Every published rule

Windows Registry: lsass.exe Creating Local Hidden User Account Entries

Alerts when lsass.exe writes hidden local user name entries to the SAM\...\Users\Names\ registry path.

Windows Security: Hidden Local User Account Creation (Event ID 4720)

Alerts on Windows 4720 local user creation for hidden accounts (username ending with '$'), excluding 'HomeGroupUser$'.

Windows Process Access to svchost.exe with Credential Dumping Access Rights

Alerts on attempts to read svchost.exe memory consistent with credential dumping, excluding known benign callers.

Windows PowerShell Get-Process or aliases targeting LSASS (lsas)

Alerts on PowerShell Get-Process/alias commands referencing LSASS in Windows process creation events.

Windows PowerShell: Get-Process querying lsass within a ScriptBlock

Alerts when PowerShell ScriptBlock text runs Get-Process against lsass, a common credential-access precursor.

Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)

Flags HybridConnectionManager-initiated DNS queries to servicebus.windows.net on Windows.

Windows Hybrid Connection Manager Service Activity (Event IDs 40300-40302)

Flags Windows Hybrid Connection Manager-related events mentioning sb:// and servicebus.windows.net.

Windows Security Event 4697: HybridConnectionManager Service Installation

Alerts on HybridConnectionManager service installation on Windows via Security Event ID 4697.

Windows Registry: Outlook Macro Security Level Set to Enable All Macros

Detects Outlook macro warning bypass by setting the Outlook security level registry value to enable all macros.

Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification

Alerts on enabling the Outlook LoadMacroProviderOnBoot registry setting, which can allow automatic VBA module loading at startup.

Windows Exchange Management: Set-OabVirtualDirectory ExternalUrl to script content

Detects Exchange Management changes to OAB ExternalUrl containing script indicators and Page_Load.

Windows schtasks.exe Creating One-Time Scheduled Tasks Using Temp Folder

Alerts on schtasks.exe commands that create one-time scheduled tasks referencing a Temp directory.

Windows: Suspicious Service Binary Executed from Public/System Directories

Alerts on service-hosted processes executing from user/public or system-writable directories on Windows.

Windows Registry: VBScript/HTMLApplication Payload Stored Under Run Keys

Flags registry persistence where script payload indicators like vbscript: and RunHTMLApplication appear in set registry values.

Windows Process Creation: rundll32.exe Command Line Invoking .sys Files

Flags Windows rundll32.exe executions whose command line references .sys file patterns.

Windows rundll32 Executing Inline VBScript via RegRead

Detects rundll32.exe command lines containing inline VBScript execution with RegRead and window.close.

Windows Process Command Line: Suspicious Inline VBScript with UN2452-Like Keywords

Alerts on Windows command lines containing inline VBScript keywords and registry access indicators matching the UNC2452 UN2452 pattern.

Windows Process Creation: Exchange PowerShell Snap-in Loading via Add-PSSnapin

Flags PowerShell executions that Add-PSSnapin Exchange snap-ins, consistent with Exchange mailbox/config data collection.

Windows PowerShell TcpClient reverse-shell connection attempt via Net.Sockets

Alerts on PowerShell processes launching with .NET TcpClient stream/write patterns consistent with reverse TCP connectivity.

Microsoft Exchange exploitation attempt via suspicious POST requests in web server logs

Flags POST traffic to Exchange OWA/ECP-related URLs with specific client and user-agent indicators consistent with exploitation attempts.