Every published rule

Windows Print Spooler Plugin Load Errors Indicative of CVE-2021-1675 Exploitation

Looks for Print Spooler plug-in/module load errors in Windows logs that may indicate CVE-2021-1675 exploitation attempts.

Windows Registry Service Install Indicators for Cobalt Strike Staging

Identifies suspicious Windows service installation registry writes tied to ADMIN$/.exe and %COMSPEC% start powershell patterns.

Pulse Connect Secure web exploitation attempts for CVE-2021-22893

Detects web requests to Pulse Connect Secure with URI query patterns consistent with CVE-2021-22893 exploitation attempts.

AWS CloudTrail: Security Hub findings evasion via finding updates or deletions

Identifies Security Hub finding and insight modifications (update or delete) that may impair detection results.

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Alerts on WMIC.exe command lines attempting to create an ActiveScriptEventConsumer for event-driven script execution.

Zeek x509: Default Cobalt Strike certificate serial observed in HTTPS traffic

Flags Zeek x509 certificates used in HTTPS when the certificate serial matches a known default Cobalt Strike value.

Windows: Detect execution of renamed megasync.exe (original MegaSync) via process creation

Flags process launches where megasync.exe appears under a renamed or nonstandard execution context based on process creation fields.

Windows: Suspicious Child Process Spawned by scrcons.exe (Script Event Consumer)

Alerts on rare child processes spawned by scrcons.exe, which may indicate abuse of Script Event Consumer for execution.

Windows Registry: New TaskCache entry created by unusual process image

Alerts when TaskCache registry entries are created by processes other than a defined set of expected Windows binaries.

Windows process and registry activity matching SOURGUM persistence/privilege escalation behavior

Alerts on Windows process activity referencing specific system/IME WimBoot files and registry 'reg add' changes targeting HKLM CLSID inprocserver32.

Windows Registry Set—Custom Outlook Today Page for Persistence

Flags registry writes that configure a custom Outlook Today URL using Outlook Today registry values.

Windows Persistence Attempt Using Outlook.exe to Create Outlook Forms Cache

Flags Outlook (outlook.exe) form file activity targeting local FORMS directories often used for persistence.

Windows Registry Changes for Outlook WebView Home Page URL Persistence

Alerts on Windows registry modifications affecting Outlook WebView home page URL settings.

Windows Registry: Microsoft Office Protected View Disabled via Security Policy Keys

Flags Windows registry updates that disable Microsoft Office Protected View for attachments, internet files, UNC paths, or unsafe locations.

Windows MSExchange: Failed Transport Agent Installation (Install-TransportAgent)

Alerts on EventID 6 Exchange management events that include "Install-TransportAgent", indicating a failed Transport Agent installation attempt.

Windows AMSI Provider Registry Key Deletion (HKLM\Software\Microsoft\AMSI)

Alerts on deletion of AMSI provider registry key entries under HKLM\Software\Microsoft\AMSI, potentially indicating AMSI inspection impairment.

PowerShell Tamper: Set-MpPreference disables Windows Defender scanning and protections

Flags PowerShell attempts to alter Windows Defender preferences using Set-MpPreference with Allow-style disable/default-action parameters.

Windows Sysmon Configuration Event Where Sysmon Stops

Alert on Sysmon status showing a stop event concurrent with a Sysmon configuration state change.

Windows Sysmon error events indicating service configuration update failures

Flags Windows Sysmon errors for failed service configuration/driver update attempts that may indicate tampering.

Windows Process Creation: SDelete Used for File Overwrite

Alerts when sdelete.exe runs in a way consistent with file overwrite to impede forensic recovery.