspicious Extension

Flags bitsadmin.exe commands that transfer or add files with suspicious extensions based on process creation command-line content.

Windows BITSAdmin Downloads from File-Sharing Domains

Alerts on BITSAdmin downloads from popular file-sharing domains when transfer/create/addfile command-line flags are present.

Windows Process Creation: bitsadmin Download Using Direct IP URL

Alerts when bitsadmin.exe is used to download via a direct IP address in the command line on Windows.

Windows attrib.exe sets hidden system file attribute (+s) on suspicious paths and script/executable extensions

Flags attrib.exe usage with +s to mark .exe/.dll and script files in public/temp/user-writable locations as system files.

PowerShell disables or removes ETW Trace via Set-EtwTraceProvider or Remove-EtwTraceProvider

Flags PowerShell commands that remove or disable ETW trace providers to impair Windows telemetry.

Windows BITS Transfer Job Download to Suspicious File Paths

Flags new Windows BITS transfer jobs that save downloaded files into predefined suspicious paths.

Windows BITS Client Downloads From File-Sharing Domains

Alerts on Windows BITS transfers (EventID 16403) that download from known file-sharing/content hosting domains.

Azure AD Sign-ins from Non-Compliant Devices

Alert on Entra ID sign-ins originating from devices flagged as non-compliant.

Azure Audit Logs: User Added to Global or Device Administrator Roles

Alerts when Azure AD role-management events add users to Global or Device Administrator roles.

Azure AD/Entra Audit Logs: Device Registration Policy Changes

Alerts on Azure audit log events that set or modify the device registration policy.

Windows dllhost.exe Launched With No Command-Line Arguments

Alerts on dllhost.exe being executed with no command-line arguments, a rare pattern that may indicate stealthy or injected activity.

Windows HandleKatz: Duplicate LSASS Handle via Process Access with Handle Duplication Rights

Flags HandleKatz-style behavior duplicating an existing LSASS handle using PROCESS_DUP_HANDLE and ntdll.dll call trace.

Windows WerFault LSASS Memory Dump File Creation

Flags WerFault dump creation where the dump filename suggests it contains LSASS memory.

Windows: Potential Process Injection via Msra.exe Spawning Suspicious Child Processes

Flags Msra.exe spawning suspicious tools that may indicate process injection or post-exploitation activity on Windows.