{
"platform": "windows-sysmon",
"note": "Seed knowledge base. Detection references are representative of publicly available Sigma logic (SigmaHQ) and should be validated against your deployed ruleset. Telemetry assumes a Windows host with Sysmon (and/or the Security event log with command-line + module auditing) emitting process, network, registry, and file events.",
"entries": [
{
"id": "whoami",
"command": "whoami",
"description": "Current user discovery",
"techniques": [{ "id": "T1033", "name": "System Owner/User Discovery" }],
"telemetry": ["Sysmon EID 1 (Process Create): whoami.exe", "Security 4688 with command line"],
"detections": [{ "source": "Sigma", "rule": "Whoami utility execution (proc_creation_win)", "confidence": "medium" }],
"noise": 40
},
{
"id": "whoami-priv",
"command": "whoami",
"args_contains": "/priv",
"description": "Privilege enumeration via whoami /priv",
"techniques": [{ "id": "T1033", "name": "System Owner/User Discovery" }],
"telemetry": ["Sysmon EID 1: whoami.exe /priv"],
"detections": [{ "source": "Sigma", "rule": "Whoami privilege enumeration (proc_creation_win)", "confidence": "high" }],
"noise": 52
},
{
"id": "systeminfo",
"command": "systeminfo",
"description": "System information / patch-level discovery",
"techniques": [{ "id": "T1082", "name": "System Information Discovery" }],
"telemetry": ["Sysmon EID 1: systeminfo.exe"],
"detections": [{ "source": "Sigma", "rule": "systeminfo execution (proc_creation_win)", "confidence": "low" }],
"noise": 35
},
{
"id": "ipconfig",
"command": "ipconfig",
"description": "Network configuration discovery",
"techniques": [{ "id": "T1016", "name": "System Network Configuration Discovery" }],
"telemetry": ["Sysmon EID 1: ipconfig.exe"],
"detections": [{ "source": "Sigma", "rule": "Network configuration discovery (proc_creation_win)", "confidence": "low" }],
"noise": 30
},
{
"id": "netstat",
"command": "netstat",
"description": "Network connection discovery",
"techniques": [{ "id": "T1049", "name": "System Network Connections Discovery" }],
"telemetry": ["Sysmon EID 1: netstat.exe -ano"],
"detections": [{ "source": "Sigma", "rule": "Network connection discovery (proc_creation_win)", "confidence": "low" }],
"noise": 40
},
{
"id": "arp",
"command": "arp",
"description": "ARP cache enumeration — adjacent host discovery",
"techniques": [{ "id": "T1018", "name": "Remote System Discovery" }],
"telemetry": ["Sysmon EID 1: arp.exe -a"],
"detections": [{ "source": "Sigma", "rule": "Remote system discovery (proc_creation_win)", "confidence": "low" }],
"noise": 38
},
{
"id": "tasklist",
"command": "tasklist",
"description": "Running process discovery",
"techniques": [{ "id": "T1057", "name": "Process Discovery" }],
"telemetry": ["Sysmon EID 1: tasklist.exe"],
"detections": [{ "source": "Sigma", "rule": "Process discovery via tasklist (proc_creation_win)", "confidence": "low" }],
"noise": 35
},
{
"id": "net-user",
"command": "net",
"args_contains": "user",
"description": "Local/domain account enumeration via net user",
"techniques": [{ "id": "T1087.001", "name": "Account Discovery: Local Account" }],
"telemetry": ["Sysmon EID 1: net.exe user (often via net1.exe child)"],
"detections": [{ "source": "Sigma", "rule": "Account discovery via net (proc_creation_win)", "confidence": "medium" }],
"noise": 45
},
{
"id": "net-account-create",
"raw_contains": "user /add",
"description": "Local account creation via net user /add — persistence",
"techniques": [{ "id": "T1136.001", "name": "Create Account: Local Account" }],
"telemetry": ["Sysmon EID 1: net.exe user /add", "Security 4720 (user account created)"],
"detections": [{ "source": "Sigma", "rule": "Local account creation via net (proc_creation_win)", "confidence": "high" }],
"noise": 70
},
{
"id": "net-localgroup-admin",
"raw_contains": "localgroup administrators",
"description": "Adding a user to the local Administrators group — privilege escalation",
"techniques": [{ "id": "T1098", "name": "Account Manipulation" }],
"telemetry": ["Sysmon EID 1: net.exe localgroup administrators ... /add", "Security 4732 (member added to security-enabled local group)"],
"detections": [{ "source": "Sigma", "rule": "Local admin group modification (proc_creation_win)", "confidence": "high" }],
"noise": 68
},
{
"id": "domain-discovery",
"raw_contains": "/domain",
"description": "Domain account/group enumeration (net group /domain, etc.)",
"techniques": [{ "id": "T1087.002", "name": "Account Discovery: Domain Account" }],
"telemetry": ["Sysmon EID 1 with /domain argument", "LDAP queries to a domain controller"],
"detections": [{ "source": "Sigma", "rule": "Domain account discovery (proc_creation_win)", "confidence": "medium" }],
"noise": 48
},
{
"id": "nltest-trusts",
"raw_contains": "/domain_trusts",
"description": "Domain trust enumeration via nltest",
"techniques": [{ "id": "T1482", "name": "Domain Trust Discovery" }],
"telemetry": ["Sysmon EID 1: nltest.exe /domain_trusts"],
"detections": [{ "source": "Sigma", "rule": "Domain trust discovery via nltest (proc_creation_win)", "confidence": "high" }],
"noise": 55
},
{
"id": "net-share",
"raw_contains": "net share",
"description": "Network share discovery",
"techniques": [{ "id": "T1135", "name": "Network Share Discovery" }],
"telemetry": ["Sysmon EID 1: net.exe share"],
"detections": [{ "source": "Sigma", "rule": "Network share discovery (proc_creation_win)", "confidence": "low" }],
"noise": 40
},
{
"id": "reg-query",
"command": "reg",
"args_contains": "query",
"description": "Registry query — configuration / autostart discovery",
"techniques": [{ "id": "T1012", "name": "Query Registry" }],
"telemetry": ["Sysmon EID 1: reg.exe query"],
"detections": [{ "source": "Sigma", "rule": "Registry query via reg.exe (proc_creation_win)", "confidence": "low" }],
"noise": 40
},
{
"id": "run-key-persist",
"raw_contains": "currentversion\\run",
"description": "Writing a Run key — registry autostart persistence",
"techniques": [{ "id": "T1547.001", "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder" }],
"telemetry": ["Sysmon EID 13 (Registry Set) under ...\\CurrentVersion\\Run"],
"detections": [{ "source": "Sigma", "rule": "Run key modification (registry_set_win)", "confidence": "high" }],
"noise": 65
},
{
"id": "schtasks-create",
"command": "schtasks",
"args_contains": "/create",
"description": "Scheduled task creation — execution / persistence",
"techniques": [{ "id": "T1053.005", "name": "Scheduled Task/Job: Scheduled Task" }],
"telemetry": ["Sysmon EID 1: schtasks.exe /create", "Security 4698 (scheduled task created)"],
"detections": [{ "source": "Sigma", "rule": "Scheduled task creation (proc_creation_win)", "confidence": "high" }],
"noise": 62
},
{
"id": "service-create",
"command": "sc",
"args_contains": "create",
"description": "Windows service creation — persistence / privilege",
"techniques": [{ "id": "T1543.003", "name": "Create or Modify System Process: Windows Service" }],
"telemetry": ["Sysmon EID 1: sc.exe create", "Security 7045 (service installed)"],
"detections": [{ "source": "Sigma", "rule": "Service creation via sc.exe (proc_creation_win)", "confidence": "high" }],
"noise": 62
},
{
"id": "powershell-encoded",
"command": "powershell",
"args_contains": "-enc",
"description": "Encoded PowerShell command — obfuscated execution",
"techniques": [
{ "id": "T1059.001", "name": "Command and Scripting Interpreter: PowerShell" },
{ "id": "T1027", "name": "Obfuscated Files or Information" }
],
"telemetry": ["Sysmon EID 1: powershell.exe -EncodedCommand", "PowerShell 4104 (scriptblock logging)"],
"detections": [{ "source": "Sigma", "rule": "Encoded PowerShell command (proc_creation_win)", "confidence": "high" }],
"noise": 75
},
{
"id": "powershell-hidden",
"raw_contains": "hidden",
"description": "Hidden-window PowerShell — defense evasion",
"techniques": [
{ "id": "T1564.003", "name": "Hide Artifacts: Hidden Window" },
{ "id": "T1059.001", "name": "Command and Scripting Interpreter: PowerShell" }
],
"telemetry": ["Sysmon EID 1 with -WindowStyle Hidden / -w hidden"],
"detections": [{ "source": "Sigma", "rule": "Hidden window process execution (proc_creation_win)", "confidence": "medium" }],
"noise": 58
},
{
"id": "download-cradle",
"raw_contains": "downloadstring",
"description": "PowerShell download cradle (Net.WebClient.DownloadString) — in-memory tool ingress",
"techniques": [
{ "id": "T1059.001", "name": "Command and Scripting Interpreter: PowerShell" },
{ "id": "T1105", "name": "Ingress Tool Transfer" }
],
"telemetry": ["Sysmon EID 1 + EID 3 (network) from powershell.exe", "PowerShell 4104 containing DownloadString"],
"detections": [{ "source": "Sigma", "rule": "PowerShell download cradle (ps_script / proc_creation_win)", "confidence": "high" }],
"noise": 80
},
{
"id": "download-file",
"raw_contains": "downloadfile",
"description": "PowerShell DownloadFile — tool ingress to disk",
"techniques": [{ "id": "T1105", "name": "Ingress Tool Transfer" }],
"telemetry": ["Sysmon EID 1 + EID 3 from powershell.exe", "Sysmon EID 11 (File Create) of the downloaded payload"],
"detections": [{ "source": "Sigma", "rule": "PowerShell DownloadFile (ps_script)", "confidence": "high" }],
"noise": 72
},
{
"id": "invoke-expression",
"raw_contains": "invoke-expression",
"description": "Invoke-Expression (IEX) — dynamic code execution",
"techniques": [{ "id": "T1059.001", "name": "Command and Scripting Interpreter: PowerShell" }],
"telemetry": ["PowerShell 4104 scriptblock containing Invoke-Expression"],
"detections": [{ "source": "Sigma", "rule": "Invoke-Expression usage (ps_script)", "confidence": "medium" }],
"noise": 65
},
{
"id": "certutil-download",
"command": "certutil",
"args_contains": "urlcache",
"description": "certutil used to download a file — LOLBin tool ingress",
"techniques": [{ "id": "T1105", "name": "Ingress Tool Transfer" }],
"telemetry": ["Sysmon EID 1: certutil.exe -urlcache -f", "Sysmon EID 3 (network) from certutil.exe"],
"detections": [{ "source": "Sigma", "rule": "certutil file download (proc_creation_win)", "confidence": "high" }],
"noise": 72
},
{
"id": "certutil-decode",
"command": "certutil",
"args_contains": "decode",
"description": "certutil used to decode a payload — LOLBin deobfuscation",
"techniques": [
{ "id": "T1140", "name": "Deobfuscate/Decode Files or Information" },
{ "id": "T1027", "name": "Obfuscated Files or Information" }
],
"telemetry": ["Sysmon EID 1: certutil.exe -decode"],
"detections": [{ "source": "Sigma", "rule": "certutil decode (proc_creation_win)", "confidence": "medium" }],
"noise": 60
},
{
"id": "bitsadmin-transfer",
"command": "bitsadmin",
"args_contains": "/transfer",
"description": "BITS job for file transfer — stealthy tool ingress",
"techniques": [{ "id": "T1197", "name": "BITS Jobs" }],
"telemetry": ["Sysmon EID 1: bitsadmin.exe /transfer", "BITS-Client operational log"],
"detections": [{ "source": "Sigma", "rule": "bitsadmin transfer (proc_creation_win)", "confidence": "medium" }],
"noise": 65
},
{
"id": "mshta-http",
"command": "mshta",
"args_contains": "http",
"description": "mshta executing remote content — LOLBin proxy execution",
"techniques": [{ "id": "T1218.005", "name": "System Binary Proxy Execution: Mshta" }],
"telemetry": ["Sysmon EID 1: mshta.exe with a URL", "Sysmon EID 3 (network) from mshta.exe"],
"detections": [{ "source": "Sigma", "rule": "mshta remote execution (proc_creation_win)", "confidence": "high" }],
"noise": 72
},
{
"id": "regsvr32-squiblydoo",
"raw_contains": "scrobj.dll",
"description": "regsvr32 scrobj.dll (Squiblydoo) — LOLBin proxy execution",
"techniques": [{ "id": "T1218.010", "name": "System Binary Proxy Execution: Regsvr32" }],
"telemetry": ["Sysmon EID 1: regsvr32.exe /i:<url> scrobj.dll", "Sysmon EID 7 (Image Loaded) scrobj.dll"],
"detections": [{ "source": "Sigma", "rule": "Squiblydoo regsvr32 execution (proc_creation_win)", "confidence": "high" }],
"noise": 72
},
{
"id": "wmic-process-create",
"command": "wmic",
"args_contains": "process call create",
"description": "Process creation via WMI",
"techniques": [{ "id": "T1047", "name": "Windows Management Instrumentation" }],
"telemetry": ["Sysmon EID 1: wmic.exe process call create", "WMI-Activity operational log"],
"detections": [{ "source": "Sigma", "rule": "WMI process creation (proc_creation_win)", "confidence": "high" }],
"noise": 66
},
{
"id": "sam-hive-dump",
"raw_contains": "hklm\\sam",
"description": "Dumping the SAM registry hive — credential access",
"techniques": [{ "id": "T1003.002", "name": "OS Credential Dumping: Security Account Manager" }],
"telemetry": ["Sysmon EID 1: reg.exe save HKLM\\SAM", "Sysmon EID 11 (File Create) of the exported hive"],
"detections": [{ "source": "Sigma", "rule": "SAM hive export via reg.exe (proc_creation_win)", "confidence": "high" }],
"noise": 82
},
{
"id": "ntds-dump",
"raw_contains": "ntds.dit",
"description": "Access to NTDS.dit — domain credential database dumping",
"techniques": [{ "id": "T1003.003", "name": "OS Credential Dumping: NTDS" }],
"telemetry": ["Sysmon EID 1 referencing ntds.dit", "ntdsutil / vssadmin activity"],
"detections": [{ "source": "Sigma", "rule": "NTDS.dit access (proc_creation_win)", "confidence": "high" }],
"noise": 84
},
{
"id": "lsass-comsvcs",
"raw_contains": "comsvcs.dll",
"description": "LSASS memory dump via comsvcs.dll MiniDump — credential access",
"techniques": [{ "id": "T1003.001", "name": "OS Credential Dumping: LSASS Memory" }],
"telemetry": ["Sysmon EID 10 (Process Access) targeting lsass.exe", "Sysmon EID 1: rundll32 comsvcs.dll, MiniDump"],
"detections": [{ "source": "Sigma", "rule": "LSASS dump via comsvcs MiniDump (proc_creation_win)", "confidence": "high" }],
"noise": 84
},
{
"id": "mimikatz",
"raw_contains": "sekurlsa",
"description": "Mimikatz sekurlsa — credential material extraction",
"techniques": [{ "id": "T1003.001", "name": "OS Credential Dumping: LSASS Memory" }],
"telemetry": ["Sysmon EID 10 (Process Access) to lsass.exe with suspicious access mask"],
"detections": [{ "source": "Sigma", "rule": "Mimikatz sekurlsa indicators (proc_creation_win / ps_script)", "confidence": "high" }],
"noise": 85
},
{
"id": "procdump-lsass",
"command": "procdump",
"args_contains": "lsass",
"description": "procdump against lsass — credential access",
"techniques": [{ "id": "T1003.001", "name": "OS Credential Dumping: LSASS Memory" }],
"telemetry": ["Sysmon EID 10 (Process Access) to lsass.exe", "Sysmon EID 11 (File Create) of the .dmp file"],
"detections": [{ "source": "Sigma", "rule": "procdump lsass dump (proc_creation_win)", "confidence": "high" }],
"noise": 80
},
{
"id": "defender-disable",
"raw_contains": "disablerealtimemonitoring",
"description": "Disabling Defender real-time monitoring — defense impairment",
"techniques": [{ "id": "T1562.001", "name": "Impair Defenses: Disable or Modify Tools" }],
"telemetry": ["PowerShell 4104: Set-MpPreference -DisableRealtimeMonitoring $true"],
"detections": [{ "source": "Sigma", "rule": "Defender real-time protection disabled (ps_script)", "confidence": "high" }],
"noise": 78
},
{
"id": "defender-exclusion",
"raw_contains": "-exclusionpath",
"description": "Adding a Defender exclusion path — defense impairment",
"techniques": [{ "id": "T1562.001", "name": "Impair Defenses: Disable or Modify Tools" }],
"telemetry": ["PowerShell 4104: Add-MpPreference -ExclusionPath"],
"detections": [{ "source": "Sigma", "rule": "Defender exclusion added (ps_script)", "confidence": "high" }],
"noise": 70
},
{
"id": "netsh-firewall",
"raw_contains": "advfirewall set",
"description": "Modifying the Windows firewall via netsh — defense impairment",
"techniques": [{ "id": "T1562.004", "name": "Impair Defenses: Disable or Modify System Firewall" }],
"telemetry": ["Sysmon EID 1: netsh.exe advfirewall set ... state off"],
"detections": [{ "source": "Sigma", "rule": "Firewall modification via netsh (proc_creation_win)", "confidence": "medium" }],
"noise": 64
},
{
"id": "clear-eventlog",
"command": "wevtutil",
"args_contains": "cl",
"description": "Clearing a Windows event log — anti-forensics",
"techniques": [{ "id": "T1070.001", "name": "Indicator Removal: Clear Windows Event Logs" }],
"telemetry": ["Sysmon EID 1: wevtutil.exe cl", "Security 1102 (audit log cleared)"],
"detections": [{ "source": "Sigma", "rule": "Event log cleared via wevtutil (proc_creation_win)", "confidence": "high" }],
"noise": 76
},
{
"id": "clear-eventlog-ps",
"raw_contains": "clear-eventlog",
"description": "Clearing event logs via PowerShell — anti-forensics",
"techniques": [{ "id": "T1070.001", "name": "Indicator Removal: Clear Windows Event Logs" }],
"telemetry": ["PowerShell 4104: Clear-EventLog", "Security 1102 (audit log cleared)"],
"detections": [{ "source": "Sigma", "rule": "Event log cleared via PowerShell (ps_script)", "confidence": "high" }],
"noise": 76
},
{
"id": "vssadmin-delete",
"command": "vssadmin",
"args_contains": "delete shadows",
"description": "Deleting volume shadow copies — inhibit system recovery",
"techniques": [{ "id": "T1490", "name": "Inhibit System Recovery" }],
"telemetry": ["Sysmon EID 1: vssadmin.exe delete shadows"],
"detections": [{ "source": "Sigma", "rule": "Shadow copy deletion (proc_creation_win)", "confidence": "high" }],
"noise": 78
},
{
"id": "bcdedit-recovery",
"command": "bcdedit",
"description": "Modifying boot configuration — inhibit system recovery",
"techniques": [{ "id": "T1490", "name": "Inhibit System Recovery" }],
"telemetry": ["Sysmon EID 1: bcdedit.exe /set ... recoveryenabled no"],
"detections": [{ "source": "Sigma", "rule": "Boot recovery tampering via bcdedit (proc_creation_win)", "confidence": "medium" }],
"noise": 60
},
{
"id": "attrib-hidden",
"command": "attrib",
"args_contains": "+h",
"description": "Setting the hidden attribute — hide artifacts",
"techniques": [{ "id": "T1564.001", "name": "Hide Artifacts: Hidden Files and Directories" }],
"telemetry": ["Sysmon EID 1: attrib.exe +h"],
"detections": [{ "source": "Sigma", "rule": "Hidden file attribute set (proc_creation_win)", "confidence": "low" }],
"noise": 45
},
{
"id": "rundll32",
"command": "rundll32",
"description": "rundll32 execution — common proxy-execution LOLBin",
"techniques": [{ "id": "T1218.011", "name": "System Binary Proxy Execution: Rundll32" }],
"telemetry": ["Sysmon EID 1: rundll32.exe", "Sysmon EID 7 (Image Loaded) of the target DLL"],
"detections": [{ "source": "Sigma", "rule": "Suspicious rundll32 execution (proc_creation_win)", "confidence": "low" }],
"noise": 50
},
{
"id": "setspn-kerberoast",
"command": "setspn",
"args_contains": "-q",
"description": "SPN enumeration via setspn — Kerberoasting reconnaissance",
"techniques": [{ "id": "T1558.003", "name": "Steal or Forge Kerberos Tickets: Kerberoasting" }],
"telemetry": ["Sysmon EID 1: setspn.exe -q", "LDAP query for servicePrincipalName to a DC"],
"detections": [{ "source": "Sigma", "rule": "SPN enumeration via setspn (proc_creation_win)", "confidence": "medium" }],
"noise": 58
},
{
"id": "kerberoast-getuserspns",
"raw_contains": "getuserspns",
"description": "Kerberoasting via GetUserSPNs (Impacket / PowerView)",
"techniques": [{ "id": "T1558.003", "name": "Steal or Forge Kerberos Tickets: Kerberoasting" }],
"telemetry": ["Kerberos TGS-REQ for service accounts with RC4 encryption", "Security 4769 (Kerberos service ticket requested)"],
"detections": [{ "source": "Sigma", "rule": "Kerberoasting via GetUserSPNs (proc_creation_win / ps_script)", "confidence": "high" }],
"noise": 74
},
{
"id": "kerberoast-invoke",
"raw_contains": "invoke-kerberoast",
"description": "Kerberoasting via Invoke-Kerberoast",
"techniques": [{ "id": "T1558.003", "name": "Steal or Forge Kerberos Tickets: Kerberoasting" }],
"telemetry": ["PowerShell 4104: Invoke-Kerberoast", "Security 4769 with RC4 ticket encryption"],
"detections": [{ "source": "Sigma", "rule": "Invoke-Kerberoast usage (ps_script)", "confidence": "high" }],
"noise": 76
},
{
"id": "rubeus",
"raw_contains": "rubeus",
"description": "Rubeus — Kerberos ticket abuse (roasting, ptt, harvesting)",
"techniques": [{ "id": "T1558.003", "name": "Steal or Forge Kerberos Tickets: Kerberoasting" }],
"telemetry": ["Sysmon EID 1 / EID 10; anomalous Kerberos ticket requests (4769/4768)"],
"detections": [{ "source": "Sigma", "rule": "Rubeus indicators (proc_creation_win)", "confidence": "high" }],
"noise": 80
},
{
"id": "asreproast",
"raw_contains": "getnpusers",
"description": "AS-REP roasting via GetNPUsers (Impacket)",
"techniques": [{ "id": "T1558.004", "name": "Steal or Forge Kerberos Tickets: AS-REP Roasting" }],
"telemetry": ["Kerberos AS-REQ for accounts without pre-auth", "Security 4768 (TGT requested)"],
"detections": [{ "source": "Sigma", "rule": "AS-REP roasting via GetNPUsers (proc_creation_win / ps_script)", "confidence": "high" }],
"noise": 74
},
{
"id": "dcsync",
"raw_contains": "dcsync",
"description": "DCSync — replicating directory secrets from a domain controller",
"techniques": [{ "id": "T1003.006", "name": "OS Credential Dumping: DCSync" }],
"telemetry": ["Security 4662 with DS-Replication-Get-Changes access from a non-DC", "replication (DRSUAPI) from an unexpected host"],
"detections": [{ "source": "Sigma", "rule": "DCSync replication request (proc_creation_win / security)", "confidence": "high" }],
"noise": 85
},
{
"id": "golden-ticket",
"raw_contains": "kerberos::golden",
"description": "Golden/forged Kerberos ticket via mimikatz kerberos::golden",
"techniques": [{ "id": "T1558.001", "name": "Steal or Forge Kerberos Tickets: Golden Ticket" }],
"telemetry": ["TGTs with anomalous lifetime; 4768/4769 mismatches"],
"detections": [{ "source": "Sigma", "rule": "Mimikatz golden ticket indicators (proc_creation_win)", "confidence": "high" }],
"noise": 84
},
{
"id": "pass-the-hash",
"raw_contains": "sekurlsa::pth",
"description": "Pass-the-Hash via mimikatz sekurlsa::pth",
"techniques": [{ "id": "T1550.002", "name": "Use Alternate Authentication Material: Pass the Hash" }],
"telemetry": ["Security 4624 type 9 (NewCredentials) logon", "Sysmon EID 10 access to lsass.exe"],
"detections": [{ "source": "Sigma", "rule": "Pass-the-hash via mimikatz (proc_creation_win)", "confidence": "high" }],
"noise": 82
},
{
"id": "lsadump",
"raw_contains": "lsadump",
"description": "mimikatz lsadump — SAM / LSA secrets extraction",
"techniques": [{ "id": "T1003.004", "name": "OS Credential Dumping: LSA Secrets" }],
"telemetry": ["Registry access to SECURITY\\Policy\\Secrets", "Sysmon EID 10 to lsass.exe"],
"detections": [{ "source": "Sigma", "rule": "mimikatz lsadump indicators (proc_creation_win)", "confidence": "high" }],
"noise": 80
},
{
"id": "sharphound",
"raw_contains": "sharphound",
"description": "BloodHound collection via SharpHound — AD relationship mapping",
"techniques": [
{ "id": "T1087.002", "name": "Account Discovery: Domain Account" },
{ "id": "T1069.002", "name": "Permission Groups Discovery: Domain Groups" }
],
"telemetry": ["heavy LDAP/SAMR enumeration to a DC", "Sysmon EID 3 to LDAP (389/636)"],
"detections": [{ "source": "Sigma", "rule": "SharpHound / BloodHound collection (proc_creation_win)", "confidence": "high" }],
"noise": 72
},
{
"id": "powerview",
"raw_contains": "get-net",
"description": "PowerView domain enumeration (Get-Net* / Get-Domain*)",
"techniques": [
{ "id": "T1087.002", "name": "Account Discovery: Domain Account" },
{ "id": "T1069.002", "name": "Permission Groups Discovery: Domain Groups" }
],
"telemetry": ["PowerShell 4104 with PowerView cmdlets", "LDAP queries to a DC"],
"detections": [{ "source": "Sigma", "rule": "PowerView domain enumeration (ps_script)", "confidence": "medium" }],
"noise": 62
},
{
"id": "adfind",
"command": "adfind",
"description": "AdFind — Active Directory enumeration",
"techniques": [
{ "id": "T1087.002", "name": "Account Discovery: Domain Account" },
{ "id": "T1482", "name": "Domain Trust Discovery" }
],
"telemetry": ["Sysmon EID 1: adfind.exe", "broad LDAP queries to a DC"],
"detections": [{ "source": "Sigma", "rule": "AdFind execution (proc_creation_win)", "confidence": "medium" }],
"noise": 64
},
{
"id": "dsquery",
"command": "dsquery",
"description": "dsquery — directory object enumeration",
"techniques": [{ "id": "T1087.002", "name": "Account Discovery: Domain Account" }],
"telemetry": ["Sysmon EID 1: dsquery.exe", "LDAP queries to a DC"],
"detections": [{ "source": "Sigma", "rule": "dsquery enumeration (proc_creation_win)", "confidence": "low" }],
"noise": 52
},
{
"id": "domain-admins-enum",
"raw_contains": "domain admins",
"description": "Enumerating the Domain Admins group — high-value target discovery",
"techniques": [{ "id": "T1069.002", "name": "Permission Groups Discovery: Domain Groups" }],
"telemetry": ["Sysmon EID 1: net group \"Domain Admins\" /domain", "LDAP query for the group's members"],
"detections": [{ "source": "Sigma", "rule": "Domain Admins enumeration (proc_creation_win)", "confidence": "medium" }],
"noise": 55
},
{
"id": "klist",
"command": "klist",
"description": "Kerberos ticket cache listing",
"techniques": [{ "id": "T1550.003", "name": "Use Alternate Authentication Material: Pass the Ticket" }],
"telemetry": ["Sysmon EID 1: klist.exe"],
"detections": [{ "source": "Sigma", "rule": "Kerberos ticket listing via klist (proc_creation_win)", "confidence": "low" }],
"noise": 40
},
{
"id": "psexec",
"command": "psexec",
"description": "PsExec — remote execution over SMB admin shares",
"techniques": [
{ "id": "T1021.002", "name": "Remote Services: SMB/Windows Admin Shares" },
{ "id": "T1569.002", "name": "System Services: Service Execution" }
],
"telemetry": ["Sysmon EID 1: psexec.exe / PSEXESVC service on the target", "Security 7045 (service installed) on target"],
"detections": [{ "source": "Sigma", "rule": "PsExec execution (proc_creation_win)", "confidence": "medium" }],
"noise": 70
},
{
"id": "impacket-exec",
"raw_contains": "wmiexec",
"description": "Impacket wmiexec/smbexec-style remote execution",
"techniques": [
{ "id": "T1021.002", "name": "Remote Services: SMB/Windows Admin Shares" },
{ "id": "T1047", "name": "Windows Management Instrumentation" }
],
"telemetry": ["service/WMI-spawned cmd.exe with output redirected to a share (\\\\127.0.0.1\\ADMIN$)"],
"detections": [{ "source": "Sigma", "rule": "Impacket lateral movement (proc_creation_win)", "confidence": "high" }],
"noise": 74
},
{
"id": "winrm-remoting",
"raw_contains": "invoke-command",
"description": "PowerShell remoting (Invoke-Command / Enter-PSSession) — lateral movement",
"techniques": [{ "id": "T1021.006", "name": "Remote Services: Windows Remote Management" }],
"telemetry": ["wsmprovhost.exe on the target", "Sysmon EID 3 to WinRM (5985/5986)"],
"detections": [{ "source": "Sigma", "rule": "PowerShell remoting execution (proc_creation_win)", "confidence": "medium" }],
"noise": 58
},
{
"id": "gpp-cpassword",
"raw_contains": "cpassword",
"description": "Reading Group Policy Preferences cPassword — credentials in SYSVOL",
"techniques": [{ "id": "T1552.006", "name": "Unsecured Credentials: Group Policy Preferences" }],
"telemetry": ["read of Groups.xml under \\\\<domain>\\SYSVOL", "cPassword field access"],
"detections": [{ "source": "Sigma", "rule": "GPP cPassword access (proc_creation_win / ps_script)", "confidence": "high" }],
"noise": 72
},
{
"id": "runas-netonly",
"raw_contains": "/netonly",
"description": "runas /netonly — using alternate credentials for network auth",
"techniques": [{ "id": "T1078", "name": "Valid Accounts" }],
"telemetry": ["Sysmon EID 1: runas.exe /netonly", "Security 4648 (explicit credential logon)"],
"detections": [{ "source": "Sigma", "rule": "runas /netonly usage (proc_creation_win)", "confidence": "medium" }],
"noise": 55
}
]
}