Sigma rule references as PDF

file_access_win_browsers_chromium_sensitive_files

Title : Access To Chromium Browsers Sensitive Files By Uncommon Applications

Rule id : c5f37810-a85f-4186-81e9-33f23abb4141

Url	Pdf

file_access_win_browsers_credential

Title : Access To Browser Credential Files By Uncommon Applications

Rule id : 91cb43db-302a-47e3-b3c8-7ede481e27bf

Url	Pdf
https://www.zscaler.com/blogs/security-research/ffdroider-stealer-targeting-social-media-platform-users	pdf/848e0043bdde9d76152a8926ed86e0ff82b511e4447f2b6f2989bff329df0b32.pdf
https://github.com/lclevy/firepwd	pdf/562d28d6456568df66a3d150b874361842d81bfeea96f515facc1d83a8d13433.pdf

file_access_win_office_outlook_mail_credential

Title : Access To Windows Outlook Mail Files By Uncommon Applications

Rule id : fc3e237f-2fef-406c-b90d-b3ae7e02fa8f

Url	Pdf
https://darkdefender.medium.com/windows-10-mail-app-forensics-39025f5418d2	pdf/e0767895e12b8ed3871cfe806be8fe1538911c3fb3573949a485eb1ec493fa37.pdf
https://github.com/redcanaryco/atomic-red-team/blob/58496ee3306e6e42a7054d36a94e6eb561ee3081/atomics/T1070.008/T1070.008.md#atomic-test-4---copy-and-modify-mailbox-data-on-windows	pdf/aacab2bf57e39a3408e68eb411568724e37142de5830db3ba571e1b1a874a09c.pdf

file_access_win_susp_credential_manager_access

Title : Credential Manager Access By Uncommon Applications

Rule id : 407aecb1-e762-4acf-8c7b-d087bcff3bb6

Url	Pdf
https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz	pdf/89ac568d585da12dd16ca28d67dcfd82b38d23eeb4bbf17492f10b5562d68dee.pdf
https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/	pdf/d101d42ca0b29f41fce15fa6962e50184794871c56412ff4d047bca8fc83cf8c.pdf

file_access_win_susp_credhist

Title : Access To Windows Credential History File By Uncommon Applications

Rule id : 7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2

Url	Pdf
https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist	pdf/be239a30b1c6e305cc3246ce277d4339b44c0ebe5ee972c5268b24fe57c8e352.pdf
https://www.passcape.com/windows_password_recovery_dpapi_credhist	pdf/ba347f1fdce3d61295fc55afa05aaf695e694b79102fff9a0946b2cab562583f.pdf

file_access_win_susp_crypto_currency_wallets

Title : Access To Crypto Currency Wallets By Uncommon Applications

Rule id : f41b0311-44f9-44f0-816d-dd45e39d4bc8

Url	Pdf

file_access_win_susp_dpapi_master_key_access

Title : Access To Windows DPAPI Master Keys By Uncommon Applications

Rule id : 46612ae6-86be-4802-bc07-39b59feb1309

Url	Pdf
http://blog.harmj0y.net/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/	pdf/e69257303943b4a3d7dccbb7e37efea3af44835137e4063758ac0f92bd7e0ae4.pdf
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords	pdf/1d35f474a6a3fb984f679aae8a36e8a6ad1e71b07b0ee3a7890a38c2f010e468.pdf

file_access_win_susp_gpo_access_uncommon_process

Title : Access To Sysvol Policies Share By Uncommon Process

Rule id : 8344c19f-a023-45ff-ad63-a01c5396aea0

Url	Pdf
https://github.com/vletoux/pingcastle	pdf/07f58edf3b3f99eb1be2d6008ce4ea1b9950671a87f06c9d04cd39fea03c2a80.pdf

file_access_win_susp_gpo_files

Title : Access To Potentially Sensitive Sysvol Files By Uncommon Applications

Rule id : d51694fe-484a-46ac-92d6-969e76d60d10

Url	Pdf
https://github.com/vletoux/pingcastle	pdf/07f58edf3b3f99eb1be2d6008ce4ea1b9950671a87f06c9d04cd39fea03c2a80.pdf

file_access_win_susp_reg_and_hive

Title : Access To .Reg/.Hive Files By Uncommon Applications

Rule id : 337a31c6-46c4-46be-886a-260d7aa78cac

Url	Pdf
https://github.com/tccontre/Reg-Restore-Persistence-Mole	pdf/0971a077a83b9756335c592532101ff05083fa81d6be4d96ba3202747ac692c4.pdf

file_access_win_susp_unattend_xml

Title : Unattend.XML File Access Attempt

Rule id : 76a26006-0942-430b-8249-bd51d448f8e5

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md	pdf/ff65506377546c9577ed85eb800594ab5a3c5d4b0bc690310875e0a56a8795b9.pdf

file_access_win_teams_sensitive_files

Title : Microsoft Teams Sensitive File Access By Uncommon Applications

Rule id : 65744385-8541-44a6-8630-ffc824d7d4cc

Url	Pdf
https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/	pdf/ce261a048b35126e37c51480086b73cad305c9bdb92137249e8fbe03bdecea37.pdf
https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens	pdf/fa0093c22c39cb46d431317fdf580f8b4fb18c362a298b9ff2fa682437f4eb4c.pdf

file_change_win_2022_timestomping

Title : File Creation Date Changed to Another Year

Rule id : 558eebe5-f2ba-4104-b339-36f7902bcc1a

Url	Pdf
https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html	pdf/a4ae2565fb7c169a136f004beee98a312636102e637ec201c2a5bba590b3627b.pdf

file_change_win_unusual_modification_by_dns_exe

Title : Unusual File Modification by dns.exe

Rule id : 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3

Url	Pdf
https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html	pdf/c321effd3d12ede1cd28e4d41a8622a63364af11360a5a7002bf7d7fb8d9443c.pdf

file_delete_win_cve_2021_1675_print_nightmare

Title : Potential PrintNightmare Exploitation Attempt

Rule id : 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf

Url	Pdf
https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/	pdf/838a643a0de1367882e6b2356215a35911a7ff98a2538a5ad6be475e77a69f46.pdf
https://github.com/cube0x0/CVE-2021-1675	pdf/8aa5de6e1fd7a9236b2e94ee2830c82ef335b679e5a926f11fb64e7156c356c2.pdf

file_delete_win_delete_backup_file

Title : Backup Files Deleted

Rule id : 06125661-3814-4e03-bfa2-1e4411c60ac3

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files	pdf/e75b1325b32139f08e8d052ecde3fea1bf2400a1043893d895f92c45931d9f5e.pdf

file_delete_win_delete_event_log_files

Title : EventLog EVTX File Deleted

Rule id : 63c779ba-f638-40a0-a593-ddd45e8b1ddc

Url	Pdf

file_delete_win_delete_exchange_powershell_logs

Title : Exchange PowerShell Cmdlet History Deleted

Rule id : a55349d8-9588-4c5a-8e3b-1925fe2a4ffe

Url	Pdf
https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/	pdf/590410e47cb1aaf28145535d3c3a8e1ee48e946daf2b6849ba223ff7a71aefc1.pdf

file_delete_win_delete_iis_access_logs

Title : IIS WebServer Access Logs Deleted

Rule id : 3eb8c339-a765-48cc-a150-4364c04652bf

Url	Pdf
https://www.elastic.co/guide/en/security/current/webserver-access-logs-deleted.html	pdf/e797f1e60f7e9c0b5b71f02aeeb952fd1cb8650731448e3d7333ec86b4126825.pdf

file_delete_win_delete_own_image

Title : Process Deletion of Its Own Executable

Rule id : f01d1f70-cd41-42ec-9c0b-26dd9c22bf29

Url	Pdf
https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion	pdf/84a14949cf6001d9b2651e6448d0d56ea4fc6f053e1b5bad1f53f32506a3963d.pdf

file_delete_win_delete_powershell_command_history

Title : PowerShell Console History Logs Deleted

Rule id : ff301988-c231-4bd0-834c-ac9d73b86586

Url	Pdf

file_delete_win_delete_prefetch

Title : Prefetch File Deleted

Rule id : 0a1f9d29-6465-4776-b091-7f43b26e4c89

Url	Pdf
https://www.group-ib.com/blog/hunting-for-ttps-with-prefetch-files/	pdf/d104e01312f8def72d1753af481457705160f2e0c44e85f5267c41d422c3b245.pdf

file_delete_win_delete_teamviewer_logs

Title : TeamViewer Log File Deleted

Rule id : b1decb61-ed83-4339-8e95-53ea51901720

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md	pdf/4ffa5749b03b648287f0777ba2dc5979fd5556e7ac8429ada3645d38282b8e09.pdf

file_delete_win_delete_tomcat_logs

Title : Tomcat WebServer Logs Deleted

Rule id : 270185ff-5f50-4d6d-a27f-24c3b8c9fef8

Url	Pdf
https://linuxhint.com/view-tomcat-logs-windows/	pdf/8f6167d923e90c5fe848ccd145e10ab842d5e578710b267f3ad9ccd8490e5f2f.pdf

file_delete_win_sysinternals_sdelete_file_deletion

Title : File Deleted Via Sysinternals SDelete

Rule id : 6ddab845-b1b8-49c2-bbf7-1a11967f64bc

Url	Pdf
OTRF/detection-hackathon-apt29#9	pdf/d051f0ffc50ddfb314badf907575399c312f79765853cb4d5c1c1839423c528f.pdf
https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.md	pdf/4bdf8e8c9fe7ce67a2e6e1dc81ca82384ab6355942d78f238ca49484a99c62e2.pdf

file_delete_win_unusual_deletion_by_dns_exe

Title : Unusual File Deletion by Dns.exe

Rule id : 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0

Url	Pdf
https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html	pdf/c321effd3d12ede1cd28e4d41a8622a63364af11360a5a7002bf7d7fb8d9443c.pdf

file_delete_win_zone_identifier_ads

Title : ADS Zone.Identifier Deleted

Rule id : 7eac0a16-5832-4e81-865f-0268a6d19e4b

Url	Pdf
https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/	pdf/5c59b23b3e9dd12497c219ddd92785098caf845185a9069bafdddebf92ddf7f9.pdf

file_delete_win_zone_identifier_ads_uncommon

Title : ADS Zone.Identifier Deleted By Uncommon Application

Rule id : 3109530e-ab47-4cc6-a953-cac5ebcc93ae

Url	Pdf
https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/	pdf/5c59b23b3e9dd12497c219ddd92785098caf845185a9069bafdddebf92ddf7f9.pdf

file_event_lnx_apt_unc4841_exfil_mail_pattern

Title : UNC4841 - Email Exfiltration File Pattern

Rule id : 0785f462-60b0-4031-9ff4-b4f3a0ba589a

Url	Pdf
https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally	pdf/8d54089d8a14d4fb5c7cbd501bdd4c6c5737ab923ec110e44d3e59f9b58986b5.pdf

file_event_lnx_apt_unc4841_file_indicators

Title : UNC4841 - Barracuda ESG Exploitation Indicators

Rule id : 5627c337-a9b2-407a-a82d-5fd97035ff39

Url	Pdf
https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally	pdf/8d54089d8a14d4fb5c7cbd501bdd4c6c5737ab923ec110e44d3e59f9b58986b5.pdf

file_event_lnx_doas_conf_creation

Title : Linux Doas Conf File Creation

Rule id : 00eee2a5-fdb0-4746-a21d-e43fbdea5681

Url	Pdf
https://research.splunk.com/endpoint/linux_doas_conf_file_creation/	pdf/ea330da6bcc716a0cc4f4a14cdbf4fdb2ed5db3ba2e567e011f0be619f1bdc09.pdf
https://www.makeuseof.com/how-to-install-and-use-doas/	pdf/bb0ca58b905a506c12bd67bc3d5cafbe4e7d40e2b1e41e57f94723828bf749c2.pdf

file_event_lnx_persistence_cron_files

Title : Persistence Via Cron Files

Rule id : 6c4e2f43-d94d-4ead-b64d-97e53fa2bd05

Url	Pdf
https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c1455283069c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml	pdf/2995f030b87973ae4e9fa220cc794dbd3a20fdfcfd865e50d33f587b394234dc.pdf

file_event_lnx_persistence_sudoers_files

Title : Persistence Via Sudoers Files

Rule id : ddb26b76-4447-4807-871f-1b035b2bfa5d

Url	Pdf
https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh	pdf/c52ab80b8482636c8d5824eedd164438dd188eff2f790d6f821fca8c2880dba4.pdf

file_event_lnx_python_path_configuration_files

Title : Python Path Configuration File Creation - Linux

Rule id : fb96c26c-9f85-4ae7-af0d-ed1ed1f1f5ce

Url	Pdf
https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/	pdf/ce33fdd13427ba1ea55d0179a11d85e2b8ebef16449d715293fa449ce4532c6c.pdf
https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac	pdf/675ca7af85aaed587f7de610757ef25c816b7150c507958ef17e2c25d321aa34.pdf
https://docs.python.org/3/library/site.html	pdf/dda87b67131b9ff2f8de4ae83b7da756880aa93ff319eb9f6fe231b19dbfdb73.pdf

file_event_lnx_susp_shell_script_under_profile_directory

Title : Potentially Suspicious Shell Script Creation in Profile Folder

Rule id : 13f08f54-e705-4498-91fd-cce9d9cee9f1

Url	Pdf
https://blogs.jpcert.or.jp/en/2023/05/gobrat.html	pdf/d700466da28ac01752dc02792e54606ce8d8cd2da35c1f1838a86cd788c7ccc8.pdf
https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/	pdf/8e84339211d4382adceb5f529766b7a0feb270c9d5f46c10cb9c51f224cff76f.pdf
https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection	pdf/d49cdd872762c5d76638070d2cd49cc8aafb309f4fe2f2ddd698ddae145dd862.pdf
https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection	pdf/96097781decc9867742e6611a6f05d220c5fd9536f5202753692fac2c6f5f52e.pdf

file_event_lnx_triple_cross_rootkit_lock_file

Title : Triple Cross eBPF Rootkit Default LockFile

Rule id : c0239255-822c-4630-b7f1-35362bcb8f44

Url	Pdf
https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L33	pdf/a8313aa6cf90eb426067d1bc971374f244afbc04b4de4ac38ca0abfc2978a75c.pdf

file_event_lnx_triple_cross_rootkit_persistence

Title : Triple Cross eBPF Rootkit Default Persistence

Rule id : 1a2ea919-d11d-4d1e-8535-06cda13be20f

Url	Pdf
https://github.com/h3xduck/TripleCross/blob/12629558b8b0a27a5488a0b98f1ea7042e76f8ab/apps/deployer.sh	pdf/d49b145979b007a628e1ef443dc18c81df6b9cc88671742e9466baed293dd57d.pdf

file_event_lnx_wget_download_file_in_tmp_dir

Title : Wget Creating Files in Tmp Directory

Rule id : 35a05c60-9012-49b6-a11f-6bab741c9f74

Url	Pdf
https://blogs.jpcert.or.jp/en/2023/05/gobrat.html	pdf/d700466da28ac01752dc02792e54606ce8d8cd2da35c1f1838a86cd788c7ccc8.pdf
https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/	pdf/8e84339211d4382adceb5f529766b7a0feb270c9d5f46c10cb9c51f224cff76f.pdf
https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection	pdf/d49cdd872762c5d76638070d2cd49cc8aafb309f4fe2f2ddd698ddae145dd862.pdf
https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection	pdf/96097781decc9867742e6611a6f05d220c5fd9536f5202753692fac2c6f5f52e.pdf

file_event_macos_emond_launch_daemon

Title : MacOS Emond Launch Daemon

Rule id : 23c43900-e732-45a4-8354-63e4a6c187ce

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.014/T1546.014.md	pdf/2b82a7f9a81abfde211ad4289c2d14e24b9f5a5cbff74725643603c9aa57478f.pdf
https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124	pdf/b24b2c6811660b21b186a66b5053621571a1c82117db964a4ae1ce9848974b40.pdf

file_event_macos_python_path_configuration_files

Title : Python Path Configuration File Creation - MacOS

Rule id : 4f394635-13ef-4599-b677-3353e0f84f55

Url	Pdf
https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/	pdf/ce33fdd13427ba1ea55d0179a11d85e2b8ebef16449d715293fa449ce4532c6c.pdf
https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac	pdf/675ca7af85aaed587f7de610757ef25c816b7150c507958ef17e2c25d321aa34.pdf
https://docs.python.org/3/library/site.html	pdf/dda87b67131b9ff2f8de4ae83b7da756880aa93ff319eb9f6fe231b19dbfdb73.pdf

file_event_macos_susp_startup_item_created

Title : Startup Item File Created - MacOS

Rule id : dfe8b941-4e54-4242-b674-6b613d521962

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md	pdf/213edc75474fd89bf3227bae4f76f9ade5b1979e54412e3be17a07f4782f6262.pdf
https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html	pdf/bc9d55aa211b1f9b2c368d4c72d1d41870c5de565b21be1bac2e7fcf62d3e37e.pdf

file_event_paloalto_globalprotect_exploit_cve_2024_3400_command_inject_file_creation

Title : Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation

Rule id : bcd95697-e3e7-4c6f-8584-8e3503e6929f

Url	Pdf
https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/	pdf/074e13fff4145d4908ec4e1776aaaef94f6e818277f617b48a658fb0ab173960.pdf
https://nvd.nist.gov/vuln/detail/CVE-2024-3400	pdf/006701c675f15a9255a500ada9d8283abb2b0bdc2564e30f5191f0dc459048af.pdf

file_event_win_adsi_cache_creation_by_uncommon_tool

Title : ADSI-Cache File Creation By Uncommon Tool

Rule id : 75bf09fa-1dd7-4d18-9af9-dd9e492562eb

Url	Pdf
https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961	pdf/81508c440dff4d370474efd4fc5aa483ac35755d9a429dd54a0777dc325eae1c.pdf
https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/	pdf/2bc7cd063037ca29abb64963ded4b81587b248693ab0829acea8be21dd138d36.pdf
https://github.com/fox-it/LDAPFragger	pdf/8267e17926f2677c3b75105c292f9769bb1515a9a9288c03410832145dd270bc.pdf

file_event_win_advanced_ip_scanner

Title : Advanced IP Scanner - File Event

Rule id : fed85bf9-e075-4280-9159-fbe8a023d6fa

Url	Pdf
https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/	pdf/8c097889a8c7ef366789e4bb54e4162ac99a549a0c8f8981a70349f7fe38b14a.pdf
https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html	pdf/c82f8f2cd34c592707868ac4a313ec884fce6c515fd93a953126b96359db7961.pdf
https://labs.f-secure.com/blog/prelude-to-ransomware-systembc	pdf/d61abd503473ab46398cf0112127b9cd84f97725f0b7d0dbb5efeb3385db28ed.pdf
https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer	pdf/473edbd4acb15cebb3c5f439dbaa4478e356ad6f476e4bb69447bada353b6427.pdf

file_event_win_anydesk_artefact

Title : Anydesk Temporary Artefact

Rule id : 0b9ad457-2554-44c1-82c2-d56a99c42377

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows	pdf/c974f4ee24da1d43205e7e0d03f309ffddf6579eec8899597d1534323ca83515.pdf

file_event_win_anydesk_writing_susp_binaries

Title : Suspicious Binary Writes Via AnyDesk

Rule id : 2d367498-5112-4ae5-a06a-96e7bc33a211

Url	Pdf
https://redcanary.com/blog/misbehaving-rats/	pdf/bce413b780067c758ce583c9a290eec4ec40f7c2be878de4d59e49b359dfc164.pdf

file_event_win_apt_cozy_bear_phishing_campaign_indicators

Title : APT29 2018 Phishing Campaign File Indicators

Rule id : 3a3f81ca-652c-482b-adeb-b1c804727f74

Url	Pdf
https://twitter.com/DrunkBinary/status/1063075530180886529	pdf/7ed4adf19c5aaf99ef21790519b7d65d416bdf3e3e18af21f72aaa99d4af68cf.pdf
https://www.mandiant.com/resources/blog/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign	pdf/320570b9d98e39614e60a1de57ca32a26a9d8b3bb1d6044d2e60ded27f13c8d5.pdf

file_event_win_apt_diamond_sleet_indicators

Title : Diamond Sleet APT File Creation Indicators

Rule id : e1212b32-55ff-4dfb-a595-62b572248056

Url	Pdf
https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/	pdf/a9e72b2851441ee8f752f82e60cdc3fdd923b1daffb9099cd1db1fda0d3bb908.pdf

file_event_win_apt_fin7_powershell_scripts_naming_convention

Title : Potential APT FIN7 Related PowerShell Script Created

Rule id : a88d9f45-ec8a-4b0e-85ee-c9f6a65e9128

Url	Pdf
https://labs.withsecure.com/publications/fin7-target-veeam-servers	pdf/bcf09078cb6247a3ea928d485651fa6eb873bd5ff379fe4aa907c61f6f3096aa.pdf

file_event_win_apt_forest_blizzard_activity

Title : Forest Blizzard APT - File Creation Activity

Rule id : b92d1d19-f5c9-4ed6-bbd5-7476709dc389

Url	Pdf
https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/	pdf/1f483cd0bed32ce5e22ec6a8cb8bfbf5e45b965839b275a8d709e6faa06e752c.pdf

file_event_win_apt_forest_blizzard_constrained_js

Title : Forest Blizzard APT - JavaScript Constrained File Creation

Rule id : ec7c4e9b-9bc9-47c7-a32f-b53b598da642

Url	Pdf
https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/	pdf/1f483cd0bed32ce5e22ec6a8cb8bfbf5e45b965839b275a8d709e6faa06e752c.pdf

file_event_win_apt_lace_tempest_indicators

Title : Lace Tempest File Indicators

Rule id : e94486ea-2650-4548-bf25-88cbd0bb32d7

Url	Pdf
https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification	pdf/2686c4b92c4166bd9d0af2e977485a734a145b4a254e438474766688aeb1eb00.pdf

file_event_win_apt_onyx_sleet_indicators

Title : Onyx Sleet APT File Creation Indicators

Rule id : 2fef4fd9-7206-40d1-b4f5-ad6441d0cd9b

Url	Pdf
https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/	pdf/a9e72b2851441ee8f752f82e60cdc3fdd923b1daffb9099cd1db1fda0d3bb908.pdf

file_event_win_apt_unknown_exploitation_indicators

Title : ScreenConnect - SlashAndGrab Exploitation Indicators

Rule id : 05164d17-8e11-4d7d-973e-9e4962436b87

Url	Pdf
https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708	pdf/db10fe51c56a21d1a65679761189968503094fc31c28113aaa26bd6b44436bc2.pdf

file_event_win_aspnet_temp_files

Title : Assembly DLL Creation Via AspNetCompiler

Rule id : 4c7f49ee-2638-43bb-b85b-ce676c30b260

Url	Pdf

file_event_win_bloodhound_collection

Title : BloodHound Collection Files

Rule id : 02773bed-83bf-469f-b7ff-e676e7d78bab

Url	Pdf
https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection	pdf/4c02b65fb5d63a4320bbc961d6c17bee2bb48540bb5765394771305c414cbfb4.pdf

file_event_win_create_evtx_non_common_locations

Title : EVTX Created In Uncommon Location

Rule id : 65236ec7-ace0-4f0c-82fd-737b04fd4dcb

Url	Pdf
https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key	pdf/ff925c3afeeb4892dc84ea766b7c4cfc72d57349a76bbd7088cceb33c39308c4.pdf

file_event_win_create_non_existent_dlls

Title : Creation Of Non-Existent System DLL

Rule id : df6ecb8b-7822-4f4b-b412-08f524b4576c

Url	Pdf
https://decoded.avast.io/martinchlumecky/png-steganography/	pdf/0eca9b786ba1979b075adeb7f9557e8b91da314dc9e07fe4ecc249906e2a4ab4.pdf
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992	pdf/028aed9f1b76d9c255d6bdb5eb04047582a2929cae3a1b907c0ddb81f24214e6.pdf
https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/	pdf/86db2068d2c1ba0a473ed64434b06e96b0169d1abd9c58dacb50172b6d09b83b.pdf
https://github.com/Wh04m1001/SysmonEoP	pdf/9b62ea7dfb5f2da61e756244a0d4936db89fa1e3c35799a215d5898260d63f4a.pdf
https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/	pdf/fcbd01621f2009b8e49a4135d1cf8b61296fc74e4dae523083e64ca389cfc379.pdf
https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc	pdf/d20ee5f2ffb1166f62978435b64fc5d5971af1a39c723e36b54cd3ac720e8eaa.pdf

file_event_win_creation_new_shim_database

Title : New Custom Shim Database Created

Rule id : ee63c85c-6d51-4d12-ad09-04e25877a947

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-2---new-shim-database-files-created-in-the-default-shim-database-directory	pdf/a8815062e52ca471f9f5ba000671dbd8f1c00bb345ac575b3d6b60a05a875714.pdf
https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence	pdf/8ca075f78b1a87a255892700ed734ee7c6fda239a22b0a07bfaa7a7b9349cd04.pdf
https://liberty-shell.com/sec/2020/02/25/shim-persistence/	pdf/9afb25c4fd97ec000f8bd0e9e113fa6c4ac14a40d0bf8fbe92193effbd50c501.pdf
https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/	pdf/c57247ffee471a3ce772493eb214443004c7df49cd3dd10311541d6fd4082308.pdf

file_event_win_creation_scr_binary_file

Title : Suspicious Screensaver Binary File Creation

Rule id : 97aa2e88-555c-450d-85a6-229bcd87efb8

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md	pdf/421e7c9258d4b7fd5c84331f976867e45cd20dca8747c7134541fb2feafefee3.pdf

file_event_win_creation_system_dll_files

Title : Files With System DLL Name In Unsuspected Locations

Rule id : 13c02350-4177-4e45-ac17-cf7ca628ff5e

Url	Pdf

file_event_win_creation_system_file

Title : Files With System Process Name In Unsuspected Locations

Rule id : d5866ddf-ce8f-4aea-b28e-d96485a20d3d

Url	Pdf

file_event_win_creation_unquoted_service_path

Title : Creation Exe for Service with Unquoted Path

Rule id : 8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.009/T1574.009.md	pdf/89f14a34c740d9699826ccd9439e252d6098690d2733d1869a8f23169c442825.pdf

file_event_win_cred_dump_tools_dropped_files

Title : Cred Dump Tools Dropped Files

Rule id : 8fbf3271-1ef6-4e94-8210-03c2317947f6

Url	Pdf
https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment	pdf/52e26c81a11e8750dcb450054f7519ab7fa64b2a0e94d3c66075f12ea424e9d0.pdf

file_event_win_cscript_wscript_dropper

Title : WScript or CScript Dropper - File

Rule id : 002bdb95-0cf1-46a6-9e08-d38c128a6127

Url	Pdf

file_event_win_csexec_service

Title : CSExec Service File Creation

Rule id : f0e2b768-5220-47dd-b891-d57b96fc0ec1

Url	Pdf
https://github.com/malcomvetter/CSExec	pdf/594bb84da93ca89f381037918ee9911b09388de75cbb80c7e2296250f0634dc6.pdf

file_event_win_csharp_compile_artefact

Title : Dynamic CSharp Compile Artefact

Rule id : e4a74e34-ecde-4aab-b2fb-9112dd01aed0

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.004/T1027.004.md#atomic-test-2---dynamic-c-compile	pdf/93de57d0202381b92f379c85cdd0372bafde908ad6f94c4dd3327ce1a60e4b65.pdf

file_event_win_cve_2021_1675_printspooler

Title : CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Rule id : 2131cfb3-8c12-45e8-8fa0-31f5924e9f07

Url	Pdf
https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/	pdf/838a643a0de1367882e6b2356215a35911a7ff98a2538a5ad6be475e77a69f46.pdf
https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare	pdf/2e14b0b876e0b3664d6da5e5475214dbcebd06a06e9323cb7a6f14f96469ccf2.pdf
https://github.com/cube0x0/CVE-2021-1675	pdf/8aa5de6e1fd7a9236b2e94ee2830c82ef335b679e5a926f11fb64e7156c356c2.pdf

file_event_win_cve_2021_26858_msexchange

Title : CVE-2021-26858 Exchange Exploitation

Rule id : b06335b3-55ac-4b41-937e-16b7f5d57dfd

Url	Pdf
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/	pdf/e389ec84e6194a795049c83849c056aed872ecedd4e19c9624d6092c9fa68421.pdf

file_event_win_cve_2021_31979_cve_2021_33771_exploits

Title : CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum

Rule id : ad7085ac-92e4-4b76-8ce2-276d2c0e68ef

Url	Pdf
https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/	pdf/726f4d5325e8166ba2dd79e5297fc8860e36022fb505080c71738d639623b133.pdf
https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/	pdf/35aadf892a73fcf5b71cb08f7678a43c1779005a8c35e0c96a06b0cd81464302.pdf

file_event_win_cve_2021_41379_msi_lpe

Title : InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Rule id : 3be82d5d-09fe-4d6a-a275-0d40d234d324

Url	Pdf
https://web.archive.org/web/20220421061949/https://github.com/klinix5/InstallerFileTakeOver	pdf/08dac31e0927ce61ca3430b913faff5376f40ce774920160c9fea8f689fdae3a.pdf
https://www.zerodayinitiative.com/advisories/ZDI-21-1308/	pdf/375273570982b29be00d7557d654105b52774274e0ef25a15b8d91638a58f32f.pdf

file_event_win_cve_2021_44077_poc_default_files

Title : CVE-2021-44077 POC Default Dropped File

Rule id : 7b501acf-fa98-4272-aa39-194f82edc8a3

Url	Pdf
https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/	pdf/2162de50e6078700ff42651788c30bd777f79da733240840fdd62632884de1db.pdf
https://github.com/horizon3ai/CVE-2021-44077/blob/b7a48e25824e8ead95e028475c7fd0e107e6e6bf/exploit.py	pdf/8fb2e63f36a0e65f1ea2dd924d58c2169c59a6299756d4122996dfa29646a98c.pdf

file_event_win_cve_2022_24527_lpe

Title : CVE-2022-24527 Microsoft Connected Cache LPE

Rule id : e0a41412-c69a-446f-8e6e-0e6d7483dad7

Url	Pdf
https://www.rapid7.com/blog/post/2022/04/12/cve-2022-24527-microsoft-connected-cache-local-privilege-escalation-fixed/	pdf/97408688e0e85bf1df6151bcaadf69135ac9681e20965104cc75a4ec18af5724.pdf

file_event_win_cve_2023_27363_foxit_rce

Title : Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader

Rule id : 9cae055f-e1d2-4f81-b8a5-1986a68cdd84

Url	Pdf
https://github.com/j00sean/SecBugs/tree/ff72d553f75d93e1a0652830c0f74a71b3f19c46/CVEs/CVE-2023-27363	pdf/de66a25f6727c63218d06ce7ccac224217630f79df1cf04093fff7ae9e996516.pdf
https://www.zerodayinitiative.com/advisories/ZDI-23-491/	pdf/b232993d06672de7d6e8e0d5a51bb417b9e2cbba3b1f3d1cc5a10838ee1f1cd6.pdf
https://www.tarlogic.com/blog/cve-2023-27363-foxit-reader/	pdf/ed87b4071c87da3c47c489e0f313af80a5100a20d7202ed146297c8a059ef587.pdf

file_event_win_dcom_iertutil_dll_hijack

Title : Potential DCOM InternetExplorer.Application DLL Hijack

Rule id : 2f7979ae-f82b-45af-ac1d-2b10e93b0baa

Url	Pdf
https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html	pdf/ba965214af2505144a26f6c901814ff29d26160ee8671d7a6cfe913b06bcc0e8.pdf

file_event_win_dll_sideloading_space_path

Title : DLL Search Order Hijackig Via Additional Space in Path

Rule id : b6f91281-20aa-446a-b986-38a92813a18f

Url	Pdf
https://twitter.com/cyb3rops/status/1552932770464292864	pdf/892da115a1ddcec8bada4e9cfa485e4f80cb50f0475063815ff0a0c750d6af57.pdf
https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows	pdf/147b4b6c8d0aed196f02a4ee0b4c738fe2ddd47180f1765cf7017c3b51c3d639.pdf

file_event_win_dump_file_creation

Title : DMP/HDMP File Creation

Rule id : 3a525307-d100-48ae-b3b9-0964699d7f97

Url	Pdf
https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps	pdf/1aa9daa30ea513bc970ddf5693962cf0da290329074712bf3f95a4fe80909c29.pdf

file_event_win_dump_file_susp_creation

Title : Potentially Suspicious DMP/HDMP File Creation

Rule id : aba15bdd-657f-422a-bab3-ac2d2a0d6f1c

Url	Pdf
https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps	pdf/1aa9daa30ea513bc970ddf5693962cf0da290329074712bf3f95a4fe80909c29.pdf

file_event_win_errorhandler_persistence

Title : Potential Persistence Attempt Via ErrorHandler.Cmd

Rule id : 15904280-565c-4b73-9303-3291f964e7f9

Url	Pdf
https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/	pdf/8e750e1c5498cf85d1ca645d045e46970fba8edddbe82008adc5d286e3e0a896.pdf
https://github.com/last-byte/PersistenceSniper	pdf/9894989623f57f0f9b9c1615be3ada4dbea3df0ce4c14683f2a141140b1a19c7.pdf

file_event_win_exchange_webshell_drop

Title : Suspicious ASPX File Drop by Exchange

Rule id : bd1212e5-78da-431e-95fa-c58e3237a8e6

Url	Pdf
https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/	pdf/639342fa8774376d4d8df7540bf322dcda017e1a7fa47ff265d58a2810422a49.pdf
https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html	pdf/afa58c6ca812fa5b1aecb1c71d871823784f62413a9a16def80a9765b90ffb13.pdf
https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html	pdf/e84344f175ce3d667b98da0e5679c340014191394fe70f99f8f8a8b5562f5ffc.pdf

file_event_win_exchange_webshell_drop_suspicious

Title : Suspicious File Drop by Exchange

Rule id : 6b269392-9eba-40b5-acb6-55c882b20ba6

Url	Pdf
https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/	pdf/639342fa8774376d4d8df7540bf322dcda017e1a7fa47ff265d58a2810422a49.pdf
https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html	pdf/afa58c6ca812fa5b1aecb1c71d871823784f62413a9a16def80a9765b90ffb13.pdf
https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html	pdf/e84344f175ce3d667b98da0e5679c340014191394fe70f99f8f8a8b5562f5ffc.pdf

file_event_win_exploit_cve_2021_40444

Title : Suspicious Word Cab File Write CVE-2021-40444

Rule id : 60c0a111-787a-4e8a-9262-ee485f3ef9d5

Url	Pdf
https://twitter.com/RonnyTNL/status/1436334640617373699?s=20	pdf/f7a00cd49b7a4f2556d2d3cf5660a9df96943d1a9873b3a2155ef91a2992e0f2.pdf
https://twitter.com/vanitasnk/status/1437329511142420483?s=21	pdf/325eb95f6b957a3ef5fdc0ff0cc95e07062e89c2a75aa213f3d23ea39d02cdf6.pdf

file_event_win_exploit_cve_2023_34362_moveit_transfer

Title : Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity

Rule id : c3b2a774-3152-4989-83c1-7afc48fd1599

Url	Pdf
https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/	pdf/f32461e6b44ec22db598d45f76e6a6dd4d84f96e9db9aa773d9e1f7bd14e0650.pdf
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023	pdf/5416dc7013354e8f1960d28568b7c99bfde771558b6b151aacf6c76451a6ca91.pdf
https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/	pdf/a417cc618cc09327bab8434e403cb53e58e2bbeddfcb13504764a1ae2e6cbf8a.pdf
https://www.reddit.com/r/sysadmin/comments/13wxuej/comment/jmhdg55/	pdf/c8fb44618b7f0c719d4ff792ef63709f530b423c9bbe564a6209bcfb502d314d.pdf

file_event_win_exploit_cve_2023_36874_report_creation

Title : Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location

Rule id : 92389a99-5215-43b0-a09f-e334453b2ed3

Url	Pdf
https://github.com/Wh04m1001/CVE-2023-36874	pdf/43c5cce5e28016160b154a311920b5cb358a2e7dcd2d292865c36eb6fc1fea46.pdf
https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/	pdf/337374074d5f4ee2d2478b4cce8e0ea0e017a37eef0f3101cf4fe421513209fb.pdf

file_event_win_exploit_cve_2023_36874_wermgr_creation

Title : Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation

Rule id : ad0960eb-0015-4d16-be13-b3d9f18f1342

Url	Pdf
https://github.com/Wh04m1001/CVE-2023-36874	pdf/43c5cce5e28016160b154a311920b5cb358a2e7dcd2d292865c36eb6fc1fea46.pdf
https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/	pdf/337374074d5f4ee2d2478b4cce8e0ea0e017a37eef0f3101cf4fe421513209fb.pdf

file_event_win_exploit_cve_2023_36884_office_windows_html_rce_file_patterns

Title : Potential CVE-2023-36884 Exploitation Dropped File

Rule id : 8023d3a2-dcdc-44da-8fa9-5c7906e55b38

Url	Pdf
https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit	pdf/a594cb46287dd549e093e3d8b6a84c1a2f58883cf1879307dea89d5426d56668.pdf
https://twitter.com/wdormann/status/1679184475677130755	pdf/3b78161123c10b377db24e23e1d001f96c30829846a7ba95ae1e756723039a0c.pdf
https://twitter.com/r00tbsd/status/1679042071477338114/photo/1	pdf/bdcbcf21080fc3ad6ea218e89945ab63e774b2e21f379611d5302c74210ec1a1.pdf

file_event_win_exploit_cve_2023_38331_winrar_susp_double_ext

Title : CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File

Rule id : e4556676-fc5c-4e95-8c39-5ef27791541f

Url	Pdf
https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/	pdf/2151ed23455d2beb2e706946133cc91157866122a5407f1770f2a1e9f2ad9d18.pdf
https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md	pdf/5ee427bdd7d97a1258a6b5c4b6f86d4c6749107a993895131bcb2a8241ccb0e2.pdf

file_event_win_exploit_cve_2023_40477_winrar_rev_file_abuse

Title : CVE-2023-40477 Potential Exploitation - .REV File Creation

Rule id : c3bd6c55-d495-4c34-918e-e03e8828c074

Url	Pdf
https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/	pdf/7a50a38e9c1a6c9440c7e8e9e0d2a769fcdc4e30fb58e1483fc805fd77309c18.pdf
https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC	pdf/ca53595396d4f0728b6495597eadb7b7b506d7bda3cf38ebc9cc59844e0f4188.pdf
https://www.rarlab.com/vuln_rev3_names.html	pdf/51961a93bd1baa4ec553931c3494cf34530b495ae3dc927bdfa7392a45144b8f.pdf

file_event_win_exploit_cve_2024_1708_screenconnect

Title : CVE-2024-1708 - ScreenConnect Path Traversal Exploitation

Rule id : 44d7af7e-88e6-4490-be11-55f7ff4d9fc1

Url	Pdf
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8	pdf/4d6798cd87d006f0dd60e61daa1bc76fb2f3dbfa9a9b495a95d6756104c045af.pdf
https://www.cve.org/CVERecord?id=CVE-2024-1709	pdf/f19b5162ce1cb07e66751606f745c9e11107ac34a0d0daf179122e9f4400851c.pdf
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass	pdf/b73da2c3fda7deaf25e552cb788423e8b8db1dc6e620583cfa3a2e4f2416688a.pdf

file_event_win_exploit_cve_2024_1709_user_database_modification_screenconnect

Title : ScreenConnect User Database Modification

Rule id : 1a821580-588b-4323-9422-660f7e131020

Url	Pdf
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8	pdf/4d6798cd87d006f0dd60e61daa1bc76fb2f3dbfa9a9b495a95d6756104c045af.pdf
https://www.cve.org/CVERecord?id=CVE-2024-1709	pdf/f19b5162ce1cb07e66751606f745c9e11107ac34a0d0daf179122e9f4400851c.pdf
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass	pdf/b73da2c3fda7deaf25e552cb788423e8b8db1dc6e620583cfa3a2e4f2416688a.pdf

file_event_win_gotoopener_artefact

Title : GoToAssist Temporary Installation Artefact

Rule id : 5d756aee-ad3e-4306-ad95-cb1abec48de2

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows	pdf/3ab89cbedb1ca0cd3f5b020de6a285c9a688310508d11d56647d59f881ad04f3.pdf

file_event_win_hktl_crackmapexec_indicators

Title : HackTool - CrackMapExec File Indicators

Rule id : 736ffa74-5f6f-44ca-94ef-1c0df4f51d2a

Url	Pdf
https://github.com/byt3bl33d3r/CrackMapExec/	pdf/7efced8a1ecea416b4c288d32f93eff6343643d68c5f2def8dd9180eaf0a19b7.pdf

file_event_win_hktl_dumpert

Title : HackTool - Dumpert Process Dumper Default File

Rule id : 93d94efc-d7ad-4161-ad7d-1638c4f908d8

Url	Pdf
https://github.com/outflanknl/Dumpert	pdf/d028574bba29d066cf4ddb010321ff1595768b8df629cd86679aff1d0f8e1980.pdf
https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/	pdf/84cb054fb7f70d3a7b40cd2e7239c56eaf754bf41a4cf8aab77a2f52456f9e06.pdf

file_event_win_hktl_hivenightmare_file_exports

Title : HackTool - Typical HiveNightmare SAM File Export

Rule id : 6ea858a8-ba71-4a12-b2cc-5d83312404c7

Url	Pdf
https://github.com/GossiTheDog/HiveNightmare	pdf/5ec279bbcb6af6eb0b8ba92203f3d543c2877f6aa5c7c26ac6f6548091f6f7b6.pdf
https://github.com/FireFart/hivenightmare/	pdf/7f0be0eb4e169e025854cc931aca782e3adf94767a4030a3c095b56a369f4880.pdf
https://github.com/WiredPulse/Invoke-HiveNightmare	pdf/43fc9ab390794fa1a8aa36492f6cacc4d3fd1d795bfe751290dc8afe9b422557.pdf
https://twitter.com/cube0x0/status/1418920190759378944	pdf/06b73c7c4c03d3722b70d4d035e716b6f6c7c2ae59ae512cb4e4545508186e77.pdf

file_event_win_hktl_inveigh_artefacts

Title : HackTool - Inveigh Execution Artefacts

Rule id : bb09dd3e-2b78-4819-8e35-a7c1b874e449

Url	Pdf
https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs	pdf/a45347458345ecd133ec32d8e944a33f861a53bf4edda630773a22e877567bc6.pdf
https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs	pdf/0f96f856c33e089a4483a8a66f74ec80a923b3bc319bee65577cd52005147596.pdf
https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/	pdf/23b21366babe87c74b746651711fdfe6514b766adc16a18017470dffad40a181.pdf

file_event_win_hktl_krbrelay_remote_ioc

Title : HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators

Rule id : 3ab79e90-9fab-4cdf-a7b2-6522bc742adb

Url	Pdf
https://github.com/CICADA8-Research/RemoteKrbRelay/blob/19ec76ba7aa50c2722b23359bc4541c0a9b2611c/Exploit/RemoteKrbRelay/Relay/Attacks/RemoteRegistry.cs#L31-L40	pdf/a2a95bf324bf4be8e7252ca012ffefd6bab0ba0bc9ea60b4d2f6daebba1c4541.pdf

file_event_win_hktl_mimikatz_files

Title : HackTool - Mimikatz Kirbi File Creation

Rule id : 9e099d99-44c2-42b6-a6d8-54c3545cab29

Url	Pdf
https://cobalt.io/blog/kerberoast-attack-techniques	pdf/c7d09edc9f60a9add2c1531a19ed0b5c7df651316790ce164109be311e7920ed.pdf
https://pentestlab.blog/2019/10/21/persistence-security-support-provider/	pdf/cd3308d996d2b5c627871556e73713bb4a3c90ebd78a4eb599d5aa8c4ec48e28.pdf

file_event_win_hktl_nppspy

Title : HackTool - NPPSpy Hacktool Usage

Rule id : cad1fe90-2406-44dc-bd03-59d0b58fe722

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy	pdf/43faf678a927e22374d7fd343843e275fea7963c6e53a5a79b4fd0deded5ea65.pdf
https://twitter.com/0gtweet/status/1465282548494487554	pdf/4adac23b130bfba6b8d2b8f8d9e9c83f9b5bd09dd6bd4c1c2229a69c41c1d701.pdf

file_event_win_hktl_powerup_dllhijacking

Title : HackTool - Powerup Write Hijack DLL

Rule id : 602a1f13-c640-4d73-b053-be9a2fa58b96

Url	Pdf
https://powersploit.readthedocs.io/en/latest/Privesc/Write-HijackDll/	pdf/44163eb48d2a27f40771286f5fd8f781e7c79cccd3e511fc3ec2305732b15ae4.pdf

file_event_win_hktl_quarkspw_filedump

Title : HackTool - QuarksPwDump Dump File

Rule id : 847def9e-924d-4e90-b7c4-5f581395a2b4

Url	Pdf
https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm	pdf/6c34b6d03ae45484d4f9d935c2f85fc177ad955f3e3a3dd8c7c38319aeef9d89.pdf

file_event_win_hktl_remote_cred_dump

Title : HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump

Rule id : 6e2a900a-ced9-4e4a-a9c2-13e706f9518a

Url	Pdf
https://github.com/Porchetta-Industries/CrackMapExec	pdf/1afb46ffaebe793d0e4c0419e010a03e7016d55a483fc969b1ea3247fedad25d.pdf
https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py	pdf/406eaaaf4443b19c293ed04c5b422c9a373bcd512843de0c16ae853bd1461ac7.pdf

file_event_win_hktl_safetykatz

Title : HackTool - SafetyKatz Dump Indicator

Rule id : e074832a-eada-4fd7-94a1-10642b130e16

Url	Pdf
https://github.com/GhostPack/SafetyKatz	pdf/3ab8bdb5502018f392fc400e55de4795f0ccaff0817cb561c078e523f7cb1417.pdf
https://github.com/GhostPack/SafetyKatz/blob/715b311f76eb3a4c8d00a1bd29c6cd1899e450b7/SafetyKatz/Program.cs#L63	pdf/7816a15665daf93e777016e6237970b5c2c3d7ad1f4626a7064d6efca007190e.pdf

file_event_win_initial_access_dll_search_order_hijacking

Title : Potential Initial Access via DLL Search Order Hijacking

Rule id : dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c

Url	Pdf
https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc	pdf/3184f0c5f3792479ec34407da9b764e3ccd1848d1005b6324047e6ffeff7e667.pdf
https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0	pdf/ddeace8231237fa359a964954c119d4f72a5b726f91d97231044aa968b703519.pdf

file_event_win_install_teamviewer_desktop

Title : Installation of TeamViewer Desktop

Rule id : 9711de76-5d4f-4c50-a94f-21e4e8f8384d

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-1---teamviewer-files-detected-test-on-windows	pdf/1903709bd926bcc75ec5d7392bd86677449447f4eb9709de3102ecd8c9381ec7.pdf

file_event_win_iphlpapi_dll_sideloading

Title : Malicious DLL File Dropped in the Teams or OneDrive Folder

Rule id : 1908fcc1-1b92-4272-8214-0fbaf2fa5163

Url	Pdf
https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/	pdf/735597318502c4a2b6debe84fb5a9b2e7241da1ae1a97309964cdc5369557f64.pdf

file_event_win_iso_file_mount

Title : ISO File Created Within Temp Folders

Rule id : 2f9356ae-bf43-41b8-b858-4496d83b2acb

Url	Pdf
https://twitter.com/Sam0x90/status/1552011547974696960	pdf/291b1e18dbbf99b22f2f3a81d9608a4891f28cd40026914d23eed8f7d7447174.pdf
https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html	pdf/c92601edb4aeb1e65ccb8ccb01d52674394499c5402ade4d24f2245d38c7e55d.pdf
https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image	pdf/5e7483419468b0f4b510e4d099a06177ca177aeafe2fc5ebd46a678551c6fc3f.pdf

file_event_win_iso_file_recent

Title : ISO or Image Mount Indicator in Recent Files

Rule id : 4358e5a5-7542-4dcb-b9f3-87667371839b

Url	Pdf
https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/	pdf/779ce14ab8d8fcaec6b350caa803959dbc2bd17c9dc49f9709d32590d083a725.pdf
https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore	pdf/275d9f6ea2347edcefd0f064f3e569bf0e74bbfe2b84d42b5c38ddf22d66d3a0.pdf
https://blog.emsisoft.com/en/32373/beware-new-wave-of-malware-spreads-via-iso-file-email-attachments/	pdf/48f812fa5fd66c187c91e1c39a1ea20f6ab69c1fb5108af9f8dfce3398c72697.pdf
https://insights.sei.cmu.edu/blog/the-dangers-of-vhd-and-vhdx-files/	pdf/79fdde16563e175c496348206201df5e2450358ba0a84284d95db460f9630675.pdf

file_event_win_lolbin_gather_network_info_script_output

Title : GatherNetworkInfo.VBS Reconnaissance Script Output

Rule id : f92a6f1e-a512-4a15-9735-da09e78d7273

Url	Pdf
https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs	pdf/60c72778b9699d187374ee9d0546ba1074cd309b21a23140114ef08bd32e45fa.pdf
https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government	pdf/6cc164cfb2a9f5789c073b13644022d9bc8e602fcd50330b365f95d8fd90df5d.pdf

file_event_win_lsass_default_dump_file_names

Title : LSASS Process Memory Dump Files

Rule id : a5a2d357-1ab8-4675-a967-ef9990a59391

Url	Pdf
https://www.google.com/search?q=procdump+lsass	pdf/b04b2e6ec5acce1100dcb0d7085997cfe7842c6f4ab15e3eae82e88cbee9379e.pdf
https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf	pdf/fe27332b369b9e06e56881a250828f99970212ffcc725d3e4a3ffdaee9fa1e6d.pdf
https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml	pdf/c01abe99e0e0523bc3fbd2b41bee5081577fa78544a4da8f545a3a971afda322.pdf
https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/	pdf/23fd796cce72de5e80c6eb36350247c824daaebedd5f67aa69e4f9546110496c.pdf
https://github.com/helpsystems/nanodump	pdf/ced65711fc744dd736ce6abf2bf660e58fb543503f1551af81143afe2eb1187e.pdf
https://github.com/CCob/MirrorDump	pdf/aeb1ed8fd3fed80a973264542c6d990fe1c730d9b8250fac579f7a52027cbbfc.pdf
https://github.com/safedv/RustiveDump/blob/1a9b026b477587becfb62df9677cede619d42030/src/main.rs#L35	pdf/9d5bdab0071975d06f9971b7408bc65d639cd5c9ed02ba195822521e5ed6745d.pdf
https://github.com/ricardojoserf/NativeDump/blob/01d8cd17f31f51f5955a38e85cd3c83a17596175/NativeDump/Program.cs#L258	pdf/bf6880a1e08f422f3f0a4c6a975232104a3765f7524e76da085429c8e46ebb97.pdf

file_event_win_lsass_shtinkering

Title : LSASS Process Dump Artefact In CrashDumps Folder

Rule id : 6902955a-01b7-432c-b32a-6f5f81d8f625

Url	Pdf
https://github.com/deepinstinct/Lsass-Shtinkering	pdf/7768bb500b70ef47545f6a638926e96ceb4a2d12afc15bf3a337fd90f415ee37.pdf

file_event_win_lsass_werfault_dump

Title : WerFault LSASS Process Memory Dump

Rule id : c3e76af5-4ce0-4a14-9c9a-25ceb8fda182

Url	Pdf
https://github.com/helpsystems/nanodump	pdf/ced65711fc744dd736ce6abf2bf660e58fb543503f1551af81143afe2eb1187e.pdf

file_event_win_mal_adwind

Title : Adwind RAT / JRAT File Artifact

Rule id : 0bcfabcb-7929-47f4-93d6-b33fb67d34d1

Url	Pdf
https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100	pdf/bbde64d2d48aa5ec11e200856b9ae1f6150e3414175dfa115133189b995c2975.pdf

file_event_win_mal_octopus_scanner

Title : Octopus Scanner Malware

Rule id : 805c55d9-31e6-4846-9878-c34c75054fe9

Url	Pdf
https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain	pdf/613e0e9f8d65589d1cf0c37aa73218509f4d2d34e68a2e388a543b018b059d7d.pdf

file_event_win_malware_coldsteel_renamed_cmd

Title : Potential COLDSTEEL RAT File Indicators

Rule id : c708a93f-46b4-4674-a5b8-54aa6219c5fa

Url	Pdf

file_event_win_malware_coldsteel_service_dll_creation

Title : Potential COLDSTEEL Persistence Service DLL Creation

Rule id : 1fea93a2-1524-4a3c-9828-3aa0c2414e27

Url	Pdf

file_event_win_malware_darkgate_autoit3_binary_creation

Title : DarkGate - Autoit3.EXE File Creation By Uncommon Process

Rule id : 1a433e1d-03d2-47a6-8063-ece992cf4e73

Url	Pdf
https://github.security.telekom.com/2023/08/darkgate-loader.html	pdf/4b57b2c0916361718d903c912195f8755681d4c8d0c1e852bb0689eda2ee6b4f.pdf
https://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware	pdf/223c81b0c383eaf24f95108d31f399d41ce2f4808bb3cbd274025ff7eee41a50.pdf
https://github.com/pr0xylife/DarkGate/tree/main	pdf/75ab05f5e67db52acdfe057c14a6930550cc60b157835f37396297f41e47834a.pdf

file_event_win_malware_darkgate_autoit3_save_temp

Title : DarkGate - Drop DarkGate Loader In C:\Temp Directory

Rule id : df49c691-8026-48dd-94d3-4ba6a79102a8

Url	Pdf
https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/	pdf/f22355c2906d08f9ab7d15301a3c248a029667f5b057178a01e9889f4fd8763f.pdf
https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html	pdf/308fcbea3aca9050a2ff22cf447fd71e02bb88c3cda591009ab0546bccacfd81.pdf

file_event_win_malware_devil_bait_script_drop

Title : Potential Devil Bait Related Indicator

Rule id : 93d5f1b4-36df-45ed-8680-f66f242b8415

Url	Pdf

file_event_win_malware_goofy_guineapig_file_indicators

Title : Goofy Guineapig Backdoor IOC

Rule id : f0bafe60-1240-4798-9e60-4364b97e6bad

Url	Pdf

file_event_win_malware_kapeka_backdoor_indicators

Title : Potential Kapeka Decrypted Backdoor Indicator

Rule id : 20228d05-dd68-435d-8b4e-e7e64938880c

Url	Pdf
https://labs.withsecure.com/publications/kapeka	pdf/2458ac308057f4f668b76f392f6de2b7c136a9c42f8606c1c740168d49e7b5c0.pdf
https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/	pdf/842a02b6dbd0c3af7c423879e83f9275d685e92409985b2b9164a1124d481364.pdf

file_event_win_malware_pingback_backdoor

Title : Pingback Backdoor File Indicators

Rule id : 2bd63d53-84d4-4210-80ff-bf0658f1bf78

Url	Pdf
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/backdoor-at-the-end-of-the-icmp-tunnel	pdf/dc54498ffb77b49ac37ae246aeeb4abf193788b749a3bac8c86226d9ec2caaea.pdf
https://app.any.run/tasks/4a54c651-b70b-4b72-84d7-f34d301d6406	pdf/d96dcaa5261a0eb4fd5c4d7a5a6f7b594822308b332a2521bb6480f1b535487d.pdf

file_event_win_malware_small_sieve_evasion_typo

Title : Small Sieve Malware File Indicator Creation

Rule id : 39466c42-c189-476a-989f-8cdb135c163a

Url	Pdf

file_event_win_malware_snake_encrypted_payload_ioc

Title : SNAKE Malware Kernel Driver File Indicator

Rule id : d6d9d23f-69c1-41b5-8305-fa8250bd027f

Url	Pdf

file_event_win_malware_snake_installers_ioc

Title : SNAKE Malware Installer Name Indicators

Rule id : 99eccc2b-7182-442f-8806-b76cc36d866b

Url	Pdf

file_event_win_malware_snake_werfault_creation

Title : SNAKE Malware WerFault Persistence File Creation

Rule id : 64827580-e4c3-4c64-97eb-c72325d45399

Url	Pdf

file_event_win_moriya_rootkit

Title : Moriya Rootkit File Created

Rule id : a1507d71-0b60-44f6-b17c-bf53220fdd88

Url	Pdf
https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831	pdf/9b9d2e14613770cf3e9d3f40ac11d4517088422df28270a909bafcc9a25564f0.pdf

file_event_win_msdt_susp_directories

Title : File Creation In Suspicious Directory By Msdt.EXE

Rule id : 318557a5-150c-4c8d-b70e-a9910e199857

Url	Pdf
https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd	pdf/3806f1f57310752457b220c7b643612fa92cb24027ba9248f27db298b420c5c1.pdf
https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/	pdf/94e585062e077703547d0c985e36420ab353b4678de99354480a62d00447978b.pdf

file_event_win_mysqld_uncommon_file_creation

Title : Uncommon File Creation By Mysql Daemon Process

Rule id : c61daa90-3c1e-4f18-af62-8f288b5c9aaf

Url	Pdf
https://asec.ahnlab.com/en/58878/	pdf/07ee9bc9670892350367516cdcb003d8c9115e08fffb184773a35c6dade07026.pdf
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/	pdf/7c9f8daebe9421d62cc4678d2f9c2343844425fd8f753b492ffe8a0f4b91a451.pdf

file_event_win_net_cli_artefact

Title : Suspicious DotNET CLR Usage Log Artifact

Rule id : e0b06658-7d1d-4cd3-bf15-03467507ff7c

Url	Pdf
https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/	pdf/0311fde195a3a8d524ff1e13d0b991efa0c95eee1c8b505b3adee84706dd83c4.pdf
https://github.com/olafhartong/sysmon-modular/blob/fa1ae53132403d262be2bbd7f17ceea7e15e8c78/11_file_create/include_dotnet.xml	pdf/1da4dad3766c1040a226e2964d26782e6ec9717c235292d6d4e25a3f42c4993b.pdf
https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008	pdf/bc0b172f44c0cefe4d4efa2dbc8aca4779ff3b1d52465b8756a1bcca2f56f553.pdf
https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html	pdf/be8630fab39fbc38fb11e53123a857e3dfcbea572a7c225ff7e4b6d85b6a2b38.pdf

file_event_win_new_files_in_uncommon_appdata_folder

Title : Suspicious File Creation In Uncommon AppData Folder

Rule id : d7b50671-d1ad-4871-aa60-5aa5b331fe04

Url	Pdf

file_event_win_new_scr_file

Title : SCR File Write Event

Rule id : c048f047-7e2a-4888-b302-55f509d4a91d

Url	Pdf
https://lolbas-project.github.io/lolbas/Libraries/Desk/	pdf/f4ed3bcb211e08c6a74d4dba0d182705987952b850465fee104d6181f3043e1b.pdf

file_event_win_notepad_plus_plus_persistence

Title : Potential Persistence Via Notepad++ Plugins

Rule id : 54127bd4-f541-4ac3-afdb-ea073f63f692

Url	Pdf
https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/	pdf/6138b83ca9e2ec6e699c450193486274b5c0051bfc11f4d95d300721a26622a2.pdf

file_event_win_ntds_dit_creation

Title : NTDS.DIT Created

Rule id : 0b8baa3f-575c-46ee-8715-d6f28cc7d33c

Url	Pdf

file_event_win_ntds_dit_uncommon_parent_process

Title : NTDS.DIT Creation By Uncommon Parent Process

Rule id : 4e7050dd-e548-483f-b7d6-527ab4fa784d

Url	Pdf
https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration	pdf/13d5e0a8fd206749e5e912ef97ea2674da09b051d77ad92ec1be6b24c537d19c.pdf
https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/	pdf/e36c52ad78d8b1f0f5c15faec9973c438253b4ec677a488b9f4930c350469eed.pdf
https://pentestlab.blog/tag/ntds-dit/	pdf/a886e27f6576f15e4a7de4c6f209f53cd2410b8710a1669f7616d22a42b7dd57.pdf
https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1	pdf/006cbf79821c3ef2fc938b7ce4cdac1f445e84f5c3652d8f2972ad309f60f4c7.pdf

file_event_win_ntds_dit_uncommon_process

Title : NTDS.DIT Creation By Uncommon Process

Rule id : 11b1ed55-154d-4e82-8ad7-83739298f720

Url	Pdf
https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/	pdf/f88cf9660e7b371aa82e72bf9ebaef7a008df280d05eae052068133831e0cf75.pdf
https://adsecurity.org/?p=2398	pdf/bb42f2c601ae520072151698b800621cf1c370d6fdcf485260722f1d9d056a92.pdf

file_event_win_ntds_exfil_tools

Title : NTDS Exfiltration Filename Patterns

Rule id : 3a8da4e0-36c1-40d2-8b29-b3e890d5172a

Url	Pdf
https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb	pdf/84c83e6d5432a4219428637f42b54c6d70b147241b516ee7469b6a5a9060652a.pdf
https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1	pdf/b6ef3a8582c113e10a8470c12e5b24c7028031555df49ed4d840afe1efa9532a.pdf
https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405	pdf/5d00be91acd71a67eeebdf6cef36c473742cc1e9346c7f488bd2258bf13d79ac.pdf

file_event_win_office_addin_persistence

Title : Potential Persistence Via Microsoft Office Add-In

Rule id : 8e1cb247-6cf6-42fa-b440-3f27d57e9936

Url	Pdf
https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence	pdf/339e324db1b6ec791842be8e7c20492c5c1e3e185bab91c55568b53a63f712d5.pdf
https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md	pdf/083114c3b2e1b9463c6ec41700e366c58cf46ec0aa015a05eb0c8b2402e2a4e0.pdf

file_event_win_office_macro_files_created

Title : Office Macro File Creation

Rule id : 91174a41-dc8f-401b-be89-7bfc140612a0

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md	pdf/e9c157223331e327defec474bb571c1c681338b1f637492710defd2abab63cd6.pdf
https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference	pdf/2283d3976935dab24b76ec0a3525cbf8176e92fc3d21427214047c9368db5285.pdf

file_event_win_office_macro_files_downloaded

Title : Office Macro File Download

Rule id : 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md	pdf/e9c157223331e327defec474bb571c1c681338b1f637492710defd2abab63cd6.pdf
https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference	pdf/2283d3976935dab24b76ec0a3525cbf8176e92fc3d21427214047c9368db5285.pdf

file_event_win_office_macro_files_from_susp_process

Title : Office Macro File Creation From Suspicious Process

Rule id : b1c50487-1967-4315-a026-6491686d860e

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md	pdf/e9c157223331e327defec474bb571c1c681338b1f637492710defd2abab63cd6.pdf
https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference	pdf/2283d3976935dab24b76ec0a3525cbf8176e92fc3d21427214047c9368db5285.pdf

file_event_win_office_onenote_files_in_susp_locations

Title : OneNote Attachment File Dropped In Suspicious Location

Rule id : 7fd164ba-126a-4d9c-9392-0d4f7c243df0

Url	Pdf
https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/	pdf/66ce25c5594b06ddb753adbb17f64e9cdbbf9e8802b6adcb6ffa260b8a281ecc.pdf
https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/	pdf/10838870afdfddb8452b21c921321e6244425253a79f5a359f4bd613bfe97d1a.pdf

file_event_win_office_onenote_susp_dropped_files

Title : Suspicious File Created Via OneNote Application

Rule id : fcc6d700-68d9-4241-9a1a-06874d621b06

Url	Pdf
https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/	pdf/66ce25c5594b06ddb753adbb17f64e9cdbbf9e8802b6adcb6ffa260b8a281ecc.pdf
https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/	pdf/10838870afdfddb8452b21c921321e6244425253a79f5a359f4bd613bfe97d1a.pdf
https://twitter.com/MaD_c4t/status/1623414582382567424	pdf/f00fce75050d95792e41d725c32bd2c9011548c45d0a65047b7fbd8ac6bc7024.pdf
https://labs.withsecure.com/publications/detecting-onenote-abuse	pdf/87714e974170bb2e20943b631aec432662309e7ef635cf36fc6d7c777cb404d4.pdf
https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/	pdf/951dfd4f64c1e9005c59cc80b8055a651f9ed18547e7cb8de1418b9911261c07.pdf
https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/	pdf/eb29ce85eead22a6e3d20e4ee87ac7cb73c00b671a5a63b440c978918c25a70b.pdf

file_event_win_office_outlook_macro_creation

Title : New Outlook Macro Created

Rule id : 8c31f563-f9a7-450c-bfa8-35f8f32f1f61

Url	Pdf
https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/	pdf/8c183e4ae347735fd20dad82d1c7e9eb6fdc434e9b393b4a035bd51d7506bc23.pdf

file_event_win_office_outlook_newform

Title : Potential Persistence Via Outlook Form

Rule id : c3edc6a5-d9d4-48d8-930e-aab518390917

Url	Pdf
https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76	pdf/274ffe226c3733c553096f35ad90e1289ef25cbb56d88c5b9cc0427d7c9e90bf.pdf
https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=79	pdf/1faee6b6fdedd2862ad8c7eb72f2a6efb7a657f6b945d7c7a2e53b840416eb01.pdf
https://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form	pdf/efe3bc5388f7c942f6a6e8aff0d36ea3b1eace8b06e9d015ccda43a6131986c0.pdf
https://www.slipstick.com/developer/custom-form/clean-outlooks-forms-cache/	pdf/d8d685fa47cd32ff25c4c1cd553a3970872d597f0734afe6f59f91f1594ecf14.pdf

file_event_win_office_outlook_rdp_file_creation

Title : .RDP File Created by Outlook Process

Rule id : f748c45a-f8d3-4e6f-b617-fe176f695b8f

Url	Pdf
https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/	pdf/59f0c86678783db48b38ef9bf709ddb23af2b926f6a1152b54e11b6f112da8bd.pdf
https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/	pdf/42da08f2694dbad8af81281fa3ccc83a44891c13bb56134ca54098127977c222.pdf
https://www.linkedin.com/feed/update/urn:li:ugcPost:7257437202706493443?commentUrn=urn%3Ali%3Acomment%3A%28ugcPost%3A7257437202706493443%2C7257522819985543168%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287257522819985543168%2Curn%3Ali%3AugcPost%3A7257437202706493443%29	pdf/71abe10b4df5c411ed5bcd7c0ba5539df94dd490f8063f8b62426dfd49be6bef.pdf

file_event_win_office_outlook_susp_macro_creation

Title : Suspicious Outlook Macro Created

Rule id : 117d3d3a-755c-4a61-b23e-9171146d094c

Url	Pdf
https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/	pdf/8c183e4ae347735fd20dad82d1c7e9eb6fdc434e9b393b4a035bd51d7506bc23.pdf
https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53	pdf/d2f5a2a1ec3050d45d7c62b1bf949064a5c8f864cc7d7c2e0814eadd28db3e06.pdf
https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/	pdf/2928d034403562adc34c80a1e06f06a5bc6c9ef775f834fac524d69d872ec3ea.pdf

file_event_win_office_publisher_files_in_susp_locations

Title : Publisher Attachment File Dropped In Suspicious Location

Rule id : 3d2a2d59-929c-4b78-8c1a-145dfe9e07b1

Url	Pdf
https://twitter.com/EmericNasi/status/1623224526220804098	pdf/27d8a973a35f31191997cbbb8c509353b3279d1a7b52f5c4f2c8dbd84dac431d.pdf

file_event_win_office_startup_persistence

Title : Potential Persistence Via Microsoft Office Startup Folder

Rule id : 0e20c89d-2264-44ae-8238-aeeaba609ece

Url	Pdf
https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies	pdf/c7c692ee5710d906f5f5cd6974051e39e8f8bb1bd61f0463004608a0266822e8.pdf
https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders	pdf/e4dc5733f93ca2aa5ade31803cf3a4b20a555b6d2eb4d418db194a76902dca6d.pdf

file_event_win_office_susp_file_extension

Title : File With Uncommon Extension Created By An Office Application

Rule id : c7a74c80-ba5a-486e-9974-ab9e682bc5e4

Url	Pdf
https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/	pdf/643ab45999a39db610b4bc8320e5b2bf5c4f9114bd60b7b58924c89ad3b99534.pdf
https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml	pdf/4bfb377418120805d5eb44103e7efa3bb3ffb504b0b7240e7b202aaca3a809ef.pdf

file_event_win_office_uncommon_file_startup

Title : Uncommon File Created In Office Startup Folder

Rule id : a10a2c40-2c4d-49f8-b557-1a946bc55d9d

Url	Pdf
https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/	pdf/0d5c471c3b349c5a8d8e420dcd7b17bd040cd066e1afe7bcce5e4097e65f8af4.pdf
http://addbalance.com/word/startup.htm	pdf/092ffb4f8677cb0017800c39ea9bb0abd2fee04b8aa90bd3ce8db436917477ce.pdf
https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3	pdf/160b1cd9b77ab5d26d7bea5b813f8edac07c0909013f015a48c85a7d49f3830b.pdf
https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions	pdf/17aab8c11ab1a9b2e92ddb2cfb54a27be68691ab780e33e26644515d125ddd0b.pdf

file_event_win_pcre_net_temp_file

Title : PCRE.NET Package Temp Files

Rule id : 6e90ae7a-7cd3-473f-a035-4ebb72d961da

Url	Pdf
https://twitter.com/rbmaslen/status/1321859647091970051	pdf/ed8d22078d6fa87c3ab623f49e6ccf952b141bff8921eb381860c9e8f6d97cfd.pdf
https://twitter.com/tifkin_/status/1321916444557365248	pdf/51e0f59d9b41cb1c8ba408bf002de35423f0c29fe702f85e0f60fb96be143885.pdf

file_event_win_perflogs_susp_files

Title : Suspicious File Created In PerfLogs

Rule id : bbb7e38c-0b41-4a11-b306-d2a457b7ac2b

Url	Pdf
https://labs.withsecure.com/publications/fin7-target-veeam-servers	pdf/bcf09078cb6247a3ea928d485651fa6eb873bd5ff379fe4aa907c61f6f3096aa.pdf

file_event_win_powershell_drop_binary_or_script

Title : Potential Binary Or Script Dropper Via PowerShell

Rule id : 7047d730-036f-4f40-b9d8-1c63e36d5e62

Url	Pdf
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution	pdf/e68de0b6374b2210244a6dac81211af1d15578900fe92e36b23b8911084ec116.pdf

file_event_win_powershell_drop_powershell

Title : PowerShell Script Dropped Via PowerShell.EXE

Rule id : 576426ad-0131-4001-ae01-be175da0c108

Url	Pdf
https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution	pdf/e68de0b6374b2210244a6dac81211af1d15578900fe92e36b23b8911084ec116.pdf

file_event_win_powershell_exploit_scripts

Title : Malicious PowerShell Scripts - FileCreation

Rule id : f331aa1f-8c53-4fc3-b083-cc159bc971cb

Url	Pdf
https://github.com/PowerShellMafia/PowerSploit	pdf/c0b02e66dd619e3d9c2901bd74fa9450cb4785c6c6e68931b77ae5e179faabf4.pdf
https://github.com/NetSPI/PowerUpSQL	pdf/2c67c2a057444ebf7224ee8437fe9d4c8e996c97dd6cddf4670af1d0687354c5.pdf
https://github.com/CsEnox/EventViewer-UACBypass	pdf/86e17442fee078e95f70a5c26815f017a8c2e9615c26b4c0ba5b9b9786e93a86.pdf
https://web.archive.org/web/20210511204621/https://github.com/AlsidOfficial/WSUSpendu	pdf/fe6f81d80822d8294dd7b3d20afb91589d2fd5f9e8fa2c02661099ec4faa48ca.pdf
https://github.com/nettitude/Invoke-PowerThIEf	pdf/61c9c7b7f39885dea2de53b33c09836d934af7427ca48594920202d4cb75053e.pdf
https://github.com/S3cur3Th1sSh1t/WinPwn	pdf/683bd9bb92afd0919341ddda00fa44a87a62f60a4dd8599e34d20a2f774f293a.pdf
https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries	pdf/e8d4ddd230b1a7a3a482ae5ad7f736ddac99085f1eb2b1b20f8bc951aacd3f28.pdf
https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1	pdf/0b05e53c7a6332156c7499d47e25761561156fd4e9a37d12af650bb8f2f331ee.pdf
https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1	pdf/0d44df958dde20de821543dd1b1141ede664c695f893a54cdc6a06cb63d3d2b6.pdf
https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1	pdf/2471d145f52e6448d739caacd7436e0b8a3fefa8dd6af5d557d34aff661f33c6.pdf
https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1	pdf/9d5ae7523dca144d94e4089d8c53676906c51e7d869c7199ecaeaede5289a248.pdf
https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/	pdf/7b3bf69cf89c1dfd7b736fbaa88a4c777eec12a6403084d681b912368555cb66.pdf
https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/	pdf/5cfc4ffcfb2a23805431aa9cd187ce31ab6897cb902c7d9325d91a80f03ebf3e.pdf
https://github.com/HarmJ0y/DAMP	pdf/08351e8a7112c8a61849680ec31ccc87e7192bfdc2bfaacd2723d32c3bdff8a4.pdf
https://github.com/samratashok/nishang	pdf/fc5f88596eb890d40d5308dde9b812d7c442adeb456fbc0bdee6ecdbe1655267.pdf
https://github.com/DarkCoderSc/PowerRunAsSystem/	pdf/4a83eea713d1b64a517497a4d1b6cb1835e471f28956cce95743b2e7b6dd8dae.pdf
https://github.com/besimorhino/powercat	pdf/591453e868426ae0b01a9ea37ab6983f2006ee841291eeb15d20d3fb557b68cd.pdf
https://github.com/Kevin-Robertson/Powermad	pdf/adbee1a5f97cc7439bcf720eaef0dc1507e0b03ec3cfc9ae20b03b9dbe48a226.pdf
https://github.com/adrecon/ADRecon	pdf/2c50a3c51c7eacb354a7fbe79cdc30c1bc56b626abde65060bb536e12ca883e0.pdf
https://github.com/adrecon/AzureADRecon	pdf/83ff7ed7b59ed0c4c46f9fb70e1187221831d92cfe7edef537dbfb854bb632e3.pdf

file_event_win_powershell_module_creation

Title : PowerShell Module File Created

Rule id : e36941d0-c0f0-443f-bc6f-cb2952eb69ea

Url	Pdf
https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3	pdf/a19a2a154eaa276677963436b2e877464e435edaaad1927c45ce02fef799cf5d.pdf

file_event_win_powershell_module_susp_creation

Title : Potential Suspicious PowerShell Module File Created

Rule id : e8a52bbd-bced-459f-bd93-64db45ce7657

Url	Pdf
https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3	pdf/a19a2a154eaa276677963436b2e877464e435edaaad1927c45ce02fef799cf5d.pdf

file_event_win_powershell_module_uncommon_creation

Title : PowerShell Module File Created By Non-PowerShell Process

Rule id : e3845023-ca9a-4024-b2b2-5422156d5527

Url	Pdf
https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3	pdf/a19a2a154eaa276677963436b2e877464e435edaaad1927c45ce02fef799cf5d.pdf

file_event_win_powershell_startup_shortcuts

Title : Potential Startup Shortcut Persistence Via PowerShell.EXE

Rule id : 92fa78e7-4d39-45f1-91a3-8b23f3f1088d

Url	Pdf
https://redcanary.com/blog/intelligence-insights-october-2021/	pdf/389158ad16e7436bfb215a649009124d1b4c7522ccca8703479dc8b6e62f238d.pdf
https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder	pdf/afdb6b71bdbe5fcbbd90f29d3db6639646a7b26b8176bdbd85a8accdfdaf153f.pdf

file_event_win_ps_script_policy_test_creation_by_uncommon_process

Title : PSScriptPolicyTest Creation By Uncommon Process

Rule id : 1027d292-dd87-4a1a-8701-2abe04d7783c

Url	Pdf
https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/	pdf/66f2ab6c9bc31a74087d677bbc3a0f0dd16b92f244d3e7c010cd9f1555c3f38e.pdf

file_event_win_python_path_configuration_files

Title : Python Path Configuration File Creation - Windows

Rule id : e3652ba3-0ad8-4010-a957-b7ba369e7bac

Url	Pdf
https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/	pdf/ce33fdd13427ba1ea55d0179a11d85e2b8ebef16449d715293fa449ce4532c6c.pdf
https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac	pdf/675ca7af85aaed587f7de610757ef25c816b7150c507958ef17e2c25d321aa34.pdf
https://docs.python.org/3/library/site.html	pdf/dda87b67131b9ff2f8de4ae83b7da756880aa93ff319eb9f6fe231b19dbfdb73.pdf

file_event_win_rclone_config_files

Title : Rclone Config File Creation

Rule id : 34986307-b7f4-49be-92f3-e7a4d01ac5db

Url	Pdf
https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/	pdf/a20c1c3dd10d17d9a76ee91daaedab58a8b41d895dfc96c69b77a640f3a888b3.pdf

file_event_win_rdp_file_susp_creation

Title : .RDP File Created By Uncommon Application

Rule id : fccfb43e-09a7-4bd2-8b37-a5a7df33386d

Url	Pdf
https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/	pdf/7670e8473af2778490c42cfe6f515b816da8dcf88841b7f46adcc316c1ca1fce.pdf
https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/	pdf/feebd46c610270b50e8e9e4ba8647b5393e85aaa2f2326b72c06a27fbaff78e7.pdf

file_event_win_redmimicry_winnti_filedrop

Title : Potential Winnti Dropper Activity

Rule id : 130c9e58-28ac-4f83-8574-0a4cc913b97e

Url	Pdf
https://redmimicry.com/posts/redmimicry-winnti/#dropper	pdf/a9563c86d5c976775e4dad8d9bd8d5bcc5bb0ff6294f6c1e36f7bc892ce3a04f.pdf

file_event_win_regedit_print_as_pdf

Title : PDF File Created By RegEdit.EXE

Rule id : 145095eb-e273-443b-83d0-f9b519b7867b

Url	Pdf
https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/	pdf/99562dc885df22a21b7f1cbcb7172c23da2fceb6b5c2a79d25a59ffa7b2f1835.pdf

file_event_win_remcom_service

Title : RemCom Service File Creation

Rule id : 7eff1a7f-dd45-4c20-877a-f21e342a7611

Url	Pdf
https://github.com/kavika13/RemCom/	pdf/4f00392024468ab4135cede5fa28aef297f5258c1947b1644f0ddd47f37926a2.pdf

file_event_win_remote_access_tools_screenconnect_artefact

Title : ScreenConnect Temporary Installation Artefact

Rule id : fec96f39-988b-4586-b746-b93d59fd1922

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows	pdf/a82876834b4c254ff3b542fc019765443d6671bba6cbec7556d1f1f2e49499d6.pdf

file_event_win_remote_access_tools_screenconnect_remote_file

Title : Remote Access Tool - ScreenConnect Temporary File

Rule id : 0afecb6e-6223-4a82-99fb-bf5b981e92a5

Url	Pdf
SigmaHQ/sigma#4467	pdf/059cd9eb70fefa147d3c1e2faf25caf4d562495a48da6bf4de2837c7502ac548.pdf

file_event_win_ripzip_attack

Title : Potential RipZip Attack on Startup Folder

Rule id : a6976974-ea6f-4e97-818e-ea08625c52cb

Url	Pdf
https://twitter.com/jonasLyk/status/1549338335243534336?t=CrmPocBGLbDyE4p6zTX1cg&s=19	pdf/0db5c661d7b87039ff34be84f56ea5a49f928a9c0ab39a64c02c1dbdf30a6c4c.pdf

file_event_win_sam_dump

Title : Potential SAM Database Dump

Rule id : 4e87b8e2-2ee9-4b2a-a715-4727d297ece0

Url	Pdf
https://github.com/search?q=CVE-2021-36934	pdf/a6d53d2f629d64f56876501ba9a6763c4e79be921dba4e1750d61e3370623f6f.pdf
https://web.archive.org/web/20210725081645/https://github.com/cube0x0/CVE-2021-36934	pdf/618072bba92fdf0e7d8c9342e8b0d58a01b6914af8c3a3976e81769ec7717d14.pdf
https://www.google.com/search?q=%22reg.exe+save%22+sam	pdf/c4908f7c2b2599208a72523c59e9ffe13fbd27bc33aa9561a25cfce435eb2492.pdf
https://github.com/HuskyHacks/ShadowSteal	pdf/8f2e577a339ce9d65ae78c84170aa6227456baee49552128cc5ca3a04f590163.pdf
https://github.com/FireFart/hivenightmare	pdf/b6d783ed85c32cf1a0e0501af0becdb47014b60fd7e1fff3a502a9c7e252b1c8.pdf

file_event_win_scheduled_task_creation

Title : Scheduled Task Created - FileCreation

Rule id : a762e74f-4dce-477c-b023-4ed81df600f9

Url	Pdf
https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/	pdf/b6166426b84e111b72dd7b01dfe9a2d58182f3611612d013ea0ce0b17b6e9e94.pdf
https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5	pdf/c2cf3a5a444efe81b2ade2699ce0a1032d014b1d793d4aa1db57e90021b0fafe.pdf

file_event_win_sed_file_creation

Title : Self Extraction Directive File Created In Potentially Suspicious Location

Rule id : 760e75d8-c3b5-409b-a9bf-6130b4c4603f

Url	Pdf
https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html	pdf/9f5fd923f950098bb27ed8ffeae8be93b2429feb64a1ad75a112481c62191854.pdf
https://en.wikipedia.org/wiki/IExpress	pdf/f506a51c3a4432de1e152d9e05563973cd22d69c53e3c2cf96eb422cbdc3f468.pdf
https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior	pdf/98bebe4accf58e785887fc1dc9197fbfd2c3725d0b83ecff9af65d0707bdf0fc.pdf

file_event_win_shell_write_susp_directory

Title : Windows Shell/Scripting Application File Write to Suspicious Folder

Rule id : 1277f594-a7d1-4f28-a2d3-73af5cbeab43

Url	Pdf

file_event_win_shell_write_susp_files_extensions

Title : Windows Binaries Write Suspicious Extensions

Rule id : b8fd0e93-ff58-4cbd-8f48-1c114e342e62

Url	Pdf

file_event_win_startup_folder_file_write

Title : Startup Folder File Write

Rule id : 2aa0a6b4-a865-495b-ab51-c28249537b75

Url	Pdf
OTRF/detection-hackathon-apt29#12	pdf/8f190e7ee12b1b68f1d4c2169d59345a49871f4f6495a7882d14bfdf9b318b7e.pdf
https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md	pdf/f377389192a78b1d8cf756f286c34d554b97d7bdd10cd871f152679a5de7eab5.pdf

file_event_win_susp_binary_dropper

Title : Creation of an Executable by an Executable

Rule id : 297afac9-5d02-4138-8c58-b977bac60556

Url	Pdf

file_event_win_susp_colorcpl

Title : Suspicious Creation with Colorcpl

Rule id : e15b518d-b4ce-4410-a9cd-501f23ce4a18

Url	Pdf
https://twitter.com/eral4m/status/1480468728324231172?s=20	pdf/7b094f46661774f07922a70f300122852b4f9d4ac5257e4bc74051898005ae54.pdf

file_event_win_susp_creation_by_mobsync

Title : Created Files by Microsoft Sync Center

Rule id : 409f8a98-4496-4aaa-818a-c931c0a8b832

Url	Pdf
https://redcanary.com/blog/intelligence-insights-november-2021/	pdf/3c7a07a61c263df2a4c2fdc639cc0f72e052d3c61d08141b26e42f1361ca7d9b.pdf

file_event_win_susp_default_gpo_dir_write

Title : Suspicious Files in Default GPO Folder

Rule id : 5f87308a-0a5b-4623-ae15-d8fa1809bc60

Url	Pdf
https://redcanary.com/blog/intelligence-insights-november-2021/	pdf/3c7a07a61c263df2a4c2fdc639cc0f72e052d3c61d08141b26e42f1361ca7d9b.pdf

file_event_win_susp_desktop_ini

Title : Suspicious desktop.ini Action

Rule id : 81315b50-6b60-4d8f-9928-3466e1022515

Url	Pdf
https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/	pdf/c3db1bdf5748426cff03dbf7eca96f4fcac51d0894ecc7d2234225a9660e3cdf.pdf

file_event_win_susp_desktop_txt

Title : Suspicious Creation TXT File in User Desktop

Rule id : caf02a0a-1e1c-4552-9b48-5e070bd88d11

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1486/T1486.md#atomic-test-5---purelocker-ransom-note	pdf/c4af0c3dfc8bbbe60ef3d21bc9f7cbf5a18f39d82a098050a154f17b58b34062.pdf

file_event_win_susp_desktopimgdownldr_file

Title : Suspicious Desktopimgdownldr Target File

Rule id : fc4f4817-0c53-4683-a4ee-b17a64bc1039

Url	Pdf
https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/	pdf/ff794bdacc7c6b13095c3183dc997f14cbd42d7a6216910d330f4cb86a4c8707.pdf
https://twitter.com/SBousseaden/status/1278977301745741825	pdf/5a82fa5990c43eb3025b5184e0f326de88753b8cfcdd672333dd54f2e84f598c.pdf

file_event_win_susp_diagcab

Title : Creation of a Diagcab

Rule id : 3d0ed417-3d94-4963-a562-4a92c940656a

Url	Pdf
https://threadreaderapp.com/thread/1533879688141086720.html	pdf/0c2cb880bc6fd69df538f033671cb534d93417edb085c7ff8f588bda5baa3084.pdf

file_event_win_susp_double_extension

Title : Suspicious Double Extension Files

Rule id : b4926b47-a9d7-434c-b3a0-adc3fa0bd13e

Url	Pdf
https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/	pdf/e89d0a089970d45bce38fc338271fda7cd797d1fc5028c7eb4a53cfa7c92f4fe.pdf
https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations	pdf/c019919436cb99960638f7424809de5589996005d33b15e252881c47307937b9.pdf
https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles	pdf/85e0c3fea3583cabbb4860031a1c08516bf128e011531155110297298e3490b1.pdf
https://twitter.com/malwrhunterteam/status/1235135745611960321	pdf/71e46e2bb04bd4c093c69dd94ab9bec9c1a2a07b7aae487ade8bba11ed168c3c.pdf
https://twitter.com/luc4m/status/1073181154126254080	pdf/8a5ec3ad723a48924f899454c6850525ea0b8b3ab672929a77059f17fcc74d5b.pdf

file_event_win_susp_dpapi_backup_and_cert_export_ioc

Title : DPAPI Backup Keys And Certificate Export Activity IOC

Rule id : 7892ec59-c5bb-496d-8968-e5d210ca3ac4

Url	Pdf
https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/	pdf/c233b6f832a018994e294c01e9565de21e478edfd11cd9f58b6f1d13a7f1cd32.pdf
https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs#L28-L32	pdf/5c6668c6954298a6c1a125942ca2e14eecb3a9cdb7a01c78ecb5a349d6e6e199.pdf

file_event_win_susp_exchange_aspx_write

Title : Suspicious MSExchangeMailboxReplication ASPX Write

Rule id : 7280c9f3-a5af-45d0-916a-bc01cb4151c9

Url	Pdf
https://redcanary.com/blog/blackbyte-ransomware/	pdf/10e22a00a87210c9408d2d71d5b9e9edd453474d1a6f03489ae2a410620a1986.pdf

file_event_win_susp_executable_creation

Title : Suspicious Executable File Creation

Rule id : 74babdd6-a758-4549-9632-26535279e654

Url	Pdf
https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae	pdf/e0e273e4d2729ed2fab80b519f9cac844d8b48f068f4dc63bbd924bf4ac50399.pdf
https://app.any.run/tasks/76c69e2d-01e8-49d9-9aea-fb7cc0c4d3ad/	pdf/19d7a54de5ca98ca0bdeca9ac1f32ba323e40bee0940b1c616519dc594b7892a.pdf

file_event_win_susp_get_variable

Title : Suspicious Get-Variable.exe Creation

Rule id : 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b

Url	Pdf
https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/	pdf/d2a9c61e134556723e02acfa0c4a66b5017c51f4972c0115c7c0a1faeeb5cac4.pdf
https://www.joesandbox.com/analysis/465533/0/html	pdf/1b70caab5932527007b4f36ee59ffb6605fd37be439bb42277ce50e12cfd8904.pdf

file_event_win_susp_hidden_dir_index_allocation

Title : Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream

Rule id : a8f866e1-bdd4-425e-a27a-37619238d9c7

Url	Pdf
https://twitter.com/pfiatde/status/1681977680688738305	pdf/72647123597788957ac0ef431bfa9ea3975755dd892a3b1c01aa5ba1271b9d88.pdf
https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/	pdf/92c507c129969388ebaefef7c3e41139164421be3a231c29e3f3cd55d1f7cc49.pdf
https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/	pdf/f44eb974e1f14aea05eac8b197b7d5e2489a509b486f1f68514e2ae1fa0c1d0c.pdf
https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation	pdf/0ab01080b227fe5a12ebd6d16093afaf777d0223d59e28f9b3327ee1c802631f.pdf
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3	pdf/c9e8435eec1eb707c56a2bd6d485035df867952d8ec0225edd79f7ce290f99de.pdf

file_event_win_susp_homoglyph_filename

Title : Potential Homoglyph Attack Using Lookalike Characters in Filename

Rule id : 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6

Url	Pdf
https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish	pdf/cc8696978d031f256817318dae856f6d270d304477f6b30bf74ad9040115a8e9.pdf
http://www.irongeek.com/homoglyph-attack-generator.php	pdf/bb016e43c42c9c95b130d8343bcc342d65b284bb5e231965ef4f323daa433cdf.pdf

file_event_win_susp_legitimate_app_dropping_archive

Title : Legitimate Application Dropped Archive

Rule id : 654fcc6d-840d-4844-9b07-2c3300e54a26

Url	Pdf
https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326	pdf/08eb51a0c784fd98193550191179e02ff71425e779ab992c5f12aee24b6e0161.pdf

file_event_win_susp_legitimate_app_dropping_exe

Title : Legitimate Application Dropped Executable

Rule id : f0540f7e-2db3-4432-b9e0-3965486744bc

Url	Pdf
https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326	pdf/08eb51a0c784fd98193550191179e02ff71425e779ab992c5f12aee24b6e0161.pdf

file_event_win_susp_legitimate_app_dropping_script

Title : Legitimate Application Dropped Script

Rule id : 7d604714-e071-49ff-8726-edeb95a70679

Url	Pdf
https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326	pdf/08eb51a0c784fd98193550191179e02ff71425e779ab992c5f12aee24b6e0161.pdf

file_event_win_susp_lnk_double_extension

Title : Suspicious LNK Double Extension File Created

Rule id : 3215aa19-f060-4332-86d5-5602511f3ca8

Url	Pdf
https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/	pdf/e89d0a089970d45bce38fc338271fda7cd797d1fc5028c7eb4a53cfa7c92f4fe.pdf
https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations	pdf/c019919436cb99960638f7424809de5589996005d33b15e252881c47307937b9.pdf
https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles	pdf/85e0c3fea3583cabbb4860031a1c08516bf128e011531155110297298e3490b1.pdf
https://twitter.com/malwrhunterteam/status/1235135745611960321	pdf/71e46e2bb04bd4c093c69dd94ab9bec9c1a2a07b7aae487ade8bba11ed168c3c.pdf
https://twitter.com/luc4m/status/1073181154126254080	pdf/8a5ec3ad723a48924f899454c6850525ea0b8b3ab672929a77059f17fcc74d5b.pdf

file_event_win_susp_pfx_file_creation

Title : Suspicious PFX File Creation

Rule id : dca1b3e8-e043-4ec8-85d7-867f334b5724

Url	Pdf
OTRF/detection-hackathon-apt29#14	pdf/e799a521234ee152643a421d67bb5d3d54948aecb9dd1c837b191d9c570b9e36.pdf
https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/6.B.1_6392C9F1-D975-4F75-8A70-433DEDD7F622.md	pdf/6622d5ec03cd909516d1eda7e3e1aeb85223f6f3b564476fd464ad254668ac41.pdf

file_event_win_susp_powershell_profile

Title : PowerShell Profile Modification

Rule id : b5b78988-486d-4a80-b991-930eff3ff8bf

Url	Pdf
https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/	pdf/e8111a62c6f4a8edfa3d762e9f844cf68d84d05f90e40428e3220e4f176df0d1.pdf
https://persistence-info.github.io/Data/powershellprofile.html	pdf/d56eab37ec664496f7367afe651708963d8352484aa005158d4f2a57d3e6c917.pdf

file_event_win_susp_procexplorer_driver_created_in_tmp_folder

Title : Suspicious PROCEXP152.sys File Created In TMP

Rule id : 3da70954-0f2c-4103-adff-b7440368f50e

Url	Pdf
https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/	pdf/39f9e06b249cba1b01c10d09b9aa36e2e83dfa8dafeb31b1df72a64a6ecd9afb.pdf

file_event_win_susp_recycle_bin_fake_exec

Title : Suspicious File Creation Activity From Fake Recycle.Bin Folder

Rule id : cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca

Url	Pdf
https://www.mandiant.com/resources/blog/infected-usb-steal-secrets	pdf/fe587bfb0c663d36d368b89ae2fcb4d8d692aec8623b6525d877312df7697152.pdf
https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/	pdf/b3af56804ea988613b3ac26854aa3bb947a8e7a812118bb6feba27508439287e.pdf

file_event_win_susp_spool_drivers_color_drop

Title : Drop Binaries Into Spool Drivers Color Folder

Rule id : ce7066a6-508a-42d3-995b-2952c65dc2ce

Url	Pdf
https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/	pdf/eb58d80ccfdabc5d355f794f6416b69507a01a1d1c3b7e62b66ffd62be77492e.pdf

file_event_win_susp_startup_folder_persistence

Title : Suspicious Startup Folder Persistence

Rule id : 28208707-fe31-437f-9a7f-4b1108b94d2e

Url	Pdf
https://github.com/last-byte/PersistenceSniper	pdf/9894989623f57f0f9b9c1615be3ada4dbea3df0ce4c14683f2a141140b1a19c7.pdf

file_event_win_susp_system_interactive_powershell

Title : Suspicious Interactive PowerShell as SYSTEM

Rule id : 5b40a734-99b6-4b98-a1d0-1cea51a08ab2

Url	Pdf
https://jpcertcc.github.io/ToolAnalysisResultSheet/details/PowerSploit_Invoke-Mimikatz.htm	pdf/94cc46fa857a50cb4ed48f675e2bc82d49db279b37d2417dab7ea3a4027c2f83.pdf

file_event_win_susp_task_write

Title : Suspicious Scheduled Task Write to System32 Tasks

Rule id : 80e1f67a-4596-4351-98f5-a9c3efabac95

Url	Pdf

file_event_win_susp_teamviewer_remote_session

Title : TeamViewer Remote Session

Rule id : 162ab1e4-6874-4564-853c-53ec3ab8be01

Url	Pdf
https://www.teamviewer.com/en-us/	pdf/f573fa89a04980cfcad07e9e53abe622d4a65577b1f7beb0719069824a851467.pdf

file_event_win_susp_vscode_powershell_profile

Title : VsCode Powershell Profile Modification

Rule id : 3a9fa2ec-30bc-4ebd-b49e-7c9cff225502

Url	Pdf
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.2	pdf/19cabaec8c205116f651ab50f986d1418e9d55d60e1714d3366592d49715c6be.pdf

file_event_win_susp_windows_terminal_profile

Title : Windows Terminal Profile Settings Modification By Uncommon Process

Rule id : 9b64de98-9db3-4033-bd7a-f51430105f00

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1547.015/T1547.015.md#atomic-test-1---persistence-by-modifying-windows-terminal-profile	pdf/9320b277c3c2e0456f256080b13bd6b3e09acb42b86e7de3b77f251ce81522b9.pdf
https://twitter.com/nas_bench/status/1550836225652686848	pdf/93b04a4f78ceb65f82424fa501803bb66a1a971c3e3071e08ef288250c6e23ba.pdf

file_event_win_susp_winsxs_binary_creation

Title : WinSxS Executable File Creation By Non-System Process

Rule id : 34746e8c-5fb8-415a-b135-0abc167e912a

Url	Pdf

file_event_win_sysinternals_livekd_default_dump_name

Title : LiveKD Kernel Memory Dump File Created

Rule id : 814ddeca-3d31-4265-8e07-8cc54fb44903

Url	Pdf

file_event_win_sysinternals_livekd_driver

Title : LiveKD Driver Creation

Rule id : 16fe46bb-4f64-46aa-817d-ff7bec4a2352

Url	Pdf

file_event_win_sysinternals_livekd_driver_susp_creation

Title : LiveKD Driver Creation By Uncommon Process

Rule id : 059c5af9-5131-4d8d-92b2-de4ad6146712

Url	Pdf

file_event_win_sysinternals_procexp_driver_susp_creation

Title : Process Explorer Driver Creation By Non-Sysinternals Binary

Rule id : de46c52b-0bf8-4936-a327-aace94f94ac6

Url	Pdf
https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer	pdf/dab33e764f4794d6cbb469e252f753e7d743594faac5c71af9059b4908cce60d.pdf
https://github.com/Yaxser/Backstab	pdf/8fa3127dd364888032049d96bc4950c117fe0454fa684671bf81220f494fe7d2.pdf
https://www.elastic.co/security-labs/stopping-vulnerable-driver-attacks	pdf/d4c0669c840c5489adf9cfa32018cab030dfce7dc1537daa7b92f118bda26766.pdf
https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/	pdf/0ef2d18ae4b87e42bf40d3eda20c584816120a8448707ed0b653f2af386eb6a9.pdf

file_event_win_sysinternals_procmon_driver_susp_creation

Title : Process Monitor Driver Creation By Non-Sysinternals Binary

Rule id : a05baa88-e922-4001-bc4d-8738135f27de

Url	Pdf

file_event_win_sysinternals_psexec_service

Title : PsExec Service File Creation

Rule id : 259e5a6a-b8d2-4c38-86e2-26c5e651361d

Url	Pdf
https://www.jpcert.or.jp/english/pub/sr/ir_research.html	pdf/f769cc934a22537ade2e2a582fd8a8d98063fb079f8f6edfb11249ef79ade5f1.pdf
https://jpcertcc.github.io/ToolAnalysisResultSheet	pdf/7991aee3378f9b38850493f0223352864c91f4444c8cd24d80d4401b0cdaf7fa.pdf

file_event_win_sysinternals_psexec_service_key

Title : PSEXEC Remote Execution File Artefact

Rule id : 304afd73-55a5-4bb9-8c21-0b1fc84ea9e4

Url	Pdf
https://aboutdfir.com/the-key-to-identify-psexec/	pdf/39af768f63488d748088c3312f83038a17817c609dd954d919d1caff1ade3730.pdf
https://twitter.com/davisrichardg/status/1616518800584704028	pdf/aff2029424f7152237940de30aef3cb07460b1b3bc4d559af6c7c89f5ec790ea.pdf

file_event_win_system32_local_folder_privilege_escalation

Title : Potential Privilege Escalation Attempt Via .Exe.Local Technique

Rule id : 07a99744-56ac-40d2-97b7-2095967b0e03

Url	Pdf
https://github.com/binderlabs/DirCreate2System	pdf/557f25bd685071f7b5d74c8a5bb20857ce82489185d39ee2fc5ccb4685c20f2c.pdf
https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt	pdf/e89db25d174bd3a7f304a2cefe7b9977be1cc54cd3b7b7aee3e5469abd52b27c.pdf

file_event_win_taskmgr_lsass_dump

Title : LSASS Process Memory Dump Creation Via Taskmgr.EXE

Rule id : 69ca12af-119d-44ed-b50f-a47af0ebc364

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1003.001/T1003.001.md#L1	pdf/696ec40df4933acf0c191177ed5da3219462845057d2ac80f53d23fe8284a2f7.pdf

file_event_win_tsclient_filewrite_startup

Title : Hijack Legit RDP Session to Move Laterally

Rule id : 52753ea4-b3a0-4365-910d-36cff487b789

Url	Pdf

file_event_win_uac_bypass_consent_comctl32

Title : UAC Bypass Using Consent and Comctl32 - File

Rule id : 62ed5b55-f991-406a-85d9-e8e8fdf18789

Url	Pdf
https://github.com/hfiref0x/UACME	pdf/d83252bc27a4be387e3207cef6aa3e0a7433677c314506a6cdd0ad98d290043e.pdf

file_event_win_uac_bypass_dotnet_profiler

Title : UAC Bypass Using .NET Code Profiler on MMC

Rule id : 93a19907-d4f9-4deb-9f91-aac4692776a6

Url	Pdf
https://github.com/hfiref0x/UACME	pdf/d83252bc27a4be387e3207cef6aa3e0a7433677c314506a6cdd0ad98d290043e.pdf

file_event_win_uac_bypass_eventvwr

Title : UAC Bypass Using EventVwr

Rule id : 63e4f530-65dc-49cc-8f80-ccfa95c69d43

Url	Pdf
https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw	pdf/c829cf48080211ca1b960cd2433df53d8820408d5695e662f0ae0bcea17fb087.pdf
https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g	pdf/8590efc081fa9281958cc06cd3e79d599ec6f8b078636c116f61f8ef33cfbeb8.pdf
https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute	pdf/9a6cb3792e47b5c69109a47522d0dd88ece09bcba294e3f317b293f5908cd3b0.pdf

file_event_win_uac_bypass_idiagnostic_profile

Title : UAC Bypass Using IDiagnostic Profile - File

Rule id : 48ea844d-19b1-4642-944e-fe39c2cc1fec

Url	Pdf
https://github.com/Wh04m1001/IDiagnosticProfileUAC	pdf/a6c3acd751f5259ad360bd5a21657c38841fb9c8950b510090a16f1927fd89a9.pdf

file_event_win_uac_bypass_ieinstal

Title : UAC Bypass Using IEInstal - File

Rule id : bdd8157d-8e85-4397-bb82-f06cc9c71dbb

Url	Pdf
https://github.com/hfiref0x/UACME	pdf/d83252bc27a4be387e3207cef6aa3e0a7433677c314506a6cdd0ad98d290043e.pdf

file_event_win_uac_bypass_msconfig_gui

Title : UAC Bypass Using MSConfig Token Modification - File

Rule id : 41bb431f-56d8-4691-bb56-ed34e390906f

Url	Pdf
https://github.com/hfiref0x/UACME	pdf/d83252bc27a4be387e3207cef6aa3e0a7433677c314506a6cdd0ad98d290043e.pdf

file_event_win_uac_bypass_ntfs_reparse_point

Title : UAC Bypass Using NTFS Reparse Point - File

Rule id : 7fff6773-2baa-46de-a24a-b6eec1aba2d1

Url	Pdf
https://github.com/hfiref0x/UACME	pdf/d83252bc27a4be387e3207cef6aa3e0a7433677c314506a6cdd0ad98d290043e.pdf

file_event_win_uac_bypass_winsat

Title : UAC Bypass Abusing Winsat Path Parsing - File

Rule id : 155dbf56-e0a4-4dd0-8905-8a98705045e8

Url	Pdf
https://github.com/hfiref0x/UACME	pdf/d83252bc27a4be387e3207cef6aa3e0a7433677c314506a6cdd0ad98d290043e.pdf

file_event_win_uac_bypass_wmp

Title : UAC Bypass Using Windows Media Player - File

Rule id : 68578b43-65df-4f81-9a9b-92f32711a951

Url	Pdf
https://github.com/hfiref0x/UACME	pdf/d83252bc27a4be387e3207cef6aa3e0a7433677c314506a6cdd0ad98d290043e.pdf

file_event_win_vhd_download_via_browsers

Title : VHD Image Download Via Browser

Rule id : 8468111a-ef07-4654-903b-b863a80bbc95

Url	Pdf
https://redcanary.com/blog/intelligence-insights-october-2021/	pdf/389158ad16e7436bfb215a649009124d1b4c7522ccca8703479dc8b6e62f238d.pdf
https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/	pdf/23231c4a62559ba492e5440557a282ef872779ab8232cf7e913edefe824d7e4d.pdf
https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/	pdf/84e47d895c79a225a88cf6dfadc42a3383caa3b8f3ac5142680b4629d1af8a32.pdf

file_event_win_vscode_tunnel_indicators

Title : VsCode Code Tunnel Execution File Indicator

Rule id : 9661ec9d-4439-4a7a-abed-d9be4ca43b6d

Url	Pdf
https://ipfyx.fr/post/visual-studio-code-tunnel/	pdf/810100d7bf8781952159cd9be60cb407088eb4c77dee3be22a8adb62f8b1badd.pdf
https://badoption.eu/blog/2023/01/31/code_c2.html	pdf/5387bce5a807b2fb5aa49c5cfe6a8f220597ca3a34b892e2b6c42bcbe90f2048.pdf

file_event_win_vscode_tunnel_remote_creation_artefacts

Title : Visual Studio Code Tunnel Remote File Creation

Rule id : 56e05d41-ce99-4ecd-912d-93f019ee0b71

Url	Pdf

file_event_win_vscode_tunnel_renamed_execution

Title : Renamed VsCode Code Tunnel Execution - File Indicator

Rule id : d102b8f5-61dc-4e68-bd83-9a3187c67377

Url	Pdf
https://ipfyx.fr/post/visual-studio-code-tunnel/	pdf/810100d7bf8781952159cd9be60cb407088eb4c77dee3be22a8adb62f8b1badd.pdf
https://badoption.eu/blog/2023/01/31/code_c2.html	pdf/5387bce5a807b2fb5aa49c5cfe6a8f220597ca3a34b892e2b6c42bcbe90f2048.pdf

file_event_win_webdav_tmpfile_creation

Title : WebDAV Temporary Local File Creation

Rule id : 4c55738d-72d8-490e-a2db-7969654e375f

Url	Pdf
https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html	pdf/e932850373ecf13d3069e33dcf6c29a315d0164cd2e2ff496cca2da31cd89f2d.pdf
https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462	pdf/fde37b57cf73a55f1d4b3014e1c6c529151591399d4f2d2e07c830f4e06b2948.pdf
https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4	pdf/f3c251465868f9b5d5eef7ae78b505c4960ad83a1f52c781e0d02a5290af93dd.pdf

file_event_win_webshell_creation_detect

Title : Potential Webshell Creation On Static Website

Rule id : 39f1f9f2-9636-45de-98f6-a4046aa8e4b9

Url	Pdf
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md	pdf/026f0c1a728c8ccc99ba23f16e38064897f1723a54ef54a996e1e74ad1d7c7f9.pdf

file_event_win_werfault_dll_hijacking

Title : Creation of an WerFault.exe in Unusual Folder

Rule id : 28a452f3-786c-4fd8-b8f2-bddbe9d616d1

Url	Pdf
https://www.bleepingcomputer.com/news/security/hackers-are-now-hiding-malware-in-windows-event-logs/	pdf/98ee9591f3f9db5d2cb8dc74cc4dab135feac15681f271898370ad313a6cce46.pdf

file_event_win_winrm_awl_bypass

Title : AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File

Rule id : d353dac0-1b41-46c2-820c-d7d2561fc6ed

Url	Pdf
https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404	pdf/e98d8d3db2eea6ae4abe7781fa247fc38d7f93d94a9c3dd518895d2c01025925.pdf

file_event_win_wmi_persistence_script_event_consumer_write

Title : WMI Persistence - Script Event Consumer File Write

Rule id : 33f41cdd-35ac-4ba8-814b-c6a4244a1ad4

Url	Pdf
https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/	pdf/004ad9fb23567ac10f1e6fb8d05c093085a2265e916adb38e141b21aab7a1f43.pdf

file_event_win_wmiexec_default_filename

Title : Wmiexec Default Output File

Rule id : 8d5aca11-22b3-4f22-b7ba-90e60533e1fb

Url	Pdf
https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/	pdf/8ed23808a280fd21c05f25f80e987d0ad5a4c009378b8ec8ceee98ce757f5ee9.pdf
https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py	pdf/a454e9d528edebcbea4addaa2626f055b0110d97377ad7fe5fb8c5b214ad93f1.pdf

file_event_win_wmiprvse_wbemcomn_dll_hijack

Title : Wmiprvse Wbemcomn DLL Hijack - File

Rule id : 614a7e17-5643-4d89-b6fe-f9df1a79641c

Url	Pdf
https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html	pdf/48fa2f0c27fb84efdab4a9f87c0c08dc3bbcbeed8ccb2e3cb0c99392188266c3.pdf

file_event_win_wpbbin_persistence

Title : UEFI Persistence Via Wpbbin - FileCreation

Rule id : e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f

Url	Pdf
https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c	pdf/b57169da0f566a74efbc4d822c66c6408aa421fc362039a2727f3220d5023bc7.pdf
https://persistence-info.github.io/Data/wpbbin.html	pdf/a6f96ee2e4c7d558f668fb7ac77b3f1429b93381bdd3d9336ab109a4b96359cc.pdf

file_event_win_writing_local_admin_share

Title : Writing Local Admin Share

Rule id : 4aafb0fa-bff5-4b9d-b99e-8093e659c65f

Url	Pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-4---execute-command-writing-output-to-local-admin-share	pdf/bfefcd88922b98601c2a8c56971e514e8e0f582c5e8f82ee60491d9742f02646.pdf

file_executable_detected_win_susp_embeded_sed_file

Title : Potentially Suspicious Self Extraction Directive File Created

Rule id : ab90dab8-c7da-4010-9193-563528cfa347

Url	Pdf
https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html	pdf/9f5fd923f950098bb27ed8ffeae8be93b2429feb64a1ad75a112481c62191854.pdf
https://en.wikipedia.org/wiki/IExpress	pdf/f506a51c3a4432de1e152d9e05563973cd22d69c53e3c2cf96eb422cbdc3f468.pdf
https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior	pdf/98bebe4accf58e785887fc1dc9197fbfd2c3725d0b83ecff9af65d0707bdf0fc.pdf

file_rename_win_non_dll_to_dll_ext

Title : Non-DLL Extension File Renamed With DLL Extension

Rule id : bbfd974c-248e-4435-8de6-1e938c79c5c1

Url	Pdf
https://twitter.com/ffforward/status/1481672378639912960	pdf/739067659ce5fe24846876c027683dc34dd3c9cef7a2ef65113a58138bc7379a.pdf
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036/T1036.md#atomic-test-1---system-file-copied-to-unusual-location	pdf/e253e19ebfe0ea118a8fae491f20d307e347d5dd89e1f2be15b6cf7d91590b27.pdf

file_rename_win_ransomware

Title : Suspicious Appended Extension

Rule id : e3f673b3-65d1-4d80-9146-466f8b63fa99

Url	Pdf
https://app.any.run/tasks/d66ead5a-faf4-4437-93aa-65785afaf9e5/	pdf/9fc105d32e43c273deb022f74a5d7e46c244d0cef836dd22f337642994d1c1bb.pdf
https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/	pdf/001871740755751cd0793e81026f25179b60855651228db3cc0be115145a0a49.pdf

fortios_sslvpnd_exploit_cve_2022_42475_exploitation_indicators

Title : Exploitation Indicator Of CVE-2022-42475

Rule id : 293ccb8c-bed8-4868-8296-bef30e303b7e

Url	Pdf
https://www.fortiguard.com/psirt/FG-IR-22-398	pdf/34b1261b57dd472177b218b08d0a6c55a9fbb16332d6ff38d1de0ed023ed2625.pdf
https://www.bleepingcomputer.com/news/security/fortinet-says-ssl-vpn-pre-auth-rce-bug-is-exploited-in-attacks/	pdf/03b78d04fc68c94c745005fcfb1e0c570fb2e2ed42b265112cfadfb195af6984.pdf
https://www.deepwatch.com/labs/customer-advisory-fortios-ssl-vpn-vulnerability-cve-2022-42475-exploited-in-the-wild/	pdf/0c5bbbe8b7bc8ddae1a747100a703bc884753dbaf823145b96f53ceaddff791d.pdf
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Critical-vulnerability-Protect-against-heap-based/ta-p/239420	pdf/ebda22bd643d7a1db16a6137758a5350253173660dcca8ac6c829b5498a1057a.pdf

Files

references_f.md

Latest commit

History