| splunk |
Impacket Lateral Movement WMIExec Commandline Parameters |
production |
2026-10-09 |
| splunk |
Possible Lateral Movement PowerShell Spawn |
production |
2026-10-09 |
| splunk |
Windows Remote Create Service |
production |
2026-10-09 |
| splunk |
Windows Cloud Files Filter Loaded by Uncommon Process |
production |
2026-10-08 |
| elastic |
Suspicious Service was Installed in the System |
production |
2026-10-06 |
| splunk |
Windows Service Create with Tscon |
production |
2026-10-02 |
| splunk |
Windows Admin Password Changed by Non-Admin |
production |
2026-09-23 |
| splunk |
Windows Vulnerable Driver Installed |
production |
2026-09-22 |
| splunk |
Windows Vulnerable Driver Loaded |
production |
2026-09-22 |
| elastic |
Anomalous Process For a Linux Population |
production |
2026-09-18 |
| elastic |
Unusual Windows Path Activity |
production |
2026-09-18 |
| elastic |
Unusual Process For a Windows Host |
production |
2026-09-18 |
| elastic |
Windows Service Installed via an Unusual Client |
production |
2026-09-18 |
| elastic |
Service Control Spawned via Script Interpreter |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Service ImagePath Modification |
production |
2026-09-18 |
| elastic |
Service Creation via Local Kerberos Authentication |
production |
2026-09-18 |
| elastic |
Creation or Modification of a new GPO Scheduled Task or Service |
production |
2026-09-18 |
| elastic |
First Time Seen Driver Loaded |
production |
2026-09-18 |
| elastic |
Persistence via WMI Standard Registry Provider |
production |
2026-09-18 |
| elastic |
Persistence via Update Orchestrator Service Hijack |
production |
2026-09-18 |
| elastic |
System Shells via Services |
production |
2026-09-18 |
| elastic |
Suspicious ImagePath Service Creation |
production |
2026-09-18 |
| elastic |
Unusual Persistence via Services Registry |
production |
2026-09-18 |
| elastic |
Unsigned DLL Loaded by Svchost |
production |
2026-09-18 |
| elastic |
Remote Windows Service Installed |
production |
2026-09-18 |
| elastic |
Service Command Lateral Movement |
production |
2026-09-18 |
| elastic |
Service DACL Modification via sc.exe |
production |
2026-09-18 |
| elastic |
Potential Evasion via Boot Time Removal Tool |
production |
2026-09-18 |
| elastic |
Suspicious ScreenConnect Client Child Process |
production |
2026-09-18 |
| elastic |
Unusual Windows Service |
production |
2026-09-18 |
| splunk |
XMRIG Driver Loaded |
deprecated |
2026-09-08 |
| sigma |
ServiceDll Hijack |
test |
2026-08-31 |
| sigma |
Sysinternals PsSuspend Execution |
test |
2026-06-29 |
| sigma |
Sysinternals PsService Execution |
test |
2026-06-29 |
| splunk |
Windows Service Create RemComSvc |
production |
2026-05-13 |
| splunk |
CMD Echo Pipe - Escalation |
production |
2026-05-13 |
| splunk |
Impacket Lateral Movement Commandline Parameters |
production |
2026-05-13 |
| splunk |
Impacket Lateral Movement smbexec CommandLine Parameters |
production |
2026-05-13 |
| splunk |
Randomly Generated Windows Service Name |
experimental |
2026-05-13 |
| splunk |
Services LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
Windows Bluetooth Service Installed From Uncommon Location |
production |
2026-05-13 |
| splunk |
Windows KrbRelayUp Service Creation |
production |
2026-05-13 |
| splunk |
Windows Service Create Kernel Mode Driver |
production |
2026-05-13 |
| splunk |
Windows Service Creation on Remote Endpoint |
production |
2026-05-13 |
| splunk |
Windows Service Initiation on Remote Endpoint |
production |
2026-05-13 |
| splunk |
Windows Suspicious Driver Loaded Path |
production |
2026-05-13 |
| splunk |
Windows MsMpEng Writing to System32 |
production |
2026-04-27 |
| sigma |
Devcon Execution Disabling VMware VMCI Device |
experimental |
2026-01-02 |
| sigma |
PUA - Kernel Driver Utility (KDU) Execution |
experimental |
2026-01-02 |
| sigma |
Special File Creation via Mknod Syscall |
experimental |
2025-12-05 |
| sigma |
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE |
test |
2025-10-22 |
| sigma |
New Kernel Driver Via SC.EXE |
test |
2025-10-07 |
| sigma |
New Service Creation Using Sc.EXE |
test |
2025-09-01 |
| sigma |
Remote Access Tool Services Have Been Installed - Security |
test |
2024-12-07 |
| sigma |
Vulnerable HackSys Extreme Vulnerable Driver Load |
test |
2024-11-23 |
| sigma |
Vulnerable WinRing0 Driver Load |
test |
2024-11-23 |
| sigma |
Potential CobaltStrike Service Installations - Registry |
test |
2024-03-25 |
| sigma |
Suspicious Service Installation Script |
test |
2024-03-05 |
| sigma |
Uncommon Service Installation Image Path |
test |
2024-02-09 |
| sigma |
Service Installation in Suspicious Folder |
test |
2024-01-18 |
| sigma |
Suspicious Service Installation |
test |
2023-12-04 |
| sigma |
Vulnerable Driver Load By Name |
test |
2023-12-02 |
| sigma |
Vulnerable Driver Load |
test |
2023-12-02 |
| sigma |
Malicious Driver Load By Name |
test |
2023-12-02 |
| sigma |
Malicious Driver Load |
test |
2023-12-02 |
| sigma |
Remote Access Tool Services Have Been Installed - System |
test |
2023-06-22 |
| sigma |
Moriya Rootkit File Created |
test |
2023-05-05 |
| sigma |
OilRig APT Activity |
test |
2023-03-08 |
| sigma |
OilRig APT Schedule Task Persistence - System |
test |
2023-03-08 |
| sigma |
OilRig APT Schedule Task Persistence - Security |
test |
2023-03-08 |
| sigma |
OilRig APT Registry Persistence |
test |
2023-03-08 |
| sigma |
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE |
test |
2023-02-28 |
| sigma |
PSEXEC Remote Execution File Artefact |
test |
2023-02-23 |
| sigma |
New Service Creation Using PowerShell |
test |
2023-02-20 |
| sigma |
Potential Persistence Attempt Via Existing Service Tampering |
test |
2023-02-04 |
| sigma |
ProcessHacker Privilege Elevation |
test |
2022-12-25 |
| sigma |
Moriya Rootkit - System |
test |
2022-11-29 |
| sigma |
CobaltStrike Service Installations - Security |
test |
2022-11-27 |
| sigma |
CobaltStrike Service Installations - System |
test |
2022-11-27 |
| sigma |
Suspicious Service Path Modification |
test |
2022-11-18 |
| sigma |
Suspicious New Service Creation |
test |
2022-11-18 |
| sigma |
Suspicious Service DACL Modification Via Set-Service Cmdlet |
test |
2022-10-18 |
| sigma |
CosmicDuke Service Installation |
test |
2022-10-09 |
| sigma |
Sliver C2 Default Service Installation |
test |
2022-08-25 |
| sigma |
New PDQDeploy Service - Client Side |
test |
2022-07-22 |
| sigma |
New PDQDeploy Service - Server Side |
test |
2022-07-22 |
| sigma |
Service Installation with Suspicious Folder Pattern |
test |
2022-03-24 |
| sigma |
Turla PNG Dropper Service |
test |
2021-11-30 |
| sigma |
StoneDrill Service Install |
test |
2021-11-30 |
| sigma |
Turla Service Install |
test |
2021-11-30 |
| sigma |
Driver Load From A Temporary Directory |
test |
2021-11-27 |