Coverage › CVE-2025-31201

CVE-2025-31201 Stale Partial Sigma

Apple Multiple Products Arbitrary Read and Write Vulnerability

Vendor / product: Apple — Multiple Products
Description (CISA): Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.
Added to KEV: 2025-04-17
Due date: 2025-05-08
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Unknown
CWE: none recorded by CISA
CISA notes: https://support.apple.com/en-us/122282
https://support.apple.com/en-us/122400
https://support.apple.com/en-us/122401
https://support.apple.com/en-us/122402
https://nvd.nist.gov/vuln/detail/CVE-2025-31201
Elsewhere: cve.org · NVD · CISA KEV · JSON

Stale mapping. This entry was mapped under ATT&CK 16.1; the current bundle is v19.2, and at least one mapped technique no longer stands as mapped:

T1562 was revoked (superseded by T1685)

The chain below is rendered for the techniques that are still live. The superseding technique is linked where ATT&CK records one, but kevmap does not transfer the mapping to it — that would be a new claim nobody has published.

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

14 mapping objects across 14 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such. Mappings marked mobile refer to ATT&CK Mobile; this site traverses the Enterprise bundle only and shows no detection chain for them.

Technique	Mapping type	CTID comment	Status in v19.2
T1203 Exploitation for Client Execution	exploitation technique	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	live
T1658 Exploitation for Client Executionmobile	exploitation technique	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	not checked (Mobile)
T1001 Data Obfuscation	secondary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	live
T1059 Command and Scripting Interpreter	secondary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	live
T1105 Ingress Tool Transfer	primary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	live
T1106 Native API	secondary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	live
T1406 Obfuscated Files or Informationmobile	secondary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	not checked (Mobile)
T1544 Ingress Tool Transfermobile	primary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	not checked (Mobile)
T1557 Adversary-in-the-Middle	secondary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	live
T1562 Impair Defenses	secondary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	revoked → T1685
T1575 Native APImobile	secondary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	not checked (Mobile)
T1623 Command and Scripting Interpretermobile	secondary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	not checked (Mobile)
T1629 Impair Defensesmobile	secondary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	not checked (Mobile)
T1638 Adversary-in-the-Middlemobile	secondary impact	A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication. ref 1 · ref 2	not checked (Mobile)

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1001 Data Obfuscation secondary impact

DET0053 Detect Obfuscated C2 via Network Traffic Analysis
AN0144 Windows
Detects excessive outbound traffic to remote host over HTTP(S) from uncommon or previously unseen processes.

NSM:Flow HTTP → DC0085 Network Traffic Content

Tunable: OutboundByteThreshold ProcessAllowlist

AN0145 Linux
Identifies custom or previously unseen userland processes initiating high-volume HTTP connections with low response volume.

auditd:SYSCALL connect → DC0082 Network Connection Creation

Tunable: UserProcessBaseline

AN0146 macOS
Flags unexpected user applications initiating long-lived HTTP(S) sessions with irregular traffic patterns.

macos:unifiedlog network flow → DC0085 Network Traffic Content
macos:unifiedlog process → DC0032 Process Creation

Tunable: SessionDuration

Sigma rules tagged `attack.t1001` (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

T1059 Command and Scripting Interpreter secondary impact

DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 Windows
Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: CommandLinePattern ParentProcessName TimeWindow

AN1429 Linux
Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: InterpreterName UserContext ExecutionChainLength

AN1430 macOS
Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

Tunable: LaunchAgentName ScriptName TerminalAppUsage

AN1431 ESXi
Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

esxi:vobd shell session start → DC0064 Command Execution

Tunable: ShellEnabledFlag SSHContext

AN1432 Network Devices
Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

networkdevice:cli shell command → DC0064 Command Execution
networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

Tunable: UserRole DeviceType

Sigma rules tagged `attack.t1059` (95)

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Add New Download Source To Winget mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842

Detects usage of winget to add new additional download sources

Techniques: T1059

Potential Arbitrary Command Execution Via FTP.EXE mediumtest

Author: Victor Sergeev, oscd.community · 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Techniques: T1059 T1202

Use of Pcalua For Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Techniques: T1059

Shai-Hulud Malware Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

Techniques: T1059

Script Interpreter Execution From Suspicious Folder hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba

Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.

Techniques: T1059

DNS Request From Windows Script Host lowtest

Author: Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c

Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.

Techniques: T1059

Windows Shell/Scripting Application File Write to Suspicious Folder hightest

Author: Florian Roth (Nextron Systems) · 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43

Detects Windows shells and scripting applications that write files to suspicious folders

Techniques: T1059

Elevated System Shell Spawned From Uncommon Parent Location mediumtest

Author: frack113, Tim Shelton (update fp) · 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Techniques: T1059

DarkGate - Autoit3.EXE File Creation By Uncommon Process mediumtest

Author: Micah Babinski · 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Techniques: T1105 T1059

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) mediumtest

Author: Andreas Braathen (mnemonic.io) · 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Techniques: T1059 T1190

CVE tags: CVE-2023-22518

Ruby Inline Command Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Techniques: T1059

Payload Decoded and Decrypted via Built-in Utilities mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Techniques: T1059 T1204 T1140

Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Techniques: T1059

Renamed PingCastle Binary Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Techniques: T1059 T1202

All 95 rules on the technique page →

T1105 Ingress Tool Transfer primary impact

DET0060 Detect Ingress Tool Transfers via Behavioral Chain
AN0165 Windows
Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: ParentProcessName DestinationIPCategory FilePathRegex

AN0166 Linux
Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

auditd:SYSCALL connect, execve, write → DC0064 Command Execution
auditd:SYSCALL file creation/modification → DC0039 File Creation
iptables:LOG TCP connections → DC0078 Network Traffic Flow

Tunable: ToolName DownloadExtension

AN0167 macOS
Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation
macos:unifiedlog file write/create → DC0039 File Creation
macos:unifiedlog connection open → DC0082 Network Connection Creation

Tunable: DirectoryTargeted ProcessPath

AN0168 ESXi
Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

esxi:hostd command execution → DC0064 Command Execution
esxi:vmkernel file write → DC0039 File Creation

Tunable: ToolName DatastorePath

AN0169 Network Devices
Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

NSM:Flow connection metadata → DC0078 Network Traffic Flow
snmp:syslog firmware write/log event → DC0039 File Creation

Tunable: PayloadVolumeThreshold ProtocolUsed

Sigma rules tagged `attack.t1105` (87)

Suspicious Curl File Upload - Linux mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582

Detects a suspicious curl process start the adds a file to a web request

Techniques: T1567 T1105

Potential Data Exfiltration Via Curl.EXE mediumtest

Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update) · 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

Techniques: T1567 T1105

Suspicious Download from Office Domain hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Techniques: T1105 T1608

Potential COM Objects Download Cradles Usage - Process Creation mediumtest

Author: frack113 · 2022-12-25 · logsource: product=windows category=process_creation · 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Techniques: T1105

Insensitive Subfolder Search Via Findstr.EXE lowtest

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Techniques: T1218 T1564.004 T1552.001 T1105

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

Techniques: T1218 T1105

CVE tags: CVE-2025-33053

Local Network Connection Initiated By Script Interpreter mediumtest

Author: frack113 · 2022-08-28 (modified 2024-05-31) · logsource: product=windows category=network_connection · 08249dc0-a28d-4555-8ba5-9255a198e08c

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Techniques: T1105

Axios NPM Compromise Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Techniques: T1195.002 T1059.006 T1059.004 T1105

Uncommon Network Connection Initiated By Certutil.EXE hightest

Author: frack113, Florian Roth (Nextron Systems) · 2022-09-02 (modified 2024-05-31) · logsource: product=windows category=network_connection · 0dba975d-a193-4ed1-a067-424df57570d1

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

Techniques: T1105

File Download with Headless Browser hightest

Author: Sreeman, Florian Roth (Nextron Systems) · 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Techniques: T1105 T1564.003

Potential DLL File Download Via PowerShell Invoke-WebRequest mediumtest

Author: Florian Roth (Nextron Systems), Hieu Tran · 2023-03-13 (modified 2025-07-18) · logsource: product=windows category=process_creation · 0f0450f3-8b47-441e-a31b-15a91dc243e2

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

Techniques: T1059.001 T1105

Potential In-Memory Download And Compile Of Payloads mediumtest

Author: Sohan G (D4rkCiph3r), Red Canary (idea) · 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Techniques: T1059.007 T1105

Suspicious File Downloaded From Direct IP Via Certutil.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Techniques: T1027 T1105

Suspicious Diantz Download and Compress Into a CAB File mediumtest

Author: frack113 · 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · 185d7418-f250-42d0-b72e-0c8b70661e93

Download and compress a remote file and store it in a cab file on local machine.

Techniques: T1105

Download from Suspicious Dyndns Hosts mediumtest

Author: Florian Roth (Nextron Systems) · 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Techniques: T1105 T1568

All 87 rules on the technique page →

T1106 Native API secondary impact

DET0529 Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls
AN1465 Windows
Unusual or suspicious processes loading critical native API DLLs (e.g., ntdll.dll, kernel32.dll) followed by direct syscall behavior, memory manipulation, or hollowing.

WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: DllName Image TargetProcess

AN1466 Linux
Userland processes invoking syscall-heavy libraries (libc, glibc) followed by fork, mmap, or ptrace behavior commonly associated with code injection or memory manipulation.

auditd:SYSCALL execve, fork, mmap, ptrace → DC0035 Process Access
auditd:SYSCALL module load or memory map path → DC0016 Module Load

Tunable: SyscallType ProcessName MAPS Path

AN1467 macOS
Execution of processes that link to CoreServices or Foundation APIs followed by creation of memory regions, code execution, or abnormal library injection.

macos:unifiedlog launch and dylib load → DC0016 Module Load
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation

Tunable: API Framework Name Execution Context

Sigma rules tagged `attack.t1106` (14)

Potential WinAPI Calls Via PowerShell Scripts hightest

Author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community · 2020-10-06 (modified 2026-04-29) · logsource: product=windows category=ps_script · 03d83090-8cba-44a0-b02f-0b756a050306

Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.

Techniques: T1059.001 T1106 T1620

HackTool - CobaltStrike BOF Injection Pattern hightest

Author: Christian Burkard (Nextron Systems) · 2021-08-04 (modified 2023-11-28) · logsource: product=windows category=process_access · 09706624-b7f6-455d-9d02-adee024cee1d

Detects a typical pattern of a CobaltStrike BOF which inject into other processes

Techniques: T1106 T1685

WinAPI Library Calls Via PowerShell Scripts mediumtest

Author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) · 2023-07-21 · logsource: product=windows category=ps_script · 19d65a1c-8540-4140-8062-8eb00db0bba5

Detects calls to WinAPI libraries from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.

Techniques: T1059.001 T1106

Potential Direct Syscall of NtOpenProcess mediumtest

Author: Christian Burkard (Nextron Systems), Tim Shelton (FP) · 2021-07-28 (modified 2023-12-13) · logsource: product=windows category=process_access · 3f3f3506-1895-401b-9cc3-e86b16e630d0

Detects potential calls to NtOpenProcess directly from NTDLL.

Techniques: T1106

Turla Group Named Pipes criticaltest

Author: Markus Neis · 2017-11-06 (modified 2021-11-27) · logsource: product=windows category=pipe_created · 739915e4-1e70-4778-8b8a-17db02f66db1

Detects a named pipe used by Turla group samples

Techniques: T1106

BPFDoor Abnormal Process ID or Lock File Accessed hightest

Author: Rafal Piasecki · 2022-08-10 (modified 2026-03-30) · logsource: product=linux service=auditd · 808146b2-9332-4d78-9416-d7e47012d83d

detects BPFDoor .lock and .pid files access in temporary file storage facility

Techniques: T1106 T1059

HackTool - WinPwn Execution - ScriptBlock hightest

Author: Swachchhanda Shrawan Poudel · 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Techniques: T1046 T1082 T1106 T1518 T1548.002 T1552.001 T1555 T1555.003

HackTool - RedMimicry Winnti Playbook Execution hightest

Author: Alexander Rausch · 2020-06-24 (modified 2023-03-01) · logsource: product=windows category=process_creation · 95022b85-ff2a-49fa-939a-d7b8f56eeb9b

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

Techniques: T1106 T1059.003 T1218.011

WinAPI Function Calls Via PowerShell Scripts mediumtest

Author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) · 2023-07-21 · logsource: product=windows category=ps_script · 9f22ccd5-a435-453b-af96-bf99cbb594d4

Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.

Techniques: T1059.001 T1106

HackTool - HandleKatz Duplicating LSASS Handle hightest

Author: Bhabesh Raj (rule), @thefLinkk · 2022-06-27 (modified 2023-11-28) · logsource: product=windows category=process_access · b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5

Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles

Techniques: T1106 T1003.001

Potential Binary Proxy Execution Via Cdb.EXE mediumtest

Author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) · 2019-10-26 (modified 2024-04-22) · logsource: product=windows category=process_creation · b5c7395f-e501-4a08-94d4-57fe7a9da9d2

Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file

Techniques: T1106 T1218 T1127

Potential WinAPI Calls Via CommandLine hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-09-06 (modified 2025-03-06) · logsource: product=windows category=process_creation · ba3f5c1b-6272-4119-9dbd-0bc8d21c2702

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Techniques: T1106

HackTool - WinPwn Execution hightest

Author: Swachchhanda Shrawan Poudel · 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Techniques: T1046 T1082 T1106 T1518 T1548.002 T1552.001 T1555 T1555.003

Suspicious Mshta.EXE Execution Patterns hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-07-17 (modified 2023-02-21) · logsource: product=windows category=process_creation · e32f92d1-523e-49c3-9374-bdb13b46a3ba

Detects suspicious mshta process execution patterns

Techniques: T1106

T1203 Exploitation for Client Execution exploitation technique

DET0287 Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)
AN0797 Windows
Cause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.

WinEventLog:Application EventCode=1000 → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TimeWindow HighRiskChildren UserPaths AllowedPlugins EgressAllowlist

AN0798 Linux
Cause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.

linux:syslog browser/office crash, segfault, abnormal termination → DC0038 Application Log Content
auditd:SYSCALL open → DC0055 File Access
auditd:SYSCALL creat → DC0039 File Creation
auditd:SYSCALL rename,chmod → DC0061 File Modification
auditd:SYSCALL execve → DC0032 Process Creation
NetFlow:Flow new outbound connections from exploited process tree → DC0078 Network Traffic Flow

Tunable: TimeWindow UserPaths HighRiskChildren PackageUpdaters

AN0799 macOS
Cause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.

macos:unifiedlog process crash, abort, code signing violations → DC0038 Application Log Content
fs:fsevents create/write/rename under user-writable paths → DC0061 File Modification
macos:osquery exec → DC0032 Process Creation
NSM:Connections new connections from exploited lineage → DC0078 Network Traffic Flow

Tunable: TimeWindow HighRiskChildren UserPaths QuarantineBypass

Sigma rules tagged `attack.t1203` (35)

Download From Suspicious TLD - Blacklist lowtest

Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19

Detects download of certain file types from hosts in suspicious TLDs

Techniques: T1566 T1203 T1204.002

Suspicious HWP Sub Processes hightest

Author: Florian Roth (Nextron Systems) · 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Techniques: T1566.001 T1203 T1059.003

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Techniques: T1189 T1203 T1059

Antivirus - APT Malware Signature criticalexperimental

Author: Arnim Rupp (Nextron Systems) · 2026-06-15 · logsource: category=antivirus · 101a1877-2cf4-474d-abfd-7f6ac4788d1a

Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1203 T1219.002

Potentially Suspicious Child Process Of WinRAR.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-08-31 · logsource: product=windows category=process_creation · 146aace8-9bd6-42ba-be7a-0070d8027b76

Detects potentially suspicious child processes of WinRAR.exe.

Techniques: T1203

OMIGOD SCX RunAsProvider ExecuteShellCommand hightest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Techniques: T1068 T1190 T1203

Antivirus - Exploitation Framework Signature criticalstable

Author: Florian Roth (Nextron Systems), Arnim Rupp · 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 238527ad-3c2c-4e4f-a1f6-92fd63adb864

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1203 T1219.002

Suspicious Invocation of Shell via Rsync highexperimental

Author: Florian Roth · 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594

Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Techniques: T1059 T1203

CVE-2021-31979 CVE-2021-33771 Exploits criticaltest

Author: Sittikorn S, frack113 · 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Techniques: T1566 T1203

CVE tags: CVE-2021-33771CVE-2021-31979

Dfsvc.EXE Network Connection To Non-Local IPs mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-12 (modified 2024-03-12) · logsource: product=windows category=network_connection · 3c21219b-49b5-4268-bce6-c914ed50f09c

Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs

Techniques: T1203

Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-05-20 · logsource: category=webserver · 41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe

Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.

Techniques: T1190 T1203

CVE tags: CVE-2025-4427CVE-2025-4428

Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process highexperimental

Author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-10-31 · logsource: product=windows category=process_creation · 43259cc4-1b80-4931-bd98-baea01afc196

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.

Techniques: T1190 T1203

CVE tags: CVE-2025-59287

Audit CVE Event criticaltest

Author: Florian Roth (Nextron Systems), Zach Mathis · 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Techniques: T1203 T1068 T1211 T1212 T1210 T1499.004

Dfsvc.EXE Initiated Network Connection Over Uncommon Port hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-12 (modified 2024-01-31) · logsource: product=windows category=network_connection · 4c5fba4a-9ef6-4f16-823d-606246054741

Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.

Techniques: T1203

Shai-Hulud Malicious Bun Execution highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9

Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.

Techniques: T1195.002 T1203

All 35 rules on the technique page →

T1557 Adversary-in-the-Middle secondary impact

DET0296 Detect Adversary-in-the-Middle via Network and Configuration Anomalies
AN0823 Windows
Detects suspicious DNS/ARP poisoning attempts, unauthorized modifications to registry/network configuration, or abnormal TLS downgrade activity. Correlates changes in system configuration with subsequent unusual network flows or authentication events.

WinEventLog:Security EventCode=4663, 4670, 4656 → DC0063 Windows Registry Key Modification
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: MonitoredRegistryPaths DowngradeCipherList TimeWindow

AN0824 Linux
Detects unauthorized edits to /etc/hosts, /etc/resolv.conf, or suspicious ARP broadcasts. Correlates file modifications with subsequent unexpected network sessions or service creation.

auditd:SYSCALL open, write → DC0061 File Modification
NSM:Flow Unexpected ARP replies or DNS responses inconsistent with authoritative servers → DC0085 Network Traffic Content

Tunable: MonitoredFiles ARPThreshold

AN0825 macOS
Detects unauthorized edits to system configuration profiles, unexpected certificate trust changes, or abnormal ARP/DNS patterns indicative of interception.

macos:unifiedlog Configuration profile modified or new profile installed → DC0038 Application Log Content
NSM:Flow TLS downgrade or inconsistent DNS answers → DC0085 Network Traffic Content

Tunable: ProfileIdentifiers TLSVersionThreshold

AN0826 Network Devices
Detects unauthorized firmware or configuration changes enabling adversary-in-the-middle positioning (e.g., route injection, DNS spoofing, SSL downgrade). Behavioral analytics focus on sudden changes to routing tables or image file integrity failures.

NSM:Flow Unexpected route changes or duplicate gateway advertisements → DC0078 Network Traffic Flow
networkdevice:config Configuration file modified or replaced on network device → DC0061 File Modification

Tunable: RoutingPolicyBaseline FirmwareChecksum

Sigma rules tagged `attack.t1557` (10)

Notepad++ Updater DNS Query to Uncommon Domains mediumexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-02-02 (modified 2026-03-16) · logsource: product=windows category=dns_query · 2074e137-1b73-4e2d-88ba-5a3407dbdce0

Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure. This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.

Techniques: T1195.002 T1557

Uncommon File Created by Notepad++ Updater Gup.EXE highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-02-03 (modified 2026-03-16) · logsource: product=windows category=file_event · 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09

Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations. This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.

Techniques: T1195.002 T1557

Cisco LDP Authentication Failures lowtest

Author: Tim Brown · 2023-01-09 · logsource: product=cisco service=ldp · 50e606bf-04ce-4ca7-9d54-3449494bbd4b

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Techniques: T1078 T1110 T1557

Cisco BGP Authentication Failures lowtest

Author: Tim Brown · 2023-01-09 (modified 2023-01-23) · logsource: product=cisco service=bgp · 56fa3cd6-f8d6-4520-a8c7-607292971886

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Techniques: T1078 T1110 T1557

Huawei BGP Authentication Failures lowtest

Author: Tim Brown · 2023-01-09 (modified 2023-01-23) · logsource: product=huawei service=bgp · a557ffe6-ac54-43d2-ae69-158027082350

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Techniques: T1078 T1110 T1557

Juniper BGP Missing MD5 lowtest

Author: Tim Brown · 2023-01-09 (modified 2023-01-23) · logsource: product=juniper service=bgp · a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Techniques: T1078 T1110 T1557

Suspicious Child Process of Notepad++ Updater - GUP.Exe highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-02-03 · logsource: product=windows category=process_creation · bb0e87ce-c89f-4857-84fa-095e4483e9cb

Detects suspicious child process creation by the Notepad++ updater process (gup.exe). This could indicate potential exploitation of the updater component to deliver unwanted malware.

Techniques: T1195.002 T1557

Potential Suspicious Activity Using SeCEdit mediumtest

Author: Janantha Marasinghe · 2022-11-18 (modified 2022-12-30) · logsource: product=windows category=process_creation · c2c76b77-32be-4d1f-82c9-7e544bdfe0eb

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Techniques: T1685.001 T1547.001 T1505.005 T1556.002 T1685 T1574.007 T1564.002 T1546.008 T1546.007 T1547.014 T1547.010 T1547.002 T1557 T1082

ISATAP Router Address Was Set mediumexperimental

Author: hamid · 2025-10-19 · logsource: product=windows service=system · d22df9cd-2aee-4089-93c7-9dc4eae77f2c

Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.

Techniques: T1557 T1565.002

Azure Sign-In With Axios User Agent lowexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2026-04-28 · logsource: product=azure service=signinlogs · ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4

Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios", indicating potential use of automated credential harvesting or AiTM phishing infrastructure. Axios is a Node.js HTTP client abused to intercept and replay stolen credentials and MFA tokens. When triaging results, analysts should: - Check the sign-in risk level, MFA status, and conditional access results for signs of bypass. - Look for sign-ins from unusual locations or IPs, especially if the same IP targets multiple accounts. - Prioritize successful sign-ins over failed ones, as they may indicate a completed credential replay or AiTM attack.

Techniques: T1557

CVE-2025-31201 Stale Partial Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1001 Data Obfuscation secondary impact

Sigma rules tagged attack.t1001 (0)

T1059 Command and Scripting Interpreter secondary impact

Sigma rules tagged attack.t1059 (95)

T1105 Ingress Tool Transfer primary impact

Sigma rules tagged attack.t1105 (87)

T1106 Native API secondary impact

Sigma rules tagged attack.t1106 (14)

T1203 Exploitation for Client Execution exploitation technique

Sigma rules tagged attack.t1203 (35)

T1557 Adversary-in-the-Middle secondary impact

Sigma rules tagged attack.t1557 (10)

Sigma rules tagged `attack.t1001` (0)

Sigma rules tagged `attack.t1059` (95)

Sigma rules tagged `attack.t1105` (87)

Sigma rules tagged `attack.t1106` (14)

Sigma rules tagged `attack.t1203` (35)

Sigma rules tagged `attack.t1557` (10)