Coverage › CVE-2020-1472

CVE-2020-1472 Mapped Sigma

Microsoft Netlogon Privilege Escalation Vulnerability

Vendor / product: Microsoft — Netlogon
Description (CISA): Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.
Added to KEV: 2021-11-03
Due date: 2022-05-03
Required action: Apply updates per vendor instructions.
Known ransomware use: Known
CWE: CWE-330
CISA notes: Reference CISA's ED 20-04 (https://www.cisa.gov/news-events/directives/ed-20-04-mitigate-netlogon-elevation-privilege-vulnerability-august-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-04. https://nvd.nist.gov/vuln/detail/CVE-2020-1472
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

8 mapping objects across 6 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1110 Brute Force	exploitation technique	CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts. ref 1 · ref 2	live
T1133 External Remote Services	exploitation technique	CVE-2020-1472, an elevation of privilege vulnerability in Microsoft’s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. ref 1 · ref 2 · ref 3 · ref 4 · ref 5	live
T1021 Remote Services	primary impact	CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts. ref 1 · ref 2	live
T1068 Exploitation for Privilege Escalation	primary impact	CVE-2020-1472, an elevation of privilege vulnerability in Microsoft’s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. ref 1 · ref 2 · ref 3 · ref 4	live
T1087.002 Domain Account	secondary impact	CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts. ref 1 · ref 2	live
T1087.002 Domain Account	primary impact	CVE-2020-1472, an elevation of privilege vulnerability in Microsoft’s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. ref 1 · ref 2 · ref 3 · ref 4	live
T1133 External Remote Services	secondary impact	CVE-2020-1472 is a privilege escalation vulnerability in Windows Netlogon. After gaining initial access, the actors exploit CVE-2020-1472 to compromise all Active Directory (AD) identity services. Actors have then been observed using legitimate remote access tools, such as VPN and Remote Desktop Protocol (RDP), to access the environment with the compromised credentials. ref 1	live
T1486 Data Encrypted for Impact	secondary impact	CVE-2020-1472, an elevation of privilege vulnerability in Microsoft’s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. CVE-2020-1472 has been reported to be exploited by Ransomware groups for initial access. ref 1 · ref 2 · ref 3 · ref 4	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1021 Remote Services primary impact

DET0269 Behavioral Detection Strategy for Remote Service Logins and Post-Access Activity
AN0750 Windows
Logon via RDP or WMI by a user account followed by uncommon command execution, file manipulation, or lateral network connections.

WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TimeWindow LogonUser RemoteHostList

AN0751 Linux
SSH session from new source IP followed by interactive shell or privilege escalation (e.g., sudo, su) and outbound lateral connection.

linux:syslog sshd: Accepted password/publickey → DC0067 Logon Session Creation
auditd:SYSCALL execve, USER_CMD → DC0064 Command Execution

Tunable: SourceIP CommandList

AN0752 macOS
Remote login via ARD or SSH followed by screensharingd process activity or modification of TCC-protected files.

macos:unifiedlog eventMessage CONTAINS 'screensharingd' or 'AuthorizationRefCreate' → DC0067 Logon Session Creation
macos:osquery process_events → DC0032 Process Creation

Tunable: RemoteService TargetedPath

AN0753 IaaS
Use of cloud-based bastion or VM console session followed by commands that initiate outbound SSH or RDP sessions from the cloud instance to other environments.

AWS:CloudTrail AWS ConsoleLogin, StartSession → DC0067 Logon Session Creation
AWS:VPCFlowLogs Outbound connections to port 22, 3389 → DC0082 Network Connection Creation

Tunable: SourceAssetTag TargetPortList

AN0754 ESXi
vSphere API logins (vimService) or SSH to ESXi host followed by unauthorized shell commands or lateral remote logins from the ESXi host.

esxi:vmkernel vim.fault.*, DCUI login, SSH shell → DC0067 Logon Session Creation
esxi:shell Command execution trace → DC0064 Command Execution

Tunable: SessionType CommandPattern

Sigma rules tagged `attack.t1021` (11)

OpenCanary - SMB File Open Request hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52

Detects instances where an SMB service on an OpenCanary node has had a file open request.

Techniques: T1021 T1005

OpenCanary - FTP Login Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 6991bc2b-ae2e-447f-bc55-3a1ba04c14e5

Detects instances where an FTP service on an OpenCanary node has had a login attempt.

Techniques: T1190 T1021

Psexec Execution mediumtest

Author: omkar72 · 2020-10-30 (modified 2023-02-28) · logsource: product=windows category=process_creation · 730fc21b-eaff-474b-ad23-90fd265d4988

Detects user accept agreement execution in psexec commandline

Techniques: T1569 T1021

HackTool - NetExec Execution highexperimental

Author: Chirag Damani · 2026-03-29 · logsource: product=windows category=process_creation · 7638e5fe-600c-4289-a968-f49dd537ec7d

Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.

Techniques: T1018 T1021

Potential Remote Desktop Tunneling mediumtest

Author: Tim Rauch, Elastic (idea) · 2022-09-27 · logsource: product=windows category=process_creation · 8a3038e8-9c9d-46f8-b184-66234a160f6f

Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.

Techniques: T1021

Privilege Escalation via Named Pipe Impersonation hightest

Author: Tim Rauch, Elastic (idea) · 2022-09-27 (modified 2022-12-30) · logsource: product=windows category=process_creation · 9bd04a79-dabe-4f1f-a5ff-92430265c96b

Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

Techniques: T1021

OpenCanary - VNC Connection Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 9db5446c-b44a-4291-8b89-fcab5609c3b3

Detects instances where a VNC service on an OpenCanary node has had a connection attempt.

Techniques: T1021

OpenCanary - SSH New Connection Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

Techniques: T1133 T1021 T1078

OpenCanary - SNMP OID Request hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · e9856028-fd4e-46e6-b3d1-10f7ceb95078

Detects instances where an SNMP service on an OpenCanary node has had an OID request.

Techniques: T1016 T1021

New RDP Connection Initiated From Domain Controller hightest

Author: Josh Nickels · 2024-05-10 · logsource: product=windows category=network_connection · fda34293-718e-4b36-b018-38caab0d1209

Detects an RDP connection originating from a domain controller.

Techniques: T1021

OpenCanary - SSH Login Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · ff7139bc-fdb1-4437-92f2-6afefe8884cb

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

Techniques: T1133 T1021 T1078

T1068 Exploitation for Privilege Escalation primary impact

DET0514 Detection Strategy for Exploitation for Privilege Escalation
AN1419 Windows
Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

Tunable: DriverNamePattern TimeWindow ParentProcessPath

AN1420 Linux
Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:SYSCALL ACCESS → DC0035 Process Access
auditd:SYSCALL dmesg → DC0016 Module Load

Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold

AN1421 macOS
Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

macos:unifiedlog process:exec and kext load events → DC0032 Process Creation
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

Tunable: EntitlementList TimeWindow

AN1422 Containers
Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

auditd:SYSCALL capset or setns → DC0067 Logon Session Creation
containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged `attack.t1068` (31)

Exploiting CVE-2019-1388 criticalstable

Author: Florian Roth (Nextron Systems) · 2019-11-20 (modified 2024-12-01) · logsource: product=windows category=process_creation · 02e0b2ea-a597-428e-b04a-af6a1a403e5c

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Techniques: T1068

CVE tags: CVE-2019-1388

Malicious Driver Load hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-08-18 (modified 2023-12-02) · logsource: product=windows category=driver_load · 05296024-fe8a-4baf-8f3d-9a5f5624ceb2

Detects loading of known malicious drivers via their hash.

Techniques: T1543.003 T1068

Possible Coin Miner CPU Priority Param criticaltest

Author: Florian Roth (Nextron Systems) · 2021-10-09 (modified 2022-12-25) · logsource: product=linux service=auditd · 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed

Detects command line parameter very often used with coin miners

Techniques: T1068

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation highexperimental

Author: Swachchhanda Shrawn Poudel (Nextron Systems) · 2025-10-02 (modified 2026-03-31) · logsource: product=linux category=file_event · 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d

Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.

Techniques: T1068

CVE tags: CVE-2025-32463

Potential CVE-2024-35250 Exploitation Activity mediumexperimental

Author: @eyezuhk Isaac Fernandes · 2025-02-19 · logsource: product=windows category=image_load · 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1

Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.

Techniques: T1068

CVE tags: CVE-2024-35250

Buffer Overflow Attempts hightest

Author: Florian Roth (Nextron Systems) · 2017-03-01 (modified 2025-03-17) · logsource: product=linux · 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781

Detects buffer overflow attempts in Unix system log files

Techniques: T1068

Exploiting SetupComplete.cmd CVE-2019-1378 hightest

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Techniques: T1068 T1059.003 T1574

CVE tags: CVE-2019-1378

OMIGOD SCX RunAsProvider ExecuteShellCommand hightest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Techniques: T1068 T1190 T1203

HKTL - SharpSuccessor Privilege Escalation Tool Execution highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-06 · logsource: product=windows category=process_creation · 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments. Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.

Techniques: T1068

Malicious Driver Load By Name mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-03 (modified 2023-12-02) · logsource: product=windows category=driver_load · 39b64854-5497-4b57-a448-40977b8c9679

Detects loading of known malicious drivers via the file name of the drivers.

Techniques: T1543.003 T1068

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event criticaltest

Author: Florian Roth (Nextron Systems) · 2021-11-22 (modified 2022-12-25) · logsource: product=windows category=file_event · 3be82d5d-09fe-4d6a-a275-0d40d234d324

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Techniques: T1068

Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator highexperimental

Author: Gene Kazimiarovich · 2026-04-30 · logsource: product=linux service=auditd · 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94

Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall. AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431 to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD splice path that corrupts the page cache of SUID binaries. Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN daemons using non-default kernel offload configurations.

Techniques: T1068

CVE tags: CVE-2026-31431

Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator highexperimental

Author: Gene Kazimiarovich · 2026-05-09 · logsource: product=linux category=process_creation · 474b415a-d917-4f3b-8c62-9e1a0d5f7b48

Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher (e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation, where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path, corrupting the page cache of SUID binaries for local privilege escalation. On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod) with 'modprobe' appearing in the command line.

Techniques: T1068 T1547.006

CVE tags: CVE-2026-31431

Audit CVE Event criticaltest

Author: Florian Roth (Nextron Systems), Zach Mathis · 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Techniques: T1203 T1068 T1211 T1212 T1210 T1499.004

All 31 rules on the technique page →

T1087.002 Domain Account primary impact, secondary impact

DET0129 Domain Account Enumeration Across Platforms
AN0363 Windows
Adversary enumeration of domain accounts using net.exe, PowerShell, WMI, or LDAP queries from non-domain controllers or non-admin endpoints.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution
NSM:Flow LDAP Bind/Search → DC0085 Network Traffic Content

Tunable: CommandLinePattern TimeWindow SourceHost

AN0364 Linux
Domain account enumeration using ldapsearch, samba tools (e.g., 'wbinfo -u'), or winbindd lookups.

auditd:SYSCALL execve → DC0032 Process Creation
linuxsyslog nslcd or winbind logs → DC0064 Command Execution
NSM:Flow LDAP Query → DC0085 Network Traffic Content

Tunable: ProcessName LDAPSearchFilter UserContext

AN0365 macOS
Domain group and user enumeration via dscl or dscacheutil, or queries to directory services from non-admin endpoints.

macos:unifiedlog Process Execution → DC0032 Process Creation
macos:unifiedlog DS daemon log entries → DC0064 Command Execution

Tunable: CommandPattern EndpointRole

Sigma rules tagged `attack.t1087.002` (21)

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

BloodHound Collection Files hightest

Author: C.J. May · 2022-08-09 (modified 2026-02-19) · logsource: product=windows category=file_event · 02773bed-83bf-469f-b7ff-e676e7d78bab

Detects default file names outputted by the BloodHound collection tool SharpHound

Techniques: T1087.001 T1087.002 T1482 T1069.001 T1069.002 T1059.001

ADExplorer Writing Complete AD Snapshot Into .dat File mediumexperimental

Author: Arnim Rupp (Nextron Systems), Thomas Patzke · 2025-07-09 · logsource: product=windows category=file_event · 0a1255c5-d732-4b62-ac02-b5152d34fb83

Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

Net.EXE Execution lowtest

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · 2019-01-16 (modified 2022-07-11) · logsource: product=windows category=process_creation · 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac

Detects execution of "Net.EXE".

Techniques: T1007 T1049 T1018 T1135 T1201 T1069.001 T1069.002 T1087.001 T1087.002 T1021.002

Potential Active Directory Reconnaissance/Enumeration Via LDAP mediumtest

Author: Adeem Mawani · 2021-06-22 (modified 2025-07-04) · logsource: product=windows service=ldap · 31d68132-4038-47c7-8f8e-635a39a7c174

Detects potential Active Directory enumeration via LDAP

Techniques: T1069.002 T1087.002 T1482

AD Privileged Users or Groups Reconnaissance hightest

Author: Samir Bousseaden · 2019-04-03 (modified 2022-07-13) · logsource: product=windows service=security · 35ba1d85-724d-42a3-889f-2e2362bcaf23

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

Techniques: T1087.002

Active Directory Computers Enumeration With Get-AdComputer lowtest

Author: frack113 · 2022-03-17 (modified 2023-07-08) · logsource: product=windows category=ps_script · 36bed6b2-e9a0-4fff-beeb-413a92b86138

Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

Techniques: T1018 T1087.002

PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE hightest

Author: frack113 · 2021-12-13 (modified 2023-03-05) · logsource: product=windows category=process_creation · 455b9d50-15a1-4b99-853f-8d37655a4c1b

Detects active directory enumeration activity using known AdFind CLI flags

Techniques: T1087.002

PUA - AdFind.EXE Execution mediumexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-02-26 · logsource: product=windows category=process_creation · 514e7e3e-b3b4-4a67-af60-be20f139198b

Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment

Techniques: T1087.002

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer · 2017-03-05 (modified 2025-12-10) · logsource: product=windows category=ps_script · 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Active Directory Database Snapshot Via ADExplorer mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-03-14 (modified 2025-07-09) · logsource: product=windows category=process_creation · 9212f354-7775-4e28-9c9f-8f0a4544e664

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

Reconnaissance Activity hightest

Author: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community · 2017-03-07 (modified 2022-08-22) · logsource: product=windows service=security · 968eef52-9cff-4454-8992-1e74b9cbad6c

Detects activity as "net user administrator /domain" and "net group domain admins /domain"

Techniques: T1087.002 T1069.002

PUA - AdFind Suspicious Execution hightest

Author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community · 2021-02-02 (modified 2025-10-24) · logsource: product=windows category=process_creation · 9a132afa-654e-11eb-ae93-0242ac130002

Detects AdFind execution with common flags seen used during attacks

Techniques: T1018 T1087.002 T1482 T1069.002

Suspicious Use of PsLogList mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2021-12-18 (modified 2026-06-29) · logsource: product=windows category=process_creation · aae1243f-d8af-40d8-ab20-33fc6d0c55bc

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Techniques: T1087 T1087.001 T1087.002

All 21 rules on the technique page →

T1110 Brute Force exploitation technique

DET0463 Brute Force Authentication Failures with Multi-Platform Log Correlation
AN1275 Windows
High volume of failed logon attempts followed by a successful one from a suspicious user, host, or timeframe

WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

Tunable: TimeWindow UserContext FailureThreshold

AN1276 Linux
Multiple authentication failures for valid or invalid users followed by success from same IP/user

auditd:USER_LOGIN USER_AUTH → DC0002 User Account Authentication

Tunable: TimeWindow IPWhitelist LoginSource

AN1277 Identity Provider
Password spraying or brute force attempts across user pool within short time intervals

azure:signinlogs Sign-in logs → DC0002 User Account Authentication

Tunable: UsernameSprayThreshold GeoAnomaly

AN1278 macOS
Multiple failed authentications in unified logs (e.g., loginwindow or sshd)

macos:unifiedlog auth → DC0002 User Account Authentication

Tunable: TimeWindow TargetUser

AN1279 SaaS
Excessive login attempts followed by success from SaaS apps like O365, Dropbox, etc.

m365:unified Sign-in logs → DC0002 User Account Authentication

Tunable: AppName UserGroup

Sigma rules tagged `attack.t1110` (25)

MSSQL Server Failed Logon lowtest

Author: Nasreddine Bencherchali (Nextron Systems), j4son · 2023-10-11 (modified 2024-06-26) · logsource: product=windows service=application · 218d2855-2bba-4f61-9c85-81d0ea63ac71

Detects failed logon attempts from clients to MSSQL server.

Techniques: T1110

External Remote RDP Logon from Public IP mediumtest

Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) · 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Techniques: T1133 T1078 T1110

Failed Authentications From Countries You Do Not Operate Out Of lowtest

Author: MikeDuddington, '@dudders1' · 2022-07-28 · logsource: product=azure service=signinlogs · 28870ae4-6a13-4616-bd1a-235a7fad7458

Detect failed authentications from countries you do not operate out of.

Techniques: T1078.004 T1110

Password Spray Activity hightest

Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' · 2023-09-03 · logsource: product=azure service=riskdetection · 28ecba0a-c743-4690-ad29-9a8f6f25a6f9

Indicates that a password spray attack has been successfully performed.

Techniques: T1110

Account Lockout mediumtest

Author: AlertIQ · 2021-10-10 (modified 2022-12-25) · logsource: product=azure service=signinlogs · 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a

Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

Techniques: T1110

HackTool - CrackMapExec Execution hightest

Author: Florian Roth (Nextron Systems) · 2022-02-25 (modified 2023-03-08) · logsource: product=windows category=process_creation · 42a993dd-bb3e-48c8-b372-4d6684c4106c

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Techniques: T1047 T1053 T1059.003 T1059.001 T1110 T1201

Cisco LDP Authentication Failures lowtest

Author: Tim Brown · 2023-01-09 · logsource: product=cisco service=ldp · 50e606bf-04ce-4ca7-9d54-3449494bbd4b

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Techniques: T1078 T1110 T1557

Potential MFA Bypass Using Legacy Client Authentication hightest

Author: Harjot Singh, '@cyb3rjy0t' · 2023-03-20 · logsource: product=azure service=signinlogs · 53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Techniques: T1078.004 T1110

Multifactor Authentication Interrupted mediumtest

Author: AlertIQ · 2021-10-10 (modified 2022-12-18) · logsource: product=azure service=signinlogs · 5496ff55-42ec-4369-81cb-00f417029e25

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Techniques: T1078.004 T1110 T1621

Cisco BGP Authentication Failures lowtest

Author: Tim Brown · 2023-01-09 (modified 2023-01-23) · logsource: product=cisco service=bgp · 56fa3cd6-f8d6-4520-a8c7-607292971886

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Techniques: T1078 T1110 T1557

Use of Legacy Authentication Protocols hightest

Author: Yochana Henderson, '@Yochana-H' · 2022-06-17 · logsource: product=azure service=signinlogs · 60f6535a-760f-42a9-be3f-c9a0a025906e

Alert on when legacy authentication has been used on an account

Techniques: T1078.004 T1110

AWS ConsoleLogin Failed Authentication mediumexperimental

Author: Ivan Saakov, Nasreddine Bencherchali · 2025-10-19 · logsource: product=aws service=cloudtrail · 6393e346-1977-46ef-8987-ad414a145fad

Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.

Techniques: T1110

Bitbucket User Login Failure mediumtest

Author: Muhammad Faisal (@faisalusuf) · 2024-02-25 · logsource: product=bitbucket service=audit · 70ed1d26-0050-4b38-a599-92c53d57d45a

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

Techniques: T1078.004 T1110

External Remote SMB Logon from Public IP hightest

Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) · 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 78d5cab4-557e-454f-9fb9-a222bd0d5edc

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Techniques: T1133 T1078 T1110

Successful Authentications From Countries You Do Not Operate Out Of mediumtest

Author: MikeDuddington, '@dudders1' · 2022-07-28 (modified 2026-05-08) · logsource: product=azure service=signinlogs · 8c944ecb-6970-4541-8496-be554b8e2846

Detect successful authentications from countries you do not operate out of.

Techniques: T1078.004 T1110

All 25 rules on the technique page →

T1133 External Remote Services exploitation technique, secondary impact

DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
AN1004 Windows
Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.

WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication
WinEventLog:Application VPN, Citrix, or remote access gateway logs showing external IP addresses → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: BusinessHours KnownRemoteIPs FailedLogonThreshold GeoIPWhitelist TimeWindow

AN1005 Linux
Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).

auditd:SYSCALL ssh logins or execve of remote commands → DC0088 Logon Session Metadata
NSM:Connections Failed password or accepted password for SSH users → DC0038 Application Log Content
NSM:Flow connection: Inbound connections to SSH or VPN ports → DC0082 Network Connection Creation

Tunable: KnownSSHClients FailedLogonThreshold TimeWindow

AN1006 macOS
Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.

macos:unifiedlog Remote login (ssh) or screen sharing authentication attempts → DC0088 Logon Session Metadata
macos:unifiedlog Inbound connections to VNC/SSH ports → DC0082 Network Connection Creation
PF:Logs External traffic to remote access services → DC0078 Network Traffic Flow

Tunable: KnownVNCServers TimeWindow

AN1007 Containers
Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.

ApplicationLog:API Docker/Kubernetes API access from external sources → DC0038 Application Log Content
kubernetes:audit Unauthorized container creation or kubelet exec logs → DC0088 Logon Session Metadata
NSM:Flow External access to container ports (2375, 6443) → DC0082 Network Connection Creation

Tunable: AllowedCIDRs TimeWindow

Sigma rules tagged `attack.t1133` (20)

Remote Access Tool - Team Viewer Session Started On Linux Host lowtest

Author: Josh Nickels, Qi Nan · 2024-03-11 · logsource: product=linux category=process_creation · 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Techniques: T1133

External Remote RDP Logon from Public IP mediumtest

Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) · 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Techniques: T1133 T1078 T1110

FortiGate - New VPN SSL Web Portal Added mediumexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2025-11-01 · logsource: product=fortigate service=event · 2bfb6216-0c31-4d20-8501-2629b29a3fa2

Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.

Techniques: T1133

OpenCanary - Telnet Login Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Techniques: T1133 T1078

OpenCanary - RDP New Connection Attempt highexperimental

Author: Marco Pedrinazzi (@pedrinazziM) · 2026-01-06 · logsource: product=opencanary category=application · 598290cf-5932-45cd-9123-be1e05ab4f2e

Detects instances where an RDP service on an OpenCanary node has had a connection attempt.

Techniques: T1133 T1021.001

Potential Exploitation of GoAnywhere MFT Vulnerability highexperimental

Author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-10-07 · logsource: product=windows category=process_creation · 6c76b3d0-afe4-4870-9443-ffe6773c5fef

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

Techniques: T1190 T1059.001 T1133

CVE tags: CVE-2025-10035

Remote Access Tool - ScreenConnect Installation Execution mediumtest

Author: Florian Roth (Nextron Systems) · 2021-02-11 (modified 2024-02-26) · logsource: product=windows category=process_creation · 75bfe6e6-cd8e-429e-91d3-03921e1d7962

Detects ScreenConnect program starts that establish a remote access to a system.

Techniques: T1133

External Remote SMB Logon from Public IP hightest

Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) · 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 78d5cab4-557e-454f-9fb9-a222bd0d5edc

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Techniques: T1133 T1078 T1110

FortiGate - VPN SSL Settings Modified mediumexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2025-11-01 · logsource: product=fortigate service=event · 8b5dacf2-aeb7-459d-b133-678eb696d410

Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.

Techniques: T1133

Unusual File Deletion by Dns.exe hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-27 (modified 2023-02-15) · logsource: product=windows category=file_delete · 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0

Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Unusual File Modification by dns.exe hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-27 · logsource: product=windows category=file_change · 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3

Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Unusual Child Process of dns.exe hightest

Author: Tim Rauch, Elastic (idea) · 2022-09-27 (modified 2023-02-05) · logsource: product=windows category=process_creation · a4e3d776-f12e-42c2-8510-9e6ed1f43ec3

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Remote Access Tool - Team Viewer Session Started On Windows Host lowtest

Author: Josh Nickels, Qi Nan · 2024-03-11 · logsource: product=windows category=process_creation · ab70c354-d9ac-4e11-bbb6-ec8e3b153357

Techniques: T1133

Running Chrome VPN Extensions via the Registry 2 VPN Extension hightest

Author: frack113 · 2021-12-28 (modified 2023-08-17) · logsource: product=windows category=registry_set · b64a026b-8deb-4c1d-92fd-98893209dff1

Running Chrome VPN Extensions via the Registry install 2 vpn extension

Techniques: T1133

OpenCanary - SSH New Connection Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

Techniques: T1133 T1021 T1078

All 20 rules on the technique page →

T1486 Data Encrypted for Impact secondary impact

DET0215 Detection of Multi-Platform File Encryption for Impact
AN0602 Windows
High-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=2 → DC0061 File Modification

Tunable: FileExtension TargetFolder TimeWindow CommandLine

AN0603 Linux
Encryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.

auditd:SYSCALL openat, write, rename, unlink → DC0061 File Modification
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: FilenamePattern SyscallBurstRate DirectoryTargeted

AN0604 macOS
Userland or kernel-level ransomware encrypting user files (Documents, Desktop) using srm, gpg, or compiled payloads. Often correlated with ransom note creation in multiple directories.

macos:unifiedlog file encrypted|new file with .encrypted extension|disk write burst → DC0061 File Modification
macos:unifiedlog exec srm|exec openssl|exec gpg → DC0032 Process Creation

Tunable: ExtensionPattern VolumeTargeted

AN0605 ESXi
Ransomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run through dcui, SSH, or vSphere.

esxi:vmkernel rename .vmdk to .*.locked|datastore write spike → DC0061 File Modification
esxi:shell openssl|tar|dd → DC0064 Command Execution

Tunable: FileType UserContext

AN0606 IaaS
Encryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.

AWS:CloudTrail PutObject (with SSE-C), UploadPart (SSE-C) → DC0023 Cloud Storage Modification

Tunable: SSEHeader AffectedBucket UserAgent

Sigma rules tagged `attack.t1486` (16)

Suspicious Reg Add BitLocker hightest

Author: frack113 · 2021-11-15 (modified 2022-09-09) · logsource: product=windows category=process_creation · 0e0255bf-2548-47b8-9582-c0955c9283f5

Detects suspicious addition to BitLocker related registry keys via the reg.exe utility

Techniques: T1486

AWS KMS Imported Key Material Usage highexperimental

Author: toopricey · 2025-10-18 · logsource: product=aws service=cloudtrail · 1279262f-1464-422f-ac0d-5b545320c526

Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.

Techniques: T1486 T1608.003

AWS EC2 Disable EBS Encryption mediumstable

Author: Sittikorn S · 2021-06-29 (modified 2021-08-20) · logsource: product=aws service=cloudtrail · 16124c2d-e40b-4fcc-8f2c-5ab7870a2223

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

Techniques: T1486 T1565

FunkLocker Ransomware File Creation highexperimental

Author: Saiprashanth Pulisetti ( @Prashanthblogs) · 2025-08-08 · logsource: product=windows category=file_event · 2c76a22b-702d-48fd-8fa9-e41e2fe203b3

Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.

Techniques: T1486

Load Of RstrtMgr.DLL By An Uncommon Process lowtest

Author: Luc Génaux · 2023-11-28 (modified 2026-07-28) · logsource: product=windows category=image_load · 3669afd2-9891-4534-a626-e5cf03810a61

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Techniques: T1486 T1685

WannaCry Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro · 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079

Detects WannaCry ransomware activity

Techniques: T1210 T1083 T1222.001 T1486 T1490

Antivirus - Ransomware Signature criticaltest

Author: Florian Roth (Nextron Systems), Arnim Rupp · 2022-05-12 (modified 2026-06-15) · logsource: category=antivirus · 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f

Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1486

Potential Conti Ransomware Activity criticaltest

Author: frack113 · 2021-10-12 (modified 2023-02-13) · logsource: product=windows category=process_creation · 689308fc-cfba-4f72-9897-796c1dc61487

Detects a specific command used by the Conti ransomware group

Techniques: T1486

LockerGoga Ransomware Activity criticalstable

Author: Vasiliy Burov, oscd.community · 2020-10-18 (modified 2023-02-03) · logsource: product=windows category=process_creation · 74db3488-fd28-480a-95aa-b7af626de068

Detects LockerGoga ransomware activity via specific command line.

Techniques: T1486

Portable Gpg.EXE Execution mediumtest

Author: frack113, Nasreddine Bencherchali (Nextron Systems) · 2023-08-06 (modified 2023-11-10) · logsource: product=windows category=process_creation · 77df53a5-1d78-4f32-bc5a-0e7465bd8f41

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Techniques: T1486

Load Of RstrtMgr.DLL By A Suspicious Process hightest

Author: Luc Génaux · 2023-11-28 · logsource: product=windows category=image_load · b48492dc-c5ef-4572-8dff-32bc241c15c8

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Techniques: T1486 T1685

Microsoft 365 - Potential Ransomware Activity mediumtest

Author: austinsonger · 2021-08-19 (modified 2022-10-09) · logsource: product=m365 service=threat_management · bd132164-884a-48f1-aa2d-c6d646b04c69

Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

Techniques: T1486

Suspicious Creation TXT File in User Desktop mediumtest

Author: frack113 · 2021-12-26 (modified 2026-01-09) · logsource: product=windows category=file_event · caf02a0a-1e1c-4552-9b48-5e070bd88d11

Detects creation of .txt files in user desktop folders via cmd.exe. This behavior may indicate ransomware deploying ransom notes, but can also occur during legitimate administrative tasks. Analysts should investigate for suspicious filenames (e.g., "RANSOM", "DECRYPT", "READ_ME"), bulk file creation patterns, or concurrent encryption activity to determine if this is part of a ransomware attack.

Techniques: T1486

Suspicious Appended Extension mediumtest

Author: frack113 · 2022-07-16 (modified 2023-11-11) · logsource: product=windows category=file_rename · e3f673b3-65d1-4d80-9146-466f8b63fa99

Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.

Techniques: T1486

Renamed Gpg.EXE Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2023-08-09 · logsource: product=windows category=process_creation · ec0722a3-eb5c-4a56-8ab2-bf6f20708592

Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.

Techniques: T1486

All 16 rules on the technique page →

Sigma rules tagged with this CVE directly

2 rules carry cve.2020-1472.

Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC hightest

Author: @Kostastsale, TheDFIRReport · 2022-02-12 · logsource: product=windows category=process_creation · dcc6a01e-9471-44a0-a699-71ea96f8ed8b

Detects the execution of the commonly used ZeroLogon PoC executable.

Techniques: T1210

CVE tags: CVE-2020-1472

Potential Zerologon (CVE-2020-1472) Exploitation hightest

Author: Aleksandr Akhremchik, @aleqs4ndr, ocsd.community · 2020-10-15 (modified 2023-12-15) · logsource: product=windows service=security · dd7876d8-0f09-11eb-adc1-0242ac120002

Detects potential Netlogon Elevation of Privilege Vulnerability aka Zerologon (CVE-2020-1472)

Techniques: T1068

CVE tags: CVE-2020-1472

CVE-2020-1472 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1021 Remote Services primary impact

Sigma rules tagged attack.t1021 (11)

T1068 Exploitation for Privilege Escalation primary impact

Sigma rules tagged attack.t1068 (31)

T1087.002 Domain Account primary impact, secondary impact

Sigma rules tagged attack.t1087.002 (21)

T1110 Brute Force exploitation technique

Sigma rules tagged attack.t1110 (25)

T1133 External Remote Services exploitation technique, secondary impact

Sigma rules tagged attack.t1133 (20)

T1486 Data Encrypted for Impact secondary impact

Sigma rules tagged attack.t1486 (16)

Sigma rules tagged with this CVE directly

Sigma rules tagged `attack.t1021` (11)

Sigma rules tagged `attack.t1068` (31)

Sigma rules tagged `attack.t1087.002` (21)

Sigma rules tagged `attack.t1110` (25)

Sigma rules tagged `attack.t1133` (20)

Sigma rules tagged `attack.t1486` (16)