Potential Entra ID PRT Extraction via BrowserCore

Uncommon Svchost Parent Process

Detects an uncommon svchost parent process

T1036.005

Written by: Florian Roth (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

Potential Configuration And Service Reconnaissance Via Reg.EXE

Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.

T1007T1012

Written by: Timur ZinniatullinAttributed by SigmaHQand 1 more author
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

DllUnregisterServer Function Call Via Msiexec.EXE

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

T1218.007

Written by: frack113Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

HighSigmaHQ

HackTool - GoldenDMSA Execution

Detects execution of GoldenDMSA hacktool used for Directory Service Account manipulation.

T1098T1110.001T1558.003

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

Potentially Suspicious GrantedAccess Flags On LSASS

Detects process access requests to LSASS process with potentially suspicious access flags

T1003.001

Written by: Florian RothAttributed by SigmaHQand 9 more authors
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

Powershell Sensitive File Discovery

Detect adversaries enumerate sensitive files

T1083

Written by: frack113Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

Potential In-Memory Execution Using Reflection.Assembly

Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory

T1620

Written by: frack113Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

Alternate PowerShell Hosts - PowerShell Module

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

T1059.001

Written by: Roberto Rodriguez @Cyb3rWard0gAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

Potentially Suspicious AccessMask Requested From LSASS

Detects process handle on LSASS process with certain access mask

T1003.001

Written by: Roberto RodriguezAttributed by SigmaHQand 5 more authors
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

LSASS Access From Non System Account

Detects potential mimikatz-like tools accessing LSASS from non system account

T1003.001

Written by: Roberto Rodriguez @Cyb3rWard0gAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

A Rule Has Been Deleted From The Windows Firewall Exception List

Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

T1686.003

Written by: frack113Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

LowSigmaHQ

AppLocker Application Would Have Been Blocked

Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. This rule triggers on the AppLocker audit events and requires review of the reported path against the local AppLocker policy. Since this rule triggers solely on event IDs without path-based filtering, tuning and false positive suppression must be handled at the AppLocker policy level by the policy

T1059.001T1059.003T1059.005T1059.006T1059.007+1 more

Written by: heyyanuAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

Detect Remote Access Software Usage URL

The following analytic detects the execution of known remote access software within the environment. It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 20, 2026

HTTP POST Request with Encoded Payload

The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex, base64, URL, XML, Unicode, or Octal encoded strings. It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex, URL, XML, Unicode, or Octal escape sequences or sixteen or more consecutive base64 character groups.

T1071.001T1132.001

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 20, 2026

Detect Remote Access Software Usage Traffic

The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 20, 2026

Detect Remote Access Software Usage DNS

The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 20, 2026

Cisco Secure Firewall - Remote Access Software Usage Traffic

The following analytic detects network traffic associated with known remote access software applications that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Cisco Secure Firewall Threat Defense Connection Event.

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 20, 2026

Cisco Secure Firewall - Connection to File Sharing Domain

The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services. While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or

T1071.001T1090.002T1105T1567.002T1588.002

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 20, 2026

Cisco Secure Firewall - Communication Over Suspicious Ports

The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios.

T1021T1055T1059.001T1105T1219+1 more

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 20, 2026

Detect Remote Access Software Usage Registry

The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 20, 2026

Detect Remote Access Software Usage Process

The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software.

Written by: Steven DickAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 20, 2026

Detect Remote Access Software Usage FileInfo

The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access.

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 20, 2026

Detect Remote Access Software Usage File

The following analytic detects the writing of files from known remote access software to disk within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on file path, file name, and user information. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.

MediumSplunk security content

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 20, 2026

AWS CreateAccessKey

This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user. Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions. Hunting queries are designed to be run manually during threat hunting activities.

T1136.003

Written by: Bhavin PatelAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 20, 2026

MediumElastic detection rules

Entra ID Privileged Role Assigned to Another Account

Identifies when a privileged Microsoft Entra ID directory role is assigned from one account to a different account. The actor can be a user or an application (service principal), and the member can be a user or a service principal. Privileged roles can be used to take over the tenant, reset credentials, add credentials to applications, or control mail and collaboration services, so an unexpected assignment is a strong persistence and privilege escalation signal.

T1078T1078.004T1098T1098.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 20, 2026

Entra ID Application Self-Assigned to Privileged Role

Identifies an Entra ID application (service principal) assigning itself to a privileged directory role. An application typically does not promote itself, and a multi-tenant vendor application is even more uncommon. Any service principal self-assigning a privileged role should be investigated. Adversaries may compromise vendor application credentials and then escalate privileges to Exchange Administrator or Global Administrator, or subsequently add client secrets to other applications.

T1078T1078.004T1098T1098.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 20, 2026

MediumElastic detection rules

Entra ID Service Principal Credentials Created by Unusual User

Identifies when new Service Principal credentials have been added in Microsoft Entra ID. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements.

T1098T1098.001

Written by: ElasticAttributed by Elastic detection rulesand 1 more author
Licence: Elastic License 2.0
Published: Oct 20, 2026

Entra ID Register Device with Phishing Kit or ROADtools User Agent

Detects a successful Microsoft Entra ID Register device audit event for an Azure AD join or Azure AD register whose user agent is a Dsreg client string hardcoded by device-registration tooling. "Dsreg/10.0 (Windows 10.0.19045.2006)" is the frozen user agent used by device code and adversary-in-the-middle (AiTM) phishing-as-a-service kits such as Tycoon2FA and Kali365 when they register a device after capturing a victim session. "Dsreg/10.0 (Windows 10.0.19041.

T1098T1098.005

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 20, 2026

Entra ID Device Registration with Phishing Kit Default OS Build

Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is "10.0.19045.2006" and the device display name follows the default "DESKTOP-" pattern. This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence.

T1098T1098.005

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 20, 2026