Every published rule

Windows reg.exe Used to Modify RDP Terminal Server Registry Values

Flags reg.exe command lines that modify Terminal Server registry values controlling RDP enablement and behavior.

Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe

Alerts on cmd.exe launching cool.exe/zero.exe with ZeroLogon PoC-style arguments and follow-on taskkill or PowerShell activity.

Windows process creation: flag suspicious program names and PowerShell script indicators

Alerts on suspicious Windows process image names and PowerShell command-line script/tool patterns commonly used in malicious tooling.

Windows File Creation Indicators for Local SAM Database Exports

Alerts on Windows file creations with filenames indicative of a local SAM export or backup artifact.

Windows Process Creation: TrolleyExpress.exe Used to Access lsass Memory (PID Parameters)

Alerts on command lines using TrolleyExpress.exe PID parameters consistent with LSASS memory dumping on Windows.

Windows LSASS memory access from TrolleyExpress/ProcessDump/dump64 processes

Alerts on Windows processes attempting to access lsass.exe from TrolleyExpress.exe, ProcessDump.exe, or dump64.exe with dump-like access rights.

Windows LSASS Memory Access Triggered by Source Image Containing 'dump' Keyword

Alerts when a process named with 'dump' requests specific access rights to lsass.exe on Windows.

Windows Script Interpreter Execution From Suspicious Folders via Command-Line Flags

Flags-and-location-based detection of cscript/wscript/mshta-style script execution launched from TEMP/Public/user directories.

Windows Process Command Line Network Recon via nslookup LDAP SRV Query

Identifies Windows command lines running nslookup with an LDAP SRV domain controller discovery query string.

Windows Process Creation: Scheduled Task Creation via schtasks and wscript/vbscript

Alerts on Windows command lines that combine schtasks task creation with wscript running VBScript for persistence.

Windows: whoami.exe Executed by Privileged Accounts

Flags execution of whoami.exe from privileged-like accounts using Windows process creation events.

Windows: Detect XORDump Utility Launch With LSASS Dump and Debug Module Switches

Alerts on xordump.exe spawning with LSASS-targeting and dump-module switches indicative of credential theft.

Linux auth logs: pkexec and XAUTHORITY strings indicating PwnKit (CVE-2021-4034) attempt

Alerts on Linux auth log entries with pkexec and PwnKit-related environment/session keywords consistent with CVE-2021-4034 attempts.

Windows: RunXCmd Command-Line Execution with System or TrustedInstaller Accounts

Flags RunXCmd usage on Windows when invoked to execute commands as System or TrustedInstaller.

Windows Process Execution: NSudo (NSudo.exe/NSudoLC/NSudoLG)

Alerts on NSudo execution on Windows with privilege and integrity/elevation command-line parameters.

Windows Process Creation: NirCmd runasSystem CommandLine Usage

Alerts on NirCmd being used to run commands as LocalSystem based on the process command line.

BlackByte ransomware Registry Set Persistence and Privilege Changes (Windows)

Alerts on BlackByte-specific Windows registry value changes to DWORD 1 across three predefined keys.

Windows Office Macro File Creation Triggered by Script/LOLBin Parent Process

Alerts when macro-enabled Office files are created by common Windows script execution processes.

Windows Network Connection Initiated by IMEWDBLD.EXE

Alerts when IMEWDBLD.EXE initiates a network connection on Windows.

Linux Auditd: Stop Firewalld, iptables, or UFW Services

Detects stopping firewall services (firewalld/iptables/ufw) on Linux via auditd service-stop events.