Atomic SecOps

ATT&CK ↕	Atomic Attack Name ↕	Sigma Rules	Google SecOps Rules
T1001.002	Execute Embedded Script in Image via Steganography	Linux Base64 Encoded Pipe to Shell Linux Shell Pipe to Shell	Linux Base64 Encoded Pipe to Shell (SecOps) Linux Shell Pipe to Shell (SecOps)
T1003	Send NTLM Hash with RPC Test Connection	Capture Credentials with Rpcping.exe Suspicious Execution of Powershell with Base64	Capture Credentials with Rpcping.exe (SecOps) Suspicious Execution of Powershell with Base64 (SecOps)
T1003	Dump Credential Manager using keymgr.dll and rundll32.exe	Suspicious Key Manager Access Potentially Suspicious PowerShell Child Processes Rundll32 Execution With Uncommon DLL Extension	Suspicious Key Manager Access (SecOps) Potentially Suspicious PowerShell Child Processes (SecOps) Rundll32 Execution With Uncommon DLL Extension (SecOps)
T1003	Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using config)	Microsoft IIS Service Account Password Dumped	Microsoft IIS Service Account Password Dumped (SecOps)
T1003.001	Powershell Mimikatz	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious Program Names Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation HackTool - Mimikatz Execution PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious Program Names (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) HackTool - Mimikatz Execution (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1003.001	Dump LSASS.exe Memory through Silent Process Exit	Use Short Name Path in Command Line	Use Short Name Path in Command Line (SecOps)
T1003.001	Dump LSASS.exe using imported Microsoft DLLs	HackTool - XORDump Execution Suspicious Script Execution From Temp Folder LSASS Dump Keyword In CommandLine	HackTool - XORDump Execution (SecOps) Suspicious Script Execution From Temp Folder (SecOps) LSASS Dump Keyword In CommandLine (SecOps)
T1003.001	Create Mini Dump of LSASS.exe using ProcDump	Potential Execution of Sysinternals Tools Procdump Execution LSASS Dump Keyword In CommandLine	Potential Execution of Sysinternals Tools (SecOps) Procdump Execution (SecOps) LSASS Dump Keyword In CommandLine (SecOps)
T1003.001	Offline Credential Theft With Mimikatz	HackTool - Mimikatz Execution LSASS Dump Keyword In CommandLine Operator Bloopers Cobalt Strike Commands	HackTool - Mimikatz Execution (SecOps) LSASS Dump Keyword In CommandLine (SecOps) Operator Bloopers Cobalt Strike Commands (SecOps)
T1003.001	Dump LSASS.exe Memory using NanoDump	Use Short Name Path in Command Line LSASS Dump Keyword In CommandLine	Use Short Name Path in Command Line (SecOps) LSASS Dump Keyword In CommandLine (SecOps)
T1003.001	Dump LSASS.exe Memory using comsvcs.dll	Process Memory Dump Via Comsvcs.DLL PowerShell Get-Process LSASS LSASS Dump Keyword In CommandLine Potentially Suspicious PowerShell Child Processes Potentially Suspicious Rundll32 Activity Use Short Name Path in Command Line	Process Memory Dump Via Comsvcs.DLL (SecOps) PowerShell Get-Process LSASS (SecOps) LSASS Dump Keyword In CommandLine (SecOps) Potentially Suspicious PowerShell Child Processes (SecOps) Potentially Suspicious Rundll32 Activity (SecOps) Use Short Name Path in Command Line (SecOps)
T1003.001	Dump LSASS.exe Memory using ProcDump	Renamed ProcDump Execution LSASS Dump Keyword In CommandLine Potential LSASS Process Dump Via Procdump Potential Execution of Sysinternals Tools Procdump Execution	Renamed ProcDump Execution (SecOps) LSASS Dump Keyword In CommandLine (SecOps) Potential LSASS Process Dump Via Procdump (SecOps) Potential Execution of Sysinternals Tools (SecOps) Procdump Execution (SecOps)
T1003.002	dump volume shadow copy hives with certutil	Copying Sensitive Files with Credential Data Potentially Suspicious CMD Shell Output Redirect Sensitive File Access Via Volume Shadow Copy Backup File Encoded To Base64 Via Certutil.EXE File In Suspicious Location Encoded To Base64 Via Certutil.EXE	Copying Sensitive Files with Credential Data (SecOps) Potentially Suspicious CMD Shell Output Redirect (SecOps) Sensitive File Access Via Volume Shadow Copy Backup (SecOps) File Encoded To Base64 Via Certutil.EXE (SecOps) File In Suspicious Location Encoded To Base64 Via Certutil.EXE (SecOps)
T1003.002	esentutl.exe SAM copy	Copying Sensitive Files with Credential Data	Copying Sensitive Files with Credential Data (SecOps)
T1003.003	Create Volume Shadow Copy with diskshadow	Diskshadow Script Mode Execution File And SubFolder Enumeration Via Dir Command	Diskshadow Script Mode Execution (SecOps) File And SubFolder Enumeration Via Dir Command (SecOps)
T1003.003	Create Symlink to Volume Shadow Copy	VolumeShadowCopy Symlink Creation Via Mklink Sensitive File Access Via Volume Shadow Copy Backup	VolumeShadowCopy Symlink Creation Via Mklink (SecOps) Sensitive File Access Via Volume Shadow Copy Backup (SecOps)
T1003.003	Create Volume Shadow Copy remotely (WMI) with esentutl	Copying Sensitive Files with Credential Data Suspicious Process Created Via Wmic.EXE New Process Created Via Wmic.EXE WMIC Remote Command Execution	Copying Sensitive Files with Credential Data (SecOps) Suspicious Process Created Via Wmic.EXE (SecOps) New Process Created Via Wmic.EXE (SecOps) WMIC Remote Command Execution (SecOps)
T1003.003	Create Volume Shadow Copy remotely with WMI	Shadow Copies Creation Using Operating Systems Utilities System Disk And Volume Reconnaissance Via Wmic.EXE Suspicious Copy From or To System Directory WMIC Remote Command Execution	Shadow Copies Creation Using Operating Systems Utilities (SecOps) System Disk And Volume Reconnaissance Via Wmic.EXE (SecOps) Suspicious Copy From or To System Directory (SecOps) WMIC Remote Command Execution (SecOps)
T1003.003	Create Volume Shadow Copy with WMI	Shadow Copies Creation Using Operating Systems Utilities System Disk And Volume Reconnaissance Via Wmic.EXE Suspicious Copy From or To System Directory	Shadow Copies Creation Using Operating Systems Utilities (SecOps) System Disk And Volume Reconnaissance Via Wmic.EXE (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1003.003	Copy NTDS.dit from Volume Shadow Copy	Copying Sensitive Files with Credential Data Sensitive File Access Via Volume Shadow Copy Backup Suspicious Process Patterns NTDS.DIT Exfil Copy From VolumeShadowCopy Via Cmd.EXE Suspicious Copy From or To System Directory	Copying Sensitive Files with Credential Data (SecOps) Sensitive File Access Via Volume Shadow Copy Backup (SecOps) Suspicious Process Patterns NTDS.DIT Exfil (SecOps) Copy From VolumeShadowCopy Via Cmd.EXE (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1003.003	Create Volume Shadow Copy with vssadmin	Shadow Copies Creation Using Operating Systems Utilities	Shadow Copies Creation Using Operating Systems Utilities (SecOps)
T1003.003	Create Volume Shadow Copy with Powershell	Shadow Copies Creation Using Operating Systems Utilities	Shadow Copies Creation Using Operating Systems Utilities (SecOps)
T1003.003	Dump Active Directory Database with NTDSUtil	Suspicious Process Patterns NTDS.DIT Exfil	Suspicious Process Patterns NTDS.DIT Exfil (SecOps)
T1003.004	Dump Kerberos Tickets from LSA using dumper.ps1	PowerShell Download and Execution Cradles PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets PowerShell Web Download	PowerShell Download and Execution Cradles (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps)
T1003.004	Dumping LSA Secrets	Use Short Name Path in Command Line Psexec Execution Potential Execution of Sysinternals Tools	Use Short Name Path in Command Line (SecOps) Psexec Execution (SecOps) Potential Execution of Sysinternals Tools (SecOps)
T1003.005	Cached Credential Dump via Cmdkey	Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE	Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE (SecOps)
T1003.006	DCSync (Active Directory)	HackTool - Mimikatz Execution Operator Bloopers Cobalt Strike Commands	HackTool - Mimikatz Execution (SecOps) Operator Bloopers Cobalt Strike Commands (SecOps)
T1003.006	Run DSInternals Get-ADReplAccount	DSInternals Suspicious PowerShell Cmdlets	DSInternals Suspicious PowerShell Cmdlets (SecOps)
T1003.007	Capture Passwords with MimiPenguin	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1003.008	Access /etc/shadow (Local)	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1007	System Service Discovery - net.exe	Potentially Suspicious CMD Shell Output Redirect	Potentially Suspicious CMD Shell Output Redirect (SecOps)
T1007	System Service Discovery	Suspicious Tasklist Discovery Command	Suspicious Tasklist Discovery Command (SecOps)
T1016	DNS Server Discovery Using nslookup	Network Reconnaissance Activity	Network Reconnaissance Activity (SecOps)
T1016	Adfind - Enumerate Active Directory Subnet Objects	PUA - AdFind Suspicious Execution	PUA - AdFind Suspicious Execution (SecOps)
T1016	System Network Configuration Discovery (TrickBot Style)	Suspicious Network Command	Suspicious Network Command (SecOps)
T1016	System Network Configuration Discovery on Windows	Suspicious Network Command	Suspicious Network Command (SecOps)
T1016.002	Enumerate Stored Wi-Fi Profiles And Passwords via netsh	Harvesting Of Wifi Credentials Via Netsh.EXE	Harvesting Of Wifi Credentials Via Netsh.EXE (SecOps)
T1018	Remote System Discovery - net group Domain Controller	Net.EXE Execution Suspicious Group And Account Reconnaissance Activity Using Net.EXE	Net.EXE Execution (SecOps) Suspicious Group And Account Reconnaissance Activity Using Net.EXE (SecOps)
T1018	Adfind - Enumerate Active Directory Computer Objects	PUA - AdFind Suspicious Execution	PUA - AdFind Suspicious Execution (SecOps)
T1018	Remote System Discovery - nltest	Potential Recon Activity Via Nltest.EXE Nltest.EXE Execution	Potential Recon Activity Via Nltest.EXE (SecOps) Nltest.EXE Execution (SecOps)
T1018	Remote System Discovery - net group Domain Computers	Net.EXE Execution Suspicious Group And Account Reconnaissance Activity Using Net.EXE	Net.EXE Execution (SecOps) Suspicious Group And Account Reconnaissance Activity Using Net.EXE (SecOps)
T1018	Remote System Discovery - net	Share And Session Enumeration Using Net.EXE	Share And Session Enumeration Using Net.EXE (SecOps)
T1018	Enumerate Remote Hosts with Netscan	Use Short Name Path in Command Line	Use Short Name Path in Command Line (SecOps)
T1018	Enumerate Active Directory Computers with ADSISearcher	PUA - AdFind Suspicious Execution	PUA - AdFind Suspicious Execution (SecOps)
T1018	Remote System Discovery - ping sweep	Suspicious Scan Loop Network	Suspicious Scan Loop Network (SecOps)
T1021.001	Disable NLA for RDP via Command Prompt	Potential Tampering With RDP Related Registry Keys Via Reg.EXE	Potential Tampering With RDP Related Registry Keys Via Reg.EXE (SecOps)
T1021.001	Changing RDP Port to Non Standard Port via Command_Prompt	New Firewall Rule Added Via Netsh.EXE Potential Tampering With RDP Related Registry Keys Via Reg.EXE	New Firewall Rule Added Via Netsh.EXE (SecOps) Potential Tampering With RDP Related Registry Keys Via Reg.EXE (SecOps)
T1021.002	Execute command writing output to local Admin Share	Suspicious Redirection to Local Admin Share HackTool - CrackMapExec Execution Patterns	Suspicious Redirection to Local Admin Share (SecOps) HackTool - CrackMapExec Execution Patterns (SecOps)
T1021.002	Copy and Execute File with PsExec	Psexec Execution Potential Execution of Sysinternals Tools	Psexec Execution (SecOps) Potential Execution of Sysinternals Tools (SecOps)
T1021.004	ESXi - Enable SSH via VIM-CMD	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1027	Execution from Compressed JScript File	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript (SecOps)
T1027	DLP Evasion via Sensitive Data in VBA Macro over HTTP	Usage Of Web Request Commands And Cmdlets PowerShell Web Download Suspicious Invoke-WebRequest Execution	Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps) Suspicious Invoke-WebRequest Execution (SecOps)
T1033	System Owner/User Discovery	Recon Command Output Piped To Findstr.EXE Whoami.EXE Execution With Output Option	Recon Command Output Piped To Findstr.EXE (SecOps) Whoami.EXE Execution With Output Option (SecOps)
T1036.003	Masquerading - wscript.exe running as svchost.exe	LOL-Binary Copied From System Directory Suspicious Copy From or To System Directory	LOL-Binary Copied From System Directory (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1036.003	Malicious process Masquerading as LSM.exe	Suspicious Copy From or To System Directory	Suspicious Copy From or To System Directory (SecOps)
T1036.003	Masquerading - powershell.exe running as taskhostw.exe	Suspicious Copy From or To System Directory	Suspicious Copy From or To System Directory (SecOps)
T1036.003	Masquerading - cscript.exe running as notepad.exe	LOL-Binary Copied From System Directory Suspicious Copy From or To System Directory	LOL-Binary Copied From System Directory (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1036.003	Masquerading as Windows LSASS process	Suspicious Copy From or To System Directory	Suspicious Copy From or To System Directory (SecOps)
T1036.004	Creating W32Time similar named service using schtasks	Suspicious Command Patterns In Scheduled Task Creation Schtasks Creation Or Modification With SYSTEM Privileges Scheduled Task Creation Via Schtasks.EXE	Suspicious Command Patterns In Scheduled Task Creation (SecOps) Schtasks Creation Or Modification With SYSTEM Privileges (SecOps) Scheduled Task Creation Via Schtasks.EXE (SecOps)
T1036.004	Creating W32Time similar named service using sc	New Service Creation Using Sc.EXE Suspicious New Service Creation	New Service Creation Using Sc.EXE (SecOps) Suspicious New Service Creation (SecOps)
T1036.007	File Extension Masquerading	LOL-Binary Copied From System Directory Suspicious Copy From or To System Directory	LOL-Binary Copied From System Directory (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1037.001	Logon Scripts	Potential Persistence Via Logon Scripts - CommandLine Potentially Suspicious CMD Shell Output Redirect	Potential Persistence Via Logon Scripts - CommandLine (SecOps) Potentially Suspicious CMD Shell Output Redirect (SecOps)
T1039	Copy a sensitive File over Administrative share with Powershell	Suspicious Script Execution From Temp Folder Suspicious Copy From or To System Directory Copy From Or To Admin Share Or Sysvol Folder	Suspicious Script Execution From Temp Folder (SecOps) Suspicious Copy From or To System Directory (SecOps) Copy From Or To Admin Share Or Sysvol Folder (SecOps)
T1039	Copy a sensitive File over Administrative share with copy	Suspicious Copy From or To System Directory Copy From Or To Admin Share Or Sysvol Folder	Suspicious Copy From or To System Directory (SecOps) Copy From Or To Admin Share Or Sysvol Folder (SecOps)
T1040	Packet Capture Linux socket AF_PACKET,SOCK_RAW with BPF filter for UDP with sudo	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1040	Packet Capture Linux socket AF_INET,SOCK_PACKET,UDP with sudo	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1040	Packet Capture Linux socket AF_INET,SOCK_RAW,TCP with sudo	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1040	Packet Capture Linux socket AF_PACKET,SOCK_RAW with sudo	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1040	Windows Internal pktmon set filter	PktMon.EXE Execution	PktMon.EXE Execution (SecOps)
T1040	Windows Internal Packet Capture	New Network Trace Capture Started Via Netsh.EXE	New Network Trace Capture Started Via Netsh.EXE (SecOps)
T1047	Application uninstall using WMIC	WMIC Remote Command Execution Application Removed Via Wmic.EXE Potential Product Reconnaissance Via Wmic.EXE	WMIC Remote Command Execution (SecOps) Application Removed Via Wmic.EXE (SecOps) Potential Product Reconnaissance Via Wmic.EXE (SecOps)
T1047	WMI Execute rundll32	Suspicious Process Created Via Wmic.EXE New Process Created Via Wmic.EXE	Suspicious Process Created Via Wmic.EXE (SecOps) New Process Created Via Wmic.EXE (SecOps)
T1047	Create a Process using WMI Query and an Encoded Command	PowerShell Base64 Encoded Invoke Keyword Suspicious Execution of Powershell with Base64 Suspicious PowerShell Parameter Substring Change PowerShell Policies to an Insecure Level	PowerShell Base64 Encoded Invoke Keyword (SecOps) Suspicious Execution of Powershell with Base64 (SecOps) Suspicious PowerShell Parameter Substring (SecOps) Change PowerShell Policies to an Insecure Level (SecOps)
T1047	WMI Execute Remote Process	Suspicious Process Created Via Wmic.EXE New Process Created Via Wmic.EXE WMIC Remote Command Execution	Suspicious Process Created Via Wmic.EXE (SecOps) New Process Created Via Wmic.EXE (SecOps) WMIC Remote Command Execution (SecOps)
T1047	WMI Execute Local Process	Suspicious Process Created Via Wmic.EXE New Process Created Via Wmic.EXE	Suspicious Process Created Via Wmic.EXE (SecOps) New Process Created Via Wmic.EXE (SecOps)
T1047	WMI Reconnaissance List Remote Services	Service Reconnaissance Via Wmic.EXE WMIC Remote Command Execution	Service Reconnaissance Via Wmic.EXE (SecOps) WMIC Remote Command Execution (SecOps)
T1047	WMI Reconnaissance Software	Windows Hotfix Updates Reconnaissance Via Wmic.EXE	Windows Hotfix Updates Reconnaissance Via Wmic.EXE (SecOps)
T1047	WMI Reconnaissance Processes	Process Reconnaissance Via Wmic.EXE	Process Reconnaissance Via Wmic.EXE (SecOps)
T1048.002	Exfiltrate data HTTPS using curl freebsd,linux or macos	Curl Usage on Linux	Curl Usage on Linux (SecOps)
T1053.002	At.exe Scheduled task	Interactive AT Job	Interactive AT Job (SecOps)
T1053.003	Cron - Add script to /var/spool/cron/crontabs/ folder	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1053.003	Cron - Add script to all cron subfolders	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1053.005	Scheduled Task ("Ghost Task") via Registry Key Manipulation	Potential Execution of Sysinternals Tools	Potential Execution of Sysinternals Tools (SecOps)
T1053.005	Scheduled task Remote	Scheduled Task Creation Via Schtasks.EXE	Scheduled Task Creation Via Schtasks.EXE (SecOps)
T1053.005	Scheduled Task Startup Script	Suspicious Schtasks Schedule Type With High Privileges Suspicious Command Patterns In Scheduled Task Creation Schtasks Creation Or Modification With SYSTEM Privileges Scheduled Task Creation Via Schtasks.EXE	Suspicious Schtasks Schedule Type With High Privileges (SecOps) Suspicious Command Patterns In Scheduled Task Creation (SecOps) Schtasks Creation Or Modification With SYSTEM Privileges (SecOps) Scheduled Task Creation Via Schtasks.EXE (SecOps)
T1053.005	Scheduled Task Executing Base64 Encoded Commands From Registry	Scheduled Task Executing Encoded Payload from Registry Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious Command Patterns In Scheduled Task Creation Scheduled Task Creation Via Schtasks.EXE	Scheduled Task Executing Encoded Payload from Registry (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious Command Patterns In Scheduled Task Creation (SecOps) Scheduled Task Creation Via Schtasks.EXE (SecOps)
T1053.005	Scheduled task Local	Suspicious Schtasks Schedule Types Scheduled Task Creation Via Schtasks.EXE	Suspicious Schtasks Schedule Types (SecOps) Scheduled Task Creation Via Schtasks.EXE (SecOps)
T1053.006	Create Systemd Service and Timer	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1055	Process Injection with Go using CreateThread WinAPI (Natively)	Potential WinAPI Calls Via CommandLine	Potential WinAPI Calls Via CommandLine (SecOps)
T1055	Process Injection with Go using CreateThread WinAPI	Potential WinAPI Calls Via CommandLine	Potential WinAPI Calls Via CommandLine (SecOps)
T1055	Remote Process Injection in LSASS via mimikatz	HackTool - Mimikatz Execution Potential Execution of Sysinternals Tools	HackTool - Mimikatz Execution (SecOps) Potential Execution of Sysinternals Tools (SecOps)
T1055.001	WinPwn - Get SYSTEM shell - Bind System Shell using UsoClient DLL load technique	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets Potential WinAPI Calls Via CommandLine	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps) Potential WinAPI Calls Via CommandLine (SecOps)
T1056.001	Input Capture	Malicious PowerShell Commandlets - ProcessCreation	Malicious PowerShell Commandlets - ProcessCreation (SecOps)
T1056.004	Hook PowerShell TLS Encrypt/Decrypt Messages	Mavinject Inject DLL Into Running Process	Mavinject Inject DLL Into Running Process (SecOps)
T1057	Discover Specific Process - tasklist	LSASS Process Reconnaissance Via Findstr.EXE Recon Command Output Piped To Findstr.EXE Suspicious Tasklist Discovery Command	LSASS Process Reconnaissance Via Findstr.EXE (SecOps) Recon Command Output Piped To Findstr.EXE (SecOps) Suspicious Tasklist Discovery Command (SecOps)
T1057	Process Discovery - wmic process	Process Reconnaissance Via Wmic.EXE	Process Reconnaissance Via Wmic.EXE (SecOps)
T1057	Process Discovery - tasklist	Suspicious Tasklist Discovery Command	Suspicious Tasklist Discovery Command (SecOps)
T1059.001	SOAPHound - Build Cache	HackTool - SOAPHound Execution	HackTool - SOAPHound Execution (SecOps)
T1059.001	SOAPHound - Dump BloodHound Data	HackTool - SOAPHound Execution	HackTool - SOAPHound Execution (SecOps)
T1059.001	ATHPowerShellCommandLineParameter -EncodedCommand parameter variations with encoded arguments	Suspicious Execution of Powershell with Base64	Suspicious Execution of Powershell with Base64 (SecOps)
T1059.001	ATHPowerShellCommandLineParameter -EncodedCommand parameter variations	Suspicious Execution of Powershell with Base64	Suspicious Execution of Powershell with Base64 (SecOps)
T1059.001	ATHPowerShellCommandLineParameter -Command parameter variations with encoded arguments	Suspicious Execution of Powershell with Base64	Suspicious Execution of Powershell with Base64 (SecOps)
T1059.001	Powershell MsXml COM object - with prompt	Suspicious PowerShell IEX Execution Patterns Suspicious PowerShell Parameter Substring Change PowerShell Policies to an Insecure Level	Suspicious PowerShell IEX Execution Patterns (SecOps) Suspicious PowerShell Parameter Substring (SecOps) Change PowerShell Policies to an Insecure Level (SecOps)
T1059.001	Invoke-AppPathBypass	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious Program Names Suspicious PowerShell Download and Execute Pattern PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious Program Names (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1059.001	Mimikatz	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious Program Names Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation HackTool - Mimikatz Execution PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious Program Names (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) HackTool - Mimikatz Execution (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1059.001	PowerShell Invoke Known Malicious Cmdlets	Malicious PowerShell Commandlets - ProcessCreation HackTool - Mimikatz Execution	Malicious PowerShell Commandlets - ProcessCreation (SecOps) HackTool - Mimikatz Execution (SecOps)
T1059.001	PowerShell Command Execution	Suspicious Execution of Powershell with Base64	Suspicious Execution of Powershell with Base64 (SecOps)
T1059.001	Mimikatz - Cradlecraft PsSendKeys	Malicious PowerShell Commandlets - ProcessCreation HackTool - Mimikatz Execution Suspicious Program Names	Malicious PowerShell Commandlets - ProcessCreation (SecOps) HackTool - Mimikatz Execution (SecOps) Suspicious Program Names (SecOps)
T1059.003	Command prompt writing script to file then executes it	Whoami.EXE Execution With Output Option	Whoami.EXE Execution With Output Option (SecOps)
T1059.003	Command Prompt read contents from CMD file and execute	Read Contents From Stdin Via Cmd.EXE	Read Contents From Stdin Via Cmd.EXE (SecOps)
T1059.003	Writes text to a file and displays it.	Potentially Suspicious CMD Shell Output Redirect	Potentially Suspicious CMD Shell Output Redirect (SecOps)
T1059.004	Detecting pipe-to-shell	Curl Usage on Linux	Curl Usage on Linux (SecOps)
T1059.004	Command-Line Interface	Linux Shell Pipe to Shell	Linux Shell Pipe to Shell (SecOps)
T1059.004	Shell Creation using awk command	Suspicious Invocation of Shell via AWK - Linux	Suspicious Invocation of Shell via AWK - Linux (SecOps)
T1059.005	Visual Basic script execution to gather local computer information	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript Potentially Suspicious PowerShell Child Processes	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript (SecOps) Potentially Suspicious PowerShell Child Processes (SecOps)
T1059.007	JScript execution to gather local computer information via wscript	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript (SecOps)
T1059.007	JScript execution to gather local computer information via cscript	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript Potentially Suspicious CMD Shell Output Redirect	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript (SecOps) Potentially Suspicious CMD Shell Output Redirect (SecOps)
T1069.001	Wmic Group Discovery	Local Groups Reconnaissance Via Wmic.EXE	Local Groups Reconnaissance Via Wmic.EXE (SecOps)
T1069.001	SharpHound3 - LocalAdmin	Use Short Name Path in Command Line	Use Short Name Path in Command Line (SecOps)
T1069.001	Basic Permission Groups Discovery Windows (Local)	Net.EXE Execution	Net.EXE Execution (SecOps)
T1069.002	Adfind - Query Active Directory Groups	PUA - AdFind Suspicious Execution	PUA - AdFind Suspicious Execution (SecOps)
T1069.002	Enumerate Active Directory Groups with ADSISearcher	PUA - AdFind Suspicious Execution	PUA - AdFind Suspicious Execution (SecOps)
T1070	Indicator Removal using FSUtil	Fsutil Suspicious Invocation	Fsutil Suspicious Invocation (SecOps)
T1070.001	Clear Logs	Suspicious Eventlog Clearing or Configuration Change Activity	Suspicious Eventlog Clearing or Configuration Change Activity (SecOps)
T1070.002	Delete system log files via unlink utility (freebsd)	Clear Linux Logs	Clear Linux Logs (SecOps)
T1070.003	Clear Bash history (rm)	History File Deletion	History File Deletion (SecOps)
T1070.004	Delete a single file - FreeBSD/Linux/macOS	File Deletion	File Deletion (SecOps)
T1070.004	Delete an entire folder - Windows cmd	File And SubFolder Enumeration Via Dir Command Directory Removal Via Rmdir	File And SubFolder Enumeration Via Dir Command (SecOps) Directory Removal Via Rmdir (SecOps)
T1070.004	Delete Prefetch File	Copy From Or To Admin Share Or Sysvol Folder	Copy From Or To Admin Share Or Sysvol Folder (SecOps)
T1070.004	Delete a single file - Windows cmd	File Deletion Via Del	File Deletion Via Del (SecOps)
T1070.005	Remove Network Share	Windows Share Mount Via Net.EXE Unmount Share Via Net.EXE Net.EXE Execution	Windows Share Mount Via Net.EXE (SecOps) Unmount Share Via Net.EXE (SecOps) Net.EXE Execution (SecOps)
T1070.005	Add Network Share	Net.EXE Execution	Net.EXE Execution (SecOps)
T1071.001	Malicious User Agents - CMD	Read Contents From Stdin Via Cmd.EXE	Read Contents From Stdin Via Cmd.EXE (SecOps)
T1071.004	DNS C2	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1074.001	Stage data from Discovery.sh	Curl Usage on Linux Linux Shell Pipe to Shell	Curl Usage on Linux (SecOps) Linux Shell Pipe to Shell (SecOps)
T1074.001	Zip a Folder with PowerShell for Staging in Temp	Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet	Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet (SecOps)
T1074.001	Stage data from Discovery.bat	Usage Of Web Request Commands And Cmdlets PowerShell Web Download Suspicious Invoke-WebRequest Execution	Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps) Suspicious Invoke-WebRequest Execution (SecOps)
T1078.001	Activate Guest Account	Suspicious Manipulation Of Default Accounts Via Net.EXE	Suspicious Manipulation Of Default Accounts Via Net.EXE (SecOps)
T1078.001	Enable Guest account with RDP capability and admin privileges	User Added to Local Administrators Group User Added to Remote Desktop Users Group Weak or Abused Passwords In CLI	User Added to Local Administrators Group (SecOps) User Added to Remote Desktop Users Group (SecOps) Weak or Abused Passwords In CLI (SecOps)
T1078.003	Use PsExec to elevate to NT Authority\SYSTEM account	Psexec Execution Potential Execution of Sysinternals Tools	Psexec Execution (SecOps) Potential Execution of Sysinternals Tools (SecOps)
T1078.003	Create local account with admin privileges	User Added to Local Administrators Group	User Added to Local Administrators Group (SecOps)
T1082	ESXi - Darkside system information discovery	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1082	ESXi - VM Discovery using ESXCLI	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1082	WinPwn - PowerSharpPack - Seatbelt	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1082	WinPwn - PowerSharpPack - Sharpup checking common Privesc vectors	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1082	WinPwn - PowerSharpPack - Watson searching for missing windows patches	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1082	System Information Discovery	Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript Potential Reconnaissance Activity Via GatherNetworkInfo.VBS	Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS (SecOps) WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript (SecOps) Potential Reconnaissance Activity Via GatherNetworkInfo.VBS (SecOps)
T1082	Griffon Recon	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript Potentially Suspicious PowerShell Child Processes	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript (SecOps) Potentially Suspicious PowerShell Child Processes (SecOps)
T1082	Windows MachineGUID Discovery	Suspicious Query of MachineGUID	Suspicious Query of MachineGUID (SecOps)
T1082	System Information Discovery	Potential Configuration And Service Reconnaissance Via Reg.EXE	Potential Configuration And Service Reconnaissance Via Reg.EXE (SecOps)
T1083	ESXi - Enumerate VMDKs available on an ESXi Host	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1083	File and Directory Discovery (cmd.exe)	Potentially Suspicious CMD Shell Output Redirect File And SubFolder Enumeration Via Dir Command	Potentially Suspicious CMD Shell Output Redirect (SecOps) File And SubFolder Enumeration Via Dir Command (SecOps)
T1087.001	ESXi - Local Account Discovery via ESXCLI	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1087.002	Enumerate Default Domain Admin Details (Domain)	Suspicious Manipulation Of Default Accounts Via Net.EXE	Suspicious Manipulation Of Default Accounts Via Net.EXE (SecOps)
T1087.002	Adfind - Enumerate Active Directory User Objects	PUA - AdFind Suspicious Execution	PUA - AdFind Suspicious Execution (SecOps)
T1087.002	Enumerate all accounts (Domain)	Net.EXE Execution Suspicious Group And Account Reconnaissance Activity Using Net.EXE	Net.EXE Execution (SecOps) Suspicious Group And Account Reconnaissance Activity Using Net.EXE (SecOps)
T1087.002	Enumerate Linked Policies In ADSISearcher Discovery	PUA - AdFind Suspicious Execution	PUA - AdFind Suspicious Execution (SecOps)
T1087.002	Enumerate Active Directory Users with ADSISearcher	PUA - AdFind Suspicious Execution	PUA - AdFind Suspicious Execution (SecOps)
T1087.002	Adfind - Enumerate Active Directory Exchange AD Objects	PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE	PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE (SecOps)
T1087.002	Adfind - Enumerate Active Directory Admins	PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE	PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE (SecOps)
T1087.002	Adfind -Listing password policy	PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE	PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE (SecOps)
T1087.002	Automated AD Recon (ADRecon)	Suspicious Program Names	Suspicious Program Names (SecOps)
T1090.001	Connection Proxy	Connection Proxy	Connection Proxy (SecOps)
T1090.001	portproxy reg key	New Port Forwarding Rule Added Via Netsh.EXE	New Port Forwarding Rule Added Via Netsh.EXE (SecOps)
T1095	Powercat C2	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious Program Names PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious Program Names (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1095	ICMP C2	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1105	Linux Download File and Run	Curl Usage on Linux Linux Shell Pipe to Shell	Curl Usage on Linux (SecOps) Linux Shell Pipe to Shell (SecOps)
T1105	sftp remote file copy (push)	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1105	Arbitrary file download using the Notepad++ GUP.exe binary	Suspicious GUP Usage File And SubFolder Enumeration Via Dir Command File Download Using Notepad++ GUP Utility	Suspicious GUP Usage (SecOps) File And SubFolder Enumeration Via Dir Command (SecOps) File Download Using Notepad++ GUP Utility (SecOps)
T1105	File Download via PowerShell	Usage Of Web Request Commands And Cmdlets PowerShell Web Download PowerShell Download Pattern	Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps)
T1105	Windows - PowerShell Download	Usage Of Web Request Commands And Cmdlets PowerShell Web Download PowerShell DownloadFile PowerShell Download Pattern	Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps) PowerShell DownloadFile (SecOps) PowerShell Download Pattern (SecOps)
T1105	Windows - BITSAdmin BITS Download	Suspicious Download From File-Sharing Website Via Bitsadmin File Download Via Bitsadmin To A Suspicious Target Folder File Download Via Bitsadmin To An Uncommon Target Folder File With Suspicious Extension Downloaded Via Bitsadmin	Suspicious Download From File-Sharing Website Via Bitsadmin (SecOps) File Download Via Bitsadmin To A Suspicious Target Folder (SecOps) File Download Via Bitsadmin To An Uncommon Target Folder (SecOps) File With Suspicious Extension Downloaded Via Bitsadmin (SecOps)
T1105	iwr or Invoke Web-Request download	Usage Of Web Request Commands And Cmdlets Suspicious Script Execution From Temp Folder PowerShell Web Download Suspicious Invoke-WebRequest Execution	Usage Of Web Request Commands And Cmdlets (SecOps) Suspicious Script Execution From Temp Folder (SecOps) PowerShell Web Download (SecOps) Suspicious Invoke-WebRequest Execution (SecOps)
T1105	Download a file using wscript	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript (SecOps)
T1105	certreq download	Suspicious Certreq Command to Download	Suspicious Certreq Command to Download (SecOps)
T1105	Lolbas replace.exe use to copy UNC file	Replace.exe Usage Greedy File Deletion Using Del	Replace.exe Usage (SecOps) Greedy File Deletion Using Del (SecOps)
T1105	Lolbas replace.exe use to copy file	Replace.exe Usage Greedy File Deletion Using Del	Replace.exe Usage (SecOps) Greedy File Deletion Using Del (SecOps)
T1105	Printer Migration Command-Line Tool UNC share folder into a zip file	File Deletion Via Del Potentially Suspicious CMD Shell Output Redirect Greedy File Deletion Using Del PrintBrm ZIP Creation of Extraction	File Deletion Via Del (SecOps) Potentially Suspicious CMD Shell Output Redirect (SecOps) Greedy File Deletion Using Del (SecOps) PrintBrm ZIP Creation of Extraction (SecOps)
T1105	Download a file with IMEWDBLD.exe	Arbitrary File Download Via IMEWDBLD.EXE	Arbitrary File Download Via IMEWDBLD.EXE (SecOps)
T1105	File download with finger.exe on Windows	Finger.EXE Execution	Finger.EXE Execution (SecOps)
T1105	Download a File with Windows Defender MpCmdRun.exe	Use Short Name Path in Command Line	Use Short Name Path in Command Line (SecOps)
T1105	svchost writing a file to a UNC path	Suspicious Copy From or To System Directory Copy From Or To Admin Share Or Sysvol Folder	Suspicious Copy From or To System Directory (SecOps) Copy From Or To Admin Share Or Sysvol Folder (SecOps)
T1105	OSTAP Worming Activity	File Deletion Via Del	File Deletion Via Del (SecOps)
T1106	WinPwn - Get SYSTEM shell - Pop System Shell using NamedPipe Impersonation technique	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1106	WinPwn - Get SYSTEM shell - Bind System Shell using CreateProcess technique	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1106	WinPwn - Get SYSTEM shell - Pop System Shell using CreateProcess technique	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1110.001	ESXi - Brute Force Until Account Lockout	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1110.001	Password Brute User using Kerbrute Tool	Use Short Name Path in Command Line	Use Short Name Path in Command Line (SecOps)
T1110.002	Password Cracking with Hashcat	HackTool - Hashcat Password Cracker Execution	HackTool - Hashcat Password Cracker Execution (SecOps)
T1110.004	SSH Credential Stuffing From Linux	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1112	Flush Shimcache	ShimCache Flush	ShimCache Flush (SecOps)
T1112	Change Powershell Execution Policy to Bypass	Change PowerShell Policies to an Insecure Level	Change PowerShell Policies to an Insecure Level (SecOps)
T1112	Modify UseTPMKeyPIN Registry entry	Suspicious Reg Add BitLocker	Suspicious Reg Add BitLocker (SecOps)
T1112	Modify UseTPMKey Registry entry	Suspicious Reg Add BitLocker	Suspicious Reg Add BitLocker (SecOps)
T1112	Modify UseTPMPIN Registry entry	Suspicious Reg Add BitLocker	Suspicious Reg Add BitLocker (SecOps)
T1112	Modify EnableBDEWithNoTPM Registry entry	Suspicious Reg Add BitLocker	Suspicious Reg Add BitLocker (SecOps)
T1112	Requires the BitLocker PIN for Pre-boot authentication	Suspicious Reg Add BitLocker	Suspicious Reg Add BitLocker (SecOps)
T1112	Disable Windows Remote Desktop Protocol	Potential Tampering With RDP Related Registry Keys Via Reg.EXE	Potential Tampering With RDP Related Registry Keys Via Reg.EXE (SecOps)
T1112	Enable RDP via Registry (fDenyTSConnections)	Potential Tampering With RDP Related Registry Keys Via Reg.EXE	Potential Tampering With RDP Related Registry Keys Via Reg.EXE (SecOps)
T1112	Activities To Disable Microsoft [FIDO Aka Fast IDentity Online] Authentication Detected By Modified Registry Value.	Reg Add Suspicious Paths Suspicious Windows Defender Registry Key Tampering Via Reg.EXE	Reg Add Suspicious Paths (SecOps) Suspicious Windows Defender Registry Key Tampering Via Reg.EXE (SecOps)
T1112	Modify Internet Zone Protocol Defaults in Current User Registry - cmd	IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI	IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI (SecOps)
T1112	Tamper Win Defender Protection	Reg Add Suspicious Paths Suspicious Windows Defender Registry Key Tampering Via Reg.EXE	Reg Add Suspicious Paths (SecOps) Suspicious Windows Defender Registry Key Tampering Via Reg.EXE (SecOps)
T1112	Enabling Remote Desktop Protocol via Remote Registry	Potential Tampering With RDP Related Registry Keys Via Reg.EXE	Potential Tampering With RDP Related Registry Keys Via Reg.EXE (SecOps)
T1112	Mimic Ransomware - Allow Multiple RDP Sessions per User	Potential Tampering With RDP Related Registry Keys Via Reg.EXE	Potential Tampering With RDP Related Registry Keys Via Reg.EXE (SecOps)
T1112	Disable Windows Error Reporting Settings	Reg Add Suspicious Paths Suspicious Windows Defender Registry Key Tampering Via Reg.EXE	Reg Add Suspicious Paths (SecOps) Suspicious Windows Defender Registry Key Tampering Via Reg.EXE (SecOps)
T1112	Ursnif Malware Registry Key Creation	Reg Add Suspicious Paths	Reg Add Suspicious Paths (SecOps)
T1112	NetWire RAT Registry Key Creation	Potential Persistence Attempt Via Run Keys Using Reg.EXE	Potential Persistence Attempt Via Run Keys Using Reg.EXE (SecOps)
T1112	Suppress Win Defender Notifications	Reg Add Suspicious Paths Suspicious Windows Defender Registry Key Tampering Via Reg.EXE	Reg Add Suspicious Paths (SecOps) Suspicious Windows Defender Registry Key Tampering Via Reg.EXE (SecOps)
T1112	Windows Add Registry Value to Load Service in Safe Mode with Network	Add SafeBoot Keys Via Reg Utility	Add SafeBoot Keys Via Reg Utility (SecOps)
T1112	Windows Add Registry Value to Load Service in Safe Mode without Network	Add SafeBoot Keys Via Reg Utility	Add SafeBoot Keys Via Reg Utility (SecOps)
T1112	Windows Powershell Logging Disabled	Suspicious PowerShell Invocations - Specific - ProcessCreation	Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps)
T1112	Modify registry to store logon credentials	Reg Add Suspicious Paths	Reg Add Suspicious Paths (SecOps)
T1112	Modify Registry of Local Machine - cmd	Direct Autorun Keys Modification Potential Persistence Attempt Via Run Keys Using Reg.EXE	Direct Autorun Keys Modification (SecOps) Potential Persistence Attempt Via Run Keys Using Reg.EXE (SecOps)
T1113	Capture Linux Desktop using Import Tool	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1113	Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted	Suspicious PowerShell Invocations - Specific - ProcessCreation Windows Recall Feature Enabled Via Reg.EXE	Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Windows Recall Feature Enabled Via Reg.EXE (SecOps)
T1114.001	Email Collection with PowerShell Get-Inbox	Use Short Name Path in Command Line Script Interpreter Execution From Suspicious Folder Suspicious Script Execution From Temp Folder Change PowerShell Policies to an Insecure Level	Use Short Name Path in Command Line (SecOps) Script Interpreter Execution From Suspicious Folder (SecOps) Suspicious Script Execution From Temp Folder (SecOps) Change PowerShell Policies to an Insecure Level (SecOps)
T1115	Utilize Clipboard to store or execute commands from	Read Contents From Stdin Via Cmd.EXE Potentially Suspicious CMD Shell Output Redirect	Read Contents From Stdin Via Cmd.EXE (SecOps) Potentially Suspicious CMD Shell Output Redirect (SecOps)
T1119	Recon information for export with Command Prompt	Potentially Suspicious CMD Shell Output Redirect	Potentially Suspicious CMD Shell Output Redirect (SecOps)
T1119	Automated Collection Command Prompt	Automated Collection Command Prompt Potentially Suspicious CMD Shell Output Redirect Suspicious Copy From or To System Directory File And SubFolder Enumeration Via Dir Command	Automated Collection Command Prompt (SecOps) Potentially Suspicious CMD Shell Output Redirect (SecOps) Suspicious Copy From or To System Directory (SecOps) File And SubFolder Enumeration Via Dir Command (SecOps)
T1120	Peripheral Device Discovery via fsutil	Fsutil Drive Enumeration	Fsutil Drive Enumeration (SecOps)
T1123	using device audio capture commandlet	Audio Capture via PowerShell	Audio Capture via PowerShell (SecOps)
T1124	System Time Discovery W32tm as a Delay	Use of W32tm as Timer	Use of W32tm as Timer (SecOps)
T1124	System Time Discovery	Windows Share Mount Via Net.EXE Discovery of a System Time	Windows Share Mount Via Net.EXE (SecOps) Discovery of a System Time (SecOps)
T1127	Lolbin Jsc.exe compile javascript to dll	Suspicious Copy From or To System Directory	Suspicious Copy From or To System Directory (SecOps)
T1127	Lolbin Jsc.exe compile javascript to exe	Suspicious Copy From or To System Directory	Suspicious Copy From or To System Directory (SecOps)
T1129	ESXi - Install a custom VIB on an ESXi host	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1132.001	Base64 Encoded data (freebsd)	Curl Usage on Linux	Curl Usage on Linux (SecOps)
T1132.001	Base64 Encoded data.	Curl Usage on Linux	Curl Usage on Linux (SecOps)
T1134.002	WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1134.004	Parent PID Spoofing - Spawn from Specified Process	Weak or Abused Passwords In CLI	Weak or Abused Passwords In CLI (SecOps)
T1134.005	Injection SID-History with mimikatz	HackTool - Mimikatz Execution	HackTool - Mimikatz Execution (SecOps)
T1135	PowerView ShareFinder	Malicious PowerShell Commandlets - ProcessCreation Suspicious Program Names Import New Module Via PowerShell CommandLine	Malicious PowerShell Commandlets - ProcessCreation (SecOps) Suspicious Program Names (SecOps) Import New Module Via PowerShell CommandLine (SecOps)
T1135	View available share drives	Net.EXE Execution	Net.EXE Execution (SecOps)
T1135	Network Share Discovery command prompt	Windows Share Mount Via Net.EXE	Windows Share Mount Via Net.EXE (SecOps)
T1136.001	Create a new Windows admin user via .NET	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1136.001	Create a new Windows admin user	User Added to Local Administrators Group Net.EXE Execution	User Added to Local Administrators Group (SecOps) Net.EXE Execution (SecOps)
T1136.001	Create a new user in a command prompt	New User Created Via Net.EXE Net.EXE Execution	New User Created Via Net.EXE (SecOps) Net.EXE Execution (SecOps)
T1136.002	Create a new account similar to ANONYMOUS LOGON	New User Created Via Net.EXE Net.EXE Execution	New User Created Via Net.EXE (SecOps) Net.EXE Execution (SecOps)
T1136.002	Create a new Windows domain admin user	Net.EXE Execution	Net.EXE Execution (SecOps)
T1137	Office Application Startup - Outlook as a C2	Potentially Suspicious CMD Shell Output Redirect	Potentially Suspicious CMD Shell Output Redirect (SecOps)
T1140	Linux Base64 Encoded Shebang in CLI	Linux Base64 Encoded Pipe to Shell Linux Base64 Encoded Shebang In CLI Linux Shell Pipe to Shell	Linux Base64 Encoded Pipe to Shell (SecOps) Linux Base64 Encoded Shebang In CLI (SecOps) Linux Shell Pipe to Shell (SecOps)
T1140	FreeBSD b64encode Shebang in CLI	Linux Base64 Encoded Shebang In CLI Linux Shell Pipe to Shell	Linux Base64 Encoded Shebang In CLI (SecOps) Linux Shell Pipe to Shell (SecOps)
T1140	Certutil Rename and Decode	LOL-Binary Copied From System Directory Suspicious Calculator Usage Suspicious Copy From or To System Directory	LOL-Binary Copied From System Directory (SecOps) Suspicious Calculator Usage (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1140	Deobfuscate/Decode Files Or Information	Suspicious Calculator Usage	Suspicious Calculator Usage (SecOps)
T1187	WinPwn - PowerSharpPack - Retrieving NTLM Hashes without Touching LSASS	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1187	Trigger an authenticated RPC call to a target server with no Sign flag set	Capture Credentials with Rpcping.exe Suspicious Execution of Powershell with Base64	Capture Credentials with Rpcping.exe (SecOps) Suspicious Execution of Powershell with Base64 (SecOps)
T1187	PetitPotam	Potential SMB Relay Attack Tool Execution	Potential SMB Relay Attack Tool Execution (SecOps)
T1195	Octopus Scanner Malware Open Source Supply Chain	Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE Suspicious Copy From or To System Directory Scheduled Task Creation Via Schtasks.EXE	Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE (SecOps) Suspicious Copy From or To System Directory (SecOps) Scheduled Task Creation Via Schtasks.EXE (SecOps)
T1197	Bits download using desktopimgdownldr.exe (cmd)	Suspicious Desktopimgdownldr Command	Suspicious Desktopimgdownldr Command (SecOps)
T1197	Bitsadmin Download (PowerShell)	Usage Of Web Request Commands And Cmdlets	Usage Of Web Request Commands And Cmdlets (SecOps)
T1197	Bitsadmin Download (cmd)	Suspicious Download From File-Sharing Website Via Bitsadmin File Download Via Bitsadmin To A Suspicious Target Folder File Download Via Bitsadmin To An Uncommon Target Folder File With Suspicious Extension Downloaded Via Bitsadmin	Suspicious Download From File-Sharing Website Via Bitsadmin (SecOps) File Download Via Bitsadmin To A Suspicious Target Folder (SecOps) File Download Via Bitsadmin To An Uncommon Target Folder (SecOps) File With Suspicious Extension Downloaded Via Bitsadmin (SecOps)
T1201	Examine domain password policy - Windows	Net.EXE Execution Suspicious Group And Account Reconnaissance Activity Using Net.EXE	Net.EXE Execution (SecOps) Suspicious Group And Account Reconnaissance Activity Using Net.EXE (SecOps)
T1201	Use of SecEdit.exe to export the local security policy (including the password policy)	Potential Suspicious Activity Using SeCEdit	Potential Suspicious Activity Using SeCEdit (SecOps)
T1201	Examine local password policy - Windows	Net.EXE Execution	Net.EXE Execution (SecOps)
T1202	Indirect Command Execution - Scriptrunner.exe	Potentially Suspicious PowerShell Child Processes Use of Scriptrunner.exe	Potentially Suspicious PowerShell Child Processes (SecOps) Use of Scriptrunner.exe (SecOps)
T1202	Indirect Command Execution - forfiles.exe	Forfiles Command Execution	Forfiles Command Execution (SecOps)
T1202	Indirect Command Execution - pcalua.exe	Use of Pcalua For Execution	Use of Pcalua For Execution (SecOps)
T1204.002	LNK Payload Download	Usage Of Web Request Commands And Cmdlets PowerShell Web Download Suspicious Invoke-WebRequest Execution	Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps) Suspicious Invoke-WebRequest Execution (SecOps)
T1204.002	Potentially Unwanted Applications (PUA)	Usage Of Web Request Commands And Cmdlets PowerShell Web Download Suspicious Invoke-WebRequest Execution	Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps) Suspicious Invoke-WebRequest Execution (SecOps)
T1204.002	OSTap Payload Download	Potentially Suspicious CMD Shell Output Redirect	Potentially Suspicious CMD Shell Output Redirect (SecOps)
T1216	SyncAppvPublishingServer Signed Script PowerShell Command Execution	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript (SecOps) SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code (SecOps)
T1216	manage-bde.wsf Signed Script Command Execution	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript Suspicious Calculator Usage	WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript (SecOps) Suspicious Calculator Usage (SecOps)
T1216.001	PubPrn.vbs Signed Script Bypass	Pubprn.vbs Proxy Execution WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript	Pubprn.vbs Proxy Execution (SecOps) WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript (SecOps)
T1217	List Internet Explorer Bookmarks using the command prompt	File And SubFolder Enumeration Via Dir Command	File And SubFolder Enumeration Via Dir Command (SecOps)
T1217	List Mozilla Firefox bookmarks on Windows with command prompt	Suspicious Where Execution	Suspicious Where Execution (SecOps)
T1217	List Google Chrome / Edge Chromium Bookmarks on Windows with command prompt	Suspicious Where Execution	Suspicious Where Execution (SecOps)
T1218	DiskShadow Command Execution	Diskshadow Script Mode Execution	Diskshadow Script Mode Execution (SecOps)
T1218	Renamed Microsoft.Workflow.Compiler.exe Payload Executions	Suspicious Process Masquerading As SvcHost.EXE Uncommon Svchost Parent Process System File Execution Location Anomaly	Suspicious Process Masquerading As SvcHost.EXE (SecOps) Uncommon Svchost Parent Process (SecOps) System File Execution Location Anomaly (SecOps)
T1218	mavinject - Inject DLL into running process	Mavinject Inject DLL Into Running Process	Mavinject Inject DLL Into Running Process (SecOps)
T1218	System Binary Proxy Execution - Wlrmdr Lolbin	Wlrmdr.EXE Uncommon Argument Or Child Process	Wlrmdr.EXE Uncommon Argument Or Child Process (SecOps)
T1218	Provlaunch.exe Executes Arbitrary Command via Registry Key	Potential Provisioning Registry Key Abuse For Binary Proxy Execution	Potential Provisioning Registry Key Abuse For Binary Proxy Execution (SecOps)
T1218	Lolbas ie4uinit.exe use as proxy	Suspicious Copy From or To System Directory	Suspicious Copy From or To System Directory (SecOps)
T1218	Lolbin Gpscript startup option	Gpscript Execution	Gpscript Execution (SecOps)
T1218	Lolbin Gpscript logon option	Gpscript Execution	Gpscript Execution (SecOps)
T1218	Load Arbitrary DLL via Wuauclt (Windows Update Client)	Proxy Execution Via Wuauclt.EXE	Proxy Execution Via Wuauclt.EXE (SecOps)
T1218	Invoke-ATHRemoteFXvGPUDisablementCommand base test	RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses	RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses (SecOps)
T1218	Microsoft.Workflow.Compiler.exe Payload Execution	Microsoft Workflow Compiler Execution	Microsoft Workflow Compiler Execution (SecOps)
T1218	InfDefaultInstall.exe .inf Execution	InfDefaultInstall.exe .inf Execution	InfDefaultInstall.exe .inf Execution (SecOps)
T1218	Register-CimProvider - Execute evil dll	DLL Execution Via Register-cimprovider.exe	DLL Execution Via Register-cimprovider.exe (SecOps)
T1218.001	Decompile Local CHM File	HH.EXE Execution Suspicious HH.EXE Execution	HH.EXE Execution (SecOps) Suspicious HH.EXE Execution (SecOps)
T1218.001	Compiled HTML Help Remote Payload	HH.EXE Execution Remote CHM File Download/Execution Via HH.EXE	HH.EXE Execution (SecOps) Remote CHM File Download/Execution Via HH.EXE (SecOps)
T1218.001	Compiled HTML Help Local Payload	HH.EXE Execution	HH.EXE Execution (SecOps)
T1218.003	CMSTP Executing UAC Bypass	Bypass UAC via CMSTP	Bypass UAC via CMSTP (SecOps)
T1218.003	CMSTP Executing Remote Scriptlet	Bypass UAC via CMSTP	Bypass UAC via CMSTP (SecOps)
T1218.005	Mshta used to Execute PowerShell	Read Contents From Stdin Via Cmd.EXE MSHTA Suspicious Execution 01 Wscript Shell Run In CommandLine	Read Contents From Stdin Via Cmd.EXE (SecOps) MSHTA Suspicious Execution 01 (SecOps) Wscript Shell Run In CommandLine (SecOps)
T1218.005	Mshta executes VBScript to execute malicious command	MSHTA Suspicious Execution 01 Wscript Shell Run In CommandLine	MSHTA Suspicious Execution 01 (SecOps) Wscript Shell Run In CommandLine (SecOps)
T1218.005	Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject	Remotely Hosted HTA File Executed Via Mshta.EXE Suspicious JavaScript Execution Via Mshta.EXE	Remotely Hosted HTA File Executed Via Mshta.EXE (SecOps) Suspicious JavaScript Execution Via Mshta.EXE (SecOps)
T1218.007	Msiexec.exe - Execute Remote MSI file	Msiexec Quiet Installation Suspicious Msiexec Quiet Install From Remote Location	Msiexec Quiet Installation (SecOps) Suspicious Msiexec Quiet Install From Remote Location (SecOps)
T1218.007	Msiexec.exe - Execute the DllUnregisterServer function of a DLL	DllUnregisterServer Function Call Via Msiexec.EXE	DllUnregisterServer Function Call Via Msiexec.EXE (SecOps)
T1218.007	Msiexec.exe - Execute the DllRegisterServer function of a DLL	Suspicious Msiexec Execute Arbitrary DLL	Suspicious Msiexec Execute Arbitrary DLL (SecOps)
T1218.007	Msiexec.exe - Execute Local MSI file with an embedded EXE	Msiexec Quiet Installation	Msiexec Quiet Installation (SecOps)
T1218.007	Msiexec.exe - Execute Local MSI file with an embedded DLL	Msiexec Quiet Installation	Msiexec Quiet Installation (SecOps)
T1218.007	Msiexec.exe - Execute Local MSI file with embedded VBScript	Msiexec Quiet Installation	Msiexec Quiet Installation (SecOps)
T1218.007	Msiexec.exe - Execute Local MSI file with embedded JScript	Msiexec Quiet Installation	Msiexec Quiet Installation (SecOps)
T1218.008	Odbcconf.exe - Load Response File	Response File Execution Via Odbcconf.EXE	Response File Execution Via Odbcconf.EXE (SecOps)
T1218.008	Odbcconf.exe - Execute Arbitrary DLL	New DLL Registered Via Odbcconf.EXE	New DLL Registered Via Odbcconf.EXE (SecOps)
T1218.010	Regsvr32 Registering Non DLL	Scripting/CommandLine Process Spawned Regsvr32 Regsvr32 DLL Execution With Suspicious File Extension Regsvr32 Execution From Potential Suspicious Location Regsvr32 DLL Execution With Uncommon Extension	Scripting/CommandLine Process Spawned Regsvr32 (SecOps) Regsvr32 DLL Execution With Suspicious File Extension (SecOps) Regsvr32 Execution From Potential Suspicious Location (SecOps) Regsvr32 DLL Execution With Uncommon Extension (SecOps)
T1218.010	Regsvr32 remote COM scriptlet execution	Scripting/CommandLine Process Spawned Regsvr32 Potential Regsvr32 Commandline Flag Anomaly Potentially Suspicious Regsvr32 HTTP/FTP Pattern	Scripting/CommandLine Process Spawned Regsvr32 (SecOps) Potential Regsvr32 Commandline Flag Anomaly (SecOps) Potentially Suspicious Regsvr32 HTTP/FTP Pattern (SecOps)
T1218.010	Regsvr32 local COM scriptlet execution	Scripting/CommandLine Process Spawned Regsvr32 Potential Regsvr32 Commandline Flag Anomaly	Scripting/CommandLine Process Spawned Regsvr32 (SecOps) Potential Regsvr32 Commandline Flag Anomaly (SecOps)
T1218.010	Regsvr32 Silent DLL Install Call DllRegisterServer	Scripting/CommandLine Process Spawned Regsvr32 Regsvr32 Execution From Highly Suspicious Location	Scripting/CommandLine Process Spawned Regsvr32 (SecOps) Regsvr32 Execution From Highly Suspicious Location (SecOps)
T1218.011	Rundll32 with Control_RunDLL	Potentially Suspicious Rundll32 Activity	Potentially Suspicious Rundll32 Activity (SecOps)
T1218.011	Rundll32 with Ordinal Value	DLL Call by Ordinal Via Rundll32.EXE	DLL Call by Ordinal Via Rundll32.EXE (SecOps)
T1218.011	Execution of non-dll using rundll32.exe	Suspicious Rundll32 Execution With Image Extension Potentially Suspicious PowerShell Child Processes Rundll32 Execution With Uncommon DLL Extension	Suspicious Rundll32 Execution With Image Extension (SecOps) Potentially Suspicious PowerShell Child Processes (SecOps) Rundll32 Execution With Uncommon DLL Extension (SecOps)
T1218.011	Rundll32 setupapi.dll Execution	Potentially Suspicious Rundll32 Activity	Potentially Suspicious Rundll32 Activity (SecOps)
T1218.011	Rundll32 syssetup.dll Execution	Potentially Suspicious Rundll32 Activity	Potentially Suspicious Rundll32 Activity (SecOps)
T1218.011	Rundll32 ieadvpack.dll Execution	Potentially Suspicious Rundll32 Activity	Potentially Suspicious Rundll32 Activity (SecOps)
T1218.011	Rundll32 advpack.dll Execution	Potentially Suspicious Rundll32 Activity	Potentially Suspicious Rundll32 Activity (SecOps)
T1218.011	Rundll32 execute VBscript command using Ordinal number	Wscript Shell Run In CommandLine DLL Call by Ordinal Via Rundll32.EXE Mshtml.DLL RunHTMLApplication Suspicious Usage Rundll32 Execution With Uncommon DLL Extension	Wscript Shell Run In CommandLine (SecOps) DLL Call by Ordinal Via Rundll32.EXE (SecOps) Mshtml.DLL RunHTMLApplication Suspicious Usage (SecOps) Rundll32 Execution With Uncommon DLL Extension (SecOps)
T1218.011	Rundll32 execute payload by calling RouteTheCall	Potentially Suspicious Rundll32 Activity Potentially Suspicious PowerShell Child Processes	Potentially Suspicious Rundll32 Activity (SecOps) Potentially Suspicious PowerShell Child Processes (SecOps)
T1218.011	Rundll32 execute command via FileProtocolHandler	Potentially Suspicious Rundll32 Activity	Potentially Suspicious Rundll32 Activity (SecOps)
T1218.011	Running DLL with .init extension and function	Rundll32 Execution With Uncommon DLL Extension	Rundll32 Execution With Uncommon DLL Extension (SecOps)
T1218.011	Rundll32 with desk.cpl	LOL-Binary Copied From System Directory Rundll32 InstallScreenSaver Execution Suspicious Copy From or To System Directory Suspicious Calculator Usage	LOL-Binary Copied From System Directory (SecOps) Rundll32 InstallScreenSaver Execution (SecOps) Suspicious Copy From or To System Directory (SecOps) Suspicious Calculator Usage (SecOps)
T1218.011	Launches an executable using Rundll32 and pcwutl.dll	Potentially Suspicious Rundll32 Activity Code Execution via Pcwutl.dll	Potentially Suspicious Rundll32 Activity (SecOps) Code Execution via Pcwutl.dll (SecOps)
T1218.011	Execution of HTA and VBS Files using Rundll32 and URL.dll	Potentially Suspicious Rundll32 Activity	Potentially Suspicious Rundll32 Activity (SecOps)
T1218.011	Rundll32 execute VBscript command	Wscript Shell Run In CommandLine Mshtml.DLL RunHTMLApplication Suspicious Usage Rundll32 Execution With Uncommon DLL Extension	Wscript Shell Run In CommandLine (SecOps) Mshtml.DLL RunHTMLApplication Suspicious Usage (SecOps) Rundll32 Execution With Uncommon DLL Extension (SecOps)
T1218.011	Rundll32 execute JavaScript Remote Payload With GetObject	Mshtml.DLL RunHTMLApplication Suspicious Usage Rundll32 Execution With Uncommon DLL Extension	Mshtml.DLL RunHTMLApplication Suspicious Usage (SecOps) Rundll32 Execution With Uncommon DLL Extension (SecOps)
T1219	GoToAssist Files Detected Test on Windows	Usage Of Web Request Commands And Cmdlets PowerShell Web Download Suspicious Invoke-WebRequest Execution	Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps) Suspicious Invoke-WebRequest Execution (SecOps)
T1219	AnyDesk Files Detected Test on Windows	Usage Of Web Request Commands And Cmdlets PowerShell Web Download Suspicious Invoke-WebRequest Execution	Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps) Suspicious Invoke-WebRequest Execution (SecOps)
T1220	WMIC bypass using remote XSL file	XSL Script Execution Via WMIC.EXE Process Reconnaissance Via Wmic.EXE	XSL Script Execution Via WMIC.EXE (SecOps) Process Reconnaissance Via Wmic.EXE (SecOps)
T1220	WMIC bypass using local XSL file	XSL Script Execution Via WMIC.EXE Process Reconnaissance Via Wmic.EXE	XSL Script Execution Via WMIC.EXE (SecOps) Process Reconnaissance Via Wmic.EXE (SecOps)
T1222	Enable Local and Remote Symbolic Links via fsutil	Fsutil Behavior Set SymlinkEvaluation	Fsutil Behavior Set SymlinkEvaluation (SecOps)
T1222.001	Grant Full Access to folder for Everyone - Ryuk Ransomware Style	File or Folder Permissions Modifications	File or Folder Permissions Modifications (SecOps)
T1222.001	attrib - hide file	Potentially Suspicious CMD Shell Output Redirect	Potentially Suspicious CMD Shell Output Redirect (SecOps)
T1222.001	attrib - Remove read-only attribute	File or Folder Permissions Modifications	File or Folder Permissions Modifications (SecOps)
T1222.001	cacls - Grant permission to specified user or group recursively	File or Folder Permissions Modifications	File or Folder Permissions Modifications (SecOps)
T1222.001	Take ownership using takeown utility	Suspicious Recursive Takeown File or Folder Permissions Modifications	Suspicious Recursive Takeown (SecOps) File or Folder Permissions Modifications (SecOps)
T1222.002	chattr - Remove immutable file attribute	Remove Immutable File Attribute	Remove Immutable File Attribute (SecOps)
T1222.002	chown - Change file or folder ownership recursively	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1222.002	chown - Change file or folder ownership and group recursively	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1222.002	chown - Change file or folder ownership and group	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1222.002	chmod - Change file or folder mode (symbolic mode) recursively	Chmod Suspicious Directory Execution Of Script Located In Potentially Suspicious Directory	Chmod Suspicious Directory (SecOps) Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1222.002	chmod - Change file or folder mode (numeric mode) recursively	Chmod Suspicious Directory	Chmod Suspicious Directory (SecOps)
T1222.002	chmod - Change file or folder mode (symbolic mode)	Chmod Suspicious Directory	Chmod Suspicious Directory (SecOps)
T1222.002	chmod - Change file or folder mode (numeric mode)	Chmod Suspicious Directory	Chmod Suspicious Directory (SecOps)
T1482	Adfind - Enumerate Active Directory OUs	PUA - AdFind Suspicious Execution	PUA - AdFind Suspicious Execution (SecOps)
T1482	Adfind - Enumerate Active Directory Trusts	PUA - AdFind Suspicious Execution	PUA - AdFind Suspicious Execution (SecOps)
T1482	Windows - Discover domain trusts with nltest	Potential Recon Activity Via Nltest.EXE Nltest.EXE Execution	Potential Recon Activity Via Nltest.EXE (SecOps) Nltest.EXE Execution (SecOps)
T1485	FreeBSD/macOS/Linux - Overwrite file with DD	DD File Overwrite	DD File Overwrite (SecOps)
T1485	ESXi - Delete VM Snapshots	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1485	Overwrite deleted data on C drive	Deleted Data Overwritten Via Cipher.EXE	Deleted Data Overwritten Via Cipher.EXE (SecOps)
T1486	PureLocker Ransom Note	Potentially Suspicious CMD Shell Output Redirect	Potentially Suspicious CMD Shell Output Redirect (SecOps)
T1489	Linux - Stop service by killing process using pkill	Terminate Linux Process Via Kill	Terminate Linux Process Via Kill (SecOps)
T1489	Linux - Stop service by killing process using killall	Terminate Linux Process Via Kill	Terminate Linux Process Via Kill (SecOps)
T1489	Linux - Stop service using systemctl	Disable Or Stop Services	Disable Or Stop Services (SecOps)
T1489	Windows - Stop service by killing process	Process Terminated Via Taskkill	Process Terminated Via Taskkill (SecOps)
T1489	Windows - Stop service using net.exe	Net.EXE Execution Stop Windows Service Via Net.EXE	Net.EXE Execution (SecOps) Stop Windows Service Via Net.EXE (SecOps)
T1489	Windows - Stop service using Service Controller	Stop Windows Service Via Sc.EXE	Stop Windows Service Via Sc.EXE (SecOps)
T1490	Modify VSS Service Permissions	Allow Service Access Using Security Descriptor Tampering Via Sc.EXE Service Security Descriptor Tampering Via Sc.EXE Deny Service Access Using Security Descriptor Tampering Via Sc.EXE	Allow Service Access Using Security Descriptor Tampering Via Sc.EXE (SecOps) Service Security Descriptor Tampering Via Sc.EXE (SecOps) Deny Service Access Using Security Descriptor Tampering Via Sc.EXE (SecOps)
T1490	Windows - vssadmin Resize Shadowstorage Volume	Shadow Copies Deletion Using Operating Systems Utilities	Shadow Copies Deletion Using Operating Systems Utilities (SecOps)
T1490	Windows - Disable the SR scheduled task	Disable Important Scheduled Task	Disable Important Scheduled Task (SecOps)
T1490	Windows - Delete Backup Files	File Deletion Via Del	File Deletion Via Del (SecOps)
T1490	Windows - Delete Volume Shadow Copies via WMI with PowerShell	Shadow Copies Deletion Using Operating Systems Utilities Deletion of Volume Shadow Copies via WMI with PowerShell	Shadow Copies Deletion Using Operating Systems Utilities (SecOps) Deletion of Volume Shadow Copies via WMI with PowerShell (SecOps)
T1490	Windows - Disable Windows Recovery Console Repair	Boot Configuration Tampering Via Bcdedit.EXE	Boot Configuration Tampering Via Bcdedit.EXE (SecOps)
T1490	Windows - Delete Volume Shadow Copies via WMI	Shadow Copies Deletion Using Operating Systems Utilities Suspicious Copy From or To System Directory	Shadow Copies Deletion Using Operating Systems Utilities (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1490	Windows - Delete Volume Shadow Copies	Shadow Copies Deletion Using Operating Systems Utilities	Shadow Copies Deletion Using Operating Systems Utilities (SecOps)
T1491.001	ESXi - Change Welcome Message on Direct Console User Interface (DCUI)	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1505.002	Install MS Exchange Transport Agent Persistence	MSExchange Transport Agent Installation	MSExchange Transport Agent Installation (SecOps)
T1505.003	Web Shell Written to Disk	Suspicious Copy From or To System Directory	Suspicious Copy From or To System Directory (SecOps)
T1505.004	Install IIS Module using AppCmd.exe	IIS Native-Code Module Command Line Installation	IIS Native-Code Module Command Line Installation (SecOps)
T1518	Find and Display Internet Explorer Browser Version	Detected Windows Software Discovery	Detected Windows Software Discovery (SecOps)
T1518.001	Security Software Discovery - ps (Linux)	Security Software Discovery - Linux	Security Software Discovery - Linux (SecOps)
T1518.001	Security Software Discovery - AV Discovery via WMI	Potential Product Class Reconnaissance Via Wmic.EXE Potential Product Reconnaissance Via Wmic.EXE	Potential Product Class Reconnaissance Via Wmic.EXE (SecOps) Potential Product Reconnaissance Via Wmic.EXE (SecOps)
T1518.001	Security Software Discovery - Sysmon Service	Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE	Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE (SecOps)
T1518.001	Security Software Discovery	Recon Command Output Piped To Findstr.EXE Suspicious Tasklist Discovery Command	Recon Command Output Piped To Findstr.EXE (SecOps) Suspicious Tasklist Discovery Command (SecOps)
T1529	ESXi - vim-cmd Used to Power Off VMs	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1529	ESXi - Avoslocker enumerates VMs and forcefully kills VMs	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1529	ESXi - Terminates VMs using pkill	Tunneling Tool Execution	Tunneling Tool Execution (SecOps)
T1531	Delete User - Windows	New User Created Via Net.EXE	New User Created Via Net.EXE (SecOps)
T1531	Change User Password - Windows	Net.EXE Execution	Net.EXE Execution (SecOps)
T1543.002	Create Systemd Service	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1543.003	Remote Service Installation CMD	New Service Creation Using Sc.EXE Suspicious New Service Creation	New Service Creation Using Sc.EXE (SecOps) Suspicious New Service Creation (SecOps)
T1543.003	TinyTurla backdoor service w64time	Potential Persistence Attempt Via Existing Service Tampering Suspicious Copy From or To System Directory	Potential Persistence Attempt Via Existing Service Tampering (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1543.003	Service Installation PowerShell	New Service Creation Using PowerShell Suspicious New Service Creation	New Service Creation Using PowerShell (SecOps) Suspicious New Service Creation (SecOps)
T1543.003	Service Installation CMD	New Service Creation Using Sc.EXE Suspicious New Service Creation	New Service Creation Using Sc.EXE (SecOps) Suspicious New Service Creation (SecOps)
T1543.003	Modify Fax service to run PowerShell	Potential Persistence Attempt Via Existing Service Tampering Suspicious Service Path Modification	Potential Persistence Attempt Via Existing Service Tampering (SecOps) Suspicious Service Path Modification (SecOps)
T1546	Persistence via ErrorHandler.cmd script execution	Suspicious Copy From or To System Directory	Suspicious Copy From or To System Directory (SecOps)
T1546.001	Change Default File Association	Change Default File Association Via Assoc	Change Default File Association Via Assoc (SecOps)
T1546.002	Set Arbitrary Binary as Screensaver	Suspicious Copy From or To System Directory	Suspicious Copy From or To System Directory (SecOps)
T1546.003	Windows MOFComp.exe Load MOF File	Potential Suspicious Mofcomp Execution	Potential Suspicious Mofcomp Execution (SecOps)
T1546.005	Trap SIGINT (freebsd)	Nohup Execution	Nohup Execution (SecOps)
T1546.005	Trap SIGINT	Nohup Execution	Nohup Execution (SecOps)
T1546.005	Trap EXIT (freebsd)	Nohup Execution	Nohup Execution (SecOps)
T1546.005	Trap EXIT	Nohup Execution	Nohup Execution (SecOps)
T1546.007	Netsh Helper DLL Registration	Potential Persistence Via Netsh Helper DLL	Potential Persistence Via Netsh Helper DLL (SecOps)
T1546.008	Create Symbolic Link From osk.exe to cmd.exe	File Deletion Via Del Greedy File Deletion Using Del Suspicious Copy From or To System Directory Potential Privilege Escalation Using Symlink Between Osk and Cmd	File Deletion Via Del (SecOps) Greedy File Deletion Using Del (SecOps) Suspicious Copy From or To System Directory (SecOps) Potential Privilege Escalation Using Symlink Between Osk and Cmd (SecOps)
T1546.008	Replace binary of sticky keys	Persistence Via Sticky Key Backdoor Suspicious Copy From or To System Directory	Persistence Via Sticky Key Backdoor (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1546.011	New shim database files created in the default shim database directory	Suspicious Copy From or To System Directory	Suspicious Copy From or To System Directory (SecOps)
T1546.011	Application Shim Installation	Potential Shim Database Persistence via Sdbinst.EXE	Potential Shim Database Persistence via Sdbinst.EXE (SecOps)
T1547	Driver Installation Using pnputil.exe	Suspicious Driver Install by pnputil.exe	Suspicious Driver Install by pnputil.exe (SecOps)
T1547	Add a driver	Suspicious Driver Install by pnputil.exe	Suspicious Driver Install by pnputil.exe (SecOps)
T1547.001	Creating Boot Verification Program Key for application execution during successful boot	Potential Persistence Attempt Via Existing Service Tampering	Potential Persistence Attempt Via Existing Service Tampering (SecOps)
T1547.001	Reg Key RunOnce	Direct Autorun Keys Modification Potential Persistence Attempt Via Run Keys Using Reg.EXE	Direct Autorun Keys Modification (SecOps) Potential Persistence Attempt Via Run Keys Using Reg.EXE (SecOps)
T1547.001	Reg Key Run	Direct Autorun Keys Modification Potential Persistence Attempt Via Run Keys Using Reg.EXE	Direct Autorun Keys Modification (SecOps) Potential Persistence Attempt Via Run Keys Using Reg.EXE (SecOps)
T1547.006	Linux - Load Kernel Module via insmod	Execution Of Script Located In Potentially Suspicious Directory	Execution Of Script Located In Potentially Suspicious Directory (SecOps)
T1547.009	Shortcut Modification	Suspicious Calculator Usage Potentially Suspicious CMD Shell Output Redirect	Suspicious Calculator Usage (SecOps) Potentially Suspicious CMD Shell Output Redirect (SecOps)
T1548.001	Make and modify binary from C source (freebsd)	Setuid and Setgid	Setuid and Setgid (SecOps)
T1548.001	Make and modify binary from C source	Setuid and Setgid	Setuid and Setgid (SecOps)
T1548.001	Do reconnaissance for files that have the setgid bit set	Potential Discovery Activity Using Find - Linux	Potential Discovery Activity Using Find - Linux (SecOps)
T1548.001	Do reconnaissance for files that have the setuid bit set	Potential Discovery Activity Using Find - Linux	Potential Discovery Activity Using Find - Linux (SecOps)
T1548.002	WinPwn - UAC Bypass DccwBypassUAC technique	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1548.002	Bypass UAC by Mocking Trusted Directories	Suspicious Copy From or To System Directory	Suspicious Copy From or To System Directory (SecOps)
T1548.002	Bypass UAC using Fodhelper	Suspicious Reg Add Open Command	Suspicious Reg Add Open Command (SecOps)
T1550.002	Mimikatz Pass the Hash	HackTool - Mimikatz Execution	HackTool - Mimikatz Execution (SecOps)
T1550.003	Mimikatz Kerberos Ticket Attack	HackTool - Mimikatz Execution	HackTool - Mimikatz Execution (SecOps)
T1552.002	Enumeration for PuTTY Credentials in Registry	Enumeration for Credentials in Registry Enumeration for 3rd Party Creds From CLI	Enumeration for Credentials in Registry (SecOps) Enumeration for 3rd Party Creds From CLI (SecOps)
T1552.002	Enumeration for Credentials in Registry	Enumeration for Credentials in Registry	Enumeration for Credentials in Registry (SecOps)
T1552.004	Private Keys	Private Keys Reconnaissance Via CommandLine Tools File And SubFolder Enumeration Via Dir Command	Private Keys Reconnaissance Via CommandLine Tools (SecOps) File And SubFolder Enumeration Via Dir Command (SecOps)
T1552.004	Export Certificates with Mimikatz	HackTool - Mimikatz Execution	HackTool - Mimikatz Execution (SecOps)
T1552.004	CertUtil ExportPFX	PowerShell Download and Execution Cradles Usage Of Web Request Commands And Cmdlets PowerShell Web Download	PowerShell Download and Execution Cradles (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps)
T1552.006	GPP Passwords (findstr)	Potential Password Reconnaissance Via Findstr.EXE Findstr GPP Passwords	Potential Password Reconnaissance Via Findstr.EXE (SecOps) Findstr GPP Passwords (SecOps)
T1552.006	GPP Passwords (Get-GPPPassword)	Malicious PowerShell Commandlets - ProcessCreation	Malicious PowerShell Commandlets - ProcessCreation (SecOps)
T1553.003	SIP (Subject Interface Package) Hijacking via Custom DLL	Scripting/CommandLine Process Spawned Regsvr32 Regsvr32 Execution From Highly Suspicious Location	Scripting/CommandLine Process Spawned Regsvr32 (SecOps) Regsvr32 Execution From Highly Suspicious Location (SecOps)
T1553.004	Add Root Certificate to CurrentUser Certificate Store	PowerShell Download and Execution Cradles Usage Of Web Request Commands And Cmdlets PowerShell Web Download	PowerShell Download and Execution Cradles (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps)
T1555	Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Web Credentials]	Windows Credential Manager Access via VaultCmd	Windows Credential Manager Access via VaultCmd (SecOps)
T1555	Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Windows Credentials]	Windows Credential Manager Access via VaultCmd	Windows Credential Manager Access via VaultCmd (SecOps)
T1555	Dump credentials from Windows Credential Manager With PowerShell [web Credentials]	PowerShell Download and Execution Cradles Usage Of Web Request Commands And Cmdlets PowerShell Web Download	PowerShell Download and Execution Cradles (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps)
T1555	Dump credentials from Windows Credential Manager With PowerShell [windows Credentials]	PowerShell Download and Execution Cradles Usage Of Web Request Commands And Cmdlets PowerShell Web Download	PowerShell Download and Execution Cradles (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps) PowerShell Web Download (SecOps)
T1555.003	WinPwn - PowerSharpPack - Sharpweb for Browser Credentials	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1555.003	Dump Chrome Login Data with esentutl	Copying Sensitive Files with Credential Data	Copying Sensitive Files with Credential Data (SecOps)
T1555.003	Simulating access to Windows Edge Login Data	Potential Browser Data Stealing Suspicious Copy From or To System Directory	Potential Browser Data Stealing (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1555.003	Simulating access to Windows Firefox Login Data	Potential Browser Data Stealing Suspicious Copy From or To System Directory	Potential Browser Data Stealing (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1555.003	Simulating access to Opera Login Data	Potential Browser Data Stealing Suspicious Copy From or To System Directory	Potential Browser Data Stealing (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1555.003	Simulating access to Chrome Login Data	Potential Browser Data Stealing Suspicious Copy From or To System Directory	Potential Browser Data Stealing (SecOps) Suspicious Copy From or To System Directory (SecOps)
T1555.003	LaZagne - Credentials from Browser	HackTool - LaZagne Execution	HackTool - LaZagne Execution (SecOps)
T1555.003	Run Chrome-password Collector	Potential Execution of Sysinternals Tools	Potential Execution of Sysinternals Tools (SecOps)
T1555.004	WinPwn - Loot local Credentials - Invoke-WCMDump	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1555.004	Access Saved Credentials via VaultCmd	Windows Credential Manager Access via VaultCmd	Windows Credential Manager Access via VaultCmd (SecOps)
T1558.003	WinPwn - PowerSharpPack - Kerberoasting Using Rubeus	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1558.004	WinPwn - PowerSharpPack - Kerberoasting Using Rubeus	PowerShell Download and Execution Cradles Suspicious PowerShell Invocations - Specific - ProcessCreation Suspicious PowerShell Download and Execute Pattern Malicious PowerShell Commandlets - ProcessCreation PowerShell Web Download PowerShell Download Pattern Usage Of Web Request Commands And Cmdlets	PowerShell Download and Execution Cradles (SecOps) Suspicious PowerShell Invocations - Specific - ProcessCreation (SecOps) Suspicious PowerShell Download and Execute Pattern (SecOps) Malicious PowerShell Commandlets - ProcessCreation (SecOps) PowerShell Web Download (SecOps) PowerShell Download Pattern (SecOps) Usage Of Web Request Commands And Cmdlets (SecOps)
T1560.001	Compress Data and lock with password for Exfiltration with winzip	Compress Data and Lock With Password for Exfiltration With WINZIP File And SubFolder Enumeration Via Dir Command	Compress Data and Lock With Password for Exfiltration With WINZIP (SecOps) File And SubFolder Enumeration Via Dir Command (SecOps)
T1560.001	Compress Data and lock with password for Exfiltration with winrar	Rar Usage with Password and Compression Level	Rar Usage with Password and Compression Level (SecOps)
T1562	Disable journal logging via systemctl utility	Disable Or Stop Services	Disable Or Stop Services (SecOps)
T1562	Windows Disable LSA Protection	LSA PPL Protection Disabled Via Reg.EXE	LSA PPL Protection Disabled Via Reg.EXE (SecOps)
T1562.001	Disable syslog	Disable Or Stop Services	Disable Or Stop Services (SecOps)
T1562.001	Disable SELinux	Disabling Security Tools	Disabling Security Tools (SecOps)
T1562.001	Disable Windows Defender with DISM	Dism Remove Online Package	Dism Remove Online Package (SecOps)
T1562.001	Kill antimalware protected processes using Backstab	Potential Execution of Sysinternals Tools	Potential Execution of Sysinternals Tools (SecOps)
T1562.001	Uninstall Crowdstrike Falcon on Windows	Uninstall Crowdstrike Falcon Sensor	Uninstall Crowdstrike Falcon Sensor (SecOps)
T1562.001	Remove Windows Defender Definition Files	Windows Defender Definition Files Removed	Windows Defender Definition Files Removed (SecOps)
T1562.001	Tamper with Windows Defender Command Prompt	Service StartupType Change Via Sc.EXE Disable Windows Defender AV Security Monitoring Suspicious Windows Service Tampering	Service StartupType Change Via Sc.EXE (SecOps) Disable Windows Defender AV Security Monitoring (SecOps) Suspicious Windows Service Tampering (SecOps)
T1562.001	Disable Arbitrary Security Windows Service	Service StartupType Change Via Sc.EXE	Service StartupType Change Via Sc.EXE (SecOps)
T1562.001	AMSI Bypass - AMSI InitFailed	Potential AMSI Bypass Via .NET Reflection	Potential AMSI Bypass Via .NET Reflection (SecOps)
T1562.001	Unload Sysmon Filter Driver	Sysmon Driver Unloaded Via Fltmc.EXE Filter Driver Unloaded Via Fltmc.EXE	Sysmon Driver Unloaded Via Fltmc.EXE (SecOps) Filter Driver Unloaded Via Fltmc.EXE (SecOps)