Every published rule

Windows PowerShell ScriptBlock containing WMImplant tool parameters

Alerts on PowerShell Script Block content containing WMImplant-related command and system-manipulation parameters.

Windows Process Creation: Java exploitation chain targeting Zoho ManageEngine Desktop Central (CVE-2020-10189)

Alerts on cmd/Pwsh/BITSAdmin and other command utilities launched by the Desktop Central Java runtime.

Windows PowerShell execution with uncommon/suspicious parent process

Alerts when PowerShell is started from certain unusual parent processes that commonly indicate abuse.

Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers

Alerts on Zeek SMB file events suggesting Impacket SecretDump-style staging in ADMIN$ under SYSTEM32 with .tmp files.

Webserver Detection of POST Logupload Attempt for VMware View Planner CVE-2021-21978

Alerts on webserver POST requests targeting logupload/logMetaData parameters tied to CVE-2021-21978 probing.

Windows: Suspicious Execution of CSharp Interactive Console via PowerShell

Alerts when PowerShell launches csi.exe, indicating possible interactive .NET code execution.

Windows MMC20 Lateral Movement via MMC.exe -Embedding spawned by svchost.exe

Alerts when svchost.exe launches mmc.exe with “-Embedding”, indicating potential MMC20 COM-based lateral movement.

Windows: Detect Microsoft Exchange CVE-2020-0688 exploitation via Eventlog errors

Identifies Exchange Control Panel error events containing a ViewState parameter consistent with CVE-2020-0688 exploitation attempts.

Webserver Request Matching for CVE-2020-0688 Exploitation Attempt

Alerts when webserver URI queries include /ecp/default.aspx with __VIEWSTATEGENERATOR and __VIEWSTATE consistent with CVE-2020-0688 probing.

Detect Potential SQL Injection Payloads in GET URIs via Webserver Access Logs

Flags HTTP GET URIs containing SQL injection indicator strings in webserver access logs, excluding 404 responses.

Windows: Office Application Loads VBE VBA DLLs via Image Load Events

Flags Office apps loading VBA-related VBE DLLs, a strong indicator of VBA macro execution.

Windows Office Apps Loading .NET GAC MSIL DLLs via Image Load Events

Alerts when an Office app loads a .NET DLL from the GAC_MSIL directory.

Windows Process Memory Dump via comsvcs.dll using rundll32

Alert on rundll32 loading comsvcs.dll with arguments consistent with a full process memory dump.

AWS CloudTrail: RestoreDBInstanceFromDBSnapshot Creates Public RDS Instance

Detects RDS restores from snapshots that result in a publicly accessible database instance in AWS CloudTrail.

AWS EC2 ModifyInstanceAttribute userData Startup Script Change

Detects CloudTrail EC2 userData startup script changes made via ModifyInstanceAttribute.

AWS GuardDuty CreateIPSet Trusted IP Set Changes (CloudTrail)

Alerts on CloudTrail GuardDuty CreateIPSet events that add or update trusted IP address sets.

Windows DNS analytic events for GALLIUM-related ddns QNAMEs (EventID 257)

Alert on Windows DNS analytical EventID 257 queries for GALLIUM-linked suspicious QNAMEs.

Windows Process Creation alerts on GALLIUM-associated hash IOCs

Flags Windows process executions where the file hash matches hardcoded GALLIUM-associated SHA256/SHA1 IOCs.

Windows: Flag SettingSyncHost.exe used to execute RoamDiag.cmd from cmd.exe

Flags non-System32/SysWOW64 processes spawned by SettingSyncHost.exe running RoamDiag.cmd via cmd.exe /c -outputpath.

PowerShell CommandLine Uses FromBase64String to Decode Base64 Content (Windows)

Detects PowerShell process creation where the command line includes ::FromBase64String(, indicating Base64 decoding.