Every published rule

AWS CloudTrail: RDS Cluster Modification or Deletion (ModifyDBCluster/DeleteDBCluster)

Detects CloudTrail ModifyDBCluster or DeleteDBCluster actions on AWS RDS clusters.

Windows Suspicious ShellExec_RunDLL via SHELL32.DLL Ordinal in Parent Command Line

Alert on Windows process starts where parent command line invokes SHELL32.DLL ShellExec_RunDLL using a matched ordinal and spawns suspicious binaries.

Windows File Event: Detect RTLO Filename Extension Spoofing

Flags Windows filenames containing U+202E plus reversed extension strings that indicate potential extension spoofing.

Windows Registry RunMRU PowerShell or WMIC Execution Command Indicators

Alerts on RunMRU registry entries showing PowerShell (encoding/invocation) or WMIC shadowcopy/process call usage.

IIS HTTP Logging Disabled via dontLog Configuration Change (Windows)

Alerts on IIS configuration updates that disable HTTP logging by setting dontLog to true for successful requests.

Windows DISM Enables PowerShell Web Access Feature via Command Line

Flags DISM executions that enable the WindowsPowerShellWebAccess feature using /online and /enable-feature parameters.

Windows PowerShell Web Access Installation via PowerShell Script Block

Detects PowerShell Web Access installation and web authorization configuration from Windows PowerShell script blocks.

Linux: rsync Used to Spawn a Shell via Command-Line -e

Alerts when rsync is run with -e to execute a shell interpreter on Linux.

Linux Inline Python (-c) Calling os.system to Spawn Shell

Flags Linux processes launching inline Python (-c) that invokes os.system() to execute a shell.

Linux process execution of shell via nice utility

Flags Linux process creation where nice is used to spawn a shell (bash/dash/fish/sh/zsh).

Linux: Git Process Used to Launch a Shell via Bash/Dash/Sh Input Redirection

Flags Linux command lines where git usage (with -p and help) triggers bash/dash/sh execution via stdin redirection.

Linux Process Creation: GCC/C89/C99 Wrapper Executing Shell via -wrapper

Flags gcc/c89/c99 executions that use -wrapper to invoke common shells with -s.

Linux: Shell Command Execution Using flock -u with Common Shell Paths

Flags Linux process creation where flock is invoked with a user option and common shell paths on the command line.

Linux Find Command Used to Execute a Shell via -exec

Flags Linux /find executions that use -exec to launch a shell interpreter.

Linux env Execution Spawning Common Shells

Flags Linux executions of /env that invoke common shells like /bin/bash, /bin/sh, /bin/zsh, /bin/dash, or /bin/fish.

Linux capsh Shell Execution via Shell-Spawn Command Line Ending With " --"

Alerts on Linux executions of /capsh with a command line ending in " --", consistent with shell invocation attempts.

Linux awk/gawk/mawk/nawk CommandLine invoking shell via system()

Flags awk/gawk/mawk/nawk command lines using BEGIN {system(...)} to spawn a shell on Linux.

Linux: SSH ProxyCommand Triggering Interactive Shell Execution

Flags Linux ssh invocations that embed shell execution and redirection via ProxyCommand/local command options.

Windows Registry: Disable Python function execution warnings in Excel

Alerts on registry updates that disable Excel Python function execution warnings via the PythonFunctionWarnings DWORD.

Azure AD Audit: Update User Risk and MFA Registration Policy

Flags Azure AD audit events showing updates to user risk and MFA registration policy.