Coverage › CVE-2023-22952

CVE-2023-22952 Stale Partial Sigma

Multiple SugarCRM Products Remote Code Execution Vulnerability

Vendor / product: SugarCRM — Multiple Products
Description (CISA): Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
Added to KEV: 2023-02-02
Due date: 2023-02-23
Required action: Apply updates per vendor instructions.
Known ransomware use: Unknown
CWE: CWE-20
CISA notes: https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/
https://nvd.nist.gov/vuln/detail/CVE-2023-22952
Elsewhere: cve.org · NVD · CISA KEV · JSON

Stale mapping. This entry was mapped under ATT&CK 16.1; the current bundle is v19.2, and at least one mapped technique no longer stands as mapped:

T1562.001 was revoked (superseded by T1685)

The chain below is rendered for the techniques that are still live. The superseding technique is linked where ATT&CK records one, but kevmap does not transfer the mapping to it — that would be a new claim nobody has published.

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

10 mapping objects across 10 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1190 Exploit Public-Facing Application	exploitation technique	This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs. The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user. ref 1 · ref 2 · ref 3	live
T1021.001 Remote Desktop Protocol	secondary impact	This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs. The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user. ref 1 · ref 2 · ref 3	live
T1059 Command and Scripting Interpreter	primary impact	This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs. The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user. ref 1 · ref 2 · ref 3	live
T1070.004 File Deletion	secondary impact	This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs. The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user. ref 1 · ref 2 · ref 3	live
T1078 Valid Accounts	secondary impact	This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs. The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user. ref 1 · ref 2 · ref 3	live
T1083 File and Directory Discovery	secondary impact	This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs. The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user. ref 1 · ref 2 · ref 3	live
T1482 Domain Trust Discovery	secondary impact	This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs. The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user. ref 1 · ref 2 · ref 3	live
T1505.003 Web Shell	secondary impact	This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs. The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user. ref 1 · ref 2 · ref 3	live
T1530 Data from Cloud Storage	secondary impact	This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs. The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user. ref 1 · ref 2 · ref 3	live
T1562.001 Disable or Modify Tools	secondary impact	This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. This vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs. The exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the "/index.php" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to "/cache/images/sweet.phar" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument "c". For example, a request like 'POST /cache/images/sweet.phar?c="L2Jpbi9pZA=="' would execute the command "/bin/id" with the same permissions as the web service's user. ref 1 · ref 2 · ref 3	revoked → T1685

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1021.001 Remote Desktop Protocol secondary impact

DET0327 Multi-event Detection Strategy for RDP-Based Remote Logins and Post-Access Activity
AN0931 Windows
Remote Desktop (RDP) logon by a user followed by unusual process execution, file access, or lateral movement activity within a short timeframe.

WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation
WinEventLog:Security EventCode=4778, EventCode=4779 → DC0088 Logon Session Metadata
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: TimeWindow UserContext ProcessList HostAccessPatterns

Sigma rules tagged `attack.t1021.001` (16)

Potential Tampering With RDP Related Registry Keys Via Reg.EXE hightest

Author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport · 2022-02-12 (modified 2025-11-22) · logsource: product=windows category=process_creation · 0d5675be-bc88-4172-86d3-1e96a4476536

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Techniques: T1021.001 T1112

Publicly Accessible RDP Service hightest

Author: Josh Brower @DefensiveDepth · 2020-08-22 (modified 2024-03-13) · logsource: product=zeek service=rdp · 1fc0809e-06bf-4de3-ad52-25e5263b7623

Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.

Techniques: T1021.001

Hermetic Wiper TG Process Patterns hightest

Author: Florian Roth (Nextron Systems) · 2022-02-25 (modified 2022-09-09) · logsource: product=windows category=process_creation · 2f974656-6d83-4059-bbdf-68ac5403422f

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

Techniques: T1021.001

Port Forwarding Activity Via SSH.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-12 (modified 2024-03-05) · logsource: product=windows category=process_creation · 327f48c1-a6db-4eb8-875a-f6981f1b0183

Detects port forwarding activity via SSH.exe

Techniques: T1572 T1021.001 T1021.004

Suspicious Plink Port Forwarding hightest

Author: Florian Roth (Nextron Systems) · 2021-01-19 (modified 2022-10-09) · logsource: product=windows category=process_creation · 48a61b29-389f-4032-b317-b30de6b95314

Detects suspicious Plink tunnel port forwarding to a local port

Techniques: T1572 T1021.001

RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class mediumexperimental

Author: Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-15 · logsource: product=windows category=process_creation · 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d

Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.

Techniques: T1021.001 T1047

RDP Login from Localhost hightest

Author: Thomas Patzke · 2019-01-28 (modified 2022-10-09) · logsource: product=windows service=security · 51e33403-2a37-4d66-a574-1fda1782cc31

RDP login with localhost source address may be a tunnelled login

Techniques: T1021.001

OpenCanary - RDP New Connection Attempt highexperimental

Author: Marco Pedrinazzi (@pedrinazziM) · 2026-01-06 · logsource: product=opencanary category=application · 598290cf-5932-45cd-9123-be1e05ab4f2e

Detects instances where an RDP service on an OpenCanary node has had a connection attempt.

Techniques: T1133 T1021.001

RDP over Reverse SSH Tunnel WFP hightest

Author: Samir Bousseaden · 2019-02-16 (modified 2022-09-02) · logsource: product=windows service=security · 5bed80b6-b3e8-428e-a3ae-d3c757589e41

Detects svchost hosting RDP termsvcs communicating with the loopback address

Techniques: T1090.001 T1090.002 T1021.001

RDP Over Reverse SSH Tunnel hightest

Author: Samir Bousseaden · 2019-02-16 (modified 2024-03-12) · logsource: product=windows category=network_connection · 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

Techniques: T1572 T1021.001

Denied Access To Remote Desktop mediumtest

Author: Pushkarev Dmitry · 2020-06-27 (modified 2021-11-27) · logsource: product=windows service=security · 8e5c03fa-b7f0-11ea-b242-07e0576828d9

This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.

Techniques: T1021.001

New Remote Desktop Connection Initiated Via Mstsc.EXE mediumtest

Author: frack113 · 2022-01-07 (modified 2024-06-04) · logsource: product=windows category=process_creation · 954f0af7-62dd-418f-b3df-a84bc2c7a774

Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Techniques: T1021.001

RDP to HTTP or HTTPS Target Ports hightest

Author: Florian Roth (Nextron Systems) · 2022-04-29 (modified 2022-07-14) · logsource: product=windows category=network_connection · b1e5da3b-ca8e-4adf-915c-9921f3d85481

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Techniques: T1572 T1021.001

Outbound RDP Connections Over Non-Standard Tools hightest

Author: Markus Neis · 2019-05-15 (modified 2024-02-09) · logsource: product=windows category=network_connection · ed74fe75-7594-4b4b-ae38-e38e3fd2eb23

Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.

Techniques: T1021.001

Suspicious RDP Redirect Using TSCON hightest

Author: Florian Roth (Nextron Systems) · 2018-03-17 (modified 2023-05-16) · logsource: product=windows category=process_creation · f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb

Detects a suspicious RDP session redirect using tscon.exe

Techniques: T1563.002 T1021.001

All 16 rules on the technique page →

T1059 Command and Scripting Interpreter primary impact

DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 Windows
Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: CommandLinePattern ParentProcessName TimeWindow

AN1429 Linux
Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: InterpreterName UserContext ExecutionChainLength

AN1430 macOS
Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

Tunable: LaunchAgentName ScriptName TerminalAppUsage

AN1431 ESXi
Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

esxi:vobd shell session start → DC0064 Command Execution

Tunable: ShellEnabledFlag SSHContext

AN1432 Network Devices
Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

networkdevice:cli shell command → DC0064 Command Execution
networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

Tunable: UserRole DeviceType

Sigma rules tagged `attack.t1059` (95)

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Techniques: T1189 T1203 T1059

Add New Download Source To Winget mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842

Detects usage of winget to add new additional download sources

Techniques: T1059

Potential Arbitrary Command Execution Via FTP.EXE mediumtest

Author: Victor Sergeev, oscd.community · 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Techniques: T1059 T1202

Use of Pcalua For Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Techniques: T1059

Shai-Hulud Malware Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

Techniques: T1059

Script Interpreter Execution From Suspicious Folder hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba

Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.

Techniques: T1059

DNS Request From Windows Script Host lowtest

Author: Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c

Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.

Techniques: T1059

Windows Shell/Scripting Application File Write to Suspicious Folder hightest

Author: Florian Roth (Nextron Systems) · 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43

Detects Windows shells and scripting applications that write files to suspicious folders

Techniques: T1059

Elevated System Shell Spawned From Uncommon Parent Location mediumtest

Author: frack113, Tim Shelton (update fp) · 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Techniques: T1059

DarkGate - Autoit3.EXE File Creation By Uncommon Process mediumtest

Author: Micah Babinski · 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Techniques: T1105 T1059

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) mediumtest

Author: Andreas Braathen (mnemonic.io) · 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Techniques: T1059 T1190

CVE tags: CVE-2023-22518

Ruby Inline Command Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Techniques: T1059

Payload Decoded and Decrypted via Built-in Utilities mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Techniques: T1059 T1204 T1140

Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Techniques: T1059

Renamed PingCastle Binary Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Techniques: T1059 T1202

All 95 rules on the technique page →

T1070.004 File Deletion secondary impact

DET0140 Behavioral Detection of Malicious File Deletion
AN0392 Windows
Detects adversary behavior deleting artifacts (e.g., dropped payloads, evidence files) using native or external utilities (e.g., del, erase, SDelete). Detects deletion events correlated with unusual process lineage or timing post-execution.

WinEventLog:Sysmon EventCode=23 → DC0040 File Deletion
WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

Tunable: TimeWindow FilePathPattern UserContext

AN0393 Linux
Detects deletion of suspicious files (e.g., payloads, temp exes, scripts) via rm, unlink, or secure deletion tools like shred, especially when performed by unexpected users or shortly after execution.

auditd:SYSCALL PATH → DC0040 File Deletion
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: PathRegex TimeWindow SecureDeletionTool

AN0394 macOS
Detects removal of adversary artifacts via rm, unlink, or secure tools, with focus on shell sessions, temp files, and modified LaunchAgents or system directories.

fs:fsusage unlink, write → DC0061 File Modification
macos:unifiedlog process → DC0032 Process Creation

Tunable: FilePathRegex ToolUsageAnomaly

AN0395 ESXi
Detects manual or scripted removal of logs, artifacts, or malware droppings via rm or PowerCLI in ESXi shell. Focus on deletions from /tmp/, /var/core/, or /scratch.

esxi:shell /var/log/shell.log → DC0040 File Deletion

Tunable: LogFilePath TimeWindow

Sigma rules tagged `attack.t1070.004` (15)

Prefetch File Deleted hightest

Author: Cedric MAURUGEON · 2021-09-29 (modified 2024-01-25) · logsource: product=windows category=file_delete · 0a1f9d29-6465-4776-b091-7f43b26e4c89

Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence

Techniques: T1070.004

Greedy File Deletion Using Del mediumtest

Author: frack113 , X__Junior (Nextron Systems) · 2021-12-02 (modified 2023-09-11) · logsource: product=windows category=process_creation · 204b17ae-4007-471b-917b-b917b315c5db

Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

Techniques: T1070.004

File Deletion informationalstable

Author: Ömer Günal, oscd.community · 2020-10-07 (modified 2022-09-15) · logsource: product=linux category=process_creation · 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

Techniques: T1070.004

ADS Zone.Identifier Deleted By Uncommon Application mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-09-04 (modified 2025-07-04) · logsource: product=windows category=file_delete · 3109530e-ab47-4cc6-a953-cac5ebcc93ae

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Techniques: T1070.004

File Deletion Via Del lowtest

Author: frack113 · 2022-01-15 (modified 2024-03-05) · logsource: product=windows category=process_creation · 379fa130-190e-4c3f-b7bc-6c8e834485f3

Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Techniques: T1070.004

Potential Secure Deletion with SDelete mediumtest

Author: Thomas Patzke · 2017-06-14 (modified 2024-12-13) · logsource: product=windows service=security · 39a80702-d7ca-4a83-b776-525b1f86a36d

Detects files that have extensions commonly seen while SDelete is used to wipe files.

Techniques: T1070.004 T1027.005 T1485 T1553.002

Directory Removal Via Rmdir lowtest

Author: frack113 · 2022-01-15 (modified 2023-03-07) · logsource: product=windows category=process_creation · 41ca393d-538c-408a-ac27-cf1e038be80c

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Techniques: T1070.004

Suspicious Ping/Del Command Combination hightest

Author: Ilya Krestinichev · 2022-11-03 (modified 2024-03-05) · logsource: product=windows category=process_creation · 54786ddc-5b8a-11ed-9b6a-0242ac120002

Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example

Techniques: T1070.004

File Deleted Via Sysinternals SDelete mediumtest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-05-02 (modified 2023-02-15) · logsource: product=windows category=file_delete · 6ddab845-b1b8-49c2-bbf7-1a11967f64bc

Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.

Techniques: T1070.004

Cisco File Deletion mediumtest

Author: Austin Clark · 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 71d65515-c436-43c0-841b-236b1f32c21e

See what files are being deleted from flash file systems

Techniques: T1070.004 T1561.001 T1561.002

ADS Zone.Identifier Deleted lowtest

Author: frack113 · 2023-09-04 · logsource: product=windows category=file_delete · 7eac0a16-5832-4e81-865f-0268a6d19e4b

Detects the deletion of the "Zone.Identifier" ADS. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Techniques: T1070.004

Backup Catalog Deleted mediumtest

Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) · 2017-05-12 (modified 2022-12-25) · logsource: product=windows service=application · 9703792d-fd9a-456d-a672-ff92efe4806a

Detects backup catalog deletions

Techniques: T1070.004

TeamViewer Log File Deleted lowtest

Author: frack113 · 2022-01-16 (modified 2023-02-15) · logsource: product=windows category=file_delete · b1decb61-ed83-4339-8e95-53ea51901720

Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence

Techniques: T1070.004

Use Of Remove-Item to Delete File - ScriptBlock lowtest

Author: frack113 · 2022-01-15 (modified 2022-03-17) · logsource: product=windows category=ps_script · b8af5f36-1361-4ebe-9e76-e36128d947bf

PowerShell Remove-Item with -Path to delete a file or a folder with "-Recurse"

Techniques: T1070.004

Potentially Suspicious Ping/Copy Command Combination mediumtest

Author: X__Junior (Nextron Systems) · 2023-07-18 (modified 2024-03-06) · logsource: product=windows category=process_creation · ded2b07a-d12f-4284-9b76-653e37b6c8b0

Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.

Techniques: T1070.004

T1078 Valid Accounts secondary impact

DET0560 Detection of Valid Account Abuse Across Platforms
AN1543 Windows
Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.

WinEventLog:Security EventCode=4624 → DC0067 Logon Session Creation
WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: LogonType TimeWindow GeoIPMismatch

AN1544 Linux
Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.

auditd:SYSCALL execve → DC0032 Process Creation
NSM:Connections sshd or PAM logins → DC0002 User Account Authentication

Tunable: UserContext HostDensityThreshold LoginMethod

AN1545 macOS
Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.

macos:unifiedlog loginwindow, sshd → DC0088 Logon Session Metadata
macos:unifiedlog exec logs → DC0032 Process Creation

Tunable: LoginOrigin ProcessTreeDepth

AN1546 Identity Provider
Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.

saas:okta Sign-in logs / audit events → DC0002 User Account Authentication

Tunable: MFAFailureCount RiskScoreThreshold IPGeoVelocity

AN1547 Containers
Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.

kubernetes:audit authentication.k8s.io → DC0002 User Account Authentication

Tunable: ServiceAccountScope ClusterIPWhitelist

Sigma rules tagged `attack.t1078` (56)

Unfamiliar Sign-In Properties hightest

Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' · 2023-09-03 · logsource: product=azure service=riskdetection · 128faeef-79dd-44ca-b43c-a9e236a60f49

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Techniques: T1078

Azure Login Bypassing Conditional Access Policies highexperimental

Author: Josh Nickels, Marius Rothenbücher · 2025-01-08 · logsource: product=m365 service=audit · 13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc

Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.

Techniques: T1078

Atypical Travel hightest

Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' · 2023-09-03 · logsource: product=azure service=riskdetection · 1a41023f-1e70-4026-921a-4d9341a9038e

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Techniques: T1078

Application Using Device Code Authentication Flow mediumtest

Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' · 2022-06-01 · logsource: product=azure service=signinlogs · 248649b7-d64f-46f0-9fb2-a52774166fb5

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Techniques: T1078

External Remote RDP Logon from Public IP mediumtest

Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) · 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Techniques: T1133 T1078 T1110

Azure Domain Federation Settings Modified mediumtest

Author: Austin Songer · 2021-09-06 (modified 2022-06-08) · logsource: product=azure service=auditlogs · 352a54e1-74ba-4929-9d47-8193d67aba1e

Identifies when an user or application modified the federation settings on the domain.

Techniques: T1078

Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure hightest

Author: jamesc-grafana · 2024-07-11 · logsource: product=aws service=cloudtrail · 352a918a-34d8-4882-8470-44830c507aa3

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

Techniques: T1078 T1078.002

Win Susp Computer Name Containing Samtheadmin criticaltest

Author: elhoim · 2022-09-09 (modified 2023-01-04) · logsource: product=windows service=security · 39698b3f-da92-4bc6-bfb5-645a98386e45

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Techniques: T1078

CVE tags: CVE-2021-42278CVE-2021-42287

Interactive Logon to Server Systems mediumtest

Author: Florian Roth (Nextron Systems) · 2017-03-17 (modified 2023-12-15) · logsource: product=windows service=security · 3ff152b2-1388-4984-9cd9-a323323fdadf

Detects interactive console logons to Server Systems

Techniques: T1078

Guest Users Invited To Tenant By Non Approved Inviters mediumtest

Author: MikeDuddington, '@dudders1' · 2022-07-28 (modified 2026-05-09) · logsource: product=azure service=auditlogs · 4ad97bf5-a514-41a4-abd3-4f3455ad4865

Detects guest users being invited to tenant by non-approved inviters

Techniques: T1078

Cisco LDP Authentication Failures lowtest

Author: Tim Brown · 2023-01-09 · logsource: product=cisco service=ldp · 50e606bf-04ce-4ca7-9d54-3449494bbd4b

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Techniques: T1078 T1110 T1557

OpenCanary - Telnet Login Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Techniques: T1133 T1078

Applications That Are Using ROPC Authentication Flow mediumtest

Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' · 2022-06-01 · logsource: product=azure service=signinlogs · 55695bc0-c8cf-461f-a379-2535f563c854

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Techniques: T1078

Cisco BGP Authentication Failures lowtest

Author: Tim Brown · 2023-01-09 (modified 2023-01-23) · logsource: product=cisco service=bgp · 56fa3cd6-f8d6-4520-a8c7-607292971886

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Techniques: T1078 T1110 T1557

Suspicious SignIns From A Non Registered Device hightest

Author: Harjot Singh, '@cyb3rjy0t' · 2023-01-10 (modified 2025-07-02) · logsource: product=azure service=signinlogs · 572b12d4-9062-11ed-a1eb-0242ac120002

Detects risky authentication from a non AD registered device without MFA being required.

Techniques: T1078

All 56 rules on the technique page →

T1083 File and Directory Discovery secondary impact

DET0370 Recursive Enumeration of Files and Directories Across Privilege Contexts
AN1040 Windows
Execution of file enumeration commands (e.g., 'dir', 'tree') from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

Tunable: CommandLineRegex UserContext TimeWindow

AN1041 Linux
Use of file enumeration commands (e.g., 'ls', 'find', 'locate') executed by suspicious users or scripts accessing broad file hierarchies or restricted directories.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:PATH PATH → DC0055 File Access

Tunable: FilePathDepth UserContext

AN1042 macOS
Execution of file or directory discovery commands (e.g., 'ls', 'find') from terminal or script-based tooling, especially outside normal user workflows.

macos:unifiedlog log collect --predicate → DC0032 Process Creation
fs:fsusage Filesystem Call Monitoring → DC0055 File Access

Tunable: PredicateScope TimeWindow

AN1043 ESXi
Execution of esxcli commands to enumerate datastore, configuration files, or directory structures by unauthorized or remote users.

esxi:shell Shell Access/Command Execution → DC0064 Command Execution
esxi:hostd vSphere File API Access → DC0055 File Access

Tunable: CLICommandPattern AccessSource

AN1044 Network Devices
Execution of file discovery commands (e.g., 'dir', 'show flash', 'nvram:') from CLI interfaces, especially by unauthorized users or from abnormal source IPs.

networkdevice:syslog CLI Command Logging → DC0064 Command Execution

Tunable: CommandWhitelist SessionOrigin

Sigma rules tagged `attack.t1083` (24)

File and Directory Discovery - MacOS informationaltest

Author: Daniil Yugoslavskiy, oscd.community · 2020-10-19 (modified 2022-11-25) · logsource: product=macos category=process_creation · 089dbdf6-b960-4bcc-90e3-ffc3480c20f6

Detects usage of system utilities to discover files and directories

Techniques: T1083

Shell Execution via Nice - Linux hightest

Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 · logsource: product=linux category=process_creation · 093d68c7-762a-42f4-9f46-95e79142571a

Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Techniques: T1083

Powershell Directory Enumeration mediumtest

Author: frack113 · 2022-03-17 · logsource: product=windows category=ps_script · 162e69a7-7981-4344-84a9-0f1c9a217a52

Detects technique used by MAZE ransomware to enumerate directories using Powershell

Techniques: T1083

PUA - Seatbelt Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-18 (modified 2023-02-04) · logsource: product=windows category=process_creation · 38646daa-e78f-4ace-9de0-55547b2d30da

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Techniques: T1526 T1087 T1083

Notepad Password Files Discovery lowexperimental

Author: The DFIR Report · 2025-02-21 · logsource: product=windows category=process_creation · 3b4e950b-a3ea-44d3-877e-432071990709

Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.

Techniques: T1083

WannaCry Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro · 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079

Detects WannaCry ransomware activity

Techniques: T1210 T1083 T1222.001 T1486 T1490

PUA - TruffleHog Execution mediumexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-09-24 · logsource: product=windows category=process_creation · 44030449-b0df-4c94-aae1-502359ab28ee

Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

Techniques: T1083 T1552.001

Shell Execution via Flock - Linux hightest

Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 · logsource: product=linux category=process_creation · 4b09c71e-4269-4111-9cdd-107d8867f0cc

Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Techniques: T1083

Shell Execution via Find - Linux hightest

Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 · logsource: product=linux category=process_creation · 6adfbf8f-52be-4444-9bac-81b539624146

Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.

Techniques: T1083

Vim GTFOBin Abuse - Linux hightest

Author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux · 2022-12-28 (modified 2026-06-05) · logsource: product=linux category=process_creation · 7ab8f73a-fcff-428b-84aa-6a5ff7877dea

Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Techniques: T1059 T1083

Powershell Sensitive File Discovery mediumtest

Author: frack113 · 2022-09-16 · logsource: product=windows category=ps_script · 7d416556-6502-45b2-9bad-9d2f05f38997

Detect adversaries enumerate sensitive files

Techniques: T1083

Potential Discovery Activity Using Find - Linux mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-28 · logsource: product=linux category=process_creation · 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf

Detects usage of "find" binary in a suspicious manner to perform discovery

Techniques: T1083

Potential Discovery Activity Using Find - MacOS mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-28 · logsource: product=macos category=process_creation · 85de3a19-b675-4a51-bfc6-b11a5186c971

Detects usage of "find" binary in a suspicious manner to perform discovery

Techniques: T1083

Source Code Enumeration Detection by Keyword mediumtest

Author: James Ahearn · 2019-06-08 (modified 2022-10-05) · logsource: category=webserver · 953d460b-f810-420a-97a2-cfca4c98e602

Detects source code enumeration that use GET requests by keyword searches in URL strings

Techniques: T1083

Cisco Discovery lowtest

Author: Austin Clark · 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b

Find information about network devices that is not stored in config files

Techniques: T1083 T1201 T1057 T1018 T1082 T1016 T1049 T1033 T1124

All 24 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 Windows
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList

AN0220 Linux
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content
auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

Tunable: WebProcList ChildToolList BurstThreshold TimeWindow

AN0221 macOS
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content
macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation
NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

Tunable: ServiceList TimeWindow

AN0222 Containers
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content
docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation
NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

Tunable: IngressNamespaces MetadataEndpoints TimeWindow

AN0223 IaaS
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content
AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

Tunable: LBProjects ErrorBurst

AN0224 ESXi
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content
NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

Tunable: MgmtCIDR TimeWindow

AN0225 Network Devices
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content
NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged `attack.t1190` (149)

Potential CVE-2023-25717 Exploitation Attempt hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Techniques: T1190

CVE tags: CVE-2023-25717

Potential CVE-2021-27905 Exploitation Attempt mediumtest

Author: @gott_cyber · 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Techniques: T1190

CVE tags: CVE-2021-27905

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 criticaltest

Author: Florian Roth (Nextron Systems) · 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Techniques: T1190

CVE tags: CVE-2020-8193CVE-2020-8195

Ruby on Rails Framework Exceptions mediumstable

Author: Thomas Patzke · 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Techniques: T1190

Potential CVE-2023-23752 Exploitation Attempt hightest

Author: Bhabesh Raj · 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Techniques: T1190

CVE tags: CVE-2023-23752

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Terminal Service Process Spawn hightest

Author: Florian Roth (Nextron Systems) · 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Techniques: T1190 T1210

RDS Database Security Group Modification mediumtest

Author: jamesc-grafana · 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015

Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.

Techniques: T1190

Cisco ASA Exploitation Activity - Proxy highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Techniques: T1190

CVE tags: CVE-2025-20333CVE-2025-20362

TerraMaster TOS CVE-2020-28188 hightest

Author: Bhabesh Raj · 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Techniques: T1190

CVE tags: CVE-2020-28188

Potential Server Side Template Injection In Velocity hightest

Author: Moti Harmats · 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Techniques: T1190

CVE-2021-21972 VSphere Exploitation hightest

Author: Bhabesh Raj · 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Techniques: T1190

CVE tags: CVE-2021-21972

Potential OWASSRF Exploitation Attempt - Webserver hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Techniques: T1190

Suspicious User-Agents Related To Recon Tools mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton · 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a

Detects known suspicious (default) user-agents related to scanning/recon tools

Techniques: T1190

Python SQL Exceptions mediumstable

Author: Thomas Patzke · 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9

Generic rule for SQL exceptions in Python according to PEP 249

Techniques: T1190

All 149 rules on the technique page →

T1482 Domain Trust Discovery secondary impact

DET0007 Detection of Domain Trust Discovery via API, Script, and CLI Enumeration
AN0016 Windows
Adversary uses nltest, PowerShell, or Win32/.NET API to enumerate domain trust relationships (via DSEnumerateDomainTrusts, GetAllTrustRelationships, or LDAP queries), followed by discovery or authentication staging.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:PowerShell Get-ADTrust|GetAllTrustRelationships → DC0064 Command Execution
WinEventLog:Security EventCode=4662 → DC0071 Active Directory Object Access

Tunable: ParentImage TimeWindow UserContext API_Name

Sigma rules tagged `attack.t1482` (17)

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

BloodHound Collection Files hightest

Author: C.J. May · 2022-08-09 (modified 2026-02-19) · logsource: product=windows category=file_event · 02773bed-83bf-469f-b7ff-e676e7d78bab

Detects default file names outputted by the BloodHound collection tool SharpHound

Techniques: T1087.001 T1087.002 T1482 T1069.001 T1069.002 T1059.001

ADExplorer Writing Complete AD Snapshot Into .dat File mediumexperimental

Author: Arnim Rupp (Nextron Systems), Thomas Patzke · 2025-07-09 · logsource: product=windows category=file_event · 0a1255c5-d732-4b62-ac02-b5152d34fb83

Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

Potential Active Directory Reconnaissance/Enumeration Via LDAP mediumtest

Author: Adeem Mawani · 2021-06-22 (modified 2025-07-04) · logsource: product=windows service=ldap · 31d68132-4038-47c7-8f8e-635a39a7c174

Detects potential Active Directory enumeration via LDAP

Techniques: T1069.002 T1087.002 T1482

Domain Trust Discovery Via Dsquery mediumtest

Author: E.M. Anhaus, Tony Lambert, oscd.community, omkar72 · 2019-10-24 (modified 2023-02-02) · logsource: product=windows category=process_creation · 3bad990e-4848-4a78-9530-b427d854aac0

Detects execution of "dsquery.exe" for domain trust discovery

Techniques: T1482

Potential Recon Activity Via Nltest.EXE mediumtest

Author: Craig Young, oscd.community, Georg Lauenstein · 2021-07-24 (modified 2023-12-15) · logsource: product=windows category=process_creation · 5cc90652-4cbd-4241-aa3b-4b462fa5a248

Detects nltest commands that can be used for information discovery

Techniques: T1016 T1482

HackTool - TruffleSnout Execution hightest

Author: frack113 · 2022-08-20 (modified 2023-02-13) · logsource: product=windows category=process_creation · 69ca006d-b9a9-47f5-80ff-ecd4d25d481a

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

Techniques: T1482

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer · 2017-03-05 (modified 2025-12-10) · logsource: product=windows category=ps_script · 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Nltest.EXE Execution lowtest

Author: Arun Chauhan · 2023-02-03 · logsource: product=windows category=process_creation · 903076ff-f442-475a-b667-4f246bcc203b

Detects nltest commands that can be used for information discovery

Techniques: T1016 T1018 T1482

Active Directory Database Snapshot Via ADExplorer mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-03-14 (modified 2025-07-09) · logsource: product=windows category=process_creation · 9212f354-7775-4e28-9c9f-8f0a4544e664

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

PUA - AdFind Suspicious Execution hightest

Author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community · 2021-02-02 (modified 2025-10-24) · logsource: product=windows category=process_creation · 9a132afa-654e-11eb-ae93-0242ac130002

Detects AdFind execution with common flags seen used during attacks

Techniques: T1018 T1087.002 T1482 T1069.002

DNS Server Discovery Via LDAP Query lowtest

Author: frack113 · 2022-08-20 (modified 2023-09-18) · logsource: product=windows category=dns_query · a21bcd7e-38ec-49ad-b69a-9ea17e69509e

Detects DNS server discovery via LDAP query requests from uncommon applications

Techniques: T1482

HackTool - SharpView Execution hightest

Author: frack113 · 2021-12-10 (modified 2023-02-14) · logsource: product=windows category=process_creation · b2317cfa-4a47-4ead-b3ff-297438c0bc2d

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Techniques: T1049 T1069.002 T1482 T1135 T1033

Renamed AdFind Execution hightest

Author: Florian Roth (Nextron Systems) · 2022-08-21 (modified 2025-02-26) · logsource: product=windows category=process_creation · df55196f-f105-44d3-a675-e9dfb6cc2f2b

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Techniques: T1018 T1087.002 T1482 T1069.002

All 17 rules on the technique page →

T1505.003 Web Shell secondary impact

DET0394 Web Shell Detection via Server Behavior and File Execution Chains
AN1108 Windows
Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)

WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation
NSM:Flow Inbound HTTP POST with suspicious payload size or user-agent → DC0085 Network Traffic Content

Tunable: WebRootPath ParentProcess

AN1109 Linux
File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx

auditd:SYSCALL new file created in /var/www/html, /srv/http, or similar web root → DC0039 File Creation
auditd:SYSCALL apache2 or nginx spawning sh, bash, or python interpreter → DC0032 Process Creation
NSM:Flow POST requests to .php, .jsp, .aspx files with high entropy body → DC0085 Network Traffic Content

Tunable: WebRootPath PayloadEntropyThreshold TimeWindow

AN1110 macOS
Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www

macos:unifiedlog httpd spawning bash, zsh, python, or osascript → DC0032 Process Creation
auditd:SYSCALL file write operations in /Library/WebServer/Documents → DC0061 File Modification

Tunable: InterpreterName ExecutionParent

Sigma rules tagged `attack.t1505.003` (35)

Suspicious File Write to SharePoint Layouts Directory highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-07-24 · logsource: product=windows category=file_event · 1f0489be-b496-4ddf-b3a9-5900f2044e9c

Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.

Techniques: T1190 T1505.003

Suspicious Process Spawned by CentreStack Portal AppPool highexperimental

Author: Jason Rathbun (Blackpoint Cyber) · 2025-04-17 · logsource: product=windows category=process_creation · 2d79e371-2a27-42de-87a4-b4213fc72a6a

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

Techniques: T1059.003 T1505.003

CVE tags: CVE-2025-30406

Webshell ReGeorg Detection Via Web Logs hightest

Author: Cian Heasley · 2020-08-04 (modified 2023-01-02) · logsource: category=webserver · 2ea44a60-cfda-11ea-87d0-0242ac130003

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Techniques: T1505.003

Execution From Webserver Root Folder mediumtest

Author: Florian Roth (Nextron Systems) · 2019-01-16 (modified 2024-01-18) · logsource: product=windows category=process_creation · 35efb964-e6a5-47ad-bbcd-19661854018d

Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors

Techniques: T1505.003

Oracle WebLogic Exploit criticaltest

Author: Florian Roth (Nextron Systems) · 2018-07-22 (modified 2023-01-02) · logsource: category=webserver · 37e8369b-43bb-4bf8-83b6-6dd43bda2000

Detects access to a webshell dropped into a keystore folder on the WebLogic server

Techniques: T1190 T1505.003

CVE tags: CVE-2018-2894

Potential Webshell Creation On Static Website mediumtest

Author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo · 2019-10-22 (modified 2023-10-15) · logsource: product=windows category=file_event · 39f1f9f2-9636-45de-98f6-a4046aa8e4b9

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Techniques: T1505.003

MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-03 (modified 2023-07-28) · logsource: category=webserver · 435e41f2-48eb-4c95-8a2b-ed24b50ec30b

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Techniques: T1505.003

CVE tags: CVE-2023-34362

Webshell Hacking Activity Patterns hightest

Author: Florian Roth (Nextron Systems) · 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Techniques: T1505.003 T1018 T1033 T1087

Mailbox Export to Exchange Webserver criticaltest

Author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems) · 2021-08-09 (modified 2023-04-30) · logsource: product=windows service=msexchange-management · 516376b4-05cd-4122-bae0-ad7641c38d48

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Techniques: T1505.003

Potential Java WebShell Upload in SAP NetViewer Server highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-05-14 · logsource: category=webserver · 639b893f-f93a-4e53-a7c8-f08cf73fe7f7

Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.

Techniques: T1505.003

CVE tags: CVE-2025-31324

Suspicious File Drop by Exchange mediumtest

Author: Florian Roth (Nextron Systems) · 2022-10-04 · logsource: product=windows category=file_event · 6b269392-9eba-40b5-acb6-55c882b20ba6

Detects suspicious file type dropped by an Exchange component in IIS

Techniques: T1190 T1505.003

Suspicious MSExchangeMailboxReplication ASPX Write hightest

Author: Florian Roth (Nextron Systems) · 2022-02-25 · logsource: product=windows category=file_event · 7280c9f3-a5af-45d0-916a-bc01cb4151c9

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

Techniques: T1190 T1505.003

Windows Webshell Strings hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2017-02-19 (modified 2022-11-18) · logsource: category=webserver · 7ff9db12-1b94-4a79-ba68-a2402c5d6729

Detects common commands used in Windows webshells

Techniques: T1505.003

Linux Webshell Indicators hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-10-15 (modified 2026-08-19) · logsource: product=linux category=process_creation · 818f7b24-0fba-4c49-a073-8b755573b9c7

Detects suspicious sub processes of web server processes

Techniques: T1505.003

Suspicious Process By Web Server Process hightest

Author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) · 2019-01-16 (modified 2024-11-26) · logsource: product=windows category=process_creation · 8202070f-edeb-4d31-a010-a26c72ac5600

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Techniques: T1505.003 T1190

All 35 rules on the technique page →

T1530 Data from Cloud Storage secondary impact

DET0484 Multi-Platform Cloud Storage Exfiltration Behavior Chain
AN1328 IaaS
Spike in object access from new IAM user or role followed by data exfiltration to external IPs

AWS:CloudTrail GetObject, CopyObject → DC0025 Cloud Storage Access
AWS:CloudTrail AssumeRole → DC0013 User Account Metadata
AWS:VPCFlowLogs Unusual volume of data transferred from S3 storage endpoints to non-corporate IPs → DC0085 Network Traffic Content

Tunable: TimeWindow ExternalIPAllowList

AN1329 SaaS
OAuth token granted to external app followed by download of high-volume files in OneDrive/Google Drive

m365:unified FileAccessed, FileDownloaded, ConsentGranted → DC0025 Cloud Storage Access

Tunable: AppRegistrationNamePattern DownloadThresholdMB

AN1330 Office Suite
Internal user account accesses shared links outside org followed by mass file download

m365:sharepoint AnonymousLinkCreated, FileDownloaded → DC0025 Cloud Storage Access
azure:signinlogs SigninSuccess → DC0002 User Account Authentication

Tunable: LinkVisibilityScope DownloadBurstThreshold

Sigma rules tagged `attack.t1530` (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

CVE-2023-22952 Stale Partial Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1021.001 Remote Desktop Protocol secondary impact

Sigma rules tagged attack.t1021.001 (16)

T1059 Command and Scripting Interpreter primary impact

Sigma rules tagged attack.t1059 (95)

T1070.004 File Deletion secondary impact

Sigma rules tagged attack.t1070.004 (15)

T1078 Valid Accounts secondary impact

Sigma rules tagged attack.t1078 (56)

T1083 File and Directory Discovery secondary impact

Sigma rules tagged attack.t1083 (24)

T1190 Exploit Public-Facing Application exploitation technique

Sigma rules tagged attack.t1190 (149)

T1482 Domain Trust Discovery secondary impact

Sigma rules tagged attack.t1482 (17)

T1505.003 Web Shell secondary impact

Sigma rules tagged attack.t1505.003 (35)

T1530 Data from Cloud Storage secondary impact

Sigma rules tagged attack.t1530 (0)

Sigma rules tagged `attack.t1021.001` (16)

Sigma rules tagged `attack.t1059` (95)

Sigma rules tagged `attack.t1070.004` (15)

Sigma rules tagged `attack.t1078` (56)

Sigma rules tagged `attack.t1083` (24)

Sigma rules tagged `attack.t1190` (149)

Sigma rules tagged `attack.t1482` (17)

Sigma rules tagged `attack.t1505.003` (35)

Sigma rules tagged `attack.t1530` (0)