Navigation :
Release Notes
User Guides
Data Onboarding Guides
Features
SSE Content
- 7Zip Commandline To SMB Share Path
- AWS Create Policy Version To Allow All Resources
- AWS Createaccesskey
- AWS Createloginprofile
- AWS Cross Account Activity From Previously Unseen Account
- AWS Detect Attach To Role Policy
- AWS Detect Permanent Key Creation
- AWS Detect Role Creation
- AWS Detect Sts Assume Role Abuse
- AWS Detect Sts Get Session Token Abuse
- AWS Detect Users Creating Keys With Encrypt Policy Without MFA
- AWS Detect Users With Kms Keys Performing Encryption S3
- AWS Ecr Container Scanning Findings High
- AWS Ecr Container Scanning Findings Low Informational Unknown
- AWS Ecr Container Scanning Findings Medium
- AWS Ecr Container Upload Outside Business Hours
- AWS Ecr Container Upload Unknown User
- AWS Excessive Security Scanning
- AWS Iam Accessdenied Discovery Events
- AWS Iam Assume Role Policy Brute Force
- AWS Iam Delete Policy
- AWS Iam Failure Group Deletion
- AWS Iam Successful Group Deletion
- AWS Network Access Control List Created With All Open Ports
- AWS Network Access Control List Deleted
- AWS Saml Access By Provider User And Principal
- AWS Saml Update Identity Provider
- AWS Setdefaultpolicyversion
- AWS Updateloginprofile
- Abnormally High Number Of Cloud Infrastructure API Calls
- Abnormally High Number Of Cloud Instances Destroyed
- Abnormally High Number Of Cloud Instances Launched
- Abnormally High Number Of Cloud Security Group API Calls
- Abnormally High Number of Endpoint Changes By User
- Abnormally High Number of HTTP Method Events By Src
- Access LSASS Memory For Dump Creation
- Access to In-Scope Unencrypted Resources
- Access to In-scope Resources
- Account Compromise with Suspicious Internal Activity
- Account Compromised followed by Exfiltration
- Account Deleted
- Account Discovery With Net App
- Activity from Expired User Identity
- Activity from Expired User Identity - on Category
- Add Defaultuser And Password In Registry
- Adsisearcher Account Discovery
- Aggregate Risky Events
- Allow File And Printing Sharing In Firewall
- Allow Inbound Traffic By Firewall Rule Registry
- Allow Inbound Traffic In Firewall Rule
- Allow Network Discovery In Firewall
- Allow Operation With Consent Admin
- Amazon EKS Kubernetes Cluster Scan Detection
- Amazon EKS Kubernetes Pod Scan Detection
- Anomalous Audit Trail Activity Detected
- Anomalous New Listening Port
- Anomalous New Process
- Anomalous New Service
- Anomalous Usage Of 7Zip
- Any Powershell Downloadfile
- Any Powershell Downloadstring
- Asset Ownership Unspecified
- Attacker Tools On Endpoint
- Attempt To Add Certificate To Untrusted Store
- Attempt To Stop Security Service
- Attempted Credential Dump From Registry Via Reg Exe
- Auditing Overview of Data Processing Systems (Glass Table)
- Authentication Against a New Domain Controller
- Auto Admin Logon Registry Entry
- Basic Brute Force Detection
- Basic Dynamic DNS Detection
- Basic Malware Outbreak
- Basic Scanning
- Basic TOR Traffic Detection
- Batch File Write To System32
- Bcdedit Command Back To Normal Mode Boot
- Bcdedit Failure Recovery Modification
- Bits Job Persistence
- Bitsadmin Download File
- Blacklisted Application
- Blacklisted Domain
- Blacklisted IP Address
- Brute Force
- Brute Force Access Behavior Detected
- Brute Force Access Behavior Detected - Against Category
- Brute Force Access Behavior Detected Over One Day
- Brute Force Access Behavior Detected Over One Day - Against Category
- Brute Force Attack
- Building a Departmental Peer Group
- COVID-19 Indicator Check
- Certutil Download With Urlcache And Split Arguments
- Certutil Download With Verifyctl And Split Arguments
- Certutil Exe Certificate Extraction
- Certutil With Decode Argument
- Change To Safe Mode With Network Config
- Chcp Command Execution
- Check Elevated Cmd Using Whoami
- Child Processes Of Spoolsv Exe
- Circle Ci Disable Security Job
- Circle Ci Disable Security Step
- Clear Unallocated Sector Using Cipher App
- Cleartext Password At Rest Detected
- Clop Common Exec Parameter
- Clop Ransomware Known Service Name
- Cloud API Calls From Previously Unseen User Roles
- Cloud APIs Called More Often Than Usual Per User
- Cloud Compute Instance Created By Previously Unseen User
- Cloud Compute Instance Created In Previously Unused Region
- Cloud Compute Instance Created With Previously Unseen Image
- Cloud Compute Instance Created With Previously Unseen Instance Type
- Cloud Instance Modified By Previously Unseen User
- Cloud Provisioning Activity From Previously Unseen City
- Cloud Provisioning Activity From Previously Unseen Country
- Cloud Provisioning Activity From Previously Unseen IP Address
- Cloud Provisioning Activity From Previously Unseen Region
- Cloud Provisioning Activity from Unusual Country
- Cloud Provisioning Activity from Unusual IP
- Cmd Echo Pipe - Escalation
- Cmdline Tool Not Executed In Cmd Shell
- Cmlua Or Cmstplua Uac Bypass
- Cobalt Strike Named Pipes
- Common Filename Launched from New Path
- Common Ransomware Extensions
- Common Ransomware Notes
- Completely Inactive Account
- Compromised Account
- Compromised Web Server
- Concentration of Attacker Tools by Filename
- Concentration of Attacker Tools by SHA1 Hash
- Concentration of Discovery Tools by Filename
- Concentration of Discovery Tools by SHA1 Hash
- Concurrent Login Attempts Detected
- Connection to New Domain
- Conti Common Exec Parameter
- Control Loading From World Writable Directory
- Correlation By Repository And Risk
- Correlation By User And Risk
- Create Local Admin Accounts Using Net Exe
- Create Or Delete Windows Shares Using Net Exe
- Create Remote Thread In Shell Application
- Create Remote Thread Into LSASS
- Create Service In Suspicious File Path
- Creation Of LSASS Dump With Taskmgr
- Creation Of Shadow Copy
- Creation Of Shadow Copy With Wmic And Powershell
- Credential Dumping Via Copy Command From Shadow Copy
- Credential Dumping Via Symlink To Shadow Copy
- Credentials In File Detected
- DNS Exfiltration Using Nslookup App
- DNS Query Length Outliers - MLTK
- DNS Query Length With High Standard Deviation
- Data Exfiltration after Account Takeover, High
- Data Exfiltration after Account Takeover, Medium
- Data Exfiltration after Data Staging
- Data Exfiltration by suspicious user or device
- Data Staging
- Default Account Activity Detected
- Default Account At Rest Detected
- Delete Shadowcopy With Powershell
- Deleting Of Net Users
- Deleting Shadow Copies
- Detect AWS Console Login By New User
- Detect AWS Console Login By User From New City
- Detect AWS Console Login By User From New Country
- Detect AWS Console Login By User From New Region
- Detect Activity Related To Pass The Hash Attacks
- Detect Arp Poisoning
- Detect Attackers Scanning For Vulnerable Jboss Servers
- Detect Azurehound Command-Line Arguments
- Detect Azurehound File Modifications
- Detect Baron Samedit Cve-2021-3156
- Detect Baron Samedit Cve-2021-3156 Segfault
- Detect Baron Samedit Cve-2021-3156 Via Osquery
- Detect Computer Changed With Anonymous Account
- Detect Copy Of Shadowcopy With Script Block Logging
- Detect Credential Dumping Through LSASS Access
- Detect Credit Card Numbers using Luhn Algorithm
- Detect Empire With Powershell Script Block Logging
- Detect Excessive Account Lockouts From Endpoint
- Detect Excessive User Account Lockouts
- Detect Exchange Web Shell
- Detect F5 Tmui RCE Cve-2020-5902
- Detect GCP Storage Access From A New IP
- Detect Hosts Connecting To Dynamic Domain Providers
- Detect Html Help Renamed
- Detect Html Help Spawn Child Process
- Detect Html Help Url In Command Line
- Detect Html Help Using Infotech Storage Handlers
- Detect Ipv6 Network Infrastructure Threats
- Detect Journal Clearing
- Detect Large Outbound ICMP Packets
- Detect Lateral Movement With WMI
- Detect Log Clearing With wevtutil
- Detect Malicious Requests To Exploit Jboss Servers
- Detect Many Unauthorized Access Attempts
- Detect Mimikatz Using Loaded Images
- Detect Mimikatz With Powershell Script Block Logging
- Detect Mshta Inline Hta Execution
- Detect Mshta Renamed
- Detect Mshta Url In Command Line
- Detect New Local Admin Account
- Detect New Login Attempts To Routers
- Detect New Open GCP Storage Buckets
- Detect New Open S3 Buckets
- Detect New Open S3 Buckets Over AWS Cli
- Detect Outbound SMB Traffic
- Detect Outlook Exe Writing A Zip File
- Detect Path Interception By Creation Of Program Exe
- Detect Port Security Violation
- Detect Processes Used For System Network Configuration Discovery
- Detect Prohibited Applications Spawning Cmd Exe
- Detect Psexec With Accepteula Flag
- Detect Rare Executables
- Detect Rclone Command-Line Usage
- Detect Regasm Spawning A Process
- Detect Regasm With Network Connection
- Detect Regasm With No Command Line Arguments
- Detect Regsvcs Spawning A Process
- Detect Regsvcs With Network Connection
- Detect Regsvcs With No Command Line Arguments
- Detect Regsvr32 Application Control Bypass
- Detect Renamed 7-Zip
- Detect Renamed Psexec
- Detect Renamed Rclone
- Detect Renamed Winrar
- Detect Rogue DHCP Server
- Detect Rundll32 Application Control Bypass - Advpack
- Detect Rundll32 Application Control Bypass - Setupapi
- Detect Rundll32 Application Control Bypass - Syssetup
- Detect Rundll32 Inline Hta Execution
- Detect S3 Access From A New IP
- Detect Shared EC2 Snapshot
- Detect Sharphound Command-Line Arguments
- Detect Sharphound File Modifications
- Detect Sharphound Usage
- Detect Snicat Sni Exfiltration
- Detect Software Download To Network Device
- Detect Spike In AWS Security Hub Alerts For EC2 Instance
- Detect Spike In AWS Security Hub Alerts For User
- Detect Spike In Blocked Outbound Traffic From Your AWS
- Detect Spike In S3 Bucket Deletion
- Detect Traffic Mirroring
- Detect Unauthorized Assets By MAC Address
- Detect Use Of Cmd Exe To Launch Script Interpreters
- Detect WMI Event Subscription Persistence
- Detect Windows DNS Sigred Via Splunk Stream
- Detect Windows DNS Sigred Via Zeek
- Detect Zerologon Via Zeek
- Detection Of Tools Built By Nirsoft
- Disable Amsi Through Registry
- Disable Etw Through Registry
- Disable Logs Using Wevtutil
- Disable Registry Tool
- Disable Show Hidden Files
- Disable Windows App Hotkeys
- Disable Windows Behavior Monitoring
- Disable Windows Smartscreen Protection
- Disabled Update Service
- Disabling Cmd Application
- Disabling Controlpanel
- Disabling Firewall With Netsh
- Disabling Folderoptions Windows Feature
- Disabling Net User Account
- Disabling Norun Windows App
- Disabling Remote User Account Control
- Disabling Systemrestore In Registry
- Disabling Task Manager
- Dllhost With No Command Line Arguments With Network
- Domain Account Discovery With Dsquery
- Domain Account Discovery With Net App
- Domain Account Discovery With Wmic
- Domain Controller Discovery With Nltest
- Domain Controller Discovery With Wmic
- Domain Group Discovery With Adsisearcher
- Domain Group Discovery With Dsquery
- Domain Group Discovery With Net
- Domain Group Discovery With Wmic
- Download Files Using Telegram
- Download from Internal Server
- Drop Icedid License Dat
- Dsquery Domain Discovery
- Dump LSASS Via Comsvcs DLL
- Dump LSASS Via Procdump
- EC2 Instance Isolation
- Elevated Group Discovery With Net
- Elevated Group Discovery With Powerview
- Elevated Group Discovery With Wmic
- Email Attachments With Lots Of Spaces
- Email Files Written Outside Of The Outlook Directory
- Email Servers Sending High Volume Traffic To Hosts
- Emails from Outside the Organization with Company Domains
- Emails with Lookalike Domains
- Enable Rdp In Other Port Number
- Endpoint Uncleaned Malware Detection
- Enumerate Users Local Group Using Telegram
- Esentutl Sam Copy
- Eventvwr Uac Bypass
- Excel Spawning Powershell
- Excel Spawning Windows Script Host
- Excessive Attempt To Disable Services
- Excessive Box Downloads
- Excessive DNS Queries
- Excessive Data Printed
- Excessive Data Transmission
- Excessive Downloads via VPN
- Excessive Failed Logins
- Excessive HTTP Failure Responses
- Excessive Number Of Distinct Processes Created In Windows Temp Folder
- Excessive Number Of Service Control Start As Disabled
- Excessive Number Of Taskhost Processes
- Excessive Service Stop Attempt
- Excessive Usage Of Cacls App
- Excessive Usage Of Net App
- Excessive Usage Of Nslookup App
- Excessive Usage Of Sc Service Utility
- Excessive Usage Of Taskkill
- Exchange Powershell Abuse Via Ssrf
- Exchange Powershell Module Usage
- Executables Or Script Creation In Suspicious Path
- Execute Javascript With Jscript Com Clsid
- Execution Of File With Multiple Extensions
- Exfiltration
- Exfiltration after Account Compromise
- Exfiltration after Infection
- Exfiltration after Suspicious Internal Activity
- Expected Host Not Reporting
- Expected Host Not Reporting - in Category
- External Alarm Activity
- External Website Attack
- Extraction Of Registry Hives
- Failed Access by Disabled Badge
- Failed Badge Accesses on Multiple Doors
- Fake Windows Processes
- Familiar Filename Launched with New Path on Host
- File With Samsam Extension
- Find Processes with Renamed Executables
- Find Unusually Long CLI Commands
- First Time Access to Jump Server for Peer Group
- First Time Accessing an Internal Git Repository
- First Time Accessing an Internal Git Repository Not Viewed by Peers
- First Time Logon to New Server
- First Time Seen Child Process Of Zoom
- First Time Seen Running Windows Service
- First Time USB Usage
- Flight Risk Emailing
- Flight Risk Printing
- Flight Risk User
- Flight Risk Web Browsing
- Fodhelper Uac Bypass
- Fsutil Zeroing File
- GCP Detect Gcploit Framework
- GCP Kubernetes Cluster Pod Scan Detection
- Geographically Improbable Access (Physical access and VPN)
- Geographically Improbable Access Detected
- Geographically Improbable Access Detected against Category
- Geographically Improbable Access Detected for Privileged Accounts
- Get Addefaultdomainpasswordpolicy With Powershell
- Get Addefaultdomainpasswordpolicy With Powershell Script Block
- Get Aduser With Powershell
- Get Aduser With Powershell Script Block
- Get Aduserresultantpasswordpolicy With Powershell
- Get Aduserresultantpasswordpolicy With Powershell Script Block
- Get Domainpolicy With Powershell
- Get Domainpolicy With Powershell Script Block
- Get Domainuser With Powershell
- Get Domainuser With Powershell Script Block
- Get Wmiobject Group Discovery
- Get Wmiobject Group Discovery With Script Block Logging
- Get-Domaintrust With Powershell
- Get-Domaintrust With Powershell Script Block
- Get-Foresttrust With Powershell
- Get-Foresttrust With Powershell Script Block
- Getadcomputer With Powershell
- Getadcomputer With Powershell Script Block
- Getadgroup With Powershell
- Getadgroup With Powershell Script Block
- Getcurrent User With Powershell
- Getcurrent User With Powershell Script Block
- Getdomaincomputer With Powershell
- Getdomaincomputer With Powershell Script Block
- Getdomaincontroller With Powershell
- Getdomaincontroller With Powershell Script Block
- Getdomaingroup With Powershell
- Getdomaingroup With Powershell Script Block
- Getlocaluser With Powershell
- Getlocaluser With Powershell Script Block
- Getnettcpconnection With Powershell
- Getnettcpconnection With Powershell Script Block
- Getwmiobject Ds Computer With Powershell
- Getwmiobject Ds Computer With Powershell Script Block
- Getwmiobject Ds Group With Powershell
- Getwmiobject Ds Group With Powershell Script Block
- Getwmiobject Ds User With Powershell
- Getwmiobject Ds User With Powershell Script Block
- Getwmiobject User Account With Powershell
- Getwmiobject User Account With Powershell Script Block
- Github Commit Changes In Master
- Github Commit In Develop
- Github Dependabot Alert
- Github Pull Request From Unknown User
- Gpupdate With No Command Line Arguments With Network
- Gsuite Drive Share In External Email
- Gsuite Email Suspicious Attachment
- Gsuite Email Suspicious Subject With Attachment
- Gsuite Email With Known Abuse Web Service Link
- Gsuite Outbound Email With Attachment To External Domain
- Gsuite Suspicious Shared File Name
- Healthcare Worker Opening More Patient Records Than Usual
- Hide User Account From Sign-In Screen
- Hiding Files And Directories With Attrib Exe
- High File Deletion Frequency
- High Number Of Infected Hosts
- High Number Of Login Failures From A Single Source
- High Number of Hosts Not Updating Malware Signatures
- High Or Critical Priority Host With Malware Detected
- High Process Count
- High Process Termination Frequency
- High Volume Email Activity to Non-corporate Domains by User
- High Volume of Traffic from High or Critical Host Observed
- High or Critical Priority Individual Logging into Infected Machine
- High or critical risk NGFW application activity detected
- Host Sending Excessive Email
- Host With A Recurring Malware Infection
- Host With High Number Of Listening ports
- Host With High Number Of Services
- Host With Multiple Infections
- Host With Old Infection Or Potential Re-Infection
- Hosts Receiving High Volume Of Network Traffic From Email Server
- Hosts Sending To More Destinations Than Normal
- Hosts Where Security Sources Go Quiet
- Hosts with Varied and Future Timestamps
- Hunting COVID Themed Attacks With IOCs
- IP Investigate and Report
- Icacls Deny Command
- Icacls Grant Command
- Icedid Exfiltrated Archived File Creation
- Image From New Repository Detected
- In-Scope Device with Outdated Anti-Malware Found
- In-Scope System with Windows Update Disabled
- Inactive Account Activity Detected
- Increase in # of Hosts Logged into
- Increase in Pages Printed
- Increase in Source Code (Git) Downloads
- Increase in Windows Privilege Escalations
- Infected Host
- Infection followed by Exfiltration
- Insecure Or Cleartext Authentication Detected
- Instance Created by Unusual User
- Instance Modified by Unusual User
- Integrating Threat Indicators with MISP and Splunk Enterprise Security
- Investigate GDPR Breaches Using ES
- Jscript Execution Using Cscript App
- Kerberoasting Spn Request With RC4 Encryption
- Known Services Killed By Ransomware
- Kubernetes AWS Detect Suspicious Kubectl Calls
- Kubernetes Nginx Ingress Lfi
- Kubernetes Nginx Ingress Rfi
- Kubernetes Scanner Image Pulling
- Land Speed Violation
- Large Volume Of DNS Any Queries
- Large Web Upload
- Lateral Movement
- Local Account Creation
- Local Account Discovery With Net
- Local Account Discovery With Wmic
- Machine Generated Beacon
- Macos - Re-Opened Applications
- Mailsniper Invoke Functions
- Malicious AD Activity
- Malicious Command Line Executions
- Malicious Insider Containment
- Malicious Powershell Executed As A Service
- Malicious Powershell Process - Connect To Internet With Hidden Window
- Malicious Powershell Process - Encoded Command
- Malicious Powershell Process - Execution Policy Bypass
- Malicious Powershell Process With Obfuscation Techniques
- Malicious URI with Potential Malware
- Malware
- Malware Investigation
- Many USB File Copies for User
- Modification Of Wallpaper
- Modify ACL Permission To Files Or Folder
- Monitor AutoRun Registry Keys
- Monitor Email For Brand Abuse
- Monitor Registry Keys For Print Monitors
- Monitor Successful Backups
- Monitor Successful Windows Updates
- Monitor Unsuccessful Backups
- Monitor Unsuccessful Windows Updates
- Monitor Web Traffic For Brand Abuse
- Ms Scripting Process Loading Ldap Module
- Ms Scripting Process Loading WMI Module
- Mshta Spawning Rundll32 Or Regsvr32 Process
- Mshtml Module Load In Office Product
- Msmpeng Application DLL Side Loading
- Multiple Account Deletion by an Administrator
- Multiple Account Disabled by an Administrator
- Multiple Account Passwords changed by an Administrator
- Multiple Archive Files Http Post Traffic
- Multiple Authentication Failures
- Multiple Authentications
- Multiple Badge Accesses
- Multiple Box login errors
- Multiple Box logins
- Multiple Box operations
- Multiple Disabled Users Failing To Authenticate From Host Using Kerberos
- Multiple External Alarms
- Multiple Failed Badge Access Attempts
- Multiple Infections on Host
- Multiple Invalid Users Failing To Authenticate From Host Using Kerberos
- Multiple Invalid Users Failing To Authenticate From Host Using Ntlm
- Multiple Login Errors
- Multiple Logins
- Multiple Okta Users With Invalid Credentials From The Same IP
- Multiple Outgoing Connections
- Multiple Primary Functions Detected
- Multiple Users Attempting To Authenticate Using Explicit Credentials
- Multiple Users Failing To Authenticate From Host Using Kerberos
- Multiple Users Failing To Authenticate From Host Using Ntlm
- Multiple Users Failing To Authenticate From Process
- Multiple Users Remotely Failing To Authenticate From Host
- Multiple failed badge attempts and unusual badge access time
- Net Localgroup Discovery
- Net Profiler Uac Bypass
- Network Change Detected
- Network Connection Discovery With Arp
- Network Connection Discovery With Net
- Network Connection Discovery With Netstat
- Network Device Rebooted
- Network Protocol Violation
- New AD Domain Detected
- New Application Accessing Salesforce.com API
- New Cloud API Call Per Peer Group
- New Cloud Provider for User
- New Connection to In-Scope Device
- New Container Uploaded To AWS Ecr
- New Data Exfil DLP Alerts for User
- New High Risk Event Types for Salesforce.com User
- New IaaS API Call Per User
- New Interactive Logon from a Service Account
- New Local Admin Account
- New Logon Type for User
- New Parent Process for cmd.exe or regedit.exe
- New RunAs Host / Privileged Account Combination
- New Service Paths for Host
- New Suspicious Executable Launch for User
- New Suspicious cmd.exe / regedit.exe / powershell.exe Service Launch
- New Tables Queried by Salesforce.com Peer Group
- New Tables Queried by Salesforce.com User
- New User Account Created On Multiple Hosts
- New User Taking Privileged Actions
- Nishang Powershelltcponeline
- Nltest Domain Trust Discovery
- No Windows Updates In A Time Frame
- Non Chrome Process Accessing Chrome Default Dir
- Non Firefox Process Access Firefox Profile Dir
- Non-Privileged Users taking Privileged Actions
- Ntdsutil Export Ntds
- O365 Add App Role Assignment Grant User
- O365 Added Service Principal
- O365 Bypass MFA Via Trusted IP
- O365 Disable MFA
- O365 Excessive Authentication Failures Alert
- O365 Excessive Sso Logon Errors
- O365 New Federated Domain Added
- O365 Pst Export Alert
- O365 Suspicious Admin Email Forwarding
- O365 Suspicious Rights Delegation
- O365 Suspicious User Email Forwarding
- Office Application Drop Executable
- Office Application Spawn Regsvr32 Process
- Office Application Spawn Rundll32 Process
- Office Document Creating Schedule Task
- Office Document Executing Macro Code
- Office Document Spawned Child Process To Download
- Office Product Spawn Cmd Process
- Office Product Spawning Bitsadmin
- Office Product Spawning Certutil
- Office Product Spawning Mshta
- Office Product Spawning Rundll32 With No DLL
- Office Product Spawning Wmic
- Office Product Writing Cab Or Inf
- Office Spawning Control
- Okta Account Lockout Events
- Okta Failed Sso Attempts
- Okta User Logins From Multiple Cities
- Old Passwords in Use
- Outbreak Detected
- Outdated Malware Definitions
- Overwriting Accessibility Binaries
- Password Policy Discovery With Net
- Period with Unusual Windows Security Event Sequences
- Permission Modification Using Takeown App
- Personally Identifiable Information Detected
- Petitpotam Network Share Access Request
- Petitpotam Suspicious Kerberos Tgt Request
- Phishing Investigation and Response
- Plain Http Post Exfiltrated Data
- Possible Phishing Attempt
- Potential Day Trading
- Potential Flight Risk Exfiltration
- Potential Flight Risk Staging
- Potential Gap in Data
- Potential Phishing Attack
- Potential Webshell Activity
- Powershell 4104 Hunting
- Powershell Creating Thread Mutex
- Powershell Disable Security Monitoring
- Powershell Domain Enumeration
- Powershell Enable Smb1Protocol Feature
- Powershell Execute Com Object
- Powershell Fileless Process Injection Via Getprocaddress
- Powershell Fileless Script Contains Base64 Encoded Content
- Powershell Get Localgroup Discovery
- Powershell Get Localgroup Discovery With Script Block Logging
- Powershell Loading Dotnet Into Memory Via System Reflection Assembly
- Powershell Processing Stream Of Data
- Powershell Remote Thread To Known Windows Process
- Powershell Start-Bitstransfer
- Powershell Using Memory As Backing Store
- Prevent Automatic Repair Mode Using Bcdedit
- Print Spooler Adding A Printer Driver
- Print Spooler Failed To Load A Plug-In
- Privilege Escalation after Powershell Activity
- Process Creating Lnk File In Suspicious Location
- Process Deleting Its Process File Path
- Process Execution Via WMI
- Process Kill Base On File Path
- Processes Launching Netsh
- Processes Tapping Keyboard Events
- Processes with High Entropy Names
- Processes with Lookalike (typo) Filenames
- Prohibited Network Traffic Allowed
- Prohibited Port Activity Detected
- Prohibited Process Detected
- Prohibited Service Detected
- Prompt and Block Domain
- Protocol Or Port Mismatch
- Protocols Passing Authentication In Cleartext
- Public Cloud Storage (Bucket)
- Public facing Website Attack
- Pull List of Privileged Users
- RFC1918 IP Not in CMDB
- Ransomware Extensions
- Ransomware Investigate and Contain
- Ransomware Note Files
- Ransomware Notes Bulk Creation
- Ransomware Vulnerabilities
- Recon Avproduct Through Pwh Or WMI
- Recon Using WMI Class
- Recurring Infection on Host
- Recursive Delete Of Directory In Batch Cmd
- Reg Exe Manipulating Windows Services Registry Keys
- Registry Keys For Creating Shim Databases
- Registry Keys Used For Persistence
- Registry Keys Used For Privilege Escalation
- Remcos Rat File Creation In Remcos Folder
- Remote Account Takeover
- Remote Desktop Network Bruteforce
- Remote Desktop Network Traffic
- Remote Desktop Process Running On System
- Remote PowerShell Launches
- Remote Process Instantiation Via WMI
- Remote System Discovery With Adsisearcher
- Remote System Discovery With Dsquery
- Remote System Discovery With Net
- Remote System Discovery With Wmic
- Remote WMI Command Attempt
- Resize Shadowstorage Volume
- Revil Common Exec Parameter
- Revil Registry Entry
- Risky Events from Privileged Users
- Rundll Loading DLL By Ordinal
- Rundll32 Control Rundll Hunt
- Rundll32 Control Rundll World Writable Directory
- Rundll32 Create Remote Thread To A Process
- Rundll32 Createremotethread In Browser
- Rundll32 Dnsquery
- Rundll32 Process Creating Exe DLL Files
- Rundll32 With No Command Line Arguments With Network
- Ryuk Test Files Detected
- Ryuk Wake On Lan Command
- SFDC Suspicious volume of records accessed
- SMB Traffic Allowed
- SMB Traffic Spike
- SMB Traffic Spike - MLTK
- Sam Database File Access Attempt
- Same Error On Many Servers Detected
- Samsam Test File Write
- Sc Exe Manipulating Windows Services
- Scanning Activity
- Schcache Change By App Connect And Create Adsi Object
- Schedule Task With Http Command Arguments
- Schedule Task With Rundll32 Command Trigger
- Scheduled Task Deleted Or Created Via Cmd
- Schtasks Run Task On Demand
- Schtasks Scheduling Job On Remote System
- Schtasks Used For Forcing A Reboot
- Script Execution Via WMI
- Sdclt Uac Bypass
- Searchprotocolhost With No Command Line With Network
- Secretdumps Offline Ntds Dumping Tool
- Sensitive Kubernetes Mount Pod Detected
- Service Account Login
- Services Escalate Exe
- Set Default Powershell Execution Policy To Unrestricted Or Bypass
- Shim Database File Creation
- Shim Database Installation With Suspicious Parameters
- Short Lived Admin Accounts
- Short Lived Windows Accounts
- Short-lived Account Detected
- Significant Increase in Interactive Logons
- Significant Increase in Interactively Logged On Users
- Silentcleanup Uac Bypass
- Single Letter Process On Endpoint
- Slui Runas Elevated
- Slui Spawning A Process
- Sources Sending Many DNS Requests
- Sources Sending a High Volume of DNS Traffic
- Spike In File Writes
- Spike in Downloaded Documents Per User from Salesforce.com
- Spike in Exported Records from Salesforce.com
- Spike in Password Reset Emails
- Spike in SMB Traffic
- Spoolsv Spawning Rundll32
- Spoolsv Suspicious Loaded Modules
- Spoolsv Suspicious Process Access
- Spoolsv Writing A DLL
- Spoolsv Writing A DLL - Sysmon
- Sql Injection With Long Urls
- Sqlite Module In Temp Folder
- Stale Account Usage
- Start Up During Safe Mode Boot
- Substantial Increase In Events
- Substantial Increase In Port Activity
- Successful Login of Account for Former Employee
- Sunburst Correlation DLL And Network Event
- Supernova Webshell
- Suspicious Account Activity
- Suspicious Account Lockout
- Suspicious Activity After Intrusion
- Suspicious Badge Activity
- Suspicious Behavior
- Suspicious Box Usage
- Suspicious Container Image Name
- Suspicious Curl Network Connection
- Suspicious Data Collection
- Suspicious Data Movement
- Suspicious Dllhost No Command Line Arguments
- Suspicious Domain Communication
- Suspicious Domain Communication followed by Malware Activity
- Suspicious Domain Name
- Suspicious Driver Loaded Path
- Suspicious Email - UBA Anomaly
- Suspicious Email Attachment Extensions
- Suspicious Event Log Service Behavior
- Suspicious External Alarm Activity
- Suspicious Gpupdate No Command Line Arguments
- Suspicious HTTP Redirects
- Suspicious HTTP Redirects followed by Suspected Infection
- Suspicious IP Address Communication
- Suspicious Icedid Regsvr32 Cmdline
- Suspicious Icedid Rundll32 Cmdline
- Suspicious Image Creation In Appdata Folder
- Suspicious Java Classes
- Suspicious Microsoft Workflow Compiler Rename
- Suspicious Microsoft Workflow Compiler Usage
- Suspicious Msbuild Path
- Suspicious Msbuild Rename
- Suspicious Msbuild Spawn
- Suspicious Mshta Child Process
- Suspicious Mshta Spawn
- Suspicious Network Connection
- Suspicious Network Exploration
- Suspicious New Access
- Suspicious Plistbuddy Usage
- Suspicious Plistbuddy Usage Via Osquery
- Suspicious Powershell Activity
- Suspicious Privilege Escalation
- Suspicious Process File Path
- Suspicious Reg Exe Process
- Suspicious Regsvr32 Register Suspicious Path
- Suspicious Rundll32 Dllregisterserver
- Suspicious Rundll32 No Command Line Arguments
- Suspicious Rundll32 Plugininit
- Suspicious Rundll32 Rename
- Suspicious Rundll32 Startw
- Suspicious Scheduled Task From Public Directory
- Suspicious Searchprotocolhost No Command Line Arguments
- Suspicious Sqlite3 Lsquarantine Behavior
- Suspicious URL Communications and Redirects
- Suspicious Wav File In Appdata Folder
- Suspicious Wevtutil Usage
- Suspicious Writes To Windows Recycle Bin
- System Information Discovery Detection
- System Processes Run From Unexpected Locations
- System User Discovery With Query
- System User Discovery With Whoami
- Threat Activity Detected
- Threat Hunting
- Tor Traffic
- Trickbot Named Pipe
- USB storage attached an unusually high number of times
- Uac Bypass Mmc Load Unsigned DLL
- Uac Bypass With Colorui Com Object
- Unauthorized Connection Through Firewall
- Unified Messaging Service Spawning A Process
- Uninstall App Using Msiexec
- Unload Sysmon Filter Driver
- Unloading Amsi Via Reflection
- Unrouteable Activity Detected
- Untriaged Notable Events
- Unusual Activity Time
- Unusual Badge Reader Access
- Unusual Child Process for spoolsv.exe or connhost.exe
- Unusual Cloud Regions
- Unusual Cloud Storage Deletions
- Unusual Cloud Storage Downloads
- Unusual External Alarm
- Unusual File Extension
- Unusual Geolocation of Communication Destination
- Unusual Machine Access
- Unusual Network Activity
- Unusual Number of Modifications to Cloud ACLs
- Unusual Printer Usage
- Unusual Time of Badge Access
- Unusual USB Activity
- Unusual USB Device Plugged In
- Unusual VPN Login Geolocation
- Unusual Volume of Network Activity
- Unusual Web Browser
- Unusual Windows Security Event (Unusual - Event Code, Process, Directory, LoginType, ReturnCode, Domain)
- Unusually Long Command Line
- Unusually Long Command Line - MLTK
- Unusually Long Content-Type Length
- Unusually Long VPN Session
- User Discovery With Env Vars Powershell
- User Discovery With Env Vars Powershell Script Block
- User Finding Project Code Names from Many Departments
- User Has Access to In-Scope Splunk Indexes They Should Not
- User Logged into In-Scope System They Should Not Have
- User Login to Unauthorized Geo
- User Login with Local Credentials
- User with Increase in Outgoing Email
- User with Many DLP Events
- Usn Journal Deletion
- Vulnerability Scanner Detected (by events)
- Vulnerability Scanner Detected (by targets)
- W3Wp Spawning Shell
- WMI Permanent Event Subscription
- WMI Permanent Event Subscription - Sysmon
- WMI Recon Running Process Or Services
- WMI Temporary Event Subscription
- Watchlisted Event Observed
- Watering Hole Infection
- Wbadmin Delete System Backups
- Wbemprox Com Object Execution
- Web Browsing to Unauthorized Sites
- Web Servers Executing Suspicious Processes
- Web Site Compromised (Webshell)
- Web Uploads to Non-corporate Sites by Users
- Wermgr Process Connecting To IP Check Web Services
- Wermgr Process Create Executable File
- Wermgr Process Spawned Cmd Or Powershell Process
- Windows Adfind Exe
- Windows Disableantispyware Registry
- Windows Event Log Cleared
- Windows Event Log Clearing Events
- Windows Security Account Manager Stopped
- Winevent Scheduled Task Created To Spawn Shell
- Winevent Scheduled Task Created Within Public Path
- Winrm Spawning A Process
- Winword Spawning Cmd
- Winword Spawning Powershell
- Winword Spawning Windows Script Host
- Wmic Group Discovery
- Write Executable In SMB Share
- Wsreset Uac Bypass
- Xmrig Driver Loaded
- Xsl Script Execution With Wmic
Technical Detail
Developing on SSE
Installation Documentation Suspicious Plistbuddy Usage Via Osquery Suspicious Plistbuddy Usage Via Osquery Description The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow, the following commands were executed:\
- PlistBuddy -c "Add :Label string initverx" ~/Library/Launchagents/init verx.plist \
- PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/initverx.plist \
- PlistBuddy -c "Add :StartInterval integer 3600" ~/Library/Launchagents/init verx.plist \
- PlistBuddy -c "Add :ProgramArguments array" ~/Library/Launchagents/initverx.plist \
- PlistBuddy -c "Add :ProgramArguments:0 string /bin/sh" ~/Library/Launchagents/init verx.plist \
- PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \
Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further.
Suspicious Plistbuddy Usage Via Osquery Help
OSQuery must be installed and configured to pick up process events (info at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402. Modify the macro and validate fields are correct.
`osquery_process` "columns.cmdline" ="*LaunchAgents*" OR "columns.cmdline" ="*RunAtLoad*" OR "columns.cmdline" ="*true*" | `suspicious_plistbuddy_usage_via_osquery_filter` Open in Search