| elastic |
Potential Lateral Tool Transfer via SMB Share |
production |
2026-10-19 |
| elastic |
Scheduled Task Execution at Scale via GPO |
production |
2026-10-06 |
| elastic |
Unusual Remote File Size |
production |
2026-09-18 |
| elastic |
Remote File Copy to a Hidden Share |
production |
2026-09-18 |
| elastic |
Remote Execution via File Shares |
production |
2026-09-18 |
| elastic |
Spike in Remote File Transfers |
production |
2026-09-18 |
| elastic |
Unusual Remote File Directory |
production |
2026-09-18 |
| elastic |
Remote File Creation in World Writeable Directory |
production |
2026-09-18 |
| elastic |
Web Server Spawned via Python |
production |
2026-09-18 |
| elastic |
Unusual Remote File Extension |
production |
2026-09-18 |
| elastic |
Lateral Movement via Startup Folder |
production |
2026-09-18 |
| elastic |
Execution via TSClient Mountpoint |
production |
2026-09-18 |
| elastic |
Potential Ransomware Behavior - Note Files by System |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a WebDav Share |
production |
2026-09-18 |
| elastic |
PsExec Network Connection |
production |
2026-09-18 |
| elastic |
Unusual Remote File Creation |
production |
2026-09-18 |
| suricata |
ET INFO Powershell Command With Encoded Argument Over SMB - Likely Lateral Movement |
rev 2 |
2026-04-27 |
| snort |
ET POLICY Powershell Command With Encoded Argument Over SMB - Likely Lateral Movement |
rev 2 |
2026-04-27 |
| sigma |
Potentially Suspicious File Creation by OpenEDR's ITSMService |
experimental |
2026-02-19 |
| snort |
ET INFO schtasks end Command in HTTP Body Response |
rev 1 |
2025-09-15 |
| suricata |
ET HUNTING schtasks change Command in HTTP Body Response |
rev 1 |
2025-09-15 |
| suricata |
ET HUNTING schtasks delete Command in HTTP Body Response |
rev 1 |
2025-09-15 |
| suricata |
ET HUNTING schtasks end Command in HTTP Body Response |
rev 1 |
2025-09-15 |
| suricata |
ET HUNTING schtasks run Command in HTTP Body Response |
rev 1 |
2025-09-15 |
| snort |
ET INFO schtasks change Command in HTTP Body Response |
rev 1 |
2025-09-15 |
| snort |
ET INFO schtasks delete Command in HTTP Body Response |
rev 1 |
2025-09-15 |
| snort |
ET INFO schtasks run Command in HTTP Body Response |
rev 1 |
2025-09-15 |
| suricata |
ET INFO WinRM wsman Access - Possible Lateral Movement |
rev 4 |
2024-04-13 |
| suricata |
ET INFO Possible winexe over SMB - Possible Lateral Movement |
rev 4 |
2024-03-07 |
| sigma |
SMB over QUIC Via Net.EXE |
test |
2023-07-21 |
| sigma |
SMB over QUIC Via PowerShell Script |
test |
2023-07-21 |
| sigma |
Rundll32 Execution Without Parameters |
test |
2023-02-28 |
| sigma |
PSEXEC Remote Execution File Artefact |
test |
2023-02-23 |
| sigma |
Metasploit Or Impacket Service Installation Via SMB PsExec |
test |
2022-10-05 |
| snort |
ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Lateral Movement Activity |
rev 1 |
2022-01-10 |
| suricata |
ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Lateral Movement Activity |
rev 1 |
2022-01-10 |
| snort |
ET TROJAN [CISA AA21-291A] Possible BlackMatter Ransomware Lateral Movement |
rev 2 |
2021-10-19 |
| suricata |
ET MALWARE [CISA AA21-291A] Possible BlackMatter Ransomware Lateral Movement |
rev 2 |
2021-10-19 |
| snort |
ET NETBIOS DCERPC DCOM ExecuteShellCommand Call - Likely Lateral Movement |
rev 2 |
2021-05-06 |
| suricata |
ET NETBIOS DCERPC DCOM ExecuteShellCommand Call - Likely Lateral Movement |
rev 2 |
2021-05-06 |
| snort |
ET POLICY Possible winexe over SMB - Possible Lateral Movement |
rev 3 |
2020-11-10 |
| suricata |
ET INFO WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With Hidden Window Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
ET INFO RunDll Request Over SMB - Likely Lateral Movement |
rev 3 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With Hidden Window Argument Over SMB - Likely Lateral Movement |
rev 3 |
2019-07-26 |
| suricata |
ET INFO SMB Remote AT Scheduled Job Create Request - Possible Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET INFO SMB2 NT Create AndX Request For a .sys File - Possible Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET INFO SMB NT Create AndX Request For a .sys File - Possible Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET INFO SMB2 NT Create AndX Request For a DLL File - Possible Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET INFO WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 3 |
2019-07-26 |
| suricata |
ET INFO WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET INFO WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| snort |
ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 3 |
2019-04-16 |
| snort |
ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 3 |
2019-04-16 |
| snort |
ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 3 |
2019-04-16 |
| snort |
ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 2 |
2019-04-16 |
| snort |
ET POLICY Powershell Command With Hidden Window Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY WinRM wsman Access - Possible Lateral Movement |
rev 2 |
2019-01-23 |
| snort |
ET POLICY Powershell Command With Hidden Window Argument Over SMB - Likely Lateral Movement |
rev 2 |
2018-07-17 |
| snort |
ET POLICY RunDll Request Over SMB - Likely Lateral Movement |
rev 2 |
2018-07-17 |
| snort |
ET POLICY Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement |
rev 1 |
2018-07-17 |
| snort |
ET POLICY Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement |
rev 1 |
2018-07-17 |
| snort |
ET POLICY Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement |
rev 1 |
2018-07-17 |
| snort |
ET POLICY SMB2 NT Create AndX Request For a DLL File - Possible Lateral Movement |
rev 2 |
2018-07-16 |
| snort |
ET POLICY SMB2 NT Create AndX Request For a .sys File - Possible Lateral Movement |
rev 2 |
2018-07-16 |
| snort |
ET POLICY SMB Remote AT Scheduled Job Create Request - Possible Lateral Movement |
rev 2 |
2018-07-16 |
| snort |
ET POLICY SMB NT Create AndX Request For a .sys File - Possible Lateral Movement |
rev 2 |
2018-07-16 |
| sentinel |
Identify Mango Sandstorm powershell commands |
Scheduled |
— |
| sentinel |
Azure VM Run Command operation executed during suspicious login window |
Scheduled |
— |
| sentinel |
New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version) |
Scheduled |
— |
| sentinel |
Azure VM Run Command operations executing a unique PowerShell script |
Scheduled |
— |