Built-in rule catalog¶
This page lists every rule in the built-in core-windows rule pack (pack version 0.3.0, 345 rules). It was generated from the rule YAML files in rulepacks/core-windows/rules/; the YAML is the source of truth.
Columns:
- Severity: the alert severity the rule assigns. Conf.: the rule's declared confidence.
- Kind:
match= one alert per matching event (event_match);threshold= one alert per run when at leastmin_countevents match. - Runs every: the rule's priority cadence (P1 = 2 min, P2 = 8 min, P3 = 15 min).
- Source table: the typed DuckDB relation in the rule's
FROMclause (the events the rule alerts on). - Also reads: other relations the query or its built-in exclusions read:
<source>_context(time-bounded history of the same source), another typed source, orartifact_path_state(latest collected file facts per path). - Excl.: number of built-in exclusions shipped with the rule.
- ATT&CK: declared MITRE ATT&CK technique IDs (metadata only).
Rule IDs and the full SQL are shown in the console under Alert rules when you select a rule.
initial_access (3)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| Shortcut File (.lnk or .url) Downloaded From the Internet | medium | medium | match | 8 min | windows_event_log |
- | - | T1566.001, T1566.002, T1204.002 |
| Web Browser Started a Shell or Script Host | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1189, T1204.002 |
| USB Mass-Storage Device Configured | low | medium | match | 15 min | windows_event_log |
- | - | T1091, T1052.001 |
execution (27)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| Explorer-Launched Process With a Padded Command Line (Hidden Shortcut Arguments) | high | medium | match | 8 min | kernel_process_etw |
- | - | T1204.002, T1027 |
| File With Uncommon Extension Created By An Office Application | high | medium | match | 8 min | file_etw |
- | - | T1204.002 |
| PowerShell Download and Execution Cradles | high | medium | match | 8 min | kernel_process_etw |
- | - | T1059 |
| PowerShell Download Or Decode And Invoke-Expression | high | medium | match | 8 min | windows_event_log |
- | - | T1059.001, T1105, T1027 |
| PowerShell Offensive Tooling Function Name | high | high | match | 2 min | windows_event_log |
- | - | T1059.001, T1003.001 |
| Script Run Directly From an Opened Archive | high | medium | match | 2 min | kernel_process_etw |
- | - | T1204.002, T1059.007, T1059.005, T1059.001, T1218.005 |
| Shell, Script Host or LOLBin Running Code From a WebDAV or UNC Location | high | medium | match | 2 min | kernel_process_etw |
- | - | T1204.002, T1218.011, T1218.010, T1105 |
| Suspicious Child Process of Outlook or a PDF Reader | high | medium | match | 8 min | kernel_process_etw |
- | - | T1204.002, T1566.001, T1203, T1059, T1137 |
| Suspicious ClickFix/FileFix Paste-and-Run Execution | high | high | match | 8 min | kernel_process_etw |
- | - | T1204.004, T1204.001, T1059.001, T1059.003, T1218.005, T1027.010 |
| Suspicious Command Pasted Into the Run Dialog or Explorer Address Bar | high | medium | match | 2 min | registry_etw |
- | - | T1204.004, T1059.001, T1059.003, T1218.005, T1027.010 |
| Suspicious Encoded PowerShell Command Line | high | medium | match | 8 min | kernel_process_etw |
- | - | T1059.001 |
| Suspicious Microsoft Office Child Process | high | high | match | 8 min | kernel_process_etw |
- | - | T1047, T1204.002, T1218.010 |
| Suspicious PowerShell IEX Execution Patterns | high | medium | match | 8 min | kernel_process_etw |
- | - | T1059.001 |
| Windows Script Host Started a Shell or LOLBin | high | medium | match | 8 min | kernel_process_etw |
- | - | T1059.005, T1059.007, T1059.001, T1059.003, T1218 |
| WScript or CScript Dropped a Script or Executable | high | medium | match | 8 min | file_etw |
- | - | T1059.005, T1059.007, T1105 |
| AutoIt Interpreter Started Outside Its Install Folder | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1059.010 |
| Defender Attack Surface Reduction Rule Triggered | medium | medium | match | 8 min | windows_event_log |
- | - | - |
| Elevated System Shell Spawned | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1059 |
| Executable Started From an Optical or Mounted ISO Volume | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1204.002, T1553.005 |
| Office Add-In Opened or Loaded From a Download, Temp or Archive Location | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1204.002, T1137.006, T1566.001 |
| Potentially Suspicious PowerShell Child Processes | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1059.001 |
| Process Creation Attempt via Wmic.EXE | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1047 |
| Screensaver File Written Outside Windows System Folders | medium | medium | match | 8 min | file_etw |
- | - | T1204.002, T1218.011 |
| WmiPrvSE Spawned A Process | medium | high | match | 8 min | kernel_process_etw |
- | - | T1047 |
| File Downloaded From the Internet Was Executed | low | low | match | 8 min | kernel_process_etw |
kernel_process_etw_context, windows_event_log |
- | T1204.002 |
| New PowerShell Instance Created | informational | medium | match | 15 min | windows_event_log |
- | 1 | T1059.001 |
| Suspicious command shell start | informational | medium | match | 8 min | kernel_process_etw |
- | - | T1059 |
persistence (83)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| Shell Started Through an Accessibility Binary Backdoor | critical | high | match | 2 min | kernel_process_etw |
- | - | T1546.008 |
| .NET Profiler Enabled Through Environment Registry | high | medium | match | 8 min | registry_etw |
- | - | T1574.012, T1548.002 |
| Accessibility Binary Replaced or Modified in System32 | high | high | match | 8 min | file_etw |
- | - | T1546.008 |
| Bitsadmin Notify Command or Remote File Added to a BITS Job | high | medium | match | 8 min | kernel_process_etw |
- | - | T1197 |
| Built-in Guest, DefaultAccount or Administrator Account Enabled | high | medium | match | 8 min | windows_event_log |
- | - | T1078.001, T1098 |
| Chromium Browser Extension Install Policy Written | high | medium | match | 8 min | registry_etw |
- | - | T1176 |
| Creation of a Local Hidden User Account by Registry | high | medium | match | 8 min | registry_etw |
- | - | T1136.001 |
| Excel XLL Add-in Registered for Autoload | high | medium | match | 8 min | registry_etw |
- | - | T1137.006 |
| File Written to an Office Startup Folder or Normal.dotm | high | medium | match | 8 min | file_etw |
- | - | T1137.001, T1137.006 |
| LSA Security Package, Netsh Helper or Time Provider DLL Registered | high | medium | match | 8 min | registry_etw |
- | - | T1547.005, T1546.007, T1547.003 |
| Member Added to a Privileged Security Group | high | high | match | 8 min | windows_event_log |
- | - | T1098 |
| New RUN Key Pointing to Suspicious Folder | high | medium | match | 8 min | registry_etw |
- | - | T1547.001 |
| NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE | high | medium | match | 8 min | kernel_process_etw |
- | - | T1546.003 |
| Office Alternate Startup Folder Configured | high | medium | match | 8 min | registry_etw |
- | - | T1137.001 |
| Per-user Startup file operation | high | medium | match | 2 min | file_etw |
- | - | T1547.001 |
| Per-user Startup USN change | high | medium | match | 2 min | usn |
- | - | T1547.001 |
| Potential ACTINIUM Persistence Activity | high | medium | match | 8 min | kernel_process_etw |
- | - | T1053, T1053.005 |
| Potential Persistence Via GlobalFlags | high | medium | match | 8 min | registry_etw |
- | - | T1546.012 |
| Potential Startup Shortcut Persistence Via PowerShell.EXE | high | medium | match | 8 min | file_etw |
- | - | T1547.001 |
| Print Processor DLL Registered | high | medium | match | 8 min | registry_etw |
- | - | T1547.012 |
| Registry Persistence via Explorer Run Key | high | medium | match | 8 min | registry_etw |
- | - | T1547.001 |
| Registry Run or RunOnce persistence | high | high | match | 2 min | registry_etw |
artifact_path_state |
- | T1547.001 |
| Scheduled Task Creation Command Requesting SYSTEM | high | medium | match | 8 min | kernel_process_etw |
- | - | T1053.005 |
| Scheduled TaskCache Change by Uncommon Program | high | medium | match | 8 min | registry_etw |
- | - | T1053, T1053.005 |
| Service creation (command) | high | medium | match | 8 min | kernel_process_etw |
- | - | T1543.003 |
| Shell Open Command Handler Points to a User-Writable Path or Script One-Liner | high | medium | match | 8 min | registry_etw |
- | 1 | T1546.001, T1548.002 |
| Startup executable content version | high | medium | match | 2 min | artifact |
- | - | T1547.001 |
| Startup Folder Location Redirected via Shell Folders Registry | high | medium | match | 8 min | registry_etw |
- | - | T1547.001, T1112 |
| Suspicious Autorun Registry Command Via WMI | high | medium | match | 8 min | kernel_process_etw |
- | - | T1547.001, T1047 |
| Suspicious Scheduled Task Creation | high | medium | match | 8 min | windows_event_log |
- | - | T1053.005 |
| Suspicious Scheduled Task Update | high | medium | match | 8 min | windows_event_log |
- | - | T1053.005 |
| Suspicious Service Installation | high | medium | match | 8 min | windows_event_log |
- | - | T1134.001, T1543.003 |
| Suspicious Startup Folder Persistence | high | medium | match | 8 min | file_etw |
- | - | T1204.002, T1547.001 |
| Uncommon Userinit Child Process | high | medium | match | 8 min | kernel_process_etw |
- | - | T1037.001 |
| User creation via commandline | high | medium | match | 8 min | kernel_process_etw |
- | - | T1136.001, T1136.002 |
| Autorun Keys Modification | medium | medium | match | 8 min | registry_etw |
artifact_path_state |
- | T1547.001 |
| Changing Existing Service ImagePath Value Via Reg.EXE | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1574.011 |
| Chromium Browser Instance Executed With Custom Extension | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1176 |
| CurrentControlSet Autorun Keys Modification | medium | medium | match | 8 min | registry_etw |
- | - | T1547.001 |
| CurrentVersion NT Autorun Keys Modification | medium | medium | match | 8 min | registry_etw |
- | - | T1547.001 |
| Custom Application Shim Database Registered | medium | medium | match | 8 min | registry_etw |
- | - | T1546.011 |
| Direct Autorun Keys Modification | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1547.001 |
| Local Account Password Reset by Another Account | medium | medium | match | 8 min | windows_event_log |
windows_event_log_context |
- | T1098, T1531 |
| New User Created Via Net.EXE | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1136.001 |
| Per-User COM LocalServer32, TreatAs or ScriptletURL Registration | medium | medium | match | 8 min | registry_etw |
artifact_path_state |
- | T1546.015 |
| Potential Binary Or Script Dropper Via PowerShell | medium | medium | match | 8 min | file_etw |
- | - | - |
| Potential Persistence Attempt Via Existing Service Tampering | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1543.003, T1574.011 |
| Potential Persistence Attempt Via Run Keys Using Reg.EXE | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1547.001 |
| Potential Persistence Via COM Search Order Hijacking | medium | medium | match | 8 min | registry_etw |
artifact_path_state |
1 | T1546.015 |
| PowerShell Profile File Created | medium | medium | match | 8 min | file_etw |
- | - | T1546.013 |
| PowerShell Profile File Modified | medium | medium | match | 8 min | file_etw |
- | - | T1546.013 |
| Run Once Task Configuration in Registry | medium | medium | match | 8 min | registry_etw |
- | - | T1112 |
| Scheduled task creation with command line | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1053.005 |
| Service Key, ImagePath, ServiceDll or FailureCommand Written Outside the Service Control Manager | medium | medium | match | 8 min | registry_etw |
- | 1 | T1543.003, T1574.011 |
| Session Manager Autorun Keys Modification | medium | medium | match | 8 min | registry_etw |
- | - | T1547.001, T1546.009 |
| Startup Folder File Created | medium | medium | match | 8 min | file_etw |
- | - | T1547.001 |
| Suspicious PowerShell In Registry Run Keys | medium | medium | match | 8 min | registry_etw |
- | 1 | T1547.001 |
| System Scripts Autorun Keys Modification | medium | medium | match | 8 min | registry_etw |
- | - | T1547.001 |
| WMI Event Consumer (Other or Missing Rule Label) | medium | low | match | 8 min | windows_event_log |
- | - | T1546.003 |
| WMI Event Consumer To Filter (Other or Missing Rule Label) | medium | low | match | 8 min | windows_event_log |
- | - | T1546.003 |
| WMI Event Filter (Other or Missing Rule Label) | medium | low | match | 8 min | windows_event_log |
- | - | T1546.003 |
| WMI Event Subscription Activity | medium | low | match | 8 min | windows_event_log |
- | - | T1546.003 |
| WMI Persistence - Script Event Consumer | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1546.003 |
| Wow6432Node CurrentVersion Autorun Keys Modification | medium | medium | match | 8 min | registry_etw |
- | - | T1547.001 |
| BITS Transfer From a Host Outside the Observed Microsoft Allowlist | low | low | match | 15 min | windows_event_log |
windows_event_log_context |
- | T1197 |
| Change Default File Association Via Assoc | low | medium | match | 15 min | kernel_process_etw |
- | - | T1546.001 |
| Local Account Created | low | low | match | 15 min | windows_event_log |
- | - | T1136.001 |
| New Service Creation | low | medium | match | 15 min | kernel_process_etw |
- | - | T1543.003 |
| Permanent WMI Consumer Binding Observed | low | low | match | 15 min | windows_event_log |
- | - | T1546.003 |
| PowerShell Script Dropped Via PowerShell.EXE | low | medium | match | 8 min | file_etw |
- | - | - |
| Run Once Task Execution as Configured in Registry | low | medium | match | 15 min | kernel_process_etw |
- | - | T1112 |
| Scheduled Task Created - FileCreation | low | medium | match | 15 min | file_etw |
- | 2 | T1053.005 |
| Scheduled Task Created - Registry | low | medium | match | 15 min | registry_etw |
registry_etw_context |
1 | T1053.005 |
| Scheduled Task Creation Via Schtasks.EXE | low | medium | match | 15 min | kernel_process_etw |
- | - | T1053.005 |
| Security Scheduled Task Created | low | low | match | 15 min | windows_event_log |
- | - | T1053.005 |
| Service Installed | low | low | match | 15 min | windows_event_log |
- | 4 | T1543.003 |
| Task Scheduler Task Registered | low | low | match | 15 min | windows_event_log |
- | 3 | T1053.005 |
| Task Scheduler Task Updated | low | low | match | 15 min | windows_event_log |
- | 3 | T1053.005 |
| Unsigned DLL Loaded From Its Loader's User-Writable Folder | low | low | match | 15 min | kernel_process_etw |
artifact_path_state |
- | T1574.002 |
| Windows Service Creation | low | low | match | 15 min | windows_event_log |
- | 4 | T1543.003 |
| WMI Event Consumer | low | low | match | 15 min | windows_event_log |
- | - | T1546.003 |
| WMI Event Consumer To Filter | low | low | match | 15 min | windows_event_log |
- | - | T1546.003 |
| WMI Event Filter | low | low | match | 15 min | windows_event_log |
- | - | T1546.003 |
privilege_escalation (6)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| Process Started From a Mock Trusted Directory With a Trailing Space | critical | high | match | 2 min | kernel_process_etw |
- | - | T1548.002, T1574.001, T1036.005 |
| Child Process of an Auto-Elevating UAC Bypass Binary | high | medium | match | 2 min | kernel_process_etw |
- | - | T1548.002 |
| Process Started by an Auto-Elevated COM Surrogate (CMSTPLUA/ICMLuaUtil UAC Bypass) | high | high | match | 2 min | kernel_process_etw |
- | - | T1548.002 |
| UAC Bypass Handler Hijack in the User Classes Hive | high | high | match | 2 min | registry_etw |
- | - | T1548.002 |
| Windir or SystemRoot Environment Variable Overridden (SilentCleanup UAC Bypass) | high | high | match | 2 min | registry_etw |
- | - | T1548.002, T1574.007 |
| Local Administrators Group Addition Command | medium | medium | match | 8 min | kernel_process_etw |
- | 1 | T1098 |
defense_evasion (115)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| Potential Emotet Rundll32 Execution | critical | medium | match | 15 min | kernel_process_etw |
- | - | T1218.011 |
| .NET Framework ETW Disabled via Registry or Environment Variable | high | high | match | 2 min | registry_etw |
- | - | T1685, T1112 |
| AMSI Disabled via Registry | high | high | match | 2 min | registry_etw |
- | - | T1562.001, T1112 |
| AspNetCompiler.exe Started Outside a Visual Studio Build | high | medium | match | 2 min | kernel_process_etw |
- | - | T1127, T1055.012 |
| Audit Policy Tampering via Resource Kit Auditpol | high | medium | match | 8 min | kernel_process_etw |
- | - | T1685.001 |
| Base64-Encoded Executable (MZ Header) in Process Command Line | high | high | match | 2 min | kernel_process_etw |
- | - | T1027, T1027.009, T1027.013, T1140 |
| Caret- or Quote-Obfuscated HTTP in Process Command Line | high | high | match | 2 min | kernel_process_etw |
- | - | T1027.010, T1140 |
| Compiled HTML Help (hh.exe) Started a Shell or LOLBin | high | high | match | 2 min | kernel_process_etw |
- | - | T1218.001, T1204.002, T1059.001, T1059.003 |
| Control Panel Applet Run From User-Writable Path or Unusual Argument | high | high | match | 2 min | kernel_process_etw |
- | - | T1218.002, T1218.011 |
| Defender Definitions Removed via MpCmdRun | high | high | match | 2 min | kernel_process_etw |
- | 1 | T1685, T1562.001 |
| Defender Protection Disabled via Registry | high | medium | match | 2 min | registry_etw |
- | - | T1562.001, T1112 |
| Defender Scan Feature Disabled by PowerShell | high | high | match | 2 min | kernel_process_etw |
- | - | T1562.001 |
| Defender Tamper Protection Blocked a Settings Change | high | medium | match | 2 min | windows_event_log |
- | - | T1562.001 |
| Defender Threat Default Action Set to Allow or No Action | high | high | match | 2 min | kernel_process_etw |
- | - | T1562.001, T1685 |
| Disable Defender Security Monitoring | high | high | match | 2 min | kernel_process_etw |
- | - | T1685 |
| Disable Windows Event Logging Via Registry | high | high | match | 2 min | registry_etw |
- | 1 | T1685.001 |
| DotNet CLR Loaded by a Script Host or Proxy Binary | high | medium | match | 8 min | kernel_process_etw |
- | - | T1620, T1218.003, T1218.005, T1218.010, T1218.011, T1220, T1059.005, T1059.007 |
| Double-Extension Lure File Created | high | medium | match | 8 min | file_etw |
- | - | T1036.007 |
| Double-Extension Program or Script Executed | high | high | match | 2 min | kernel_process_etw |
- | - | T1036.007, T1204.002 |
| Driver Signature Enforcement Weakened Via Bcdedit.EXE | high | medium | match | 2 min | kernel_process_etw |
- | - | T1553.006 |
| ETW Session Tampering via Logman | high | high | match | 2 min | kernel_process_etw |
- | - | T1562.002 |
| Event Log Configuration or Alternate Clear Command | high | high | match | 15 min | kernel_process_etw |
- | - | T1070.001 |
| Event Log or Defender ETW AutoLogger Disabled via Registry | high | high | match | 2 min | registry_etw |
registry_etw_context |
- | T1562.006, T1562.002 |
| Execution From a Malware Staging or Windows Data Folder | high | medium | match | 2 min | kernel_process_etw |
- | - | T1036.005, T1059.001, T1218 |
| File Decoded From Base64/Hex Via Certutil.EXE | high | medium | match | 2 min | kernel_process_etw |
- | - | T1140 |
| Filter Driver Unloaded or Detached Via Fltmc.EXE | high | medium | match | 2 min | kernel_process_etw |
- | - | T1685, T1685.001 |
| FromBase64String in Process Command Line | high | medium | match | 8 min | kernel_process_etw |
- | - | T1027, T1140, T1059.001 |
| Fsutil USN Journal Deletion or File Zeroing | high | medium | match | 2 min | kernel_process_etw |
- | - | T1070, T1070.004, T1485 |
| Important Windows Auditing Disabled | high | high | match | 2 min | windows_event_log |
- | - | T1562.002 |
| Important Windows Event Log Cleared | high | high | match | 2 min | windows_event_log |
- | - | T1070.001 |
| Inline Script Execution via Rundll32 MSHTML, Mshta or WScript.Shell | high | medium | match | 2 min | kernel_process_etw |
- | - | T1218.011, T1218.005, T1059.005, T1059.007 |
| Invoke-Obfuscation Obfuscated IEX in a Command Line | high | high | match | 2 min | kernel_process_etw |
- | - | T1027.010, T1059.001 |
| LOL-Binary Copied From System Directory | high | medium | match | 2 min | kernel_process_etw |
- | - | T1036.003 |
| LOLBin or Document Reader Wrote an Executable, Script or Archive | high | medium | match | 8 min | file_etw |
- | - | T1218, T1105, T1203 |
| LSA Protection, Credential Guard or Memory Integrity Disabled via Registry | high | medium | match | 2 min | registry_etw |
- | - | T1562.001, T1112 |
| Microsoft Vulnerable Driver Blocklist Disabled | high | medium | match | 8 min | registry_etw |
- | - | T1685, T1112 |
| MMC Opened a Console File From an Unusual Path | high | medium | match | 2 min | kernel_process_etw |
- | - | T1218.014, T1204.002 |
| MMC Spawned a Shell, Script Host or LOLBin | high | medium | match | 8 min | kernel_process_etw |
- | - | T1218.014, T1059, T1021.003 |
| MSHTA Execution with Suspicious File Extensions | high | medium | match | 2 min | kernel_process_etw |
- | - | T1218.005, T1036.008 |
| Mshta Started a Shell, Script Host, LOLBin or User-Folder Executable | high | high | match | 2 min | kernel_process_etw |
- | - | T1218.005, T1059.001, T1059.003, T1218.011, T1204.002 |
| PowerShell 2.0 Engine Started (Downgrade Attack) | high | medium | match | 8 min | windows_event_log |
- | - | T1562.010, T1059.001 |
| PowerShell AMSI Bypass Script Block | high | high | match | 2 min | windows_event_log |
- | - | T1562.001, T1059.001 |
| PowerShell Base64-Compressed Payload Decoding | high | medium | match | 8 min | windows_event_log |
- | - | T1027.015, T1140, T1059.001 |
| PowerShell Logging Policy Disabled in the Registry | high | high | match | 2 min | registry_etw |
- | - | T1562.002, T1685.001, T1112 |
| PowerShell Reflective Assembly Load From Memory | high | medium | match | 8 min | windows_event_log |
- | - | T1620, T1059.001 |
| PowerShell Script Block With Embedded Base64 Executable | high | medium | match | 2 min | windows_event_log |
- | - | T1027.009, T1027.013, T1059.001 |
| PowerShell Set-Acl Permission Change | high | medium | match | 8 min | kernel_process_etw |
- | - | T1222.001 |
| PowerShell Shellcode Runner or Process Injection Script Block | high | medium | match | 2 min | windows_event_log |
- | 1 | T1055, T1059.001, T1620 |
| PowerShell Token Obfuscation | high | medium | match | 8 min | kernel_process_etw |
- | - | T1027.009 |
| Process Explorer Driver Written By Non-Sysinternals Process | high | medium | match | 2 min | file_etw |
- | - | T1562.001, T1685, T1068 |
| Process Launched Through Conhost.EXE | high | medium | match | 8 min | kernel_process_etw |
- | - | T1202, T1564.003 |
| Regsvr32 Loading a Disguised or Staged Module | high | medium | match | 2 min | kernel_process_etw |
- | - | T1218.010, T1036.008 |
| Remotely Hosted HTA File Executed Via Mshta.EXE | high | medium | match | 2 min | kernel_process_etw |
- | - | T1218.005 |
| Right-to-Left Override in Process Command Line | high | high | match | 2 min | kernel_process_etw |
- | - | T1036.002 |
| Rundll32 Running a Fake-Extension or Script-Launched User-Folder Module | high | medium | match | 8 min | kernel_process_etw |
- | - | T1218.011, T1036.008 |
| Sacrificial Process Started Without Arguments | high | medium | match | 2 min | kernel_process_etw |
- | - | T1055, T1055.012 |
| Safe Mode Boot Configured Via Bcdedit.EXE | high | medium | match | 2 min | kernel_process_etw |
- | - | T1688, T1562.009 |
| Script Payload Stored in a Registry Value | high | medium | match | 8 min | registry_etw |
- | - | T1027.011, T1112, T1218.005, T1218.011, T1059.005, T1059.007 |
| Security Event Log Cleared | high | high | match | 2 min | windows_event_log |
- | - | T1070.001 |
| Security Event Logging Disabled via MiniNt Registry Key | high | high | match | 2 min | registry_etw |
- | - | T1562.002, T1685.001, T1112 |
| Security Product Tampering Via WMIC | high | medium | match | 2 min | kernel_process_etw |
- | - | T1685, T1047 |
| Security Service Disabled via Registry Start Value | high | medium | match | 2 min | registry_etw |
- | - | T1562.001, T1112 |
| Service Deny-ACE Or SCManager DACL Tampering Via Sc.EXE | high | medium | match | 8 min | kernel_process_etw |
- | - | T1564, T1543.003, T1569.002 |
| Service Registered to Start in Safe Mode | high | medium | match | 2 min | registry_etw |
- | - | T1562.009, T1112 |
| SIP or Trust Provider DLL Registered or Changed | high | medium | match | 2 min | registry_etw |
- | 1 | T1553.003, T1112 |
| Suspicious .NET Utility Proxy Execution (MSBuild, RegAsm, RegSvcs, InstallUtil) | high | medium | match | 8 min | kernel_process_etw |
- | - | T1127.001, T1218.004, T1218.009 |
| Suspicious Child Process of Regsvr32 | high | medium | match | 2 min | kernel_process_etw |
- | - | T1218.010 |
| Suspicious JavaScript Execution Via Mshta.EXE | high | medium | match | 2 min | kernel_process_etw |
- | - | T1218.005 |
| Suspicious PowerShell Parameter Variation | high | medium | match | 8 min | kernel_process_etw |
- | - | T1059.001 |
| Suspicious Remote Thread From PowerShell or a LOLBin, or Into a Shell or Sacrificial Process | high | medium | match | 2 min | windows_event_log |
- | - | T1055, T1059.001, T1127.001 |
| Suspicious Windows Service Tampering Command | high | high | match | 8 min | kernel_process_etw |
- | - | T1489 |
| Suspicious XOR Encoded PowerShell Command | high | medium | match | 2 min | kernel_process_etw |
- | - | T1027.010, T1140, T1059.001 |
| Sysmon Configuration or Driver Altitude Registry Change | high | medium | match | 2 min | registry_etw |
registry_etw_context |
- | T1562.001, T1685, T1112 |
| Sysmon Sensor Stopped, Disabled or Tampered | high | high | match | 2 min | windows_event_log |
- | - | T1562.001, T1685.001 |
| UAC Disabled or Weakened via Registry | high | medium | match | 2 min | registry_etw |
- | - | T1548.002, T1562.001, T1112 |
| User Account Hidden From Sign-In Screen via SpecialAccounts UserList | high | high | match | 8 min | registry_etw |
- | - | T1564.002 |
| Windows Defender Malware And PUA Scanning Disabled | high | medium | match | 2 min | windows_event_log |
- | - | T1562.001 |
| Windows Defender Real-time Protection Disabled | high | medium | match | 2 min | windows_event_log |
- | - | T1562.001 |
| Windows Defender Virus Scanning Feature Disabled | high | medium | match | 2 min | windows_event_log |
- | - | T1562.001 |
| Windows Event Log Service Start Type Changed | high | high | match | 2 min | windows_event_log |
- | - | T1562.002, T1685.001 |
| Windows System Binary Masquerading by Location, Look-Alike Name or Parent | high | medium | match | 8 min | kernel_process_etw |
- | 1 | T1036.005, T1036.003, T1055.012 |
| AppLocker Blocked or Would Block an Executable or DLL | medium | medium | match | 8 min | windows_event_log |
- | 1 | T1204.002 |
| Audit Policy Disabled by Auditpol Command | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1562.002 |
| CodeIntegrity - Blocked Image/Driver Load For Policy Violation | medium | medium | match | 8 min | windows_event_log |
- | - | T1553.002 |
| Defender Exclusion Registry Value Set | medium | medium | match | 8 min | registry_etw |
- | - | T1562.001 |
| Defender Firewall Disabled via Registry | medium | medium | match | 8 min | registry_etw |
- | - | T1562.004, T1686.003 |
| Driver Loaded (Unsigned) | medium | medium | match | 8 min | windows_event_log |
- | - | T1553.002 |
| Event Log Clear Attempt via Wevtutil | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1070.001 |
| Event Log Clear Attempt via WMIC | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1070.001 |
| Executable or Script Dropped in a Malware Staging Folder | medium | medium | match | 8 min | file_etw |
- | - | T1036.005, T1564.001, T1074.001, T1105 |
| Files With System Process Name In Unsuspected Locations | medium | medium | match | 8 min | file_etw |
- | - | T1036.005 |
| Firewall Disabled via Netsh | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1686.003 |
| Hiding Files with Attrib.exe | medium | medium | match | 15 min | kernel_process_etw |
- | - | T1564.001 |
| Mark-of-the-Web Download Protection Weakened via Registry | medium | medium | match | 8 min | registry_etw |
- | - | T1553.005, T1562.001, T1112 |
| Msiexec Installs or Administers a Package From a URL | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1218.007 |
| Office Macro Security Weakened or Document Macros Enabled | medium | medium | match | 8 min | registry_etw |
- | - | T1562.001, T1112, T1204.002 |
| Potentially Suspicious Regsvr32 HTTP/FTP Pattern | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1218.010 |
| Recursive Takeown Command | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1222.001 |
| Service StartupType Change Via PowerShell Set-Service | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1685 |
| Suspicious PowerShell Invocation | medium | medium | match | 8 min | kernel_process_etw |
- | - | - |
| Sysmon Process Tampering | medium | medium | match | 8 min | windows_event_log |
- | - | T1055 |
| Windows Defender Exclusion Configuration Changed | medium | medium | match | 8 min | windows_event_log |
- | - | T1685 |
| Windows Event Log EVTX File Deleted | medium | medium | match | 8 min | file_etw |
- | - | T1070 |
| Change PowerShell Policies to an Insecure Level | low | medium | match | 15 min | kernel_process_etw |
- | - | T1059.001 |
| Creation Time of an Executable or Script Changed | low | low | match | 15 min | artifact |
file_etw, usn |
- | T1070.006 |
| Defender Real-time Protection Feature Configuration Changed | low | low | match | 15 min | windows_event_log |
- | 1 | T1562.001 |
| DMP/HDMP File Creation | low | medium | match | 15 min | file_etw |
- | - | - |
| Forceful File Deletion via CMD | low | medium | match | 15 min | kernel_process_etw |
- | - | T1070.004 |
| Inbound Allow Rule Added to Windows Firewall | low | low | match | 15 min | windows_event_log |
- | - | T1562.004 |
| ISO or Virtual Disk Mounted From a User Location | low | low | match | 15 min | windows_event_log |
- | - | T1553.005 |
| Raw Disk Access by Uncommon Tools | low | low | match | 15 min | windows_event_log |
- | - | T1006 |
| Security Audit Scheduled Task Deleted | low | high | match | 15 min | windows_event_log |
artifact_path_state |
1 | - |
| Set Files as System Files Using Attrib | low | medium | match | 15 min | kernel_process_etw |
- | - | T1564.001 |
| Suspicious In-Memory Module Execution | low | medium | match | 15 min | windows_event_log |
kernel_process_etw |
- | T1055.001, T1055.002 |
| Task Scheduler Task Deleted | low | high | match | 15 min | windows_event_log |
- | 3 | - |
credential_access (42)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| LSASS Process Clone or Unexpected LSASS Start | critical | high | match | 2 min | kernel_process_etw |
- | - | T1003.001 |
| mimikatz.exe process creation | critical | high | match | 2 min | kernel_process_etw |
- | - | T1003 |
| Potential Credential Dumping Via LSASS SilentProcessExit Technique | critical | high | match | 2 min | registry_etw |
- | - | T1003.001 |
| Accessing WinAPI in PowerShell for Credentials Dumping | high | high | match | 2 min | windows_event_log |
- | 1 | T1003.001 |
| Browser Credential Store Copied or Queried From the Command Line | high | medium | match | 8 min | kernel_process_etw |
- | - | T1555.003, T1539, T1074.001 |
| Browser Started With Remote Debugging by an Unexpected Parent | high | medium | match | 8 min | kernel_process_etw |
- | - | T1539, T1555.003, T1564.003 |
| CreateMiniDump Hacktool | high | medium | match | 2 min | file_etw |
- | - | T1003.001 |
| Credential Acquisition via Registry Hive Dumping | high | high | match | 2 min | kernel_process_etw |
- | - | T1003 |
| Credential Hive, NTDS.dit or Shadow Copy Path in a Command Line | high | high | match | 2 min | kernel_process_etw |
- | - | T1003.002, T1003.003, T1006 |
| Dumping LSASS Process Into a File | high | high | match | 8 min | windows_event_log |
- | - | T1003.001 |
| Dumping of Sensitive Hives Via Reg.EXE | high | medium | match | 2 min | kernel_process_etw |
- | - | T1003.002, T1003.004, T1003.005 |
| Exports Critical Registry Keys To a File | high | high | match | 8 min | kernel_process_etw |
- | - | T1003, T1012 |
| HackTool - CrackMapExec Process Patterns | high | medium | match | 2 min | kernel_process_etw |
- | - | T1003.001 |
| HackTool - XORDump Execution | high | medium | match | 8 min | kernel_process_etw |
- | - | T1036, T1003.001 |
| LSASS Crash Reported in the Application Log | high | medium | match | 2 min | windows_event_log |
- | - | T1003.001 |
| LSASS credential dump with LSASSY (process) | high | medium | match | 15 min | kernel_process_etw |
- | - | T1003.001 |
| LSASS Dump Keyword In CommandLine | high | medium | match | 8 min | kernel_process_etw |
- | - | T1003.001 |
| Lsass Full Dump Request Via DumpType Registry Settings | high | medium | match | 2 min | registry_etw |
- | - | T1003.001 |
| LSASS Memory Dump File Creation | high | high | match | 2 min | file_etw |
- | - | T1003.001 |
| Lsass Memory Dump via Comsvcs DLL | high | high | match | 2 min | windows_event_log |
- | - | T1003.001 |
| LSASS process access with listed access masks | high | medium | match | 2 min | windows_event_log |
- | 1 | T1003.001 |
| LSASS Process Access with Query and Memory-Read Masks | high | medium | match | 2 min | windows_event_log |
- | 1 | T1003 |
| LSASS Process ID Lookup via Findstr, Tasklist, WMIC or Get-Process | high | medium | match | 8 min | kernel_process_etw |
- | - | T1057, T1003.001 |
| LSASS Process Memory Dump Files | high | medium | match | 8 min | file_etw |
- | - | T1003.001 |
| Mimikatz Command Syntax in a Process Command Line | high | high | match | 2 min | kernel_process_etw |
- | - | T1003.001, T1003.002, T1003.004, T1003.005, T1003.006 |
| Network or RDP Logon Success After Repeated Failures From the Same Source | high | medium | match | 8 min | windows_event_log |
windows_event_log_context |
- | T1110.001, T1110.003, T1078 |
| Password Dumper Remote Thread in LSASS | high | medium | match | 8 min | windows_event_log |
- | - | T1003.001 |
| Potential LSASS Process Dump Via Procdump | high | high | match | 2 min | kernel_process_etw |
- | - | T1003.001, T1036 |
| PowerShell SAM Copy | high | medium | match | 8 min | kernel_process_etw |
- | - | T1003.002 |
| PowerShell Script Copies or Decrypts Browser Credential Stores | high | medium | match | 8 min | windows_event_log |
- | - | T1555.003, T1059.001 |
| Process accessed LSASS from unbacked memory | high | high | match | 2 min | windows_event_log |
- | - | T1003.001 |
| Registry Dump of SAM Creds and Secrets | high | medium | match | 2 min | kernel_process_etw |
- | - | T1003.002 |
| Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs | high | medium | match | 2 min | windows_event_log |
- | - | T1003.001, T1685 |
| Wdigest authentication enabled (Reg via command) | high | high | match | 2 min | kernel_process_etw |
- | - | T1003, T1562 |
| WDigest UseLogonCredential Enabled in the Registry | high | high | match | 2 min | registry_etw |
- | - | T1003.001, T1112 |
| LSASS Refused a Module That Failed Its Signing Requirement | medium | medium | match | 8 min | windows_event_log |
- | - | T1547.005, T1556.002 |
| Many Failed Logons for One Account or From One Source | medium | medium | threshold (≥10) | 8 min | windows_event_log |
- | - | T1110 |
| Network Provider DLL Path Written Outside the Service Control Manager | medium | medium | match | 8 min | registry_etw |
- | - | T1556.008, T1543.003 |
| Potential Credential Dumping Attempt Via PowerShell | medium | medium | match | 8 min | windows_event_log |
- | 1 | T1003.001 |
| Potentially Suspicious GrantedAccess Flags On LSASS | medium | medium | match | 8 min | windows_event_log |
- | - | T1003.001 |
| Saved Wi-Fi Passwords Dumped via Netsh | medium | high | match | 8 min | kernel_process_etw |
- | - | T1555, T1016 |
| Unsigned Image Loaded Into LSASS Process | medium | high | match | 8 min | windows_event_log |
- | - | T1003.001 |
discovery (14)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| Password policy discovery via commandline | high | medium | match | 2 min | kernel_process_etw |
- | - | T1201 |
| Security Privileges Enumeration Via Whoami.EXE | high | medium | match | 8 min | kernel_process_etw |
- | - | T1033 |
| Whoami.EXE Run as SYSTEM or a Service Account | high | medium | match | 2 min | kernel_process_etw |
- | - | T1033, T1078.003 |
| Domain Trust or Domain Controller Recon via Nltest.EXE | medium | high | match | 8 min | kernel_process_etw |
- | - | T1482, T1018 |
| Enumerate All Information With Whoami.EXE | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1033 |
| Group discovery (command) | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1069.001, T1069.002 |
| Group Membership Reconnaissance Via Whoami.EXE | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1033 |
| Recon Command Output Piped To Findstr.EXE | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1057 |
| Reconnaissance Activity Using BuiltIn Commands | medium | medium | match | 2 min | kernel_process_etw |
- | - | T1087, T1082 |
| Whoami.EXE Execution Anomaly | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1033 |
| CMD Shell Output Redirect | low | medium | match | 15 min | kernel_process_etw |
- | - | T1082 |
| File and Subfolder Enumeration Via dir Command | low | medium | match | 15 min | kernel_process_etw |
- | - | T1217 |
| Insensitive Subfolder Search Via Findstr.EXE | low | medium | match | 8 min | kernel_process_etw |
- | - | T1218, T1564.004, T1552.001, T1105 |
| System Network Connections Discovery Via Net.EXE | low | medium | match | 15 min | kernel_process_etw |
- | - | T1049 |
lateral_movement (9)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| Outbound RDP Connections Over Non-Standard Tools | high | medium | match | 8 min | windows_event_log |
- | - | T1021.001 |
| Potential Remote PowerShell Session Initiated | high | medium | match | 8 min | windows_event_log |
- | - | T1059.001, T1021.006 |
| Copy From Or To Admin Share Or Sysvol Folder | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1039, T1048, T1021.002 |
| Inbound RDP Authentication From a Non-Loopback Address | medium | medium | match | 8 min | windows_event_log |
- | - | T1021.001 |
| Outgoing Logon with New Credentials | medium | medium | match | 8 min | windows_event_log |
- | - | T1550 |
| Remote Desktop Enabled in the Registry | medium | medium | match | 8 min | registry_etw |
- | - | T1021.001, T1112 |
| RDP or Local Session Logon | low | low | match | 15 min | windows_event_log |
- | - | T1021.001 |
| Successful Account Login Via WMI | low | low | match | 15 min | windows_event_log |
- | - | T1047 |
| WinRM Session Created | low | low | match | 15 min | windows_event_log |
- | - | T1021.006 |
collection (3)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| PowerShell Keylogger API Use in Script Block | high | medium | match | 2 min | windows_event_log |
- | - | T1056.001, T1059.001, T1106 |
| PowerShell Screen Capture via CopyFromScreen | high | medium | match | 2 min | windows_event_log |
- | - | T1113, T1059.001 |
| Webcam or Microphone Used by a Program in a Suspicious Folder | high | medium | match | 8 min | registry_etw |
- | - | T1125, T1123 |
command_and_control (18)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| AnyDesk Silent Install or Unattended-Access Password Set via Command Line | high | medium | match | 2 min | kernel_process_etw |
- | - | T1219.002 |
| Curl Download And Execute Combination | high | medium | match | 8 min | kernel_process_etw |
- | - | T1218, T1105 |
| DNS Query for a Tor Onion or Tor2web Gateway Address | high | medium | match | 8 min | windows_event_log |
- | - | T1090.003 |
| Download From a File-Sharing Site or Raw IP by PowerShell, Curl or Wget | high | medium | match | 2 min | kernel_process_etw |
- | - | T1105, T1102, T1059.001 |
| Executable or Script Downloaded From a Raw Public IP Address | high | medium | match | 8 min | windows_event_log |
- | - | T1105 |
| Finger.EXE Execution | high | high | match | 2 min | kernel_process_etw |
- | - | T1105 |
| NetSupport Client Started Outside Program Files | high | high | match | 2 min | kernel_process_etw |
artifact_path_state |
- | T1219.002, T1036.003 |
| Network Activity From a Process in a Suspicious Folder | high | medium | match | 8 min | windows_event_log |
- | - | T1105 |
| Nslookup Used to Stage a Payload From a Shell One-Liner | high | medium | match | 8 min | kernel_process_etw |
- | - | T1071.004, T1105, T1059 |
| Outbound Network Connection Initiated By Script Interpreter | high | medium | match | 8 min | windows_event_log |
- | - | T1105 |
| PowerShell TCP Reverse Shell Command Line | high | high | match | 2 min | kernel_process_etw |
- | - | T1095, T1059.001 |
| RDP Authentication Over a Loopback Tunnel | high | medium | match | 2 min | windows_event_log |
- | - | T1572, T1021.001 |
| Regsvr32, RegSvcs or RegAsm Connected to a Public Address | high | medium | match | 8 min | windows_event_log |
- | - | T1105, T1218.010, T1218.009 |
| DNS Query for a Tunnelling or Port-Forwarding Service | medium | medium | match | 8 min | windows_event_log |
- | - | T1572, T1219.001, T1105 |
| First WebDAV Connection to an External Host | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1105, T1218.011, T1187 |
| PortProxy Port Forwarding Rule Added | medium | medium | match | 8 min | registry_etw |
- | - | T1090.001, T1572 |
| Suspicious Download Via Certutil.EXE | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1105 |
| Remote Access Tool Started | low | medium | match | 15 min | kernel_process_etw |
- | - | T1219 |
exfiltration (3)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| File Upload or Sync to a Remote Host by an Exfiltration Tool | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1567.002, T1048 |
| Outbound SMTP Connection From an Unexpected Process | medium | medium | match | 8 min | windows_event_log |
- | - | T1048.003, T1071.003 |
| Telegram Bot API Contacted by an Unexpected Process | medium | medium | match | 8 min | windows_event_log |
- | - | T1567, T1102.002 |
impact (17)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| All Backups Deleted Via Wbadmin.EXE | high | medium | match | 2 min | kernel_process_etw |
- | - | T1490 |
| Boot Configuration Tampering Via Bcdedit.EXE | high | medium | match | 2 min | kernel_process_etw |
- | - | T1490 |
| Burst of Renames to Unknown or Appended Extensions | high | medium | threshold (≥20) | 2 min | usn |
- | - | T1486 |
| Cryptocurrency Miner Started | high | medium | match | 2 min | kernel_process_etw |
- | - | T1496.001 |
| Delete All Scheduled Tasks | high | medium | match | 8 min | kernel_process_etw |
- | - | T1489 |
| Deletion of Volume Shadow Copies via WMI with PowerShell | high | medium | match | 8 min | kernel_process_etw |
- | - | T1490 |
| Logon Banner (LegalNotice) Message Set | high | medium | match | 8 min | registry_etw |
- | - | T1491.001 |
| Same Ransom-Note-Like File Name Created in Many Directories | high | medium | threshold (≥5) | 2 min | usn |
- | - | T1486 |
| Shadow Copies Deletion Using Operating Systems Utilities | high | medium | match | 8 min | kernel_process_etw |
- | - | T1070, T1490 |
| Shadow Copy Deletion via WMI in a PowerShell Script Block | high | medium | match | 2 min | windows_event_log |
- | - | T1490, T1059.001 |
| System Restore Disabled via Registry | high | medium | match | 8 min | registry_etw |
- | - | T1490 |
| System Restore Registry Modification via CommandLine | high | medium | match | 8 min | kernel_process_etw |
- | - | T1490 |
| Backup Files Deleted | medium | medium | match | 8 min | file_etw |
- | - | T1490 |
| Defender Controlled Folder Access Blocked a Write | medium | low | match | 8 min | windows_event_log |
- | - | T1486 |
| DNS Query for a Cryptocurrency Mining Pool | medium | medium | match | 8 min | windows_event_log |
- | - | T1496.001 |
| Windows Backup Deleted Via Wbadmin.EXE | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1490 |
| Windows Recovery Environment Disabled via Reagentc | medium | medium | match | 8 min | kernel_process_etw |
- | - | T1490 |
malware (5)¶
| Rule | Severity | Conf. | Kind | Runs every | Source table | Also reads | Excl. | ATT&CK |
|---|---|---|---|---|---|---|---|---|
| Defender Alert (Severe) | critical | high | match | 2 min | windows_event_log |
- | - | - |
| Defender Alert (High) | high | high | match | 2 min | windows_event_log |
- | - | - |
| Defender Detection Not Remediated | high | high | match | 2 min | windows_event_log |
- | - | - |
| Defender Alert (Moderate) | medium | medium | match | 8 min | windows_event_log |
- | - | - |
| Defender Alert (Low) | low | medium | match | 8 min | windows_event_log |
- | - | - |