Coverage › CVE-2021-40539

CVE-2021-40539 Mapped Partial Sigma

Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

Vendor / product: Zoho — ManageEngine
Description (CISA): Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.
Added to KEV: 2021-11-03
Due date: 2021-11-17
Required action: Apply updates per vendor instructions.
Known ransomware use: Known
CWE: CWE-55
CISA notes: https://nvd.nist.gov/vuln/detail/CVE-2021-40539
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

14 mapping objects across 13 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1190 Exploit Public-Facing Application	exploitation technique	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1003 OS Credential Dumping	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1003.003 NTDS	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1027 Obfuscated Files or Information	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1047 Windows Management Instrumentation	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1070.004 File Deletion	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1087.002 Domain Account	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1136 Create Account	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1140 Deobfuscate/Decode Files or Information	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1218 System Binary Proxy Execution	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1505.003 Web Shell	primary impact	CVE-2021-40539 is an authentication bypass vulnerability affecting representational state transfer (REST) application programming interface (API) URLs that could enable remote code execution. Successful exploitation of the vulnerability allows an attacker to place webshells, which enable the adversary to conduct post-exploitation activities, such as compromising administrator credentials, conducting lateral movement, and exfiltrating registry hives and Active Directory files. ref 1	live
T1505.003 Web Shell	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1560.001 Archive via Utility	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live
T1573.001 Symmetric Cryptography	secondary impact	This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report. ref 1	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1003 OS Credential Dumping secondary impact

DET0234 Credential Dumping via Sensitive Memory and Registry Access Correlation
AN0648 Windows
Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.

WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access
WinEventLog:Security EventCode=4662 → DC0071 Active Directory Object Access

Tunable: AccessMask TimeWindow ParentProcessFilter

AN0649 Linux
Processes opening /proc//mem or /proc//maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.

auditd:SYSCALL open → DC0055 File Access
auditd:SYSCALL ptrace → DC0035 Process Access
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: TargetProcessName ToolProcessName

AN0650 macOS
Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.

macos:unifiedlog Code Execution & Entitlement Access → DC0034 Process Metadata
macos:keychain Access to Keychain DB or system.keychain → DC0055 File Access
macos:osquery Invocation of osascript or dylib injection → DC0032 Process Creation

Tunable: KeychainAccessPath SignedBinaryStatus

Sigma rules tagged `attack.t1003` (37)

Potential Credential Dumping Attempt Using New NetworkProvider - REG mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-08-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0442defa-b4a2-41c9-ae2c-ea7042fc4701

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Techniques: T1003

Potential Invoke-Mimikatz PowerShell Script hightest

Author: Tim Rauch, Elastic (idea) · 2022-09-28 · logsource: product=windows category=ps_script · 189e3b02-82b2-4b90-9662-411eb64486d4

Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.

Techniques: T1003

WCE wceaux.dll Access criticaltest

Author: Thomas Patzke · 2017-06-14 (modified 2025-01-30) · logsource: product=windows service=security · 1de68c67-af5c-4097-9c85-fe5578e09e67

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

Techniques: T1003

Hacktool Execution - Imphash criticaltest

Author: Florian Roth (Nextron Systems) · 2022-03-04 (modified 2024-11-23) · logsource: product=windows category=process_creation · 24e3e58a-646b-4b50-adef-02ef935b9fc8

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Techniques: T1588.002 T1003

Suspicious SYSTEM User Process Creation hightest

Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) · 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Techniques: T1134 T1003 T1027

Microsoft IIS Service Account Password Dumped hightest

Author: Tim Rauch, Janantha Marasinghe, Elastic (original idea) · 2022-11-08 (modified 2023-01-22) · logsource: product=windows category=process_creation · 2d3cdeec-c0db-45b4-aa86-082f7eb75701

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Techniques: T1003

HackTool - Rubeus Execution - ScriptBlock hightest

Author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems) · 2023-04-27 · logsource: product=windows category=ps_script · 3245cd30-e015-40ff-a31d-5cadd5f377ec

Detects the execution of the hacktool Rubeus using specific command line flags

Techniques: T1003 T1558.003 T1550.003

Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 mediumexperimental

Author: Milad Cheraghi · 2026-04-28 · logsource: product=linux category=process_creation · 33b3cfb1-574e-44b9-b527-fbf9303b9d7b

Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2. Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges. These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets. CVE-2025-5054: Information leak via core dumps from SUID binaries using apport. CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.

Techniques: T1548 T1003

CVE tags: CVE-2025-5054CVE-2025-4598

Loaded Module Enumeration Via Tasklist.EXE mediumtest

Author: Swachchhanda Shrawan Poudel · 2024-02-12 (modified 2024-03-13) · logsource: product=windows category=process_creation · 34275eb8-fa19-436b-b959-3d9ecd53fa1f

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

Techniques: T1003

Hacktool Execution - PE Metadata hightest

Author: Florian Roth (Nextron Systems) · 2022-04-27 (modified 2024-01-15) · logsource: product=windows category=process_creation · 37c1333a-a0db-48be-b64b-7393b2386e3b

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Techniques: T1588.002 T1003

OpenCanary - MSSQL Login Attempt Via SQLAuth hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.

Techniques: T1003 T1213

Credential Manager Access By Uncommon Applications mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-11 (modified 2026-07-28) · logsource: product=windows category=file_access · 407aecb1-e762-4acf-8c7b-d087bcff3bb6

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Techniques: T1003

Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-27 (modified 2026-01-09) · logsource: product=windows category=image_load · 416bc4a2-7217-4519-8dc7-c3271817f1d5

Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.

Techniques: T1003 T1685

Linux Keylogging with Pam.d hightest

Author: Pawel Mazur · 2021-05-24 (modified 2022-12-18) · logsource: product=linux service=auditd · 49aae26c-450e-448b-911d-b3c13d178dfc

Detect attempt to enable auditing of TTY input

Techniques: T1003 T1056.001

OpenCanary - REDIS Action Command Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 547dfc53-ebf6-4afe-8d2e-793d9574975d

Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.

Techniques: T1003 T1213

All 37 rules on the technique page →

T1003.003 NTDS secondary impact

DET0586 Detection of NTDS.dit Credential Dumping from Domain Controllers
AN1611 Windows
Detects credential dumping attempts targeting the NTDS.dit database by monitoring shadow copy creation, suspicious file access to %SystemRoot%\NTDS\ntds.dit, and the use of tooling like ntdsutil.exe or volume management APIs.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=2 → DC0061 File Modification
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Microsoft-Windows-VSS Volume Shadow Copy Creation → DC0097 Volume Creation

Tunable: TargetFilePath ParentProcessName TimeWindow UserContext

Sigma rules tagged `attack.t1003.003` (24)

NTDS.DIT Created lowtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-05 · logsource: product=windows category=file_event · 0b8baa3f-575c-46ee-8715-d6f28cc7d33c

Detects creation of a file named "ntds.dit" (Active Directory Database)

Techniques: T1003.003

NTDS.DIT Creation By Uncommon Process hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-01-11 (modified 2022-07-14) · logsource: product=windows category=file_event · 11b1ed55-154d-4e82-8ad7-83739298f720

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory

Techniques: T1003.002 T1003.003

Possible Impacket SecretDump Remote Activity hightest

Author: Samir Bousseaden, wagga · 2019-04-03 (modified 2022-08-11) · logsource: product=windows service=security · 252902e3-5830-4cf6-bf21-c22083dfd5cf

Detect AD credential dumping using impacket secretdump HKTL

Techniques: T1003.002 T1003.004 T1003.003

Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) mediumtest

Author: Thomas Patzke · 2019-01-16 (modified 2022-03-11) · logsource: product=windows category=process_creation · 2afafd61-6aae-4df4-baed-139fa1f4c345

Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)

Techniques: T1003.003

Transferring Files with Credential Data via Network Shares - Zeek mediumtest

Author: @neu5ron, Teymur Kheirkhabarov, oscd.community · 2020-04-02 (modified 2021-11-27) · logsource: product=zeek service=smb_files · 2e69f167-47b5-4ae7-a390-47764529eff5

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Techniques: T1003.002 T1003.001 T1003.003

Sensitive File Dump Via Print.EXE hightest

Author: Ayush Anand (Securityinbits) · 2026-04-28 · logsource: product=windows category=process_creation · 2fcda7e2-8c57-4904-86ac-37fc3157e09d

Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.

Techniques: T1003.003 T1003.002 T1218

NTDS Exfiltration Filename Patterns hightest

Author: Florian Roth (Nextron Systems) · 2022-03-11 (modified 2023-05-05) · logsource: product=windows category=file_event · 3a8da4e0-36c1-40d2-8b29-b3e890d5172a

Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.

Techniques: T1003.003

VolumeShadowCopy Symlink Creation Via Mklink highstable

Author: Teymur Kheirkhabarov, oscd.community · 2019-10-22 (modified 2023-03-06) · logsource: product=windows category=process_creation · 40b19fa6-d835-400c-b301-41f3a2baacaf

Shadow Copies storage symbolic link creation using operating systems utilities

Techniques: T1003.002 T1003.003

NTDS.DIT Creation By Uncommon Parent Process hightest

Author: Florian Roth (Nextron Systems) · 2022-03-11 (modified 2023-01-05) · logsource: product=windows category=file_event · 4e7050dd-e548-483f-b7d6-527ab4fa784d

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

Techniques: T1003.003

Esentutl Gather Credentials mediumtest

Author: sam0x90 · 2021-08-06 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7df1713a-1a5b-4a4b-a071-dc83b144a101

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Techniques: T1003 T1003.003

Sensitive File Recovery From Backup Via Wbadmin.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2024-05-10 · logsource: product=windows category=process_creation · 84972c80-251c-4c3a-9079-4f00aad93938

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Techniques: T1003.003

Sensitive File Dump Via Wbadmin.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2024-05-10 · logsource: product=windows category=process_creation · 8b93a509-1cb8-42e1-97aa-ee24224cdc15

Techniques: T1003.003

Suspicious Process Patterns NTDS.DIT Exfil hightest

Author: Florian Roth (Nextron Systems) · 2022-03-11 (modified 2022-11-10) · logsource: product=windows category=process_creation · 8bc64091-6875-4881-aaf9-7bd25b5dda08

Detects suspicious process patterns used in NTDS.DIT exfiltration

Techniques: T1003.003

Cred Dump Tools Dropped Files hightest

Author: Teymur Kheirkhabarov, oscd.community · 2019-11-01 (modified 2025-10-25) · logsource: product=windows category=file_event · 8fbf3271-1ef6-4e94-8210-03c2317947f6

Files with well-known filenames (parts of credential dump software or files produced by them) creation

Techniques: T1003.001 T1003.002 T1003.003 T1003.004 T1003.005

Transferring Files with Credential Data via Network Shares mediumtest

Author: Teymur Kheirkhabarov, oscd.community · 2019-10-22 (modified 2025-07-11) · logsource: product=windows service=security · 910ab938-668b-401b-b08c-b596e80fdca5

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Techniques: T1003.002 T1003.001 T1003.003

All 24 rules on the technique page →

T1027 Obfuscated Files or Information secondary impact

DET0378 Behavioral Detection of Obfuscated Files or Information
AN1064 Windows
Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: PayloadEntropyThreshold TimeWindow SuspiciousParentProcessList

AN1065 Linux
Detects use of gzip, base64, tar, or openssl in scripts or commands that encode/encrypt files after file staging or system enumeration.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:SYSCALL open, write → DC0061 File Modification
linux:cli Shell history logs → DC0064 Command Execution

Tunable: CommandRegex SensitivePathList

AN1066 macOS
Monitors use of archive or encryption tools (zip, openssl) tied to user-scripted activity or binaries writing encoded payloads under /Users or /Volumes.

macos:unifiedlog log stream --predicate 'processImagePath contains "zip" OR "base64"' → DC0064 Command Execution
macos:osquery file_events → DC0039 File Creation

Tunable: FilenameExtensionList UserContext

AN1067 Network Devices
Identifies transfer of base64, uuencoded, or high-entropy files over HTTP, FTP, or custom protocols in lateral movement or exfiltration streams.

networkdevice:IDS content inspection / PCAP / HTTP body → DC0085 Network Traffic Content

Tunable: EntropyThreshold ProtocolScope

AN1068 ESXi
Detects encoded PowerCLI or Base64-encoded payloads staged via datastore uploads or shell access (e.g., ESXi Shell or backdoored VIBs).

esxi:vmkernel Datastore modification events → DC0059 File Metadata
esxi:hostd Remote access API calls and file uploads → DC0021 OS API Execution

Tunable: StagingLocation EncodedLengthThreshold

Sigma rules tagged `attack.t1027` (94)

Password Protected ZIP File Opened mediumtest

Author: Florian Roth (Nextron Systems) · 2022-05-09 · logsource: product=windows service=security · 00ba9da1-b510-4f6b-b258-8d338836180f

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Techniques: T1027

Invoke-Obfuscation Via Use MSHTA - PowerShell Module hightest

Author: Nikita Nazarov, oscd.community · 2020-10-08 (modified 2023-01-04) · logsource: product=windows category=ps_module · 07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb

Detects Obfuscated Powershell via use MSHTA in Scripts

Techniques: T1027 T1059.001

Invoke-Obfuscation VAR+ Launcher - PowerShell hightest

Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2024-04-05) · logsource: product=windows category=ps_script · 0adfbc14-0ed1-11eb-adc1-0242ac120002

Detects Obfuscated use of Environment Variables to execute PowerShell

Techniques: T1027 T1059.001

Suspicious Get-Variable.exe Creation hightest

Author: frack113 · 2022-04-23 · logsource: product=windows category=file_event · 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

Techniques: T1546 T1027

Invoke-Obfuscation STDIN+ Launcher - Security hightest

Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2022-11-29) · logsource: product=windows service=security · 0c718a5e-4284-4fb9-b4d9-b9a50b3a1974

Detects Obfuscated use of stdin to execute PowerShell

Techniques: T1027 T1059.001

PUA - Potential PE Metadata Tamper Using Rcedit mediumtest

Author: Micah Babinski · 2022-12-11 (modified 2023-03-05) · logsource: product=windows category=process_creation · 0c92f2e6-f08f-4b73-9216-ecb0ca634689

Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

Techniques: T1036.003 T1036 T1027.005 T1027

Potentially Suspicious Long Filename Pattern - Linux lowexperimental

Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 11629c4d-0fe6-465b-be62-b39a1c442aad

Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting. Adjust the threshold of filename length as needed based on your environment.

Techniques: T1059.004 T1027

Invoke-Obfuscation RUNDLL LAUNCHER - System mediumtest

Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows service=system · 11b52f18-aaec-4d60-9143-5dd8cc4706b9

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Techniques: T1027 T1059.001

Potential Winnti Dropper Activity hightest

Author: Alexander Rausch · 2020-06-24 (modified 2023-01-05) · logsource: product=windows category=file_event · 130c9e58-28ac-4f83-8574-0a4cc913b97e

Detects files dropped by Winnti as described in RedMimicry Winnti playbook

Techniques: T1027

Suspicious File Downloaded From Direct IP Via Certutil.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Techniques: T1027 T1105

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System hightest

Author: Timur Zinniatullin, oscd.community · 2020-10-13 (modified 2022-11-29) · logsource: product=windows service=system · 14bcba49-a428-42d9-b943-e2ce0f0f7ae6

Detects Obfuscated Powershell via VAR++ LAUNCHER

Techniques: T1027 T1059.001

Invoke-Obfuscation COMPRESS OBFUSCATION - System mediumtest

Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows service=system · 175997c5-803c-4b08-8bb0-70b099f47595

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Techniques: T1027 T1059.001

Suspicious Filename with Embedded Base64 Commands highexperimental

Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 179b3686-6271-4d87-807d-17d843a8af73

Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.

Techniques: T1059.004 T1027

PowerShell Base64 Encoded WMI Classes hightest

Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2023-01-30 · logsource: product=windows category=process_creation · 1816994b-42e1-4fb1-afd2-134d88184f71

Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.

Techniques: T1059.001 T1027

Suspicious Download Via Certutil.EXE mediumtest

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 19b08b1c-861d-4e75-a1ef-ea0c1baf202b

Detects the execution of certutil with certain flags that allow the utility to download files.

Techniques: T1027 T1105

All 94 rules on the technique page →

T1047 Windows Management Instrumentation secondary impact

DET0364 Behavioral Detection Strategy for WMI Execution Abuse on Windows
AN1031 Windows
Detects adversarial abuse of WMI to execute local or remote commands via WMIC, PowerShell, or COM API through a multi-event chain: process creation, command execution, and corresponding network connection if remote.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:WMI EventCode=5857, 5858, 5860, 5861 → DC0008 WMI Creation

Tunable: WMIQueryScope TimeWindow UserContext RemoteDestinationThreshold SuspiciousCommandPatterns

Sigma rules tagged `attack.t1047` (52)

HackTool - CrackMapExec Execution Patterns highstable

Author: Thomas Patzke · 2020-05-22 (modified 2023-11-06) · logsource: product=windows category=process_creation · 058f4380-962d-40a5-afce-50207d36d7e2

Detects various execution patterns of the CrackMapExec pentesting framework

Techniques: T1047 T1053 T1059.003 T1059.001

XSL Script Execution Via WMIC.EXE mediumtest

Author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel · 2019-10-21 (modified 2026-01-24) · logsource: product=windows category=process_creation · 05c36dd6-79d6-4a9a-97da-3db20298ab2d

Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Techniques: T1047 T1220 T1059.005 T1059.007

WMIC Unquoted Services Path Lookup - PowerShell mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-20 (modified 2022-11-25) · logsource: product=windows category=ps_script · 09658312-bc27-4a3b-91c5-e49ab9046d1b

Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts

Techniques: T1047

Service Started/Stopped Via Wmic.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-20 (modified 2023-02-14) · logsource: product=windows category=process_creation · 0b7163dc-7eee-4960-af17-c0cd517f92da

Detects usage of wmic to start or stop a service

Techniques: T1047

HackTool - Potential Impacket Lateral Movement Activity highstable

Author: Ecco, oscd.community, Jonhnathan Ribeiro, Tim Rauch · 2019-09-03 (modified 2023-02-21) · logsource: product=windows category=process_creation · 10c14723-61c7-4c75-92ca-9af245723ad2

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

Techniques: T1047 T1021.003

Potential Product Reconnaissance Via Wmic.EXE mediumtest

Author: Nasreddine Bencherchali · 2023-02-14 (modified 2025-12-15) · logsource: product=windows category=process_creation · 15434e33-5027-4914-88d5-3d4145ec25a9

Detects the execution of WMIC in order to get a list of firewall and antivirus products

Techniques: T1047

Potential Process Reconnaissance via Wmic.EXE mediumtest

Author: frack113 · 2022-01-01 (modified 2025-12-15) · logsource: product=windows category=process_creation · 221b251a-357a-49a9-920a-271802777cc0

Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.

Techniques: T1047 T1057

Potential Maze Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems) · 2020-05-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 29fd07fc-9cfd-4331-b7fd-cc18dfa21052

Detects specific process characteristics of Maze ransomware word document droppers

Techniques: T1204.002 T1047 T1490

Suspicious Process Created Via Wmic.EXE hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2020-10-12 (modified 2023-02-14) · logsource: product=windows category=process_creation · 3c89a1e8-0fba-449e-8f1b-8409d6267ec8

Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.

Techniques: T1047

Hardware Model Reconnaissance Via Wmic.EXE mediumtest

Author: Florian Roth (Nextron Systems) · 2023-02-14 · logsource: product=windows category=process_creation · 3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d

Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

Techniques: T1047

HackTool - CrackMapExec Execution hightest

Author: Florian Roth (Nextron Systems) · 2022-02-25 (modified 2023-03-08) · logsource: product=windows category=process_creation · 42a993dd-bb3e-48c8-b372-4d6684c4106c

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Techniques: T1047 T1053 T1059.003 T1059.001 T1110 T1201

Suspicious Microsoft Office Child Process hightest

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io · 2018-04-06 (modified 2023-04-24) · logsource: product=windows category=process_creation · 438025f9-5856-4663-83f7-52f878a70a50

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Techniques: T1047 T1204.002 T1218.010

WMI Event Consumer Created Named Pipe mediumtest

Author: Florian Roth (Nextron Systems) · 2021-09-01 (modified 2023-11-30) · logsource: product=windows category=pipe_created · 493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb

Detects the WMI Event Consumer service scrcons.exe creating a named pipe

Techniques: T1047

Application Termination Attempt via Wmic.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-09-11 · logsource: product=windows category=process_creation · 49d9671b-0a0a-4c09-8280-d215bfd30662

Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may use wmic to terminate security products or other applications on the compromised host. This event is triggered on on attempt and process creation can be either successful or unsuccessful.

Techniques: T1047

RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class mediumexperimental

Author: Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-15 · logsource: product=windows category=process_creation · 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d

Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.

Techniques: T1021.001 T1047

All 52 rules on the technique page →

T1070.004 File Deletion secondary impact

DET0140 Behavioral Detection of Malicious File Deletion
AN0392 Windows
Detects adversary behavior deleting artifacts (e.g., dropped payloads, evidence files) using native or external utilities (e.g., del, erase, SDelete). Detects deletion events correlated with unusual process lineage or timing post-execution.

WinEventLog:Sysmon EventCode=23 → DC0040 File Deletion
WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

Tunable: TimeWindow FilePathPattern UserContext

AN0393 Linux
Detects deletion of suspicious files (e.g., payloads, temp exes, scripts) via rm, unlink, or secure deletion tools like shred, especially when performed by unexpected users or shortly after execution.

auditd:SYSCALL PATH → DC0040 File Deletion
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: PathRegex TimeWindow SecureDeletionTool

AN0394 macOS
Detects removal of adversary artifacts via rm, unlink, or secure tools, with focus on shell sessions, temp files, and modified LaunchAgents or system directories.

fs:fsusage unlink, write → DC0061 File Modification
macos:unifiedlog process → DC0032 Process Creation

Tunable: FilePathRegex ToolUsageAnomaly

AN0395 ESXi
Detects manual or scripted removal of logs, artifacts, or malware droppings via rm or PowerCLI in ESXi shell. Focus on deletions from /tmp/, /var/core/, or /scratch.

esxi:shell /var/log/shell.log → DC0040 File Deletion

Tunable: LogFilePath TimeWindow

Sigma rules tagged `attack.t1070.004` (15)

Prefetch File Deleted hightest

Author: Cedric MAURUGEON · 2021-09-29 (modified 2024-01-25) · logsource: product=windows category=file_delete · 0a1f9d29-6465-4776-b091-7f43b26e4c89

Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence

Techniques: T1070.004

Greedy File Deletion Using Del mediumtest

Author: frack113 , X__Junior (Nextron Systems) · 2021-12-02 (modified 2023-09-11) · logsource: product=windows category=process_creation · 204b17ae-4007-471b-917b-b917b315c5db

Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

Techniques: T1070.004

File Deletion informationalstable

Author: Ömer Günal, oscd.community · 2020-10-07 (modified 2022-09-15) · logsource: product=linux category=process_creation · 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

Techniques: T1070.004

ADS Zone.Identifier Deleted By Uncommon Application mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-09-04 (modified 2025-07-04) · logsource: product=windows category=file_delete · 3109530e-ab47-4cc6-a953-cac5ebcc93ae

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Techniques: T1070.004

File Deletion Via Del lowtest

Author: frack113 · 2022-01-15 (modified 2024-03-05) · logsource: product=windows category=process_creation · 379fa130-190e-4c3f-b7bc-6c8e834485f3

Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Techniques: T1070.004

Potential Secure Deletion with SDelete mediumtest

Author: Thomas Patzke · 2017-06-14 (modified 2024-12-13) · logsource: product=windows service=security · 39a80702-d7ca-4a83-b776-525b1f86a36d

Detects files that have extensions commonly seen while SDelete is used to wipe files.

Techniques: T1070.004 T1027.005 T1485 T1553.002

Directory Removal Via Rmdir lowtest

Author: frack113 · 2022-01-15 (modified 2023-03-07) · logsource: product=windows category=process_creation · 41ca393d-538c-408a-ac27-cf1e038be80c

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Techniques: T1070.004

Suspicious Ping/Del Command Combination hightest

Author: Ilya Krestinichev · 2022-11-03 (modified 2024-03-05) · logsource: product=windows category=process_creation · 54786ddc-5b8a-11ed-9b6a-0242ac120002

Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example

Techniques: T1070.004

File Deleted Via Sysinternals SDelete mediumtest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-05-02 (modified 2023-02-15) · logsource: product=windows category=file_delete · 6ddab845-b1b8-49c2-bbf7-1a11967f64bc

Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.

Techniques: T1070.004

Cisco File Deletion mediumtest

Author: Austin Clark · 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 71d65515-c436-43c0-841b-236b1f32c21e

See what files are being deleted from flash file systems

Techniques: T1070.004 T1561.001 T1561.002

ADS Zone.Identifier Deleted lowtest

Author: frack113 · 2023-09-04 · logsource: product=windows category=file_delete · 7eac0a16-5832-4e81-865f-0268a6d19e4b

Detects the deletion of the "Zone.Identifier" ADS. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Techniques: T1070.004

Backup Catalog Deleted mediumtest

Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) · 2017-05-12 (modified 2022-12-25) · logsource: product=windows service=application · 9703792d-fd9a-456d-a672-ff92efe4806a

Detects backup catalog deletions

Techniques: T1070.004

TeamViewer Log File Deleted lowtest

Author: frack113 · 2022-01-16 (modified 2023-02-15) · logsource: product=windows category=file_delete · b1decb61-ed83-4339-8e95-53ea51901720

Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence

Techniques: T1070.004

Use Of Remove-Item to Delete File - ScriptBlock lowtest

Author: frack113 · 2022-01-15 (modified 2022-03-17) · logsource: product=windows category=ps_script · b8af5f36-1361-4ebe-9e76-e36128d947bf

PowerShell Remove-Item with -Path to delete a file or a folder with "-Recurse"

Techniques: T1070.004

Potentially Suspicious Ping/Copy Command Combination mediumtest

Author: X__Junior (Nextron Systems) · 2023-07-18 (modified 2024-03-06) · logsource: product=windows category=process_creation · ded2b07a-d12f-4284-9b76-653e37b6c8b0

Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.

Techniques: T1070.004

T1087.002 Domain Account secondary impact

DET0129 Domain Account Enumeration Across Platforms
AN0363 Windows
Adversary enumeration of domain accounts using net.exe, PowerShell, WMI, or LDAP queries from non-domain controllers or non-admin endpoints.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution
NSM:Flow LDAP Bind/Search → DC0085 Network Traffic Content

Tunable: CommandLinePattern TimeWindow SourceHost

AN0364 Linux
Domain account enumeration using ldapsearch, samba tools (e.g., 'wbinfo -u'), or winbindd lookups.

auditd:SYSCALL execve → DC0032 Process Creation
linuxsyslog nslcd or winbind logs → DC0064 Command Execution
NSM:Flow LDAP Query → DC0085 Network Traffic Content

Tunable: ProcessName LDAPSearchFilter UserContext

AN0365 macOS
Domain group and user enumeration via dscl or dscacheutil, or queries to directory services from non-admin endpoints.

macos:unifiedlog Process Execution → DC0032 Process Creation
macos:unifiedlog DS daemon log entries → DC0064 Command Execution

Tunable: CommandPattern EndpointRole

Sigma rules tagged `attack.t1087.002` (21)

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

BloodHound Collection Files hightest

Author: C.J. May · 2022-08-09 (modified 2026-02-19) · logsource: product=windows category=file_event · 02773bed-83bf-469f-b7ff-e676e7d78bab

Detects default file names outputted by the BloodHound collection tool SharpHound

Techniques: T1087.001 T1087.002 T1482 T1069.001 T1069.002 T1059.001

ADExplorer Writing Complete AD Snapshot Into .dat File mediumexperimental

Author: Arnim Rupp (Nextron Systems), Thomas Patzke · 2025-07-09 · logsource: product=windows category=file_event · 0a1255c5-d732-4b62-ac02-b5152d34fb83

Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

Net.EXE Execution lowtest

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · 2019-01-16 (modified 2022-07-11) · logsource: product=windows category=process_creation · 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac

Detects execution of "Net.EXE".

Techniques: T1007 T1049 T1018 T1135 T1201 T1069.001 T1069.002 T1087.001 T1087.002 T1021.002

Potential Active Directory Reconnaissance/Enumeration Via LDAP mediumtest

Author: Adeem Mawani · 2021-06-22 (modified 2025-07-04) · logsource: product=windows service=ldap · 31d68132-4038-47c7-8f8e-635a39a7c174

Detects potential Active Directory enumeration via LDAP

Techniques: T1069.002 T1087.002 T1482

AD Privileged Users or Groups Reconnaissance hightest

Author: Samir Bousseaden · 2019-04-03 (modified 2022-07-13) · logsource: product=windows service=security · 35ba1d85-724d-42a3-889f-2e2362bcaf23

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

Techniques: T1087.002

Active Directory Computers Enumeration With Get-AdComputer lowtest

Author: frack113 · 2022-03-17 (modified 2023-07-08) · logsource: product=windows category=ps_script · 36bed6b2-e9a0-4fff-beeb-413a92b86138

Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

Techniques: T1018 T1087.002

PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE hightest

Author: frack113 · 2021-12-13 (modified 2023-03-05) · logsource: product=windows category=process_creation · 455b9d50-15a1-4b99-853f-8d37655a4c1b

Detects active directory enumeration activity using known AdFind CLI flags

Techniques: T1087.002

PUA - AdFind.EXE Execution mediumexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-02-26 · logsource: product=windows category=process_creation · 514e7e3e-b3b4-4a67-af60-be20f139198b

Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment

Techniques: T1087.002

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer · 2017-03-05 (modified 2025-12-10) · logsource: product=windows category=ps_script · 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Active Directory Database Snapshot Via ADExplorer mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-03-14 (modified 2025-07-09) · logsource: product=windows category=process_creation · 9212f354-7775-4e28-9c9f-8f0a4544e664

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

Reconnaissance Activity hightest

Author: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community · 2017-03-07 (modified 2022-08-22) · logsource: product=windows service=security · 968eef52-9cff-4454-8992-1e74b9cbad6c

Detects activity as "net user administrator /domain" and "net group domain admins /domain"

Techniques: T1087.002 T1069.002

PUA - AdFind Suspicious Execution hightest

Author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community · 2021-02-02 (modified 2025-10-24) · logsource: product=windows category=process_creation · 9a132afa-654e-11eb-ae93-0242ac130002

Detects AdFind execution with common flags seen used during attacks

Techniques: T1018 T1087.002 T1482 T1069.002

Suspicious Use of PsLogList mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2021-12-18 (modified 2026-06-29) · logsource: product=windows category=process_creation · aae1243f-d8af-40d8-ab20-33fc6d0c55bc

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Techniques: T1087 T1087.001 T1087.002

All 21 rules on the technique page →

T1136 Create Account secondary impact

DET0583 Detection Strategy for T1136 - Create Account across platforms
AN1604 Windows
Adversary uses built-in OS tools or API calls to create local or domain accounts for persistence or lateral movement. Tools such as 'net user', PowerShell, or MMC snap-ins may be used. Detection focuses on Event ID 4720 paired with process lineage and user context.

WinEventLog:Security EventCode=4720 → DC0014 User Account Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: TimeWindow ParentProcessName UserContext

AN1605 Linux
Adversary invokes 'useradd', 'adduser', or equivalent system commands or scripts to create local users. Detection focuses on command execution and audit trail of passwd/shadow file modifications.

auditd:SYSCALL useradd or adduser executed → DC0014 User Account Creation
auditd:SYSCALL chmod/chown to /etc/passwd or /etc/shadow → DC0061 File Modification

Tunable: BinaryPath ExecutionTime

AN1606 macOS
Adversary creates new users using 'dscl' commands, GUI tools, or by modifying user plist files. Detection includes monitoring dscl invocation and user-related plist changes.

macos:unifiedlog dscl . -create → DC0064 Command Execution
macos:unifiedlog modification to /var/db/dslocal/nodes/Default/users/ → DC0061 File Modification

Tunable: UsernamePattern ExecutionSource

AN1607 Identity Provider
Adversary creates users via IAM/IdP API or portal (e.g., Azure AD, Okta). Detection involves monitoring API calls, admin action logs, and correlation with role assignments.

azure:audit Add user → DC0014 User Account Creation

Tunable: AdminThreshold AutomationExemptions

AN1608 IaaS
Account creation via cloud service APIs or CLI, often associated with key generation. Monitored via CloudTrail or equivalent audit logs.

AWS:CloudTrail CreateUser → DC0014 User Account Creation
AWS:CloudTrail AttachUserPolicy → DC0010 User Account Modification

Tunable: Region ServiceScope

Sigma rules tagged `attack.t1136` (3)

AWS ElastiCache Security Group Created lowtest

Author: Austin Songer @austinsonger · 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 4ae68615-866f-4304-b24b-ba048dfa5ca7

Detects when an ElastiCache security group has been created.

Techniques: T1136 T1136.003

ESXi Account Creation Via ESXCLI mediumtest

Author: Cedric Maurugeon · 2023-08-22 · logsource: product=linux category=process_creation · b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db

Detects user account creation on ESXi system via esxcli

Techniques: T1136 T1059.012

New Kubernetes Service Account Created lowtest

Author: Leo Tsaousis (@laripping) · 2024-03-26 · logsource: product=kubernetes category=application service=audit · e31bae15-83ed-473e-bf31-faf4f8a17d36

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

Techniques: T1136

T1140 Deobfuscate/Decode Files or Information secondary impact

DET0275 Detect Adversary Deobfuscation or Decoding of Files and Payloads
AN0767 Windows
An adversary leverages built-in tools such as certutil.exe, powershell.exe, or copy.exe to decode, reassemble, or extract hidden malicious content from obfuscated containers or encoded formats. The decoding utility often spawns shortly after file staging or download and may be chained with script interpreters or further payload execution.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

Tunable: ToolName FileExtensionFilter CommandLineRegex TimeWindow

AN0768 Linux
The adversary uses native utilities like base64, gzip, tar, or openssl to decode, decompress, or decrypt files that were previously staged or downloaded. These tools may be chained with curl/wget and executed via bash/zsh, often to extract an embedded payload or reverse shell script.

auditd:SYSCALL bash/zsh of base64, tar, gzip, or openssl immediately after file write → DC0064 Command Execution

Tunable: ShellProcessName DecodeUtility ParentProcess ArgumentPattern

AN0769 macOS
The adversary invokes built-in scripting or decoding tools like base64, plutil, or AppleScript-based utilities to decode files embedded in staging artifacts. Decoding often occurs post-download or as part of post-exploitation payload deployment via zsh, python, or osascript.

macos:unifiedlog base64 -d or osascript invoked on staged file → DC0064 Command Execution

Tunable: DecodeInterpreter ExecutionContext UserContext

Sigma rules tagged `attack.t1140` (18)

DNS-over-HTTPS Enabled by Registry mediumtest

Author: Austin Songer · 2021-07-22 (modified 2023-08-17) · logsource: product=windows category=registry_set · 04b45a8a-d11d-49e4-9acc-4a1b524407a5

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

Techniques: T1140 T1112

Potential Base64 Decoded From Images hightest

Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2023-12-20 · logsource: product=macos category=process_creation · 09a910bf-f71f-4737-9c40-88880ba5913d

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

Techniques: T1140

Ping Hex IP hightest

Author: Florian Roth (Nextron Systems) · 2018-03-23 (modified 2025-10-17) · logsource: product=windows category=process_creation · 1a0d4aba-7668-4365-9ce4-6d79ab088dfd

Detects a ping command that uses a hex encoded IP address

Techniques: T1140 T1027

PowerShell Decompress Commands informationaltest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-05-02 (modified 2022-12-25) · logsource: product=windows category=ps_module · 1ddc1472-8e52-4f7d-9f11-eab14fc171f5

A General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.

Techniques: T1140

Payload Decoded and Decrypted via Built-in Utilities mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Techniques: T1059 T1204 T1140

UNC4841 - Download Tar File From Untrusted Direct IP Via Wget hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-16 · logsource: product=linux category=process_creation · 23835beb-ec38-4e74-a5d4-b99af6684e91

Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Techniques: T1140

UNC4841 - SSL Certificate Exfiltration Via Openssl hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-16 · logsource: product=linux category=process_creation · 60911c07-f989-4362-84af-c609828ef829

Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.

Techniques: T1140

UNC4841 - Download Compressed Files From Temp.sh Using Wget hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-16 · logsource: product=linux category=process_creation · 60d050c4-e253-4d9a-b673-5ac100cfddfb

Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Techniques: T1140

Linux Shell Pipe to Shell mediumtest

Author: Florian Roth (Nextron Systems) · 2022-03-14 (modified 2022-07-26) · logsource: product=linux category=process_creation · 880973f3-9708-491c-a77b-2a35a1921158

Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell

Techniques: T1140

Potential BlackByte Ransomware Activity hightest

Author: Florian Roth (Nextron Systems) · 2022-02-25 (modified 2023-02-08) · logsource: product=windows category=process_creation · 999e8307-a775-4d5f-addc-4855632335be

Detects command line patterns used by BlackByte ransomware in different operations

Techniques: T1485 T1498 T1059.001 T1140

Linux Base64 Encoded Pipe to Shell mediumtest

Author: pH-T (Nextron Systems) · 2022-07-26 (modified 2023-06-16) · logsource: product=linux category=process_creation · ba592c6d-6888-43c3-b8c6-689b8fe47337

Detects suspicious process command line that uses base64 encoded input for execution with a shell

Techniques: T1140

Suspicious XOR Encoded PowerShell Command mediumtest

Author: Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali · 2018-09-05 (modified 2023-01-30) · logsource: product=windows category=process_creation · bb780e0c-16cf-4383-8383-1e5471db6cf9

Detects presence of a potentially xor encoded powershell command

Techniques: T1059.001 T1140 T1027

MSHTA Execution with Suspicious File Extensions hightest

Author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems) · 2019-02-22 (modified 2025-05-12) · logsource: product=windows category=process_creation · cc7abbd0-762b-41e3-8a26-57ad50d2eea3

Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.

Techniques: T1140 T1218.005 T1059.007

CVE tags: CVE-2020-1599

Suspicious Inbox Manipulation Rules hightest

Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' · 2023-09-03 · logsource: product=azure service=riskdetection · ceb55fd0-726e-4656-bf4e-b585b7f7d572

Detects suspicious rules that delete or move messages or folders are set on a user's inbox.

Techniques: T1140

Base64 Encoded PowerShell Command Detected hightest

Author: Florian Roth (Nextron Systems) · 2020-01-29 (modified 2023-01-26) · logsource: product=windows category=process_creation · e32d4572-9826-4738-b651-95fa63747e8a

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

Techniques: T1027 T1140 T1059.001

All 18 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 Windows
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList

AN0220 Linux
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content
auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

Tunable: WebProcList ChildToolList BurstThreshold TimeWindow

AN0221 macOS
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content
macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation
NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

Tunable: ServiceList TimeWindow

AN0222 Containers
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content
docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation
NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

Tunable: IngressNamespaces MetadataEndpoints TimeWindow

AN0223 IaaS
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content
AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

Tunable: LBProjects ErrorBurst

AN0224 ESXi
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content
NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

Tunable: MgmtCIDR TimeWindow

AN0225 Network Devices
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content
NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged `attack.t1190` (149)

Potential CVE-2023-25717 Exploitation Attempt hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Techniques: T1190

CVE tags: CVE-2023-25717

Potential CVE-2021-27905 Exploitation Attempt mediumtest

Author: @gott_cyber · 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Techniques: T1190

CVE tags: CVE-2021-27905

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 criticaltest

Author: Florian Roth (Nextron Systems) · 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Techniques: T1190

CVE tags: CVE-2020-8193CVE-2020-8195

Ruby on Rails Framework Exceptions mediumstable

Author: Thomas Patzke · 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Techniques: T1190

Potential CVE-2023-23752 Exploitation Attempt hightest

Author: Bhabesh Raj · 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Techniques: T1190

CVE tags: CVE-2023-23752

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Terminal Service Process Spawn hightest

Author: Florian Roth (Nextron Systems) · 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Techniques: T1190 T1210

RDS Database Security Group Modification mediumtest

Author: jamesc-grafana · 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015

Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.

Techniques: T1190

Cisco ASA Exploitation Activity - Proxy highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Techniques: T1190

CVE tags: CVE-2025-20333CVE-2025-20362

TerraMaster TOS CVE-2020-28188 hightest

Author: Bhabesh Raj · 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Techniques: T1190

CVE tags: CVE-2020-28188

Potential Server Side Template Injection In Velocity hightest

Author: Moti Harmats · 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Techniques: T1190

CVE-2021-21972 VSphere Exploitation hightest

Author: Bhabesh Raj · 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Techniques: T1190

CVE tags: CVE-2021-21972

Potential OWASSRF Exploitation Attempt - Webserver hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Techniques: T1190

Suspicious User-Agents Related To Recon Tools mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton · 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a

Detects known suspicious (default) user-agents related to scanning/recon tools

Techniques: T1190

Python SQL Exceptions mediumstable

Author: Thomas Patzke · 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9

Generic rule for SQL exceptions in Python according to PEP 249

Techniques: T1190

All 149 rules on the technique page →

T1218 System Binary Proxy Execution secondary impact

DET0081 Detection of Proxy Execution via Trusted Signed Binaries Across Platforms
AN0226 Windows
Execution of trusted, Microsoft-signed binaries such as rundll32.exe, msiexec.exe, or regsvr32.exe used to execute externally hosted, unsigned, or suspicious payloads through command-line parameters or network retrieval.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

Tunable: ParentProcessName SignedBinaryList CommandLineRegex RemoteDomainAllowlist

AN0227 Linux
Execution of trusted system binaries (e.g., split, tee, bash, env) used in uncommon sequences or chained behaviors to execute malicious payloads or perform actions inconsistent with normal system or script behavior.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:SYSCALL connect → DC0082 Network Connection Creation

Tunable: TrustedBinaryList AnomalyScore

AN0228 macOS
Use of system binaries such as osascript, bash, or curl to download or execute unsigned code or files in conjunction with application proxying.

macos:unifiedlog exec of osascript, bash, curl with suspicious parameters → DC0032 Process Creation
macos:osquery execution of trusted tools interacting with external endpoints → DC0082 Network Connection Creation

Tunable: TrustedUtilityList SignedToUnsignedTransition

Sigma rules tagged `attack.t1218` (153)

Potentially Over Permissive Permissions Granted Using Dsacls.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-20 (modified 2023-02-04) · logsource: product=windows category=process_creation · 01c42d3c-242d-4655-85b2-34f1739632f7

Detects usage of Dsacls to grant over permissive permissions

Techniques: T1218

Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution mediumtest

Author: frack113 · 2022-03-06 (modified 2023-08-03) · logsource: product=windows category=process_creation · 02b18447-ea83-4b1b-8805-714a8a34546a

Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory. The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.

Techniques: T1218

Insensitive Subfolder Search Via Findstr.EXE lowtest

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Techniques: T1218 T1564.004 T1552.001 T1105

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

Techniques: T1218 T1105

CVE tags: CVE-2025-33053

Time Travel Debugging Utility Usage hightest

Author: Ensar Şamil, @sblmsrsn, @oscd_initiative · 2020-10-06 (modified 2022-10-09) · logsource: product=windows category=process_creation · 0b4ae027-2a2d-4b93-8c7e-962caaba5b2a

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

Techniques: T1218 T1003.001

Execution via WorkFolders.exe hightest

Author: Maxime Thiebaut (@0xThiebaut) · 2021-10-21 (modified 2022-12-25) · logsource: product=windows category=process_creation · 0bbc6369-43e3-453d-9944-cae58821c173

Detects using WorkFolders.exe to execute an arbitrary control.exe

Techniques: T1218

Diskshadow Script Mode Execution mediumtest

Author: Ivan Dyachkov, oscd.community · 2020-10-07 (modified 2024-03-13) · logsource: product=windows category=process_creation · 0c2f8629-7129-4a8a-9897-7e0768f13ff2

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that deleted the shadow copies on the systems. Investigate the content of the scripts and its location.

Techniques: T1218

Potential DLL Sideloading Using Coregen.exe mediumtest

Author: frack113 · 2022-12-31 · logsource: product=windows category=image_load · 0fa66f66-e3f6-4a9c-93f8-4f2610b00171

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Techniques: T1218 T1055

File Download Using ProtocolHandler.exe mediumtest

Author: frack113 · 2021-07-13 (modified 2023-11-09) · logsource: product=windows category=process_creation · 104cdb48-a7a8-4ca7-a453-32942c6e5dcb

Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)

Techniques: T1218

Malicious PE Execution by Microsoft Visual Studio Debugger mediumtest

Author: Agro (@agro_sev), Ensar Şamil (@sblmsrsn), oscd.community · 2020-10-14 (modified 2022-10-09) · logsource: product=windows category=process_creation · 15c7904e-6ad1-4a45-9b46-5fb25df37fd2

There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package.

Techniques: T1218

Potential File Download Via MS-AppInstaller Protocol Handler mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel · 2023-11-09 · logsource: product=windows category=process_creation · 180c7c5c-d64b-4a63-86e9-68910451bc8b

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>"

Techniques: T1218

REGISTER_APP.VBS Proxy Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-08-19 · logsource: product=windows category=process_creation · 1c8774a0-44d4-4db0-91f8-e792359c70bd

Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.

Techniques: T1218

Legitimate Application Writing Files In Uncommon Location highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-12-10 · logsource: product=windows category=file_event · 1cf465a1-2609-4c15-9b66-c32dbe4bfd67

Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution. Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.

Techniques: T1218 T1105

Scheduled Task Creation with Curl and PowerShell Execution Combo mediumexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-02-05 · logsource: product=windows category=process_creation · 1d174d38-8fda-4081-a9b6-56d9763c0cd8

Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.

Techniques: T1053.005 T1218 T1105

Potentially Suspicious Mofcomp Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-07-12 (modified 2026-08-06) · logsource: product=windows category=process_creation · 1dd05363-104e-4b4a-b963-196a534b03a1

Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts

Techniques: T1218

All 153 rules on the technique page →

T1505.003 Web Shell primary impact, secondary impact

DET0394 Web Shell Detection via Server Behavior and File Execution Chains
AN1108 Windows
Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)

WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation
NSM:Flow Inbound HTTP POST with suspicious payload size or user-agent → DC0085 Network Traffic Content

Tunable: WebRootPath ParentProcess

AN1109 Linux
File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx

auditd:SYSCALL new file created in /var/www/html, /srv/http, or similar web root → DC0039 File Creation
auditd:SYSCALL apache2 or nginx spawning sh, bash, or python interpreter → DC0032 Process Creation
NSM:Flow POST requests to .php, .jsp, .aspx files with high entropy body → DC0085 Network Traffic Content

Tunable: WebRootPath PayloadEntropyThreshold TimeWindow

AN1110 macOS
Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www

macos:unifiedlog httpd spawning bash, zsh, python, or osascript → DC0032 Process Creation
auditd:SYSCALL file write operations in /Library/WebServer/Documents → DC0061 File Modification

Tunable: InterpreterName ExecutionParent

Sigma rules tagged `attack.t1505.003` (35)

Suspicious File Write to SharePoint Layouts Directory highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-07-24 · logsource: product=windows category=file_event · 1f0489be-b496-4ddf-b3a9-5900f2044e9c

Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.

Techniques: T1190 T1505.003

Suspicious Process Spawned by CentreStack Portal AppPool highexperimental

Author: Jason Rathbun (Blackpoint Cyber) · 2025-04-17 · logsource: product=windows category=process_creation · 2d79e371-2a27-42de-87a4-b4213fc72a6a

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

Techniques: T1059.003 T1505.003

CVE tags: CVE-2025-30406

Webshell ReGeorg Detection Via Web Logs hightest

Author: Cian Heasley · 2020-08-04 (modified 2023-01-02) · logsource: category=webserver · 2ea44a60-cfda-11ea-87d0-0242ac130003

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Techniques: T1505.003

Execution From Webserver Root Folder mediumtest

Author: Florian Roth (Nextron Systems) · 2019-01-16 (modified 2024-01-18) · logsource: product=windows category=process_creation · 35efb964-e6a5-47ad-bbcd-19661854018d

Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors

Techniques: T1505.003

Oracle WebLogic Exploit criticaltest

Author: Florian Roth (Nextron Systems) · 2018-07-22 (modified 2023-01-02) · logsource: category=webserver · 37e8369b-43bb-4bf8-83b6-6dd43bda2000

Detects access to a webshell dropped into a keystore folder on the WebLogic server

Techniques: T1190 T1505.003

CVE tags: CVE-2018-2894

Potential Webshell Creation On Static Website mediumtest

Author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo · 2019-10-22 (modified 2023-10-15) · logsource: product=windows category=file_event · 39f1f9f2-9636-45de-98f6-a4046aa8e4b9

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Techniques: T1505.003

MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-03 (modified 2023-07-28) · logsource: category=webserver · 435e41f2-48eb-4c95-8a2b-ed24b50ec30b

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Techniques: T1505.003

CVE tags: CVE-2023-34362

Webshell Hacking Activity Patterns hightest

Author: Florian Roth (Nextron Systems) · 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Techniques: T1505.003 T1018 T1033 T1087

Mailbox Export to Exchange Webserver criticaltest

Author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems) · 2021-08-09 (modified 2023-04-30) · logsource: product=windows service=msexchange-management · 516376b4-05cd-4122-bae0-ad7641c38d48

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Techniques: T1505.003

Potential Java WebShell Upload in SAP NetViewer Server highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-05-14 · logsource: category=webserver · 639b893f-f93a-4e53-a7c8-f08cf73fe7f7

Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.

Techniques: T1505.003

CVE tags: CVE-2025-31324

Suspicious File Drop by Exchange mediumtest

Author: Florian Roth (Nextron Systems) · 2022-10-04 · logsource: product=windows category=file_event · 6b269392-9eba-40b5-acb6-55c882b20ba6

Detects suspicious file type dropped by an Exchange component in IIS

Techniques: T1190 T1505.003

Suspicious MSExchangeMailboxReplication ASPX Write hightest

Author: Florian Roth (Nextron Systems) · 2022-02-25 · logsource: product=windows category=file_event · 7280c9f3-a5af-45d0-916a-bc01cb4151c9

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

Techniques: T1190 T1505.003

Windows Webshell Strings hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2017-02-19 (modified 2022-11-18) · logsource: category=webserver · 7ff9db12-1b94-4a79-ba68-a2402c5d6729

Detects common commands used in Windows webshells

Techniques: T1505.003

Linux Webshell Indicators hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-10-15 (modified 2026-08-19) · logsource: product=linux category=process_creation · 818f7b24-0fba-4c49-a073-8b755573b9c7

Detects suspicious sub processes of web server processes

Techniques: T1505.003

Suspicious Process By Web Server Process hightest

Author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) · 2019-01-16 (modified 2024-11-26) · logsource: product=windows category=process_creation · 8202070f-edeb-4d31-a010-a26c72ac5600

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Techniques: T1505.003 T1190

All 35 rules on the technique page →

T1560.001 Archive via Utility secondary impact

DET0298 Detect Archiving via Utility (T1560.001)
AN0831 Windows
Detects adversarial archiving using built-in or third-party utilities (makecab, diantz, xcopy, certutil, 7z, WinRAR, WinZip). Correlates suspicious process creation events with command-line arguments for compression/encoding, followed by creation of archive files (.cab, .zip, .7z, .rar). Identifies anomalous loading of crypt32.dll for encryption operations or execution of diantz.exe to compress remotely staged files.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

Tunable: SuspiciousExtensions ProcessAllowlist FileSizeThresholdMB

AN0832 Linux
Detects execution of archiving utilities (tar, gzip, bzip2, xz, zip, openssl) followed by suspicious archive file creation. Correlates archive creation in temporary or staging directories with execution of commands involving compression or encryption options.

auditd:SYSCALL execve: Execution of tar, gzip, bzip2, xz, zip, or openssl with compression/encryption arguments → DC0064 Command Execution
auditd:FILE create: Creation of archive files in /tmp, /var/tmp, or user home directories → DC0039 File Creation

Tunable: ArchiveCommands MonitoredDirectories TimeWindow

AN0833 macOS
Detects invocation of macOS-native archiving utilities (zip, ditto, hdiutil) or openssl used for encryption. Correlates execution with archive or encrypted file creation (.zip, .dmg, .tar.gz) in user or temporary directories. Identifies anomalous use of archiving commands by Office applications or daemons.

macos:unifiedlog Execution of zip, ditto, hdiutil, or openssl by processes not normally associated with archiving → DC0032 Process Creation
macos:unifiedlog Creation of .zip, .dmg, .tar.gz files in /Users, /tmp, or application directories → DC0039 File Creation

Tunable: AllowedArchivers UserContext PayloadEntropyThreshold

Sigma rules tagged `attack.t1560.001` (17)

APT31 Judgement Panda Activity criticaltest

Author: Florian Roth (Nextron Systems) · 2019-02-21 (modified 2023-03-10) · logsource: product=windows category=process_creation · 03e2746e-2b31-42f1-ab7a-eb39365b2422

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

Techniques: T1003.001 T1560.001

Winrar Compressing Dump Files mediumtest

Author: Florian Roth (Nextron Systems) · 2022-01-04 (modified 2023-09-12) · logsource: product=windows category=process_creation · 1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc

Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Techniques: T1560.001

Potentially Suspicious Compression Tool Parameters mediumtest

Author: Florian Roth (Nextron Systems), Samir Bousseaden · 2019-10-15 (modified 2023-08-29) · logsource: product=windows category=process_creation · 27a72a60-7e5e-47b1-9d17-909c9abafdcd

Detects potentially suspicious command line arguments of common data compression tools

Techniques: T1560.001

LiteLLM / TeamPCP Supply Chain Attack Indicators highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-03-30 · logsource: product=linux category=process_creation · 36603778-030c-43c4-8cbb-cd3c1d1a80c7

Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8). In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.

Techniques: T1195.002 T1560.001 T1543.002

Compressed File Creation Via Tar.EXE lowtest

Author: Nasreddine Bencherchali (Nextron Systems), AdmU3 · 2023-12-19 · logsource: product=windows category=process_creation · 418a3163-3247-4b7b-9933-dcfcb7c52ea9

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Techniques: T1560 T1560.001

WinRAR Execution in Non-Standard Folder mediumtest

Author: Florian Roth (Nextron Systems), Tigzy · 2021-11-17 (modified 2025-07-16) · logsource: product=windows category=process_creation · 4ede543c-e098-43d9-a28f-dd784a13132f

Detects a suspicious WinRAR execution in a folder which is not the default installation folder

Techniques: T1560.001

Suspicious Manipulation Of Default Accounts Via Net.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-09-01 (modified 2023-02-21) · logsource: product=windows category=process_creation · 5b768e71-86f2-4879-b448-81061cbae951

Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc

Techniques: T1560.001

Cisco Stage Data lowtest

Author: Austin Clark · 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59

Various protocols maybe used to put data on the device for exfil or infil

Techniques: T1074 T1105 T1560.001

Files Added To An Archive Using Rar.EXE lowtest

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community · 2019-10-21 (modified 2023-02-05) · logsource: product=windows category=process_creation · 6f3e2987-db24-4c78-a860-b4f4095a7095

Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Techniques: T1560.001

Compress Data and Lock With Password for Exfiltration With 7-ZIP mediumtest

Author: frack113 · 2021-07-27 (modified 2026-06-05) · logsource: product=windows category=process_creation · 9fbf5927-5261-4284-a71d-f681029ea574

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Techniques: T1560.001

Data Compressed lowtest

Author: Timur Zinniatullin, oscd.community · 2019-10-21 (modified 2023-07-28) · logsource: product=linux service=auditd · a3b5e3e9-1b49-4119-8b8e-0344a01f21ee

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Techniques: T1560.001

Password Protected Compressed File Extraction Via 7Zip lowtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-03-10 (modified 2026-06-05) · logsource: product=windows category=process_creation · b717b8fd-6467-4d7d-b3d3-27f9a463af77

Detects usage of 7zip utilities (7z.exe, 7za.exe and 7zr.exe) to extract password protected zip files.

Techniques: T1560.001

Disk Image Mounting Via Hdiutil - MacOS mediumtest

Author: Omar Khaled (@beacon_exe) · 2024-08-10 · logsource: product=macos category=process_creation · bf241472-f014-4f01-a869-96f99330ca8c

Detects the execution of the hdiutil utility in order to mount disk images.

Techniques: T1566.001 T1560.001

Compressed File Extraction Via Tar.EXE lowtest

Author: AdmU3 · 2023-12-19 · logsource: product=windows category=process_creation · bf361876-6620-407a-812f-bfe11e51e924

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.

Techniques: T1560 T1560.001

Compress Data and Lock With Password for Exfiltration With WINZIP mediumtest

Author: frack113 · 2021-07-27 (modified 2022-12-25) · logsource: product=windows category=process_creation · e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Techniques: T1560.001

All 17 rules on the technique page →

T1573.001 Symmetric Cryptography secondary impact

DET0143 Detection Strategy for Encrypted Channel via Symmetric Cryptography across OS Platforms
AN0400 Windows
Processes that typically do not perform cryptographic operations loading symmetric encryption libraries (e.g., bcryptprimitives.dll, aes.dll), then initiating outbound connections with high-entropy payloads. Defender correlates process creation, DLL load, and anomalous encrypted traffic patterns.

WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: AllowedCryptoProcesses EntropyThreshold TimeWindow

AN0401 Linux
Unexpected processes (e.g., bash, python, custom binaries) dynamically loading libcrypto or performing AES/RC4 encryption operations, then initiating outbound sessions with abnormal byte entropy or asymmetric traffic patterns.

auditd:SYSCALL execve or socket/connect system calls from processes using crypto libraries → DC0032 Process Creation
linux:syslog System daemons initiating encrypted sessions with unexpected destinations → DC0038 Application Log Content
linux:osquery Process linked with libcrypto.so making external connections → DC0016 Module Load

Tunable: TrustedCryptoLibs TrafficAsymmetryRatio

AN0402 macOS
Launchd jobs or user processes invoking symmetric crypto APIs from the Security framework and generating outbound connections carrying randomized payloads inconsistent with normal TLS patterns.

macos:unifiedlog Process using AES/RC4 routines unexpectedly → DC0032 Process Creation
macos:unifiedlog Encrypted connection with anomalous payload entropy → DC0085 Network Traffic Content

Tunable: DoHResolvers PayloadEntropyThreshold

AN0403 ESXi
ESXi daemons (hostd, vpxa) unexpectedly using symmetric encryption routines for external connections. Defender identifies logs of service traffic with encrypted payloads inconsistent with VMware management baselines.

esxi:vpxd Symmetric crypto routines triggered for external session → DC0038 Application Log Content
esxcli:network Socket sessions with randomized payloads inconsistent with TLS → DC0085 Network Traffic Content

Tunable: AllowedMgmtHosts

AN0404 Network Devices
Flows showing encrypted payloads with high entropy not matching TLS handshake patterns, particularly when occurring on non-standard ports. Defender observes NetFlow/IPFIX byte distribution anomalies or IDS/IPS detecting symmetric encryption patterns without associated key exchange.

NSM:Flow Flow records with entropy signatures resembling symmetric encryption → DC0078 Network Traffic Flow
NSM:Connections Symmetric encryption detected without TLS handshake sequence → DC0085 Network Traffic Content

Tunable: PortProfiles TrafficVolumeThreshold

Sigma rules tagged `attack.t1573.001` (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

Sigma rules tagged with this CVE directly

2 rules carry cve.2021-40539.

ADSelfService Exploitation hightest

Author: Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems) · 2021-09-20 (modified 2023-01-02) · logsource: category=webserver · 6702b13c-e421-44cc-ab33-42cc25570f11

Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539

Techniques: T1190

CVE tags: CVE-2021-40539

CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit criticaltest

Author: Sittikorn S, Nuttakorn Tungpoonsup · 2021-09-10 (modified 2023-01-02) · logsource: category=webserver · fcbb4a77-f368-4945-b046-4499a1da69d1

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

Techniques: T1190 T1505.003

CVE tags: CVE-2021-40539

CVE-2021-40539 Mapped Partial Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1003 OS Credential Dumping secondary impact

Sigma rules tagged attack.t1003 (37)

T1003.003 NTDS secondary impact

Sigma rules tagged attack.t1003.003 (24)

T1027 Obfuscated Files or Information secondary impact

Sigma rules tagged attack.t1027 (94)

T1047 Windows Management Instrumentation secondary impact

Sigma rules tagged attack.t1047 (52)

T1070.004 File Deletion secondary impact

Sigma rules tagged attack.t1070.004 (15)

T1087.002 Domain Account secondary impact

Sigma rules tagged attack.t1087.002 (21)

T1136 Create Account secondary impact

Sigma rules tagged attack.t1136 (3)

T1140 Deobfuscate/Decode Files or Information secondary impact

Sigma rules tagged attack.t1140 (18)

T1190 Exploit Public-Facing Application exploitation technique

Sigma rules tagged attack.t1190 (149)

T1218 System Binary Proxy Execution secondary impact

Sigma rules tagged attack.t1218 (153)

T1505.003 Web Shell primary impact, secondary impact

Sigma rules tagged attack.t1505.003 (35)

T1560.001 Archive via Utility secondary impact

Sigma rules tagged attack.t1560.001 (17)

T1573.001 Symmetric Cryptography secondary impact

Sigma rules tagged attack.t1573.001 (0)

Sigma rules tagged with this CVE directly

Sigma rules tagged `attack.t1003` (37)

Sigma rules tagged `attack.t1003.003` (24)

Sigma rules tagged `attack.t1027` (94)

Sigma rules tagged `attack.t1047` (52)

Sigma rules tagged `attack.t1070.004` (15)

Sigma rules tagged `attack.t1087.002` (21)

Sigma rules tagged `attack.t1136` (3)

Sigma rules tagged `attack.t1140` (18)

Sigma rules tagged `attack.t1190` (149)

Sigma rules tagged `attack.t1218` (153)

Sigma rules tagged `attack.t1505.003` (35)

Sigma rules tagged `attack.t1560.001` (17)

Sigma rules tagged `attack.t1573.001` (0)