Coverage › CVE-2021-35394

CVE-2021-35394 Mapped Sigma

Realtek Jungle SDK Remote Code Execution Vulnerability

Vendor / product: Realtek — Jungle Software Development Kit (SDK)
Description (CISA): RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
Added to KEV: 2021-12-10
Due date: 2021-12-24
Required action: Apply updates per vendor instructions.
Known ransomware use: Unknown
CWE: CWE-78, CWE-138
CISA notes: https://nvd.nist.gov/vuln/detail/CVE-2021-35394
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

7 mapping objects across 7 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1190 Exploit Public-Facing Application	exploitation technique	The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node. The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service. ref 1 · ref 2	live
T1059 Command and Scripting Interpreter	primary impact	The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node. The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service. ref 1 · ref 2	live
T1071.001 Web Protocols	secondary impact	The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node. The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service. ref 1 · ref 2	live
T1105 Ingress Tool Transfer	secondary impact	The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node. The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service. ref 1 · ref 2	live
T1496 Resource Hijacking	secondary impact	The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node. The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service. ref 1 · ref 2	live
T1499 Endpoint Denial of Service	secondary impact	The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node. The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service. ref 1 · ref 2	live
T1569.002 Service Execution	secondary impact	The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node. The attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service. ref 1 · ref 2	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059 Command and Scripting Interpreter primary impact

DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 Windows
Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: CommandLinePattern ParentProcessName TimeWindow

AN1429 Linux
Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: InterpreterName UserContext ExecutionChainLength

AN1430 macOS
Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

Tunable: LaunchAgentName ScriptName TerminalAppUsage

AN1431 ESXi
Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

esxi:vobd shell session start → DC0064 Command Execution

Tunable: ShellEnabledFlag SSHContext

AN1432 Network Devices
Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

networkdevice:cli shell command → DC0064 Command Execution
networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

Tunable: UserRole DeviceType

Sigma rules tagged `attack.t1059` (95)

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Add New Download Source To Winget mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842

Detects usage of winget to add new additional download sources

Techniques: T1059

Potential Arbitrary Command Execution Via FTP.EXE mediumtest

Author: Victor Sergeev, oscd.community · 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Techniques: T1059 T1202

Use of Pcalua For Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Techniques: T1059

Shai-Hulud Malware Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

Techniques: T1059

Script Interpreter Execution From Suspicious Folder hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba

Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.

Techniques: T1059

DNS Request From Windows Script Host lowtest

Author: Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c

Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.

Techniques: T1059

Windows Shell/Scripting Application File Write to Suspicious Folder hightest

Author: Florian Roth (Nextron Systems) · 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43

Detects Windows shells and scripting applications that write files to suspicious folders

Techniques: T1059

Elevated System Shell Spawned From Uncommon Parent Location mediumtest

Author: frack113, Tim Shelton (update fp) · 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Techniques: T1059

DarkGate - Autoit3.EXE File Creation By Uncommon Process mediumtest

Author: Micah Babinski · 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Techniques: T1105 T1059

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) mediumtest

Author: Andreas Braathen (mnemonic.io) · 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Techniques: T1059 T1190

CVE tags: CVE-2023-22518

Ruby Inline Command Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Techniques: T1059

Payload Decoded and Decrypted via Built-in Utilities mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Techniques: T1059 T1204 T1140

Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Techniques: T1059

Renamed PingCastle Binary Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Techniques: T1059 T1202

All 95 rules on the technique page →

T1071.001 Web Protocols secondary impact

DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
AN0075 Windows
Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.

NSM:Flow http.log, ssl.log → DC0085 Network Traffic Content
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: ProcessNameExclusions UserAgentAnomalies OutboundByteRatioThreshold

AN0076 Linux
Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.

NSM:Flow http.log, conn.log → DC0085 Network Traffic Content
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: CommandLinePatternMatch BeaconIntervalWindow

AN0077 macOS
Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).

macos:osquery socket_events → DC0078 Network Traffic Flow
macos:unifiedlog log stream --predicate → DC0064 Command Execution

Tunable: SuspiciousParentProcess URIEntropyThreshold

AN0078 ESXi
Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.

NSM:Flow SPAN or port-mirrored HTTP/S → DC0085 Network Traffic Content
esxi:shell /root/.ash_history or /etc/init.d/* → DC0032 Process Creation

Tunable: ShellScriptMatch ExternalConnectionFilter

AN0079 Network Devices
Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.

NSM:Flow http.log, ssl.log, websocket.log → DC0085 Network Traffic Content

Tunable: HeaderEncodingPattern TLSFingerprintMismatch

Sigma rules tagged `attack.t1071.001` (42)

DNS Query To Devtunnels Domain mediumtest

Author: citron_ninja · 2023-10-25 (modified 2023-11-20) · logsource: product=windows category=dns_query · 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1071.001 T1572

HTTP Request With Empty User Agent mediumtest

Author: Florian Roth (Nextron Systems) · 2017-07-08 (modified 2021-11-27) · logsource: category=proxy · 21e44d78-95e7-421b-a464-ffd8395659c4

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Techniques: T1071.001

PwnDrp Access criticaltest

Author: Florian Roth (Nextron Systems) · 2020-04-15 (modified 2021-11-27) · logsource: category=proxy · 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Techniques: T1071.001 T1102.001 T1102.003

Renamed Visual Studio Code Tunnel Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-09-28 (modified 2025-10-29) · logsource: product=windows category=process_creation · 2cf29f11-e356-4f61-98c0-1bdb9393d6da

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Techniques: T1071.001 T1219

HackTool - BabyShark Agent Default URL Pattern criticaltest

Author: Florian Roth (Nextron Systems) · 2021-06-09 (modified 2024-02-15) · logsource: category=proxy · 304810ed-8853-437f-9e36-c4975c3dfd7e

Detects Baby Shark C2 Framework default communication patterns

Techniques: T1071.001

Visual Studio Code Tunnel Service Installation mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-10-25 · logsource: product=windows category=process_creation · 30bf1789-379d-4fdc-900f-55cd0a90a801

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Techniques: T1071.001

Curl.EXE Execution With Custom UserAgent mediumtest

Author: frack113 · 2022-01-23 (modified 2023-02-21) · logsource: product=windows category=process_creation · 3286d37a-00fd-41c2-a624-a672dcd34e60

Detects execution of curl.exe with custom useragent options

Techniques: T1071.001

Outbound Network Connection Initiated By Microsoft Dialer hightest

Author: CertainlyP · 2024-04-26 · logsource: product=windows category=network_connection · 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

Techniques: T1071.001

Wannacry Killswitch Domain hightest

Author: Mike Wade · 2020-09-16 (modified 2022-03-24) · logsource: category=dns · 3eaf6218-3bed-4d8a-8707-274096f12a18

Detects wannacry killswitch domain dns queries

Techniques: T1071.001

Raw Paste Service Access hightest

Author: Florian Roth (Nextron Systems) · 2019-12-05 (modified 2023-01-19) · logsource: category=proxy · 5468045b-4fcc-4d1a-973c-c9c9578edacb

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Techniques: T1071.001 T1102.001 T1102.003

APT40 Dropbox Tool User Agent hightest

Author: Thomas Patzke · 2019-11-12 (modified 2023-05-18) · logsource: category=proxy · 5ba715b6-71b7-44fd-8245-f66893e81b3d

Detects suspicious user agent string of APT40 Dropbox tool

Techniques: T1071.001 T1567.002

Malware User Agent hightest

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2017-07-08 (modified 2024-04-14) · logsource: category=proxy · 5c84856b-55a5-45f1-826f-13f37250cf4e

Detects suspicious user agent strings used by malware in proxy logs

Techniques: T1071.001

APT User Agent hightest

Author: Florian Roth (Nextron Systems), Markus Neis · 2019-11-12 (modified 2024-02-15) · logsource: category=proxy · 6ec820f2-e963-4801-9127-d8b2dce4d31b

Detects suspicious user agent strings used in APT malware in proxy logs

Techniques: T1071.001

Suspicious User Agent hightest

Author: Florian Roth (Nextron Systems) · 2017-07-08 (modified 2022-10-31) · logsource: category=proxy · 7195a772-4b3f-43a4-a210-6a003d65caa1

Detects suspicious malformed user agent strings in proxy logs

Techniques: T1071.001

Axios NPM Compromise Malicious C2 Domain DNS Query highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: category=dns · 73e5d24f-493f-4092-bd2f-c72cabda40ee

Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.

Techniques: T1071.001 T1568

All 42 rules on the technique page →

T1105 Ingress Tool Transfer secondary impact

DET0060 Detect Ingress Tool Transfers via Behavioral Chain
AN0165 Windows
Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: ParentProcessName DestinationIPCategory FilePathRegex

AN0166 Linux
Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

auditd:SYSCALL connect, execve, write → DC0064 Command Execution
auditd:SYSCALL file creation/modification → DC0039 File Creation
iptables:LOG TCP connections → DC0078 Network Traffic Flow

Tunable: ToolName DownloadExtension

AN0167 macOS
Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation
macos:unifiedlog file write/create → DC0039 File Creation
macos:unifiedlog connection open → DC0082 Network Connection Creation

Tunable: DirectoryTargeted ProcessPath

AN0168 ESXi
Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

esxi:hostd command execution → DC0064 Command Execution
esxi:vmkernel file write → DC0039 File Creation

Tunable: ToolName DatastorePath

AN0169 Network Devices
Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

NSM:Flow connection metadata → DC0078 Network Traffic Flow
snmp:syslog firmware write/log event → DC0039 File Creation

Tunable: PayloadVolumeThreshold ProtocolUsed

Sigma rules tagged `attack.t1105` (87)

Suspicious Curl File Upload - Linux mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582

Detects a suspicious curl process start the adds a file to a web request

Techniques: T1567 T1105

Potential Data Exfiltration Via Curl.EXE mediumtest

Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update) · 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

Techniques: T1567 T1105

Suspicious Download from Office Domain hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Techniques: T1105 T1608

Potential COM Objects Download Cradles Usage - Process Creation mediumtest

Author: frack113 · 2022-12-25 · logsource: product=windows category=process_creation · 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Techniques: T1105

Insensitive Subfolder Search Via Findstr.EXE lowtest

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Techniques: T1218 T1564.004 T1552.001 T1105

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

Techniques: T1218 T1105

CVE tags: CVE-2025-33053

Local Network Connection Initiated By Script Interpreter mediumtest

Author: frack113 · 2022-08-28 (modified 2024-05-31) · logsource: product=windows category=network_connection · 08249dc0-a28d-4555-8ba5-9255a198e08c

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Techniques: T1105

Axios NPM Compromise Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Techniques: T1195.002 T1059.006 T1059.004 T1105

Uncommon Network Connection Initiated By Certutil.EXE hightest

Author: frack113, Florian Roth (Nextron Systems) · 2022-09-02 (modified 2024-05-31) · logsource: product=windows category=network_connection · 0dba975d-a193-4ed1-a067-424df57570d1

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

Techniques: T1105

File Download with Headless Browser hightest

Author: Sreeman, Florian Roth (Nextron Systems) · 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Techniques: T1105 T1564.003

Potential DLL File Download Via PowerShell Invoke-WebRequest mediumtest

Author: Florian Roth (Nextron Systems), Hieu Tran · 2023-03-13 (modified 2025-07-18) · logsource: product=windows category=process_creation · 0f0450f3-8b47-441e-a31b-15a91dc243e2

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

Techniques: T1059.001 T1105

Potential In-Memory Download And Compile Of Payloads mediumtest

Author: Sohan G (D4rkCiph3r), Red Canary (idea) · 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Techniques: T1059.007 T1105

Suspicious File Downloaded From Direct IP Via Certutil.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Techniques: T1027 T1105

Suspicious Diantz Download and Compress Into a CAB File mediumtest

Author: frack113 · 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · 185d7418-f250-42d0-b72e-0c8b70661e93

Download and compress a remote file and store it in a cab file on local machine.

Techniques: T1105

Download from Suspicious Dyndns Hosts mediumtest

Author: Florian Roth (Nextron Systems) · 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Techniques: T1105 T1568

All 87 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 Windows
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList

AN0220 Linux
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content
auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

Tunable: WebProcList ChildToolList BurstThreshold TimeWindow

AN0221 macOS
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content
macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation
NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

Tunable: ServiceList TimeWindow

AN0222 Containers
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content
docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation
NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

Tunable: IngressNamespaces MetadataEndpoints TimeWindow

AN0223 IaaS
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content
AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

Tunable: LBProjects ErrorBurst

AN0224 ESXi
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content
NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

Tunable: MgmtCIDR TimeWindow

AN0225 Network Devices
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content
NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged `attack.t1190` (149)

Potential CVE-2023-25717 Exploitation Attempt hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Techniques: T1190

CVE tags: CVE-2023-25717

Potential CVE-2021-27905 Exploitation Attempt mediumtest

Author: @gott_cyber · 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Techniques: T1190

CVE tags: CVE-2021-27905

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 criticaltest

Author: Florian Roth (Nextron Systems) · 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Techniques: T1190

CVE tags: CVE-2020-8193CVE-2020-8195

Ruby on Rails Framework Exceptions mediumstable

Author: Thomas Patzke · 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Techniques: T1190

Potential CVE-2023-23752 Exploitation Attempt hightest

Author: Bhabesh Raj · 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Techniques: T1190

CVE tags: CVE-2023-23752

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Terminal Service Process Spawn hightest

Author: Florian Roth (Nextron Systems) · 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Techniques: T1190 T1210

RDS Database Security Group Modification mediumtest

Author: jamesc-grafana · 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015

Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.

Techniques: T1190

Cisco ASA Exploitation Activity - Proxy highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Techniques: T1190

CVE tags: CVE-2025-20333CVE-2025-20362

TerraMaster TOS CVE-2020-28188 hightest

Author: Bhabesh Raj · 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Techniques: T1190

CVE tags: CVE-2020-28188

Potential Server Side Template Injection In Velocity hightest

Author: Moti Harmats · 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Techniques: T1190

CVE-2021-21972 VSphere Exploitation hightest

Author: Bhabesh Raj · 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Techniques: T1190

CVE tags: CVE-2021-21972

Potential OWASSRF Exploitation Attempt - Webserver hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Techniques: T1190

Suspicious User-Agents Related To Recon Tools mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton · 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a

Detects known suspicious (default) user-agents related to scanning/recon tools

Techniques: T1190

Python SQL Exceptions mediumstable

Author: Thomas Patzke · 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9

Generic rule for SQL exceptions in Python according to PEP 249

Techniques: T1190

All 149 rules on the technique page →

T1496 Resource Hijacking secondary impact

DET0267 Resource Hijacking Detection Strategy
AN0741 Windows
Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
Windows:perfmon High sustained CPU usage by a single process → DC0018 Host Status
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TimeWindow DestinationIPList ExecutableNamePatterns

AN0742 Linux
Abnormal CPU/memory usage by unauthorized processes with outbound connections to known mining pools or using cron jobs/scripts to maintain persistence.

auditd:SYSCALL execve → DC0032 Process Creation
linux:procfs Sustained high /proc/[pid]/stat usage → DC0018 Host Status
NSM:Flow Outbound traffic to mining pools or proxies → DC0078 Network Traffic Flow

Tunable: ProcessPath CPUThreshold KnownMiningDomains

AN0743 macOS
Background launch agents/daemons with high CPU use and network access to external mining services.

macos:unifiedlog launchctl activity and process creation → DC0032 Process Creation
macos:unifiedlog Persistent outbound traffic to mining domains → DC0085 Network Traffic Content

Tunable: launchdLabel TrafficVolumeThreshold

AN0744 IaaS
Sudden spikes in cloud VM CPU usage with outbound traffic to mining pools and unauthorized instance creation.

AWS:CloudTrail RunInstances → DC0080 Instance Start
AWS:CloudWatch Sustained EC2 CPU usage above normal baseline → DC0018 Host Status
AWS:VPCFlowLogs Outbound flow logs to known mining pools → DC0078 Network Traffic Flow

Tunable: CPUUtilizationThreshold UnusualRegionList

AN0745 Containers
High CPU usage by unauthorized containers running mining binaries or public proxy tools.

containerd:events New container with suspicious image name or high resource usage → DC0032 Process Creation
prometheus:metrics Container CPU/Memory usage exceeding threshold → DC0018 Host Status
container:cni Outbound network traffic to mining proxies → DC0078 Network Traffic Flow

Tunable: ImageName CPUQuotaThreshold

AN0746 SaaS
Abuse of cloud messaging platforms to send mass spam or consume quota-based resources.

m365:unified SendMessage → DC0069 Cloud Service Modification
saas:application High-volume API calls or traffic via messaging or webhook service → DC0038 Application Log Content

Tunable: MessageRateThreshold APIKeyList

Sigma rules tagged `attack.t1496` (13)

Azure Kubernetes Network Policy Change mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 08d6ac24-c927-4469-b3b7-2e422d6e3c43

Identifies when a Azure Kubernetes network policy is modified or deleted.

Techniques: T1485 T1496 T1489

Azure Kubernetes Service Account Modified or Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2

Identifies when a service account is modified or deleted.

Techniques: T1531 T1485 T1496 T1489

Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 25cb259b-bbdc-4b87-98b7-90d7c72f8743

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Techniques: T1485 T1496 T1489

Potential Crypto Mining Activity highstable

Author: Florian Roth (Nextron Systems) · 2021-10-26 (modified 2023-02-13) · logsource: product=windows category=process_creation · 66c3b204-9f88-4d0a-a7f7-8a57d521ca55

Detects command line parameters or strings often used by crypto miners

Techniques: T1496

Azure Kubernetes Secret or Config Object Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 7ee0b4aa-d8d4-4088-b661-20efdf41a04c

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Techniques: T1485 T1496 T1489

Azure Kubernetes Sensitive Role Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 818fee0c-e0ec-4e45-824e-83e4817b0887

Identifies when ClusterRoles/Roles are being modified or deleted.

Techniques: T1485 T1496 T1489

Linux Crypto Mining Indicators hightest

Author: Florian Roth (Nextron Systems) · 2021-10-26 (modified 2022-12-25) · logsource: product=linux category=process_creation · 9069ea3c-b213-4c52-be13-86506a227ab1

Detects command line parameters or strings often used by crypto miners

Techniques: T1496

Azure Container Registry Created or Deleted lowtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 93e0ef48-37c8-49ed-a02c-038aab23628e

Detects when a Container Registry is created or deleted.

Techniques: T1485 T1496 T1489

Azure Kubernetes Cluster Created or Deleted lowtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 9541f321-7cba-4b43-80fc-fbd1fb922808

Detects when a Azure Kubernetes Cluster is created or deleted.

Techniques: T1485 T1496 T1489

Linux Crypto Mining Pool Connections highstable

Author: Florian Roth (Nextron Systems) · 2021-10-26 · logsource: product=linux category=network_connection · a46c93b7-55ed-4d27-a41b-c259456c4746

Detects process connections to a Monero crypto mining pool

Techniques: T1496

Monero Crypto Coin Mining Pool Lookup highstable

Author: Florian Roth (Nextron Systems) · 2021-10-24 · logsource: category=dns · b593fd50-7335-4682-a36c-4edcb68e4641

Detects suspicious DNS queries to Monero mining pools

Techniques: T1496 T1567

Author: Saw Winn Naung, Azure-Sentinel, @neu5ron · 2021-08-19 (modified 2022-07-07) · logsource: product=zeek service=dns · bf74135c-18e8-4a72-a926-0e4f47888c19

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Techniques: T1569.002 T1496

Network Communication With Crypto Mining Pool highstable

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-10-26 (modified 2026-07-24) · logsource: product=windows category=network_connection · fa5b1358-b040-4403-9868-15f7d9ab6329

Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.

Techniques: T1496

T1499 Endpoint Denial of Service secondary impact

DET0208 Endpoint Resource Saturation and Crash Pattern Detection Across Platforms
AN0584 Windows
Excessive resource exhaustion or service crash induced by processes launched by users or scripts that rapidly consume CPU/memory or attempt malformed service interactions.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Application Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server) → DC0038 Application Log Content
WinEventLog:System System shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations → DC0018 Host Status

Tunable: TimeWindow ServiceTarget CPUThresholdPercent

AN0585 Linux
Malicious script or binary causes repeated kernel panics, OOM kills, or systemd service restarts targeting services like nginx, httpd, sshd.

auditd:SYSCALL execve → DC0032 Process Creation
linux:syslog Out of memory killer invoked or kernel panic entries → DC0018 Host Status
journald:systemd Repeated service restart attempts or unit failures → DC0038 Application Log Content

Tunable: ServiceName RestartThreshold OOMKillCount

AN0586 macOS
Adversary launches high-entropy process or malformed app bundle causing repeated application crashes and system slowdowns.

macos:unifiedlog Repeated process crashes logged by CrashReporter or system instability logs in com.apple.console → DC0038 Application Log Content
macos:unifiedlog Spike in CPU or memory use from non-user-initiated processes → DC0018 Host Status

Tunable: CrashCountThreshold PayloadEntropyThreshold

AN0587 IaaS
Instance enters degraded/unhealthy state due to abnormal process load or memory exhaustion, often caused by automation or script-based attacks.

AWS:CloudWatch StatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3) → DC0018 Host Status
AWS:CloudTrail StartInstances → DC0080 Instance Start
VPCFlowLogs:All High volume internal traffic with low entropy indicating looped or malicious DoS script → DC0078 Network Traffic Flow

Tunable: InstanceType FailureThreshold

AN0588 Containers
Container orchestrator logs show crashlooping pods, repeated resource exhaustion, or malicious binaries with infinite loops consuming systemd/cgroup limits.

kubernetes:events CrashLoopBackOff, OOMKilled, container restart count exceeds threshold → DC0018 Host Status
docker:events Container exited with non-zero code repeatedly in short period → DC0038 Application Log Content

Tunable: RestartCountThreshold ContainerImageEntropy

Sigma rules tagged `attack.t1499` (3)

CVE-2024-49113 Exploitation Attempt - LDAP Nightmare highexperimental

Author: Samuel Monsempes · 2025-01-08 · logsource: product=windows service=application · 3f2c93c7-7b2a-4d58-bb8d-6f39422d8148

Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".

Techniques: T1499

CVE tags: CVE-2024-49113

Potential Abuse of Linux Magic System Request Key mediumexperimental

Author: Milad Cheraghi · 2025-05-23 · logsource: product=linux service=auditd · ea61bb82-a5e0-42e6-8537-91d29500f1b9

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

Techniques: T1059.004 T1529 T1489 T1499

LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089 highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-06-02 · logsource: product=windows service=application · f8a66a02-4a16-46e5-b7fd-a42c8a93d137

Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409). This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability, which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service, leading to a stack-based buffer overflow and subsequent crash of the LSASS process.

Techniques: T1499

CVE tags: CVE-2026-41089

T1569.002 Service Execution secondary impact

DET0421 Detection Strategy for System Services Service Execution
AN1185 Windows
Detection focuses on abnormal service executions initiated via service control manager APIs, sc.exe, net.exe, or PsExec creating temporary services. Defenders observe process creation of services.exe spawning non-standard binaries, registry changes in service keys followed by rapid execution, and network connections originating from processes tied to transient services. Correlation across process lineage, registry activity, and service logs provides strong signals of malicious service execution.

WinEventLog:Security EventCode=4697 → DC0060 Service Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: ServiceBinaryAllowlist ParentProcessCorrelationWindow RemoteExecutionHosts

Sigma rules tagged `attack.t1569.002` (43)

Remote Server Service Abuse for Lateral Movement hightest

Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · 10018e73-06ec-46ec-8107-9172f1e04ff2

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Techniques: T1569.002

Remote Access Tool Services Have Been Installed - System mediumtest

Author: Connor Martin, Nasreddine Bencherchali · 2022-12-23 (modified 2023-06-22) · logsource: product=windows service=system · 1a31b18a-f00c-4061-9900-f735b96c99fc

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Techniques: T1543.003 T1569.002

WFP Filter Added via Registry mediumexperimental

Author: Frack113 · 2025-10-23 · logsource: product=windows category=registry_set · 1f1d8209-636e-4c6c-a137-781cca8b82f9

Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.

Techniques: T1685 T1569.002

PsExec Service File Creation lowtest

Author: Thomas Patzke · 2017-06-12 (modified 2022-10-26) · logsource: product=windows category=file_event · 259e5a6a-b8d2-4c38-86e2-26c5e651361d

Detects default PsExec service filename which indicates PsExec service installation and execution

Techniques: T1569.002

Start Windows Service Via Net.EXE lowtest

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community · 2019-10-21 (modified 2023-03-05) · logsource: product=windows category=process_creation · 2a072a96-a086-49fa-bcb5-15cc5a619093

Detects the usage of the "net.exe" command to start a service using the "start" flag

Techniques: T1569.002

PowerShell Scripts Installed as Services - Security hightest

Author: oscd.community, Natalia Shornikova · 2020-10-06 (modified 2022-11-29) · logsource: product=windows service=security · 2a926e6a-4b81-4011-8a96-e36cc8c04302

Detects powershell script installed as a Service

Techniques: T1569.002

Sliver C2 Default Service Installation hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-08-25 · logsource: product=windows service=system · 31c51af6-e7aa-4da7-84d4-8f32cc580af2

Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

Techniques: T1543.003 T1569.002

PsExec Tool Execution From Suspicious Locations - PipeName mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-08-04 (modified 2023-09-20) · logsource: product=windows category=pipe_created · 41504465-5e3a-4a5b-a5b4-2a0baadd4463

Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack

Techniques: T1569.002

PsExec Service Installation mediumtest

Author: Thomas Patzke · 2017-06-12 (modified 2023-08-04) · logsource: product=windows service=system · 42c575ea-e41e-41f1-b248-8093c3e82a28

Detects PsExec service installation and execution events

Techniques: T1569.002

Credential Dumping Tools Service Execution - System hightest

Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community · 2017-03-05 (modified 2022-11-29) · logsource: product=windows service=system · 4976aa50-8f41-45c6-8b15-ab3fc10e79ed

Detects well-known credential dumping tools execution via service execution events

Techniques: T1003.001 T1003.002 T1003.004 T1003.005 T1003.006 T1569.002

PowerShell as a Service in Registry hightest

Author: oscd.community, Natalia Shornikova · 2020-10-06 (modified 2023-08-17) · logsource: product=windows category=registry_set · 4a5f5a5e-ac01-474b-9b4e-d61298c9df1d

Detects that a powershell code is written to the registry as a service.

Techniques: T1569.002

PUA - NirCmd Execution mediumtest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-01-24 (modified 2023-02-13) · logsource: product=windows category=process_creation · 4e2ed651-1906-4a59-a78a-18220fca1b22

Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity

Techniques: T1569.002

smbexec.py Service Installation hightest

Author: Omer Faruk Celik · 2018-03-20 (modified 2023-11-09) · logsource: product=windows service=system · 52a85084-6989-40c3-8f32-091e12e13f09

Detects the use of smbexec.py tool by detecting a specific service installation

Techniques: T1021.002 T1569.002

CobaltStrike Service Installations - System criticaltest

Author: Florian Roth (Nextron Systems), Wojciech Lesicki · 2021-05-26 (modified 2022-11-27) · logsource: product=windows service=system · 5a105d34-05fc-401e-8553-272b45c1522d

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Techniques: T1021.002 T1543.003 T1569.002

Rundll32 Execution Without Parameters hightest

Author: Bartlomiej Czyz, Relativity · 2021-01-31 (modified 2023-02-28) · logsource: product=windows category=process_creation · 5bb68627-3198-40ca-b458-49f973db8752

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

Techniques: T1021.002 T1570 T1569.002

All 43 rules on the technique page →

CVE-2021-35394 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059 Command and Scripting Interpreter primary impact

Sigma rules tagged attack.t1059 (95)

T1071.001 Web Protocols secondary impact

Sigma rules tagged attack.t1071.001 (42)

T1105 Ingress Tool Transfer secondary impact

Sigma rules tagged attack.t1105 (87)

T1190 Exploit Public-Facing Application exploitation technique

Sigma rules tagged attack.t1190 (149)

T1496 Resource Hijacking secondary impact

Sigma rules tagged attack.t1496 (13)

T1499 Endpoint Denial of Service secondary impact

Sigma rules tagged attack.t1499 (3)

T1569.002 Service Execution secondary impact

Sigma rules tagged attack.t1569.002 (43)

Sigma rules tagged `attack.t1059` (95)

Sigma rules tagged `attack.t1071.001` (42)

Sigma rules tagged `attack.t1105` (87)

Sigma rules tagged `attack.t1190` (149)

Sigma rules tagged `attack.t1496` (13)

Sigma rules tagged `attack.t1499` (3)

Sigma rules tagged `attack.t1569.002` (43)