Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	MFA was disabled for an Azure identity MFA was disabled for the user.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Credential Access, Defense Evasion, Persistence
Analytics BIOC	Microsoft 365 DLP policy disabled or removed A user disabled or removed a Microsoft 365 data loss prevention (DLP) policy, which may indicate DLP monitoring evasion.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Office 365 Audit	Defense Evasion
BIOC	Microsoft Connection Manager Profile Installer loads a file from the users to temporary folder The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.	Low	Platform Analytics	Process execution	Defense Evasion
BIOC	Microsoft Connection Manager Profile Installer makes connections to the network The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.	Low	Platform Analytics	Network	Defense Evasion
BIOC	Microsoft Connection Manager Profile Installer runs command line or PowerShell The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.	Low	Platform Analytics	Process execution	Defense Evasion
BIOC	Microsoft HTML Application Host spawns from CMD or PowerShell Microsoft HTML Application Host is a program whose source code consists of HTML, Dynamic HTML and a few scripting languages compatible with Internet Explorer such as VBScript or JScript. It does not typically spawn from PowerShell or CMD.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Microsoft HTML Application Host spawns from Explorer.exe Mshta allows execution of .hta files, an attacker can use mshta to execute malicious hta files on the victim's host.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Microsoft Office injects code into a process An attacker may inject payloads into processes via Microsoft Office. While legitimate in certain cases, code injection can also be used in malicious ways.	Low	Platform Analytics	XDR Agent	Initial Access, Defense Evasion
Analytics BIOC	Microsoft Teams application setup policy was modified Microsoft Teams the application setup policy, which is responsible for application management, was modified.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Defense Evasion, Persistence
Analytics BIOC	Microsoft Teams external communication policy was modified Microsoft Teams external communication policy was modified.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Defense Evasion, Exfiltration
Analytics BIOC	Modification of PAM Modification of PAM configuration files.	Informational	Platform Analytics	XDR Agent	Persistence, Defense Evasion, Credential Access
Analytics BIOC	Modification of the AD FS IdentityServer configuration file The AD FS service configuration file was modified.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Defense Evasion
BIOC	Modification of Windows boot configuration using bcdedit.exe BCDEdit is a Microsoft Windows utility that can modify boot parameters. It is usually used as part of an attack to prevent repair of the affected system by disabling booting in recovery mode. It can also be used to stop Windows' Patchguard from objecting to the unsigned and insecure nature of a driver being loaded.	Informational	Platform Analytics	Process execution	Defense Evasion, Impact
BIOC	MSBuild execution Attackers may use MSBuild.exe to proxy execution of code through a trusted Windows utility.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Mshta.exe launched with suspicious arguments Microsoft HTML application host process has been launched with suspicious arguments, which may indicate malicious intent.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Mshta.exe spawns from a browser process Mshta is the Microsoft HTML Application Host. It executes HTML applications on Windows. Detected when a browser process has spawned mshta, which can be a potential attack vector.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	MSI accessed a web page running a server-side script The Microsoft installer command line included a URL to a web page running a server-side script, which is suspicious.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Msiexec execution of an executable from an uncommon remote location Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Multi region enumeration activity An internal identity performed an operation on multiple regions, considerably more than usual. This may indicate an attacker's attempt to identify all available resources in the cloud environment.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Discovery, Defense Evasion
BIOC	Netsh.exe modifies allowed firewall port/program lists Malware will often modify local firewall settings to permit untrusted software to communicate with the Internet for C2. Check for malicious use.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	New addition to Windows Defender exclusion list Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension.	Low	Platform Analytics	XDR Agent	Defense Evasion
BIOC	New certificate added to the trusted root store Untrusted certificates could be used to install untrusted drivers and malicious code.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Notepad process makes a network connection Notepad.exe processes should not normally make network connections (with the occasional exception of printing documents). This can be a possible indicator of exploitation, e.g. Metasploit Meterpreter injection.	Low	Platform Analytics	Network	Defense Evasion
Analytics BIOC	Office process spawned with suspicious command-line arguments An Office process was executed with LOLBIN-like command-line arguments. This behavior is exhibited in the VBA-RunPE tool that executes executables from the memory of Word/Excel/PowerPoint.	Low	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Permissive file privileges were granted Setting readable, writable, and executable permissions for all users may pose a major security risk.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Ping executed with loopback address This seemingly strange "wait" mechanism is often used by malware to stall command execution.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Ping to a known external IP address Pinging a known external IP address is often used by malware to check internet connectivity.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Ping to localhost from an uncommon, unsigned parent process Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Possible binary padding using dd A suspicious dd command ran and added data to a binary. This may indicate binary padding to change the hash of a file.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Possible code downloading from a remote host by Regsvr32 Regsvr32 may be used to fetch arbitrary code from a remote host and execute it without dropping the payload onto the disk. Known to be used for malicious purposes.	Medium	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Possible data obfuscation A command that can be used for file obfuscation was executed with an uncommon command line.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Possible DCSync from a non domain controller Attackers may pose a compromised host as a DC to replicate data to it (DCSync).	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access, Defense Evasion
Analytics BIOC	Possible DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. This DLL name is usually signed by Microsoft, which might indicate an attacker performing DLL Hijacking.	Informational	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	Possible DLL Search Order Hijacking An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module.	Low	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
BIOC	Possible log destruction using the dd command Possible destruction of system log files using the dd command.	Informational	Platform Analytics	File	Defense Evasion
Analytics BIOC	Possible malicious .NET compilation started by a commonly abused process Attackers may use csc.exe to compile payloads on a compromised machine.	Medium	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Potential DCSync by an unusual user Attackers may leverage the domain replication process to extract sensitive information (DCSync).	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Credential Access
Analytics	Potential extraction of NAA Account Credentials in Microsoft Configuration Manager Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.	Low	Identity Analytics	AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access, Defense Evasion
Analytics BIOC	Potential spoofing of internal domain spotted An external sender is possibly impersonating an employee by spoofing the company's internal address.	Informational	Email Security	Microsoft 365 Emails	Initial Access, Defense Evasion
BIOC	PowerShell is used to execute a CPL file Attackers may use PowerShell.exe to execute a CPL file to achieve Control Panel proxy execution.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	PowerShell is used to modify a timestamp Attackers may use PowerShell.exe to modify the timestamp of a file.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Procdump executed from an atypical directory Procdump.exe is a SysInternals tool used to dump process memory; it can be used to dump lsass.exe memory to extract credentials.	Medium	Platform Analytics	XDR Agent	Defense Evasion, Credential Access
BIOC	Process attempts to kill a known security/AV tool This process has attempted to use taskkill.exe to terminate a known AV process or security analysis tool. Likely attempt to evade detection.	Medium	Platform Analytics	Process execution	Defense Evasion
BIOC	Process runs from the recycle bin Process running from the recycle bin.	Low	Platform Analytics	Process execution	Defense Evasion
BIOC	Pubprn.vbs signed script proxy execution Pubprn.vbs is a standard script that is installed with Windows that can be abused to run malicious scripts. This behavior may bypass signature validation restrictions and application whitelisting solutions.	High	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Punycode characters detected in URL(s) Punycode character(s) detected within URL(s) in email content.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion, Execution
Analytics BIOC	Rare security product signed executable executed in the network Attackers may attempt to install a security product with a known vulnerability to bypass security features.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Persistence
Analytics BIOC	Rare signature signed executable executed in the network Attackers may use signed executables by less known vendors to bypass security features.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Registration of Uncommon .NET Services and/or Assemblies Regasm.exe and regsvcs.exe are used to register .NET COM assemblies, which are typically located in specific paths, attackers might leverage that to execute code within a Microsoft signed binary.	Informational	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Regsvr32 may have run code from an untrusted source Regsvr32 may be used to run arbitrary code by passing the '/i' parameter. The code may also be hosted on a remote host.	High	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Removal of an Azure Owner from an Application or Service Principal An Azure Owner was removed from an application or service principal. This may indicate malicious activity or unauthorized access to the application or service.	Informational	Cortex Cloud	Azure Audit Log	Defense Evasion
BIOC	Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.	Informational	Platform Analytics	Registry	Defense Evasion
BIOC	Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Rundll32 loads a known abused DLL Rundll32.exe is called to execute an arbitrary binary, this execution may also bypass whitelisting defenses as a signed Microsoft application.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Rundll32.exe executes a rare unsigned module Rundll32.exe executes a rare unsigned module, which can indicate an attacker's malicious execution.	Low	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Rundll32.exe launches an executable using ordinal numbers argument Rundll32.exe launches an executable using ordinal numbers argument, this behavior may be used by attackers to evade detection.	Medium	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Rundll32.exe running with no command-line arguments Rundll32.exe is meant to run with parameters, so the absence of them is extremely suspicious; this behavior is used in the default configuration of Cobalt Strike.	Medium	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Rundll32.exe spawns conhost.exe This unusual parent-child process relationship may indicate that an attacker has abused rundll32.exe to run a console-based application such as PowerShell.	Medium	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Rundll32.exe was used to run JavaScript Attackers may execute malicious JavaScript code (either remotely or locally) using rundll32.exe.	Medium	Platform Analytics	Process execution	Defense Evasion
BIOC	Rundll32.exe with 'main' as EntryPoint Rundll32.exe ran with 'main' as EntryPoint. Attackers may leverage rundll32.exe to execute malicious functions and DLLs.	Medium	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Scheduled Task hidden by registry modification Attackers may try to hide a Scheduled Task by deleting the Scheduled Task's software descriptor (SD) value in the registry.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
BIOC	Scripting engine creates an Alternate Data Stream (ADS) Malware may hide data inside alternate data streams instead of inside a file.	Informational	Platform Analytics	File	Defense Evasion
Analytics BIOC	Security object deletion in Google Workspace Admin Console A security object was deleted in Google Workspace Admin Console.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Defense Evasion
BIOC	Security services stopped Attackers may stop security critical services to avoid possible detection of their activities.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Security tools detection attempt A script has executed commands that can be used to detect security tools.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Discovery
BIOC	SELinux was set to permissive mode SELinux was set to permissive mode using the "setenforce 0" command.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Setuid and Setgid file bit manipulation The setuid or setgid bits were set on a file.	Low	Platform Analytics	XDR Agent	Privilege Escalation, Defense Evasion
BIOC	Shell binary copied to another location Attackers may try to evade detection by copying the shell binary to an innocent-looking name.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics	Short-lived Azure AD user account An Azure AD user was created and deleted within a short period of time.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Defense Evasion
Analytics	Short-lived user account A user was created and deleted within a short period of time.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	Signed process performed an unpopular DLL injection A signed process performed an unpopular DLL injection into another process.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Signed process performed an unpopular injection A signed process performed an unpopular injection to another process.	Informational	Platform Analytics	XDR Agent	Defense Evasion
BIOC	SmartScreen disabled via Registry These Registry keys control the SmartScreen. Malware may turn it off to evade SmartScreen functionality.	Informational	Platform Analytics	Registry	Defense Evasion
Analytics BIOC	Space after filename A file was created or renamed to have a space at the end of its name.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
BIOC	Space after filename creation An attacker may append a space to the end of a filename to change how it's processed by the operating system.	Informational	Platform Analytics	File	Defense Evasion
Analytics BIOC	Suspicious .NET process loads an MSBuild DLL A suspicious process in the Microsoft .NET directory loaded the Microsoft Build Framework DLL. This may occur if an attacker masquerades a process like MSBuild (PowerLessShell).	Medium	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Suspicious .NET process spawns csc.exe A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell).	Low	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Suspicious activity on logging bucket An identity performed a suspicious activity on bucket used to store logs.	Informational	Cortex Cloud	AWS Audit Log	Defense Evasion
Analytics BIOC	Suspicious AMSI decode attempt A script has executed commands that can be used to decode commands or files.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
BIOC	Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).	Low	Platform Analytics	Module	Defense Evasion
Analytics BIOC	Suspicious authentication with Azure Password Hash Sync user Authentication to an unusual authentication target was performed by the Azure AD Password Hash Sync user.	Medium	Identity Analytics	AzureAD	Initial Access, Defense Evasion
Analytics BIOC	Suspicious brand affiliation detected The sender's name or address suggests association with a recognized brand, but the email address doesn't match established patterns for that brand.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion
Analytics BIOC	Suspicious certutil command line An attacker may use certutil to download malware.	Medium	Platform Analytics	XDR Agent	Command and Control, Defense Evasion
Analytics BIOC	Suspicious data encryption Known applications were used to encrypt data within a machine's local file system.	Low	Platform Analytics	XDR Agent	Impact, Defense Evasion
Analytics BIOC	Suspicious disablement of the Windows Firewall The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Suspicious disablement of the Windows Firewall using PowerShell commands The Windows Firewall has been disabled using PowerShell. Malware may turn it off to exfiltrate data and communicate with C2 servers.	Medium	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	Suspicious DKIM Result The email contains a suspicious DKIM entry, showing either an unexpected verification result (none, fail, or policy) or a mismatched signing domain, which may indicate potential tampering or spoofing activity.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion
BIOC	Suspicious DLL load using Control.exe This execution mechanism is known to be used by malware to load malicious DLLs.	Medium	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Suspicious DMARC result The email has a suspicious DMARC result of either fail or none, which may indicate a potential domain misconfiguration or spoofing.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion
Analytics BIOC	Suspicious DotNet log file created Payloads that use the DotNet framework may generate suspicious Microsoft DotNet log files.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
BIOC	Suspicious executable created in a .NET directory Cmd.exe created an executable file in the Microsoft .NET directory. This behavior is exhibited in the PowerLessShell tool to disguise MSBuild.exe.	High	Platform Analytics	File	Defense Evasion
Analytics BIOC	Suspicious hidden user created A user account was created with a name that mimics a machine account.	Medium	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Defense Evasion
Analytics BIOC	Suspicious process accessed a site masquerading as Google A suspicious process accessed a site masquerading as Google.	Informational	Platform Analytics	XDR Agent	Command and Control, Defense Evasion
Analytics BIOC	Suspicious process execution from tmp folder An unpopular process was executed from the tmp folder.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Suspicious Process Spawned by wininit.exe An unusual process was spawned by wininit.exe, possibly indicating malicious local or remote code execution.	Medium	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Suspicious process spawns MSBuild.exe The Microsoft Build Engine was started by an abnormal process. MSBuild is normally used for development purposes, so this unusual behavior may be malicious.	Medium	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Suspicious SearchProtocolHost.exe parent process SearchProtocolHost.exe has been launched from a process that is different from SearchIndexer.exe This may indicate malicious activity (such as malware later being injected to it, or it being used for phantom DLL hijacking).	Medium	Platform Analytics	XDR Agent	Execution, Defense Evasion
Analytics BIOC	Suspicious SPF Result The email has a suspicious SPF result of fail, soft fail, or policy, which may indicate a potential domain misconfiguration or spoofing.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion
Analytics BIOC	Suspicious SSH Downgrade The endpoint asked for an ssh downgrade, ssh downgrade may enable attackers to perform attacks such as data decryption, man in the middle, session hijack, replay attack and more.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs	Lateral Movement, Defense Evasion

Analytics BIOC

MFA was disabled for an Azure identity MFA was disabled for the user.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Credential Access, Defense Evasion, Persistence

Analytics BIOC

Microsoft 365 DLP policy disabled or removed A user disabled or removed a Microsoft 365 data loss prevention (DLP) policy, which may indicate DLP monitoring evasion.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security

Office 365 Audit

Defense Evasion

BIOC

Microsoft Connection Manager Profile Installer loads a file from the users to temporary folder The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

Low

Platform Analytics

Process execution

Defense Evasion

BIOC

Microsoft Connection Manager Profile Installer makes connections to the network The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

Low

Platform Analytics

Network

Defense Evasion

BIOC

Microsoft Connection Manager Profile Installer runs command line or PowerShell The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

Low

Platform Analytics

Process execution

Defense Evasion

BIOC

Microsoft HTML Application Host spawns from CMD or PowerShell Microsoft HTML Application Host is a program whose source code consists of HTML, Dynamic HTML and a few scripting languages compatible with Internet Explorer such as VBScript or JScript. It does not typically spawn from PowerShell or CMD.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Microsoft HTML Application Host spawns from Explorer.exe Mshta allows execution of .hta files, an attacker can use mshta to execute malicious hta files on the victim's host.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Microsoft Office injects code into a process An attacker may inject payloads into processes via Microsoft Office. While legitimate in certain cases, code injection can also be used in malicious ways.

Low

Platform Analytics

XDR Agent

Initial Access, Defense Evasion

Analytics BIOC

Microsoft Teams application setup policy was modified Microsoft Teams the application setup policy, which is responsible for application management, was modified.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Office 365 Audit

Defense Evasion, Persistence

Analytics BIOC

Microsoft Teams external communication policy was modified Microsoft Teams external communication policy was modified.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Office 365 Audit

Defense Evasion, Exfiltration

Analytics BIOC

Modification of PAM Modification of PAM configuration files.

Informational

Platform Analytics

XDR Agent

Persistence, Defense Evasion, Credential Access

Analytics BIOC

Modification of the AD FS IdentityServer configuration file The AD FS service configuration file was modified.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Defense Evasion

BIOC

Modification of Windows boot configuration using bcdedit.exe BCDEdit is a Microsoft Windows utility that can modify boot parameters. It is usually used as part of an attack to prevent repair of the affected system by disabling booting in recovery mode. It can also be used to stop Windows' Patchguard from objecting to the unsigned and insecure nature of a driver being loaded.

Informational

Platform Analytics

Process execution

Defense Evasion, Impact

BIOC

MSBuild execution Attackers may use MSBuild.exe to proxy execution of code through a trusted Windows utility.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Mshta.exe launched with suspicious arguments Microsoft HTML application host process has been launched with suspicious arguments, which may indicate malicious intent.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Mshta.exe spawns from a browser process Mshta is the Microsoft HTML Application Host. It executes HTML applications on Windows. Detected when a browser process has spawned mshta, which can be a potential attack vector.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

MSI accessed a web page running a server-side script The Microsoft installer command line included a URL to a web page running a server-side script, which is suspicious.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Msiexec execution of an executable from an uncommon remote location Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Multi region enumeration activity An internal identity performed an operation on multiple regions, considerably more than usual. This may indicate an attacker's attempt to identify all available resources in the cloud environment.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Discovery, Defense Evasion

BIOC

Netsh.exe modifies allowed firewall port/program lists Malware will often modify local firewall settings to permit untrusted software to communicate with the Internet for C2. Check for malicious use.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

New addition to Windows Defender exclusion list Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension.

Low

Platform Analytics

XDR Agent

Defense Evasion

BIOC

New certificate added to the trusted root store Untrusted certificates could be used to install untrusted drivers and malicious code.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Notepad process makes a network connection Notepad.exe processes should not normally make network connections (with the occasional exception of printing documents). This can be a possible indicator of exploitation, e.g. Metasploit Meterpreter injection.

Low

Platform Analytics

Network

Defense Evasion

Analytics BIOC

Office process spawned with suspicious command-line arguments An Office process was executed with LOLBIN-like command-line arguments. This behavior is exhibited in the VBA-RunPE tool that executes executables from the memory of Word/Excel/PowerPoint.

Low

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Permissive file privileges were granted Setting readable, writable, and executable permissions for all users may pose a major security risk.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Ping executed with loopback address This seemingly strange "wait" mechanism is often used by malware to stall command execution.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Ping to a known external IP address Pinging a known external IP address is often used by malware to check internet connectivity.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Ping to localhost from an uncommon, unsigned parent process Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Possible binary padding using dd A suspicious dd command ran and added data to a binary. This may indicate binary padding to change the hash of a file.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Possible code downloading from a remote host by Regsvr32 Regsvr32 may be used to fetch arbitrary code from a remote host and execute it without dropping the payload onto the disk. Known to be used for malicious purposes.

Medium

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Possible data obfuscation A command that can be used for file obfuscation was executed with an uncommon command line.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Possible DCSync from a non domain controller Attackers may pose a compromised host as a DC to replicate data to it (DCSync).

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access, Defense Evasion

Analytics BIOC

Possible DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. This DLL name is usually signed by Microsoft, which might indicate an attacker performing DLL Hijacking.

Informational

Platform Analytics

XDR Agent

Persistence, Privilege Escalation, Defense Evasion

Analytics BIOC

Possible DLL Search Order Hijacking An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module.

Low

Platform Analytics

XDR Agent

Persistence, Privilege Escalation, Defense Evasion

BIOC

Possible log destruction using the dd command Possible destruction of system log files using the dd command.

Informational

Platform Analytics

File

Defense Evasion

Analytics BIOC

Possible malicious .NET compilation started by a commonly abused process Attackers may use csc.exe to compile payloads on a compromised machine.

Medium

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Potential DCSync by an unusual user Attackers may leverage the domain replication process to extract sensitive information (DCSync).

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion, Credential Access

Analytics

Potential extraction of NAA Account Credentials in Microsoft Configuration Manager Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.

Low

Identity Analytics

AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access, Defense Evasion

Analytics BIOC

Potential spoofing of internal domain spotted An external sender is possibly impersonating an employee by spoofing the company's internal address.

Informational

Email Security

Microsoft 365 Emails

Initial Access, Defense Evasion

BIOC

PowerShell is used to execute a CPL file Attackers may use PowerShell.exe to execute a CPL file to achieve Control Panel proxy execution.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

PowerShell is used to modify a timestamp Attackers may use PowerShell.exe to modify the timestamp of a file.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Procdump executed from an atypical directory Procdump.exe is a SysInternals tool used to dump process memory; it can be used to dump lsass.exe memory to extract credentials.

Medium

Platform Analytics

XDR Agent

Defense Evasion, Credential Access

BIOC

Process attempts to kill a known security/AV tool This process has attempted to use taskkill.exe to terminate a known AV process or security analysis tool. Likely attempt to evade detection.

Medium

Platform Analytics

Process execution

Defense Evasion

BIOC

Process runs from the recycle bin Process running from the recycle bin.

Low

Platform Analytics

Process execution

Defense Evasion

BIOC

Pubprn.vbs signed script proxy execution Pubprn.vbs is a standard script that is installed with Windows that can be abused to run malicious scripts. This behavior may bypass signature validation restrictions and application whitelisting solutions.

High

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Punycode characters detected in URL(s) Punycode character(s) detected within URL(s) in email content.

Informational

Email Security

Microsoft 365 Emails

Defense Evasion, Execution

Analytics BIOC

Rare security product signed executable executed in the network Attackers may attempt to install a security product with a known vulnerability to bypass security features.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion, Persistence

Analytics BIOC

Rare signature signed executable executed in the network Attackers may use signed executables by less known vendors to bypass security features.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Registration of Uncommon .NET Services and/or Assemblies Regasm.exe and regsvcs.exe are used to register .NET COM assemblies, which are typically located in specific paths, attackers might leverage that to execute code within a Microsoft signed binary.

Informational

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Regsvr32 may have run code from an untrusted source Regsvr32 may be used to run arbitrary code by passing the '/i' parameter. The code may also be hosted on a remote host.

High

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Removal of an Azure Owner from an Application or Service Principal An Azure Owner was removed from an application or service principal. This may indicate malicious activity or unauthorized access to the application or service.

Informational

Cortex Cloud

Azure Audit Log

Defense Evasion

BIOC

Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.

Informational

Platform Analytics

Registry

Defense Evasion

BIOC

Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Rundll32 loads a known abused DLL Rundll32.exe is called to execute an arbitrary binary, this execution may also bypass whitelisting defenses as a signed Microsoft application.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Rundll32.exe executes a rare unsigned module Rundll32.exe executes a rare unsigned module, which can indicate an attacker's malicious execution.

Low

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Rundll32.exe launches an executable using ordinal numbers argument Rundll32.exe launches an executable using ordinal numbers argument, this behavior may be used by attackers to evade detection.

Medium

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Rundll32.exe running with no command-line arguments Rundll32.exe is meant to run with parameters, so the absence of them is extremely suspicious; this behavior is used in the default configuration of Cobalt Strike.

Medium

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Rundll32.exe spawns conhost.exe This unusual parent-child process relationship may indicate that an attacker has abused rundll32.exe to run a console-based application such as PowerShell.

Medium

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Rundll32.exe was used to run JavaScript Attackers may execute malicious JavaScript code (either remotely or locally) using rundll32.exe.

Medium

Platform Analytics

Process execution

Defense Evasion

BIOC

Rundll32.exe with 'main' as EntryPoint Rundll32.exe ran with 'main' as EntryPoint. Attackers may leverage rundll32.exe to execute malicious functions and DLLs.

Medium

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Scheduled Task hidden by registry modification Attackers may try to hide a Scheduled Task by deleting the Scheduled Task's software descriptor (SD) value in the registry.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

BIOC

Scripting engine creates an Alternate Data Stream (ADS) Malware may hide data inside alternate data streams instead of inside a file.

Informational

Platform Analytics

File

Defense Evasion

Analytics BIOC

Security object deletion in Google Workspace Admin Console A security object was deleted in Google Workspace Admin Console.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Defense Evasion

BIOC

Security services stopped Attackers may stop security critical services to avoid possible detection of their activities.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Security tools detection attempt A script has executed commands that can be used to detect security tools.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion, Discovery

BIOC

SELinux was set to permissive mode SELinux was set to permissive mode using the "setenforce 0" command.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Setuid and Setgid file bit manipulation The setuid or setgid bits were set on a file.

Low

Platform Analytics

XDR Agent

Privilege Escalation, Defense Evasion

BIOC

Shell binary copied to another location Attackers may try to evade detection by copying the shell binary to an innocent-looking name.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics

Short-lived Azure AD user account An Azure AD user was created and deleted within a short period of time.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Defense Evasion

Analytics

Short-lived user account A user was created and deleted within a short period of time.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

Signed process performed an unpopular DLL injection A signed process performed an unpopular DLL injection into another process.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Signed process performed an unpopular injection A signed process performed an unpopular injection to another process.

Informational

Platform Analytics

XDR Agent

Defense Evasion

BIOC

SmartScreen disabled via Registry These Registry keys control the SmartScreen. Malware may turn it off to evade SmartScreen functionality.

Informational

Platform Analytics

Registry

Defense Evasion

Analytics BIOC

Space after filename A file was created or renamed to have a space at the end of its name.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

BIOC

Space after filename creation An attacker may append a space to the end of a filename to change how it's processed by the operating system.

Informational

Platform Analytics

File

Defense Evasion

Analytics BIOC

Suspicious .NET process loads an MSBuild DLL A suspicious process in the Microsoft .NET directory loaded the Microsoft Build Framework DLL. This may occur if an attacker masquerades a process like MSBuild (PowerLessShell).

Medium

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Suspicious .NET process spawns csc.exe A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell).

Low

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Suspicious activity on logging bucket An identity performed a suspicious activity on bucket used to store logs.

Informational

Cortex Cloud

AWS Audit Log

Defense Evasion

Analytics BIOC

Suspicious AMSI decode attempt A script has executed commands that can be used to decode commands or files.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

BIOC

Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).

Low

Platform Analytics

Module

Defense Evasion

Analytics BIOC

Suspicious authentication with Azure Password Hash Sync user Authentication to an unusual authentication target was performed by the Azure AD Password Hash Sync user.

Medium

Identity Analytics

AzureAD

Initial Access, Defense Evasion

Analytics BIOC

Suspicious brand affiliation detected The sender's name or address suggests association with a recognized brand, but the email address doesn't match established patterns for that brand.

Informational

Email Security

Microsoft 365 Emails

Defense Evasion

Analytics BIOC

Suspicious certutil command line An attacker may use certutil to download malware.

Medium

Platform Analytics

XDR Agent

Command and Control, Defense Evasion

Analytics BIOC

Suspicious data encryption Known applications were used to encrypt data within a machine's local file system.

Low

Platform Analytics

XDR Agent

Impact, Defense Evasion

Analytics BIOC

Suspicious disablement of the Windows Firewall The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Suspicious disablement of the Windows Firewall using PowerShell commands The Windows Firewall has been disabled using PowerShell. Malware may turn it off to exfiltrate data and communicate with C2 servers.

Medium

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

Suspicious DKIM Result The email contains a suspicious DKIM entry, showing either an unexpected verification result (none, fail, or policy) or a mismatched signing domain, which may indicate potential tampering or spoofing activity.

Informational

Email Security

Microsoft 365 Emails

Defense Evasion

BIOC

Suspicious DLL load using Control.exe This execution mechanism is known to be used by malware to load malicious DLLs.

Medium

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Suspicious DMARC result The email has a suspicious DMARC result of either fail or none, which may indicate a potential domain misconfiguration or spoofing.

Informational

Email Security

Microsoft 365 Emails

Defense Evasion

Analytics BIOC

Suspicious DotNet log file created Payloads that use the DotNet framework may generate suspicious Microsoft DotNet log files.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

BIOC

Suspicious executable created in a .NET directory Cmd.exe created an executable file in the Microsoft .NET directory. This behavior is exhibited in the PowerLessShell tool to disguise MSBuild.exe.

High

Platform Analytics

File

Defense Evasion

Analytics BIOC

Suspicious hidden user created A user account was created with a name that mimics a machine account.

Medium

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Defense Evasion

Analytics BIOC

Suspicious process accessed a site masquerading as Google A suspicious process accessed a site masquerading as Google.

Informational

Platform Analytics

XDR Agent

Command and Control, Defense Evasion

Analytics BIOC

Suspicious process execution from tmp folder An unpopular process was executed from the tmp folder.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Suspicious Process Spawned by wininit.exe An unusual process was spawned by wininit.exe, possibly indicating malicious local or remote code execution.

Medium

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Suspicious process spawns MSBuild.exe The Microsoft Build Engine was started by an abnormal process. MSBuild is normally used for development purposes, so this unusual behavior may be malicious.

Medium

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Suspicious SearchProtocolHost.exe parent process SearchProtocolHost.exe has been launched from a process that is different from SearchIndexer.exe This may indicate malicious activity (such as malware later being injected to it, or it being used for phantom DLL hijacking).

Medium

Platform Analytics

XDR Agent

Execution, Defense Evasion

Analytics BIOC

Suspicious SPF Result The email has a suspicious SPF result of fail, soft fail, or policy, which may indicate a potential domain misconfiguration or spoofing.

Informational

Email Security

Microsoft 365 Emails

Defense Evasion

Analytics BIOC

Suspicious SSH Downgrade The endpoint asked for an ssh downgrade, ssh downgrade may enable attackers to perform attacks such as data decryption, man in the middle, session hijack, replay attack and more.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs

Lateral Movement, Defense Evasion