| splunk |
Windows InstallUtil in Non Standard Path |
production |
2026-10-09 |
| elastic |
Suspicious Microsoft Diagnostics Wizard Execution |
production |
2026-10-09 |
| splunk |
Windows DotNet Binary in Non Standard Path |
production |
2026-10-02 |
| splunk |
System Processes Run From Unexpected Locations |
production |
2026-10-02 |
| sigma |
Renamed Schtasks Execution |
experimental |
2026-10-02 |
| splunk |
Windows Renamed Command Interpreter was Executed |
production |
2026-09-23 |
| splunk |
Windows Renamed Python Binary was Executed |
production |
2026-09-23 |
| splunk |
Windows Renamed Popular 3rd Party Software was Executed |
production |
2026-09-23 |
| splunk |
Windows Renamed LOLBAS Binary was Executed |
production |
2026-09-23 |
| splunk |
Windows Renamed Powershell Execution |
deprecated |
2026-09-23 |
| splunk |
Windows LOLBAS Executed As Renamed File |
deprecated |
2026-09-23 |
| splunk |
Suspicious MSBuild Rename |
deprecated |
2026-09-23 |
| splunk |
Suspicious microsoft workflow compiler rename |
deprecated |
2026-09-23 |
| elastic |
System Binary Moved or Copied |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration via Rclone |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution via Renamed PsExec Executable |
production |
2026-09-18 |
| elastic |
Renamed Utility Executed with Short Program Name |
production |
2026-09-18 |
| elastic |
Renamed Automation Script Interpreter |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft Antimalware Service Execution |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Using an Alternate Name |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Renamed COM+ Services DLL |
production |
2026-09-18 |
| elastic |
Potential Kubectl Masquerading via Unexpected Process |
production |
2026-09-18 |
| elastic |
Suspicious Renaming of ESXI Files |
production |
2026-09-18 |
| sigma |
Potential Defense Evasion Via Rename Of Highly Relevant Binaries |
test |
2026-06-29 |
| sigma |
Renamed ProcDump Execution |
test |
2026-06-29 |
| sigma |
Potential Defense Evasion Via Binary Rename |
test |
2026-06-05 |
| sigma |
Suspicious Start-Process PassThru |
test |
2026-05-18 |
| splunk |
Suspicious Copy on System32 |
production |
2026-05-13 |
| splunk |
Suspicious msbuild path |
production |
2026-05-13 |
| splunk |
Execution of File with Multiple Extensions |
production |
2026-05-13 |
| sigma |
Suspicious Download From File-Sharing Website Via Bitsadmin |
test |
2026-03-29 |
| sigma |
Suspicious Copy From or To System Directory |
test |
2026-03-16 |
| elastic |
Deprecated - Suspicious Renaming of ESXI index.html File |
deprecated |
2026-02-04 |
| sigma |
File Download Via Bitsadmin To A Suspicious Target Folder |
test |
2025-12-10 |
| sigma |
Renamed Office Binary Execution |
test |
2025-12-09 |
| sigma |
LOL-Binary Copied From System Directory |
test |
2025-11-27 |
| sigma |
Potential PendingFileRenameOperations Tampering |
test |
2025-10-07 |
| sigma |
Remote Access Tool - Renamed MeshAgent Execution - Windows |
experimental |
2025-05-19 |
| sigma |
Remote Access Tool - Renamed MeshAgent Execution - MacOS |
experimental |
2025-05-19 |
| sigma |
Windows Processes Suspicious Parent Directory |
test |
2025-03-06 |
| sigma |
Renamed Powershell Under Powershell Channel |
test |
2025-01-20 |
| sigma |
Masquerading as Linux Crond Process |
test |
2023-08-22 |
| sigma |
File With Suspicious Extension Downloaded Via Bitsadmin |
test |
2023-05-30 |
| sigma |
Potential WerFault ReflectDebugger Registry Value Abuse |
test |
2023-05-18 |
| sigma |
Potential Homoglyph Attack Using Lookalike Characters in Filename |
test |
2023-05-08 |
| sigma |
Potential Homoglyph Attack Using Lookalike Characters |
test |
2023-05-07 |
| sigma |
Ps.exe Renamed SysInternals Tool |
test |
2023-05-02 |
| sigma |
PUA - Potential PE Metadata Tamper Using Rcedit |
test |
2023-03-05 |
| sigma |
Suspicious Download From Direct IP Via Bitsadmin |
test |
2023-02-15 |
| sigma |
File Download Via Bitsadmin |
test |
2023-02-15 |
| sigma |
Renamed Msdt.EXE Execution |
test |
2023-02-03 |
| sigma |
Renamed BrowserCore.EXE Execution |
test |
2023-02-03 |
| sigma |
Renamed Jusched.EXE Execution |
test |
2023-02-03 |