Every published rule

Windows renamed dctask64.exe execution via known IMPHASH values

Flags Windows process creations where a renamed dctask64.exe execution matches known IMPHASH values.

Windows Process Creation: Detect dctask64.exe with Endpoint Central Execution/Injection Flags

Alerts on Windows execution of ManageEngine Endpoint Central dctask64.exe with specific hash and suspicious command-line indicators.

Windows MSTSC Shadowing CommandLine Using shadow:

Flags Windows processes launching MSTSC with noconsentprompt and shadow: parameters consistent with RDP session shadowing.

AWS CloudTrail: AWS Config Delivery Channel/Recorder Disabled

Identifies CloudTrail actions that delete AWS Config delivery channels or stop the configuration recorder.

Windows Process Command Lines Using System32/SysWow64 Tasks Folder

Alerts on process command lines referencing the writable System32/SysWow64 Tasks folders with common file staging/copy primitives.

Windows Process: curl Download with HTTP Output Redirect and Command Chaining

Flags Windows commands where curl downloads over HTTP with -o and then executes via command chaining with '&'.

Windows: Koadic Command Prompt Invocation with /q /c chcp

Flags cmd.exe executions with /q /c and chcp in the command line, matching Koadic-style command parameters.

Windows Process Access to svchost.exe with High-Rights GrantedAccess

Alerts on high-privilege access to svchost.exe when process call context is UNKNOWN, excluding MSBuild-origin traffic.

Windows Process Creation: svchost.exe Spawned Without Command-Line Arguments

Flags svchost.exe process starts lacking command-line values, excluding rpcnet/rpcnetp parent cases.

Windows CreateMiniDump.exe HackTool Execution via Process Creation

Detects the execution of CreateMiniDump.exe using image name and a specific IMPHASH.

Windows Process Execution of Bloodhound/SharpHound Command-Line Collection Options

Alerts on SharpHound/Bloodhound-like processes launching with discovery-focused command-line parameters.

Windows Security: checkadmin.exe TargetUserName starting with Administr (Event ID 4799)

Detects Windows Security Event 4799 where checkadmin.exe targets “Administr*” accounts, consistent with admin account enumeration.

Ursnif dropper download URLs matching PHP l= parameter ending in CAB

Flags proxy responses where a request URI contains /.php?l= and ends with .cab, returning HTTP 200.

Windows Process Execution Indicative of Ryuk-Style Ransomware Behavior

Flags suspicious Windows process command lines combining autorun persistence, public staging, file backup wiping, and service stoppage behavior.

Proxy access to raw paste endpoints on paste.ee and Pastebin-style services

Alerts on proxy requests for raw paste service URLs that can be used to stage or fetch malicious payloads.

Windows ProcDump Execution via Renamed Binary

Flags renamed ProcDump usage on Windows by matching procdump indicators and dump flags while excluding known executable names.

Windows Security: Anonymous Logon (4624 LogonType 3) with Loopback IPs

Alerts on Windows 4624 LogonType 3 with ANONYMOUS LOGON and loopback IPs, matching RottenPotato-like patterns.

Windows Process Creation: Suspicious SetupComplete.cmd execution for CVE-2019-1378 exploitation

Alerts on cmd.exe parent command lines executing SetupComplete.cmd or PartnerSetupComplete.cmd from Windows Setup script paths.

Windows msiexec.exe Execution from Uncommon Directory

Alerts when msiexec.exe starts from a non-standard path, which may indicate masquerading.

Suspicious APT User-Agent Strings in Proxy Logs

Alerts when proxy requests contain known APT-style user agent strings indicating likely malicious client behavior.