Coverage › CVE-2021-40449

CVE-2021-40449 Mapped Partial Sigma

Microsoft Windows Win32k Privilege Escalation Vulnerability

Vendor / product: Microsoft — Windows
Description (CISA): Unspecified vulnerability allows for an authenticated user to escalate privileges.
Added to KEV: 2021-11-17
Due date: 2021-12-01
Required action: Apply updates per vendor instructions.
Known ransomware use: Known
CWE: CWE-416
CISA notes: https://nvd.nist.gov/vuln/detail/CVE-2021-40449
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

8 mapping objects across 8 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1566 Phishing	exploitation technique	This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities. The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user. ref 1 · ref 2 · ref 3	live
T1016 System Network Configuration Discovery	secondary impact	This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities. The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user. ref 1 · ref 2 · ref 3	live
T1027 Obfuscated Files or Information	secondary impact	This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities. The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user. ref 1 · ref 2 · ref 3	live
T1059.003 Windows Command Shell	secondary impact	This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities. The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user. ref 1 · ref 2 · ref 3	live
T1068 Exploitation for Privilege Escalation	primary impact	This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities. The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user. ref 1 · ref 2 · ref 3	live
T1071.001 Web Protocols	secondary impact	This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities. The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user. ref 1 · ref 2 · ref 3	live
T1082 System Information Discovery	secondary impact	This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities. The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user. ref 1 · ref 2 · ref 3	live
T1573.001 Symmetric Cryptography	secondary impact	This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities. The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user. ref 1 · ref 2 · ref 3	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1016 System Network Configuration Discovery secondary impact

DET0195 Behavioral Detection of System Network Configuration Discovery
AN0559 Windows
Execution of built-in tools (e.g., ipconfig, route, netsh) or PowerShell/WMI queries to enumerate IP, MAC, interface status, or routing configuration.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

Tunable: ParentProcess UserContext TimeWindow

AN0560 Linux
Execution of ifconfig, ip a, or access to /proc/net/ indicating collection of local interface and route configuration.

auditd:EXECVE execve → DC0032 Process Creation

Tunable: CommandLinePattern InteractiveShellIndicator

AN0561 macOS
Execution of ifconfig, networksetup, or system_profiler to query IP/MAC/interface configuration and status.

macos:unifiedlog process → DC0032 Process Creation

Tunable: ScriptedContext ExecutionFrequency

AN0562 ESXi
Use of esxcli network commands (e.g., esxcli network nic list, esxcli network ip interface ipv4 get) via SSH or hostd to enumerate adapter and IP information.

esxi:hostd None → DC0064 Command Execution

Tunable: SSHSessionOrigin esxcliCommandDepth

AN0563 Network Devices
CLI-based execution of interface and routing discovery commands (e.g., show ip interface, show arp, show route) over Telnet, SSH, or console.

networkdevice:cli None → DC0064 Command Execution

Tunable: Username CommandString TransportType

Sigma rules tagged `attack.t1016` (12)

Firewall Configuration Discovery Via Netsh.EXE lowtest

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' · 2021-12-07 (modified 2025-10-18) · logsource: product=windows category=process_creation · 0e4164da-94bc-450d-a7be-a4b176179f1f

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Techniques: T1016

Userdomain Variable Enumeration lowtest

Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io · 2023-02-09 (modified 2024-08-01) · logsource: product=windows category=process_creation · 43311e65-84d8-42a5-b3d4-c94d9b67038f

Detects suspicious enumeration of the domain the user is associated with.

Techniques: T1016

System Network Discovery - macOS informationaltest

Author: remotephone, oscd.community · 2020-10-06 (modified 2024-08-29) · logsource: product=macos category=process_creation · 58800443-f9fc-4d55-ae0c-98a3966dfb97

Detects enumeration of local network configuration

Techniques: T1016

Potential Recon Activity Via Nltest.EXE mediumtest

Author: Craig Young, oscd.community, Georg Lauenstein · 2021-07-24 (modified 2023-12-15) · logsource: product=windows category=process_creation · 5cc90652-4cbd-4241-aa3b-4b462fa5a248

Detects nltest commands that can be used for information discovery

Techniques: T1016 T1482

Potential Pikabot Discovery Activity hightest

Author: Andreas Braathen (mnemonic.io) · 2023-10-27 (modified 2024-01-26) · logsource: product=windows category=process_creation · 698d4431-514f-4c82-af4d-cf573872a9f5

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

Techniques: T1016 T1049 T1087

Nltest.EXE Execution lowtest

Author: Arun Chauhan · 2023-02-03 · logsource: product=windows category=process_creation · 903076ff-f442-475a-b667-4f246bcc203b

Detects nltest commands that can be used for information discovery

Techniques: T1016 T1018 T1482

Cisco Discovery lowtest

Author: Austin Clark · 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b

Find information about network devices that is not stored in config files

Techniques: T1083 T1201 T1057 T1018 T1082 T1016 T1049 T1033 T1124

Suspicious Network Command lowtest

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' · 2021-12-07 (modified 2025-10-19) · logsource: product=windows category=process_creation · a29c1813-ab1f-4dde-b489-330b952e91ae

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Techniques: T1016

System Network Discovery - Linux informationaltest

Author: Ömer Günal and remotephone, oscd.community · 2020-10-06 (modified 2022-09-15) · logsource: product=linux category=process_creation · e7bd1cfa-b446-4c88-8afb-403bcd79e3fa

Detects enumeration of local network configuration

Techniques: T1016

OpenCanary - SNMP OID Request hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · e9856028-fd4e-46e6-b3d1-10f7ceb95078

Detects instances where an SNMP service on an OpenCanary node has had an OID request.

Techniques: T1016 T1021

Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet lowtest

Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io · 2023-07-13 · logsource: product=windows category=ps_module · ea207a23-b441-4a17-9f76-ad5be47d51d3

Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.

Techniques: T1518.001 T1016

Suspicious Network Connection to IP Lookup Service APIs mediumtest

Author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems) · 2023-04-24 (modified 2024-03-22) · logsource: product=windows category=network_connection · edf3485d-dac4-4d50-90e4-b0e5813f7e60

Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.

Techniques: T1016

T1027 Obfuscated Files or Information secondary impact

DET0378 Behavioral Detection of Obfuscated Files or Information
AN1064 Windows
Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: PayloadEntropyThreshold TimeWindow SuspiciousParentProcessList

AN1065 Linux
Detects use of gzip, base64, tar, or openssl in scripts or commands that encode/encrypt files after file staging or system enumeration.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:SYSCALL open, write → DC0061 File Modification
linux:cli Shell history logs → DC0064 Command Execution

Tunable: CommandRegex SensitivePathList

AN1066 macOS
Monitors use of archive or encryption tools (zip, openssl) tied to user-scripted activity or binaries writing encoded payloads under /Users or /Volumes.

macos:unifiedlog log stream --predicate 'processImagePath contains "zip" OR "base64"' → DC0064 Command Execution
macos:osquery file_events → DC0039 File Creation

Tunable: FilenameExtensionList UserContext

AN1067 Network Devices
Identifies transfer of base64, uuencoded, or high-entropy files over HTTP, FTP, or custom protocols in lateral movement or exfiltration streams.

networkdevice:IDS content inspection / PCAP / HTTP body → DC0085 Network Traffic Content

Tunable: EntropyThreshold ProtocolScope

AN1068 ESXi
Detects encoded PowerCLI or Base64-encoded payloads staged via datastore uploads or shell access (e.g., ESXi Shell or backdoored VIBs).

esxi:vmkernel Datastore modification events → DC0059 File Metadata
esxi:hostd Remote access API calls and file uploads → DC0021 OS API Execution

Tunable: StagingLocation EncodedLengthThreshold

Sigma rules tagged `attack.t1027` (94)

Password Protected ZIP File Opened mediumtest

Author: Florian Roth (Nextron Systems) · 2022-05-09 · logsource: product=windows service=security · 00ba9da1-b510-4f6b-b258-8d338836180f

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Techniques: T1027

Invoke-Obfuscation Via Use MSHTA - PowerShell Module hightest

Author: Nikita Nazarov, oscd.community · 2020-10-08 (modified 2023-01-04) · logsource: product=windows category=ps_module · 07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb

Detects Obfuscated Powershell via use MSHTA in Scripts

Techniques: T1027 T1059.001

Invoke-Obfuscation VAR+ Launcher - PowerShell hightest

Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2024-04-05) · logsource: product=windows category=ps_script · 0adfbc14-0ed1-11eb-adc1-0242ac120002

Detects Obfuscated use of Environment Variables to execute PowerShell

Techniques: T1027 T1059.001

Suspicious Get-Variable.exe Creation hightest

Author: frack113 · 2022-04-23 · logsource: product=windows category=file_event · 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

Techniques: T1546 T1027

Invoke-Obfuscation STDIN+ Launcher - Security hightest

Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2022-11-29) · logsource: product=windows service=security · 0c718a5e-4284-4fb9-b4d9-b9a50b3a1974

Detects Obfuscated use of stdin to execute PowerShell

Techniques: T1027 T1059.001

PUA - Potential PE Metadata Tamper Using Rcedit mediumtest

Author: Micah Babinski · 2022-12-11 (modified 2023-03-05) · logsource: product=windows category=process_creation · 0c92f2e6-f08f-4b73-9216-ecb0ca634689

Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

Techniques: T1036.003 T1036 T1027.005 T1027

Potentially Suspicious Long Filename Pattern - Linux lowexperimental

Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 11629c4d-0fe6-465b-be62-b39a1c442aad

Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting. Adjust the threshold of filename length as needed based on your environment.

Techniques: T1059.004 T1027

Invoke-Obfuscation RUNDLL LAUNCHER - System mediumtest

Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows service=system · 11b52f18-aaec-4d60-9143-5dd8cc4706b9

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Techniques: T1027 T1059.001

Potential Winnti Dropper Activity hightest

Author: Alexander Rausch · 2020-06-24 (modified 2023-01-05) · logsource: product=windows category=file_event · 130c9e58-28ac-4f83-8574-0a4cc913b97e

Detects files dropped by Winnti as described in RedMimicry Winnti playbook

Techniques: T1027

Suspicious File Downloaded From Direct IP Via Certutil.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Techniques: T1027 T1105

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System hightest

Author: Timur Zinniatullin, oscd.community · 2020-10-13 (modified 2022-11-29) · logsource: product=windows service=system · 14bcba49-a428-42d9-b943-e2ce0f0f7ae6

Detects Obfuscated Powershell via VAR++ LAUNCHER

Techniques: T1027 T1059.001

Invoke-Obfuscation COMPRESS OBFUSCATION - System mediumtest

Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows service=system · 175997c5-803c-4b08-8bb0-70b099f47595

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Techniques: T1027 T1059.001

Suspicious Filename with Embedded Base64 Commands highexperimental

Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 179b3686-6271-4d87-807d-17d843a8af73

Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.

Techniques: T1059.004 T1027

PowerShell Base64 Encoded WMI Classes hightest

Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2023-01-30 · logsource: product=windows category=process_creation · 1816994b-42e1-4fb1-afd2-134d88184f71

Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.

Techniques: T1059.001 T1027

Suspicious Download Via Certutil.EXE mediumtest

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 19b08b1c-861d-4e75-a1ef-ea0c1baf202b

Detects the execution of certutil with certain flags that allow the utility to download files.

Techniques: T1027 T1105

All 94 rules on the technique page →

T1059.003 Windows Command Shell secondary impact

DET0202 Behavioral Detection of Windows Command Shell Execution
AN0578 Windows
Detects interactive or scripted abuse of cmd.exe, batch files, or shell invocation chains. Focuses on parent-child relationships (e.g., cmd.exe launched from unusual parents), anomalous command-line parameters, and chaining with discovery, credential access, or lateral movement behaviors.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
EDR:scriptblock Process Tree + Script Block Logging → DC0029 Script Execution

Tunable: ParentProcessName TimeWindow CommandLinePattern ScriptStoragePath UserContext

Sigma rules tagged `attack.t1059.003` (46)

Headless Process Launched Via Conhost.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2024-07-23 · logsource: product=windows category=process_creation · 00ca75ab-d5ce-43be-b86c-55ff39c6abfc

Detects the launch of a child process via "conhost.exe" with the "--headless" flag. The "--headless" flag hides the windows from the user upon execution.

Techniques: T1059.001 T1059.003

Suspicious HWP Sub Processes hightest

Author: Florian Roth (Nextron Systems) · 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Techniques: T1566.001 T1203 T1059.003

Powershell Executed From Headless ConHost Process mediumtest

Author: Matt Anderson (Huntress) · 2024-07-23 · logsource: product=windows category=process_creation · 056c7317-9a09-4bd4-9067-d051312752ea

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

Techniques: T1059.001 T1059.003 T1564.003

HackTool - CrackMapExec Execution Patterns highstable

Author: Thomas Patzke · 2020-05-22 (modified 2023-11-06) · logsource: product=windows category=process_creation · 058f4380-962d-40a5-afce-50207d36d7e2

Detects various execution patterns of the CrackMapExec pentesting framework

Techniques: T1047 T1053 T1059.003 T1059.001

Remote Access Tool - ScreenConnect Command Execution lowtest

Author: Ali Alwashali · 2023-10-10 · logsource: product=windows service=application · 076ebe48-cc05-4d8f-9d41-89245cd93a14

Detects command execution via ScreenConnect RMM

Techniques: T1059.003

Potential CommandLine Path Traversal Via Cmd.EXE hightest

Author: xknow @xknow_infosec, Tim Shelton · 2020-06-11 (modified 2023-03-06) · logsource: product=windows category=process_creation · 087790e3-3287-436c-bccf-cbd0184a7db1

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

Techniques: T1059.003

HackTool - Jlaive In-Memory Assembly Execution mediumtest

Author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk) · 2022-05-24 (modified 2023-02-22) · logsource: product=windows category=process_creation · 0a99eb3e-1617-41bd-b095-13dc767f3def

Detects the use of Jlaive to execute assemblies in a copied PowerShell

Techniques: T1059.003

Remote Access Tool - ScreenConnect Temporary File lowtest

Author: Ali Alwashali · 2023-10-10 · logsource: product=windows category=file_event · 0afecb6e-6223-4a82-99fb-bf5b981e92a5

Detects the creation of files in a specific location by ScreenConnect RMM. ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.

Techniques: T1059.003

Rorschach Ransomware Execution Activity criticaltest

Author: X__Junior (Nextron Systems) · 2023-04-04 (modified 2023-04-22) · logsource: product=windows category=process_creation · 0e9e6c63-1350-48c4-9fa1-7ccb235edc68

Detects Rorschach ransomware execution activity

Techniques: T1059.003 T1059.001

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

AWS EC2 Startup Shell Script Change hightest

Author: faloker · 2020-02-12 (modified 2022-06-07) · logsource: product=aws service=cloudtrail · 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Techniques: T1059.001 T1059.003 T1059.004

Command Line Execution with Suspicious URL and AppData Strings mediumtest

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · 2019-01-16 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1ac8666b-046f-4201-8aba-1951aaec03a3

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Techniques: T1059.003 T1059.001 T1105

Exploiting SetupComplete.cmd CVE-2019-1378 hightest

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Techniques: T1068 T1059.003 T1574

CVE tags: CVE-2019-1378

Read Contents From Stdin Via Cmd.EXE mediumtest

Author: frack113, Nasreddine Bencherchali (Nextron Systems) · 2023-03-07 · logsource: product=windows category=process_creation · 241e802a-b65e-484f-88cd-c2dc10f9206d

Detect the use of "<" to read and potentially execute a file via cmd.exe

Techniques: T1059.003

Suspicious Usage of For Loop with Recursive Directory Search in CMD mediumexperimental

Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2025-11-12 · logsource: product=windows category=process_creation · 2782fbd8-b662-4eb5-9962-5bfbfb671e7b

Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing. This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection. This behavior has been observed in various malicious lnk files.

Techniques: T1059.003 T1027.010

All 46 rules on the technique page →

T1068 Exploitation for Privilege Escalation primary impact

DET0514 Detection Strategy for Exploitation for Privilege Escalation
AN1419 Windows
Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

Tunable: DriverNamePattern TimeWindow ParentProcessPath

AN1420 Linux
Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:SYSCALL ACCESS → DC0035 Process Access
auditd:SYSCALL dmesg → DC0016 Module Load

Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold

AN1421 macOS
Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

macos:unifiedlog process:exec and kext load events → DC0032 Process Creation
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

Tunable: EntitlementList TimeWindow

AN1422 Containers
Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

auditd:SYSCALL capset or setns → DC0067 Logon Session Creation
containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged `attack.t1068` (31)

Exploiting CVE-2019-1388 criticalstable

Author: Florian Roth (Nextron Systems) · 2019-11-20 (modified 2024-12-01) · logsource: product=windows category=process_creation · 02e0b2ea-a597-428e-b04a-af6a1a403e5c

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Techniques: T1068

CVE tags: CVE-2019-1388

Malicious Driver Load hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-08-18 (modified 2023-12-02) · logsource: product=windows category=driver_load · 05296024-fe8a-4baf-8f3d-9a5f5624ceb2

Detects loading of known malicious drivers via their hash.

Techniques: T1543.003 T1068

Possible Coin Miner CPU Priority Param criticaltest

Author: Florian Roth (Nextron Systems) · 2021-10-09 (modified 2022-12-25) · logsource: product=linux service=auditd · 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed

Detects command line parameter very often used with coin miners

Techniques: T1068

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation highexperimental

Author: Swachchhanda Shrawn Poudel (Nextron Systems) · 2025-10-02 (modified 2026-03-31) · logsource: product=linux category=file_event · 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d

Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.

Techniques: T1068

CVE tags: CVE-2025-32463

Potential CVE-2024-35250 Exploitation Activity mediumexperimental

Author: @eyezuhk Isaac Fernandes · 2025-02-19 · logsource: product=windows category=image_load · 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1

Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.

Techniques: T1068

CVE tags: CVE-2024-35250

Buffer Overflow Attempts hightest

Author: Florian Roth (Nextron Systems) · 2017-03-01 (modified 2025-03-17) · logsource: product=linux · 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781

Detects buffer overflow attempts in Unix system log files

Techniques: T1068

Exploiting SetupComplete.cmd CVE-2019-1378 hightest

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Techniques: T1068 T1059.003 T1574

CVE tags: CVE-2019-1378

OMIGOD SCX RunAsProvider ExecuteShellCommand hightest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Techniques: T1068 T1190 T1203

HKTL - SharpSuccessor Privilege Escalation Tool Execution highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-06 · logsource: product=windows category=process_creation · 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments. Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.

Techniques: T1068

Malicious Driver Load By Name mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-03 (modified 2023-12-02) · logsource: product=windows category=driver_load · 39b64854-5497-4b57-a448-40977b8c9679

Detects loading of known malicious drivers via the file name of the drivers.

Techniques: T1543.003 T1068

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event criticaltest

Author: Florian Roth (Nextron Systems) · 2021-11-22 (modified 2022-12-25) · logsource: product=windows category=file_event · 3be82d5d-09fe-4d6a-a275-0d40d234d324

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Techniques: T1068

Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator highexperimental

Author: Gene Kazimiarovich · 2026-04-30 · logsource: product=linux service=auditd · 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94

Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall. AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431 to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD splice path that corrupts the page cache of SUID binaries. Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN daemons using non-default kernel offload configurations.

Techniques: T1068

CVE tags: CVE-2026-31431

Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator highexperimental

Author: Gene Kazimiarovich · 2026-05-09 · logsource: product=linux category=process_creation · 474b415a-d917-4f3b-8c62-9e1a0d5f7b48

Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher (e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation, where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path, corrupting the page cache of SUID binaries for local privilege escalation. On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod) with 'modprobe' appearing in the command line.

Techniques: T1068 T1547.006

CVE tags: CVE-2026-31431

Audit CVE Event criticaltest

Author: Florian Roth (Nextron Systems), Zach Mathis · 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Techniques: T1203 T1068 T1211 T1212 T1210 T1499.004

All 31 rules on the technique page →

T1071.001 Web Protocols secondary impact

DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
AN0075 Windows
Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.

NSM:Flow http.log, ssl.log → DC0085 Network Traffic Content
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: ProcessNameExclusions UserAgentAnomalies OutboundByteRatioThreshold

AN0076 Linux
Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.

NSM:Flow http.log, conn.log → DC0085 Network Traffic Content
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: CommandLinePatternMatch BeaconIntervalWindow

AN0077 macOS
Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).

macos:osquery socket_events → DC0078 Network Traffic Flow
macos:unifiedlog log stream --predicate → DC0064 Command Execution

Tunable: SuspiciousParentProcess URIEntropyThreshold

AN0078 ESXi
Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.

NSM:Flow SPAN or port-mirrored HTTP/S → DC0085 Network Traffic Content
esxi:shell /root/.ash_history or /etc/init.d/* → DC0032 Process Creation

Tunable: ShellScriptMatch ExternalConnectionFilter

AN0079 Network Devices
Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.

NSM:Flow http.log, ssl.log, websocket.log → DC0085 Network Traffic Content

Tunable: HeaderEncodingPattern TLSFingerprintMismatch

Sigma rules tagged `attack.t1071.001` (42)

DNS Query To Devtunnels Domain mediumtest

Author: citron_ninja · 2023-10-25 (modified 2023-11-20) · logsource: product=windows category=dns_query · 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1071.001 T1572

HTTP Request With Empty User Agent mediumtest

Author: Florian Roth (Nextron Systems) · 2017-07-08 (modified 2021-11-27) · logsource: category=proxy · 21e44d78-95e7-421b-a464-ffd8395659c4

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Techniques: T1071.001

PwnDrp Access criticaltest

Author: Florian Roth (Nextron Systems) · 2020-04-15 (modified 2021-11-27) · logsource: category=proxy · 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Techniques: T1071.001 T1102.001 T1102.003

Renamed Visual Studio Code Tunnel Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-09-28 (modified 2025-10-29) · logsource: product=windows category=process_creation · 2cf29f11-e356-4f61-98c0-1bdb9393d6da

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Techniques: T1071.001 T1219

HackTool - BabyShark Agent Default URL Pattern criticaltest

Author: Florian Roth (Nextron Systems) · 2021-06-09 (modified 2024-02-15) · logsource: category=proxy · 304810ed-8853-437f-9e36-c4975c3dfd7e

Detects Baby Shark C2 Framework default communication patterns

Techniques: T1071.001

Visual Studio Code Tunnel Service Installation mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-10-25 · logsource: product=windows category=process_creation · 30bf1789-379d-4fdc-900f-55cd0a90a801

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Techniques: T1071.001

Curl.EXE Execution With Custom UserAgent mediumtest

Author: frack113 · 2022-01-23 (modified 2023-02-21) · logsource: product=windows category=process_creation · 3286d37a-00fd-41c2-a624-a672dcd34e60

Detects execution of curl.exe with custom useragent options

Techniques: T1071.001

Outbound Network Connection Initiated By Microsoft Dialer hightest

Author: CertainlyP · 2024-04-26 · logsource: product=windows category=network_connection · 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

Techniques: T1071.001

Wannacry Killswitch Domain hightest

Author: Mike Wade · 2020-09-16 (modified 2022-03-24) · logsource: category=dns · 3eaf6218-3bed-4d8a-8707-274096f12a18

Detects wannacry killswitch domain dns queries

Techniques: T1071.001

Raw Paste Service Access hightest

Author: Florian Roth (Nextron Systems) · 2019-12-05 (modified 2023-01-19) · logsource: category=proxy · 5468045b-4fcc-4d1a-973c-c9c9578edacb

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Techniques: T1071.001 T1102.001 T1102.003

APT40 Dropbox Tool User Agent hightest

Author: Thomas Patzke · 2019-11-12 (modified 2023-05-18) · logsource: category=proxy · 5ba715b6-71b7-44fd-8245-f66893e81b3d

Detects suspicious user agent string of APT40 Dropbox tool

Techniques: T1071.001 T1567.002

Malware User Agent hightest

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2017-07-08 (modified 2024-04-14) · logsource: category=proxy · 5c84856b-55a5-45f1-826f-13f37250cf4e

Detects suspicious user agent strings used by malware in proxy logs

Techniques: T1071.001

APT User Agent hightest

Author: Florian Roth (Nextron Systems), Markus Neis · 2019-11-12 (modified 2024-02-15) · logsource: category=proxy · 6ec820f2-e963-4801-9127-d8b2dce4d31b

Detects suspicious user agent strings used in APT malware in proxy logs

Techniques: T1071.001

Suspicious User Agent hightest

Author: Florian Roth (Nextron Systems) · 2017-07-08 (modified 2022-10-31) · logsource: category=proxy · 7195a772-4b3f-43a4-a210-6a003d65caa1

Detects suspicious malformed user agent strings in proxy logs

Techniques: T1071.001

Axios NPM Compromise Malicious C2 Domain DNS Query highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: category=dns · 73e5d24f-493f-4092-bd2f-c72cabda40ee

Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.

Techniques: T1071.001 T1568

All 42 rules on the technique page →

T1082 System Information Discovery secondary impact

DET0525 System Discovery via Native and Remote Utilities
AN1452 Windows
Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

Tunable: TimeWindow UserContext

AN1453 Linux
Execution of system enumeration commands such as uname, df, uptime, hostname, lscpu, and cat /etc/os-release through local terminal or scripts.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: CommandList TerminalSessionID

AN1454 macOS
Execution of system info utilities like systemsetup, sw_vers, uname, or sysctl by terminal or scripted processes.

macos:unifiedlog log show --predicate 'process == <utility>' → DC0064 Command Execution

Tunable: ParentProcess FrequencyThreshold

AN1455 ESXi
Execution of esxcli system hostname get, esxcli system version get, or esxcli hardware commands through SSH or local shell.

esxi:vmkernel /var/log/vmkernel.log → DC0064 Command Execution

Tunable: SessionOrigin CommandString

AN1456 IaaS
Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.

AWS:CloudTrail DescribeInstances, GetConsoleOutput, DescribeImages → DC0075 Instance Enumeration

Tunable: IAMRoleContext APIFrequency

AN1457 Network Devices
Execution of show version, show hardware, or show system commands through CLI via SSH or console.

networkdevice:syslog Privilege-level command execution → DC0064 Command Execution

Tunable: Username CommandList

Sigma rules tagged `attack.t1082` (33)

System Information Discovery via Registry Queries lowexperimental

Author: lazarg · 2025-06-12 (modified 2025-10-25) · logsource: product=windows category=process_creation · 0022869c-49f7-4ff2-ba03-85ac42ddac58

Detects attempts to query system information directly from the Windows Registry.

Techniques: T1082

Suspicious Execution of Systeminfo lowtest

Author: frack113 · 2022-01-01 (modified 2022-07-14) · logsource: product=windows category=process_creation · 0ef56343-059e-4cb6-adc1-4c3c967c5e46

Detects usage of the "systeminfo" command to retrieve information

Techniques: T1082

Docker Container Discovery Via Dockerenv Listing lowtest

Author: Seth Hanford · 2023-08-23 · logsource: product=linux category=process_creation · 11701de9-d5a5-44aa-8238-84252f131895

Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery

Techniques: T1082

System and Hardware Information Discovery informationalstable

Author: Ömer Günal, oscd.community · 2020-10-08 (modified 2022-11-26) · logsource: product=linux service=auditd · 1f358e2e-cb63-43c3-b575-dfb072a6814f

Detects system information discovery commands

Techniques: T1082

System Information Discovery Using Ioreg mediumtest

Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2023-12-20 (modified 2024-01-02) · logsource: product=macos category=process_creation · 2d5e7a8b-f484-4a24-945d-7f0efd52eab0

Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

Techniques: T1082

System Information Discovery informationalstable

Author: Ömer Günal, oscd.community · 2020-10-08 (modified 2021-09-14) · logsource: product=linux category=process_creation · 42df45e7-e6e9-43b5-8f26-bec5b39cc239

Detects system information discovery commands

Techniques: T1082

Potential Container Discovery Via Inodes Listing lowtest

Author: Seth Hanford · 2023-08-23 (modified 2025-11-24) · logsource: product=linux category=process_creation · 43e26eb5-cd58-48d1-8ce9-a273f5d298d8

Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.

Techniques: T1082

System Information Discovery Using System_Profiler mediumtest

Author: Stephen Lincoln `@slincoln_aiq` (AttackIQ) · 2024-01-02 · logsource: product=macos category=process_creation · 4809c683-059b-4935-879d-36835986f8cf

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

Techniques: T1082 T1497.001

CMD Shell Output Redirect lowtest

Author: frack113 · 2022-01-22 (modified 2024-03-19) · logsource: product=windows category=process_creation · 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a

Detects the use of the redirection character ">" to redirect information on the command line. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

Techniques: T1082

Bitbucket User Details Export Attempt Detected mediumtest

Author: Muhammad Faisal (@faisalusuf) · 2024-02-25 · logsource: product=bitbucket service=audit · 5259cbf2-0a75-48bf-b57a-c54d6fabaef3

Detects user data export activity.

Techniques: T1213 T1082 T1591.004

PUA - System Informer Execution mediumtest

Author: Florian Roth (Nextron Systems) · 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 5722dff1-4bdd-4949-86ab-fbaf707e767a

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Techniques: T1082 T1564 T1543

System Information Discovery Using sw_vers mediumtest

Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2023-12-20 · logsource: product=macos category=process_creation · 5de06a6f-673a-4fc0-8d48-bcfe3837b033

Detects the use of "sw_vers" for system information discovery

Techniques: T1082

System Information Discovery Via Sysctl - MacOS mediumtest

Author: Pratinav Chandra · 2024-05-27 · logsource: product=macos category=process_creation · 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c

Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.

Techniques: T1497.001 T1082

Suspicious Kernel Dump Using Dtrace hightest

Author: Florian Roth (Nextron Systems) · 2021-12-28 · logsource: product=windows category=process_creation · 7124aebe-4cd7-4ccb-8df0-6d6b93c96795

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

Techniques: T1082

Container Residence Discovery Via Proc Virtual FS lowtest

Author: Seth Hanford · 2023-08-23 · logsource: product=linux category=process_creation · 746c86fb-ccda-4816-8997-01386263acc4

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

Techniques: T1082

All 33 rules on the technique page →

T1566 Phishing exploitation technique

DET0070 Detection Strategy for Phishing across platforms.
AN0188 Windows
Unusual inbound email activity where attachments or embedded URLs are delivered to users followed by execution of new processes or suspicious document behavior. Detection involves correlating email metadata, file creation, and network activity after a phishing message is received.

m365:unified Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: SuspiciousFileTypes AllowedSenders

AN0189 Linux
Monitor for malicious payload delivery through phishing where attachments or URLs in email clients (e.g., Thunderbird, mutt) result in unusual file creation or outbound network connections. Focus on correlation between mail logs, file writes, and execution activity.

Application:Mail Inbound messages with anomalous headers, spoofed SPF/DKIM failures → DC0038 Application Log Content
auditd:SYSCALL execve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir) → DC0032 Process Creation

Tunable: MonitoredMailPaths AttachmentHashBaseline

AN0190 macOS
Detection of phishing through anomalous Mail app activity, such as attachments saved to disk and immediately executed, or Safari/Preview launching URLs and files linked from email messages. Correlate UnifiedLogs events with subsequent process execution.

macos:unifiedlog Inbound email activity with suspicious domains or mismatched sender information → DC0038 Application Log Content
macos:unifiedlog Preview.app, Safari.app, or Mail.app spawning new processes outside normal patterns → DC0032 Process Creation

Tunable: SuspiciousDomains ExecutionDelayWindow

AN0191 Office Suite
Phishing via Office documents containing embedded macros or links that spawn processes. Detection relies on correlating Office application logs with suspicious child process execution and outbound network connections.

m365:unified FileAccessed: Access of email attachments by Office applications → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: ParentProcessList MacroExecutionThreshold

AN0192 Identity Provider
Phishing attempts targeting IdPs often manifest as anomalous login attempts from suspicious email invitations or fake SSO prompts. Detection correlates login flows, MFA bypass attempts, and anomalous geographic patterns following phishing email delivery.

azure:signinlogs Failed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges → DC0067 Logon Session Creation

Tunable: GeoAnomalyThreshold MFABypassIndicators

AN0193 SaaS
Phishing delivered via SaaS services (chat, collaboration platforms) where messages contain malicious URLs or attachments. Detect anomalous link clicks, suspicious file uploads, or token misuse after SaaS-based phishing attempts.

saas:collaboration MessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom) → DC0038 Application Log Content

Tunable: MonitoredSaaSApps LinkInspectionPolicy

Sigma rules tagged `attack.t1566` (14)

Download From Suspicious TLD - Blacklist lowtest

Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19

Detects download of certain file types from hosts in suspicious TLDs

Techniques: T1566 T1203 T1204.002

Suspicious External WebDAV Execution hightest

Author: Ahmed Farouk · 2024-05-10 · logsource: category=proxy · 1ae64f96-72b6-48b3-ad3d-e71dff6c6398

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

Techniques: T1584 T1566

CVE-2021-31979 CVE-2021-33771 Exploits criticaltest

Author: Sittikorn S, frack113 · 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Techniques: T1566 T1203

CVE tags: CVE-2021-33771CVE-2021-31979

Potential Malicious Usage of CloudTrail System Manager hightest

Author: jamesc-grafana · 2024-07-11 (modified 2025-12-08) · logsource: product=aws service=cloudtrail · 38e7f511-3f74-41d4-836e-f57dfa18eead

Detect when System Manager successfully executes commands against an instance.

Techniques: T1566 T1566.002

WebDAV Temporary Local File Creation mediumtest

Author: Micah Babinski · 2023-08-21 · logsource: product=windows category=file_event · 4c55738d-72d8-490e-a2db-7969654e375f

Detects the creation of WebDAV temporary files with potentially suspicious extensions

Techniques: T1584 T1566

HTML Help HH.EXE Suspicious Child Process hightest

Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Techniques: T1047 T1059.001 T1059.003 T1059.005 T1059.007 T1218 T1218.001 T1218.010 T1218.011 T1566 T1566.001

Suspicious Execution via macOS Script Editor mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4

Detects when the macOS Script Editor utility spawns an unusual child process.

Techniques: T1566 T1566.002 T1059 T1059.002 T1204 T1204.001 T1553

CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum criticaltest

Author: Sittikorn S · 2021-07-16 (modified 2022-10-09) · logsource: product=windows category=file_event · ad7085ac-92e4-4b76-8ce2-276d2c0e68ef

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Techniques: T1566 T1203

CVE tags: CVE-2021-33771CVE-2021-31979

Download From Suspicious TLD - Whitelist lowtest

Author: Florian Roth (Nextron Systems) · 2017-03-13 (modified 2023-05-18) · logsource: category=proxy · b5de2919-b74a-4805-91a7-5049accbaefe

Detects executable downloads from suspicious remote systems

Techniques: T1566 T1203 T1204.002

Suspicious Microsoft OneNote Child Process hightest

Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea) · 2022-10-21 (modified 2023-02-10) · logsource: product=windows category=process_creation · c27515df-97a9-4162-8a60-dc0eeb51b775

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Techniques: T1566 T1566.001

Potential Initial Access via DLL Search Order Hijacking mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 · logsource: product=windows category=file_event · dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Techniques: T1566 T1566.001 T1574 T1574.001

Suspicious HH.EXE Execution hightest

Author: Maxim Pavlunin · 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · e8a95b5e-c891-46e2-b33a-93937d3abc31

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Techniques: T1047 T1059.001 T1059.003 T1059.005 T1059.007 T1218 T1218.001 T1218.010 T1218.011 T1566 T1566.001

Okta FastPass Phishing Detection hightest

Author: Austin Songer @austinsonger · 2023-05-07 (modified 2026-04-27) · logsource: product=okta service=okta · ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e

Detects when Okta FastPass prevents a known phishing site.

Techniques: T1566

Phishing Pattern ISO in Archive hightest

Author: Florian Roth (Nextron Systems) · 2022-06-07 · logsource: product=windows category=process_creation · fcdf69e5-a3d3-452a-9724-26f2308bf2b1

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

Techniques: T1566

T1573.001 Symmetric Cryptography secondary impact

DET0143 Detection Strategy for Encrypted Channel via Symmetric Cryptography across OS Platforms
AN0400 Windows
Processes that typically do not perform cryptographic operations loading symmetric encryption libraries (e.g., bcryptprimitives.dll, aes.dll), then initiating outbound connections with high-entropy payloads. Defender correlates process creation, DLL load, and anomalous encrypted traffic patterns.

WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: AllowedCryptoProcesses EntropyThreshold TimeWindow

AN0401 Linux
Unexpected processes (e.g., bash, python, custom binaries) dynamically loading libcrypto or performing AES/RC4 encryption operations, then initiating outbound sessions with abnormal byte entropy or asymmetric traffic patterns.

auditd:SYSCALL execve or socket/connect system calls from processes using crypto libraries → DC0032 Process Creation
linux:syslog System daemons initiating encrypted sessions with unexpected destinations → DC0038 Application Log Content
linux:osquery Process linked with libcrypto.so making external connections → DC0016 Module Load

Tunable: TrustedCryptoLibs TrafficAsymmetryRatio

AN0402 macOS
Launchd jobs or user processes invoking symmetric crypto APIs from the Security framework and generating outbound connections carrying randomized payloads inconsistent with normal TLS patterns.

macos:unifiedlog Process using AES/RC4 routines unexpectedly → DC0032 Process Creation
macos:unifiedlog Encrypted connection with anomalous payload entropy → DC0085 Network Traffic Content

Tunable: DoHResolvers PayloadEntropyThreshold

AN0403 ESXi
ESXi daemons (hostd, vpxa) unexpectedly using symmetric encryption routines for external connections. Defender identifies logs of service traffic with encrypted payloads inconsistent with VMware management baselines.

esxi:vpxd Symmetric crypto routines triggered for external session → DC0038 Application Log Content
esxcli:network Socket sessions with randomized payloads inconsistent with TLS → DC0085 Network Traffic Content

Tunable: AllowedMgmtHosts

AN0404 Network Devices
Flows showing encrypted payloads with high entropy not matching TLS handshake patterns, particularly when occurring on non-standard ports. Defender observes NetFlow/IPFIX byte distribution anomalies or IDS/IPS detecting symmetric encryption patterns without associated key exchange.

NSM:Flow Flow records with entropy signatures resembling symmetric encryption → DC0078 Network Traffic Flow
NSM:Connections Symmetric encryption detected without TLS handshake sequence → DC0085 Network Traffic Content

Tunable: PortProfiles TrafficVolumeThreshold

Sigma rules tagged `attack.t1573.001` (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

CVE-2021-40449 Mapped Partial Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1016 System Network Configuration Discovery secondary impact

Sigma rules tagged attack.t1016 (12)

T1027 Obfuscated Files or Information secondary impact

Sigma rules tagged attack.t1027 (94)

T1059.003 Windows Command Shell secondary impact

Sigma rules tagged attack.t1059.003 (46)

T1068 Exploitation for Privilege Escalation primary impact

Sigma rules tagged attack.t1068 (31)

T1071.001 Web Protocols secondary impact

Sigma rules tagged attack.t1071.001 (42)

T1082 System Information Discovery secondary impact

Sigma rules tagged attack.t1082 (33)

T1566 Phishing exploitation technique

Sigma rules tagged attack.t1566 (14)

T1573.001 Symmetric Cryptography secondary impact

Sigma rules tagged attack.t1573.001 (0)

Sigma rules tagged `attack.t1016` (12)

Sigma rules tagged `attack.t1027` (94)

Sigma rules tagged `attack.t1059.003` (46)

Sigma rules tagged `attack.t1068` (31)

Sigma rules tagged `attack.t1071.001` (42)

Sigma rules tagged `attack.t1082` (33)

Sigma rules tagged `attack.t1566` (14)

Sigma rules tagged `attack.t1573.001` (0)