Coverage › CVE-2023-36884

CVE-2023-36884 Stale Sigma

Microsoft Windows Search Remote Code Execution Vulnerability

Vendor / product: Microsoft — Windows
Description (CISA): Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.
Added to KEV: 2023-07-17
Due date: 2023-08-29
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Known
CWE: CWE-362
CISA notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884
https://nvd.nist.gov/vuln/detail/CVE-2023-36884
Elsewhere: cve.org · NVD · CISA KEV · JSON

Stale mapping. This entry was mapped under ATT&CK 16.1; the current bundle is v19.2, and at least one mapped technique no longer stands as mapped:

T1070.001 was revoked (superseded by T1685.005)

The chain below is rendered for the techniques that are still live. The superseding technique is linked where ATT&CK records one, but kevmap does not transfer the mapping to it — that would be a new claim nobody has published.

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

8 mapping objects across 8 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1566 Phishing	exploitation technique	This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key. The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts. This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption. The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation. ref 1 · ref 2 · ref 3	live
T1005 Data from Local System	secondary impact	This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key. The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts. This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption. The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation. ref 1 · ref 2 · ref 3	live
T1070.001 Clear Windows Event Logs	secondary impact	This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key. The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts. This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption. The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation. ref 1 · ref 2 · ref 3	revoked → T1685.005
T1204.002 Malicious File	primary impact	This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key. The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts. This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption. The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation. ref 1 · ref 2 · ref 3	live
T1486 Data Encrypted for Impact	secondary impact	This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key. The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts. This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption. The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation. ref 1 · ref 2 · ref 3	live
T1489 Service Stop	secondary impact	This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key. The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts. This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption. The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation. ref 1 · ref 2 · ref 3	live
T1490 Inhibit System Recovery	secondary impact	This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key. The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts. This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption. The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation. ref 1 · ref 2 · ref 3	live
T1553.005 Mark-of-the-Web Bypass	secondary impact	This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key. The ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts. This vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption. The ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation. ref 1 · ref 2 · ref 3	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1005 Data from Local System secondary impact

DET0380 Detection of Local Data Collection Prior to Exfiltration
AN1070 Windows
Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

Tunable: TargetFilePathRegex ParentProcessFilter

AN1071 Linux
Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

auditd:SYSCALL open → DC0055 File Access
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: TimeWindow ScriptToolName

AN1072 macOS
Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

macos:unifiedlog process:spawn → DC0032 Process Creation
fs:fsusage read/write → DC0055 File Access

Tunable: UserContext TargetVolume

AN1073 Network Devices
Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.

networkdevice:cli command logging → DC0064 Command Execution

Tunable: CommandScope AuthenticatedUserList

AN1074 ESXi
Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.

esxis:vmkernel Datastore Access → DC0055 File Access
esxi:hostd Command Execution → DC0064 Command Execution

Tunable: AccessPathRegex InteractiveShellUsage

Sigma rules tagged `attack.t1005` (14)

Script Interpreter Spawning Credential Scanner - Windows highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

ADFS Database Named Pipe Connection By Uncommon Tool mediumtest

Author: Roberto Rodriguez @Cyb3rWard0g · 2021-10-08 (modified 2023-11-30) · logsource: product=windows category=pipe_created · 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3

Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.

Techniques: T1005

OpenCanary - SMB File Open Request hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52

Detects instances where an SMB service on an OpenCanary node has had a file open request.

Techniques: T1021 T1005

SQLite Chromium Profile Data DB Access hightest

Author: TropChaud · 2022-12-19 (modified 2023-01-19) · logsource: product=windows category=process_creation · 24c77512-782b-448a-8950-eddb0785fc71

Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.

Techniques: T1539 T1555.003 T1005

Potential Conti Ransomware Database Dumping Activity Via SQLCmd hightest

Author: frack113 · 2021-08-16 (modified 2023-05-04) · logsource: product=windows category=process_creation · 2f47f1fd-0901-466e-a770-3b7092834a1b

Detects a command used by conti to dump database

Techniques: T1005

SQLite Firefox Profile Data DB Access hightest

Author: frack113 · 2022-04-08 (modified 2023-01-19) · logsource: product=windows category=process_creation · 4833155a-4053-4c9c-a997-777fcea0baa7

Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.

Techniques: T1539 T1005

AWS EC2 VM Export Failure lowtest

Author: Diogo Braz · 2020-04-16 (modified 2022-10-05) · logsource: product=aws service=cloudtrail · 54b9a76a-3c71-4673-b4b3-2edb4566ea7b

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

Techniques: T1005 T1537

Veeam Backup Database Suspicious Query mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-04 · logsource: product=windows category=process_creation · 696bfb54-227e-4602-ac5b-30d9d2053312

Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.

Techniques: T1005

Esentutl Steals Browser Information mediumtest

Author: frack113 · 2022-02-13 (modified 2024-03-05) · logsource: product=windows category=process_creation · 6a69f62d-ce75-4b57-8dce-6351eb55b362

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

Techniques: T1005

Crash Dump Created By Operating System mediumexperimental

Author: Jason Mull · 2025-05-12 · logsource: product=windows service=system · 882fbe50-d8d7-4e29-ae80-0648a8556866

Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.

Techniques: T1003.002 T1005

VeeamBackup Database Credentials Dump Via Sqlcmd.EXE hightest

Author: frack113 · 2021-12-20 (modified 2023-02-13) · logsource: product=windows category=process_creation · b57ba453-b384-4ab9-9f40-1038086b4e53

Detects dump of credentials in VeeamBackup dbo

Techniques: T1005

Cisco Collect Data lowtest

Author: Austin Clark · 2019-08-11 (modified 2023-01-04) · logsource: product=cisco service=aaa · cd072b25-a418-4f98-8ebc-5093fb38fe1a

Collect pertinent data from the configuration files

Techniques: T1087.001 T1552.001 T1005

Shai-Hulud NPM Package Malicious Exfiltration via Curl highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983

Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.

Techniques: T1041 T1005

Script Interpreter Spawning Credential Scanner - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · f0025a69-e1b7-4dda-a53c-db21fa2d4071

Techniques: T1552 T1005 T1059.004

T1204.002 Malicious File primary impact

DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
AN0819 Windows
User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

Tunable: TimeWindow SuspiciousExtensions UserPaths ParentApps SignerAllowList

AN0820 macOS
User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

macos:unifiedlog process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} → DC0032 Process Creation
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions → DC0039 File Creation

Tunable: TimeWindow QuarantineRequired ParentApps

AN0821 Linux
User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.

auditd:SYSCALL open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions → DC0039 File Creation
auditd:SYSCALL execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser → DC0032 Process Creation

Tunable: TimeWindow DesktopParentMap

Sigma rules tagged `attack.t1204.002` (39)

Download From Suspicious TLD - Blacklist lowtest

Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19

Detects download of certain file types from hosts in suspicious TLDs

Techniques: T1566 T1203 T1204.002

Potential Suspicious Browser Launch From Document Reader Process mediumtest

Author: Joseph Kamau · 2024-05-27 (modified 2025-10-07) · logsource: product=windows category=process_creation · 1193d960-2369-499f-a158-7b50a31df682

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.

Techniques: T1204.002

Microsoft Word Add-In Loaded lowtest

Author: Steffen Rogge (dr0pd34d) · 2024-07-10 · logsource: product=windows category=image_load · 1337afba-d17d-4d23-bd55-29b927603b30

Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.

Techniques: T1204.002

Suspicious Outlook Child Process hightest

Author: Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team · 2022-02-28 (modified 2023-02-04) · logsource: product=windows category=process_creation · 208748f7-881d-47ac-a29c-07ea84bf691d

Detects a suspicious process spawning from an Outlook process.

Techniques: T1204.002

Suspicious Startup Folder Persistence hightest

Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · 2022-08-10 (modified 2025-10-12) · logsource: product=windows category=file_event · 28208707-fe31-437f-9a7f-4b1108b94d2e

Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.

Techniques: T1204.002 T1547.001

Successful MSIX/AppX Package Installation lowexperimental

Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-03 · logsource: product=windows service=appxdeployment-server · 289dfa9e-e378-4a56-a9d4-7ed5ee218029

Detects successful MSIX/AppX package installations on Windows systems by monitoring EventID 854 in the Microsoft-Windows-AppXDeployment-Server/Operational log. While most installations are legitimate, this can help identify unauthorized or suspicious package installations. It is crucial to monitor such events as threat actors may exploit MSIX/AppX packages to deliver and execute malicious payloads.

Techniques: T1204.002

Potential Maze Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems) · 2020-05-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 29fd07fc-9cfd-4331-b7fd-cc18dfa21052

Detects specific process characteristics of Maze ransomware word document droppers

Techniques: T1204.002 T1047 T1490

TanStack Supply-Chain Attack Execution Indicators - Linux highexperimental

Author: Leonardo Gasparini · 2026-05-12 · logsource: product=linux category=process_creation · 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.

Techniques: T1059.007 T1059.006 T1204.002

AppLocker Prevented Application or Script from Running mediumtest

Author: Pushkarev Dmitry · 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

Suspicious Microsoft Office Child Process hightest

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io · 2018-04-06 (modified 2023-04-24) · logsource: product=windows category=process_creation · 438025f9-5856-4663-83f7-52f878a70a50

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Techniques: T1047 T1204.002 T1218.010

Flash Player Update from Suspicious Location hightest

Author: Florian Roth (Nextron Systems) · 2017-10-25 (modified 2022-08-08) · logsource: category=proxy · 4922a5dd-6743-4fc2-8e81-144374280997

Detects a flashplayer update from an unofficial location

Techniques: T1189 T1204.002 T1036.005

AppLocker Application Would Have Been Blocked mediumexperimental

Author: heyyanu · 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c

Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

New Application in AppCompat informationaltest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-05-02 (modified 2023-08-17) · logsource: product=windows category=registry_set · 60936b49-fca0-4f32-993d-7415edcf9a5d

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

Techniques: T1204.002

Droppers Exploiting CVE-2017-11882 criticalstable

Author: Florian Roth (Nextron Systems) · 2017-11-23 (modified 2021-11-27) · logsource: product=windows category=process_creation · 678eb5f4-8597-4be6-8be7-905e4234b53a

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Techniques: T1203 T1204.002 T1566.001

CVE tags: CVE-2017-11882

Suspicious Microsoft Office Child Process - MacOS hightest

Author: Sohan G (D4rkCiph3r) · 2023-01-31 (modified 2023-02-04) · logsource: product=macos category=process_creation · 69483748-1525-4a6c-95ca-90dc8d431b68

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Techniques: T1059.002 T1137.002 T1204.002

All 39 rules on the technique page →

T1486 Data Encrypted for Impact secondary impact

DET0215 Detection of Multi-Platform File Encryption for Impact
AN0602 Windows
High-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=2 → DC0061 File Modification

Tunable: FileExtension TargetFolder TimeWindow CommandLine

AN0603 Linux
Encryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.

auditd:SYSCALL openat, write, rename, unlink → DC0061 File Modification
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: FilenamePattern SyscallBurstRate DirectoryTargeted

AN0604 macOS
Userland or kernel-level ransomware encrypting user files (Documents, Desktop) using srm, gpg, or compiled payloads. Often correlated with ransom note creation in multiple directories.

macos:unifiedlog file encrypted|new file with .encrypted extension|disk write burst → DC0061 File Modification
macos:unifiedlog exec srm|exec openssl|exec gpg → DC0032 Process Creation

Tunable: ExtensionPattern VolumeTargeted

AN0605 ESXi
Ransomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run through dcui, SSH, or vSphere.

esxi:vmkernel rename .vmdk to .*.locked|datastore write spike → DC0061 File Modification
esxi:shell openssl|tar|dd → DC0064 Command Execution

Tunable: FileType UserContext

AN0606 IaaS
Encryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.

AWS:CloudTrail PutObject (with SSE-C), UploadPart (SSE-C) → DC0023 Cloud Storage Modification

Tunable: SSEHeader AffectedBucket UserAgent

Sigma rules tagged `attack.t1486` (16)

Suspicious Reg Add BitLocker hightest

Author: frack113 · 2021-11-15 (modified 2022-09-09) · logsource: product=windows category=process_creation · 0e0255bf-2548-47b8-9582-c0955c9283f5

Detects suspicious addition to BitLocker related registry keys via the reg.exe utility

Techniques: T1486

AWS KMS Imported Key Material Usage highexperimental

Author: toopricey · 2025-10-18 · logsource: product=aws service=cloudtrail · 1279262f-1464-422f-ac0d-5b545320c526

Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.

Techniques: T1486 T1608.003

AWS EC2 Disable EBS Encryption mediumstable

Author: Sittikorn S · 2021-06-29 (modified 2021-08-20) · logsource: product=aws service=cloudtrail · 16124c2d-e40b-4fcc-8f2c-5ab7870a2223

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

Techniques: T1486 T1565

FunkLocker Ransomware File Creation highexperimental

Author: Saiprashanth Pulisetti ( @Prashanthblogs) · 2025-08-08 · logsource: product=windows category=file_event · 2c76a22b-702d-48fd-8fa9-e41e2fe203b3

Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.

Techniques: T1486

Load Of RstrtMgr.DLL By An Uncommon Process lowtest

Author: Luc Génaux · 2023-11-28 (modified 2026-07-28) · logsource: product=windows category=image_load · 3669afd2-9891-4534-a626-e5cf03810a61

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Techniques: T1486 T1685

WannaCry Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro · 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079

Detects WannaCry ransomware activity

Techniques: T1210 T1083 T1222.001 T1486 T1490

Antivirus - Ransomware Signature criticaltest

Author: Florian Roth (Nextron Systems), Arnim Rupp · 2022-05-12 (modified 2026-06-15) · logsource: category=antivirus · 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f

Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1486

Potential Conti Ransomware Activity criticaltest

Author: frack113 · 2021-10-12 (modified 2023-02-13) · logsource: product=windows category=process_creation · 689308fc-cfba-4f72-9897-796c1dc61487

Detects a specific command used by the Conti ransomware group

Techniques: T1486

LockerGoga Ransomware Activity criticalstable

Author: Vasiliy Burov, oscd.community · 2020-10-18 (modified 2023-02-03) · logsource: product=windows category=process_creation · 74db3488-fd28-480a-95aa-b7af626de068

Detects LockerGoga ransomware activity via specific command line.

Techniques: T1486

Portable Gpg.EXE Execution mediumtest

Author: frack113, Nasreddine Bencherchali (Nextron Systems) · 2023-08-06 (modified 2023-11-10) · logsource: product=windows category=process_creation · 77df53a5-1d78-4f32-bc5a-0e7465bd8f41

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Techniques: T1486

Load Of RstrtMgr.DLL By A Suspicious Process hightest

Author: Luc Génaux · 2023-11-28 · logsource: product=windows category=image_load · b48492dc-c5ef-4572-8dff-32bc241c15c8

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Techniques: T1486 T1685

Microsoft 365 - Potential Ransomware Activity mediumtest

Author: austinsonger · 2021-08-19 (modified 2022-10-09) · logsource: product=m365 service=threat_management · bd132164-884a-48f1-aa2d-c6d646b04c69

Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

Techniques: T1486

Suspicious Creation TXT File in User Desktop mediumtest

Author: frack113 · 2021-12-26 (modified 2026-01-09) · logsource: product=windows category=file_event · caf02a0a-1e1c-4552-9b48-5e070bd88d11

Detects creation of .txt files in user desktop folders via cmd.exe. This behavior may indicate ransomware deploying ransom notes, but can also occur during legitimate administrative tasks. Analysts should investigate for suspicious filenames (e.g., "RANSOM", "DECRYPT", "READ_ME"), bulk file creation patterns, or concurrent encryption activity to determine if this is part of a ransomware attack.

Techniques: T1486

Suspicious Appended Extension mediumtest

Author: frack113 · 2022-07-16 (modified 2023-11-11) · logsource: product=windows category=file_rename · e3f673b3-65d1-4d80-9146-466f8b63fa99

Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.

Techniques: T1486

Renamed Gpg.EXE Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2023-08-09 · logsource: product=windows category=process_creation · ec0722a3-eb5c-4a56-8ab2-bf6f20708592

Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.

Techniques: T1486

All 16 rules on the technique page →

T1489 Service Stop secondary impact

DET0021 Behavioral Detection for Service Stop across Platforms
AN0061 Windows
Adversary disables or stops critical services (e.g., Exchange, SQL, AV, endpoint monitoring) using native utilities or API calls, often preceding destructive actions (T1485, T1486). Behavioral chain: Elevated execution context + stop-service or sc.exe or ChangeServiceConfigW + terminated or disabled service + possible follow-up file manipulation.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata
WinEventLog:System EventCode=7036 → DC0060 Service Creation
WinEventLog:Sysmon EventCode=4 → DC0041 Service Metadata

Tunable: TimeWindow ServiceName ParentProcess

AN0062 Linux
Adversary executes systemctl or service stop targeting high-value services (e.g., mysql, sshd), possibly followed by rm or shred against data stores. Behavioral chain: sudo/su usage + stop command + /var/log/messages or syslog entries + file access/delete.

auditd:SYSCALL execve of systemctl or service stop → DC0032 Process Creation
auditd:SYSCALL unlink/unlinkat on service binaries or data targets → DC0040 File Deletion
linux:syslog service stopped messages → DC0041 Service Metadata

Tunable: TimeWindow ExecUser

AN0063 macOS
Use of launchctl to stop services or kill critical background processes (e.g., securityd, com.apple.*), typically followed by command-line tools like rm or diskutil. Behavioral chain: Terminal or remote shell + launchctl bootout/disable + process termination + follow-on modification.

macos:unifiedlog launchctl disable or bootout calls → DC0041 Service Metadata
auditd:SYSCALL execve of launchctl or pkill → DC0032 Process Creation

Tunable: ServiceLabel LaunchType

AN0064 ESXi
Attacker disables VM-related services or stops VMs forcibly to target vmdk or logs. Behavioral chain: esxcli or vim-cmd stop + audit log showing user privilege use + datastore file manipulation.

esxi:hostd Stop VM or disable service events via vim-cmd → DC0041 Service Metadata
esxi:hostd Log entries indicating VM powered off or forcibly terminated → DC0033 Process Termination

Tunable: VMName InitiatorUser

Sigma rules tagged `attack.t1489` (20)

Azure Kubernetes Network Policy Change mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 08d6ac24-c927-4469-b3b7-2e422d6e3c43

Identifies when a Azure Kubernetes network policy is modified or deleted.

Techniques: T1485 T1496 T1489

Azure Kubernetes Service Account Modified or Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2

Identifies when a service account is modified or deleted.

Techniques: T1531 T1485 T1496 T1489

Delete All Scheduled Tasks hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-09-09 · logsource: product=windows category=process_creation · 220457c1-1c9f-4c2e-afe6-9598926222c1

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Techniques: T1489

Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 25cb259b-bbdc-4b87-98b7-90d7c72f8743

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Techniques: T1485 T1496 T1489

Azure Application Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-09-03 (modified 2026-04-30) · logsource: product=azure service=auditlogs · 410d2a41-1e6d-452f-85e5-abdd8257a823

Identifies when a application is deleted in Azure.

Techniques: T1489

Application Uninstalled lowtest

Author: frack113 · 2022-01-28 (modified 2022-09-17) · logsource: product=windows service=application · 570ae5ec-33dc-427c-b815-db86228ad43e

An application has been removed. Check if it is critical.

Techniques: T1489

Azure Kubernetes Secret or Config Object Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 7ee0b4aa-d8d4-4088-b661-20efdf41a04c

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Techniques: T1485 T1496 T1489

Azure Kubernetes Sensitive Role Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 818fee0c-e0ec-4e45-824e-83e4817b0887

Identifies when ClusterRoles/Roles are being modified or deleted.

Techniques: T1485 T1496 T1489

Stop Windows Service Via Sc.EXE lowtest

Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) · 2023-03-05 (modified 2024-01-18) · logsource: product=windows category=process_creation · 81bcb81b-5b1f-474b-b373-52c871aaa7b1

Detects the stopping of a Windows service via the "sc.exe" utility

Techniques: T1489

Process Terminated Via Taskkill lowtest

Author: frack113, MalGamy (Nextron Systems), Nasreddine Bencherchali · 2021-12-26 (modified 2024-10-06) · logsource: product=windows category=process_creation · 86085955-ea48-42a2-9dd3-85d4c36b167d

Detects execution of "taskkill.exe" in order to stop a service or a process. Look for suspicious parents executing this command in order to hunt for potential malicious activity. Attackers might leverage this in order to conduct data destruction or data encrypted for impact on the data stores of services like Exchange and SQL Server.

Techniques: T1489

Stop Windows Service Via Net.EXE lowtest

Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) · 2023-03-05 · logsource: product=windows category=process_creation · 88872991-7445-4a22-90b2-a3adadb0e827

Detects the stopping of a Windows service via the "net" utility.

Techniques: T1489

Azure Container Registry Created or Deleted lowtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 93e0ef48-37c8-49ed-a02c-038aab23628e

Detects when a Container Registry is created or deleted.

Techniques: T1485 T1496 T1489

Azure Kubernetes Cluster Created or Deleted lowtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 9541f321-7cba-4b43-80fc-fbd1fb922808

Detects when a Azure Kubernetes Cluster is created or deleted.

Techniques: T1485 T1496 T1489

Disable Important Scheduled Task hightest

Author: frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior · 2021-12-26 (modified 2026-03-11) · logsource: product=windows category=process_creation · 9ac94dc8-9042-493c-ba45-3b5e7c86b980

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

Techniques: T1489

Important Scheduled Task Deleted or Disabled hightest

Author: frack113 · 2023-01-13 (modified 2026-03-11) · logsource: product=windows service=taskscheduler · 9e3cb244-bdb8-4632-8c90-6079c8f4f16d

Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

Techniques: T1489

All 20 rules on the technique page →

T1490 Inhibit System Recovery secondary impact

DET0329 Behavioral Detection for T1490 - Inhibit System Recovery
AN0933 Windows
Process chains that use native utilities (vssadmin, wbadmin, diskshadow, bcdedit, REAgentC, wmic) with arguments to delete shadow copies, disable recovery, or remove backup catalogs

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Microsoft-Windows-Backup Windows Backup Catalog deletion or catalog corruption → DC0040 File Deletion
WinEventLog:System Service stopped or RecoveryDisabled set via REAgentC → DC0041 Service Metadata
WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

Tunable: TimeWindow CommandLinePattern ParentProcessContext

AN0934 Linux
Shell utilities or scripts deleting /etc/systemd/system/rescue.target, /etc/fstab backups, or /boot/efi partitions; chattr used to block snapshot auto-recovery

auditd:SYSCALL chattr, rm, shred, dd run on recovery directories or partitions → DC0064 Command Execution
auditd:CONFIG_CHANGE /etc/fstab, /etc/systemd/* → DC0040 File Deletion

Tunable: WatchedFilePaths ShellProcessUser

AN0935 ESXi
ESXi shell or vim-cmd execution that deletes all VM snapshots using vmsvc/snapshot.removeall or rm on snapshot paths

esxi:hostd snapshot.removeall or snapshot file deletion → DC0049 Snapshot Deletion

Tunable: TargetVMNames

AN0936 Network Devices
Execution of erase, format, and reload in immediate sequence from a privileged AAA session

networkdevice:syslog command sequence: erase → format → reload → DC0064 Command Execution

Tunable: CommandSequenceWindow UserPrivilegeLevel

AN0937 IaaS
Cloud API calls disabling snapshot scheduling, backup policies, versioning, followed by DeleteSnapshot/DeleteVolume operations

AWS:CloudTrail DeleteSnapshot → DC0049 Snapshot Deletion
AWS:CloudTrail DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances → DC0022 Cloud Storage Deletion

Tunable: UserAgent ResourceType

Sigma rules tagged `attack.t1490` (27)

Backup Files Deleted mediumtest

Author: frack113 · 2022-01-02 (modified 2023-02-15) · logsource: product=windows category=file_delete · 06125661-3814-4e03-bfa2-1e4411c60ac3

Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Techniques: T1490

Boot Configuration Tampering Via Bcdedit.EXE highstable

Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2019-10-24 (modified 2023-02-15) · logsource: product=windows category=process_creation · 1444443e-6757-43e4-9ea4-c8fc705f79a2

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

Techniques: T1490

Deletion of Volume Shadow Copies via WMI with PowerShell hightest

Author: Tim Rauch, Elastic (idea) · 2022-09-20 (modified 2022-12-30) · logsource: product=windows category=process_creation · 21ff4ca9-f13a-41ad-b828-0077b2af2e40

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Techniques: T1490

Potential Maze Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems) · 2020-05-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 29fd07fc-9cfd-4331-b7fd-cc18dfa21052

Detects specific process characteristics of Maze ransomware word document droppers

Techniques: T1204.002 T1047 T1490

Time Machine Backup Disabled Via Tmutil - MacOS mediumtest

Author: Pratinav Chandra · 2024-05-29 · logsource: product=macos category=process_creation · 2c95fa8a-8b8d-4787-afce-7117ceb8e3da

Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring.

Techniques: T1490

Suspicious Volume Shadow Copy VSS_PS.dll Load hightest

Author: Markus Neis, @markus_neis · 2021-07-07 (modified 2025-07-11) · logsource: product=windows category=image_load · 333cdbe8-27bb-4246-bf82-b41a0dca4b70

Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.

Techniques: T1490

Suspicious Volume Shadow Copy Vssapi.dll Load hightest

Author: frack113 · 2022-10-31 (modified 2026-05-18) · logsource: product=windows category=image_load · 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8

Detects the image load of VSS DLL by uncommon executables

Techniques: T1490

WannaCry Ransomware Activity criticaltest

Detects WannaCry ransomware activity

Techniques: T1210 T1083 T1222.001 T1486 T1490

Time Machine Backup Deletion Attempt Via Tmutil - MacOS mediumtest

Author: Pratinav Chandra · 2024-05-29 · logsource: product=macos category=process_creation · 452df256-da78-427a-866f-49fa04417d74

Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.

Techniques: T1490

Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load mediumtest

Author: frack113 · 2023-02-17 (modified 2025-12-03) · logsource: product=windows category=image_load · 48bfd177-7cf2-412b-ad77-baf923489e82

Detects the image load of VSS DLL by uncommon executables

Techniques: T1490

Registry Disable System Restore hightest

Author: frack113 · 2022-04-04 (modified 2023-08-17) · logsource: product=windows category=registry_set · 5de03871-5d46-4539-a82d-3aa992a69a83

Detects the modification of the registry to disable a system restore on the computer

Techniques: T1490

All Backups Deleted Via Wbadmin.EXE hightest

Author: frack113, Nasreddine Bencherchali (Nextron Systems) · 2021-12-13 (modified 2024-05-10) · logsource: product=windows category=process_creation · 639c9081-f482-47d3-a0bd-ddee3d4ecd76

Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

Techniques: T1490

Cisco Modify Configuration mediumtest

Author: Austin Clark · 2019-08-12 (modified 2025-04-28) · logsource: product=cisco service=aaa · 671ffc77-50a7-464f-9e3d-9ea2b493b26b

Modifications to a config that will serve an adversary's impacts or persistence

Techniques: T1490 T1505 T1565.002 T1053

File Recovery From Backup Via Wbadmin.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2024-05-10 · logsource: product=windows category=process_creation · 6fe4aa1e-0531-4510-8be2-782154b73b48

Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.

Techniques: T1490

System Restore Registry Modification via CommandLine highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-03-11 · logsource: product=windows category=process_creation · 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9

Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer.

Techniques: T1490

All 27 rules on the technique page →

T1553.005 Mark-of-the-Web Bypass secondary impact

DET0257 Detect Mark-of-the-Web (MOTW) Bypass via Container and Disk Image Files
AN0712 Windows
Detects extraction or mounting of container/archive files (e.g., .iso, .vhd, .zip) that originated from the Internet but whose contained files lack Zone.Identifier MOTW tagging. Correlates file creation metadata with subsequent execution of unsigned or untrusted binaries launched outside SmartScreen or Protected View.

WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

Tunable: WatchedExtensions TimeWindow TrustedExtractionTools

Sigma rules tagged `attack.t1553.005` (6)

Suspicious Mount-DiskImage lowtest

Author: frack113 · 2022-02-01 · logsource: product=windows category=ps_script · 29e1c216-6408-489d-8a06-ee9d151ef819

Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.

Techniques: T1553.005

Suspicious Unblock-File mediumtest

Author: frack113 · 2022-02-01 · logsource: product=windows category=ps_script · 5947497f-1aa4-41dd-9693-c9848d58727d

Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.

Techniques: T1553.005

Suspicious Invoke-Item From Mount-DiskImage mediumtest

Author: frack113 · 2022-02-01 · logsource: product=windows category=ps_script · 902cedee-0398-4e3a-8183-6f3a89773a96

Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.

Techniques: T1553.005

Windows AppX Deployment Unsigned Package Installation mediumexperimental

Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-03 · logsource: product=windows service=appxdeployment-server · 9a025188-6f2d-42f8-bb2f-d3a83d24a5af

Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events

Techniques: T1204.002 T1553.005

Windows MSIX Package Support Framework AI_STUBS Execution lowexperimental

Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-03 · logsource: product=windows category=process_creation · af5732ed-764e-489d-826d-0447c8b36242

Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'. This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.

Techniques: T1218 T1553.005 T1204.002

Windows AppX Deployment Full Trust Package Installation mediumexperimental

Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-03 · logsource: product=windows service=appxdeployment-server · e54279c7-4910-4e2c-902c-c56a25b549f6

Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions

Techniques: T1204.002 T1553.005

T1566 Phishing exploitation technique

DET0070 Detection Strategy for Phishing across platforms.
AN0188 Windows
Unusual inbound email activity where attachments or embedded URLs are delivered to users followed by execution of new processes or suspicious document behavior. Detection involves correlating email metadata, file creation, and network activity after a phishing message is received.

m365:unified Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: SuspiciousFileTypes AllowedSenders

AN0189 Linux
Monitor for malicious payload delivery through phishing where attachments or URLs in email clients (e.g., Thunderbird, mutt) result in unusual file creation or outbound network connections. Focus on correlation between mail logs, file writes, and execution activity.

Application:Mail Inbound messages with anomalous headers, spoofed SPF/DKIM failures → DC0038 Application Log Content
auditd:SYSCALL execve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir) → DC0032 Process Creation

Tunable: MonitoredMailPaths AttachmentHashBaseline

AN0190 macOS
Detection of phishing through anomalous Mail app activity, such as attachments saved to disk and immediately executed, or Safari/Preview launching URLs and files linked from email messages. Correlate UnifiedLogs events with subsequent process execution.

macos:unifiedlog Inbound email activity with suspicious domains or mismatched sender information → DC0038 Application Log Content
macos:unifiedlog Preview.app, Safari.app, or Mail.app spawning new processes outside normal patterns → DC0032 Process Creation

Tunable: SuspiciousDomains ExecutionDelayWindow

AN0191 Office Suite
Phishing via Office documents containing embedded macros or links that spawn processes. Detection relies on correlating Office application logs with suspicious child process execution and outbound network connections.

m365:unified FileAccessed: Access of email attachments by Office applications → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: ParentProcessList MacroExecutionThreshold

AN0192 Identity Provider
Phishing attempts targeting IdPs often manifest as anomalous login attempts from suspicious email invitations or fake SSO prompts. Detection correlates login flows, MFA bypass attempts, and anomalous geographic patterns following phishing email delivery.

azure:signinlogs Failed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges → DC0067 Logon Session Creation

Tunable: GeoAnomalyThreshold MFABypassIndicators

AN0193 SaaS
Phishing delivered via SaaS services (chat, collaboration platforms) where messages contain malicious URLs or attachments. Detect anomalous link clicks, suspicious file uploads, or token misuse after SaaS-based phishing attempts.

saas:collaboration MessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom) → DC0038 Application Log Content

Tunable: MonitoredSaaSApps LinkInspectionPolicy

Sigma rules tagged `attack.t1566` (14)

Download From Suspicious TLD - Blacklist lowtest

Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19

Detects download of certain file types from hosts in suspicious TLDs

Techniques: T1566 T1203 T1204.002

Suspicious External WebDAV Execution hightest

Author: Ahmed Farouk · 2024-05-10 · logsource: category=proxy · 1ae64f96-72b6-48b3-ad3d-e71dff6c6398

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

Techniques: T1584 T1566

CVE-2021-31979 CVE-2021-33771 Exploits criticaltest

Author: Sittikorn S, frack113 · 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Techniques: T1566 T1203

CVE tags: CVE-2021-33771CVE-2021-31979

Potential Malicious Usage of CloudTrail System Manager hightest

Author: jamesc-grafana · 2024-07-11 (modified 2025-12-08) · logsource: product=aws service=cloudtrail · 38e7f511-3f74-41d4-836e-f57dfa18eead

Detect when System Manager successfully executes commands against an instance.

Techniques: T1566 T1566.002

WebDAV Temporary Local File Creation mediumtest

Author: Micah Babinski · 2023-08-21 · logsource: product=windows category=file_event · 4c55738d-72d8-490e-a2db-7969654e375f

Detects the creation of WebDAV temporary files with potentially suspicious extensions

Techniques: T1584 T1566

HTML Help HH.EXE Suspicious Child Process hightest

Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Techniques: T1047 T1059.001 T1059.003 T1059.005 T1059.007 T1218 T1218.001 T1218.010 T1218.011 T1566 T1566.001

Suspicious Execution via macOS Script Editor mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4

Detects when the macOS Script Editor utility spawns an unusual child process.

Techniques: T1566 T1566.002 T1059 T1059.002 T1204 T1204.001 T1553

CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum criticaltest

Author: Sittikorn S · 2021-07-16 (modified 2022-10-09) · logsource: product=windows category=file_event · ad7085ac-92e4-4b76-8ce2-276d2c0e68ef

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Techniques: T1566 T1203

CVE tags: CVE-2021-33771CVE-2021-31979

Download From Suspicious TLD - Whitelist lowtest

Author: Florian Roth (Nextron Systems) · 2017-03-13 (modified 2023-05-18) · logsource: category=proxy · b5de2919-b74a-4805-91a7-5049accbaefe

Detects executable downloads from suspicious remote systems

Techniques: T1566 T1203 T1204.002

Suspicious Microsoft OneNote Child Process hightest

Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea) · 2022-10-21 (modified 2023-02-10) · logsource: product=windows category=process_creation · c27515df-97a9-4162-8a60-dc0eeb51b775

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Techniques: T1566 T1566.001

Potential Initial Access via DLL Search Order Hijacking mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 · logsource: product=windows category=file_event · dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Techniques: T1566 T1566.001 T1574 T1574.001

Suspicious HH.EXE Execution hightest

Author: Maxim Pavlunin · 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · e8a95b5e-c891-46e2-b33a-93937d3abc31

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Techniques: T1047 T1059.001 T1059.003 T1059.005 T1059.007 T1218 T1218.001 T1218.010 T1218.011 T1566 T1566.001

Okta FastPass Phishing Detection hightest

Author: Austin Songer @austinsonger · 2023-05-07 (modified 2026-04-27) · logsource: product=okta service=okta · ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e

Detects when Okta FastPass prevents a known phishing site.

Techniques: T1566

Phishing Pattern ISO in Archive hightest

Author: Florian Roth (Nextron Systems) · 2022-06-07 · logsource: product=windows category=process_creation · fcdf69e5-a3d3-452a-9724-26f2308bf2b1

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

Techniques: T1566

Sigma rules tagged with this CVE directly

6 rules carry cve.2023-36884.

Potential CVE-2023-36884 Exploitation Pattern criticaltest

Author: X__Junior · 2023-07-12 · logsource: category=proxy · 0066d244-c277-4c3e-88ec-9e7b777cc8bc

Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884

CVE tags: CVE-2023-36884

Potential CVE-2023-36884 Exploitation - Share Access hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-07-13 · logsource: product=windows service=security · 3df95076-9e78-4e63-accb-16699c3b74f8

Detects access to a file share with a naming schema seen being used during exploitation of CVE-2023-36884

CVE tags: CVE-2023-36884

Potential CVE-2023-36884 Exploitation - File Downloads mediumtest

Author: X__Junior · 2023-07-12 · logsource: category=proxy · 6af1617f-c179-47e3-bd66-b28034a1052d

Detects files seen being requested by RomCom while potentially exploiting CVE-2023-36884

CVE tags: CVE-2023-36884

Potential CVE-2023-36884 Exploitation Dropped File mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2023-07-13 · logsource: product=windows category=file_event · 8023d3a2-dcdc-44da-8fa9-5c7906e55b38

Detects a specific file being created in the recent folder of Office. These files have been seen being dropped during potential exploitations of CVE-2023-36884

CVE tags: CVE-2023-36884

Potential CVE-2023-36884 URL Request Pattern Traffic hightest

Author: X__Junior · 2023-07-12 (modified 2026-06-14) · logsource: category=proxy · d9365e39-febd-4a4b-8441-3ca91bb9d333

Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884

CVE tags: CVE-2023-36884

Potential CVE-2023-36884 Exploitation - URL Marker hightest

Author: X__Junior · 2023-07-12 · logsource: category=proxy · e59f71ff-c042-4f7a-8a82-8f53beea817e

Detects a unique URL marker seen being used by RomCom potentially exploiting CVE-2023-36884

CVE tags: CVE-2023-36884

CVE-2023-36884 Stale Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1005 Data from Local System secondary impact

Sigma rules tagged attack.t1005 (14)

T1204.002 Malicious File primary impact

Sigma rules tagged attack.t1204.002 (39)

T1486 Data Encrypted for Impact secondary impact

Sigma rules tagged attack.t1486 (16)

T1489 Service Stop secondary impact

Sigma rules tagged attack.t1489 (20)

T1490 Inhibit System Recovery secondary impact

Sigma rules tagged attack.t1490 (27)

T1553.005 Mark-of-the-Web Bypass secondary impact

Sigma rules tagged attack.t1553.005 (6)

T1566 Phishing exploitation technique

Sigma rules tagged attack.t1566 (14)

Sigma rules tagged with this CVE directly

Sigma rules tagged `attack.t1005` (14)

Sigma rules tagged `attack.t1204.002` (39)

Sigma rules tagged `attack.t1486` (16)

Sigma rules tagged `attack.t1489` (20)

Sigma rules tagged `attack.t1490` (27)

Sigma rules tagged `attack.t1553.005` (6)

Sigma rules tagged `attack.t1566` (14)