Every published rule

Windows Registry Access to WCESERVICE Start Key

Detects registry activity targeting the WCE service Start configuration in Windows.

Windows Process Execution of Windows Credential Editor (WCE) Executables

Flags execution of Windows Credential Editor (WCE.exe/WCE64.exe) using image name endings and known imphash values.

Ursnif C2 Proxy Traffic Identified by Base64 URI Encoding and .avi/.images Pattern

Flags proxy requests with Base64-like URI characters plus '/images/' and '.avi' patterns consistent with Ursnif C2.

Windows CVE-2019-1388 UAC Consent to Internet Explorer Execution as LOCAL_SYSTEM

Flags UAC consent.exe launching iexplore.exe running as SYSTEM, consistent with CVE-2019-1388 exploitation.

Webserver CVE-2019-11510 Exploitation Attempt via Guacamole URI

Alerts on web requests with a Guacamole-related URI query pattern associated with a Pulse Secure CVE-2019-11510 exploitation attempt.

Windows PowerShell: Silence EmpireDNSAgent script matches DNS tunnel and remote shutdown/restart activity

Flags PowerShell ScriptBlockText that combines Empire process-control indicators with dnscat DNS tunneling commands.

Windows Named Pipe Creation for Known Credential Dumping Tool Pipe Names

Alerts on Windows named pipe creations matching credential dumping tool pipe names.

Windows process creation: Suspicious Dtrack RAT ping and network recon commands

Alerts on Windows command-line reconnaissance patterns resembling Dtrack RAT activity.

Linux sudo CVE-2019-14287 exploit attempt via unusual USER strings

Alerts on sudo events with USER values matching patterns linked to CVE-2019-14287 exploit attempts.

Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)

Alerts on execve/execveat executions by the web server user, consistent with potential webshell command execution.

Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

Alerts when WMI-backed execution is launched under EdgeTransport.exe, excluding common Exchange and conhost false positives.

Windows Process Activity Indicative of QBot (WinRAR to wscript, ping/type, regsvr32)

Alerts on Windows process creation consistent with QBot-like script execution chains from WinRAR and regsvr32/tmp staging.

Windows Security: Detect WRITE_DAC on AD DS objects (Event ID 4662)

Flags AD DS Security Event 4662 activity indicating WRITE_DAC permission changes on domain objects.

Windows Process Creation: Empire PowerShell UAC Bypass CommandLine Pattern

Flags Windows process creation events running Empire-style PowerShell UAC bypass command fragments.

Windows Security: AD object replication attempted by non-machine account (Event ID 4662)

Alerts on AD replication-related object access events where the requester is not a machine account.

Windows Registry: Create/Modify CLSID/AppX keys associated with OceanLotus decoy paths

OceanLotus Registry Activity

Windows Process CommandLine contains -export dll_u (DLL export function load)

Flags Windows processes that invoke a DLL export function named dll_u via command-line export arguments.

Windows process activity matching WannaCry executables and ransom note text

Alerts on Windows process creation where WannaCry-related executables and the @Please_Read_Me@.txt command indicator appear.

Windows: NotPetya indicators via wevtutil log clearing, fsutil deletejournal, and rundll32 .dat/.zip.dll execution

Flags Windows process execution indicative of NotPetya: clearing event logs with wevtutil and deleting C drive USN journal with fsutil.

Windows Process Creation: Potential Dridex-Related Execution via svchost/regsvr32 and Recon Tools

Alerts on suspicious svchost.exe or regsvr32.exe process executions with matching command-line and parent/child patterns indicative of Dridex activity.