Navigation :
Release Notes
User Guides
Data Onboarding Guides
Features
SSE Content
- 7Zip Commandline To SMB Share Path
- AWS Create Policy Version To Allow All Resources
- AWS Createaccesskey
- AWS Createloginprofile
- AWS Cross Account Activity From Previously Unseen Account
- AWS Detect Attach To Role Policy
- AWS Detect Permanent Key Creation
- AWS Detect Role Creation
- AWS Detect Sts Assume Role Abuse
- AWS Detect Sts Get Session Token Abuse
- AWS Detect Users Creating Keys With Encrypt Policy Without MFA
- AWS Detect Users With Kms Keys Performing Encryption S3
- AWS Ecr Container Scanning Findings High
- AWS Ecr Container Scanning Findings Low Informational Unknown
- AWS Ecr Container Scanning Findings Medium
- AWS Ecr Container Upload Outside Business Hours
- AWS Ecr Container Upload Unknown User
- AWS Excessive Security Scanning
- AWS Iam Accessdenied Discovery Events
- AWS Iam Assume Role Policy Brute Force
- AWS Iam Delete Policy
- AWS Iam Failure Group Deletion
- AWS Iam Successful Group Deletion
- AWS Network Access Control List Created With All Open Ports
- AWS Network Access Control List Deleted
- AWS Saml Access By Provider User And Principal
- AWS Saml Update Identity Provider
- AWS Setdefaultpolicyversion
- AWS Updateloginprofile
- Abnormally High Number Of Cloud Infrastructure API Calls
- Abnormally High Number Of Cloud Instances Destroyed
- Abnormally High Number Of Cloud Instances Launched
- Abnormally High Number Of Cloud Security Group API Calls
- Abnormally High Number of Endpoint Changes By User
- Abnormally High Number of HTTP Method Events By Src
- Access LSASS Memory For Dump Creation
- Access to In-Scope Unencrypted Resources
- Access to In-scope Resources
- Account Compromise with Suspicious Internal Activity
- Account Compromised followed by Exfiltration
- Account Deleted
- Account Discovery With Net App
- Activity from Expired User Identity
- Activity from Expired User Identity - on Category
- Add Defaultuser And Password In Registry
- Adsisearcher Account Discovery
- Aggregate Risky Events
- Allow File And Printing Sharing In Firewall
- Allow Inbound Traffic By Firewall Rule Registry
- Allow Inbound Traffic In Firewall Rule
- Allow Network Discovery In Firewall
- Allow Operation With Consent Admin
- Amazon EKS Kubernetes Cluster Scan Detection
- Amazon EKS Kubernetes Pod Scan Detection
- Anomalous Audit Trail Activity Detected
- Anomalous New Listening Port
- Anomalous New Process
- Anomalous New Service
- Anomalous Usage Of 7Zip
- Any Powershell Downloadfile
- Any Powershell Downloadstring
- Asset Ownership Unspecified
- Attacker Tools On Endpoint
- Attempt To Add Certificate To Untrusted Store
- Attempt To Stop Security Service
- Attempted Credential Dump From Registry Via Reg Exe
- Auditing Overview of Data Processing Systems (Glass Table)
- Authentication Against a New Domain Controller
- Auto Admin Logon Registry Entry
- Basic Brute Force Detection
- Basic Dynamic DNS Detection
- Basic Malware Outbreak
- Basic Scanning
- Basic TOR Traffic Detection
- Batch File Write To System32
- Bcdedit Command Back To Normal Mode Boot
- Bcdedit Failure Recovery Modification
- Bits Job Persistence
- Bitsadmin Download File
- Blacklisted Application
- Blacklisted Domain
- Blacklisted IP Address
- Brute Force
- Brute Force Access Behavior Detected
- Brute Force Access Behavior Detected - Against Category
- Brute Force Access Behavior Detected Over One Day
- Brute Force Access Behavior Detected Over One Day - Against Category
- Brute Force Attack
- Building a Departmental Peer Group
- COVID-19 Indicator Check
- Certutil Download With Urlcache And Split Arguments
- Certutil Download With Verifyctl And Split Arguments
- Certutil Exe Certificate Extraction
- Certutil With Decode Argument
- Change To Safe Mode With Network Config
- Chcp Command Execution
- Check Elevated Cmd Using Whoami
- Child Processes Of Spoolsv Exe
- Circle Ci Disable Security Job
- Circle Ci Disable Security Step
- Clear Unallocated Sector Using Cipher App
- Cleartext Password At Rest Detected
- Clop Common Exec Parameter
- Clop Ransomware Known Service Name
- Cloud API Calls From Previously Unseen User Roles
- Cloud APIs Called More Often Than Usual Per User
- Cloud Compute Instance Created By Previously Unseen User
- Cloud Compute Instance Created In Previously Unused Region
- Cloud Compute Instance Created With Previously Unseen Image
- Cloud Compute Instance Created With Previously Unseen Instance Type
- Cloud Instance Modified By Previously Unseen User
- Cloud Provisioning Activity From Previously Unseen City
- Cloud Provisioning Activity From Previously Unseen Country
- Cloud Provisioning Activity From Previously Unseen IP Address
- Cloud Provisioning Activity From Previously Unseen Region
- Cloud Provisioning Activity from Unusual Country
- Cloud Provisioning Activity from Unusual IP
- Cmd Echo Pipe - Escalation
- Cmdline Tool Not Executed In Cmd Shell
- Cmlua Or Cmstplua Uac Bypass
- Cobalt Strike Named Pipes
- Common Filename Launched from New Path
- Common Ransomware Extensions
- Common Ransomware Notes
- Completely Inactive Account
- Compromised Account
- Compromised Web Server
- Concentration of Attacker Tools by Filename
- Concentration of Attacker Tools by SHA1 Hash
- Concentration of Discovery Tools by Filename
- Concentration of Discovery Tools by SHA1 Hash
- Concurrent Login Attempts Detected
- Connection to New Domain
- Conti Common Exec Parameter
- Control Loading From World Writable Directory
- Correlation By Repository And Risk
- Correlation By User And Risk
- Create Local Admin Accounts Using Net Exe
- Create Or Delete Windows Shares Using Net Exe
- Create Remote Thread In Shell Application
- Create Remote Thread Into LSASS
- Create Service In Suspicious File Path
- Creation Of LSASS Dump With Taskmgr
- Creation Of Shadow Copy
- Creation Of Shadow Copy With Wmic And Powershell
- Credential Dumping Via Copy Command From Shadow Copy
- Credential Dumping Via Symlink To Shadow Copy
- Credentials In File Detected
- DNS Exfiltration Using Nslookup App
- DNS Query Length Outliers - MLTK
- DNS Query Length With High Standard Deviation
- Data Exfiltration after Account Takeover, High
- Data Exfiltration after Account Takeover, Medium
- Data Exfiltration after Data Staging
- Data Exfiltration by suspicious user or device
- Data Staging
- Default Account Activity Detected
- Default Account At Rest Detected
- Delete Shadowcopy With Powershell
- Deleting Of Net Users
- Deleting Shadow Copies
- Detect AWS Console Login By New User
- Detect AWS Console Login By User From New City
- Detect AWS Console Login By User From New Country
- Detect AWS Console Login By User From New Region
- Detect Activity Related To Pass The Hash Attacks
- Detect Arp Poisoning
- Detect Attackers Scanning For Vulnerable Jboss Servers
- Detect Azurehound Command-Line Arguments
- Detect Azurehound File Modifications
- Detect Baron Samedit Cve-2021-3156
- Detect Baron Samedit Cve-2021-3156 Segfault
- Detect Baron Samedit Cve-2021-3156 Via Osquery
- Detect Computer Changed With Anonymous Account
- Detect Copy Of Shadowcopy With Script Block Logging
- Detect Credential Dumping Through LSASS Access
- Detect Credit Card Numbers using Luhn Algorithm
- Detect Empire With Powershell Script Block Logging
- Detect Excessive Account Lockouts From Endpoint
- Detect Excessive User Account Lockouts
- Detect Exchange Web Shell
- Detect F5 Tmui RCE Cve-2020-5902
- Detect GCP Storage Access From A New IP
- Detect Hosts Connecting To Dynamic Domain Providers
- Detect Html Help Renamed
- Detect Html Help Spawn Child Process
- Detect Html Help Url In Command Line
- Detect Html Help Using Infotech Storage Handlers
- Detect Ipv6 Network Infrastructure Threats
- Detect Journal Clearing
- Detect Large Outbound ICMP Packets
- Detect Lateral Movement With WMI
- Detect Log Clearing With wevtutil
- Detect Malicious Requests To Exploit Jboss Servers
- Detect Many Unauthorized Access Attempts
- Detect Mimikatz Using Loaded Images
- Detect Mimikatz With Powershell Script Block Logging
- Detect Mshta Inline Hta Execution
- Detect Mshta Renamed
- Detect Mshta Url In Command Line
- Detect New Local Admin Account
- Detect New Login Attempts To Routers
- Detect New Open GCP Storage Buckets
- Detect New Open S3 Buckets
- Detect New Open S3 Buckets Over AWS Cli
- Detect Outbound SMB Traffic
- Detect Outlook Exe Writing A Zip File
- Detect Path Interception By Creation Of Program Exe
- Detect Port Security Violation
- Detect Processes Used For System Network Configuration Discovery
- Detect Prohibited Applications Spawning Cmd Exe
- Detect Psexec With Accepteula Flag
- Detect Rare Executables
- Detect Rclone Command-Line Usage
- Detect Regasm Spawning A Process
- Detect Regasm With Network Connection
- Detect Regasm With No Command Line Arguments
- Detect Regsvcs Spawning A Process
- Detect Regsvcs With Network Connection
- Detect Regsvcs With No Command Line Arguments
- Detect Regsvr32 Application Control Bypass
- Detect Renamed 7-Zip
- Detect Renamed Psexec
- Detect Renamed Rclone
- Detect Renamed Winrar
- Detect Rogue DHCP Server
- Detect Rundll32 Application Control Bypass - Advpack
- Detect Rundll32 Application Control Bypass - Setupapi
- Detect Rundll32 Application Control Bypass - Syssetup
- Detect Rundll32 Inline Hta Execution
- Detect S3 Access From A New IP
- Detect Shared EC2 Snapshot
- Detect Sharphound Command-Line Arguments
- Detect Sharphound File Modifications
- Detect Sharphound Usage
- Detect Snicat Sni Exfiltration
- Detect Software Download To Network Device
- Detect Spike In AWS Security Hub Alerts For EC2 Instance
- Detect Spike In AWS Security Hub Alerts For User
- Detect Spike In Blocked Outbound Traffic From Your AWS
- Detect Spike In S3 Bucket Deletion
- Detect Traffic Mirroring
- Detect Unauthorized Assets By MAC Address
- Detect Use Of Cmd Exe To Launch Script Interpreters
- Detect WMI Event Subscription Persistence
- Detect Windows DNS Sigred Via Splunk Stream
- Detect Windows DNS Sigred Via Zeek
- Detect Zerologon Via Zeek
- Detection Of Tools Built By Nirsoft
- Disable Amsi Through Registry
- Disable Etw Through Registry
- Disable Logs Using Wevtutil
- Disable Registry Tool
- Disable Show Hidden Files
- Disable Windows App Hotkeys
- Disable Windows Behavior Monitoring
- Disable Windows Smartscreen Protection
- Disabled Update Service
- Disabling Cmd Application
- Disabling Controlpanel
- Disabling Firewall With Netsh
- Disabling Folderoptions Windows Feature
- Disabling Net User Account
- Disabling Norun Windows App
- Disabling Remote User Account Control
- Disabling Systemrestore In Registry
- Disabling Task Manager
- Dllhost With No Command Line Arguments With Network
- Domain Account Discovery With Dsquery
- Domain Account Discovery With Net App
- Domain Account Discovery With Wmic
- Domain Controller Discovery With Nltest
- Domain Controller Discovery With Wmic
- Domain Group Discovery With Adsisearcher
- Domain Group Discovery With Dsquery
- Domain Group Discovery With Net
- Domain Group Discovery With Wmic
- Download Files Using Telegram
- Download from Internal Server
- Drop Icedid License Dat
- Dsquery Domain Discovery
- Dump LSASS Via Comsvcs DLL
- Dump LSASS Via Procdump
- EC2 Instance Isolation
- Elevated Group Discovery With Net
- Elevated Group Discovery With Powerview
- Elevated Group Discovery With Wmic
- Email Attachments With Lots Of Spaces
- Email Files Written Outside Of The Outlook Directory
- Email Servers Sending High Volume Traffic To Hosts
- Emails from Outside the Organization with Company Domains
- Emails with Lookalike Domains
- Enable Rdp In Other Port Number
- Endpoint Uncleaned Malware Detection
- Enumerate Users Local Group Using Telegram
- Esentutl Sam Copy
- Eventvwr Uac Bypass
- Excel Spawning Powershell
- Excel Spawning Windows Script Host
- Excessive Attempt To Disable Services
- Excessive Box Downloads
- Excessive DNS Queries
- Excessive Data Printed
- Excessive Data Transmission
- Excessive Downloads via VPN
- Excessive Failed Logins
- Excessive HTTP Failure Responses
- Excessive Number Of Distinct Processes Created In Windows Temp Folder
- Excessive Number Of Service Control Start As Disabled
- Excessive Number Of Taskhost Processes
- Excessive Service Stop Attempt
- Excessive Usage Of Cacls App
- Excessive Usage Of Net App
- Excessive Usage Of Nslookup App
- Excessive Usage Of Sc Service Utility
- Excessive Usage Of Taskkill
- Exchange Powershell Abuse Via Ssrf
- Exchange Powershell Module Usage
- Executables Or Script Creation In Suspicious Path
- Execute Javascript With Jscript Com Clsid
- Execution Of File With Multiple Extensions
- Exfiltration
- Exfiltration after Account Compromise
- Exfiltration after Infection
- Exfiltration after Suspicious Internal Activity
- Expected Host Not Reporting
- Expected Host Not Reporting - in Category
- External Alarm Activity
- External Website Attack
- Extraction Of Registry Hives
- Failed Access by Disabled Badge
- Failed Badge Accesses on Multiple Doors
- Fake Windows Processes
- Familiar Filename Launched with New Path on Host
- File With Samsam Extension
- Find Processes with Renamed Executables
- Find Unusually Long CLI Commands
- First Time Access to Jump Server for Peer Group
- First Time Accessing an Internal Git Repository
- First Time Accessing an Internal Git Repository Not Viewed by Peers
- First Time Logon to New Server
- First Time Seen Child Process Of Zoom
- First Time Seen Running Windows Service
- First Time USB Usage
- Flight Risk Emailing
- Flight Risk Printing
- Flight Risk User
- Flight Risk Web Browsing
- Fodhelper Uac Bypass
- Fsutil Zeroing File
- GCP Detect Gcploit Framework
- GCP Kubernetes Cluster Pod Scan Detection
- Geographically Improbable Access (Physical access and VPN)
- Geographically Improbable Access Detected
- Geographically Improbable Access Detected against Category
- Geographically Improbable Access Detected for Privileged Accounts
- Get Addefaultdomainpasswordpolicy With Powershell
- Get Addefaultdomainpasswordpolicy With Powershell Script Block
- Get Aduser With Powershell
- Get Aduser With Powershell Script Block
- Get Aduserresultantpasswordpolicy With Powershell
- Get Aduserresultantpasswordpolicy With Powershell Script Block
- Get Domainpolicy With Powershell
- Get Domainpolicy With Powershell Script Block
- Get Domainuser With Powershell
- Get Domainuser With Powershell Script Block
- Get Wmiobject Group Discovery
- Get Wmiobject Group Discovery With Script Block Logging
- Get-Domaintrust With Powershell
- Get-Domaintrust With Powershell Script Block
- Get-Foresttrust With Powershell
- Get-Foresttrust With Powershell Script Block
- Getadcomputer With Powershell
- Getadcomputer With Powershell Script Block
- Getadgroup With Powershell
- Getadgroup With Powershell Script Block
- Getcurrent User With Powershell
- Getcurrent User With Powershell Script Block
- Getdomaincomputer With Powershell
- Getdomaincomputer With Powershell Script Block
- Getdomaincontroller With Powershell
- Getdomaincontroller With Powershell Script Block
- Getdomaingroup With Powershell
- Getdomaingroup With Powershell Script Block
- Getlocaluser With Powershell
- Getlocaluser With Powershell Script Block
- Getnettcpconnection With Powershell
- Getnettcpconnection With Powershell Script Block
- Getwmiobject Ds Computer With Powershell
- Getwmiobject Ds Computer With Powershell Script Block
- Getwmiobject Ds Group With Powershell
- Getwmiobject Ds Group With Powershell Script Block
- Getwmiobject Ds User With Powershell
- Getwmiobject Ds User With Powershell Script Block
- Getwmiobject User Account With Powershell
- Getwmiobject User Account With Powershell Script Block
- Github Commit Changes In Master
- Github Commit In Develop
- Github Dependabot Alert
- Github Pull Request From Unknown User
- Gpupdate With No Command Line Arguments With Network
- Gsuite Drive Share In External Email
- Gsuite Email Suspicious Attachment
- Gsuite Email Suspicious Subject With Attachment
- Gsuite Email With Known Abuse Web Service Link
- Gsuite Outbound Email With Attachment To External Domain
- Gsuite Suspicious Shared File Name
- Healthcare Worker Opening More Patient Records Than Usual
- Hide User Account From Sign-In Screen
- Hiding Files And Directories With Attrib Exe
- High File Deletion Frequency
- High Number Of Infected Hosts
- High Number Of Login Failures From A Single Source
- High Number of Hosts Not Updating Malware Signatures
- High Or Critical Priority Host With Malware Detected
- High Process Count
- High Process Termination Frequency
- High Volume Email Activity to Non-corporate Domains by User
- High Volume of Traffic from High or Critical Host Observed
- High or Critical Priority Individual Logging into Infected Machine
- High or critical risk NGFW application activity detected
- Host Sending Excessive Email
- Host With A Recurring Malware Infection
- Host With High Number Of Listening ports
- Host With High Number Of Services
- Host With Multiple Infections
- Host With Old Infection Or Potential Re-Infection
- Hosts Receiving High Volume Of Network Traffic From Email Server
- Hosts Sending To More Destinations Than Normal
- Hosts Where Security Sources Go Quiet
- Hosts with Varied and Future Timestamps
- Hunting COVID Themed Attacks With IOCs
- IP Investigate and Report
- Icacls Deny Command
- Icacls Grant Command
- Icedid Exfiltrated Archived File Creation
- Image From New Repository Detected
- In-Scope Device with Outdated Anti-Malware Found
- In-Scope System with Windows Update Disabled
- Inactive Account Activity Detected
- Increase in # of Hosts Logged into
- Increase in Pages Printed
- Increase in Source Code (Git) Downloads
- Increase in Windows Privilege Escalations
- Infected Host
- Infection followed by Exfiltration
- Insecure Or Cleartext Authentication Detected
- Instance Created by Unusual User
- Instance Modified by Unusual User
- Integrating Threat Indicators with MISP and Splunk Enterprise Security
- Investigate GDPR Breaches Using ES
- Jscript Execution Using Cscript App
- Kerberoasting Spn Request With RC4 Encryption
- Known Services Killed By Ransomware
- Kubernetes AWS Detect Suspicious Kubectl Calls
- Kubernetes Nginx Ingress Lfi
- Kubernetes Nginx Ingress Rfi
- Kubernetes Scanner Image Pulling
- Land Speed Violation
- Large Volume Of DNS Any Queries
- Large Web Upload
- Lateral Movement
- Local Account Creation
- Local Account Discovery With Net
- Local Account Discovery With Wmic
- Machine Generated Beacon
- Macos - Re-Opened Applications
- Mailsniper Invoke Functions
- Malicious AD Activity
- Malicious Command Line Executions
- Malicious Insider Containment
- Malicious Powershell Executed As A Service
- Malicious Powershell Process - Connect To Internet With Hidden Window
- Malicious Powershell Process - Encoded Command
- Malicious Powershell Process - Execution Policy Bypass
- Malicious Powershell Process With Obfuscation Techniques
- Malicious URI with Potential Malware
- Malware
- Malware Investigation
- Many USB File Copies for User
- Modification Of Wallpaper
- Modify ACL Permission To Files Or Folder
- Monitor AutoRun Registry Keys
- Monitor Email For Brand Abuse
- Monitor Registry Keys For Print Monitors
- Monitor Successful Backups
- Monitor Successful Windows Updates
- Monitor Unsuccessful Backups
- Monitor Unsuccessful Windows Updates
- Monitor Web Traffic For Brand Abuse
- Ms Scripting Process Loading Ldap Module
- Ms Scripting Process Loading WMI Module
- Mshta Spawning Rundll32 Or Regsvr32 Process
- Mshtml Module Load In Office Product
- Msmpeng Application DLL Side Loading
- Multiple Account Deletion by an Administrator
- Multiple Account Disabled by an Administrator
- Multiple Account Passwords changed by an Administrator
- Multiple Archive Files Http Post Traffic
- Multiple Authentication Failures
- Multiple Authentications
- Multiple Badge Accesses
- Multiple Box login errors
- Multiple Box logins
- Multiple Box operations
- Multiple Disabled Users Failing To Authenticate From Host Using Kerberos
- Multiple External Alarms
- Multiple Failed Badge Access Attempts
- Multiple Infections on Host
- Multiple Invalid Users Failing To Authenticate From Host Using Kerberos
- Multiple Invalid Users Failing To Authenticate From Host Using Ntlm
- Multiple Login Errors
- Multiple Logins
- Multiple Okta Users With Invalid Credentials From The Same IP
- Multiple Outgoing Connections
- Multiple Primary Functions Detected
- Multiple Users Attempting To Authenticate Using Explicit Credentials
- Multiple Users Failing To Authenticate From Host Using Kerberos
- Multiple Users Failing To Authenticate From Host Using Ntlm
- Multiple Users Failing To Authenticate From Process
- Multiple Users Remotely Failing To Authenticate From Host
- Multiple failed badge attempts and unusual badge access time
- Net Localgroup Discovery
- Net Profiler Uac Bypass
- Network Change Detected
- Network Connection Discovery With Arp
- Network Connection Discovery With Net
- Network Connection Discovery With Netstat
- Network Device Rebooted
- Network Protocol Violation
- New AD Domain Detected
- New Application Accessing Salesforce.com API
- New Cloud API Call Per Peer Group
- New Cloud Provider for User
- New Connection to In-Scope Device
- New Container Uploaded To AWS Ecr
- New Data Exfil DLP Alerts for User
- New High Risk Event Types for Salesforce.com User
- New IaaS API Call Per User
- New Interactive Logon from a Service Account
- New Local Admin Account
- New Logon Type for User
- New Parent Process for cmd.exe or regedit.exe
- New RunAs Host / Privileged Account Combination
- New Service Paths for Host
- New Suspicious Executable Launch for User
- New Suspicious cmd.exe / regedit.exe / powershell.exe Service Launch
- New Tables Queried by Salesforce.com Peer Group
- New Tables Queried by Salesforce.com User
- New User Account Created On Multiple Hosts
- New User Taking Privileged Actions
- Nishang Powershelltcponeline
- Nltest Domain Trust Discovery
- No Windows Updates In A Time Frame
- Non Chrome Process Accessing Chrome Default Dir
- Non Firefox Process Access Firefox Profile Dir
- Non-Privileged Users taking Privileged Actions
- Ntdsutil Export Ntds
- O365 Add App Role Assignment Grant User
- O365 Added Service Principal
- O365 Bypass MFA Via Trusted IP
- O365 Disable MFA
- O365 Excessive Authentication Failures Alert
- O365 Excessive Sso Logon Errors
- O365 New Federated Domain Added
- O365 Pst Export Alert
- O365 Suspicious Admin Email Forwarding
- O365 Suspicious Rights Delegation
- O365 Suspicious User Email Forwarding
- Office Application Drop Executable
- Office Application Spawn Regsvr32 Process
- Office Application Spawn Rundll32 Process
- Office Document Creating Schedule Task
- Office Document Executing Macro Code
- Office Document Spawned Child Process To Download
- Office Product Spawn Cmd Process
- Office Product Spawning Bitsadmin
- Office Product Spawning Certutil
- Office Product Spawning Mshta
- Office Product Spawning Rundll32 With No DLL
- Office Product Spawning Wmic
- Office Product Writing Cab Or Inf
- Office Spawning Control
- Okta Account Lockout Events
- Okta Failed Sso Attempts
- Okta User Logins From Multiple Cities
- Old Passwords in Use
- Outbreak Detected
- Outdated Malware Definitions
- Overwriting Accessibility Binaries
- Password Policy Discovery With Net
- Period with Unusual Windows Security Event Sequences
- Permission Modification Using Takeown App
- Personally Identifiable Information Detected
- Petitpotam Network Share Access Request
- Petitpotam Suspicious Kerberos Tgt Request
- Phishing Investigation and Response
- Plain Http Post Exfiltrated Data
- Possible Phishing Attempt
- Potential Day Trading
- Potential Flight Risk Exfiltration
- Potential Flight Risk Staging
- Potential Gap in Data
- Potential Phishing Attack
- Potential Webshell Activity
- Powershell 4104 Hunting
- Powershell Creating Thread Mutex
- Powershell Disable Security Monitoring
- Powershell Domain Enumeration
- Powershell Enable Smb1Protocol Feature
- Powershell Execute Com Object
- Powershell Fileless Process Injection Via Getprocaddress
- Powershell Fileless Script Contains Base64 Encoded Content
- Powershell Get Localgroup Discovery
- Powershell Get Localgroup Discovery With Script Block Logging
- Powershell Loading Dotnet Into Memory Via System Reflection Assembly
- Powershell Processing Stream Of Data
- Powershell Remote Thread To Known Windows Process
- Powershell Start-Bitstransfer
- Powershell Using Memory As Backing Store
- Prevent Automatic Repair Mode Using Bcdedit
- Print Spooler Adding A Printer Driver
- Print Spooler Failed To Load A Plug-In
- Privilege Escalation after Powershell Activity
- Process Creating Lnk File In Suspicious Location
- Process Deleting Its Process File Path
- Process Execution Via WMI
- Process Kill Base On File Path
- Processes Launching Netsh
- Processes Tapping Keyboard Events
- Processes with High Entropy Names
- Processes with Lookalike (typo) Filenames
- Prohibited Network Traffic Allowed
- Prohibited Port Activity Detected
- Prohibited Process Detected
- Prohibited Service Detected
- Prompt and Block Domain
- Protocol Or Port Mismatch
- Protocols Passing Authentication In Cleartext
- Public Cloud Storage (Bucket)
- Public facing Website Attack
- Pull List of Privileged Users
- RFC1918 IP Not in CMDB
- Ransomware Extensions
- Ransomware Investigate and Contain
- Ransomware Note Files
- Ransomware Notes Bulk Creation
- Ransomware Vulnerabilities
- Recon Avproduct Through Pwh Or WMI
- Recon Using WMI Class
- Recurring Infection on Host
- Recursive Delete Of Directory In Batch Cmd
- Reg Exe Manipulating Windows Services Registry Keys
- Registry Keys For Creating Shim Databases
- Registry Keys Used For Persistence
- Registry Keys Used For Privilege Escalation
- Remcos Rat File Creation In Remcos Folder
- Remote Account Takeover
- Remote Desktop Network Bruteforce
- Remote Desktop Network Traffic
- Remote Desktop Process Running On System
- Remote PowerShell Launches
- Remote Process Instantiation Via WMI
- Remote System Discovery With Adsisearcher
- Remote System Discovery With Dsquery
- Remote System Discovery With Net
- Remote System Discovery With Wmic
- Remote WMI Command Attempt
- Resize Shadowstorage Volume
- Revil Common Exec Parameter
- Revil Registry Entry
- Risky Events from Privileged Users
- Rundll Loading DLL By Ordinal
- Rundll32 Control Rundll Hunt
- Rundll32 Control Rundll World Writable Directory
- Rundll32 Create Remote Thread To A Process
- Rundll32 Createremotethread In Browser
- Rundll32 Dnsquery
- Rundll32 Process Creating Exe DLL Files
- Rundll32 With No Command Line Arguments With Network
- Ryuk Test Files Detected
- Ryuk Wake On Lan Command
- SFDC Suspicious volume of records accessed
- SMB Traffic Allowed
- SMB Traffic Spike
- SMB Traffic Spike - MLTK
- Sam Database File Access Attempt
- Same Error On Many Servers Detected
- Samsam Test File Write
- Sc Exe Manipulating Windows Services
- Scanning Activity
- Schcache Change By App Connect And Create Adsi Object
- Schedule Task With Http Command Arguments
- Schedule Task With Rundll32 Command Trigger
- Scheduled Task Deleted Or Created Via Cmd
- Schtasks Run Task On Demand
- Schtasks Scheduling Job On Remote System
- Schtasks Used For Forcing A Reboot
- Script Execution Via WMI
- Sdclt Uac Bypass
- Searchprotocolhost With No Command Line With Network
- Secretdumps Offline Ntds Dumping Tool
- Sensitive Kubernetes Mount Pod Detected
- Service Account Login
- Services Escalate Exe
- Set Default Powershell Execution Policy To Unrestricted Or Bypass
- Shim Database File Creation
- Shim Database Installation With Suspicious Parameters
- Short Lived Admin Accounts
- Short Lived Windows Accounts
- Short-lived Account Detected
- Significant Increase in Interactive Logons
- Significant Increase in Interactively Logged On Users
- Silentcleanup Uac Bypass
- Single Letter Process On Endpoint
- Slui Runas Elevated
- Slui Spawning A Process
- Sources Sending Many DNS Requests
- Sources Sending a High Volume of DNS Traffic
- Spike In File Writes
- Spike in Downloaded Documents Per User from Salesforce.com
- Spike in Exported Records from Salesforce.com
- Spike in Password Reset Emails
- Spike in SMB Traffic
- Spoolsv Spawning Rundll32
- Spoolsv Suspicious Loaded Modules
- Spoolsv Suspicious Process Access
- Spoolsv Writing A DLL
- Spoolsv Writing A DLL - Sysmon
- Sql Injection With Long Urls
- Sqlite Module In Temp Folder
- Stale Account Usage
- Start Up During Safe Mode Boot
- Substantial Increase In Events
- Substantial Increase In Port Activity
- Successful Login of Account for Former Employee
- Sunburst Correlation DLL And Network Event
- Supernova Webshell
- Suspicious Account Activity
- Suspicious Account Lockout
- Suspicious Activity After Intrusion
- Suspicious Badge Activity
- Suspicious Behavior
- Suspicious Box Usage
- Suspicious Container Image Name
- Suspicious Curl Network Connection
- Suspicious Data Collection
- Suspicious Data Movement
- Suspicious Dllhost No Command Line Arguments
- Suspicious Domain Communication
- Suspicious Domain Communication followed by Malware Activity
- Suspicious Domain Name
- Suspicious Driver Loaded Path
- Suspicious Email - UBA Anomaly
- Suspicious Email Attachment Extensions
- Suspicious Event Log Service Behavior
- Suspicious External Alarm Activity
- Suspicious Gpupdate No Command Line Arguments
- Suspicious HTTP Redirects
- Suspicious HTTP Redirects followed by Suspected Infection
- Suspicious IP Address Communication
- Suspicious Icedid Regsvr32 Cmdline
- Suspicious Icedid Rundll32 Cmdline
- Suspicious Image Creation In Appdata Folder
- Suspicious Java Classes
- Suspicious Microsoft Workflow Compiler Rename
- Suspicious Microsoft Workflow Compiler Usage
- Suspicious Msbuild Path
- Suspicious Msbuild Rename
- Suspicious Msbuild Spawn
- Suspicious Mshta Child Process
- Suspicious Mshta Spawn
- Suspicious Network Connection
- Suspicious Network Exploration
- Suspicious New Access
- Suspicious Plistbuddy Usage
- Suspicious Plistbuddy Usage Via Osquery
- Suspicious Powershell Activity
- Suspicious Privilege Escalation
- Suspicious Process File Path
- Suspicious Reg Exe Process
- Suspicious Regsvr32 Register Suspicious Path
- Suspicious Rundll32 Dllregisterserver
- Suspicious Rundll32 No Command Line Arguments
- Suspicious Rundll32 Plugininit
- Suspicious Rundll32 Rename
- Suspicious Rundll32 Startw
- Suspicious Scheduled Task From Public Directory
- Suspicious Searchprotocolhost No Command Line Arguments
- Suspicious Sqlite3 Lsquarantine Behavior
- Suspicious URL Communications and Redirects
- Suspicious Wav File In Appdata Folder
- Suspicious Wevtutil Usage
- Suspicious Writes To Windows Recycle Bin
- System Information Discovery Detection
- System Processes Run From Unexpected Locations
- System User Discovery With Query
- System User Discovery With Whoami
- Threat Activity Detected
- Threat Hunting
- Tor Traffic
- Trickbot Named Pipe
- USB storage attached an unusually high number of times
- Uac Bypass Mmc Load Unsigned DLL
- Uac Bypass With Colorui Com Object
- Unauthorized Connection Through Firewall
- Unified Messaging Service Spawning A Process
- Uninstall App Using Msiexec
- Unload Sysmon Filter Driver
- Unloading Amsi Via Reflection
- Unrouteable Activity Detected
- Untriaged Notable Events
- Unusual Activity Time
- Unusual Badge Reader Access
- Unusual Child Process for spoolsv.exe or connhost.exe
- Unusual Cloud Regions
- Unusual Cloud Storage Deletions
- Unusual Cloud Storage Downloads
- Unusual External Alarm
- Unusual File Extension
- Unusual Geolocation of Communication Destination
- Unusual Machine Access
- Unusual Network Activity
- Unusual Number of Modifications to Cloud ACLs
- Unusual Printer Usage
- Unusual Time of Badge Access
- Unusual USB Activity
- Unusual USB Device Plugged In
- Unusual VPN Login Geolocation
- Unusual Volume of Network Activity
- Unusual Web Browser
- Unusual Windows Security Event (Unusual - Event Code, Process, Directory, LoginType, ReturnCode, Domain)
- Unusually Long Command Line
- Unusually Long Command Line - MLTK
- Unusually Long Content-Type Length
- Unusually Long VPN Session
- User Discovery With Env Vars Powershell
- User Discovery With Env Vars Powershell Script Block
- User Finding Project Code Names from Many Departments
- User Has Access to In-Scope Splunk Indexes They Should Not
- User Logged into In-Scope System They Should Not Have
- User Login to Unauthorized Geo
- User Login with Local Credentials
- User with Increase in Outgoing Email
- User with Many DLP Events
- Usn Journal Deletion
- Vulnerability Scanner Detected (by events)
- Vulnerability Scanner Detected (by targets)
- W3Wp Spawning Shell
- WMI Permanent Event Subscription
- WMI Permanent Event Subscription - Sysmon
- WMI Recon Running Process Or Services
- WMI Temporary Event Subscription
- Watchlisted Event Observed
- Watering Hole Infection
- Wbadmin Delete System Backups
- Wbemprox Com Object Execution
- Web Browsing to Unauthorized Sites
- Web Servers Executing Suspicious Processes
- Web Site Compromised (Webshell)
- Web Uploads to Non-corporate Sites by Users
- Wermgr Process Connecting To IP Check Web Services
- Wermgr Process Create Executable File
- Wermgr Process Spawned Cmd Or Powershell Process
- Windows Adfind Exe
- Windows Disableantispyware Registry
- Windows Event Log Cleared
- Windows Event Log Clearing Events
- Windows Security Account Manager Stopped
- Winevent Scheduled Task Created To Spawn Shell
- Winevent Scheduled Task Created Within Public Path
- Winrm Spawning A Process
- Winword Spawning Cmd
- Winword Spawning Powershell
- Winword Spawning Windows Script Host
- Wmic Group Discovery
- Write Executable In SMB Share
- Wsreset Uac Bypass
- Xmrig Driver Loaded
- Xsl Script Execution With Wmic
Technical Detail
Developing on SSE
Installation Documentation O365 Suspicious User Email Forwarding O365 Suspicious User Email Forwarding Description This search detects when multiple user configured a forwarding rule to the same destination.
O365 Suspicious User Email Forwarding Help
You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
`o365_management_activity` Operation=Set-Mailbox | spath input =Parameters | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc (src_user) AS count_src_user earliest (_time) as firstTime latest (_time) as lastTime values (src_user) AS src_user values (user) AS user by ForwardingSmtpAddress | where count_src_user > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter` Open in Search