Process CreationSuspicious Execution Location Of Wermgr.EXEPotential CVE-2023-36874 Exploitation – Fake Wermgr ExecutionNetwork Reconnaissance ActivityNode Process ExecutionsNslookup PowerShell Download Cradle – Process CreationSuspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)Harvesting Of Wifi Credentials Via Netsh.EXENew Port Forwarding Rule Added Via Netsh.EXXNew

Account ManagementOutgoing Logon with New CredentialsRottenPotato Like Attack PatternScanner PoC for CVE-2019-0708 RDP RCE Vuln File EventWebDAV Temporary Local File CreationSCR File Write Event Image LoadMicrosoft Office DLL Sideload Kernel-GeneralQuarksPwDump Clearing Access History Network Share ObjectRemote Task Creation via ATSVC

Process CreationMMC20 Lateral Movement Process CreationMMC Spawning Windows Shell Process CreationPotential Arbitrary Command Execution Using Msdt.EXE Process CreationSuspicious MSDT Parent Process Process CreationRemotely Hosted HTA File Executed Via Mshta.EXE Process CreationSuspicious JavaScript Execution Via Mshta.EXE Process CreationPotential LethalHTA Technique Execution

Account ManagementExternal Remote RDP Logon from Public IPKrbRelayUp Attack Pattern File EventSuspicious Get-Variable.exe CreationFile Creation In Suspicious Directory By Msdt.EXENTDS Exfiltration Filename Patterns Groups MonitoringA Member was Added into a VIP GroupA Member was Removed From Monitoring Group Image LoadPotential

Acount Management   1. Admin User Remote Logon    2. External Remote SMB Logon from Public IP AWS   3. AWS:Glue Development Endpoint Activity Big IP@F5   4. User Connected from two different countries – F5 Big IP CodeIntegrity   5. CodeIntegrity – Blocked Image

SentinelOne EDR    1. User Deleted 2. User Logged In to Management Console Process Creation    3. Use of Remote.exe 4. Use of Pcalua For Execution 5. Process Memory Dump Via Dotnet-Dump 6. Detect Virtualbox Driver Installation OR Starting Of

NTFS:   1. Volume Shadow Copy Mount PowerShell Script   2. Code Executed Via Office Add-in XLL File   3. Potential Invoke-Mimikatz PowerShell Script   4. Tamper Windows Defender Remove-MpPreference – ScriptBlockLogging   5. Abuse of Service Permissions to Hide Services Via Set-Service – PS

MSMQ:    1. MSMQ Corrupted Packet Encountered Network Share Object:    2. Protected Storage Service Access   3. Possible Impacket SecretDump Remote Activity Process Access:    4. Suspicious LSASS Access Via MalSecLogon   5. Mimikatz through Windows Remote Management Registry Event:  

Process Creation:    1. Suspicious Execution of InstallUtil Without Log   2. Suspicious Execution of InstallUtil To Download   3. Potential PowerShell Execution Via DLL   4. Suspicious Debugger Registration Cmdline   5. Dotnet.exe Exec Dll and Execute Unsigned Code LOLBIN   6. Potential DLL

Process Creation Suspicious Ping-Copy Command Combination LSASS Process Reconnaissance Via Findstr.EXE Firewall Rule Update Via Netsh.EXE Scheduled Task Executing Payload from Registry Potentially Suspicious Call To Win32_NTEventlogFile Class Suspicious Process Execution From Fake Recycle.Bin Folder Rebuild Performance Counter Values Via

Windows/Network Connection: Suspicious Epmap ConnectionSuspicious Dropbox API UsageSuspicious Outbound Kerberos ConnectionSuspicious Program Location with Network Connections Windows/System or Application/Service Control Manager: Tap Driver InstallationInvoke-Obfuscation COMPRESS OBFUSCATION – SystemInvoke-Obfuscation RUNDLL LAUNCHER – SystemInvoke-Obfuscation Via Stdin – SystemInvoke-Obfuscation Via Use Clip –

Windows/Network Connection: Communication To Ngrok.Io Communication To Ngrok Tunneling Service Notepad Making Network Connection RDP Over Reverse SSH Tunnel RDP to HTTP or HTTPS Target Ports Silenttrinity Stager Msbuild Activity Suspicious Office Outbound Connections Windows/System or Application/Service Control Manager: 8.

Windows/Network Connection: Windows/System or Application/Service Control Manager: Drive Load: Azure/Azure Active Directory: Windows/Image Load: Windows/Files: Fortigate@Fortinet: Windows/Process Creation: Windows/PowerShell: 365 Defender: Web Cache: Pulse Connect Secure@Pulse Secure: Windows/Registry:

DNS Trace Log Microsoft Windows@Process Creation Microsoft Windows@System Errors Web Cache Web Server Sysmon@Create Remote Thread Sysmon@Files Sysmon@Image Load Sysmon@Registry